Timeline

Mar 27, 2019:

11:22 PM Changeset in webkit [243601] by rniwa@webkit.org

• 10 edits
  5 adds in trunk

[macOS] Select element doesn't show popup if select element had lost focus while popup was previosuly shown
​https://bugs.webkit.org/show_bug.cgi?id=196336

Reviewed by Tim Horton.

Source/WebCore:

• rendering/RenderMenuList.cpp:

(RenderMenuList::popupDidHide): Added a comment.

Source/WebKit:

The bug was caused by WebPopupMenu::hide never notifying PopupClient that the popup had been dismissed.
This resulted in RenderMenuList::m_popupIsVisible to be never reset.

Also fixed a bug in WebPopupMenuProxyMac::hidePopupMenu that this function was never dismissing
the popup as the selector "dismissPopUp", on the contrary to its name, does not dimiss the popup.
Send cancelTracking to NSMenu instead, which DOES dismiss the popup.

Tests: fast/forms/select/mac-wk2/blur-dismisses-select-popup.html

fast/forms/select/mac-wk2/open-select-popup-after-dismissing-by-blur.html

• UIProcess/mac/WebPopupMenuProxyMac.mm:

(WebKit::WebPopupMenuProxyMac::hidePopupMenu):

• WebProcess/WebCoreSupport/WebPopupMenu.cpp:

(WebKit::WebPopupMenu::hide):

Source/WebKitLegacy/mac:

Fixed the bug that we were not actually dismissing the popup in PopupMenuMac::hide as done in WebKit2.

Unfortunately no new tests since intenals.isSelectPopupVisible would always return false in WebKit1.

• WebCoreSupport/PopupMenuMac.mm:

(PopupMenuMac::hide):

LayoutTests:

Added regression tests for dismissing the select element's popup menu by bluring the element then re-opening the popup.
Unfortunately these tests are only enabled in WebKit2 since intenals.isSelectPopupVisible would always return false in WebKit1.

• TestExpectations:
• fast/forms/select/mac-wk2: Added.
• fast/forms/select/mac-wk2/blur-dismisses-select-popup-expected.html: Added.
• fast/forms/select/mac-wk2/blur-dismisses-select-popup.html: Added.
• fast/forms/select/mac-wk2/open-select-popup-after-dismissing-by-blur-expected.txt: Added.
• fast/forms/select/mac-wk2/open-select-popup-after-dismissing-by-blur.html: Added.
• platform/mac-wk2/TestExpectations:

10:44 PM Changeset in webkit [243600] by mitz@apple.com

• 7 copies
  1 add in releases/Apple/watchOS 5.2

Added a tag for watchOS 5.2.

10:43 PM Changeset in webkit [243599] by mitz@apple.com

• 9 copies
  1 add in releases/Apple/Safari 12.1

Added a tag for Safari 12.1.

10:40 PM Changeset in webkit [243598] by mitz@apple.com

• 8 copies
  1 add in releases/Apple/iOS 12.2

Added a tag for iOS 12.2.

6:47 PM Changeset in webkit [243597] by sbarati@apple.com

• 4 edits in trunk

JetStream 2 should not report time values as scores
​https://bugs.webkit.org/show_bug.cgi?id=196334

Reviewed by Yusuke Suzuki.

PerformanceTests:

• JetStream2/JetStreamDriver.js:

(toTimeValue):
(Driver.prototype.async.reportScoreToRunBenchmarkRunner):

Websites/browserbench.org:

• JetStream2.0/JetStreamDriver.js:

(toTimeValue):
(Driver.prototype.async.reportScoreToRunBenchmarkRunner):

6:06 PM Changeset in webkit [243596] by sbarati@apple.com

• 4 edits
  1 add in trunk

validateOSREntryValue with Int52 should box the value being checked into double format
​https://bugs.webkit.org/show_bug.cgi?id=196313
<rdar://problem/49306703>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/validate-int-52-ai-state.js: Added.

Source/JavaScriptCore:

• dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::validateAIState):

6:02 PM Changeset in webkit [243595] by dino@apple.com

• 2 edits in trunk/Source/WebKit

[ARKit] Black view when opening a 3D model usdz file in new tab
​https://bugs.webkit.org/show_bug.cgi?id=196333
<rdar://problem/47693367>

Reviewed by Tim Horton.

When opening a new WKSystemPreviewView, we were exiting if there was no
presentingViewController. This code was unnecessary, and causing blank
content when opening a new tab.

• UIProcess/ios/WKSystemPreviewView.mm:

(-[WKSystemPreviewView web_setContentProviderData:suggestedFilename:]):
Remove the code looking for a presentingViewController.

5:58 PM Changeset in webkit [243594] by aboya@igalia.com

• 5 edits
  1 add in trunk/LayoutTests

[GTK] Unreviewed test gardening
​https://bugs.webkit.org/show_bug.cgi?id=196329

• platform/gtk/TestExpectations:
• platform/gtk/http/tests/inspector/network/har/har-page-expected.txt:
• platform/gtk/http/tests/inspector/network/resource-sizes-network-expected.txt:
• platform/gtk/js/intl-datetimeformat-expected.txt: Added.
• platform/wpe/TestExpectations:

4:56 PM Changeset in webkit [243593] by Alan Coon

• 3 edits
  2 adds in branches/safari-607-branch

Cherry-pick r242943. rdar://problem/49307995

Cleanup inline boxes when list marker gets blockified
​https://bugs.webkit.org/show_bug.cgi?id=195746
<rdar://problem/48049175>

Reviewed by Antti Koivisto.

Source/WebCore:

Normally when an element gets blockified (inline -> block) we destroy its renderer and construct a new one (RenderInline -> RenderBlock).
During this process the associated inline boxtree gets destroyed as well. Since RenderListMarker is just a generic RenderBox, the blockifying
change does not require a new renderer.
This patch takes care of destroying the inline boxtree when the marker gains block display type.

Test: fast/block/float/list-marker-is-float-crash.html

• rendering/RenderListMarker.cpp: (WebCore::RenderListMarker::styleDidChange):

LayoutTests:

• fast/block/float/list-marker-is-float-crash-expected.txt: Added.
• fast/block/float/list-marker-is-float-crash.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242943 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:52 PM Changeset in webkit [243592] by Alan Coon

• 4 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r242964. rdar://problem/49359851

Storing a Node in Ref/RefPtr inside its destructor results in double delete
​https://bugs.webkit.org/show_bug.cgi?id=195661

Reviewed by Brent Fulgham.

Set Node::m_refCount to 1 before calling its virtual destructor.

This is a security mitigation to prevent any code which ends up storing the node to Ref / RefPtr
inside the destructor, which is a programming error caught by debug assertions, from triggering
a double-delete on the same Node.

Such a code would hit the debug assertions in Node::deref() because m_inRemovedLastRefFunction
had been set to true by then.

• dom/Document.cpp: (WebCore::Document::removedLastRef):
• dom/Document.h: (WebCore::Document::decrementReferencingNodeCount):
• dom/Node.cpp: (WebCore::Node::~Node): (WebCore::Node::removedLastRef):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242964 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:50 PM WebKitGTK/2.24.x edited by Adrian Perez de Castro

(diff)

4:50 PM Changeset in webkit [243591] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merged r243538 - Build failure with gstreamer 1.12.5 if USE_GSTREAMER_GL is enabled
​https://bugs.webkit.org/show_bug.cgi?id=196178

Reviewed by Xabier Rodriguez-Calvar.

The gst/gl/gl.h header needs to be included before
GraphicsContext3D.h to avoid declaration conflicts with
OpenGLShims.

Based on a patch from Mike Gorse <​mgorse@suse.com>

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::GstVideoFrameHolder::GstVideoFrameHolder):

4:48 PM Changeset in webkit [243590] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.24/Source/WebKit

Merged r243492 - [WPE][Qt] Uninitialized racy ViewBackend
​https://bugs.webkit.org/show_bug.cgi?id=196247

Patch by Philippe Normand <​pnormand@igalia.com> on 2019-03-26
Reviewed by Carlos Garcia Campos.

• UIProcess/API/wpe/qt/WPEQtView.h: Initialize the backend pointer to nullptr.

4:48 PM Changeset in webkit [243589] by Adrian Perez de Castro

• 7 edits in releases/WebKitGTK/webkit-2.24

Merged r243489 - [GStreamer] Sound loop with Google Hangouts and WhatsApp notifications
​https://bugs.webkit.org/show_bug.cgi?id=189471

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

The media duration is now cached (again). The loop issue was
triggered by the previous version of the code returning positive
infinite duration in didEnd(), followed by the timeupdate event
propagation that would trick the HTMLMediaElement into a new call
to play(). Now the cached duration is updated to current position
at EOS (for forward playback direction only), so the media element
no longer triggers a new play call for those cases.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
(WebCore::MediaPlayerPrivateGStreamer::loadFull):
(WebCore::MediaPlayerPrivateGStreamer::playbackPosition const):
(WebCore::MediaPlayerPrivateGStreamer::platformDuration const):
(WebCore::MediaPlayerPrivateGStreamer::durationMediaTime const):
(WebCore::MediaPlayerPrivateGStreamer::currentMediaTime const):
(WebCore::MediaPlayerPrivateGStreamer::didEnd):
(WebCore::MediaPlayerPrivateGStreamer::durationChanged):

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
• platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:

(WebCore::MediaPlayerPrivateGStreamerMSE::currentMediaTime const):

LayoutTests:

• platform/gtk/TestExpectations:
• platform/gtk/media/video-playing-and-pause-expected.txt:

4:47 PM Changeset in webkit [243588] by Adrian Perez de Castro

• 4 edits
  6 adds in releases/WebKitGTK/webkit-2.24

Merged r243372 - [MSE][GStreamer] Don't construct segments on PlaybackPipeline::flush
​https://bugs.webkit.org/show_bug.cgi?id=195867

Reviewed by Xabier Rodriguez-Calvar.

LayoutTests/imported/w3c:

These tests check that video and audio are roughly in sync with each
other and with the reported player position during MSE playback.

• web-platform-tests/media-source/mediasource-correct-frames-after-reappend-expected.txt: Added.
• web-platform-tests/media-source/mediasource-correct-frames-after-reappend.html: Added.
• web-platform-tests/media-source/mediasource-correct-frames-expected.txt: Added.
• web-platform-tests/media-source/mediasource-correct-frames.html: Added.
• web-platform-tests/media-source/mp4/test-boxes-audio.mp4: Added.
• web-platform-tests/media-source/mp4/test-boxes-video.mp4: Added.

Source/WebCore:

The previous approach did not really work for flushes on only one
branch, as setting reset-time in FLUSH_STOP affects the running time
of the entire pipeline, causing timing issues in the other branch.

Since it's preferable not to interfere with the other branch if
possible, setting reset-time to FALSE fixes that problem.

Also, it's not necessary to fabricate a segment. Since we are not
seeking, only the base needs to be adjusted, and gstbasesrc already
handles this correctly by default.

This fixes an audio/video synchronization bug in YT when some
automatic quality changes occur.

Tests: imported/w3c/web-platform-tests/media-source/mediasource-correct-frames-after-reappend.html

imported/w3c/web-platform-tests/media-source/mediasource-correct-frames.html

• platform/graphics/gstreamer/mse/PlaybackPipeline.cpp:

(WebCore::PlaybackPipeline::flush):

LayoutTests:

Drawing an MSE video in a canvas seems to be failing in Mac. That
functionality is necessary for the tests introduced with this patch,
therefore they fail there. Marking them as Skip.

• platform/mac/TestExpectations:

4:47 PM Changeset in webkit [243587] by Adrian Perez de Castro

• 3 edits
  4 adds in releases/WebKitGTK/webkit-2.24

Merged r243199 - [MSE][GStreamer] Fix handling of resolution changes in AppendPipeline
​https://bugs.webkit.org/show_bug.cgi?id=195855

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

MediaSample instances produced by the AppendPipeline were not
accounting for resolution changes. The causes of this are twofold:

1) m_presentationSize is set by connectDemuxerSrcPadToAppsink() (by
calling parseDemuxerSrcPadCaps()), but not by appsinkCapsChanged().

2) appsinkCapsChanged() was being called in the main thread as an
asynchronous task. In consequence, even if m_presentationSize is set
there, many samples with the new resolution would still be wrapped in
a MediaSampleGStreamer using the old resolution by the main thread
running consumeAppsinkAvailableSamples() before appsinkCapsChanged()
is dispatched.

This patch fixes these problems by updating m_presentationSize in
appsinkCapsChanged() and making the streaming thread block until the
main thread has dispatched appsinkCapsChanged(). This way the handling
of caps changes is serialized with the handling of frames.

Test: media/media-source/media-source-samples-resolution-change.html

• platform/graphics/gstreamer/mse/AppendPipeline.cpp:

(WebCore::AppendPipeline::AppendPipeline):
(WebCore::AppendPipeline::appsinkCapsChanged):

LayoutTests:

• media/media-source/content/test-green-6s-320x240.mp4: Added.
• media/media-source/content/test-red-3s-480x360.mp4: Added.
• media/media-source/media-source-samples-resolution-change-expected.txt: Added.
• media/media-source/media-source-samples-resolution-change.html: Added.

4:47 PM Changeset in webkit [243586] by Adrian Perez de Castro

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.24

Merged r243138 - [MSE] Use tolerance in eraseBeginTime
​https://bugs.webkit.org/show_bug.cgi?id=195911

Reviewed by Jer Noble.

Source/WebCore:

​https://bugs.webkit.org/show_bug.cgi?id=190085 introduced tolerance
when erasing frames during the Coded Frame Processing algorithm in
such a way that, in files with less than perfect timestamps, a frame
existing before after the current append is not erased accidentally
due to small overlaps.

This patch takes care of the opposite problem: we don't want an old
frame being accidentally NOT erased by a new one with the same
timestamps just because these overlaps make
highestPresentationTimestamp very slightly higher than the frame PTS.

This bug in practice causes some frames of the old quality to not be
erased when the new quality is appended, resulting in some seemingly
still frames from a different quality appearing at some points during
WebM video in presence of quality changes.

This bug can be reduced to this minimal test case that illustrates the
timestamp imprecission of a typical WebM file:

function sampleRun(generation) {

return concatenateSamples([

makeASample( 0, 0, 166667, 1000000, 1, SAMPLE_FLAG.SYNC, generation),
makeASample(167000, 167000, 166667, 1000000, 1, SAMPLE_FLAG.NONE, generation),
makeASample(333000, 333000, 166667, 1000000, 1, SAMPLE_FLAG.SYNC, generation), overlaps previous frame
makeASample(500000, 500000, 166667, 1000000, 1, SAMPLE_FLAG.NONE, generation),

]);

}

After appending this twice it would be expected that the second
generation takes fully over the first, since the timestamps are
completely the same. Due to the bug, sync frames with an overlap, like
the third one in that list, actually persist from the first
generation, due to lack of tolerance when comparing the start of a new
frame with highestPresentationTimestamp.

This patch introduces the tolerance in that case too to fix this
problem.

Test: media/media-source/media-source-append-twice-overlapping-sync-frame.html

• Modules/mediasource/SourceBuffer.cpp:

(WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

LayoutTests:

• media/media-source/media-source-append-twice-overlapping-sync-frame-expected.txt: Added.
• media/media-source/media-source-append-twice-overlapping-sync-frame.html: Added.

4:46 PM WebKitGTK/2.24.x edited by Adrian Perez de Castro

(diff)

4:44 PM Changeset in webkit [243585] by Alan Coon

• 1 edit in branches/safari-607-branch/Source/WebCore/platform/sql/SQLiteDatabase.cpp

Apply patch. rdar://problem/49308059

4:44 PM Changeset in webkit [243584] by Alan Coon

• 3 edits
  2 adds in branches/safari-607-branch

Cherry-pick r243506. rdar://problem/49307987

vertexAttribPointer must restrict offset parameter
​https://bugs.webkit.org/show_bug.cgi?id=196261
<rdar://problem/48458086>

Reviewed by Antoine Quint.

Source/WebCore:

This WebGL function should fail if the offset parameter is
not within [0, max 32-bit int].

Test: fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html

• html/canvas/WebGLRenderingContextBase.cpp: (WebCore::WebGLRenderingContextBase::vertexAttribPointer):

LayoutTests:

Add a test where the offset parameter is out of bounds.

• fast/canvas/webgl/vertexAttribPointer-with-bad-offset-expected.txt: Added.
• fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243506 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:44 PM Changeset in webkit [243583] by Alan Coon

• 2 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r243341. rdar://problem/49308013

Inband Text Track cues interspersed with Data cues can display out of order.
​https://bugs.webkit.org/show_bug.cgi?id=196095

Reviewed by Eric Carlson.

The compareCueIntervalForDisplay() comparator depends on a virtual function, isPositionedAbove(TextTrackCue* other),
but this comparison returns inconsistent results for cueA->isPositionedAbove(cueB) and cueB->isPositionedAbove(cueA)
if the two cues are different subclasses of TextTrackCue.

The underlying algorithm should be fixed in a future patch, but for now, remove all non-displaying cues from the array
of activeCues before sorting, rather than after when iterating over the sorted list of activeCues.

• html/shadow/MediaControlElements.cpp: (WebCore::MediaControlTextTrackContainerElement::updateDisplay):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243341 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:44 PM Changeset in webkit [243582] by Alan Coon

• 2 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r243338. rdar://problem/49307958

Fix iOS build after r243337
​https://bugs.webkit.org/show_bug.cgi?id=195935

• platform/ios/PlaybackSessionInterfaceAVKit.mm: (WebCore::PlaybackSessionInterfaceAVKit::playbackSessionModel const): (WebCore::playbackSessionModel const): Deleted.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243338 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:44 PM Changeset in webkit [243581] by Alan Coon

• 8 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r243337. rdar://problem/49307958

Hardening: Use WeakPtrs in PlaybackSessionInterface{Mac,AVKit}
​https://bugs.webkit.org/show_bug.cgi?id=195935
<rdar://problem/49007015>

Reviewed by Eric Carlson.

The PlaybackSessionInterface{Mac,AVKit} implementations store their playback session model
and playback controls manager members as bare pointers, something we've been working
to eliminate.

This patch corrects this oversight.

No new tests since no changes in behavior.

• platform/cocoa/PlaybackSessionModel.h:
• platform/ios/PlaybackSessionInterfaceAVKit.h:
• platform/ios/PlaybackSessionInterfaceAVKit.mm: (WebCore::PlaybackSessionInterfaceAVKit::PlaybackSessionInterfaceAVKit): (WebCore::playbackSessionModel const): Moved to implementation since WEBCORE_EXPORT is not supposed to be used with inline methods.
• platform/mac/PlaybackSessionInterfaceMac.h:
• platform/mac/PlaybackSessionInterfaceMac.mm: (WebCore::PlaybackSessionInterfaceMac::PlaybackSessionInterfaceMac): (WebCore::PlaybackSessionInterfaceMac::playbackSessionModel const): (WebCore::PlaybackSessionInterfaceMac::beginScrubbing): (WebCore::PlaybackSessionInterfaceMac::endScrubbing): (WebCore::PlaybackSessionInterfaceMac::playBackControlsManager):
• platform/mac/VideoFullscreenInterfaceMac.mm: (WebCore::VideoFullscreenInterfaceMac::~VideoFullscreenInterfaceMac):
• platform/mac/WebPlaybackControlsManager.mm: (-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]): (-[WebPlaybackControlsManager setCurrentAudioTouchBarMediaSelectionOption:]): (-[WebPlaybackControlsManager setCurrentLegibleTouchBarMediaSelectionOption:]):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243337 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:44 PM Changeset in webkit [243580] by Alan Coon

• 4 edits
  2 adds in branches/safari-607-branch

Cherry-pick r243331. rdar://problem/49308068

Do not insert the first-letter anonymous container until after we've constructed the first-letter renderer.
​https://bugs.webkit.org/show_bug.cgi?id=195919
<rdar://problem/48573434>

Reviewed by Brent Fulgham.

Source/WebCore:

When the container is injected too early, we might end up removing it as part of the collapsing logic
while the text renderer is being removed (replaced with the first letter + remaining text).

Test: fast/css/first-letter-and-float-crash.html

• rendering/updating/RenderTreeBuilderFirstLetter.cpp: (WebCore::RenderTreeBuilder::FirstLetter::createRenderers):

LayoutTests:

• fast/css/first-letter-and-float-crash-expected.txt: Added.
• fast/css/first-letter-and-float-crash.html: Added.
• platform/mac/TestExpectations:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243331 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243579] by Alan Coon

• 7 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r243298. rdar://problem/49308011

Hardening: Use WeakPtrs in VideoFullscreenInterface{Mac,AVKit}
​https://bugs.webkit.org/show_bug.cgi?id=196052
<rdar://problem/48778571>

Reviewed by Eric Carlson.

The VideoFullscreenInterface{Mac,AVKit} implementations store their fullscreen model
and fullscreen change observer members as bare pointers, something we've been working
to eliminate.

This patch corrects this oversight.

No new tests since no changes in behavior.

• platform/cocoa/VideoFullscreenChangeObserver.h:
• platform/cocoa/VideoFullscreenModel.h:
• platform/ios/VideoFullscreenInterfaceAVKit.h:
• platform/ios/VideoFullscreenInterfaceAVKit.mm: (VideoFullscreenInterfaceAVKit::setVideoFullscreenModel): (VideoFullscreenInterfaceAVKit::setVideoFullscreenChangeObserver): (VideoFullscreenInterfaceAVKit::presentingViewController): (VideoFullscreenInterfaceAVKit::invalidate): (VideoFullscreenInterfaceAVKit::preparedToExitFullscreen): (VideoFullscreenInterfaceAVKit::shouldExitFullscreenWithReason): (VideoFullscreenInterfaceAVKit::doSetup):
• platform/mac/VideoFullscreenInterfaceMac.h: (WebCore::VideoFullscreenInterfaceMac::videoFullscreenModel const): (WebCore::VideoFullscreenInterfaceMac::videoFullscreenChangeObserver const):
• platform/mac/VideoFullscreenInterfaceMac.mm: (WebCore::VideoFullscreenInterfaceMac::setVideoFullscreenModel): (WebCore::VideoFullscreenInterfaceMac::setVideoFullscreenChangeObserver): (WebCore::VideoFullscreenInterfaceMac::enterFullscreen): (WebCore::VideoFullscreenInterfaceMac::invalidate):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243298 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243578] by Alan Coon

• 3 edits in branches/safari-607-branch/Source/WebKit

Cherry-pick r243291. rdar://problem/49307996

Fix possible memory leak when dismissing a color picker
​https://bugs.webkit.org/show_bug.cgi?id=196026
<rdar://problem/48778568>

Reviewed by Wenson Hsieh.

Fix a problem with WebPageProxy::endColorPicker where an early return could leave a color picker
with a +1 reference count after dismissing it.

• UIProcess/WebColorPicker.cpp: (WebKit::WebColorPicker::endPicker):
• UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::endColorPicker): (WebKit::WebPageProxy::didEndColorPicker):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243291 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243577] by Alan Coon

• 8 edits
  1 add in branches/safari-607-branch

Cherry-pick r243280. rdar://problem/49308036

Cap length of an array with spread to MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.
​https://bugs.webkit.org/show_bug.cgi?id=196055
<rdar://problem/49067448>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: Added.

Source/JavaScriptCore:

We are doing this because:

1. We expect the array to be densely packed.
2. SpeculativeJIT::compileAllocateNewArrayWithSize() (and the FTL equivalent) expects the array length to be less than MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH if we don't want to use an ArrayStorage shape.
3. There's no reason why an array with spread needs to be that large anyway. MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH is plenty.

In this patch, we also add a debug assert in compileAllocateNewArrayWithSize() and
emitAllocateButterfly() to check for overflows.

• assembler/AbortReason.h:
• dfg/DFGOperations.cpp:
• dfg/DFGSpeculativeJIT.cpp: (JSC::DFG::SpeculativeJIT::compileCreateRest): (JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread): (JSC::DFG::SpeculativeJIT::emitAllocateButterfly): (JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
• ftl/FTLLowerDFGToB3.cpp: (JSC::FTL::DFG::LowerDFGToB3::compileNewArrayWithSpread):
• runtime/ArrayConventions.h:
• runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243280 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243576] by Alan Coon

• 3 edits
  1 add in branches/safari-607-branch

Cherry-pick r243069. rdar://problem/49308056

Structure::flattenDictionary() should clear unused property slots.
​https://bugs.webkit.org/show_bug.cgi?id=195871
<rdar://problem/48959497>

Reviewed by Michael Saboff.

JSTests:

• stress/structure-flattenDictionary-should-clear-unused-property-slots.js: Added.

Source/JavaScriptCore:

It currently attempts to do this but fails because it's actually clearing up the
preCapacity region instead. The fix is simply to account for the preCapacity
when computing the start address of the property slots.

• runtime/Structure.cpp: (JSC::Structure::flattenDictionaryStructure):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243069 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243575] by Alan Coon

• 2 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r242946. rdar://problem/49308005

Certain videos are causing a crash when used as WebGL texture
​https://bugs.webkit.org/show_bug.cgi?id=195700
<rdar://problem/48869347>

Reviewed by Eric Carlson.

CFEqual is not null-safe, so perform a null and type check before comparing.

• platform/graphics/cv/VideoTextureCopierCV.cpp: (WebCore::transferFunctionFromString):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242946 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243574] by Alan Coon

• 3 edits in branches/safari-607-branch/Source/WebCore

Cherry-pick r242921. rdar://problem/49308071

[WeakPtr] RenderListMarker::m_listItem should be a WeakPtr
​https://bugs.webkit.org/show_bug.cgi?id=195704
<rdar://problem/48486278>

Reviewed by Simon Fraser.

• rendering/RenderListMarker.cpp: (WebCore::RenderListMarker::RenderListMarker): (WebCore::RenderListMarker::paint): (WebCore::RenderListMarker::layout): (WebCore::RenderListMarker::updateContent): (WebCore::RenderListMarker::computePreferredLogicalWidths): (WebCore::RenderListMarker::lineHeight const): (WebCore::RenderListMarker::baselinePosition const): (WebCore::RenderListMarker::suffix const): (WebCore::RenderListMarker::isInside const): (WebCore::RenderListMarker::getRelativeMarkerRect):
• rendering/RenderListMarker.h:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242921 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243573] by Alan Coon

• 4 edits
  2 adds in branches/safari-607-branch

Cherry-pick r242919. rdar://problem/49307949

Use RenderBox::previousSiblingBox/nextSiblingBox in RenderMultiColumnFlow
​https://bugs.webkit.org/show_bug.cgi?id=195701
<rdar://problem/48448658>

Reviewed by Simon Fraser.

Source/WebCore:

It's safer to use existing RenderBox functions to get sibling boxes.

Test: fast/ruby/crash-when-paginated-ruby.html

• rendering/RenderMultiColumnFlow.cpp: (WebCore::RenderMultiColumnFlow::nextColumnSetOrSpannerSiblingOf): (WebCore::RenderMultiColumnFlow::previousColumnSetOrSpannerSiblingOf):

LayoutTests:

• fast/ruby/crash-when-paginated-ruby-expected.txt: Added.
• fast/ruby/crash-when-paginated-ruby.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242919 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243572] by Alan Coon

• 4 edits
  2 adds in branches/safari-607-branch

Cherry-pick r242917. rdar://problem/49307956

Fix an edge case where HTMLFormElement::removeFormElement is invoked twice with the same element
​https://bugs.webkit.org/show_bug.cgi?id=195663
<rdar://problem/48576391>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Currently, it's possible for HTMLFormControlElement's destructor to be reentrant. This may happen if the form
control element is ref'd while carrying out its destructor's logic. This may happen in two places in
HTMLFormControlElement (didChangeForm and resetDefaultButton), both of which actually don't require ensuring a
protected reference to the form control element since they should never result in any script execution.

To fix the bug, convert these strong references into raw pointers, and add ScriptDisallowedScope to ensure that
we don't change these codepaths in the future, such that they trigger arbitrary script execution.

Test: fast/forms/remove-associated-element-after-gc.html

• html/HTMLFormControlElement.cpp: (WebCore::HTMLFormControlElement::didChangeForm):
• html/HTMLFormElement.cpp: (WebCore::HTMLFormElement::resetDefaultButton):

LayoutTests:

Add a layout test to exercise the scenario described in the WebCore ChangeLog.

• fast/forms/remove-associated-element-after-gc-expected.txt: Added.
• fast/forms/remove-associated-element-after-gc.html: Added.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242917 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243571] by Alan Coon

• 3 edits
  1 add in branches/safari-607-branch

Cherry-pick r242838. rdar://problem/49307991

REGRESSION (iOS 12.2): Webpage using CoffeeScript crashes
​https://bugs.webkit.org/show_bug.cgi?id=195613

Reviewed by Mark Lam.

JSTests:

New regression test.

• stress/regexp-backref-inbounds.js: Added. (testRegExp):

Source/JavaScriptCore:

The bug here is in Yarr JIT backreference matching code. We are incorrectly
using a checkedOffset / inputPosition correction when checking for the available
length left in a string. It is improper to do these corrections as a backreference's
match length is based on what was matched in the referenced capture group and not
part of the checkedOffset and inputPosition computed when we compiled the RegExp.
In some cases, the resulting incorrect calculation would allow us to go past
the subject string's length. Removed these adjustments.

After writing tests for the first bug, found another bug where the non-greedy
backreference backtracking code didn't do an "are we at the end of the input?" check.
This caused an infinite loop as we'd jump from the backtracking code back to
try matching one more backreference, fail and then backtrack.

• yarr/YarrJIT.cpp: (JSC::Yarr::YarrGenerator::generateBackReference): (JSC::Yarr::YarrGenerator::backtrackBackReference):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@242838 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4:43 PM Changeset in webkit [243570] by Alan Coon

• 2 edits in branches/safari-607-branch/Source/WebKit

Apply patch. rdar://problem/49307967

fix-radar-48878188

4:34 PM Changeset in webkit [243569] by Wenson Hsieh

• 2 edits
  1 add in trunk/Source/WebKit

Need a way to include WebKitAdditions code in WebKit API headers
​https://bugs.webkit.org/show_bug.cgi?id=196173

Reviewed by Tim Horton.

Introduce a mechanism that allows us to insert code from WebKitAdditions into public or private SDK headers
using #imports of the form:

`
#if USE(APPLE_INTERNAL_SDK)
#import <WebKitAdditions/WKWebViewConfigurationAdditions.h>
#endif
`

The resulting header in the built products directory will contain the contents of the imported file inserted in
place of the #if USE(APPLE_INTERNAL_SDK) … #endif block; however, when building with the Apple internal SDK,
the additions header content will be imported by the usual means.

• mac/postprocess-framework-headers.sh:
• mac/replace-webkit-additions-includes.py: Added.

Add a step when post-processing framework headers to replace instances of #if USE(APPLE_INTERNAL_SDK) … #endif
with the text content of the additions files. The replacement script first searches in the built products
directory for the matching additions file, and falls back to the SDK if no matching file is found. If neither
are present (e.g. a build using the public SDK), then the block is simply replaced by the empty string.

(read_content_from_webkit_additions):
(main):

4:32 PM WebKitGTK/2.24.x edited by Adrian Perez de Castro

(diff)

4:32 PM Changeset in webkit [243568] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.24/Source/WebCore

Merged r243104 - REGRESSION(r236862): early frame decoupling leaves JSC ArrayBuffer objects lingering
​https://bugs.webkit.org/show_bug.cgi?id=195322

Reviewed by Ryosuke Niwa.

Since r236862, DOMWindow objects get disconnected from their Frame object as soon as
their iframe element gets removed from the document. Previously, DOMWindow was a
FrameDestructionObserver and would stay connected to its frame until the frame died.

This means that some of the work that we were doing in DOMWindow::frameDestroyed() and
Document::willDetachPage() no longer happens for subframe windows because they get
disconnected from their frame because they get a chance to get such notifications.
To address this issue, we now also do this work in DOMWindow::willDetachDocumentFromFrame()
which gets called when the iframe gets removed from the document and the document / window
get disconnected from the Frame element.

No new tests, verified locally that the leak is gone on JetStream.

• page/DOMWindow.cpp:

(WebCore::DOMWindow::willDetachDocumentFromFrame):

4:09 PM Changeset in webkit [243567] by aestes@apple.com

• 5 edits
  1 delete in trunk

REGRESSION (r242686): package-root creates roots with broken symlinks in WebKit.framework/XPCServices/
​https://bugs.webkit.org/show_bug.cgi?id=196317

Reviewed by Dan Bernstein.

Source/WebKit:

Removed some remnants of the Storage Process.

• Configurations/BaseTarget.xcconfig:
• Resources/SandboxProfiles/ios/com.apple.WebKit.Storage.sb: Removed.
• WebKit.xcodeproj/project.pbxproj:

Tools:

package-root copies built products into a staging directory using ditto(1), which does not
follow symbolic links as it traverses a directory. Now that the files in
WebKit.framework/XPCServices/ are symbolic links to a location outside of the framework
itself, these become broken links when ditto'd into the staging directory.

To account for this, change package-root to copy using cp(1) in a mode that follows symlinks.

• Scripts/package-root:

4:06 PM WebKitGTK/2.24.x edited by Adrian Perez de Castro

(diff)

3:16 PM Changeset in webkit [243566] by Shawn Roberts

• 3 edits in trunk/LayoutTests

The following layout tests are flaky Image Only Failures
imported/w3c/web-platform-tests/mathml/relations/css-styling/mathvariant-bold.html
imported/w3c/web-platform-tests/mathml/relations/css-styling/mathvariant-double-struck.html
imported/w3c/web-platform-tests/mathml/relations/css-styling/mathvariant-italic.html
​https://bugs.webkit.org/show_bug.cgi?id=196112

Unreviewed test gardening.

• platform/ios-simulator-wk2/TestExpectations:
• platform/mac/TestExpectations: Marking tests as flaky

2:48 PM Changeset in webkit [243565] by Keith Rollin

• 2 edits in trunk/Source/WebKit

Include the CFNetworking task UUID to the NSError when a resource-load fails
​https://bugs.webkit.org/show_bug.cgi?id=196156

Reviewed by Alex Christensen.

In order to help track the connection between a failed resource-load
and a user-visible error message, include the CFNetworking task UUID
in the associated error as an element of the userInfo property. This
can then be pulled out and reported in the logging at the point the
error is reported to the user.

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:didCompleteWithError:]):

2:09 PM Changeset in webkit [243564] by aakash_jain@apple.com

• 2 edits in trunk/Tools

[ews-app] Update display text of Submit for ews analysis
​https://bugs.webkit.org/show_bug.cgi?id=196309

Reviewed by Dewei Zhu.

• BuildSlaveSupport/ews-app/ews/templates/statusbubble.html:

1:47 PM Changeset in webkit [243563] by Justin Fan

• 44 edits
  1 copy in trunk

[Web GPU] Standardize Web GPU object reference counting and creation logic
​https://bugs.webkit.org/show_bug.cgi?id=196183

Reviewed by Dean Jackson.

Source/WebCore:

Make getters return raw refs/pointers and provide const versions if necessary.
All Web GPU objects are non-nullable, but become no-op if invalid, and descriptors are not moved unless needed.

No new tests; no change in behavior.

Getter updates and const qualifications:

• Modules/webgpu/WebGPUAdapter.h:

(WebCore::WebGPUAdapter::options const):

• Modules/webgpu/WebGPUBindGroup.h:

(WebCore::WebGPUBindGroup::bindGroup):
(WebCore::WebGPUBindGroup::bindGroup const): Deleted.

• Modules/webgpu/WebGPUBindGroupDescriptor.cpp:

(WebCore::WebGPUBindGroupDescriptor::tryCreateGPUBindGroupDescriptor const):

• Modules/webgpu/WebGPUBindGroupDescriptor.h:
• Modules/webgpu/WebGPUBindGroupLayout.h:

(WebCore::WebGPUBindGroupLayout::bindGroupLayout const):

• Modules/webgpu/WebGPUBuffer.h:

(WebCore::WebGPUBuffer::buffer):
(WebCore::WebGPUBuffer::buffer const):

• Modules/webgpu/WebGPURenderPassDescriptor.cpp:

(WebCore::WebGPURenderPassDescriptor::tryCreateGPURenderPassDescriptor const):

• Modules/webgpu/WebGPURenderPassEncoder.cpp:

(WebCore::WebGPURenderPassEncoder::setVertexBuffers):

• Modules/webgpu/WebGPUSampler.h:

(WebCore::WebGPUSampler::sampler const):

• Modules/webgpu/WebGPUSwapChain.h:

(WebCore::WebGPUSwapChain::swapChain):
(WebCore::WebGPUSwapChain::swapChain const): Deleted.

• Modules/webgpu/WebGPUTexture.h:

(WebCore::WebGPUTexture::texture):
(WebCore::WebGPUTexture::texture const): Deleted.

• Modules/webgpu/WebGPUTextureView.h:

(WebCore::WebGPUTextureView::texture):
(WebCore::WebGPUTextureView::texture const): Deleted.

• platform/graphics/gpu/GPUBindGroupBinding.h:
• platform/graphics/gpu/GPUBindGroupDescriptor.h:
• platform/graphics/gpu/cocoa/GPUBindGroupMetal.mm:

(WebCore::tryGetResourceAsMTLSamplerState):

Web GPU object creation logic:

• Modules/webgpu/WebGPUCommandEncoder.cpp:

(WebCore::WebGPUBufferCopyView::tryCreateGPUBufferCopyView const):
(WebCore::WebGPUTextureCopyView::tryCreateGPUTextureCopyView const):
(WebCore::WebGPUCommandEncoder::beginRenderPass):
(WebCore::WebGPUCommandEncoder::copyBufferToBuffer):

• Modules/webgpu/WebGPUCommandEncoder.h:
• Modules/webgpu/WebGPUDevice.cpp:

(WebCore::WebGPUDevice::createBuffer const):
(WebCore::WebGPUDevice::createTexture const):
(WebCore::WebGPUDevice::createPipelineLayout const):
(WebCore::WebGPUDevice::createBindGroup const):
(WebCore::WebGPUDevice::createShaderModule const):
(WebCore::WebGPUDevice::createRenderPipeline const):
(WebCore::WebGPUDevice::getQueue const):

• Modules/webgpu/WebGPUDevice.h:
• Modules/webgpu/WebGPUPipelineLayout.cpp:

(WebCore::WebGPUPipelineLayout::create):
(WebCore::WebGPUPipelineLayout::WebGPUPipelineLayout):

• Modules/webgpu/WebGPUPipelineLayout.h:

(WebCore::WebGPUPipelineLayout::pipelineLayout):

• Modules/webgpu/WebGPUPipelineLayoutDescriptor.cpp:

(WebCore::WebGPUPipelineLayoutDescriptor::tryCreateGPUPipelineLayoutDescriptor const):

• Modules/webgpu/WebGPUPipelineLayoutDescriptor.h:
• Modules/webgpu/WebGPUQueue.cpp:

(WebCore::WebGPUQueue::create):
(WebCore::WebGPUQueue::WebGPUQueue):
(WebCore::WebGPUQueue::submit):

• Modules/webgpu/WebGPUQueue.h:
• Modules/webgpu/WebGPUShaderModule.cpp:

(WebCore::WebGPUShaderModule::create):
(WebCore::WebGPUShaderModule::WebGPUShaderModule):

• Modules/webgpu/WebGPUShaderModule.h:

(WebCore::WebGPUShaderModule::module const):

• platform/graphics/gpu/GPUBuffer.h:
• platform/graphics/gpu/GPUDevice.cpp:

(WebCore::GPUDevice::tryCreateBuffer):
(WebCore::GPUDevice::tryCreateTexture const):
(WebCore::GPUDevice::tryCreateShaderModule const):
(WebCore::GPUDevice::tryCreateRenderPipeline const):
(WebCore::GPUDevice::tryGetQueue const):
(WebCore::GPUDevice::createShaderModule const): Deleted.
(WebCore::GPUDevice::createRenderPipeline const): Deleted.
(WebCore::GPUDevice::getQueue const): Deleted.

• platform/graphics/gpu/GPUDevice.h:
• platform/graphics/gpu/GPUPipelineLayout.cpp:

(WebCore::GPUPipelineLayout::create):
(WebCore::GPUPipelineLayout::GPUPipelineLayout):

• platform/graphics/gpu/GPUPipelineLayout.h:

(WebCore::GPUPipelineLayout::bindGroupLayouts const):

• platform/graphics/gpu/GPUPipelineLayoutDescriptor.h:
• platform/graphics/gpu/GPURenderPipeline.h:
• platform/graphics/gpu/GPUShaderModule.h:
• platform/graphics/gpu/cocoa/GPUBufferMetal.mm:

(WebCore::GPUBuffer::tryCreate):
(WebCore::GPUBuffer::GPUBuffer):
(WebCore::GPUBuffer::setSubData):

• platform/graphics/gpu/cocoa/GPUCommandBufferMetal.mm:

(WebCore::GPUCommandBuffer::tryCreate):

• platform/graphics/gpu/cocoa/GPUDeviceMetal.mm:

(WebCore::GPUDevice::tryCreate):

• platform/graphics/gpu/cocoa/GPURenderPipelineMetal.mm:

(WebCore::GPURenderPipeline::tryCreate):
(WebCore::GPURenderPipeline::GPURenderPipeline):
(WebCore::GPURenderPipeline::create): Deleted.

• platform/graphics/gpu/cocoa/GPUShaderModuleMetal.mm:

(WebCore::GPUShaderModule::tryCreate):
(WebCore::GPUShaderModule::create): Deleted.

Add WebGPUPipelineLayoutDescriptor.cpp to project:

• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:

LayoutTests:

GPUShaderModule is no longer nullable.

• webgpu/shader-modules.html:

1:47 PM Changeset in webkit [243562] by Chris Dumez

• 2 edits in trunk/Source/WebKit

[ iOS Sim ] REGRESSION (r242277) Layout Test http/tests/cookies/same-site/lax-samesite-cookie-after-cross-site-history-load.php is a flaky timeout
​https://bugs.webkit.org/show_bug.cgi?id=195425
<rdar://problem/48682403>

Reviewed by Alex Christensen.

When process-swapping on history navigation, we lookup the WebProcessProxy we'd like to use from the
process identifier that is saved on the WebBackForwardListItem, to try and load the item in the process
in which it was previously loaded. However, we were failing to check if the WebProcess in question was
still running so we could potentially try to use a process that's already exited.

• UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::processForNavigationInternal):

1:29 PM Changeset in webkit [243561] by Shawn Roberts

• 4 edits
  2 deletes in trunk

Unreviewed, rolling out r243346.

Causing timeouts in animation tests across 10 builds

Reverted changeset:

"[Web Animations] JS wrapper may be deleted while animation is
yet to dispatch its finish event"
​https://bugs.webkit.org/show_bug.cgi?id=196118
​https://trac.webkit.org/changeset/243346

1:29 PM Changeset in webkit [243560] by ysuzuki@apple.com

• 24 edits
  2 moves
  1 add in trunk

[JSC] Owner of watchpoints should validate at GC finalizing phase
​https://bugs.webkit.org/show_bug.cgi?id=195827

Reviewed by Filip Pizlo.

JSTests:

• stress/gc-should-reap-dead-watchpoints.js: Added.

(foo):
(A.prototype.y):
(A):

Source/JavaScriptCore:

This patch fixes JSC's watchpoint liveness issue by the following two policies.

1. Watchpoint should have owner cell, and "fire" operation should be gaurded with owner cell's isLive check.

Watchpoints should hold its owner cell, and fire procedure should be guarded by owner->isLive().
When the owner cell is destroyed, these watchpoints are destroyed too. But this destruction can
be delayed due to incremental sweeper. So the following condition can happen.

When we have a watchpoint like the following.

class XXXWatchpoint {

ObjectPropertyCondition m_key;
JSCell* m_owner;

};

Both m_key's cell and m_owner is now unreachable from the root. So eventually, m_owner cell's destructor
is called and this watchpoint will be destroyed. But before that, m_key's cell can be destroyed. And this
watchpoint's fire procedure can be called since m_owner's destructor is not called yet. In this situation,
we encounter the destroyed cell held in m_key. This problem can be avoided if we guard fire procedure with
m_owner->isLive(). Until the owner cell is destroyed, this guard avoids "fire" procedure execution. And
once the destructor of m_owner is called, this watchpoint will be destroyed too.

2. Watchpoint liveness should be maintained by owner cell's unconditional finalizer

Watchpoints often hold weak references to the other cell (like, m_key in the above example). If we do not
delete watchpoints with dead cells when these weak cells become dead, these watchpoints continue holding dead cells,
and watchpoint's fire operation can use these dead cells accidentally. isLive / isStillLive check for these weak cells
in fire operation is not useful. Because these dead cells can be reused to the other live cells eventually, and this
isLive / isStillLive checks fail to see these cells are live if they are reused. Appropriate way is deleting watchpoints
with dead cells when finalizing GC. In this patch, we do this in unconditional finalizers in owner cells of watchpoints.
We already did this in CodeBlock etc. We add the same thing to StructureRareData which owns watchpoints for toString operations.

• JavaScriptCore.xcodeproj/project.pbxproj:
• Sources.txt:
• bytecode/AdaptiveInferredPropertyValueWatchpointBase.h:

(JSC::AdaptiveInferredPropertyValueWatchpointBase::StructureWatchpoint::StructureWatchpoint): Deleted.
(JSC::AdaptiveInferredPropertyValueWatchpointBase::PropertyWatchpoint::PropertyWatchpoint): Deleted.

• bytecode/CodeBlockJettisoningWatchpoint.h:

(JSC::CodeBlockJettisoningWatchpoint::CodeBlockJettisoningWatchpoint): Deleted.

• bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.cpp:

(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::LLIntPrototypeLoadAdaptiveStructureWatchpoint):
(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::fireInternal):

• bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h:

(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::key const): Deleted.

• bytecode/StructureStubClearingWatchpoint.cpp:

(JSC::StructureStubClearingWatchpoint::fireInternal):
(JSC::WatchpointsOnStructureStubInfo::isValid const):

• bytecode/StructureStubClearingWatchpoint.h:

(JSC::StructureStubClearingWatchpoint::StructureStubClearingWatchpoint): Deleted.

• dfg/DFGAdaptiveInferredPropertyValueWatchpoint.cpp:

(JSC::DFG::AdaptiveInferredPropertyValueWatchpoint::isValid const):

• dfg/DFGAdaptiveInferredPropertyValueWatchpoint.h:
• dfg/DFGAdaptiveStructureWatchpoint.cpp:

(JSC::DFG::AdaptiveStructureWatchpoint::fireInternal):

• dfg/DFGAdaptiveStructureWatchpoint.h:

(JSC::DFG::AdaptiveStructureWatchpoint::key const): Deleted.

• dfg/DFGDesiredWatchpoints.cpp:

(JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):

• heap/Heap.cpp:

(JSC::Heap::finalizeUnconditionalFinalizers):

• llint/LLIntSlowPaths.cpp:

(JSC::LLInt::setupGetByIdPrototypeCache):

• runtime/ArrayBuffer.cpp:

(JSC::ArrayBuffer::notifyIncommingReferencesOfTransfer):

• runtime/ArrayBufferNeuteringWatchpointSet.cpp: Renamed from Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.cpp.

(JSC::ArrayBufferNeuteringWatchpointSet::ArrayBufferNeuteringWatchpointSet):
(JSC::ArrayBufferNeuteringWatchpointSet::destroy):
(JSC::ArrayBufferNeuteringWatchpointSet::create):
(JSC::ArrayBufferNeuteringWatchpointSet::createStructure):
(JSC::ArrayBufferNeuteringWatchpointSet::fireAll):

• runtime/ArrayBufferNeuteringWatchpointSet.h: Renamed from Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.h.
• runtime/FunctionRareData.h:
• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::tryInstallArraySpeciesWatchpoint):

• runtime/ObjectPropertyChangeAdaptiveWatchpoint.h:

(JSC::ObjectPropertyChangeAdaptiveWatchpoint::ObjectPropertyChangeAdaptiveWatchpoint): Deleted.

• runtime/StructureRareData.cpp:

(JSC::StructureRareData::finalizeUnconditionally):

• runtime/StructureRareData.h:
• runtime/VM.cpp:

(JSC::VM::VM):

1:25 PM Changeset in webkit [243559] by ddkilzer@apple.com

• 13 edits in trunk/Tools

run-webkit-tests should check for leaks in WebKit processes
<​https://webkit.org/b/193772>
<rdar://problem/46526680>

Reviewed by Ryosuke Niwa.

This works by doing the following:

• Add a "#LIST CHILD PROCESSES" command to WebKitTestRunnner. The list of child processes are returned one per line: process.name: pid
• Run the "#LIST CHILD PROCESSES" command just before the "#CHECK FOR WORLD LEAKS" command, and store the list of child processes on the ServerProcess object.
• When the --leaks switch is handled, run check_for_leaks() on each child process after the main test harness.

• DumpRenderTree/mac/DumpRenderTree.mm:

(handleControlCommand):

• Use strncmp() instead of strcmp().
• Add support for handling "#LIST CHILD PROCESSES" command.

• Scripts/webkitpy/port/base.py:

(Port.check_for_leaks):

• Scripts/webkitpy/port/darwin.py:

(DarwinPort.check_for_leaks):

• Rename redundant 'process_pid' argument to 'process_id'.

• Scripts/webkitpy/port/driver.py:

(Driver.do_post_tests_work):

• Restructure the logic since "#CHECK FOR WORLD LEAKS" is no longer the only command this sends to WebKitTestRunner.
• If the --leaks switch is present, send the "#LIST CHILD PROCESSES" to WebKitTestRunner and store the result using Port.set_webkit_processes().

(Driver._parse_child_processes_output):

• Add helper method to parse list of child process names and process IDs returned from WebKitTestRunner.

• Scripts/webkitpy/port/ios_device.py:

(IOSDevicePort.check_for_leaks):

• Rename redundant 'process_pid' argument to 'process_id'.

• Scripts/webkitpy/port/leakdetector.py:

(LeakDetector._parse_leaks_output):

• Return early if there is no leaks_output.

(LeakDetector.check_for_leaks):

• Rename redundant 'process_pid' argument to 'process_id'.

• Scripts/webkitpy/port/server_process.py:

(ServerProcess.init):
(ServerProcess.child_processes):
(ServerProcess.set_child_processes):

• Add instance variable to Port to store list of child process names and process IDs returned from WebKitTestRunner.

(ServerProcess._start):

• Clear self._child_processes.

(ServerProcess.stop):

• If self._child_processes is set, call self._port.check_for_leaks() for each child process.

• Scripts/webkitpy/port/server_process_unittest.py:

(TrivialMockPort.check_for_leaks):

• Rename redundant 'process_pid' argument to 'process_id'.

• Scripts/webkitpy/port/simulator_process.py:

(SimulatorProcess.stop):

• If self._child_processes is set, call self._port.check_for_leaks() for each child process.

• Scripts/webkitpy/port/watch_device.py:

(WatchDevicePort.check_for_leaks):

• Rename redundant 'process_pid' argument to 'process_id'.

• WebKitTestRunner/TestController.cpp:

(WTR::TestController::dumpResponse):

• Extract method from findAndDumpWorldLeaks() so that it may be reused by findAndDumpWebKitProcessIdentifiers().

(WTR::TestController::findAndDumpWebKitProcessIdentifiers):

• Add method to output process name and process ID of both the WebContent and Networking processes.

(WTR::TestController::findAndDumpWorldLeaks):

• Fix missing newline in output when there were no abandoned documents.
• Call dumpResponse() for extracted code.

(WTR::TestController::handleControlCommand):

• Restructure the logic for "#CHECK FOR WORLD LEAKS".
• Use strncmp() instead of strcmp().
• Call findAndDumpWebKitProcessIdentifiers() when "#LIST CHILD PROCESSES" command is sent.
• WebKitTestRunner/TestController.h:

(WTR::TestController::dumpResponse):
(WTR::TestController::findAndDumpWebKitProcessIdentifiers):

• Declare methods.

12:56 PM Changeset in webkit [243558] by Chris Dumez

• 2 edits in trunk/LayoutTests

[ iOS Simulator ] REGRESSION (r237702) Layout Test http/tests/security/xss-DENIED-script-inject-into-inactive-window.html is a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=195385
<rdar://problem/48657425>

Reviewed by Alex Christensen.

Before r237702, the test used to detect that _openedWindowDocument had become frameless (i.e. lost its browsing context)
by checking if _openedWindowDocument.location.href is the empty String. However, r237702 updating Location to return
"about:blank" instead of "" when frameless, to match the latest specification. As a result, I had updated the test to
expect _openedWindowDocument.location.href to be "about:blank". However, I had not noticed that the document's initial
URL (while it had a browsing context) was also "about:blank". Therefore, checking that location.href is "about:blank"
would actually not guarantee that the document has no browsing context.

To address the issue, check that _openedWindowDocument.defaultView is null instead since this is guaranteed to be null
for Documents that do not have a browsing context as per:

• ​https://html.spec.whatwg.org/multipage/window-object.html#dom-document-defaultview

• http/tests/security/xss-DENIED-script-inject-into-inactive-window.html:

12:41 PM Changeset in webkit [243557] by Alan Bujtas

• 2 edits in trunk/Source/WebKit

[ContentChangeObserver] Always dispatch the synthetic click asynchronously
​https://bugs.webkit.org/show_bug.cgi?id=196278
<rdar://problem/49299968>

Reviewed by Simon Fraser.

This patch ensures that all completeSyntheticClick() calls happen in an asynchronous manner (unless the feature is turned off).

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::dispatchSyntheticMouseMove):
(WebKit::WebPage::handleSyntheticClick):

12:05 PM Changeset in webkit [243556] by Alan Bujtas

• 6 edits
  3 adds in trunk

[ContentChangeObserver] Stop using the global _WKContentChange
​https://bugs.webkit.org/show_bug.cgi?id=196288
<rdar://problem/49228081>

Reviewed by Simon Fraser.

Source/WebCore:

This patch ensures that activities on frames don't overwrite the observed state on other frames.
(Unfortunately the global variable is still used in WebKitLegacy (see webkit.org/b/196286)).

Tests: fast/events/touch/ios/content-observation/remove-subframe-while-observing.html

fast/events/touch/ios/content-observation/subframe.html

• page/ios/ContentChangeObserver.cpp:

(WebCore::ContentChangeObserver::observedContentChange const): Deleted.

• page/ios/ContentChangeObserver.h:

(WebCore::ContentChangeObserver::observedContentChange const):
(WebCore::ContentChangeObserver::setHasNoChangeState):
(WebCore::ContentChangeObserver::setHasIndeterminateState):
(WebCore::ContentChangeObserver::setHasVisibleChangeState):
(WebCore::ContentChangeObserver::setObservedContentState):

LayoutTests:

• fast/events/touch/ios/content-observation/remove-subframe-while-observing-expected.txt: Added.
• fast/events/touch/ios/content-observation/remove-subframe-while-observing.html: Added.
• fast/events/touch/ios/content-observation/subframe.html: Added.
• platform/ios-device-wk1/TestExpectations:
• platform/ios-simulator-wk1/TestExpectations:

11:56 AM Changeset in webkit [243555] by commit-queue@webkit.org

• 35 edits
  2 adds
  33 deletes in trunk

Remove the SVG tear off objects for SVGPathSeg, SVGPathSegList and SVGAnimatedPathSegList
​https://bugs.webkit.org/show_bug.cgi?id=196085

Patch by Said Abou-Hallawa <​sabouhallawa@apple.com> on 2019-03-27
Reviewed by Simon Fraser.

Source/WebCore:

The SVGPathSegList is similar to the other SVGLists, e.g. SVGNUmberList
and SVGPointList except in two things:

1. Its items can be different but they are derived from the same base class SVGPathSeg.

2. The SVGPathSeg items are only used for DOM. When drawing or animating we have to have an SVGPathByteStream and convert it to a Path. Converting an SVGPathByteStream to SVGPathSeg items and vice versa is expensive. Building a Path from an SVGPathByteStream is also expensive. So an extra care needs to be taken for when these conversions happen.

In addition to handling the SVGPathSeg items, SVGPathSegList will manage
the associated SVGPathByteStream and Path objects. SVGPathSegList will be
lazy in getting updated objects when a change happens. For example, when
the byte stream changes, SVGPathSegList will clear its items and nullify
the Path object. But it will not build any of them until they are explicitly
requested.

Like what was done for other SVG properties when removing their tear off
objects, a new accessor, a new animator and a new animation function will
be added for the SVGAnimatedPathSegList.

All the header files of the concrete classes of SVGPathSeg will be removed
because they are small structures which hold some data items and they provide
setters and getters for these items. Here is the new file structures and
their contents:

-- SVGPathSeg.h still has the class SVGPathSeg which is now a superclass

of SVGProperty.

-- SVGPathSegValue.h will have the template class SVGPathSegValue which

holds an std::tuple of packed arguments. It provides setters and getters
for these arguments. SVGPathSegValue.h will also have specialized
classed derived from SVGPathSegValue and hold different arguments.

-- SVGPathSegImpl.h will have the final concrete SVGPathSeg classes.

Note SVGPathSeg concrete classes do not need to have a reference to the
the context SVGPathElement. SVGPathSeg will be owned by its SVGPathSegList
which will be owned by the SVGAnimatedPathSegList which will be owned by
the SVGPathElement.

• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:
• bindings/js/JSSVGPathSegCustom.cpp:
• bindings/scripts/CodeGenerator.pm:

(IsSVGPathSegTypeName):
(IsSVGPathSegType):

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):

• rendering/svg/SVGPathData.cpp:

(WebCore::pathFromPathElement):

• svg/SVGAnimatedPath.cpp: Removed.
• svg/SVGAnimatedPath.h: Removed.
• svg/SVGAnimatedType.h:

(WebCore::SVGAnimatedType::type const):

• svg/SVGAnimatorFactory.h:

(WebCore::SVGAnimatorFactory::create):

• svg/SVGPathByteStream.h:

(WebCore::SVGPathByteStream::SVGPathByteStream):
This constructor is used by SVGAnimationPathSegListFunction to convert
the 'form', 'to' and 'toAtEndOfDuration' strings to SVGPathByteStreams.

(WebCore::SVGPathByteStream::resize): Deleted.
(WebCore::SVGPropertyTraits<SVGPathByteStream>::initialValue): Deleted.
(WebCore::SVGPropertyTraits<SVGPathByteStream>::fromString): Deleted.
(WebCore::SVGPropertyTraits<SVGPathByteStream>::parse): Deleted.
(WebCore::SVGPropertyTraits<SVGPathByteStream>::toString): Deleted.

• svg/SVGPathElement.cpp:

(WebCore::SVGPathElement::SVGPathElement):
(WebCore::SVGPathElement::parseAttribute):
(WebCore::SVGPathElement::svgAttributeChanged):
(WebCore::SVGPathElement::getTotalLength const):
(WebCore::SVGPathElement::getPointAtLength const):
(WebCore::SVGPathElement::getPathSegAtLength const):
(WebCore::SVGPathElement::createSVGPathSegClosePath): Deleted.
(WebCore::SVGPathElement::createSVGPathSegMovetoAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegMovetoRel): Deleted.
(WebCore::SVGPathElement::createSVGPathSegLinetoAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegLinetoRel): Deleted.
(WebCore::SVGPathElement::createSVGPathSegCurvetoCubicAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegCurvetoCubicRel): Deleted.
(WebCore::SVGPathElement::createSVGPathSegCurvetoQuadraticAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegCurvetoQuadraticRel): Deleted.
(WebCore::SVGPathElement::createSVGPathSegArcAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegArcRel): Deleted.
(WebCore::SVGPathElement::createSVGPathSegLinetoHorizontalAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegLinetoHorizontalRel): Deleted.
(WebCore::SVGPathElement::createSVGPathSegLinetoVerticalAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegLinetoVerticalRel): Deleted.
(WebCore::SVGPathElement::createSVGPathSegCurvetoCubicSmoothAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegCurvetoCubicSmoothRel): Deleted.
(WebCore::SVGPathElement::createSVGPathSegCurvetoQuadraticSmoothAbs): Deleted.
(WebCore::SVGPathElement::createSVGPathSegCurvetoQuadraticSmoothRel): Deleted.
The SVGPathSeg creation functions are moved to the header file.

(WebCore::SVGPathElement::registerAttributes): Deleted.
(WebCore::SVGPathElement::pathByteStream const): Deleted.
(WebCore::SVGPathElement::pathForByteStream const): Deleted.
(WebCore::SVGPathElement::lookupOrCreateDWrapper): Deleted.
(WebCore::SVGPathElement::animatedPropertyWillBeDeleted): Deleted.
(WebCore::SVGPathElement::pathSegList): Deleted.
(WebCore::SVGPathElement::normalizedPathSegList): Deleted.
(WebCore::SVGPathElement::animatedPathSegList): Deleted.
(WebCore::SVGPathElement::animatedNormalizedPathSegList): Deleted.
(WebCore::SVGPathElement::approximateMemoryCost const): Deleted.
(WebCore::SVGPathElement::pathSegListChanged): Deleted.
Managing the SVGPathByteStream and the drawing Path objects will be the
responsibility of SVGPathSegList.

• svg/SVGPathElement.h:
• svg/SVGPathSeg.h:
• svg/SVGPathSegArc.h: Removed.
• svg/SVGPathSegArcAbs.h: Removed.
• svg/SVGPathSegArcRel.h: Removed.
• svg/SVGPathSegClosePath.h: Removed.
• svg/SVGPathSegCurvetoCubic.h: Removed.
• svg/SVGPathSegCurvetoCubicAbs.h: Removed.
• svg/SVGPathSegCurvetoCubicRel.h: Removed.
• svg/SVGPathSegCurvetoCubicSmooth.h: Removed.
• svg/SVGPathSegCurvetoCubicSmoothAbs.h: Removed.
• svg/SVGPathSegCurvetoCubicSmoothRel.h: Removed.
• svg/SVGPathSegCurvetoQuadratic.h: Removed.
• svg/SVGPathSegCurvetoQuadraticAbs.h: Removed.
• svg/SVGPathSegCurvetoQuadraticRel.h: Removed.
• svg/SVGPathSegCurvetoQuadraticSmoothAbs.h: Removed.
• svg/SVGPathSegCurvetoQuadraticSmoothRel.h: Removed.
• svg/SVGPathSegImpl.h: Added.
• svg/SVGPathSegLinetoAbs.h: Removed.
• svg/SVGPathSegLinetoHorizontal.h: Removed.
• svg/SVGPathSegLinetoHorizontalAbs.h: Removed.
• svg/SVGPathSegLinetoHorizontalRel.h: Removed.
• svg/SVGPathSegLinetoRel.h: Removed.
• svg/SVGPathSegLinetoVertical.h: Removed.
• svg/SVGPathSegLinetoVerticalAbs.h: Removed.
• svg/SVGPathSegLinetoVerticalRel.h: Removed.

The definition of these classes are now in SVGPathSegImpl.h.

• svg/SVGPathSegList.cpp: Removed.
• svg/SVGPathSegList.h:
• svg/SVGPathSegListBuilder.cpp:

(WebCore::SVGPathSegListBuilder::SVGPathSegListBuilder):
(WebCore::SVGPathSegListBuilder::moveTo):
(WebCore::SVGPathSegListBuilder::lineTo):
(WebCore::SVGPathSegListBuilder::lineToHorizontal):
(WebCore::SVGPathSegListBuilder::lineToVertical):
(WebCore::SVGPathSegListBuilder::curveToCubic):
(WebCore::SVGPathSegListBuilder::curveToCubicSmooth):
(WebCore::SVGPathSegListBuilder::curveToQuadratic):
(WebCore::SVGPathSegListBuilder::curveToQuadraticSmooth):
(WebCore::SVGPathSegListBuilder::arcTo):
(WebCore::SVGPathSegListBuilder::closePath):

• svg/SVGPathSegListBuilder.h:

The concrete SVGPathSeg classes can now create instances of their classes
without having to go through the SVGPathElement.

• svg/SVGPathSegListSource.cpp:

(WebCore::SVGPathSegListSource::SVGPathSegListSource):

• svg/SVGPathSegListSource.h:
• svg/SVGPathSegListValues.cpp: Removed.
• svg/SVGPathSegListValues.h: Removed.
• svg/SVGPathSegMovetoAbs.h: Removed.
• svg/SVGPathSegMovetoRel.h: Removed.
• svg/SVGPathSegValue.h: Added.

(WebCore::SVGPathSegValue::create):
(WebCore::SVGPathSegValue::clone const):
(WebCore::SVGPathSegValue::SVGPathSegValue):
(WebCore::SVGPathSegValue::argument const):
(WebCore::SVGPathSegValue::setArgument):
(WebCore::SVGPathSegLinetoHorizontal::x const):
(WebCore::SVGPathSegLinetoHorizontal::setX):
(WebCore::SVGPathSegLinetoVertical::y const):
(WebCore::SVGPathSegLinetoVertical::setY):
(WebCore::SVGPathSegSingleCoordinate::x const):
(WebCore::SVGPathSegSingleCoordinate::setX):
(WebCore::SVGPathSegSingleCoordinate::y const):
(WebCore::SVGPathSegSingleCoordinate::setY):
(WebCore::SVGPathSegCurvetoQuadratic::x const):
(WebCore::SVGPathSegCurvetoQuadratic::setX):
(WebCore::SVGPathSegCurvetoQuadratic::y const):
(WebCore::SVGPathSegCurvetoQuadratic::setY):
(WebCore::SVGPathSegCurvetoQuadratic::x1 const):
(WebCore::SVGPathSegCurvetoQuadratic::setX1):
(WebCore::SVGPathSegCurvetoQuadratic::y1 const):
(WebCore::SVGPathSegCurvetoQuadratic::setY1):
(WebCore::SVGPathSegCurvetoCubicSmooth::x const):
(WebCore::SVGPathSegCurvetoCubicSmooth::setX):
(WebCore::SVGPathSegCurvetoCubicSmooth::y const):
(WebCore::SVGPathSegCurvetoCubicSmooth::setY):
(WebCore::SVGPathSegCurvetoCubicSmooth::x2 const):
(WebCore::SVGPathSegCurvetoCubicSmooth::setX2):
(WebCore::SVGPathSegCurvetoCubicSmooth::y2 const):
(WebCore::SVGPathSegCurvetoCubicSmooth::setY2):
(WebCore::SVGPathSegCurvetoCubic::x const):
(WebCore::SVGPathSegCurvetoCubic::setX):
(WebCore::SVGPathSegCurvetoCubic::y const):
(WebCore::SVGPathSegCurvetoCubic::setY):
(WebCore::SVGPathSegCurvetoCubic::x1 const):
(WebCore::SVGPathSegCurvetoCubic::setX1):
(WebCore::SVGPathSegCurvetoCubic::y1 const):
(WebCore::SVGPathSegCurvetoCubic::setY1):
(WebCore::SVGPathSegCurvetoCubic::x2 const):
(WebCore::SVGPathSegCurvetoCubic::setX2):
(WebCore::SVGPathSegCurvetoCubic::y2 const):
(WebCore::SVGPathSegCurvetoCubic::setY2):
(WebCore::SVGPathSegArc::x const):
(WebCore::SVGPathSegArc::setX):
(WebCore::SVGPathSegArc::y const):
(WebCore::SVGPathSegArc::setY):
(WebCore::SVGPathSegArc::r1 const):
(WebCore::SVGPathSegArc::setR1):
(WebCore::SVGPathSegArc::r2 const):
(WebCore::SVGPathSegArc::setR2):
(WebCore::SVGPathSegArc::angle const):
(WebCore::SVGPathSegArc::setAngle):
(WebCore::SVGPathSegArc::largeArcFlag const):
(WebCore::SVGPathSegArc::setLargeArcFlag):
(WebCore::SVGPathSegArc::sweepFlag const):
(WebCore::SVGPathSegArc::setSweepFlag):

• svg/SVGPathSegWithContext.h: Removed.

• svg/SVGPathUtilities.cpp:

(WebCore::buildSVGPathByteStreamFromSVGPathSegList):
(WebCore::buildSVGPathSegListFromByteStream):
(WebCore::buildStringFromByteStream):
(WebCore::buildSVGPathByteStreamFromSVGPathSegListValues): Deleted.
(WebCore::appendSVGPathByteStreamFromSVGPathSeg): Deleted.
(WebCore::buildSVGPathSegListValuesFromByteStream): Deleted.
(WebCore::buildStringFromSVGPathSegListValues): Deleted.

• svg/SVGPathUtilities.h:

Since the class SVGPathSegListValues is removed, all the parsing functions
have now to deal with SVGPathSegList directly.

• svg/SVGPoint.h:
• svg/SVGValue.h:
• svg/properties/SVGAnimatedPathSegListPropertyTearOff.cpp: Removed.
• svg/properties/SVGAnimatedPathSegListPropertyTearOff.h: Removed.
• svg/properties/SVGAnimatedPropertyAccessorImpl.h:
• svg/properties/SVGAnimatedPropertyAnimatorImpl.h:
• svg/properties/SVGAnimatedPropertyImpl.h:

(WebCore::SVGAnimatedPathSegList::create):
(WebCore::SVGAnimatedPathSegList::currentPathByteStream):
(WebCore::SVGAnimatedPathSegList::currentPath):
(WebCore::SVGAnimatedPathSegList::approximateMemoryCost const):
Provides an easy way to access the current SVGPathByteStream and Path
objects from the SVGAnimatedPathSegList.

• svg/properties/SVGAnimationAdditiveValueFunctionImpl.h:

(WebCore::SVGAnimationPathSegListFunction::progress):

• svg/properties/SVGPropertyOwnerRegistry.h:

(WebCore::SVGPropertyOwnerRegistry::registerProperty):

LayoutTests:

• svg/dom/SVGPathSegList-appendItem-expected.txt:
• svg/dom/SVGPathSegList-appendItem.xhtml:
• svg/dom/SVGPathSegList-clear-and-initialize-expected.txt:
• svg/dom/SVGPathSegList-clear-and-initialize.xhtml:
• svg/dom/SVGPathSegList-insertItemBefore-expected.txt:
• svg/dom/SVGPathSegList-insertItemBefore.xhtml:
• svg/dom/SVGPathSegList-replaceItem-expected.txt:
• svg/dom/SVGPathSegList-replaceItem.xhtml:

These changes are required because SVGPathSegList will be following the SVG2
specs regarding adding new items to the list.

See ​https://www.w3.org/TR/SVG/types.html#TermListInterface.

11:33 AM Changeset in webkit [243554] by Shawn Roberts

• 3 edits in trunk/LayoutTests

http/tests/resourceLoadStatistics/website-data-removal-for-site-navigated-to-with-link-decoration.html is a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=196307

Unreviewed test gardening.

• platform/ios-simulator-wk2/TestExpectations:
• platform/mac-wk2/TestExpectations: Marking test as flaky while waiting for a fix

11:22 AM Changeset in webkit [243553] by timothy_horton@apple.com

• 10 edits
  2 deletes in trunk/Source/WebKit

Fix some more deprecation warnings in WKDrawingView
​https://bugs.webkit.org/show_bug.cgi?id=196282
<rdar://problem/47637608>

Reviewed by Wenson Hsieh.

• Platform/spi/ios/PencilKitSPI.h:
• SourcesCocoa.txt:
• UIProcess/ios/PencilKitSoftLink.h:
• UIProcess/ios/PencilKitSoftLink.mm:
• UIProcess/ios/WKContentViewInteraction.mm:
• UIProcess/ios/WKDrawingCoordinator.h:
• UIProcess/ios/WKDrawingCoordinator.mm:

(-[WKDrawingCoordinator initWithContentView:]):
(-[WKDrawingCoordinator currentInk]):
(-[WKDrawingCoordinator undoManagerForInkPicker:]):
(-[WKDrawingCoordinator containingViewForInkPicker:]):
(-[WKDrawingCoordinator inkPickerDidToggleRuler:]):
(-[WKDrawingCoordinator inkPickerDidChangeInk:]):
(-[WKDrawingCoordinator installInkPickerForDrawing:]):
(-[WKDrawingCoordinator uninstallInkPicker]):
(-[WKDrawingCoordinator inkPicker]): Deleted.
(-[WKDrawingCoordinator didChangeRulerState:]): Deleted.
(-[WKDrawingCoordinator didChangeInk:]): Deleted.

• UIProcess/ios/WKDrawingView.mm:

(-[WKDrawingView _canvasViewWillBeginDrawing:]):

• UIProcess/ios/WKInkPickerView.h: Removed.
• UIProcess/ios/WKInkPickerView.mm: Removed.
• WebKit.xcodeproj/project.pbxproj:

Adopt the new names.

11:22 AM Changeset in webkit [243552] by Ryan Haddad

• 2 edits in trunk/Source/WebCore

AVAudioSessionRouteSharingPolicyLongForm has been deprecated
​https://bugs.webkit.org/show_bug.cgi?id=196301

Unrereivewed build fix.

• platform/audio/ios/AudioSessionIOS.mm:

(WebCore::AudioSession::setCategory):
(WebCore::AudioSession::routeSharingPolicy const):

11:10 AM Changeset in webkit [243551] by Chris Dumez

• 14 edits in trunk

XMLHttpRequestUpload's loadstart event not correct initialized
​https://bugs.webkit.org/show_bug.cgi?id=196174
<rdar://problem/49191412>

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

• web-platform-tests/xhr/event-error-order.sub.html:

Update test after ​https://github.com/web-platform-tests/wpt/pull/13365

• web-platform-tests/xhr/abort-during-upload-expected.txt:
• web-platform-tests/xhr/event-error-order.sub-expected.txt:
• web-platform-tests/xhr/event-loadstart-upload-expected.txt:
• web-platform-tests/xhr/event-timeout-order-expected.txt:
• web-platform-tests/xhr/send-response-event-order-expected.txt:

Rebaseline several WPT tests that are now passing.

Source/WebCore:

Align progress event firing with the XHR specification.

No new tests, rebaselined existing tests.

• xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::createRequest):
As per [1], the loadstart event fired on the XMLHttpRequestUpload object should use
loaded=0 and total=req’s body’s total bytes.
[1] ​https://xhr.spec.whatwg.org/#the-send()-method (step 11.2.)

(WebCore::XMLHttpRequest::didSendData):
As per [2], the progress / load / loadend should use loaded=transmitted and total=length.
[2] ​https://xhr.spec.whatwg.org/#ref-for-process-request-end-of-body (steps 5, 6 and 7)

(WebCore::XMLHttpRequest::didReceiveData):
As per [3], we should fire the readystatechange event *before* the progress event.
This is covered by web-platform-tests/xhr/send-response-event-order.htm which was failing
differently after the other changes in this patch.
[3] ​https://xhr.spec.whatwg.org/#ref-for-process-response (steps 9.4 and 9.5)

(WebCore::XMLHttpRequest::dispatchErrorEvents):
As per [4], in case of an error, we should fire the provided 'event' and 'loadend' with
loaded=0 and total=0.
[4] ​https://xhr.spec.whatwg.org/#request-error-steps (steps 7 and 8)

• xml/XMLHttpRequestUpload.cpp:

(WebCore::XMLHttpRequestUpload::dispatchProgressEvent):

• xml/XMLHttpRequestUpload.h:

Simplify XMLHttpRequestUpload. It no longer needs to store loaded / total as data
members now that they are always passed by the call site. lengthComputable is set
to !!total as [5] says to set it to true if length/total is not 0.
[5] ​https://xhr.spec.whatwg.org/#concept-event-fire-progress

11:06 AM Changeset in webkit [243550] by Simon Fraser

• 3 edits
  2 adds in trunk

REGRESSION (r242687): Fullscreen YouTube videos show blank white space at top
​https://bugs.webkit.org/show_bug.cgi?id=196304
rdar://problem/49175760

Reviewed by Zalan Bujtas.

Source/WebCore:

repositionRelatedLayers() should not short-circuit when topContentInset is zero,
because topContentInset might be changing from non-zero to zero, and then we need
to move layers around.

Test: scrollingcoordinator/mac/top-content-inset-to-zero.html

• page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:

(WebCore::ScrollingTreeFrameScrollingNodeMac::repositionRelatedLayers):

LayoutTests:

• scrollingcoordinator/mac/top-content-inset-to-zero-expected.html: Added.
• scrollingcoordinator/mac/top-content-inset-to-zero.html: Added.

10:59 AM Changeset in webkit [243549] by Shawn Roberts

• 2 edits in trunk/LayoutTests

http/tests/cache/disk-cache/memory-cache-revalidation-updates-disk-cache.html is a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=16297

Unreviewed test gardening.

• platform/ios-simulator-wk2/TestExpectations: Updated test expectations to include iOS Simulator

9:42 AM Changeset in webkit [243548] by Shawn Roberts

• 2 edits in trunk/LayoutTests

fast/viewport/ios/use-minimum-device-width-for-page-without-viewport-meta.html is a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=196298

Unreviewed test gardening

• platform/ios-simulator-wk2/TestExpectations: Updating test expectation for flaky failure

9:37 AM Changeset in webkit [243547] by Shawn Roberts

• 2 edits in trunk/LayoutTests

fast/visual-viewport/ios/min-scale-greater-than-one.html is a flaky failure
​https://bugs.webkit.org/show_bug.cgi?id=196300

Unreviewed test gardening.

• platform/ios-simulator-wk2/TestExpectations: Updating test expectation for flaky failure

9:33 AM Changeset in webkit [243546] by Alan Coon

• 7 edits in tags/Safari-608.1.14/Source

Versioning.

9:31 AM Changeset in webkit [243545] by Alan Coon

• 1 copy in tags/Safari-608.1.14

Tag Safari-608.1.14.

9:12 AM Changeset in webkit [243544] by pvollan@apple.com

• 4 edits in trunk

Layout Test js/math-clz32.html is failing
​https://bugs.webkit.org/show_bug.cgi?id=196209

Reviewed by Ross Kirsling.

Source/WTF:

Use the correct number of loop iterations when counting leading zeros. Also, the
count was off by one for the Win64 case.

• wtf/MathExtras.h:

(WTF::clz):

LayoutTests:

• platform/win/TestExpectations:

8:46 AM Changeset in webkit [243543] by Alan Coon

• 4 edits in tags/Safari-608.1.13.2/Source/WebKit

Cherry-pick r243454. rdar://problem/48702444

Animated keyboard scrolling is extremely chaotic
​https://bugs.webkit.org/show_bug.cgi?id=196164
<rdar://problem/48702444>

Reviewed by Simon Fraser.

• UIProcess/ios/WKContentViewInteraction.mm: (-[WKContentView _interpretKeyEvent:isCharEvent:]): Consume keyboard events instead of interpreting them traditionally if WKKeyboardScrollingAnimator is animating.

• UIProcess/ios/WKKeyboardScrollingAnimator.h:
• UIProcess/ios/WKKeyboardScrollingAnimator.mm: (-[WKKeyboardScrollingAnimator beginWithEvent:]): (-[WKKeyboardScrollingAnimator handleKeyEvent:]): (-[WKKeyboardScrollingAnimator stopAnimatedScroll]): (-[WKKeyboardScrollingAnimator scrollTriggeringKeyIsPressed]): (-[WKKeyboardScrollingAnimator displayLinkFired:]): (-[WKKeyboardScrollViewAnimator scrollTriggeringKeyIsPressed]): Expose the current state of interactive scrolling, and rename the related member.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243454 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:29 AM Changeset in webkit [243542] by Alan Coon

• 7 edits in tags/Safari-608.1.13.2/Source

Versioning.

8:22 AM Changeset in webkit [243541] by sbarati@apple.com

• 4 edits in trunk

Unreviewed. Fix individual benchmark description urls to go to in-depth.html instead of about.html

PerformanceTests:

• JetStream2/JetStreamDriver.js:

(Driver.prototype.prepareToRun.text.div.id.string_appeared_here.h3):

Websites/browserbench.org:

• JetStream2.0/JetStreamDriver.js:

(Driver.prototype.prepareToRun.text.div.id.string_appeared_here.h3):

8:22 AM Changeset in webkit [243540] by Alan Coon

• 1 copy in tags/Safari-608.1.13.2

New tag.

8:22 AM Changeset in webkit [243539] by Simon Fraser

• 9 edits
  2 adds in trunk

[iOS WK2] Fixed elements in frames can be misplaced sometimes
​https://bugs.webkit.org/show_bug.cgi?id=196290

Reviewed by Frédéric Wang.

Source/WebCore:

In a page containing position:fixed inside an async-scrolling iframe, if the
main page is scrolled down, and you reload, then the fixed element in the iframe can
get misplaced or disappear.

The bug was that the reconcileViewportConstrainedLayerPositions() recursive state node
walk would cross frame boundaries, hitting subframe ScrollingStateFixedNodes with a viewport rect
for the main page.

Fix by giving ScrollingStateTree the responsibility for the recursive tree walk, and
have it bail at at frame boundaries.

Test: scrollingcoordinator/ios/fixed-in-frame-layer-reconcile-layer-position.html

• page/scrolling/AsyncScrollingCoordinator.cpp:

(WebCore::AsyncScrollingCoordinator::reconcileViewportConstrainedLayerPositions):

• page/scrolling/ScrollingStateFixedNode.cpp:

(WebCore::ScrollingStateFixedNode::reconcileLayerPositionForViewportRect):

• page/scrolling/ScrollingStateNode.cpp:

(WebCore::ScrollingStateNode::reconcileLayerPositionForViewportRect): Deleted.

• page/scrolling/ScrollingStateNode.h:

(WebCore::ScrollingStateNode::reconcileLayerPositionForViewportRect):

• page/scrolling/ScrollingStateStickyNode.cpp:

(WebCore::ScrollingStateStickyNode::reconcileLayerPositionForViewportRect):

• page/scrolling/ScrollingStateTree.cpp:

(WebCore::ScrollingStateTree::reconcileLayerPositionsRecursive):
(WebCore::ScrollingStateTree::reconcileViewportConstrainedLayerPositions):

• page/scrolling/ScrollingStateTree.h:

LayoutTests:

• scrollingcoordinator/ios/fixed-in-frame-layer-reconcile-layer-position-expected.txt: Added.
• scrollingcoordinator/ios/fixed-in-frame-layer-reconcile-layer-position.html: Added.

5:15 AM WebKitGTK/2.24.x edited by Philippe Normand

(diff)

5:14 AM Changeset in webkit [243538] by Philippe Normand

• 2 edits in trunk/Source/WebCore

Build failure with gstreamer 1.12.5 if USE_GSTREAMER_GL is enabled
​https://bugs.webkit.org/show_bug.cgi?id=196178

Reviewed by Xabier Rodriguez-Calvar.

The gst/gl/gl.h header needs to be included before
GraphicsContext3D.h to avoid declaration conflicts with
OpenGLShims.

Based on a patch from Mike Gorse <​mgorse@suse.com>

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::GstVideoFrameHolder::GstVideoFrameHolder):

4:34 AM Changeset in webkit [243537] by Philippe Normand

• 4 edits in trunk/Source/WebCore

[GStreamer] Remove the HLS queue buffering query hack
​https://bugs.webkit.org/show_bug.cgi?id=196244

Reviewed by Xabier Rodriguez-Calvar.

Because the http src element now provides network statistics to
the player we can now compute an estimation of the data loading in
case the buffering query isn't handled by any element of the
pipeline.

No new tests, existing HLS tests cover this change.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::fillTimerFired):
(WebCore::findHLSQueue): Deleted.
(WebCore::isHLSProgressing): Deleted.

4:34 AM Changeset in webkit [243536] by Adrian Perez de Castro

• 1 copy in releases/WPE WebKit/webkit-2.24.0

WPE WebKit 2.24.0

4:34 AM Changeset in webkit [243535] by Adrian Perez de Castro

• 4 edits in releases/WebKitGTK/webkit-2.24

Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.24.0 release

.:

• Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

• wpe/NEWS: Add release notes for 2.24.0

3:59 AM Changeset in webkit [243534] by Carlos Garcia Campos

• 3 edits in trunk/Tools

Unreviewed. Add GLib API test cases after r243434.

• TestWebKitAPI/Tests/WebKitGLib/TestLoaderClient.cpp:

(testWebViewActiveURI):
(serverCallback):

• TestWebKitAPI/Tests/WebKitGLib/WebExtensionTest.cpp:

(sendRequestCallback):

2:36 AM Changeset in webkit [243533] by Carlos Garcia Campos

• 6 edits in trunk

Geolocation request not complete when watch request was started in a different web process
​https://bugs.webkit.org/show_bug.cgi?id=195996

Reviewed by Alex Christensen.

Source/WebKit:

In WebGeolocationManagerProxy::startUpdating() we do nothing when the provider is already updating. We should
reply with a DidChangePosition using the last known position, if available. If we are updating, but we still
don't have a known position, the request will be completed when
WebGeolocationManagerProxy::providerDidChangePosition() is called since it always notifies all web
processes.

• UIProcess/WebGeolocationManagerProxy.cpp:

(WebKit::WebGeolocationManagerProxy::providerDidChangePosition): Cache the position.
(WebKit::WebGeolocationManagerProxy::startUpdating): Reply using cached position if already known.

• UIProcess/WebGeolocationManagerProxy.h:

(WebKit::WebGeolocationManagerProxy::lastPosition const): Return cached position.

• WebProcess/WebCoreSupport/WebGeolocationClient.cpp:

(WebKit::WebGeolocationClient::lastPosition): Remove the FIXME since we don't want this feature.

Tools:

Add a test case.

• TestWebKitAPI/Tests/WebKit/Geolocation.cpp:

(TestWebKitAPI::runJavaScriptAlert):
(TestWebKitAPI::TEST):

Mar 26, 2019:

6:05 PM Changeset in webkit [243532] by Said Abou-Hallawa

• 2 edits in trunk/Source/WebCore

Unreviewed Windows build fix
​https://bugs.webkit.org/show_bug.cgi?id=196083
<rdar://problem/49121836>

• svg/SVGAnimatorFactory.h:

(WebCore::SVGAnimatorFactory::isSupportedAttributeType):

5:55 PM Changeset in webkit [243531] by Brent Fulgham

• 2 edits in trunk/Source/WebKit

[macOS] Correct kerberos-related sandbox violations
​https://bugs.webkit.org/show_bug.cgi?id=196279
<rdar://problem/48622502>

Reviewed by Per Arne Vollan.

We need to allow communications with a Kerberos-related service on macOS
until <rdar://problem/35542803> is fixed.

• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:

5:08 PM Changeset in webkit [243530] by sbarati@apple.com

• 3 edits in trunk/Source/JavaScriptCore

FTL: Emit code to validate AI's state when running the compiled code
​https://bugs.webkit.org/show_bug.cgi?id=195924
<rdar://problem/49003422>

Reviewed by Filip Pizlo.

This patch adds code that between the execution of each node that validates
the types that AI proves. This option is too expensive to turn on for our
regression testing, but we think it will be valuable in other types of running
modes, such as when running with a fuzzer.

This patch also adds options to only probabilistically run this validation
after the execution of each node. As the probability is lowered, there is
less of a perf hit.

This patch just adds this validation in the FTL. A follow-up patch will land
it in the DFG too: ​https://bugs.webkit.org/show_bug.cgi?id=196219

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::LowerDFGToB3):
(JSC::FTL::DFG::LowerDFGToB3::compileBlock):
(JSC::FTL::DFG::LowerDFGToB3::validateAIState):
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::lowJSValue):

• runtime/Options.h:

5:02 PM Changeset in webkit [243529] by dinfuehr@igalia.com

• 2 edits in trunk/JSTests

Skip WebAssembly test on 32-bit systems
​https://bugs.webkit.org/show_bug.cgi?id=196206

Reviewed by Saam Barati.

Invoking runDefault executes test immediately even though
that test should be skipped due to missing WASM support.
Therefore remove runDefault.

• wasm/regress/web-assembly-link-error-exception-check.js:

4:54 PM Changeset in webkit [243528] by Chris Dumez

• 5 edits in trunk/Source/WebKit

[macOS] The network process is not exiting reliably when the WebProcessPool is destroyed
​https://bugs.webkit.org/show_bug.cgi?id=196277
<rdar://problem/49127581>

Reviewed by Alex Christensen.

When, an AuxiliaryProcess receives the AuxiliaryProcess::Terminate IPC, it calls stopRunLoop()
to exit. WebProcess overrides AuxiliaryProcess::stopRunLoop() to call exit(0) on the main
thread. Other auxiliary processes such as the NetworkProcess would end up calling
platformStopRunLoop(). On iOS and iOSMac, platformStopRunLoop() calls XPCServiceExit(), which
makes sense since auxiliary processes run their run loop by calling xpc_main(). However, on
macOS, platformStopRunLoop() was calling RunLoop::main().stop() to exit instead, which was
unreliable as demonstrated by the test app attached to the radar.

Updating platformStopRunLoop() to call XPCServiceExit() on macOS fixes the problem and I now
see the NetworkProcess exiting reliably there. This is the approach I have chosen in this
patch since it appears to be reliable and it makes the code consistent on all Cocoa platforms.

• Shared/AuxiliaryProcess.cpp:
• Shared/Cocoa/AuxiliaryProcessCocoa.mm:

(WebKit::AuxiliaryProcess::platformStopRunLoop):

• Shared/ios/AuxiliaryProcessIOS.mm:

(WebKit::AuxiliaryProcess::platformStopRunLoop): Deleted.

• Shared/mac/AuxiliaryProcessMac.mm:

(WebKit::AuxiliaryProcess::platformStopRunLoop): Deleted.

4:51 PM Changeset in webkit [243527] by Keith Rollin

• 2 edits in trunk/Tools

Update the way generate-xcfilelists returns strings from functions
​https://bugs.webkit.org/show_bug.cgi?id=195975
<rdar://problem/49040807>

Reviewed by Dean Jackson.

There are places where generate-xcfilelists executes assignments with
statements like:

FOO=$(some_function)

where "some_function" return a string by echoing it. E.g.

some_function()
{

echo "Hello, World"

}

This is a common idiom, but it has a problem if "some_function" needs
to call "exit" in an attempt to halt the entire script right then and
there. Since "some_function" is called inside of $(), it's being
executed in a sub-shell. Calling exit in that sub-shell simply exits
that shell; it doesn't not exit the outer shell in which the main part
of the script is still running. As such, the main script keeps
executing when the intent was for the script to halt.

The solution to this is to use a different idiom for returning
strings. The one we now is to pass in the name of the variable to
receive the string result:

some_function()
{

variable_name=$1
eval $variable_name ="Hello, World"

}

The call site now looks like

some_function FOO

Because there's no invocation of a sub-shell, some_function can now
call "exit" if it wants to, and the entire script will exit at that
point.

• Scripts/generate-xcfilelists:

4:50 PM Changeset in webkit [243526] by Jon Davis

• 3 edits
  2 adds in trunk/Websites/browserbench.org

Update BrowserBench for JetStream2.
​https://bugs.webkit.org/show_bug.cgi?id=196273

Reviewed by Saam Barati.

• index.html:
• resources/JetStream2-Logo.png: Added.
• resources/​JetStream2-Logo@2x.png: Added.
• resources/main.css:

(.benchmark:hover img): Improved hover effect for the JetStream2 logo.

4:41 PM Changeset in webkit [243525] by Wenson Hsieh

• 4 edits in trunk/Source/WebCore

[Cocoa] Refactor some helper functions for building UserAgent strings
​https://bugs.webkit.org/show_bug.cgi?id=195990

Reviewed by Brent Fulgham.

Add an optional argument to standardUserAgentWithApplicationName to request the desktop version of the user
agent in Cocoa platforms. Work towards refactoring some codepaths to make the implementation of the "Request
Desktop Site" feature in Safari a bit more straightforward.

No change in behavior.

• platform/UserAgent.h:
• platform/ios/UserAgentIOS.mm:

(WebCore::standardUserAgentWithApplicationName):

The corresponding macOS version is currently hard-coded — the followup bug webkit.org/b/196275 tracks making
this dynamically fetch the paired macOS version when building for iOS.

• platform/mac/UserAgentMac.mm:

(WebCore::standardUserAgentWithApplicationName):

4:29 PM Changeset in webkit [243524] by Keith Rollin

• 4 edits in trunk/Source

Inhibit CFNetwork logging in private sessions
​https://bugs.webkit.org/show_bug.cgi?id=196268
<rdar://problem/48210793>

Reviewed by Alex Christensen.

Before performing any logging, the NetworkProcess checks to see if
it's performing an operation associated with a private (ephemeral)
browsing session. If so, it skips the logging. However, networking
layers below the NetworkProcess don't know about private browsing, so
they would still perform their own logging. CFNetwork now has a flag
that lets us control that, so set it to False if private browsing.

Source/WebKit:

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::configurationForSessionID):

Source/WTF:

• wtf/Platform.h:

4:24 PM Changeset in webkit [243523] by Chris Dumez

• 17 edits
  2 adds in trunk

Add basic layout test coverage for File Picker on iOS
​https://bugs.webkit.org/show_bug.cgi?id=196265

Reviewed by Wenson Hsieh.

Source/WebKit:

Add layout test infrastructure to test the file picker on iOS.

• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _dismissFilePicker]):

• UIProcess/API/Cocoa/WKWebViewPrivate.h:
• UIProcess/ios/WKContentViewInteraction.h:
• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView dismissFilePicker]):
(-[WKContentView _contentsOfUserInterfaceItem:]):

• UIProcess/ios/forms/WKFileUploadPanel.h:
• UIProcess/ios/forms/WKFileUploadPanel.mm:

(-[WKFileUploadPanel currentAvailableActionTitles]):

Tools:

Add layout test infrastructure to test the file picker on iOS.

• DumpRenderTree/ios/UIScriptControllerIOS.mm:

(WTR::UIScriptController::dismissFilePicker):

• TestRunnerShared/UIScriptContext/Bindings/UIScriptController.idl:
• TestRunnerShared/UIScriptContext/UIScriptController.cpp:

(WTR::UIScriptController::dismissFilePicker):

• TestRunnerShared/UIScriptContext/UIScriptController.h:
• WebKitTestRunner/TestController.cpp:

(WTR::TestController::createWebViewWithOptions):
(WTR::updateTestOptionsFromTestHeader):

• WebKitTestRunner/TestOptions.h:

(WTR::TestOptions::hasSameInitializationOptions const):

• WebKitTestRunner/ios/TestControllerIOS.mm:

(overridePresentViewController):
(WTR::TestController::platformInitialize):

• WebKitTestRunner/ios/UIScriptControllerIOS.mm:

(WTR::UIScriptController::dismissFilePicker):

LayoutTests:

Add new layout test.

• fast/forms/ios/file-upload-panel-expected.txt: Added.
• fast/forms/ios/file-upload-panel.html: Added.

3:59 PM Changeset in webkit [243522] by Shawn Roberts

• 2 edits in trunk/LayoutTests

Layout tests editing/deleting/delete-emoji-1.html
editing/deleting/delete-emoji-9.html
editing/deleting/delete-emoji.html are failing
webkit.org/b/191709

Unreviewed test gardening.

• platform/ios-simulator-wk2/TestExpectations: Updating test expectations waiting for rebaseline

3:13 PM Changeset in webkit [243521] by Shawn Roberts

• 3 edits in trunk/LayoutTests

imported/w3c/web-platform-tests/xhr/send-redirect-post-upload.htm is a flaky crash and a failing test
​https://bugs.webkit.org/show_bug.cgi?id=196274

Unreviewed test gardening.

• TestExpectations:
• platform/mac/TestExpectations: Updating test expectaion for flaky crash

3:08 PM Changeset in webkit [243520] by dbates@webkit.org

• 2 edits in trunk/Source/WebKit

[iOS][WK2] Use a better concept to describe the reason we defer zooming a focused element: selectabiltiy
​https://bugs.webkit.org/show_bug.cgi?id=196264

Reviewed by Wenson Hsieh.

Rename shouldDeferZoomingToSelectionWhenRevealingFocusedElement() to mayContainSelectableText() to describe
the criterion that we will use to decide whether to defer zooming or not. We defer zooming only for elements
that may support text selection on initial focus because we do not have an up-to-date selection rect at that
time. For element, like <select>, that do not support text selection, we can zoom them immediately when focused.

• UIProcess/ios/WKContentViewInteraction.mm:

(mayContainSelectableText): Renamed from shouldDeferZoomingToSelectionWhenRevealingFocusedElement.
List all the input types in the switch block and remove the default case to force the compiler to check that we
covered all cases. This will prevent unforseen keyboard issues (why isn't the keyboard shown? or why is the keyboard shown?)
for future input types that we may add.
(rectToRevealWhenZoomingToFocusedElement): Update for renaming.
(-[WKContentView _elementDidFocus:userIsInteracting:blurPreviousNode:changingActivityState:userObject:]): Add a
comment to explain why we may need to defer the zoom: the focused element supports text selection and we need
to wait for the web process to call back to provide an up-to-date selection rect for us to zoom and reveal.
(-[WKContentView _didReceiveEditorStateUpdateAfterFocus]): Update for renaming.
(shouldDeferZoomingToSelectionWhenRevealingFocusedElement): Deleted.

2:15 PM Changeset in webkit [243519] by Wenson Hsieh

• 7 edits in trunk

Implement async paste method on UIWKInteractionViewProtocol
​https://bugs.webkit.org/show_bug.cgi?id=196267
<rdar://problem/49236346>

Reviewed by Tim Horton.

Source/WebKit:

Implement a new UIWKInteractionViewProtocol hook to perform a paste command, and invoke the given completion
handler when pasting is finished.

Test: UIPasteboardTests.PasteWithCompletionHandler

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView pasteWithCompletionHandler:]):

Tools:

Add a new test to exercise the new SPI. Additionally, add staging forward declarations for
-pasteWithCompletionHandler:, and remove some old existing staging declarations for other bits of UIKit SPI that
are now a part of all iOS 12 internal SDKs.

• TestWebKitAPI/Tests/ios/UIPasteboardTests.mm:

While we're here, also change a few iOS 11.3 checks to just be about PLATFORM(IOS) (since we don't build for iOS
prior to 12, these version checks are effectively only about iOS vs. tvOS or watchOS).

• TestWebKitAPI/Tests/ios/WKWebViewAutofillTests.mm:
• TestWebKitAPI/ios/DragAndDropSimulatorIOS.mm:

(-[DragAndDropSimulator _sendQueuedAdditionalItemRequest]):

• TestWebKitAPI/ios/UIKitSPI.h:

2:04 PM Changeset in webkit [243518] by aakash_jain@apple.com

• 2 edits in trunk/Tools

[ews-build] Use PostgreSQL for ews.webkit.org database
​https://bugs.webkit.org/show_bug.cgi?id=196270

Reviewed by Lucas Forschler.

• BuildSlaveSupport/ews-app/ews-app/settings.py:

1:42 PM Changeset in webkit [243517] by Shawn Roberts

• 3 edits in trunk/LayoutTests

Layout tests http/tests/resourceLoadStatistics/capped-lifetime-for-cookie-set-in-js-with-link-fragment-from-prevalent-resource.html
http/tests/resourceLoadStatistics/capped-lifetime-for-cookie-set-in-js-with-link-query-and-fragment-from-prevalent-resource.html
http/tests/resourceLoadStatistics/capped-lifetime-for-cookie-set-in-js-with-link-query-from-prevalent-resource.html
http/tests/resourceLoadStatistics/capped-lifetime-for-cookie-set-in-js-without-link-decoration-from-prevalent-resource.html are flaky time outs
​https://bugs.webkit.org/show_bug.cgi?id=196269

Unreviewed test gardening.

• platform/ios-simulator-wk2/TestExpectations: Updating test expectations for flaky tests
• platform/ios-wk2/TestExpectations: Updatiting test expectations for flaky tests

1:41 PM Changeset in webkit [243516] by Jonathan Bedard

• 2 edits in trunk/Tools

[ews] Reset simctl states on reboot
​https://bugs.webkit.org/show_bug.cgi?id=196260

Rubber-stamped by Aakash Jain.

• EWSTools/start-queue-mac.sh:

1:14 PM Changeset in webkit [243515] by Said Abou-Hallawa

• 78 edits
  4 copies
  6 deletes in trunk

Remove the SVG tear off objects for SVGLength, SVGLengthList and SVGAnimatedLengthList
​https://bugs.webkit.org/show_bug.cgi?id=196083

Reviewed by Simon Fraser.

Source/WebCore:

-- SVGLength will be a superclass of SVGValueProperty<SVGLengthValue>. It

is a wrapper of SVGLengthValue. It will be provide the DOM methods. It
can setValueAsString() and return valueAsString().

-- SVGLengthList will be a superclass of SVGValuePropertyList<SVGLength>.

The base class will provide all the DOM methods. SVGLengthList will be
responsible for parsing a String to a SVGLength items. It can also
build a string representing the stored items.

-- SVGAnimatedLengthList will be defined as SVGAnimatedPropertyList<SVGLengthList>.

Like SVGAnimatedPointList, all the required methods and attributes
will be handled by SVGAnimatedPropertyList.

-- SVGAnimatedLengthAccessor and SVGAnimatedLengthListAccessor will be

added to access the members of types SVGAnimatedLength and
SVGAnimatedLengthList.

-- SVGAnimatedLengthAnimator and SVGAnimatedLengthListAnimator will be

created by the the new accessors to animate attributes of types
SVGAnimatedLength and SVGAnimatedLengthList.

-- SVGAnimationLengthFunction and SVGAnimationLengthListFunction will be

responsible for progressing the animVal() of attributes of types
SVGAnimatedLength and SVGAnimatedLengthList.

-- SVGValuePropertyAnimator is a new template class which can animate a

none reflecting attribute which should be backed by a value property,
e.g. SVGLength.

-- SVGValuePropertyListAnimator is a new template class which can animate a

none reflecting attribute which should be backed by a value property
list, e.g. SVGLengthList.

Notes:

-- SVGElement::isAnimatedStyleAttribute() will return true if the

attribute is known by SVGPropertyAnimatorFactory. Or it's has
a reflecting SVGAnimatedPropertyLength property and its name is
one of the names listed in isAnimatedStylePropertyAttribute() of
the propertyRegistry() of the SVGElement.

-- SVGElement::commitPropertyChange() has to handle the attributes

for which isAnimatedStylePropertyAttribute() returns true different
from the other ones. styleReclac() needs updated attributes since
it does not access the reflecting properties in the SVGELement.

-- SVGTextContentElement does not need a customized SVGAnimatedLength.

All SVGTextContentElement::textLengthAnimated() needs to know is
whether m_textLength->baseVal() holds an empty SVGLength. If it
does, it sets its value to getComputedTextLength().

• Sources.txt:
• WebCore.xcodeproj/project.pbxproj:
• rendering/svg/SVGTextLayoutAttributesBuilder.cpp:

(WebCore::updateCharacterData):
(WebCore::SVGTextLayoutAttributesBuilder::fillCharacterDataMap):

• svg/SVGAnimateElementBase.cpp:

(WebCore::SVGAnimateElementBase::hasValidAttributeType const):

• svg/SVGAnimatedLength.cpp: Removed.
• svg/SVGAnimatedLength.h: Removed.
• svg/SVGAnimatedLengthList.cpp: Removed.
• svg/SVGAnimatedLengthList.h: Removed.
• svg/SVGAnimatedType.h:

(WebCore::SVGAnimatedType::type const):

• svg/SVGAnimationElement.cpp:

(WebCore::SVGAnimationElement::isTargetAttributeCSSProperty):
(WebCore::inheritsFromProperty):

• svg/SVGAnimatorFactory.h:

(WebCore::SVGAnimatorFactory::isSupportedAttribute):
(WebCore::SVGAnimatorFactory::create):
These changes were required because some of the tests were trying to
animated unsupported attributes. To differentiate between between the
these two cases:

1) the attribute is animate-able by the legacy controller.
2) animating the attribute or the attribute itself is not supported

by the element.

We want SVGAnimatorFactory tell us whether it can create an animator for
a given attribute or not.

• svg/SVGCircleElement.cpp:

(WebCore::SVGCircleElement::SVGCircleElement):
(WebCore::SVGCircleElement::parseAttribute):
(WebCore::SVGCircleElement::svgAttributeChanged):
(WebCore::SVGCircleElement::registerAttributes): Deleted.

• svg/SVGCircleElement.h:
• svg/SVGCursorElement.cpp:

(WebCore::SVGCursorElement::SVGCursorElement):
(WebCore::SVGCursorElement::parseAttribute):
(WebCore::SVGCursorElement::svgAttributeChanged):
(WebCore::SVGCursorElement::registerAttributes): Deleted.

• svg/SVGCursorElement.h:
• svg/SVGElement.cpp:

(WebCore::SVGElement::commitPropertyChange):
(WebCore::SVGElement::isAnimatedStyleAttribute const):

• svg/SVGElement.h:
• svg/SVGEllipseElement.cpp:

(WebCore::SVGEllipseElement::SVGEllipseElement):
(WebCore::SVGEllipseElement::parseAttribute):
(WebCore::SVGEllipseElement::svgAttributeChanged):
(WebCore::SVGEllipseElement::registerAttributes): Deleted.

• svg/SVGEllipseElement.h:
• svg/SVGFilterElement.cpp:

(WebCore::SVGFilterElement::SVGFilterElement):
(WebCore::SVGFilterElement::registerAttributes):
(WebCore::SVGFilterElement::parseAttribute):

• svg/SVGFilterElement.h:
• svg/SVGFilterPrimitiveStandardAttributes.cpp:

(WebCore::SVGFilterPrimitiveStandardAttributes::SVGFilterPrimitiveStandardAttributes):
(WebCore::SVGFilterPrimitiveStandardAttributes::parseAttribute):
(WebCore::SVGFilterPrimitiveStandardAttributes::registerAttributes): Deleted.

• svg/SVGFilterPrimitiveStandardAttributes.h:

(WebCore::SVGFilterPrimitiveStandardAttributes::x const):
(WebCore::SVGFilterPrimitiveStandardAttributes::y const):
(WebCore::SVGFilterPrimitiveStandardAttributes::width const):
(WebCore::SVGFilterPrimitiveStandardAttributes::height const):
(WebCore::SVGFilterPrimitiveStandardAttributes::xAnimated):
(WebCore::SVGFilterPrimitiveStandardAttributes::yAnimated):
(WebCore::SVGFilterPrimitiveStandardAttributes::widthAnimated):
(WebCore::SVGFilterPrimitiveStandardAttributes::heightAnimated):
(WebCore::SVGFilterPrimitiveStandardAttributes::isKnownAttribute): Deleted.

• svg/SVGForeignObjectElement.cpp:

(WebCore::SVGForeignObjectElement::SVGForeignObjectElement):
(WebCore::SVGForeignObjectElement::parseAttribute):
(WebCore::SVGForeignObjectElement::registerAttributes): Deleted.

• svg/SVGForeignObjectElement.h:
• svg/SVGImageElement.cpp:

(WebCore::SVGImageElement::SVGImageElement):
(WebCore::SVGImageElement::parseAttribute):
(WebCore::SVGImageElement::registerAttributes): Deleted.

• svg/SVGImageElement.h:
• svg/SVGLength.h:

(WebCore::SVGLength::create):
(WebCore::SVGLength::clone const):
(WebCore::SVGLength::unitType):
(WebCore::SVGLength::valueForBindings):
(WebCore::SVGLength::setValueForBindings):
(WebCore::SVGLength::valueInSpecifiedUnits):
(WebCore::SVGLength::setValueInSpecifiedUnits):
(WebCore::SVGLength::setValueAsString):
(WebCore::SVGLength::newValueSpecifiedUnits):
(WebCore::SVGLength::convertToSpecifiedUnits):
(WebCore::SVGLength::valueAsString): Deleted.
(WebCore::SVGLength::SVGLength): Deleted.

• svg/SVGLengthList.h:

(WebCore::SVGLengthList::create):
(WebCore::SVGLengthList::lengthMode const):
(WebCore::SVGLengthList::parse):
(WebCore::SVGLengthList::SVGLengthList):

• svg/SVGLengthListValues.cpp: Removed.
• svg/SVGLengthListValues.h: Removed.
• svg/SVGLineElement.cpp:

(WebCore::SVGLineElement::SVGLineElement):
(WebCore::SVGLineElement::parseAttribute):
(WebCore::SVGLineElement::svgAttributeChanged):
(WebCore::SVGLineElement::registerAttributes): Deleted.

• svg/SVGLineElement.h:
• svg/SVGLinearGradientElement.cpp:

(WebCore::SVGLinearGradientElement::SVGLinearGradientElement):
(WebCore::SVGLinearGradientElement::parseAttribute):
(WebCore::SVGLinearGradientElement::svgAttributeChanged):
(WebCore::SVGLinearGradientElement::registerAttributes): Deleted.

• svg/SVGLinearGradientElement.h:
• svg/SVGMarkerElement.cpp:

(WebCore::SVGMarkerElement::SVGMarkerElement):
(WebCore::SVGMarkerElement::registerAttributes):
(WebCore::SVGMarkerElement::parseAttribute):

• svg/SVGMarkerElement.h:
• svg/SVGMaskElement.cpp:

(WebCore::SVGMaskElement::SVGMaskElement):
(WebCore::SVGMaskElement::registerAttributes):
(WebCore::SVGMaskElement::parseAttribute):
(WebCore::SVGMaskElement::svgAttributeChanged):

• svg/SVGMaskElement.h:
• svg/SVGPatternElement.cpp:

(WebCore::SVGPatternElement::SVGPatternElement):
(WebCore::SVGPatternElement::registerAttributes):
(WebCore::SVGPatternElement::parseAttribute):

• svg/SVGPatternElement.h:
• svg/SVGPoint.h:
• svg/SVGRadialGradientElement.cpp:

(WebCore::SVGRadialGradientElement::SVGRadialGradientElement):
(WebCore::SVGRadialGradientElement::parseAttribute):
(WebCore::SVGRadialGradientElement::svgAttributeChanged):
(WebCore::SVGRadialGradientElement::registerAttributes): Deleted.

• svg/SVGRadialGradientElement.h:
• svg/SVGRectElement.cpp:

(WebCore::SVGRectElement::SVGRectElement):
(WebCore::SVGRectElement::parseAttribute):
(WebCore::SVGRectElement::svgAttributeChanged):
(WebCore::SVGRectElement::registerAttributes): Deleted.

• svg/SVGRectElement.h:
• svg/SVGSVGElement.cpp:

(WebCore::SVGSVGElement::SVGSVGElement):
(WebCore::SVGSVGElement::parseAttribute):
(WebCore::SVGSVGElement::svgAttributeChanged):
(WebCore::SVGSVGElement::registerAttributes): Deleted.

• svg/SVGSVGElement.h:
• svg/SVGTextContentElement.cpp:

(WebCore::SVGTextContentElement::SVGTextContentElement):
(WebCore::SVGTextContentElement::registerAttributes):
(WebCore::SVGTextContentElement::parseAttribute):
(WebCore::SVGTextContentElement::svgAttributeChanged):
(WebCore::SVGTextContentElement::textLengthAnimated):

• svg/SVGTextContentElement.h:

(WebCore::SVGTextContentElement::specifiedTextLength const):
(WebCore::SVGTextContentElement::textLength const):
(WebCore::SVGTextContentElement::specifiedTextLength): Deleted.
(WebCore::SVGTextContentElement::textLengthAnimated): Deleted.
(WebCore::SVGTextContentElement::SVGAnimatedCustomLengthAttribute::SVGAnimatedCustomLengthAttribute): Deleted.
(WebCore::SVGTextContentElement::SVGAnimatedCustomLengthAttribute::synchronize): Deleted.
(WebCore::SVGTextContentElement::SVGAnimatedCustomLengthAttribute::animatedProperty): Deleted.

• svg/SVGTextPathElement.cpp:

(WebCore::SVGTextPathElement::SVGTextPathElement):
(WebCore::SVGTextPathElement::registerAttributes):
(WebCore::SVGTextPathElement::parseAttribute):

• svg/SVGTextPathElement.h:
• svg/SVGTextPositioningElement.cpp:

(WebCore::SVGTextPositioningElement::SVGTextPositioningElement):
(WebCore::SVGTextPositioningElement::parseAttribute):
(WebCore::SVGTextPositioningElement::svgAttributeChanged):
(WebCore::SVGTextPositioningElement::registerAttributes): Deleted.

• svg/SVGTextPositioningElement.h:

(WebCore::SVGTextPositioningElement::x const):
(WebCore::SVGTextPositioningElement::y const):
(WebCore::SVGTextPositioningElement::dx const):
(WebCore::SVGTextPositioningElement::dy const):
(WebCore::SVGTextPositioningElement::xAnimated):
(WebCore::SVGTextPositioningElement::yAnimated):
(WebCore::SVGTextPositioningElement::dxAnimated):
(WebCore::SVGTextPositioningElement::dyAnimated):
(WebCore::SVGTextPositioningElement::isKnownAttribute): Deleted.

• svg/SVGUseElement.cpp:

(WebCore::SVGUseElement::SVGUseElement):
(WebCore::SVGUseElement::parseAttribute):
(WebCore::SVGUseElement::svgAttributeChanged):
(WebCore::SVGUseElement::registerAttributes): Deleted.

• svg/SVGUseElement.h:
• svg/SVGValue.h:
• svg/properties/SVGAnimatedPropertyAccessorImpl.h:
• svg/properties/SVGAnimatedPropertyAnimator.h:
• svg/properties/SVGAnimatedPropertyAnimatorImpl.h:
• svg/properties/SVGAnimatedPropertyImpl.h:
• svg/properties/SVGAnimationAdditiveListFunctionImpl.h:

(WebCore::SVGAnimationLengthListFunction::SVGAnimationLengthListFunction):
(WebCore::SVGAnimationLengthListFunction::progress):
(WebCore::SVGAnimationNumberListFunction::progress):
(WebCore::SVGAnimationPointListFunction::progress):

• svg/properties/SVGAnimationAdditiveValueFunctionImpl.h:

(WebCore::SVGAnimationLengthFunction::SVGAnimationLengthFunction):
(WebCore::SVGAnimationLengthFunction::progress):

• svg/properties/SVGAttributeAnimator.cpp:

(WebCore::SVGAttributeAnimator::isAnimatedStylePropertyAniamtor const):

• svg/properties/SVGAttributeAnimator.h:
• svg/properties/SVGAttributeRegistry.h:
• svg/properties/SVGPropertyAnimatorFactory.h:

(WebCore::SVGPropertyAnimatorFactory::createLengthAnimator):
(WebCore::SVGPropertyAnimatorFactory::createLengthListAnimator):
(WebCore::SVGPropertyAnimatorFactory::attributeAnimatorCreator):

• svg/properties/SVGPropertyOwnerRegistry.h:

(WebCore::SVGPropertyOwnerRegistry::registerProperty):
(WebCore::SVGPropertyOwnerRegistry::isAnimatedLengthAttribute):

• svg/properties/SVGPropertyRegistry.h:
• svg/properties/SVGValuePropertyAnimator.h: Added.

(WebCore::SVGValuePropertyAnimator::SVGValuePropertyAnimator):

• svg/properties/SVGValuePropertyAnimatorImpl.h: Added.
• svg/properties/SVGValuePropertyListAnimator.h: Added.

(WebCore::SVGValuePropertyListAnimator::SVGValuePropertyListAnimator):

• svg/properties/SVGValuePropertyListAnimatorImpl.h: Added.

LayoutTests:

• platform/win/TestExpectations:
• svg/animations/svglength-element-removed-crash.svg:
• svg/dom/SVGLengthList-appendItem-expected.txt:
• svg/dom/SVGLengthList-appendItem.xhtml:
• svg/dom/SVGLengthList-basics-expected.txt:
• svg/dom/SVGLengthList-basics.xhtml:
• svg/dom/SVGLengthList-initialize-expected.txt:
• svg/dom/SVGLengthList-initialize.xhtml:
• svg/dom/SVGLengthList-insertItemBefore-expected.txt:
• svg/dom/SVGLengthList-insertItemBefore.xhtml:
• svg/dom/SVGLengthList-removeItem-expected.txt:
• svg/dom/SVGLengthList-removeItem.xhtml:
• svg/dom/SVGLengthList-replaceItem-expected.txt:
• svg/dom/SVGLengthList-replaceItem.xhtml:

This changes are required because SVGLengthList will be following the SVG2
specs regarding adding new items to the list.

See ​https://www.w3.org/TR/SVG/types.html#TermListInterface.

12:29 PM Changeset in webkit [243514] by Tadeu Zagallo

• 7 edits in trunk

WebAssembly: Fix f32.min, f64.min and f64.max operations on NaN
​https://bugs.webkit.org/show_bug.cgi?id=196217

Reviewed by Saam Barati.

JSTests:

Re-enable all NaN tests for f32.min, f64.min and f64.max.

• wasm/spec-tests/f32.wast.js:
• wasm/spec-tests/f64.wast.js:
• wasm/wasm.json:

Source/JavaScriptCore:

Generalize the fix for f32.max to properly handle NaN by doing an extra GreatherThan
comparison in r243446 to all min and max float operations.

• wasm/WasmAirIRGenerator.cpp:

(JSC::Wasm::AirIRGenerator::addOp<OpType::F32Min>):
(JSC::Wasm::AirIRGenerator::addFloatingPointMinOrMax):
(JSC::Wasm::AirIRGenerator::addOp<OpType::F32Max>):
(JSC::Wasm::AirIRGenerator::addOp<OpType::F64Min>):
(JSC::Wasm::AirIRGenerator::addOp<OpType::F64Max>):

• wasm/wasm.json:

12:23 PM Changeset in webkit [243513] by Simon Fraser

• 5 edits
  1 copy
  3 adds in trunk

[iOS WK2] position:fixed inside oveflow:scroll is jumpy
​https://bugs.webkit.org/show_bug.cgi?id=196238

Reviewed by Antti Koivisto.
Source/WebCore:

We were inadvertently making Positioned nodes for position:fixed, which is unnecessary because
Fixed nodes handle them, and harmful because they introduced unwanted layer movement.

Tests: scrollingcoordinator/ios/fixed-in-overflow-scroll-scrolling-tree.html

scrollingcoordinator/ios/fixed-in-overflow-scroll.html

• rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::computeCoordinatedPositioningForLayer const):

LayoutTests:

fixed-in-overflow-scroll-scrolling-tree.html actually tests the fix.
For some reason fixed-in-overflow-scroll.html doesn't show the jumpiness, but it's
a good test to have nonetheless.

Other minor cleanup.

• resources/ui-helper.js:

(window.UIHelper.immediateScrollElementAtContentPointToOffset):

• scrollingcoordinator/ios/fixed-in-overflow-scroll-expected.html: Added.
• scrollingcoordinator/ios/fixed-in-overflow-scroll-scrolling-tree-expected.txt: Added.
• scrollingcoordinator/ios/fixed-in-overflow-scroll-scrolling-tree.html: Copied from LayoutTests/scrollingcoordinator/ios/ui-scrolling-tree.html.
• scrollingcoordinator/ios/fixed-in-overflow-scroll.html: Added.
• scrollingcoordinator/ios/ui-scrolling-tree.html:

12:20 PM WebKitGTK/2.24.x edited by Adrian Perez de Castro

(diff)

12:20 PM WebKitGTK/2.24.x edited by Adrian Perez de Castro

(diff)

12:18 PM Changeset in webkit [243512] by andy@vanwagoner.family

• 5 edits in trunk

Intl.DateTimeFormat should obey 2-digit hour
​https://bugs.webkit.org/show_bug.cgi?id=195974

Reviewed by Keith Miller.

Source/JavaScriptCore:

• runtime/IntlDateTimeFormat.cpp:

(JSC::IntlDateTimeFormat::initializeDateTimeFormat):

LayoutTests:

• js/intl-datetimeformat-expected.txt:
• js/script-tests/intl-datetimeformat.js:

12:15 PM Changeset in webkit [243511] by pvollan@apple.com

• 3 edits in trunk/Source/WebKit

[macOS] Fix sandbox violations
​https://bugs.webkit.org/show_bug.cgi?id=196262
<rdar://problem/47738015>

Reviewed by Brent Fulgham.

Fix various observed sandbox violations.

• NetworkProcess/mac/com.apple.WebKit.NetworkProcess.sb.in:
• WebProcess/com.apple.WebProcess.sb.in:

12:04 PM Changeset in webkit [243510] by Dewei Zhu

• 3 edits in trunk/Websites/perf.webkit.org

Primary cluster of measurement set should always contain latest point.
​https://bugs.webkit.org/show_bug.cgi?id=196243

Reviewed by Ryosuke Niwa.

Fix a bug in measurement-set api that primary cluster may not contain latest data point as
'carry_over' row may not be updated.

• public/api/measurement-set.php: Should always keep 'carry_over' data points up to date.
• server-tests/api-measurement-set-tests.js: Added an unit test for this change.

Fixed a typo.

11:20 AM Changeset in webkit [243509] by aakash_jain@apple.com

• 2 edits in trunk/Tools

[ews-build] Use PostgreSQL for ews-build database
​https://bugs.webkit.org/show_bug.cgi?id=196229

Reviewed by Lucas Forschler.

• BuildSlaveSupport/ews-build/master.cfg:

11:13 AM Changeset in webkit [243508] by aakash_jain@apple.com

• 2 edits in trunk/Tools

[ews-build] Get master_hostname dynamically in master.cfg
​https://bugs.webkit.org/show_bug.cgi?id=196255

Reviewed by Lucas Forschler.

• BuildSlaveSupport/ews-build/master.cfg: Get hostname dynamically. Also do not

send events data in test mode.

11:12 AM Changeset in webkit [243507] by Devin Rousso

• 2 edits in trunk/Source/WebInspectorUI

Web Inspector: Sources: fix typo in CSS selector to always show add breakpoint button
​https://bugs.webkit.org/show_bug.cgi?id=196241

Reviewed by Matt Baker.

• UserInterface/Views/SourcesNavigationSidebarPanel.css:

(.sidebar > .panel.navigation.sources > .content > .details-section:matches(.paused-reason, .breakpoints).collapsed > .header > .options,):
(.sidebar > .panel.navigation.sources > .content > .details-section:matches(.paused-reason, .breakpoins).collapsed > .header > .options,): Deleted.

11:00 AM Changeset in webkit [243506] by dino@apple.com

• 3 edits
  2 adds in trunk

vertexAttribPointer must restrict offset parameter
​https://bugs.webkit.org/show_bug.cgi?id=196261
<rdar://problem/48458086>

Reviewed by Antoine Quint.

Source/WebCore:

This WebGL function should fail if the offset parameter is
not within [0, max 32-bit int].

Test: fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html

• html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::vertexAttribPointer):

LayoutTests:

Add a test where the offset parameter is out of bounds.

• fast/canvas/webgl/vertexAttribPointer-with-bad-offset-expected.txt: Added.
• fast/canvas/webgl/vertexAttribPointer-with-bad-offset.html: Added.

10:57 AM Changeset in webkit [243505] by commit-queue@webkit.org

• 3 edits in trunk/Source/WebKit

Assertion failure !isInAcceleratedCompositingMode() in DrawingAreaProxyCoordinatedGraphics::incorporateUpdate when forceCompositingMode is turned on
​https://bugs.webkit.org/show_bug.cgi?id=195879

Patch by Tomoki Imai <Tomoki Imai> on 2019-03-26
Reviewed by Carlos Garcia Campos.

The root cause is that DrawingAreaProxyCoordinatedGraphics::isInAcceleratedCompositingMode checks both of alwaysUseCompositing() and !m_layerTreeContext.isEmpty().
alwaysUseCompositing() refers preferences, which is written by the application (UIProcess).
On the other hand, m_layerTreeContext is changed when it receives enterAcceleratedCompositingMode/exitAcceleratedCompositingMode from WebProcess.

It results when we set forceCompositingMode and acceleratedCompositingEnabled to true, WebProcess and UIProcess is out of sync until WebProcess sends enterAcceleratedCompositingMode message.
In such situation, WebProcess sends incorporateUpdate to UIProcess because WebProcess is in non-AC mode, but isInAcceleratedCompositingMode becomes true in UIProcess side.

• UIProcess/CoordinatedGraphics/DrawingAreaProxyCoordinatedGraphics.cpp:

(WebKit::DrawingAreaProxyCoordinatedGraphics::~DrawingAreaProxyCoordinatedGraphics): Should call exitAcceleratedCompositingMode even when alwaysUseCompositing is true.
(WebKit::DrawingAreaProxyCoordinatedGraphics::enterAcceleratedCompositingMode): enterAcceleratedCompositingMode should check enterAcceleratedCompositingMode is not called twice.

• UIProcess/CoordinatedGraphics/DrawingAreaProxyCoordinatedGraphics.h: Remove alwaysUseCompositing from isInAcceleratedCompositingMode

10:29 AM Changeset in webkit [243504] by graouts@webkit.org

• 4 edits in trunk/Source/WebCore

Remove mousemoveEventHandlingPreventsDefault internal setting and quirk
​https://bugs.webkit.org/show_bug.cgi?id=196254
<rdar://problem/49124334>

Unreviewed. Fix build broken by previous commit.

• dom/Event.cpp:
• dom/Event.h:

(WebCore::Event::hasEncounteredListener const): Deleted.
(WebCore::Event::setHasEncounteredListener): Deleted.

• dom/EventTarget.cpp:

(WebCore::EventTarget::innerInvokeEventListeners):

10:27 AM Changeset in webkit [243503] by Alan Bujtas

• 3 edits
  2 adds in trunk

[ContentChangeObserver] Skip anonymous renderers when checking for "willRespondToMouseClickEvents"
​https://bugs.webkit.org/show_bug.cgi?id=196259
<rdar://problem/49240029>

Reviewed by Dean Jackson.

Source/WebCore:

Anonymous renderers don't have associated DOM nodes so they can't have event listeners either. Let's skip them.

Test: fast/events/touch/ios/content-observation/crash-on-anonymous-renderer.html

• page/ios/ContentChangeObserver.cpp:

(WebCore::ContentChangeObserver::StyleChangeScope::isConsideredClickable const):

LayoutTests:

• fast/events/touch/ios/content-observation/crash-on-anonymous-renderer-expected.txt: Added.
• fast/events/touch/ios/content-observation/crash-on-anonymous-renderer.html: Added.

10:13 AM Changeset in webkit [243502] by aakash_jain@apple.com

• 3 edits in trunk/Tools

[ews-app] Set db_constraint to False for Foreign Keys
​https://bugs.webkit.org/show_bug.cgi?id=196252

Reviewed by Lucas Forschler.

• BuildSlaveSupport/ews-app/ews/models/build.py:
• BuildSlaveSupport/ews-app/ews/models/step.py:

10:12 AM Changeset in webkit [243501] by aakash_jain@apple.com

• 2 edits in trunk/Tools

[ews-build] is_test_mode_enabled should default to True
​https://bugs.webkit.org/show_bug.cgi?id=196248

Reviewed by Lucas Forschler.

• BuildSlaveSupport/ews-build/master.cfg: Reverse the environment variable used to decide is_test_mode_enabled.

10:08 AM Changeset in webkit [243500] by aakash_jain@apple.com

• 2 edits in trunk/Tools

[ews-app] Add webkitperl to ENABLED_QUEUES
​https://bugs.webkit.org/show_bug.cgi?id=196253

Reviewed by Lucas Forschler.

• BuildSlaveSupport/ews-app/ews/views/statusbubble.py:

9:57 AM Changeset in webkit [243499] by graouts@webkit.org

• 6 edits in trunk/Source

Remove mousemoveEventHandlingPreventsDefault internal setting and quirk
​https://bugs.webkit.org/show_bug.cgi?id=196254
<rdar://problem/49124334>

Reviewed by Dean Jackson.

Source/WebCore:

• page/Quirks.cpp:

(WebCore::Quirks::shouldMousemoveEventHandlingPreventDefault const): Deleted.

• page/Quirks.h:
• page/RuntimeEnabledFeatures.h:

(WebCore::RuntimeEnabledFeatures::setMouseEventsSimulationEnabled):
(WebCore::RuntimeEnabledFeatures::mousemoveEventHandlingPreventsDefaultEnabled const): Deleted.
(WebCore::RuntimeEnabledFeatures::setMousemoveEventHandlingPreventsDefaultEnabled): Deleted.

Source/WebKit:

• Shared/WebPreferences.yaml:

9:39 AM Changeset in webkit [243498] by Shawn Roberts

• 2 edits in trunk/LayoutTests

Layout tests fast/events/wheel-event-destroys-overflow.html
fast/events/wheelevent-mousewheel-interaction.html
fast/events/wheel-event-destroys-frame.html
fast/events/wheelevent-basic.html
fast/events/wheelevent-in-text-node.html are a flaky timeouts
​https://bugs.webkit.org/show_bug.cgi?id=195719

Unreviewed test gardening.

• platform/mac-wk2/TestExpectations: Marking tests as flaky

9:36 AM Changeset in webkit [243497] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

Unreviewed, rolling out r243493.
​https://bugs.webkit.org/show_bug.cgi?id=196257

broke the non-gst-gl build (Requested by philn on #webkit).

Reverted changeset:

"Build failure with gstreamer 1.12.5 if USE_GSTREAMER_GL is
enabled"
​https://bugs.webkit.org/show_bug.cgi?id=196178
​https://trac.webkit.org/changeset/243493

9:30 AM WebKitGTK/2.24.x edited by Philippe Normand

(diff)

8:58 AM Changeset in webkit [243496] by ap@apple.com

• 5 edits in trunk/Tools

Address NSWindow sometimes using WebKitTestRunnerEvent too early
​https://bugs.webkit.org/show_bug.cgi?id=196211
rdar://problem/49110552

Reviewed by Tim Horton.

• WebKitTestRunner/TestController.cpp: (WTR::TestController::initialize):

Make sure that EventSenderProxy always exists when running tests. We used to create
it when resetting before the first test, which is a bit too late.

• WebKitTestRunner/TestController.h:
• WebKitTestRunner/cocoa/TestControllerCocoa.mm:

(WTR::TestController::platformCreateWebView):
(WTR::TestController::platformCreateOtherPage):
(WTR::TestController::finishCreatingPlatformWebView):

• WebKitTestRunner/mac/PlatformWebViewMac.mm:

(WTR::PlatformWebView::PlatformWebView):
Moved some code that made NSWindow use NSEvent during web view creation. We may
need to move more if some other case us found, but this is enough for now.

7:50 AM Changeset in webkit [243495] by pvollan@apple.com

• 2 edits in trunk/LayoutTests

Layout Test js/math-clz32.html is failing
​https://bugs.webkit.org/show_bug.cgi?id=196209

Unreviewed test gardening.

• platform/win/TestExpectations:

6:22 AM Changeset in webkit [243494] by Diego Pino Garcia

• 2 edits
  3 adds in trunk/LayoutTests

[GTK] Unreviewed gardening, update test expectations and baselines

• platform/gtk/TestExpectations:
• platform/gtk/compositing/overflow/textarea-scroll-touch-expected.txt:

New expected results after r243031.

• platform/gtk/http/tests/inspector/network/har/har-page-expected.txt:

New expected results after r243347.

6:19 AM WebKitGTK/2.24.x edited by Philippe Normand

(diff)

6:11 AM Changeset in webkit [243493] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

Build failure with gstreamer 1.12.5 if USE_GSTREAMER_GL is enabled
​https://bugs.webkit.org/show_bug.cgi?id=196178

Patch by Mike Gorse <​mgorse@alum.wpi.edu> on 2019-03-26
Reviewed by Philippe Normand.

No new tests (build fix).

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

Include gst/gl/gl.h before including GraphicsContext3D.h.

5:19 AM WebKitGTK/2.24.x edited by Adrian Perez de Castro

(diff)

5:16 AM WebKitGTK/2.24.x edited by Philippe Normand

(diff)

5:09 AM Changeset in webkit [243492] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebKit

[WPE][Qt] Uninitialized racy ViewBackend
​https://bugs.webkit.org/show_bug.cgi?id=196247

Patch by Philippe Normand <​pnormand@igalia.com> on 2019-03-26
Reviewed by Carlos Garcia Campos.

• UIProcess/API/wpe/qt/WPEQtView.h: Initialize the backend pointer to nullptr.

4:18 AM Changeset in webkit [243491] by Carlos Garcia Campos

• 8 edits in trunk

Unreviewed. Fix typo in GLib geolocation API after r243285.

gelocation -> geolocation.

Source/WebKit:

• UIProcess/API/glib/WebKitGeolocationManager.cpp:

(webkit_geolocation_manager_class_init):
(webkit_geolocation_manager_update_position):
(webkit_geolocation_manager_failed):
(webkit_gelocation_manager_update_position): Deleted.
(webkit_gelocation_manager_failed): Deleted.

• UIProcess/API/gtk/WebKitGeolocationManager.h:
• UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt:
• UIProcess/API/wpe/WebKitGeolocationManager.h:
• UIProcess/API/wpe/docs/wpe-1.0-sections.txt:

Tools:

• TestWebKitAPI/Tests/WebKitGLib/TestGeolocationManager.cpp:

(testGeolocationManagerWatchPosition):

3:16 AM Changeset in webkit [243490] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebKit

[GTK][WPE] Disable process warming
​https://bugs.webkit.org/show_bug.cgi?id=196208

Patch by Patrick Griffis <Patrick Griffis> on 2019-03-26
Reviewed by Chris Dumez.

Fixes crash caused by r243384.

Process warming is incompatible with our launcher as it expects a valid
WebsiteDataStore at initialization time for sandbox permissions.

• UIProcess/glib/WebProcessPoolGLib.cpp:

(WebKit::WebProcessPool::platformInitialize):

2:34 AM Changeset in webkit [243489] by Philippe Normand

• 7 edits in trunk

[GStreamer] Sound loop with Google Hangouts and WhatsApp notifications
​https://bugs.webkit.org/show_bug.cgi?id=189471

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

The media duration is now cached (again). The loop issue was
triggered by the previous version of the code returning positive
infinite duration in didEnd(), followed by the timeupdate event
propagation that would trick the HTMLMediaElement into a new call
to play(). Now the cached duration is updated to current position
at EOS (for forward playback direction only), so the media element
no longer triggers a new play call for those cases.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
(WebCore::MediaPlayerPrivateGStreamer::loadFull):
(WebCore::MediaPlayerPrivateGStreamer::playbackPosition const):
(WebCore::MediaPlayerPrivateGStreamer::platformDuration const):
(WebCore::MediaPlayerPrivateGStreamer::durationMediaTime const):
(WebCore::MediaPlayerPrivateGStreamer::currentMediaTime const):
(WebCore::MediaPlayerPrivateGStreamer::didEnd):
(WebCore::MediaPlayerPrivateGStreamer::durationChanged):

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
• platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:

(WebCore::MediaPlayerPrivateGStreamerMSE::currentMediaTime const):

LayoutTests:

• platform/gtk/TestExpectations:
• platform/gtk/media/video-playing-and-pause-expected.txt:

12:12 AM Changeset in webkit [243488] by Antti Koivisto

• 7 edits in trunk

Hit-testing on layers overlapping scrollers should hit-test on text boxes
​https://bugs.webkit.org/show_bug.cgi?id=195373
<rdar://problem/48649865>

Reviewed by Simon Fraser.

Source/WebCore:

• rendering/InlineFlowBox.cpp:

(WebCore::InlineFlowBox::paint):

• rendering/InlineTextBox.cpp:

(WebCore::InlineTextBox::paint):

Collect event region for overflowing line boxes.

• rendering/SimpleLineLayoutFunctions.cpp:

(WebCore::SimpleLineLayout::paintFlow):

Collect event region for overflowing simple lines.

LayoutTests:

• fast/scrolling/ios/overflow-scroll-overlap-3.html: