Context Navigation

← Previous Period
Next Period →

Timeline

Mar 14, 2019:

10:56 PM Changeset in webkit [242991] by ysuzuki@apple.com

13 edits
1 add in trunk

[JSC] Retain PrivateName of Symbol before passing it to operations potentially incurring GC
https://bugs.webkit.org/show_bug.cgi?id=195791
<rdar://problem/48806130>

Reviewed by Mark Lam.

JSTests:

stress/symbol-is-destructed-before-refing-underlying-symbol-impl.js: Added.

(foo):

Source/JavaScriptCore:

Consider the following example:

void putByVal(JSObject*, PropertyName propertyName, ...);

putByVal(object, symbol->privateName(), ...);

PropertyName does not retain the passed UniquedStringImpl*. It just holds the pointer to UniquedStringImpl*.
It means that since Symbol::privateName() returns const PrivateName& instead of PrivateName, putByVal
and its caller does not retain UniquedStringImpl* held in PropertyName. The problem happens when the putByVal
incurs GC, and when the symbol is missing in the conservative GC scan. The underlying UniquedStringImpl* of
PropertyName can be accidentally destroyed in the middle of the putByVal operation. We should retain PrivateName
before passing it to operations which takes it as PropertyName.

We use the code pattern like this.

auto propertyName = symbol->privateName();
someOperation(..., propertyName);

This pattern is well aligned to existing JSValue::toPropertyKey(exec) and JSString::toIdentifier(exec) code patterns.

auto propertyName = value.toPropertyKey(exec);
RETURN_IF_EXCEPTION(scope, { });
someOperation(..., propertyName);

We change Symbol::privateName() to returning PrivateName instead of const PrivateName& to avoid potential dangerous use cases. This is OK because the code using Symbol::privateName() is not a critical path, and they typically need to retain PrivateName.

We audit similar functions toPropertyKey(exec) and toIdentifier(exec) for needed but missing exception checks. BTW, these functions are safe to the problem fixed in this patch since they return Identifier instead of const Identifier&.

Mark and Robin investigated and offered important data to understand what went wrong. And figured out the reason behind
the mysterious behavior shown in the data, and now, we confirm that this is the right fix for this bug.

dfg/DFGOperations.cpp:
jit/JITOperations.cpp:

(JSC::tryGetByValOptimize):

runtime/JSFunction.cpp:

(JSC::JSFunction::setFunctionName):

runtime/JSModuleLoader.cpp:

(JSC::printableModuleKey):

runtime/JSONObject.cpp:

(JSC::Stringifier::Stringifier):

runtime/Symbol.cpp:

(JSC::Symbol::descriptiveString const):
(JSC::Symbol::description const):

runtime/Symbol.h:
runtime/SymbolConstructor.cpp:

(JSC::symbolConstructorKeyFor):

tools/JSDollarVM.cpp:

(JSC::functionGetGetterSetter):

Source/WebCore:

bindings/js/ScriptController.cpp:

(WebCore::ScriptController::setupModuleScriptHandlers):

10:45 PM Changeset in webkit [242990] by ysuzuki@apple.com

6 edits in trunk/Source/JavaScriptCore

REGRESSION(r242841): Fix conservative DFG OSR entry validation to accept values which will be stored in AnyInt / Double flush formats
https://bugs.webkit.org/show_bug.cgi?id=195752

Reviewed by Saam Barati.

We fixed the bug skipping AbstractValue validations when the flush format is Double or AnyInt. But it
was too conservative. While validating inputs with AbstractValue is mandatory (without it, whole CFA
falls into wrong condition), our validation does not care AnyInt and Double representations in lower
tiers. For example, if a value is stored in Double flush format in DFG, its AbstractValue becomes
SpecFullDouble. However, it does not include Int32 and OSR entry is rejected if Int32 comes for DoubleRep
OSR entry value. This is wrong since we later convert these numbers into DoubleRep representation
before entering DFG code.

This patch performs AbstractValue validation onto the correctly converted value with flush format hint.

And it still does not fix OSR entry failures in navier-stokes. This is because AbstractValue representation
in navier-stokes's lin_solve was too strict. Then, this patch reverts r242627. Instead of removing must handle
value handling in CFA, DFG OSR entry now correctly validates inputs with AbstractValues even if the flush format
is Double or AnyInt. As long as DFG OSR entry validates inputs, merging must handle values as proven constants is OK.

We can see that # of OSR entry failures in navier-stokes.js becomes the same to the previous count. And we can see
AnyInt OSR entry actually works in microbenchmarks/large-int.js. However, AnyInt effect is hard to observe because this
is super rare. Since we inject type prediction based on must handle value, the flush format tends to be SpecAnyIntAsDouble
and it accepts JSValues simply.

bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):

dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::filterValueByType):

dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::validateOSREntryValue const):
(JSC::DFG::AbstractValue::validateTypeAcceptingBoxedInt52 const):
(JSC::DFG::AbstractValue::validate const): Deleted.
(JSC::DFG::AbstractValue::validateType const): Deleted.

dfg/DFGCFAPhase.cpp:

(JSC::DFG::CFAPhase::run):
(JSC::DFG::CFAPhase::injectOSR):
(JSC::DFG::CFAPhase::performBlockCFA):

dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

9:31 PM Changeset in webkit [242989] by sbarati@apple.com

3 edits
2 adds in trunk

We can't remove code after ForceOSRExit until after FixupPhase
https://bugs.webkit.org/show_bug.cgi?id=186916
<rdar://problem/41396612>

Reviewed by Yusuke Suzuki.

JSTests:

stress/movhint-backwards-propagation-must-merge-use-as-value-add.js: Added.

(foo):

stress/movhint-backwards-propagation-must-merge-use-as-value.js: Added.

(foo):

Source/JavaScriptCore:

There was an optimization in the bytecode parser I added in r232742 that converted blocks
with ForceOSRExit in them to remove all IR after the ForceOSRExit. However,
this is incorrect because it breaks backwards propagation. For example, it
could incorrectly lead us to think it's safe to not check for overflow in
an Add because such Add has no non-int uses. Backwards propagation relies on
having a view over bytecode uses, and this optimization broke that. This patch
rolls out that optimization, as initial perf data shows it may no longer be
needed.

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::addToGraph):
(JSC::DFG::ByteCodeParser::parse):

8:31 PM Changeset in webkit [242988] by Brent Fulgham

5 edits
1 copy in trunk/Source/WebCore

Move CoreCrypto SPI declarations to an appropriate PAL/spi header
https://bugs.webkit.org/show_bug.cgi?id=195754
<rdar://problem/48591957>

Reviewed by Jiewen Tan.

Move the forward declarations of various CoreCrypto SPI to an appropriate PAL/spi header.
Update the const correctness of one function call to match new SDK declaration.

No tests because there are no changes in behavior.

Source/WebCore:

crypto/CommonCryptoUtilities.h:
crypto/mac/CryptoAlgorithmHKDFMac.cpp:

(WebCore::CryptoAlgorithmHKDF::platformDeriveBits):

Source/WebCore/PAL:

PAL.xcodeproj/project.pbxproj:
pal/spi/cocoa/CommonCryptoSPI.h: Copied from Source/WebCore/crypto/CommonCryptoUtilities.h.

8:17 PM Changeset in webkit [242987] by pvollan@apple.com

2 edits in trunk/Source/WebKit

[iOS] WebKit crashes when opening pages documents
https://bugs.webkit.org/show_bug.cgi?id=195784
<rdar://problem/48904334>

Reviewed by Brent Fulgham.

The sandbox needs to allow additional syscalls.

Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

7:24 PM Changeset in webkit [242986] by sihui_liu@apple.com

19 edits in trunk

IndexedDB: re-enable some leak tests
https://bugs.webkit.org/show_bug.cgi?id=194806

Reviewed by Geoffrey Garen.

Source/WebCore:

Protected JSIDBCursor object when advance/continue request on IDBCursor is not finished, because after the
advance operation completes on success, we need to return the same JSIDBCursor object as before the advance,
and during the wait for advance operation to complete, we need to return error as the result.

Covered by existing tests.

Modules/indexeddb/IDBCursor.cpp:

(WebCore::IDBCursor::setGetResult):
(WebCore::IDBCursor::clearWrappers):

Modules/indexeddb/IDBCursor.h:
Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::stop):
(WebCore::IDBRequest::setResult):
(WebCore::IDBRequest::setResultToStructuredClone):
(WebCore::IDBRequest::setResultToUndefined):
(WebCore::IDBRequest::willIterateCursor):
(WebCore::IDBRequest::didOpenOrIterateCursor):
(WebCore::IDBRequest::clearWrappers):

Modules/indexeddb/IDBRequest.h:

(WebCore::IDBRequest::cursorWrapper):

bindings/js/JSIDBRequestCustom.cpp:

(WebCore::JSIDBRequest::visitAdditionalChildren):

bindings/js/JSValueInWrappedObject.h:

(WebCore::JSValueInWrappedObject::JSValueInWrappedObject):
(WebCore::JSValueInWrappedObject::operator=):
(WebCore::JSValueInWrappedObject::clear):

LayoutTests:

TestExpectations:
platform/win/TestExpectations:
storage/indexeddb/connection-leak-expected.txt:
storage/indexeddb/connection-leak-private-expected.txt:
storage/indexeddb/cursor-leak-expected.txt:
storage/indexeddb/cursor-leak-private-expected.txt:
storage/indexeddb/cursor-request-cycle-expected.txt:
storage/indexeddb/cursor-request-cycle-private-expected.txt:
storage/indexeddb/request-leak-expected.txt:
storage/indexeddb/request-leak-private-expected.txt:
storage/indexeddb/resources/cursor-request-cycle.js:

7:24 PM Changeset in webkit [242985] by Shawn Roberts

5 edits
1 delete in trunk/Source/WebCore

Unreviewed, rolling out r242981.

Causing internal build failures on watch/tv OS

Reverted changeset:

"Move CoreCrypto SPI declarations to an appropriate PAL/spi
header"
https://bugs.webkit.org/show_bug.cgi?id=195754
https://trac.webkit.org/changeset/242981

7:14 PM Changeset in webkit [242984] by Fujii Hironori

9 edits in trunk/Tools

[Win][MinBrowser][WK2] Implement createNewPage of WKPageUIClient to open a new window
https://bugs.webkit.org/show_bug.cgi?id=195740

Reviewed by Ross Kirsling.

window.open doesn't work for WebKitBrowserWindow because it is not
implemented yet.

Implemented createNewPage callback of WKPageUIClient.
Changed MainWindow to take a BrowserWindow factory function instead of BrowserWindowType to be flexible to create BrowserWindow with extra settings.
Renamed MainWindow::BrowserWindowType to BrowserWindowType because it is not relevant with MainWindow anymore.

MiniBrowser/win/Common.cpp:

(parseCommandLine):

MiniBrowser/win/Common.h:

(CommandLineOptions::CommandLineOptions):

MiniBrowser/win/MainWindow.cpp:

(MainWindow::MainWindow):
(MainWindow::create):
(MainWindow::init):
(MainWindow::WndProc):

MiniBrowser/win/MainWindow.h:
MiniBrowser/win/PrintWebUIDelegate.cpp:

(PrintWebUIDelegate::createWebViewWithRequest):

MiniBrowser/win/WebKitBrowserWindow.cpp:

(WebKitBrowserWindow::create): Moved WKPageConfigurationRef related code from WebKitBrowserWindow::WebKitBrowserWindow.
(WebKitBrowserWindow::WebKitBrowserWindow): Added a WKPageConfigurationRef parameter.
(WebKitBrowserWindow::updateProxySettings):
(WebKitBrowserWindow::createNewPage):

MiniBrowser/win/WebKitBrowserWindow.h:
MiniBrowser/win/WinMain.cpp:

(wWinMain):

6:54 PM Changeset in webkit [242983] by sihui_liu@apple.com

3 edits in trunk/Source/WebCore

Web process is put to suspended when holding locked WebSQL files
https://bugs.webkit.org/show_bug.cgi?id=195768

Reviewed by Geoffrey Garen.

We need to keep processes active during database close, because SQLite database may run a checkpoint operation
and lock database files.

platform/sql/SQLiteDatabase.cpp:

(WebCore::SQLiteDatabase::useWALJournalMode):
(WebCore::SQLiteDatabase::close):

platform/sql/SQLiteDatabase.h:

6:28 PM Changeset in webkit [242982] by sbarati@apple.com

4 edits in trunk/Source/JavaScriptCore

JSScript should have an accessor saying if it's cached or not
https://bugs.webkit.org/show_bug.cgi?id=195783

Reviewed by Michael Saboff.

API/JSScript.h:
API/JSScript.mm:

(-[JSScript isUsingBytecodeCache]):

API/tests/testapi.mm:

(testIsUsingBytecodeCacheAccessor):
(testObjectiveCAPI):

6:27 PM Changeset in webkit [242981] by Brent Fulgham

5 edits
1 copy in trunk/Source/WebCore

Move CoreCrypto SPI declarations to an appropriate PAL/spi header
https://bugs.webkit.org/show_bug.cgi?id=195754
<rdar://problem/48591957>

Reviewed by Jiewen Tan.

Move the forward declarations of various CoreCrypto SPI to an appropriate PAL/spi header.
Update the const correctness of one function call to match new SDK declaration.

No tests because there are no changes in behavior.

Source/WebCore:

crypto/CommonCryptoUtilities.h:
crypto/mac/CryptoAlgorithmHKDFMac.cpp:

(WebCore::CryptoAlgorithmHKDF::platformDeriveBits):

Source/WebCore/PAL:

PAL.xcodeproj/project.pbxproj:
pal/spi/cocoa/CommonCryptoSPI.h: Copied from Source/WebCore/crypto/CommonCryptoUtilities.h.

6:10 PM Changeset in webkit [242980] by sbarati@apple.com

6 edits in trunk/Source/JavaScriptCore

Remove retain cycle from JSScript and also don't keep the cache file descriptor open so many JSScripts can be cached in a loop
https://bugs.webkit.org/show_bug.cgi?id=195782
<rdar://problem/48880625>

Reviewed by Michael Saboff.

This patch fixes two issues with JSScript API:

There was a retain cycle causing us to never destroy a JSScript once it

created a JSSourceCode. The reason for this is that JSScript had a
Strong<JSSourceCode> field. And JSSourceCode transitively had RetainPtr<JSScript>.

This patch fixes this issue by making the "jsSourceCode" accessor return a transient object.

r242585 made it so that JSScript would keep the cache file descriptor open

(and locked) for the duration of the lifetime of the JSScript itself. Our
anticipation here is that it would make implementing iterative cache updates
easier. However, this made using the API super limiting in other ways. For
example, if a program had a loop that cached 3000 different JSScripts, it's
likely that such a program would exhaust the open file count limit. This patch
reverts to the behavior prior to r242585 where we just keep open the file descriptor
while we read or write it.

API/JSAPIGlobalObject.mm:

(JSC::JSAPIGlobalObject::moduleLoaderFetch):

API/JSContext.mm:

(-[JSContext evaluateJSScript:]):

API/JSScript.mm:

(-[JSScript dealloc]):
(-[JSScript readCache]):
(-[JSScript init]):
(-[JSScript sourceCode]):
(-[JSScript jsSourceCode]):
(-[JSScript writeCache:]):
(-[JSScript forceRecreateJSSourceCode]): Deleted.

API/JSScriptInternal.h:
API/tests/testapi.mm:

(testCanCacheManyFilesWithTheSameVM):
(testObjectiveCAPI):
(testCacheFileIsExclusive): Deleted.

6:10 PM Changeset in webkit [242979] by Simon Fraser

20 edits in trunk

Make it possible to test scrolling tree layer manipulation more easily
https://bugs.webkit.org/show_bug.cgi?id=195780

Reviewed by Tim Horton.
Source/WebKit:

Add a boolean attribute 'scrollUpdatesDisabled' on UIScriptController that
cuts off communication of scrolling tree scrolls back to the web process
(in RemoteScrollingCoordinatorProxy::scrollingTreeNodeDidScroll()). This
allows tests to trigger scrolls which run the scrolling tree layer positioning
logic, but never get another commit from the web process that might mask
scrolling tree bugs.

WKWebView's testing protocol get @property _scrollingUpdatesDisabledForTesting,
whose getters and setters are overridden by TestRunnerWKWebView. Plumbing
via PageClient and WebPageProxy makes this flag reachable by RemoteScrollingCoordinatorProxy.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _scrollingUpdatesDisabledForTesting]):
(-[WKWebView _setScrollingUpdatesDisabledForTesting:]):

UIProcess/API/Cocoa/WKWebViewPrivate.h:
UIProcess/Cocoa/PageClientImplCocoa.h:
UIProcess/Cocoa/PageClientImplCocoa.mm:

(WebKit::PageClientImplCocoa::scrollingUpdatesDisabledForTesting):

UIProcess/Cocoa/WebPageProxyCocoa.mm:

(WebKit::WebPageProxy::scrollingUpdatesDisabledForTesting):

UIProcess/PageClient.h:

(WebKit::PageClient::scrollingUpdatesDisabledForTesting):

UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp:

(WebKit::RemoteScrollingCoordinatorProxy::scrollingTreeNodeDidScroll):

UIProcess/WebPageProxy.h:

Tools:

DumpRenderTree/ios/UIScriptControllerIOS.mm:

(WTR::UIScriptController::scrollUpdatesDisabled const):
(WTR::UIScriptController::setScrollUpdatesDisabled):

TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:
TestRunnerShared/UIScriptContext/UIScriptController.cpp:

(WTR::UIScriptController::scrollUpdatesDisabled const):
(WTR::UIScriptController::setScrollUpdatesDisabled):

TestRunnerShared/UIScriptContext/UIScriptController.h:
WebKitTestRunner/cocoa/TestRunnerWKWebView.h:
WebKitTestRunner/cocoa/TestRunnerWKWebView.mm:

(-[TestRunnerWKWebView _scrollingUpdatesDisabledForTesting]):
(-[TestRunnerWKWebView _setScrollingUpdatesDisabledForTesting:]):

WebKitTestRunner/ios/TestControllerIOS.mm:

(WTR::TestController::platformResetStateToConsistentValues):

WebKitTestRunner/ios/UIScriptControllerIOS.mm:

(WTR::UIScriptController::scrollUpdatesDisabled const):
(WTR::UIScriptController::setScrollUpdatesDisabled):

LayoutTests:

resources/ui-helper.js: Some 'async' functions that awaited promises should just return

the promise.
(window.UIHelper.immediateScrollTo):
(window.UIHelper.immediateUnstableScrollTo):
(window.UIHelper.async.delayFor): Deleted.
(window.UIHelper.async.immediateScrollTo): Deleted.
(window.UIHelper.async.immediateUnstableScrollTo): Deleted.

5:15 PM Changeset in webkit [242978] by commit-queue@webkit.org

27 edits
3 moves in trunk/Source/WebCore

Rename SVGProperty to SVGLegacyProperty and rename SVGAnimatedProperty to SVGLegacyAnimatedProperty
https://bugs.webkit.org/show_bug.cgi?id=195767

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2019-03-14
Reviewed by Tim Horton.

This is a step towards removing the SVG properties tear off objects.

Sources.txt:
WebCore.xcodeproj/project.pbxproj:
svg/SVGAngle.h:

(WebCore::SVGAngle::create):
(WebCore::SVGAngle::SVGAngle):

svg/SVGAnimateElement.h:
svg/SVGAnimatedTypeAnimator.h:

(WebCore::SVGAnimatedTypeAnimator::castAnimatedPropertyToActualType):

svg/SVGElement.h:

(WebCore::SVGElement::lookupAnimatedProperty const):
(WebCore::SVGElement::lookupOrCreateAnimatedProperty):
(WebCore::SVGElement::lookupOrCreateAnimatedProperties):

svg/SVGLength.h:

(WebCore::SVGLength::create):
(WebCore::SVGLength::SVGLength):

svg/SVGMatrix.h:

(WebCore::SVGMatrix::create):
(WebCore::SVGMatrix::SVGMatrix):

svg/SVGNumber.h:

(WebCore::SVGNumber::create):
(WebCore::SVGNumber::SVGNumber):

svg/SVGPathElement.cpp:

(WebCore::SVGPathElement::lookupOrCreateDWrapper):

svg/SVGPathElement.h:
svg/SVGPathSegList.cpp:

(WebCore::SVGPathSegList::processIncomingListItemValue):

svg/SVGPathSegWithContext.h:

(WebCore::SVGPathSegWithContext::animatedProperty const):

svg/SVGPoint.h:

(WebCore::SVGPoint::create):
(WebCore::SVGPoint::SVGPoint):

svg/SVGPreserveAspectRatio.h:

(WebCore::SVGPreserveAspectRatio::create):
(WebCore::SVGPreserveAspectRatio::SVGPreserveAspectRatio):

svg/SVGRect.h:

(WebCore::SVGRect::create):
(WebCore::SVGRect::SVGRect):

svg/SVGTransform.h:

(WebCore::SVGTransform::create):
(WebCore::SVGTransform::SVGTransform):

svg/properties/SVGAnimatedListPropertyTearOff.h:

(WebCore::SVGAnimatedListPropertyTearOff::findItem):
(WebCore::SVGAnimatedListPropertyTearOff::SVGAnimatedListPropertyTearOff):

svg/properties/SVGAnimatedProperty.cpp: Removed.
svg/properties/SVGAnimatedProperty.h: Removed.
svg/properties/SVGAnimatedPropertyTearOff.h:
svg/properties/SVGAnimatedStaticPropertyTearOff.h:

(WebCore::SVGAnimatedStaticPropertyTearOff::SVGAnimatedStaticPropertyTearOff):

svg/properties/SVGAttributeAccessor.h:

(WebCore::SVGAttributeAccessor::lookupOrCreateAnimatedProperty const):
(WebCore::SVGAttributeAccessor::lookupAnimatedProperty const):
(WebCore::SVGAttributeAccessor::lookupOrCreateAnimatedProperties const):
(WebCore::SVGAnimatedAttributeAccessor::lookupOrCreateAnimatedProperty):
(WebCore::SVGAnimatedAttributeAccessor::lookupAnimatedProperty):

svg/properties/SVGAttributeOwnerProxy.h:
svg/properties/SVGAttributeOwnerProxyImpl.h:
svg/properties/SVGAttributeRegistry.h:

(WebCore::SVGAttributeRegistry::lookupOrCreateAnimatedProperty const):
(WebCore::SVGAttributeRegistry::lookupAnimatedProperty const):
(WebCore::SVGAttributeRegistry::lookupOrCreateAnimatedProperties const):
(WebCore::SVGAttributeRegistry::lookupOrCreateAnimatedPropertyBaseTypes):
(WebCore::SVGAttributeRegistry::lookupAnimatedPropertyBaseTypes):
(WebCore::SVGAttributeRegistry::lookupOrCreateAnimatedPropertiesBaseTypes):

svg/properties/SVGLegacyAnimatedProperty.cpp: Copied from Source/WebCore/svg/properties/SVGAnimatedProperty.cpp.

(WebCore::SVGLegacyAnimatedProperty::SVGLegacyAnimatedProperty):
(WebCore::SVGLegacyAnimatedProperty::~SVGLegacyAnimatedProperty):
(WebCore::SVGLegacyAnimatedProperty::commitChange):
(WebCore::SVGAnimatedProperty::SVGAnimatedProperty): Deleted.
(WebCore::SVGAnimatedProperty::~SVGAnimatedProperty): Deleted.
(WebCore::SVGAnimatedProperty::commitChange): Deleted.

svg/properties/SVGLegacyAnimatedProperty.h: Copied from Source/WebCore/svg/properties/SVGAnimatedProperty.h.

(WebCore::SVGLegacyAnimatedProperty::lookupOrCreateAnimatedProperty):
(WebCore::SVGLegacyAnimatedProperty::lookupAnimatedProperty):
(WebCore::SVGAnimatedProperty::isAnimating const): Deleted.
(WebCore::SVGAnimatedProperty::isAnimatedListTearOff const): Deleted.
(WebCore::SVGAnimatedProperty::contextElement const): Deleted.
(WebCore::SVGAnimatedProperty::attributeName const): Deleted.
(WebCore::SVGAnimatedProperty::animatedPropertyType const): Deleted.
(WebCore::SVGAnimatedProperty::isReadOnly const): Deleted.
(WebCore::SVGAnimatedProperty::setIsReadOnly): Deleted.
(WebCore::SVGAnimatedProperty::lookupOrCreateAnimatedProperty): Deleted.
(WebCore::SVGAnimatedProperty::lookupAnimatedProperty): Deleted.
(WebCore::SVGAnimatedProperty::animatedPropertyCache): Deleted.

svg/properties/SVGLegacyProperty.h: Copied from Source/WebCore/svg/properties/SVGProperty.h.
svg/properties/SVGListProperty.h:
svg/properties/SVGProperty.h: Removed.
svg/properties/SVGPropertyTearOff.h:

(WebCore::SVGPropertyTearOff::create):
(WebCore::SVGPropertyTearOff::animatedProperty const):
(WebCore::SVGPropertyTearOff::setAnimatedProperty):
(WebCore::SVGPropertyTearOff::SVGPropertyTearOff):

5:00 PM Changeset in webkit [242977] by Ryan Haddad

5 edits
1 delete in trunk/Source/WebCore

Unreviewed, rolling out r242963.

Breaks watchOS build.

Reverted changeset:

"Move CommonCrypto SPI declarations to an appropriate PAL/spi
header"
https://bugs.webkit.org/show_bug.cgi?id=195754
https://trac.webkit.org/changeset/242963

4:35 PM Changeset in webkit [242976] by Chris Dumez

3 edits in trunk/Source/WebCore

Unreviewed, update xcfilelist files as they are out of sync.

DerivedSources-input.xcfilelist:
DerivedSources-output.xcfilelist:

4:08 PM Changeset in webkit [242975] by youenn@apple.com

6 edits in trunk

Move IDB storage in private browsing mode to NetworkProcess
https://bugs.webkit.org/show_bug.cgi?id=195602

Reviewed by Brady Eidson.

Source/WebKit:

Covered by existing IDB tests and added API test.

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::createIDBServer):
Make sure that path is empty for private sessions.
This will make IDB use a memory backing store.

WebProcess/Databases/WebDatabaseProvider.cpp:

(WebKit::WebDatabaseProvider::idbConnectionToServerForSession):
Use NetworkProcess IDB server instead of InProcessIDBServer.

Tools:

TestWebKitAPI/Tests/WebKitCocoa/IndexedDBPersistence.mm:

(TEST):

4:04 PM Changeset in webkit [242974] by Justin Fan

37 edits
3 copies in trunk

[Web GPU] Updates to GPUCommandBuffer for new GPUCommandEncoder concept
https://bugs.webkit.org/show_bug.cgi?id=195083
<rdar://problem/48423591>

Reviewed by Dean Jackson.

Fixing build error and re-introducing rolled-out changes.
Source/WebCore:

WebGPUCommandBuffer now represents a completed GPUCommandBuffer that can only be used in queue submits. The previous WebGPUCommandBuffer
is now WebGPUCommandEncoder.

Affected Web GPU tests updated to match new API.

New files and symbols:

CMakeLists.txt:
DerivedSources.make:
Sources.txt:
WebCore.xcodeproj/project.pbxproj:
bindings/js/WebCoreBuiltinNames.h:

Implement new WebGPUCommandBuffer, now just a DOM object carrier for a finished GPUCommandBuffer:

Modules/webgpu/WebGPUCommandBuffer.cpp:

(WebCore::WebGPUCommandBuffer::create):
(WebCore::WebGPUCommandBuffer::WebGPUCommandBuffer):
(WebCore::WebGPUBufferCopyView::tryCreateGPUBufferCopyView const): Deleted.
(WebCore::WebGPUTextureCopyView::tryCreateGPUTextureCopyView const): Deleted.
(WebCore::WebGPUCommandBuffer::beginRenderPass): Deleted.
(WebCore::WebGPUCommandBuffer::copyBufferToBuffer): Deleted.
(WebCore::WebGPUCommandBuffer::copyBufferToTexture): Deleted.
(WebCore::WebGPUCommandBuffer::copyTextureToBuffer): Deleted.
(WebCore::WebGPUCommandBuffer::copyTextureToTexture): Deleted.

Modules/webgpu/WebGPUCommandBuffer.h:

(WebCore::WebGPUCommandBuffer::commandBuffer):
(WebCore::WebGPUCommandBuffer::commandBuffer const): Deleted.

Modules/webgpu/WebGPUCommandBuffer.idl:

Rename old WebGPUCommandBuffer to WebGPUCommandEncoder:

Modules/webgpu/WebGPUCommandEncoder.cpp: Copied from Source/WebCore/Modules/webgpu/WebGPUCommandBuffer.cpp.

(WebCore::WebGPUBufferCopyView::tryCreateGPUBufferCopyView const):
(WebCore::WebGPUTextureCopyView::tryCreateGPUTextureCopyView const):
(WebCore::WebGPUCommandEncoder::create):
(WebCore::WebGPUCommandEncoder::WebGPUCommandEncoder):
(WebCore::WebGPUCommandEncoder::beginRenderPass):
(WebCore::WebGPUCommandEncoder::copyBufferToBuffer):
(WebCore::WebGPUCommandEncoder::copyBufferToTexture):
(WebCore::WebGPUCommandEncoder::copyTextureToBuffer):
(WebCore::WebGPUCommandEncoder::copyTextureToTexture):
(WebCore::WebGPUCommandEncoder::finish): Added. "Completes" this and invalidates it. Returns its GPUCommandBuffer, ready for submission.

Modules/webgpu/WebGPUCommandEncoder.h: Copied from Source/WebCore/Modules/webgpu/WebGPUCommandBuffer.h.
Modules/webgpu/WebGPUCommandEncoder.idl: Copied from Source/WebCore/Modules/webgpu/WebGPUCommandBuffer.idl.
Modules/webgpu/WebGPUDevice.cpp:

(WebCore::WebGPUDevice::createCommandEncoder const): Renamed fom createCommandBuffer. Now returns non-nullable.
(WebCore::WebGPUDevice::createCommandBuffer const): Deleted.

Modules/webgpu/WebGPUDevice.h:
Modules/webgpu/WebGPUDevice.idl:
Modules/webgpu/WebGPUProgrammablePassEncoder.cpp:

(WebCore::WebGPUProgrammablePassEncoder::WebGPUProgrammablePassEncoder):
(WebCore::WebGPUProgrammablePassEncoder::endPass): No longer returns the original WebGPUCommandBuffer.
(WebCore::WebGPUProgrammablePassEncoder::setBindGroup const):
(WebCore::WebGPUProgrammablePassEncoder::setPipeline):

Modules/webgpu/WebGPUProgrammablePassEncoder.h:
Modules/webgpu/WebGPUProgrammablePassEncoder.idl:
Modules/webgpu/WebGPUQueue.cpp:

(WebCore::WebGPUQueue::submit): Replace unnecessary rvalue reference parameter.

Modules/webgpu/WebGPUQueue.h:
Modules/webgpu/WebGPUQueue.idl:
Modules/webgpu/WebGPURenderPassEncoder.cpp:

(WebCore::WebGPURenderPassEncoder::create):
(WebCore::WebGPURenderPassEncoder::WebGPURenderPassEncoder):
(WebCore::WebGPURenderPassEncoder::setVertexBuffers):
(WebCore::WebGPURenderPassEncoder::draw):
(WebCore::WebGPURenderPassEncoder::passEncoder const): Now returns a pointer since it is properly backed by a RefPtr.

Modules/webgpu/WebGPURenderPassEncoder.h:
Modules/webgpu/WebGPUSwapChain.cpp:

(WebCore::WebGPUSwapChain::getCurrentTexture): No longer invalidates m_currentTexture. Doh!

platform/graphics/gpu/GPUCommandBuffer.h: Missing includes for the *CopyView structs.
platform/graphics/gpu/GPUDevice.cpp:

(WebCore::GPUDevice::tryCreateCommandBuffer const): Renamed from createCommandBuffer.
(WebCore::GPUDevice::createCommandBuffer): Deleted.

platform/graphics/gpu/GPUDevice.h:
platform/graphics/gpu/cocoa/GPUCommandBufferMetal.mm:

(WebCore::GPUCommandBuffer::tryCreate): Renamed from create.
(WebCore::GPUCommandBuffer::create): Deleted.

LayoutTests:

Update existing Web GPU tests for GPUCommandEncoder and new GPUCommandBuffer.

webgpu/blit-commands.html:
webgpu/buffer-command-buffer-races.html:
webgpu/buffer-resource-triangles.html:
webgpu/command-buffers-expected.txt:
webgpu/command-buffers.html:
webgpu/depth-enabled-triangle-strip.html:
webgpu/js/webgpu-functions.js:

(beginBasicRenderPass):

webgpu/render-command-encoding.html:
webgpu/simple-triangle-strip.html:
webgpu/texture-triangle-strip.html:
webgpu/vertex-buffer-triangle-strip.html:

3:42 PM Changeset in webkit [242973] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Styles: Jump to effective property button doesn't hide after overridden property become effective
https://bugs.webkit.org/show_bug.cgi?id=195770
<rdar://problem/48903634>

Reviewed by Matt Baker.

UserInterface/Views/SpreadsheetCSSStyleDeclarationEditor.css:

(.spreadsheet-style-declaration-editor .property .select-effective-property): Added.
(.spreadsheet-style-declaration-editor .property.overridden .select-effective-property): Deleted.
Hide .select-effective-property element for properties that aren't overridden.

3:26 PM Changeset in webkit [242972] by Justin Fan

26 edits
2 deletes in trunk/Source/WebCore

[Web GPU] Enum cleanup
https://bugs.webkit.org/show_bug.cgi?id=195766

Reviewed by Myles C. Maxfield.

Clean up enum implementations in Web GPU. Enums referenced by only one class now share implementation files with that class to reduce clutter.

No change in behavior.

DerivedSources.make:
Modules/webgpu/GPUBindGroupLayoutBinding.h:
Modules/webgpu/GPUBindGroupLayoutBinding.idl:
Modules/webgpu/GPUInputStateDescriptor.idl:
Modules/webgpu/GPURequestAdapterOptions.idl:
Modules/webgpu/GPUSamplerDescriptor.idl:
Modules/webgpu/GPUTextureDescriptor.idl:
Modules/webgpu/GPUTextureDimension.idl: Removed.
Modules/webgpu/GPUVertexAttributeDescriptor.idl:
Modules/webgpu/GPUVertexInputDescriptor.idl:
Modules/webgpu/WebGPUBindGroupDescriptor.cpp:

(WebCore::validateBufferBindingType):

Modules/webgpu/WebGPURenderPipelineDescriptor.h:
Modules/webgpu/WebGPURenderPipelineDescriptor.idl:
Sources.txt:
WebCore.xcodeproj/project.pbxproj:
platform/graphics/gpu/GPUInputStateDescriptor.h:
platform/graphics/gpu/GPURequestAdapterOptions.h:
platform/graphics/gpu/GPUSamplerDescriptor.h:
platform/graphics/gpu/GPUTextureDescriptor.h:
platform/graphics/gpu/GPUTextureDimension.h: Removed.
platform/graphics/gpu/GPUVertexAttributeDescriptor.h:
platform/graphics/gpu/GPUVertexInputDescriptor.h:
platform/graphics/gpu/cocoa/GPUBindGroupLayoutMetal.mm:

(WebCore::MTLDataTypeForBindingType):

platform/graphics/gpu/cocoa/GPUBindGroupMetal.mm:

(WebCore::GPUBindGroup::tryCreate):

platform/graphics/gpu/cocoa/GPUDeviceMetal.mm:

(WebCore::GPUDevice::create):

platform/graphics/gpu/cocoa/GPUSamplerMetal.mm:

(WebCore::mtlAddressModeForAddressMode):
(WebCore::mtlMinMagFilterForFilterMode):
(WebCore::mtlMipFilterForFilterMode):

3:18 PM Changeset in webkit [242971] by Ryan Haddad

2 edits in trunk/LayoutTests

[ iOS Sim WK2 ] Layout Test quicklook/numbers.html is failing
https://bugs.webkit.org/show_bug.cgi?id=191711

Unreviewed test gardening.

platform/ios/TestExpectations: Mark test as failing.

3:11 PM Changeset in webkit [242970] by commit-queue@webkit.org

22 edits in trunk/Source/WebCore

Use enum class for AnimationMode
https://bugs.webkit.org/show_bug.cgi?id=195762

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2019-03-14
Reviewed by Tim Horton.

Convert AnimationMode into an enum class.

svg/SVGAnimateElementBase.cpp:

(WebCore::SVGAnimateElementBase::calculateFromAndByValues):
(WebCore::SVGAnimateElementBase::isAdditive const):

svg/SVGAnimateMotionElement.cpp:

(WebCore::SVGAnimateMotionElement::calculateFromAndByValues):
(WebCore::SVGAnimateMotionElement::calculateAnimatedValue):
(WebCore::SVGAnimateMotionElement::updateAnimationMode):

svg/SVGAnimatedAngle.cpp:

(WebCore::SVGAnimatedAngleAnimator::calculateAnimatedValue):

svg/SVGAnimatedBoolean.cpp:

(WebCore::SVGAnimatedBooleanAnimator::calculateAnimatedValue):

svg/SVGAnimatedColor.cpp:

(WebCore::SVGAnimatedColorAnimator::calculateAnimatedValue):

svg/SVGAnimatedEnumeration.cpp:

(WebCore::SVGAnimatedEnumerationAnimator::calculateAnimatedValue):

svg/SVGAnimatedInteger.cpp:

(WebCore::SVGAnimatedIntegerAnimator::calculateAnimatedValue):

svg/SVGAnimatedIntegerOptionalInteger.cpp:

(WebCore::SVGAnimatedIntegerOptionalIntegerAnimator::calculateAnimatedValue):

svg/SVGAnimatedLength.cpp:

(WebCore::SVGAnimatedLengthAnimator::calculateAnimatedValue):

svg/SVGAnimatedLengthList.cpp:

(WebCore::SVGAnimatedLengthListAnimator::calculateAnimatedValue):

svg/SVGAnimatedNumber.cpp:

(WebCore::SVGAnimatedNumberAnimator::calculateAnimatedValue):

svg/SVGAnimatedNumberList.cpp:

(WebCore::SVGAnimatedNumberListAnimator::calculateAnimatedValue):

svg/SVGAnimatedNumberOptionalNumber.cpp:

(WebCore::SVGAnimatedNumberOptionalNumberAnimator::calculateAnimatedValue):

svg/SVGAnimatedPath.cpp:

(WebCore::SVGAnimatedPathAnimator::calculateAnimatedValue):

svg/SVGAnimatedPointList.cpp:

(WebCore::SVGAnimatedPointListAnimator::calculateAnimatedValue):

svg/SVGAnimatedPreserveAspectRatio.cpp:

(WebCore::SVGAnimatedPreserveAspectRatioAnimator::calculateAnimatedValue):

svg/SVGAnimatedRect.cpp:

(WebCore::SVGAnimatedRectAnimator::calculateAnimatedValue):

svg/SVGAnimatedTransformList.cpp:

(WebCore::SVGAnimatedTransformListAnimator::calculateAnimatedValue):

svg/SVGAnimationElement.cpp:

(WebCore::SVGAnimationElement::updateAnimationMode):
(WebCore::SVGAnimationElement::isAdditive const):
(WebCore::SVGAnimationElement::isAccumulated const):
(WebCore::SVGAnimationElement::calculateKeyTimesForCalcModePaced):
(WebCore::SVGAnimationElement::startedActiveInterval):
(WebCore::SVGAnimationElement::updateAnimation):

svg/SVGAnimationElement.h:

(WebCore::SVGAnimationElement::adjustFromToListValues):
(WebCore::SVGAnimationElement::animateDiscreteType):
(WebCore::SVGAnimationElement::animateAdditiveNumber):

svg/SVGSetElement.cpp:

(WebCore::SVGSetElement::SVGSetElement):
(WebCore::SVGSetElement::updateAnimationMode):

3:08 PM Changeset in webkit [242969] by aakash_jain@apple.com

3 edits in trunk/Tools

[ews-build] Make descriptionDone messages more readable
https://bugs.webkit.org/show_bug.cgi?id=195760

Reviewed by Lucas Forschler.

BuildSlaveSupport/ews-build/steps.py:
BuildSlaveSupport/ews-build/steps_unittest.py:

3:07 PM Changeset in webkit [242968] by Wenson Hsieh

7 edits
2 adds in trunk

REGRESSION (r242801): [iOS] preventDefault() on touchstart in a subframe does not prevent focusing the subframe
https://bugs.webkit.org/show_bug.cgi?id=195749
<rdar://problem/48892367>

Reviewed by Tim Horton.

Source/WebKit:

r242801 added logic to fetch interaction information at the touch location upon touch start. However this,
combined with an existing behavior where the process of computing InteractionInformationAtPosition in WebPage
moves focus into the frame of the hit-tested node below the touch location, means that we'll always trigger a
blur event on the window and move focus into the subframe when performing a touch inside a subframe, even if the
page prevents default on touchstart.

To fix this, add a "readonly" flag to InteractionInformationRequest, and only change focus when requesting
position information in the case where the request is not readonly. For now, this readonly flag is false by
default; in a future patch, we should identify the (hopefully few) places that rely on position information
requests to move focus, explicitly turn this bit off in those places, and otherwise send readonly position
information requests by default.

Shared/ios/InteractionInformationRequest.cpp:

(WebKit::InteractionInformationRequest::encode const):
(WebKit::InteractionInformationRequest::decode):
(WebKit::InteractionInformationRequest::isValidForRequest):
(WebKit::InteractionInformationRequest::isApproximatelyValidForRequest):

Ensure that a readonly request is not valid for a non-readonly request.

Shared/ios/InteractionInformationRequest.h:
UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _requestActivatedElementAtPosition:completionBlock:]):

Send a readonly position information request in the case where a WebKit SPI client is querying for element
information at the given location.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _webTouchEventsRecognized:]):

Send a readonly position information request on touchstart.

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::positionInformation):

LayoutTests:

Add a test to verify that tapping a subframe doesn't move focus into it subframe if the page prevents default
on touchstart.

fast/events/touch/ios/no-focus-change-when-preventing-default-on-touchstart-expected.txt: Added.
fast/events/touch/ios/no-focus-change-when-preventing-default-on-touchstart.html: Added.

3:06 PM Changeset in webkit [242967] by aakash_jain@apple.com

2 edits in trunk/Tools

[ews-build] Generate status-bubble hover-over messages
https://bugs.webkit.org/show_bug.cgi?id=195680

Reviewed by Lucas Forschler.

BuildSlaveSupport/ews-app/ews/views/statusbubble.py:

(StatusBubble):
(StatusBubble._build_bubble): Generate bubbledetails_message which would be displayed
on hover-over.
(StatusBubble._iso_time):
(StatusBubble._steps_messages): Returns status messages from steps to be displayed in
hover-over message.
(StatusBubble._most_recent_step_message): Returns status message from most recent step.

2:44 PM Changeset in webkit [242966] by aakash_jain@apple.com

3 edits in trunk/Tools

[ews-app] Gracefully handle the case when state_string is None
https://bugs.webkit.org/show_bug.cgi?id=195753

Reviewed by Lucas Forschler.

BuildSlaveSupport/ews-app/ews/models/build.py:
BuildSlaveSupport/ews-app/ews/models/step.py:

2:33 PM Changeset in webkit [242965] by aakash_jain@apple.com

2 edits in trunk/Tools

[ews-app] Status bubble display pending for currently running build step
https://bugs.webkit.org/show_bug.cgi?id=195744

Reviewed by Lucas Forschler.

BuildSlaveSupport/ews-build/events.py:

(Events.stepStarted): If state_string is pending, replace it with step name.

2:09 PM Changeset in webkit [242964] by rniwa@webkit.org

4 edits in trunk/Source/WebCore

Storing a Node in Ref/RefPtr inside its destructor results in double delete
https://bugs.webkit.org/show_bug.cgi?id=195661

Reviewed by Brent Fulgham.

Set Node::m_refCount to 1 before calling its virtual destructor.

This is a security mitigation to prevent any code which ends up storing the node to Ref / RefPtr
inside the destructor, which is a programming error caught by debug assertions, from triggering
a double-delete on the same Node.

Such a code would hit the debug assertions in Node::deref() because m_inRemovedLastRefFunction
had been set to true by then.

dom/Document.cpp:

(WebCore::Document::removedLastRef):

dom/Document.h:

(WebCore::Document::decrementReferencingNodeCount):

dom/Node.cpp:

(WebCore::Node::~Node):
(WebCore::Node::removedLastRef):

1:56 PM Changeset in webkit [242963] by Brent Fulgham

5 edits
1 copy in trunk/Source/WebCore

Move CommonCrypto SPI declarations to an appropriate PAL/spi header
https://bugs.webkit.org/show_bug.cgi?id=195754
<rdar://problem/48591957>

Reviewed by Jiewen Tan.

Move the forward declarations of various CommonCrypto SPI to an appropriate PAL/spi header.
Update the const correctness of one function call to match new SDK declaration.

No tests because there are no changes in behavior.

Source/WebCore:

crypto/CommonCryptoUtilities.h:
crypto/mac/CryptoAlgorithmHKDFMac.cpp:

(WebCore::CryptoAlgorithmHKDF::platformDeriveBits):

Source/WebCore/PAL:

PAL.xcodeproj/project.pbxproj:
pal/spi/cocoa/CommonCryptoSPI.h: Copied from Source/WebCore/crypto/CommonCryptoUtilities.h.

1:48 PM Changeset in webkit [242962] by Devin Rousso

2 edits in trunk/Source/WebInspectorUI

Web Inspector: REGRESSION: Canvas: the first processed action should be selected as soon as it's available if no previous selected action exists
https://bugs.webkit.org/show_bug.cgi?id=195732
<rdar://problem/48875214>

Reviewed by Matt Baker.

UserInterface/Views/CanvasSidebarPanel.js:

(WI.CanvasSidebarPanel.prototype._handleRecordingProcessedAction):
Rather than wait until the entire recording is ready, set the selected action as soon as the
first action is ready (assuming there isn't already a selected action).

1:46 PM Changeset in webkit [242961] by Jon Davis

5 edits
3 adds in trunk/PerformanceTests

Implement a new design for JetStream2
https://bugs.webkit.org/show_bug.cgi?id=195492

Reviewed by Saam Barati.

JetStream2/JetStream.css:

(html):
(body):
(::selection):
(main):
(.logo):
(.logo .logo-image):
(#jetstreams):
(#jetstreams svg):
(.summary):
(.summary + .summary):
(.summary:empty):
(article, .summary):
(h1):
(h2, h3, h4, h5, h6):
(h4, h5, h6):
(p):
(h5, h6):
(h6):
(a:link,):
(a:hover,):
(#status):
(#status label,):
(a.button):
(#status.loading):
(#status.error):
(.error h2, .error p):
(.error h2):
(#result-summary):
(#result-summary label):
(#result-summary .score):
(#result-summary .score .interval):
(#results):
(.benchmark):
(.benchmark h3, .benchmark h4, .benchmark .result, .benchmark label):
(.benchmark-running h4, .benchmark-running .result, .benchmark-running label):
(.benchmark-done h3, .benchmark-done h4, .benchmark-done .result, .benchmark-done label):
(.benchmark h3):
(.benchmark-running h3):
(.benchmark-done h3):
(.benchmark h3 a,):
(.benchmark-done h3 a:hover):
(.benchmark h4):
(.benchmark-done h4):
(.benchmark p,):
(.benchmark .result):
(.benchmark-done .result):
(.benchmark label):
(.benchmark-done label):
(@keyframes fadein):
(to):
(@keyframes scaledown):
(@keyframes shine):
(100%):
(@keyframes swingin):
(@media (max-width: 415px)):
(#logo): Deleted.
(p.summary): Deleted.
(p.summary + p.summary): Deleted.
(p.summary:empty): Deleted.
(p:first-of-type): Deleted.
(#status a:link): Deleted.
(.interval): Deleted.
(a:link, a:visited): Deleted.
(a:link:hover): Deleted.
(table): Deleted.
(td, th): Deleted.
(th): Deleted.
(tr:first-child > th:nth-child(even)): Deleted.
(tr:nth-child(even):not(:first-child, .benchmark-running)): Deleted.
(.result): Deleted.
(.benchmark-running): Deleted.
(:not(.benchmark-running) .result): Deleted.
(.benchmark-running .result): Deleted.
(.benchmark-name): Deleted.
(.result.category,): Deleted.
(.benchmark-name:not(.category):not(.geometric-mean)): Deleted.
(.geometric-mean): Deleted.
(.benchmark-name:not(:first-child)): Deleted.
(.benchmark-name a:link,): Deleted.
(.highlighted-result): Deleted.

JetStream2/JetStream2Logo.svg: Added.
JetStream2/JetStreamDriver.js:

(updateUI):
(Driver.prototype.async.start):
(Driver.prototype.prepareToRun.text.div.id.string_appeared_here.h3):
(Driver.prototype.prepareToRun.text.span):
(Driver.prototype.prepareToRun.a.h3.h4):
(Driver.prototype.prepareToRun.text.div):
(Driver.prototype.async.initialize):
(Driver.prototype.async.fetchResources.prototype.statusElement.onclick):
(prototype.fetchResources):
(prototype.updateUIBeforeRun):
(prototype.updateUIAfterRun):
(Driver.prototype.async.fetchResources.statusElement.innerHTML.a.href.string_appeared_here):
(Driver.prototype.async.fetchResources):
(Driver.prototype.prepareToRun.text.tr.id.string_appeared_here.FIXME.link.to.benchmark.explanation.td): Deleted.

JetStream2/clouds.svg: Added.
JetStream2/in-depth.html:
JetStream2/index.html:
JetStream2/jetstreams.svg: Added.

1:40 PM Changeset in webkit [242960] by Chris Dumez

14 edits in trunk

Add WebsitePolicy for the client to specify the device orientation & motion access policy
https://bugs.webkit.org/show_bug.cgi?id=195750

Reviewed by Geoffrey Garen.

Source/WebCore:

Add WebsitePolicy for the client to specify the device orientation & motion access policy. If
the client already knows access to the device motion & orientation API will be granted / denied,
it can let WebKit know via WebsitePolicies so that WebKit will not ask the client when the
permission is requested by JS.

dom/DeviceOrientationAndMotionAccessController.cpp:

(WebCore::DeviceOrientationAndMotionAccessController::shouldAllowAccess):
(WebCore::DeviceOrientationAndMotionAccessController::setAccessState):
(WebCore::DeviceOrientationAndMotionAccessController::accessState const):

dom/DeviceOrientationAndMotionAccessController.h:
loader/DocumentLoader.h:

(WebCore::DocumentLoader::deviceOrientationAndMotionAccessState const):
(WebCore::DocumentLoader::setDeviceOrientationAndMotionAccessState):

page/DOMWindow.cpp:

(WebCore::DOMWindow::isAllowedToUseDeviceMotionOrientation const):

Source/WebKit:

Shared/WebsitePoliciesData.cpp:

(WebKit::WebsitePoliciesData::encode const):
(WebKit::WebsitePoliciesData::decode):
(WebKit::WebsitePoliciesData::applyToDocumentLoader):

Shared/WebsitePoliciesData.h:
UIProcess/API/APIWebsitePolicies.cpp:

(API::WebsitePolicies::data):

UIProcess/API/APIWebsitePolicies.h:
UIProcess/API/Cocoa/_WKWebsitePolicies.h:
UIProcess/API/Cocoa/_WKWebsitePolicies.mm:

(-[_WKWebsitePolicies setDeviceOrientationAndMotionAccessPolicy:]):
(-[_WKWebsitePolicies deviceOrientationAndMotionAccessPolicy]):

Tools:

Add API test coverage.

TestWebKitAPI/Tests/WebKitCocoa/WebsitePolicies.mm:

(-[WebsitePoliciesDeviceOrientationDelegate initWithDeviceOrientationAccessPolicy:]):
(-[WebsitePoliciesDeviceOrientationDelegate _webView:decidePolicyForNavigationAction:userInfo:decisionHandler:]):
(-[WebsitePoliciesDeviceOrientationUIDelegate _webView:shouldAllowDeviceOrientationAndMotionAccessRequestedByFrame:decisionHandler:]):

1:30 PM Changeset in webkit [242959] by bshafiei@apple.com

7 edits in tags/Safari-608.1.9.100/Source

Versioning.

1:19 PM Changeset in webkit [242958] by bshafiei@apple.com

1 copy in tags/Safari-608.1.9.100

Tag Safari-608.1.9.100.

12:56 PM Changeset in webkit [242957] by Alan Coon

1 copy in tags/Safari-608.1.9

Tag Safari-608.1.9.

12:46 PM Changeset in webkit [242956] by Shawn Roberts

37 edits
3 deletes in trunk

Unreviewed, rolling out r242931.

Causing internal watch/tv OS build failures

Reverted changeset:

"[Web GPU] Updates to GPUCommandBuffer for new GPUCommandQueue
concept"
https://bugs.webkit.org/show_bug.cgi?id=195083
https://trac.webkit.org/changeset/242931

12:31 PM Changeset in webkit [242955] by msaboff@apple.com

5 edits
1 add in trunk

ASSERTION FAILED: regexp->isValid() or ASSERTION FAILED: !isCompilationThread()
https://bugs.webkit.org/show_bug.cgi?id=195735

Reviewed by Mark Lam.

JSTests:

New regression test.

stress/dont-strength-reduce-regexp-with-compile-error.js: Added.

(foo):
(bar):

Source/JavaScriptCore:

There are two bug fixes here.

The first bug happens due to a race condition when we are compiling on a separate thread while the
main thread is compiling the RegExp at a place where it can run out of stack. When that happens,
the RegExp becomes invalid due to the out of stack error. If we check the ASSERT condition in the DFG
compilation thread, we crash. After the main thread throws an exception, it resets the RegExp as
it might compile successfully the next time we try to execute it on a shallower stack.
The main thread will see the regular expression as valid when it executes the JIT'ed code we are compiling
or any slow path we call out to. Therefore ASSERTs like this in compilation code can be eliminated.

The second bug is due to incorrect logic when we go to run the regexp in the Strength Reduction phase.
The current check for "do we have code to run the RegExp?" only checks that the RegExp's state
is != NotCompiled. We also can't run the RegExp if there the state is ParseError.
Changing hasCode() to take this into account fixes the second issue.

(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):

runtime/RegExp.h:
dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewRegexp):

runtime/RegExp.h:

12:27 PM Changeset in webkit [242954] by sbarati@apple.com

6 edits
1 add in trunk

Fixup uses KnownInt32 incorrectly in some nodes
https://bugs.webkit.org/show_bug.cgi?id=195279
<rdar://problem/47915654>

Reviewed by Yusuke Suzuki.

JSTests:

stress/known-int32-cant-be-used-across-bytecode-boundary.js: Added.

(foo):

Source/JavaScriptCore:

Fixup was sometimes using KnownInt32 edges when it knew some
incoming value is an Int32 based on what the bytecode would return.
However, because bytecode may result in Int32 for some node does
not mean we'll pick Int32 as the value format for that local. For example,
we may choose for a value to be represented as a double. This patch
corrects such uses of KnownInt32.

dfg/DFGArgumentsEliminationPhase.cpp:
dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArrayPush):
(JSC::DFG::SpeculativeJIT::compileGetDirectPname):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):

12:22 PM Changeset in webkit [242953] by timothy@apple.com

2 edits in trunk/Source/WebKit

REGRESSION (r242908): TestWebKitAPI.WebKit.AddAndRemoveDataDetectors Crashed
https://bugs.webkit.org/show_bug.cgi?id=195751

Reviewed by Wenson Hsieh.

Shared/Cocoa/ArgumentCodersCocoa.mm:

(IPC::decodeArrayInternal): Added allowedClasses, pass to internal decodeObject for values.
(IPC::decodeDictionaryInternal): Ditto for keys and values.
(IPC::decodeObject): Pass allowedClasses to array and dictionary decoders.

12:11 PM Changeset in webkit [242952] by Chris Dumez

7 edits in trunk

[PSON] Make sure the WebProcessCache is leverage when relaunching a process after termination
https://bugs.webkit.org/show_bug.cgi?id=195747

Reviewed by Geoff Garen.

Source/WebKit:

Make sure the WebProcessCache and the prewarmed process are used when relaunching a process
after termination (e.g. crash).

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::reattachToWebProcess):
(WebKit::WebPageProxy::reattachToWebProcessForReload):
(WebKit::WebPageProxy::reattachToWebProcessWithItem):
(WebKit::WebPageProxy::loadRequest):
(WebKit::WebPageProxy::loadFile):
(WebKit::WebPageProxy::loadData):
(WebKit::WebPageProxy::loadAlternateHTML):
(WebKit::WebPageProxy::loadWebArchiveData):
(WebKit::WebPageProxy::navigateToPDFLinkWithSimulatedClick):

UIProcess/WebPageProxy.h:
UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::processForRegistrableDomain):
(WebKit::WebProcessPool::createWebPage):
(WebKit::WebProcessPool::processForNavigationInternal):
(WebKit::WebProcessPool::tryPrewarmWithDomainInformation):

UIProcess/WebProcessPool.h:

Tools:

Add API test coverage.

TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

11:57 AM Changeset in webkit [242951] by Chris Dumez

11 edits in trunk

Device orientation's permission should only require a user gesture to prompt the user
https://bugs.webkit.org/show_bug.cgi?id=195731

Reviewed by Geoffrey Garen.

Source/WebCore:

Device orientation's permission should only require a user gesture to prompt the user. If the
user already made a decision, we should resolve the promise with this decision, even without
user gesture.

This is useful for JS to figure out if they are access to device orientation or not because
showing UI for the user to give permission.

No new tests, updated existing tests.

dom/DeviceOrientationAndMotionAccessController.cpp:

(WebCore::DeviceOrientationAndMotionAccessController::shouldAllowAccess):

dom/DeviceOrientationAndMotionAccessController.h:
dom/DeviceOrientationOrMotionEvent.cpp:

(WebCore::DeviceOrientationOrMotionEvent::requestPermission):

LayoutTests:

Update layout tests accordingly.

fast/device-orientation/device-motion-request-permission-denied.html:
fast/device-orientation/device-motion-request-permission-granted.html:
fast/device-orientation/device-motion-request-permission-user-gesture-expected.txt:
fast/device-orientation/device-orientation-request-permission-denied.html:
fast/device-orientation/device-orientation-request-permission-granted.html:
fast/device-orientation/device-orientation-request-permission-user-gesture-expected.txt:

11:40 AM Changeset in webkit [242950] by timothy@apple.com

2 edits in trunk/Source/WebKit

Unreviewed speculative build fix for watchOS after r242908.

Shared/Cocoa/WebCoreArgumentCodersCocoa.mm:

11:38 AM Changeset in webkit [242949] by dino@apple.com

6 edits in trunk/LayoutTests

Block all plugins smaller than 5x5px
https://bugs.webkit.org/show_bug.cgi?id=195702
<rdar://problem/28435204>

Updating some tests to account for this change. Make the plugins
big enough to be created.

compositing/plugins/small-to-large-composited-plugin.html:
fast/frames/resources/sandboxed-iframe-about-blank.html:
fast/frames/resources/sandboxed-iframe-plugins-frame-applet.html:
fast/frames/resources/sandboxed-iframe-plugins-frame-embed.html:
fast/frames/resources/sandboxed-iframe-plugins-frame-object.html:

11:27 AM Changeset in webkit [242948] by Joseph Pecoraro

8 edits
8 adds in trunk

Web Inspector: Network - HAR Import
https://bugs.webkit.org/show_bug.cgi?id=195642
<rdar://problem/34820974>

Reviewed by Devin Rousso.

Source/WebInspectorUI:

Localizations/en.lproj/localizedStrings.js
UserInterface/Test.html:
UserInterface/Test.html:

New strings and resources.

UserInterface/Controllers/HARBuilder.js:

(WI.HARBuilder.dateFromHARDate):
(WI.HARBuilder.protocolFromHARProtocol):
(WI.HARBuilder.responseSourceFromHARFetchType):
Reverse parsers from HAR to WI.Resource types.

UserInterface/Models/LocalResource.js: Added.

(WI.LocalResource):
(WI.LocalResource.headersArrayToHeadersObject):
(WI.LocalResource.fromHAREntry):
(WI.LocalResource.prototype.hasContent):
(WI.LocalResource.prototype.setContent):
(WI.LocalResource.prototype.requestContentFromBackend):
A Resource subclass with data fully supplied in the frontend.

UserInterface/Controllers/NetworkManager.js:

(WI.NetworkManager):
(WI.NetworkManager.synthesizeImportError):
(WI.NetworkManager.prototype.localResourceForURL):
(WI.NetworkManager.prototype.processHAR):
Process a HAR and extract local resources.

UserInterface/Views/NetworkTableContentView.js:

(WI.NetworkTableContentView):
(WI.NetworkTableContentView.prototype.reset):
(WI.NetworkTableContentView.prototype._handleResourceAdded):
(WI.NetworkTableContentView.prototype._importHAR):
Add an import button. When an import succeeds reset the
table and only show imported resources (ignoring page
loaded resources).

LayoutTests:

http/tests/inspector/network/har/har-import-expected.txt: Added.
http/tests/inspector/network/har/har-import.html: Added.

HAR import tests.

http/tests/inspector/network/har/resources/bad-version.har: Added.
http/tests/inspector/network/har/resources/basic.har: Added.
http/tests/inspector/network/har/resources/empty.har: Added.
http/tests/inspector/network/har/resources/webkit.org.har: Added.

Sample HARs to test against.

11:25 AM Changeset in webkit [242947] by youenn@apple.com

6 edits in trunk/Source

Reset storage quota when clearing IDB/Cache API entries
https://bugs.webkit.org/show_bug.cgi?id=195716

Reviewed by Chris Dumez.

Source/WebCore:

On clearing of databases, reset all quota users.
This will ensure all layout test runs start with a clean state.

Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::didPerformCloseAndDeleteDatabases):

storage/StorageQuotaManager.h:

(WebCore::StorageQuotaManager::resetQuota):

Source/WebKit:

On clearing DOMCache or IDB data, reset quota value to the default value.
This ensures consistent layout test runs.

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::deleteWebsiteData):
(WebKit::NetworkProcess::deleteWebsiteDataForOrigins):
(WebKit::NetworkProcess::clearStorageQuota):

NetworkProcess/NetworkProcess.h:

11:22 AM Changeset in webkit [242946] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

Certain videos are causing a crash when used as WebGL texture
https://bugs.webkit.org/show_bug.cgi?id=195700
<rdar://problem/48869347>

Reviewed by Eric Carlson.

CFEqual is not null-safe, so perform a null and type check before comparing.

platform/graphics/cv/VideoTextureCopierCV.cpp:

(WebCore::transferFunctionFromString):

10:41 AM Changeset in webkit [242945] by keith_miller@apple.com

4 edits
1 add in trunk

DFG liveness can't skip tail caller inline frames
https://bugs.webkit.org/show_bug.cgi?id=195715
JSTests:

Reviewed by Saam Barati.

stress/dfg-scan-inlined-tail-caller-frames-liveness.js:

(i.foo):

Source/JavaScriptCore:

<rdar://problem/46221598>

Reviewed by Saam Barati.

In order to simplify OSR exit/DFG bytecode parsing our bytecode
generator always emits an op_ret after any tail call. However, the
DFG when computing the liveness of locals, would skip any tail
caller inline frames. This mean that if we ended up inserting a
Check that would OSR to the op_ret we wouldn't have kept
availability data around for it.

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::isLiveInBytecode):

dfg/DFGGraph.h:

(JSC::DFG::Graph::forAllLocalsLiveInBytecode):

9:41 AM Changeset in webkit [242944] by rmorisset@apple.com

3 edits in trunk/Source/JavaScriptCore

DFG::Worklist can be shrunk by 16 bytes
https://bugs.webkit.org/show_bug.cgi?id=195490

Reviewed by Darin Adler.

dfg/DFGWorklist.cpp:

(JSC::DFG::Worklist::Worklist):

dfg/DFGWorklist.h:

9:21 AM Changeset in webkit [242943] by Alan Bujtas

3 edits
2 adds in trunk

Cleanup inline boxes when list marker gets blockified
https://bugs.webkit.org/show_bug.cgi?id=195746
<rdar://problem/48049175>

Reviewed by Antti Koivisto.

Source/WebCore:

Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
change does not require a new renderer.
This patch takes care of destroying the inline boxtree when the marker gains block display type.

Test: fast/block/float/list-marker-is-float-crash.html

rendering/RenderListMarker.cpp:

(WebCore::RenderListMarker::styleDidChange):

LayoutTests:

fast/block/float/list-marker-is-float-crash-expected.txt: Added.
fast/block/float/list-marker-is-float-crash.html: Added.

9:05 AM Changeset in webkit [242942] by Ryan Haddad

5 edits in trunk/LayoutTests

Unreviewed test gardening, rebaseline tests after r241934.

fast/events/touch/ios/block-without-overflow-scroll-and-passive-observer-on-block-scrolling-state-expected.txt:
fast/events/touch/ios/block-without-overflow-scroll-and-passive-observer-on-document-scrolling-state-expected.txt:
fast/events/touch/ios/block-without-overflow-scroll-scrolling-state-expected.txt:
fast/events/touch/ios/tap-with-active-touch-end-listener-expected.txt:

3:13 AM Changeset in webkit [242941] by Devin Rousso

13 edits
7 adds in trunk

Web Inspector: Audit: provide a way to get the contents of resources
https://bugs.webkit.org/show_bug.cgi?id=195266
<rdar://problem/48550911>

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

inspector/InjectedScriptBase.cpp:

(Inspector::InjectedScriptBase::makeAsyncCall):
Drive-by: fix missing else.

Source/WebCore:

Test: inspector/audit/run-resources.html

inspector/InspectorAuditResourcesObject.idl: Added.
inspector/InspectorAuditResourcesObject.h: Added.

(WebCore::InspectorAuditResourcesObject::create):
(WebCore::InspectorAuditResourcesObject::Resource):
(WebCore::InspectorAuditResourcesObject::ResourceContent):
(WebCore::InspectorAuditResourcesObject::InspectorAuditCachedResourceClient):
(WebCore::InspectorAuditResourcesObject::InspectorAuditCachedFontClient):
(WebCore::InspectorAuditResourcesObject::InspectorAuditCachedImageClient):
(WebCore::InspectorAuditResourcesObject::InspectorAuditCachedRawResourceClient):
(WebCore::InspectorAuditResourcesObject::InspectorAuditCachedStyleSheetClient):
(WebCore::InspectorAuditResourcesObject::InspectorAuditCachedSVGDocumentClient):

inspector/InspectorAuditResourcesObject.cpp: Added.

(WebCore::InspectorAuditResourcesObject::InspectorAuditResourcesObject):
(WebCore::InspectorAuditResourcesObject::getResources):
(WebCore::InspectorAuditResourcesObject::getResourceContent):
(WebCore::InspectorAuditResourcesObject::clientForResource):

inspector/agents/InspectorPageAgent.h:
inspector/agents/InspectorPageAgent.cpp:

(WebCore::InspectorPageAgent::cachedResourcesForFrame): Added.
(WebCore::allResourcesURLsForFrame):
Moved a file static function to be a class static function so it can be used elsewhere.

CMakeLists.txt:
DerivedSources-input.xcfilelist:
DerivedSources-output.xcfilelist:
DerivedSources.make:
Sources.txt:
WebCore.xcodeproj/project.pbxproj:

LayoutTests:

inspector/audit/resources/sample-resource.css: Added.
inspector/audit/resources/sample-resource.js: Added.
inspector/audit/run-resources.html: Added.
inspector/audit/run-resources-expected.txt: Added.

2:46 AM Changeset in webkit [242940] by Devin Rousso

14 edits in trunk

Web Inspector: Console: getEventListeners should work for any EventTarget
https://bugs.webkit.org/show_bug.cgi?id=195713

Reviewed by Joseph Pecoraro.

Source/WebCore:

Test: inspector/console/command-line-api-getEventListeners.html

dom/EventTarget.h:
dom/EventTarget.cpp:

(WebCore::EventTarget::eventTypes): Added.

inspector/CommandLineAPIHost.idl:
inspector/CommandLineAPIHost.h:

(WebCore::CommandLineAPIHost::init):

inspector/CommandLineAPIHost.cpp:

(WebCore::CommandLineAPIHost::disconnect):
(WebCore::CommandLineAPIHost::getEventListeners):
(WebCore::listenerEntriesFromListenerInfo): Deleted.

inspector/CommandLineAPIModuleSource.js:

(CommandLineAPIImpl.prototype.getEventListeners):

inspector/InspectorController.cpp:

(WebCore::InspectorController::InspectorController):

inspector/WorkerInspectorController.cpp:

(WebCore::WorkerInspectorController::WorkerInspectorController):

Source/WebInspectorUI:

UserInterface/Models/NativeFunctionParameters.js:

LayoutTests:

inspector/console/command-line-api-getEventListeners.html:
inspector/console/command-line-api-getEventListeners-expected.txt:

2:33 AM Changeset in webkit [242939] by Devin Rousso

10 edits
2 adds in trunk

Web Inspector: Styles: ::-webkit-scrollbar* rules aren't shown
https://bugs.webkit.org/show_bug.cgi?id=195123
<rdar://problem/48450148>

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

inspector/protocol/CSS.json:

Add CSS.PseudoId enum, rather than send a number, so that we have more knowledge about
which pseudo type the rule corresponds to (e.g. a string is more descriptive than a number).

Source/WebCore:

Test: inspector/css/getMatchedStylesForNode.html

inspector/agents/InspectorCSSAgent.cpp:

(WebCore::protocolValueForPseudoId): Added.
(WebCore::InspectorCSSAgent::getMatchedStylesForNode):

Source/WebInspectorUI:

UserInterface/Controllers/CSSManager.js:

(WI.CSSManager.displayNameForPseudoId): Added.

UserInterface/Models/DOMNodeStyles.js:

(WI.DOMNodeStyles.static uniqueOrderedStyles): Added.
(WI.DOMNodeStyles.prototype.get uniqueOrderedStyles):

UserInterface/Views/SpreadsheetRulesStyleDetailsPanel.js:

(WI.SpreadsheetRulesStyleDetailsPanel.prototype.layout):
(WI.SpreadsheetRulesStyleDetailsPanel.prototype._handleSectionFilterApplied):
Rather than iterate over the WI.DOMNode's list of pseudo-elements (which is only ::before
and ::after), we iterate over the WI.DOMNodeStyle's list of pseudo-element rules. This is
an object where the key is a CSS.PseudoId and the value is an object containing all the
matched rules and ordered styles for that pseudo-type. We can preserve the current
functionality by using the ::before/::after WI.DOMNode when we encounter one of those
pseudo-ids.

An additional benefit of this change is that ::before/::after styles will still appear
in the Rules panel even if they don't have a content property set (e.g. when the
::before/::after pseudo-element doesn't exist). This is because the styles are no longer
fetched from those pseudo-element nodes directly, but rather as a matched style for the
parent node. As such, editing a content property to become invalid/disablde in a
::before/::after rule won't make the entire rule disappeaer.

LayoutTests:

inspector/css/getMatchedStylesForNode.html: Added.
inspector/css/getMatchedStylesForNode-expected.txt: Added.

1:02 AM Changeset in webkit [242938] by ysuzuki@apple.com

29 edits
1 add in trunk/Source/bmalloc

[bmalloc] Add StaticPerProcess for known types to save pages
https://bugs.webkit.org/show_bug.cgi?id=195691

Reviewed by Mark Lam.

As initial memory footprint of VM + JSGlobalObject becomes 488KB dirty size in fast malloc memory (w/ JSC_useJIT=0 and Malloc=1), pages for PerProcess is costly.
For example, under Malloc=1 mode, we still need to allocate PerProcess<DebugHeap> and PerProcess<Environment>. And sizeof(Environment) is only 1 (bool flag), and
sizeof(DebugHeap) is 120. But we are allocating 1 pages for them. Since page size in iOS is 16KB, this 121B consumes 16KB dirty memory, and it is not negligible
size if we keep in mind that the current fast malloc heap size is 488KB. Putting them into the DATA section, close to the other mutable data, we can avoid allocating
this page.

This patch revives the SafePerProcess concept in r228107. We add "StaticPerProcess<T>", which allocates underlying storage statically in the DATA section instead of
allocating it at runtime. And we use this StaticPerProcess<T> for types where (1) T is known a priori, and (2) sizeof(T) is not huge.

bmalloc.xcodeproj/project.pbxproj:
bmalloc/AllIsoHeaps.cpp:
bmalloc/AllIsoHeaps.h:
bmalloc/Allocator.cpp:

(bmalloc::Allocator::Allocator):

bmalloc/Cache.cpp:

(bmalloc::Cache::Cache):

bmalloc/CryptoRandom.cpp:

(bmalloc::cryptoRandom):

bmalloc/Deallocator.cpp:

(bmalloc::Deallocator::Deallocator):

bmalloc/DebugHeap.cpp:
bmalloc/DebugHeap.h:

(bmalloc::DebugHeap::tryGet):

bmalloc/Environment.cpp:
bmalloc/Environment.h:
bmalloc/Gigacage.cpp:

(Gigacage::Callback::Callback):
(Gigacage::Callback::function):
(bmalloc::PrimitiveDisableCallbacks::PrimitiveDisableCallbacks):
(Gigacage::disablePrimitiveGigacage):
(Gigacage::addPrimitiveDisableCallback):
(Gigacage::removePrimitiveDisableCallback):
(Gigacage::shouldBeEnabled):
(Gigacage::bmalloc::Callback::Callback): Deleted.
(Gigacage::bmalloc::Callback::function): Deleted.
(Gigacage::bmalloc::PrimitiveDisableCallbacks::PrimitiveDisableCallbacks): Deleted.

bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):
(bmalloc::Heap::tryAllocateLarge):

bmalloc/IsoDirectoryInlines.h:

(bmalloc::passedNumPages>::takeFirstEligible):
(bmalloc::passedNumPages>::didBecome):

bmalloc/IsoHeapImpl.cpp:

(bmalloc::IsoHeapImplBase::addToAllIsoHeaps):

bmalloc/IsoPage.cpp:

(bmalloc::IsoPageBase::allocatePageMemory):

bmalloc/IsoTLS.cpp:

(bmalloc::IsoTLS::IsoTLS):
(bmalloc::IsoTLS::ensureEntries):
(bmalloc::IsoTLS::forEachEntry):

bmalloc/IsoTLSEntry.cpp:

(bmalloc::IsoTLSEntry::IsoTLSEntry):

bmalloc/IsoTLSInlines.h:

(bmalloc::IsoTLS::allocateSlow):
(bmalloc::IsoTLS::deallocateSlow):

bmalloc/IsoTLSLayout.cpp:
bmalloc/IsoTLSLayout.h:
bmalloc/Scavenger.cpp:

(bmalloc::Scavenger::Scavenger):
(bmalloc::dumpStats):
(bmalloc::Scavenger::scavenge):
(bmalloc::Scavenger::partialScavenge):
(bmalloc::Scavenger::freeableMemory):
(bmalloc::Scavenger::footprint):

bmalloc/Scavenger.h:
bmalloc/StaticPerProcess.h: Added.
bmalloc/VMHeap.cpp:
bmalloc/VMHeap.h:
bmalloc/Zone.h:
bmalloc/bmalloc.cpp:

(bmalloc::api::scavenge):
(bmalloc::api::isEnabled):
(bmalloc::api::setScavengerThreadQOSClass):
(bmalloc::api::enableMiniMode):

test/testbmalloc.cpp:

(assertEmptyPointerSet):
(assertHasObjects):
(assertHasOnlyObjects):
(assertClean):

1:00 AM Changeset in webkit [242937] by Devin Rousso

8 edits in trunk/Source/WebInspectorUI

Web Inspector: we should show artificial context menus on mousedown instead of click
https://bugs.webkit.org/show_bug.cgi?id=195494

Reviewed by Joseph Pecoraro.

UserInterface/Views/ContextMenu.js:

(WI.ContextMenu):
(WI.ContextMenu.prototype.show):
(WI.ContextMenu.prototype.addBeforeShowCallback): Added.
(WI.ContextMenu.prototype.handleEvent):
Provide a way to register a callback that will be called right as the "contextmenu" event is
handled, but before the context menu is actually shown. Since "mousedown" events are also
fired when/before a "contextmenu" event is fired, each of the below callers has to maintain
some state indicating "we are about to show a context menu, so ignore all "mousedown" events
until that time". Without this, the below callers wouldn't be able to tell when the context
menu is finally shown.

UserInterface/Base/SearchUtilities.js:

(WI.SearchUtilities.createSettingsButton):

UserInterface/Views/CanvasContentView.js:

(WI.CanvasContentView):
(WI.CanvasContentView.prototype.initialLayout):
(WI.CanvasContentView.prototype._handleCanvasElementButtonMouseDown): Added.
(WI.CanvasContentView.prototype._handleViewShaderButtonMouseDown): Added.
(WI.CanvasContentView.prototype._handleViewRecordingButtonMouseDown): Added.
(WI.CanvasContentView.prototype._canvasElementButtonClicked): Deleted.
(WI.CanvasContentView.prototype._handleViewShaderButtonClicked): Deleted.
(WI.CanvasContentView.prototype._handleViewRecordingButtonClicked): Deleted.

UserInterface/Views/DebuggerSidebarPanel.js:

(WI.DebuggerSidebarPanel):
(WI.DebuggerSidebarPanel.prototype._handleCreateBreakpointMouseDown): Added.
(WI.DebuggerSidebarPanel.prototype._handleCreateBreakpointClicked): Deleted.

UserInterface/Views/SourcesNavigationSidebarPanel.js:

(WI.SourcesNavigationSidebarPanel):
(WI.SourcesNavigationSidebarPanel.prototype._handleCreateBreakpointMouseDown): Added.
(WI.SourcesNavigationSidebarPanel.prototype._handleCreateBreakpointClicked): Deleted.

UserInterface/Views/TabBar.js:

(WI.TabBar.prototype._handleMouseDown):

UserInterface/Views/LegacyTabBar.js:

(WI.LegacyTabBar.prototype._handleMouseDown):

Mar 13, 2019:

10:44 PM Changeset in webkit [242936] by benjamin@webkit.org

3 edits in trunk/Source/WebCore

Fix the argument type of RenderView::resumePausedImageAnimationsIfNeeded()
https://bugs.webkit.org/show_bug.cgi?id=195659

Reviewed by Saam Barati.

The two callers of resumePausedImageAnimationsIfNeeded() both get the IntRect
as a reference. The rect was going on the stack then used as a reference again.

rendering/RenderView.cpp:

(WebCore::RenderView::resumePausedImageAnimationsIfNeeded):

rendering/RenderView.h:

9:49 PM Changeset in webkit [242935] by Alan Bujtas

5 edits in trunk/Source

[ContentChangeObserver] Stop content observation when content calls preventDefault() on touch events
https://bugs.webkit.org/show_bug.cgi?id=195724
<rdar://problem/48873456>

Reviewed by Simon Fraser.

Source/WebCore:

Call willNotProceedWithClick on preventDefault. This is very similar to the long press case.

page/ios/ContentChangeObserver.cpp:

(WebCore::willNotProceedWithClick):
(WebCore::ContentChangeObserver::didRecognizeLongPress):
(WebCore::ContentChangeObserver::didPreventDefaultForEvent):

page/ios/ContentChangeObserver.h:

Source/WebKit:

WebProcess/WebCoreSupport/ios/WebChromeClientIOS.mm:

(WebKit::WebChromeClient::didPreventDefaultForEvent):

8:59 PM Changeset in webkit [242934] by Wenson Hsieh

5 edits in trunk

Make -[_WKAttachment setFileWrapper:contentType:completion:] robust when given a nil completion handler
https://bugs.webkit.org/show_bug.cgi?id=195725
<rdar://problem/48545062>

Reviewed by Tim Horton.

Source/WebKit:

Add a missing nil check before invoking the given completionHandler in the case where the attachment is invalid.
Tested by augmenting WKAttachmentTests.SetFileWrapperForPDFImageAttachment to exercise this scenario.

UIProcess/API/APIAttachment.cpp:

(API::Attachment::invalidate):

Additionally make sure that an invalidated _WKAttachment is also considered to be disconnected.

UIProcess/API/Cocoa/_WKAttachment.mm:

(-[_WKAttachment setFileWrapper:contentType:completion:]):

Tools:

Test that we don't crash when changing the file wrapper of an invalid attachment, if the given completion
handler is nil.

TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:

(TestWebKitAPI::TEST):

8:07 PM Changeset in webkit [242933] by Dewei Zhu

3 edits in trunk/Websites/perf.webkit.org

Test freshness page should improve the ability to correlating issues from same builder.
https://bugs.webkit.org/show_bug.cgi?id=195242

Reviewed by Ryosuke Niwa.

Added the ability to highlight indicators with same builder when mouse is hovering over one indicator.
This is a very useful visualization for correlating issues specific to a builder.
Added tooltip with latest build link when hovering over an indicator.

public/v3/components/freshness-indicator.js:

(FreshnessIndicator): Removed 'summary' field as it's no longer needed.
Added 'highlighted' field.
(FreshnessIndicator.prototype.update): Added 'highlighted' argument.
(FreshnessIndicator.prototype.didConstructShadowTree): Make indicator to dispatch mouse enter and leave
messages so that UI can highlight corresponding cells.
(FreshnessIndicator.prototype.render):
(FreshnessIndicator.cssTemplate):

public/v3/pages/test-freshness-page.js: Added tooltip to show latest build time and build link.

Added logic to manually compute table body height.
(TestFreshnessPage):
(TestFreshnessPage.prototype.didConstructShadowTree):
(TestFreshnessPage.prototype._fetchTestResults):
(TestFreshnessPage.prototype.render):
(TestFreshnessPage.prototype._renderTooltip):
(TestFreshnessPage.prototype._constructTableCell):
(TestFreshnessPage.cssTemplate):

7:46 PM Changeset in webkit [242932] by commit-queue@webkit.org

5 edits
1 add in trunk

Add utility function to allow easy reverse range-based iteration of a container
https://bugs.webkit.org/show_bug.cgi?id=195542

Patch by Sam Weinig <sam@webkit.org> on 2019-03-13
Reviewed by Antti Koivisto.

Source/WTF:

Add functions to create an IteratorRange<T> that will iterate a container backwards. It
works with any container that is compatible with std::rbegin() and std::rend(). It is
expected to be used in conjunction with range-based for-loops like so:

for (auto& value : WTF::makeReversedRange(myContainer))

...

wtf/IteratorRange.h:

(WTF::makeReversedRange):

Tools:

TestWebKitAPI/CMakeLists.txt:
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WTF/IteratorRange.cpp: Added.

(TestWebKitAPI::TEST):
Add test to ensure WTF::makeReversedRange() works correctly and uses the correct types.

6:42 PM Changeset in webkit [242931] by Justin Fan

37 edits
3 copies in trunk

[Web GPU] Updates to GPUCommandBuffer for new GPUCommandQueue concept
https://bugs.webkit.org/show_bug.cgi?id=195083
<rdar://problem/48423591>

Reviewed by Dean Jackson.

Source/WebCore:

WebGPUCommandBuffer now represents a completed GPUCommandBuffer that can only be used in queue submits. The previous WebGPUCommandBuffer
is now WebGPUCommandEncoder.

Affected Web GPU tests updated to match new API.

New files and symbols:

CMakeLists.txt:
DerivedSources.make:
Sources.txt:
WebCore.xcodeproj/project.pbxproj:
bindings/js/WebCoreBuiltinNames.h:

Implement new WebGPUCommandBuffer, now just a DOM object carrier for a finished GPUCommandBuffer:

Modules/webgpu/WebGPUCommandBuffer.cpp:

Modules/webgpu/WebGPUCommandBuffer.h:

(WebCore::WebGPUCommandBuffer::commandBuffer):
(WebCore::WebGPUCommandBuffer::commandBuffer const): Deleted.

Modules/webgpu/WebGPUCommandBuffer.idl:

Rename old WebGPUCommandBuffer to WebGPUCommandEncoder:

Modules/webgpu/WebGPUCommandEncoder.cpp: Copied from Source/WebCore/Modules/webgpu/WebGPUCommandBuffer.cpp.

Modules/webgpu/WebGPUCommandEncoder.h: Copied from Source/WebCore/Modules/webgpu/WebGPUCommandBuffer.h.
Modules/webgpu/WebGPUCommandEncoder.idl: Copied from Source/WebCore/Modules/webgpu/WebGPUCommandBuffer.idl.
Modules/webgpu/WebGPUDevice.cpp:

(WebCore::WebGPUDevice::createCommandEncoder const): Renamed fom createCommandBuffer. Now returns non-nullable.
(WebCore::WebGPUDevice::createCommandBuffer const): Deleted.

Modules/webgpu/WebGPUDevice.h:
Modules/webgpu/WebGPUDevice.idl:
Modules/webgpu/WebGPUProgrammablePassEncoder.cpp:

Modules/webgpu/WebGPUProgrammablePassEncoder.h:
Modules/webgpu/WebGPUProgrammablePassEncoder.idl:
Modules/webgpu/WebGPUQueue.cpp:

(WebCore::WebGPUQueue::submit): Replace unnecessary rvalue reference parameter.

Modules/webgpu/WebGPUQueue.h:
Modules/webgpu/WebGPUQueue.idl:
Modules/webgpu/WebGPURenderPassEncoder.cpp:

Modules/webgpu/WebGPURenderPassEncoder.h:
Modules/webgpu/WebGPUSwapChain.cpp:

(WebCore::WebGPUSwapChain::getCurrentTexture): No longer invalidates m_currentTexture. Doh!

platform/graphics/gpu/GPUCommandBuffer.h: Missing includes for the *CopyView structs.
platform/graphics/gpu/GPUDevice.cpp:

(WebCore::GPUDevice::tryCreateCommandBuffer const): Renamed from createCommandBuffer.
(WebCore::GPUDevice::createCommandBuffer): Deleted.

platform/graphics/gpu/GPUDevice.h:
platform/graphics/gpu/cocoa/GPUCommandBufferMetal.mm:

(WebCore::GPUCommandBuffer::tryCreate): Renamed from create.
(WebCore::GPUCommandBuffer::create): Deleted.

LayoutTests:

Update existing Web GPU tests for GPUCommandEncoder and new GPUCommandBuffer.

webgpu/blit-commands.html:
webgpu/buffer-command-buffer-races.html:
webgpu/buffer-resource-triangles.html:
webgpu/command-buffers-expected.txt:
webgpu/command-buffers.html:
webgpu/depth-enabled-triangle-strip.html:
webgpu/js/webgpu-functions.js:

(beginBasicRenderPass):

webgpu/render-command-encoding.html:
webgpu/simple-triangle-strip.html:
webgpu/texture-triangle-strip.html:
webgpu/vertex-buffer-triangle-strip.html:

6:40 PM Changeset in webkit [242930] by timothy@apple.com

2 edits in trunk/Source/WebKit

REGRESSION (r242908): 'NSInvalidArgumentException', reason: '+[PKPaymentMerchantSession count]: unrecognized selector sent to class 0x1c0fae060'
https://bugs.webkit.org/show_bug.cgi?id=195720

Reviewed by Andy Estes.

Add back decode(Decoder& decoder, Class allowedClass) for Apple Pay code.

Shared/Cocoa/ArgumentCodersCocoa.h:

(IPC::decode): Added.

6:35 PM Changeset in webkit [242929] by Devin Rousso

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Debugger: pausing in an inline script on a page with a URL query creates an Extra Script
https://bugs.webkit.org/show_bug.cgi?id=195705
<rdar://problem/48853820>

Reviewed by Antoine Quint.

UserInterface/Models/Script.js:

(WI.Script.prototype._resolveResource):
If the page's URL has a query parameter, the payload we receive for any inline <script>s
doesn't include the query parameter as part of its URL. As such, if there isn't an existing
resource with a URL that exactly matches the URL of the script and if the URL of the main
resource for the script's target starts with the URL of the script, we assume that the
script "belongs" to the target's main resource and associate the script with it as such.

6:09 PM Changeset in webkit [242928] by Caio Lima

6 edits in trunk/Source/JavaScriptCore

[JSC] CodeBlock::visitChildren is reporting extra memory even when its JITCode is singleton
https://bugs.webkit.org/show_bug.cgi?id=195638

Reviewed by Mark Lam.

This patch introduces a m_isShared flag to track whether the
JITCode is shared between many CodeBlocks. This flag is used in
CodeBlock::setJITCode and CodeBlock::visitChildren to avoid
reporting duplicated extra memory for singleton JITCodes.
With those changes, we now stop counting singleton LLIntEntrypoints
as extra memory, since they are declared as static variables. This
change can potentially avoid unecessary GC pressure, because
extra memory is used by Heap::updateAllocationLimits() to update Heap
limits.
Even though it is hard to show performance difference for this change
(see results below), it is important to keep extra memory usage
correct. Otherwise, it can be a source of a complicated bug on
GC in the future.

Results from last run of Speedometer 2 comparing ToT and changes. We
collected those numbers running Minibrowser on a MacBook Pro 15-inch
with 2,6 GHz Intel Core i7. Both versions are with JIT disabled,
since these singleton JITCode are only used by this configuration:

Speedometer2 Run #1

ToT: 58.2 +- 1.1
changes: 57.9 +- 0.99

Speedometer2 Run #2

ToT: 58.5 +- 1.7
changes: 58.0 +- 1.5

Speedometer2 Run #2

ToT: 58.5 +- 0.99
changes: 57.1 +- 1.5

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::estimatedSize):
(JSC::CodeBlock::visitChildren):

bytecode/CodeBlock.h:

(JSC::CodeBlock::setJITCode):

jit/JITCode.cpp:

(JSC::JITCode::JITCode):
(JSC::JITCodeWithCodeRef::JITCodeWithCodeRef):
(JSC::DirectJITCode::DirectJITCode):
(JSC::NativeJITCode::NativeJITCode):

jit/JITCode.h:

(JSC::JITCode::isShared const):

llint/LLIntEntrypoint.cpp:

(JSC::LLInt::setFunctionEntrypoint):
(JSC::LLInt::setEvalEntrypoint):
(JSC::LLInt::setProgramEntrypoint):
(JSC::LLInt::setModuleProgramEntrypoint):

6:05 PM Changeset in webkit [242927] by Kocsen Chung

1 copy in tags/Safari-607.2.1

Tag Safari-607.2.1.

5:50 PM Changeset in webkit [242926] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit

Stop using some deprecated SPI in WKDrawingView
https://bugs.webkit.org/show_bug.cgi?id=195706
<rdar://problem/48062599>

Reviewed by Wenson Hsieh.

UIProcess/ios/WKDrawingView.mm:

(-[WKDrawingView renderedDrawing]):
(-[WKDrawingView PNGRepresentation]):
(-[WKDrawingView loadDrawingFromPNGRepresentation:]):

5:38 PM Changeset in webkit [242925] by Ryan Haddad

2 edits in trunk/Source/WebKitLegacy/win

Unreviewed attempt to fix the Windows build after r242920.

WebCoreSupport/WebFrameLoaderClient.h:

5:37 PM Changeset in webkit [242924] by aboya@igalia.com

3 edits in trunk/LayoutTests

[GTK] Unreviewed test gardening
https://bugs.webkit.org/show_bug.cgi?id=195717

platform/gtk/TestExpectations:
platform/wpe/TestExpectations:

5:17 PM Changeset in webkit [242923] by timothy@apple.com

2 edits in trunk/Source/WebKit

Unreviewed speculative build fix for watchOS after r242908.

Shared/Cocoa/ArgumentCodersCocoa.mm:

(IPC::decodeObject):

5:06 PM Changeset in webkit [242922] by mark.lam@apple.com

3 edits in trunk/JSTests

Gardening: reducing the variants on 2 tests to avoid timing out on JSC Debug queue.
https://bugs.webkit.org/show_bug.cgi?id=195415

Not reviewed.

Changed these tests to only run the default configuration.
The ftl-no-cjit-validate-sampling-profiler variant was timing out.
There's no strong need to run this test on that variant.

stress/dfg-to-string-on-int-does-gc.js:
stress/dfg-to-string-on-string-or-string-object-does-not-gc.js:

4:46 PM Changeset in webkit [242921] by Alan Bujtas

3 edits in trunk/Source/WebCore

[WeakPtr] RenderListMarker::m_listItem should be a WeakPtr
https://bugs.webkit.org/show_bug.cgi?id=195704
<rdar://problem/48486278>

Reviewed by Simon Fraser.

rendering/RenderListMarker.cpp:

(WebCore::RenderListMarker::RenderListMarker):
(WebCore::RenderListMarker::paint):
(WebCore::RenderListMarker::layout):
(WebCore::RenderListMarker::updateContent):
(WebCore::RenderListMarker::computePreferredLogicalWidths):
(WebCore::RenderListMarker::lineHeight const):
(WebCore::RenderListMarker::baselinePosition const):
(WebCore::RenderListMarker::suffix const):
(WebCore::RenderListMarker::isInside const):
(WebCore::RenderListMarker::getRelativeMarkerRect):

rendering/RenderListMarker.h:

4:37 PM Changeset in webkit [242920] by dino@apple.com

31 edits
2 adds in trunk

Block all plugins smaller than 5x5px
https://bugs.webkit.org/show_bug.cgi?id=195702
<rdar://problem/28435204>

Reviewed by Sam Weinig.

Source/WebCore:

Block all plugins that are smaller than a threshold, in this case
5px x 5px. Other browsers have implemented this for a while, and now
that we have Intersection Observers, small plugins are no longer
necessary.

Test: plugins/small-plugin-blocked.html

en.lproj/Localizable.strings: New message for a small plugin.
platform/LocalizedStrings.cpp:

(WebCore::pluginTooSmallText):

platform/LocalizedStrings.h:

html/HTMLPlugInElement.cpp: Helper function for Internals testing.

(WebCore::HTMLPlugInElement::isBelowSizeThreshold const):

html/HTMLPlugInElement.h:

loader/EmptyClients.cpp: Removed an unused function.

(WebCore::EmptyFrameLoaderClient::recreatePlugin): Deleted.

loader/EmptyFrameLoaderClient.h:
loader/FrameLoaderClient.h:

page/Settings.yaml: Add flag for new feature.

rendering/RenderEmbeddedObject.cpp: New unavailability reason for

embedded objects.
(WebCore::unavailablePluginReplacementText):

rendering/RenderEmbeddedObject.h:

(WebCore::RenderEmbeddedObject::pluginUnavailabilityReason const):

testing/Internals.cpp: Helper function for testing.

(WebCore::Internals::pluginIsBelowSizeThreshold):

testing/Internals.h:
testing/Internals.idl:

Source/WebKit:

Block all plugins that are smaller than a threshold, in this case
5x5px. Other browsers have implemented this for a while, and now
that we have Intersection Observers, small plugins are no longer
necessary.

Shared/WebPreferences.yaml: New setting for this feature.

UIProcess/WebPageProxy.cpp: Handle new unavailability type.

(WebKit::WebPageProxy::unavailablePluginButtonClicked):

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::shouldUnavailablePluginMessageBeButton const):

WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp: Removed this function

as it was never being called.
(WebKit::WebFrameLoaderClient::recreatePlugin): Deleted.

WebProcess/WebCoreSupport/WebFrameLoaderClient.h:

WebProcess/WebPage/WebPage.cpp:

(WebKit::pluginIsSmall): Checks the size of the plugin.
(WebKit::WebPage::createPlugin): If the plugin is too small, stop it from
launching.

Source/WebKitLegacy/mac:

Removed a function that was never being called.

WebCoreSupport/WebFrameLoaderClient.h:
WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::recreatePlugin): Deleted.

LayoutTests:

New test for some small plugins. Updated existing tests
to create plugins bigger than a threshold if necessary.

plugins/clicking-missing-plugin-fires-delegate.html:
plugins/destroy-stream-twice.html:
plugins/npruntime/npruntime.html:
plugins/object-embed-plugin-scripting.html:
plugins/small-plugin-blocked-expected.txt: Added.
plugins/small-plugin-blocked.html: Added.
platform/mac-wk1/TestExpectations: Skip new test on WK1.

4:36 PM Changeset in webkit [242919] by Alan Bujtas

4 edits
2 adds in trunk

Use RenderBox::previousSiblingBox/nextSiblingBox in RenderMultiColumnFlow
https://bugs.webkit.org/show_bug.cgi?id=195701
<rdar://problem/48448658>

Reviewed by Simon Fraser.

Source/WebCore:

It's safer to use existing RenderBox functions to get sibling boxes.

Test: fast/ruby/crash-when-paginated-ruby.html

rendering/RenderMultiColumnFlow.cpp:

(WebCore::RenderMultiColumnFlow::nextColumnSetOrSpannerSiblingOf):
(WebCore::RenderMultiColumnFlow::previousColumnSetOrSpannerSiblingOf):

LayoutTests:

fast/ruby/crash-when-paginated-ruby-expected.txt: Added.
fast/ruby/crash-when-paginated-ruby.html: Added.

4:24 PM Changeset in webkit [242918] by Keith Rollin

16 edits
1 add in trunk/Source

Add support for new StagedFrameworks layout
https://bugs.webkit.org/show_bug.cgi?id=195543

Reviewed by Alexey Proskuryakov.

Source/JavaScriptCore: