Timeline

Jun 25, 2019:

11:53 PM Changeset in webkit [246834] by bshafiei@apple.com

• 7 edits in branches/safari-608.1.31.0-branch

Cherry-pick r246800. rdar://problem/51554509

[iOS] Occasional crash under -[UIPreviewTarget initWithContainer:center:transform:] when generating a drag preview
​https://bugs.webkit.org/show_bug.cgi?id=199192
<rdar://problem/51554509>

Reviewed by Tim Horton.

Source/WebKit:

Tweak our preview generation code (for both the context menu and dragging) to be robust in the case where the
content view's unscaled view is nil; this may happen in the case after the web content process is terminated
and -cleanupInteraction is called, but before -setupInteraction is subsequently called.

Additionally, make our logic for creating targeted previews robust in the case where the view is removed from
the view hierarchy right before the platform asks for a targeted preview.

Test: DragAndDropTests.WebProcessTerminationDuringDrag

DragAndDropTests.WebViewRemovedFromViewHierarchyDuringDrag

• UIProcess/ios/WKContentViewInteraction.mm: (-[WKContentView containerViewForTargetedPreviews]): (-[WKContentView _deliverDelayedDropPreviewIfPossible:]): (-[WKContentView dragInteraction:previewForLiftingItem:session:]): (-[WKContentView _ensureTargetedPreview]):

Tools:

Tweak the drag and drop simulator to ask for drag cancellation previews, and use this to write a couple tests to
verify that we gracefully handle web process termination and web view unparenting mid-drag.

• TestWebKitAPI/Tests/ios/DragAndDropTestsIOS.mm: (TestWebKitAPI::TEST):
• TestWebKitAPI/cocoa/DragAndDropSimulator.h:
• TestWebKitAPI/ios/DragAndDropSimulatorIOS.mm: (-[DragAndDropSimulator _resetSimulatedState]): (-[DragAndDropSimulator _concludeDropAndPerformOperationIfNecessary]): (-[DragAndDropSimulator _advanceProgress]): (-[DragAndDropSimulator liftPreviews]): (-[DragAndDropSimulator cancellationPreviews]): (-[DragAndDropSimulator setSessionWillBeginBlock:]): (-[DragAndDropSimulator sessionWillBeginBlock]): (-[DragAndDropSimulator _webView:dataInteraction:sessionWillBegin:]):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@246800 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:53 PM Changeset in webkit [246833] by bshafiei@apple.com

• 4 edits in branches/safari-608.1.31.0-branch/Source

Cherry-pick r246767. rdar://problem/51535942

Null deref in WebFrameLoaderClient::dispatchDidReceiveServerRedirectForProvisionalLoad.
<rdar://problem/51535942> and ​https://bugs.webkit.org/show_bug.cgi?id=199123

Reviewed by Andy Estes.

Source/WebCore:

• loader/FrameLoaderStateMachine.h: (WebCore::FrameLoaderStateMachine::stateForDebugging const):

Source/WebKit:

• WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp: (WebKit::WebFrameLoaderClient::dispatchDidReceiveServerRedirectForProvisionalLoad): Properly detect this null DocumentLoader and try to learn more about the state of things.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@246767 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:56 PM Changeset in webkit [246832] by Ryan Haddad

• 2 edits in trunk/Source/ThirdParty/ANGLE

Unreviewed, rolling out r246825.

Breaks internal builds.

Reverted changeset:

"Script which adjusts include paths in ANGLE's copied headers
breaks incremental builds"
​https://bugs.webkit.org/show_bug.cgi?id=199212
​https://trac.webkit.org/changeset/246825

8:51 PM Changeset in webkit [246831] by Fujii Hironori

• 3 edits in trunk/Source/WebCore

[WinCairo] incorrect font height for 'Google Sans Display' font
​https://bugs.webkit.org/show_bug.cgi?id=198909

Reviewed by Frédéric Wang.

r191893 changed to use OS/2 typo metrics, but its calculation
wasn't correct. And, there is no reliable way to get OS/2 table by
using Windows API. Revert the part of r191893 change at the
moment.

• platform/graphics/win/SimpleFontDataCairoWin.cpp:

(WebCore::Font::platformInit):

• platform/graphics/win/SimpleFontDataWin.cpp:

(WebCore::Font::initGDIFont):
Reverted the part of r191893 change, and added FIXME comments.

8:49 PM Changeset in webkit [246830] by Ryan Haddad

• 2 edits in trunk/LayoutTests

Layout Test imported/blink/editing/selection/deleteFromDocument-crash.html is failing.
​https://bugs.webkit.org/show_bug.cgi?id=199213

Unreviewed Test Gardening.

Patch by Russell Epstein <​russell_e@apple.com> on 2019-06-25

• platform/ios-wk2/TestExpectations:

8:11 PM Changeset in webkit [246829] by jiewen_tan@apple.com

• 11 edits
  1 add in trunk

Implement a new SPI to inform clients about AppSSO
​https://bugs.webkit.org/show_bug.cgi?id=199085
<rdar://problem/50028246>

Reviewed by Geoffrey Garen.

Source/WebKit:

This patch implements a new SPI to inform clients about incoming AppSSO interceptions during
navigations. Therefore, clients can make an informed decision about whether this is the right
moment to do the interception as interceptions often show native UI. Also, the SPI is designed
to pass along a human readable name for the extension such that clients can do whatever they
want to inform users about what's going on.

Here is the new SPI:

• (void)_webView:(WKWebView *)webView decidePolicyForSOAuthorizationLoadWithCurrentPolicy:(_WKSOAuthorizationLoadPolicy)policy forExtension:(NSString *)extension completionHandler:(void (^{)(_WKSOAuthorizationLoadPolicy policy))completionHandler;}

• UIProcess/API/APINavigationClient.h:

(API::NavigationClient::decidePolicyForSOAuthorizationLoad):

• UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h:
• UIProcess/Cocoa/NavigationState.h:
• UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::setNavigationDelegate):
(WebKit::soAuthorizationLoadPolicy):
(WebKit::wkSOAuthorizationLoadPolicy):
(WebKit::NavigationState::NavigationClient::decidePolicyForSOAuthorizationLoad):

• UIProcess/Cocoa/SOAuthorization/SOAuthorizationLoadPolicy.h: Added.
• UIProcess/Cocoa/SOAuthorization/SOAuthorizationSession.mm:

(WebKit::SOAuthorizationSession::start):

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::decidePolicyForSOAuthorizationLoad):

• UIProcess/WebPageProxy.h:
• WebKit.xcodeproj/project.pbxproj:

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/TestSOAuthorization.mm:

(-[TestSOAuthorizationBasicDelegate webView:didFinishNavigation:]):
(-[TestSOAuthorizationNavigationDelegate init]):
(-[TestSOAuthorizationNavigationDelegate _webView:decidePolicyForSOAuthorizationLoadWithCurrentPolicy:forExtension:completionHandler:]):
(TestWebKitAPI::TEST):

7:59 PM Changeset in webkit [246828] by Simon Fraser

• 2 edits in trunk/Source/WebKit

[iOS WK2 Debug] scrollingcoordinator/scrolling-tree/scroller-with-negative-z-child.html asserts
​https://bugs.webkit.org/show_bug.cgi?id=199218

Reviewed by Zalan Bujtas.

Followup to r246766; don't assert in the UI process if a ScrollingTreeOverflowScrollProxyNode
doesn't have a related overflow node; this is currently expected behavior with negative z-order
children of a scroller.

• UIProcess/RemoteLayerTree/ios/RemoteScrollingCoordinatorProxyIOS.mm:

(WebKit::RemoteScrollingCoordinatorProxy::establishLayerTreeScrollingRelations):

7:25 PM Changeset in webkit [246827] by keith_miller@apple.com

• 2 edits in trunk/Source/WTF

CagedPtr doesn't merge PAC bits back into the resulting caged pointer.
​https://bugs.webkit.org/show_bug.cgi?id=199214

Reviewed by Yusuke Suzuki.

The current code means that caging will just strip the any failed
authentication bits. Adding this code doesn't appear to be a
regression on iPhone Xs.

• wtf/CagedPtr.h:

(WTF::CagedPtr::get const):
(WTF::CagedPtr::getMayBeNull const):
(WTF::CagedPtr::getUnsafe const):
(WTF::CagedPtr::mergePointers):

7:00 PM Changeset in webkit [246826] by weinig@apple.com

• 2 edits in trunk/Source/WTF

Experiment with simple structured bindings use
​https://bugs.webkit.org/show_bug.cgi?id=198905

Reviewed by Darin Adler.

• wtf/URLHelpers.cpp:

(WTF::URLHelpers::mapHostNames):
Simplify code using c++ structured bindings (​https://en.cppreference.com/w/cpp/language/structured_binding)
to see if all the platforms will work with it.

6:44 PM Changeset in webkit [246825] by dino@apple.com

• 2 edits in trunk/Source/ThirdParty/ANGLE

Script which adjusts include paths in ANGLE's copied headers breaks incremental builds
​https://bugs.webkit.org/show_bug.cgi?id=199212

Patch by Kenneth Russell <​kbr@chromium.org> on 2019-06-25
Reviewed by Darin Adler.

Maintain and test a timestamp in adjust-angle-include-paths.sh
in order to avoid touching the headers during each build.

• adjust-angle-include-paths.sh:

6:40 PM Changeset in webkit [246824] by Justin Fan

• 4 edits
  2 copies
  2 moves in trunk/LayoutTests

[WHLSL] Make whlsl-test-harness actually generate WHLSL shaders by default
​https://bugs.webkit.org/show_bug.cgi?id=199028

Reviewed by Saam Barati.

whlsl-test-harness.js now generates WHLSL shaders and invokes WebKit's WHLSL compiler.
MSL mode remains to facilitate further harness tesing.
In addition, if WebGPU is not supported, synchronous Harness methods do nothing.
Asynchronous methods will throw a WebGPUUnsupportedError that "rejects" the returned Promise.

• TestExpectations:
• platform/mac/TestExpectations:
• webgpu/js/whlsl-test-harness.js:

(WebGPUUnsupportedError): Layout tests should catch these to fail gracefully if WebGPU is not supported.
(Data):
(Data.prototype.async.getArrayBuffer):
(Data.prototype.get isBuffer): Renamed from isPointer.
(Harness):
(Harness.prototype.async.requestDevice): Can be used to re-acquire a GPUDevice.
(Harness.prototype.set isWHLSL): Determines whether harness will generate WHLSL or MSL shaders.
(Harness.prototype.async.callTypedFunction):
(Harness.prototype.callVoidFunction):
(Harness.prototype.get device):
(Harness.prototype._clearResults):
(Harness.prototype._setUpArguments):
(Harness.prototype._callFunction):
(Data.prototype.get isPointer): Deleted.
(Harness.prototype._initialize): Deleted.
(Harness.prototype.async.callVoidFunction): Deleted.
(harness._initialize.async): Deleted.

• webgpu/msl-harness-test-expected.txt: Renamed from LayoutTests/webgpu/whlsl-harness-test-expected.txt.
• webgpu/msl-harness-test.html: Copied from LayoutTests/webgpu/whlsl-harness-test.html.
• webgpu/whlsl-test-harness-test-expected.html: Added.
• webgpu/whlsl-test-harness-test.html: Renamed from LayoutTests/webgpu/whlsl-harness-test.html.

6:01 PM Changeset in webkit [246823] by aakash_jain@apple.com

• 2 edits in trunk/Tools

[ews-build] Retry Layout test in case of failures
​https://bugs.webkit.org/show_bug.cgi?id=199194

Reviewed by Jonathan Bedard.

• BuildSlaveSupport/ews-build/steps.py:

(RunWebKitTests.evaluateCommand): Check if tests failed and retry them if required.
(ReRunWebKitTests): Build step to re-run layout tests.
(ReRunWebKitTests.evaluateCommand): Check if tests failed and retry on clean build if required.
(RunWebKitTestsWithoutPatch): Build step to run tests without patch.
(RunWebKitTestsWithoutPatch.evaluateCommand):

5:56 PM Changeset in webkit [246822] by aakash_jain@apple.com

• 3 edits in trunk/Tools

[ews-build] Combine various patchFailed*Tests properties
​https://bugs.webkit.org/show_bug.cgi?id=199193

Reviewed by Jonathan Bedard.

• BuildSlaveSupport/ews-build/steps.py: Renamed patchFailedJSCTests and patchFailedAPITests to patchFailedTests. This property

can also be used for layout-tests later on.

• BuildSlaveSupport/ews-build/steps_unittest.py: Updated unit-tests.

4:45 PM Changeset in webkit [246821] by Matt Baker

• 3 edits in trunk/Source/WebInspectorUI

Web Inspector: Elements: show shadow DOM by default
​https://bugs.webkit.org/show_bug.cgi?id=199128

Reviewed by Devin Rousso.

• UserInterface/Base/Setting.js:

• UserInterface/Test/Test.js:

(WI.loaded):
Overriding the default value isn't necessary since the default is now true.

4:44 PM Changeset in webkit [246820] by Kocsen Chung

• 7 edits in branches/safari-607-branch/Source

Versioning.

4:43 PM Changeset in webkit [246819] by Kocsen Chung

• 1 copy in tags/Safari-607.3.6

Tag Safari-607.3.6.

4:42 PM Changeset in webkit [246818] by timothy@apple.com

• 3 edits in trunk/Source/WebCore

Clicking the up/down spin buttons for a number input increments/decrements by 2.
​https://bugs.webkit.org/show_bug.cgi?id=198809

Reviewed by Tim Horton.

AppKit no longer registers NSScrollerButtonDelay and NSScrollerButtonPeriod in the base
NSUserDefaults for an app. This caused our use to always get 0s when setting the click
and hold timer, causing the value to increment quickly for a single press.

• platform/mac/ScrollbarThemeMac.h:

(WebCore::ScrollbarThemeMac::initialAutoscrollTimerDelay): Added. Hardcode 500ms.
(WebCore::ScrollbarThemeMac::autoscrollTimerDelay): Added. Hardcode 50ms.

• platform/mac/ScrollbarThemeMac.mm:

(WebCore::ScrollbarThemeMac::preferencesChanged): Removed use of old user defaults.
(WebCore::ScrollbarThemeMac::initialAutoscrollTimerDelay): Deleted.
(WebCore::ScrollbarThemeMac::autoscrollTimerDelay): Deleted.

4:41 PM Changeset in webkit [246817] by dbates@webkit.org

• 5 edits
  2 adds in trunk

Non-editable text selections should be modifiable with hardware keyboard
​https://bugs.webkit.org/show_bug.cgi?id=199204
<rdar://problem/51651496>

Reviewed by Wenson Hsieh.

Source/WebKit:

UIKit changes are need for this to work, including <rdar://problem/48322899>.
Note that without these changes, -canPerformAction is never called for _move*
selectors.

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView canPerformAction:withSender:]):

LayoutTests:

Add a test, skipped for now, until we have the fix for <rdar://problem/48322899>.

• editing/selection/ios/select-non-editable-text-using-keyboard-expected.txt: Added.
• editing/selection/ios/select-non-editable-text-using-keyboard.html: Added.
• platform/ios/TestExpectations:
• resources/ui-helper.js:

(window.UIHelper.callFunctionAndWaitForEvent): Added.

4:40 PM Changeset in webkit [246816] by Nikita Vasilyev

• 3 edits in trunk/Source/WebInspectorUI

REGRESSION(r246621): Web Inspector: Styles: property may get removed when editing after deleting value
​https://bugs.webkit.org/show_bug.cgi?id=199143
<rdar://problem/52042815>

Reviewed by Matt Baker.

r246621 affected when WI.CSSStyleDeclaration.Event.PropertiesChanged event is fired, which caused
SpreadsheetCSSStyleDeclarationEditor to possibly enter a state when focused property is
incorrectly set to false.

• UserInterface/Views/SpreadsheetCSSStyleDeclarationEditor.js:

(WI.SpreadsheetCSSStyleDeclarationEditor.prototype.spreadsheetStylePropertyRemoved): Removed.
(WI.SpreadsheetCSSStyleDeclarationEditor.prototype.spreadsheetStylePropertyWillRemove): Added.
Renamed from "removed" to "willRemove" since we need to call it before the property DOM element
is detached from the document.

• UserInterface/Views/SpreadsheetStyleProperty.js:

(WI.SpreadsheetStyleProperty.prototype.remove):
Don't set focused to false when the removed property wasn't focused.
This code need to exist because removing focused element from the DOM doesn't trigger blur event.

4:38 PM Changeset in webkit [246815] by Kocsen Chung

• 1 copy in tags/Safari-608.1.31.2.1

Tag Safari-608.1.31.2.1.

4:24 PM Changeset in webkit [246814] by Ross Kirsling

• 8 edits in trunk/Tools

[Win] MiniBrowser should default to webkit.org
​https://bugs.webkit.org/show_bug.cgi?id=199201

Reviewed by Don Olmstead.

• MiniBrowser/win/BrowserWindow.h:
• MiniBrowser/win/MiniBrowserReplace.h:
• MiniBrowser/win/WebKitBrowserWindow.cpp:

(WebKitBrowserWindow::loadHTMLString): Deleted.

• MiniBrowser/win/WebKitBrowserWindow.h:
• MiniBrowser/win/WebKitLegacyBrowserWindow.cpp:

(WebKitLegacyBrowserWindow::loadHTMLString): Deleted.

• MiniBrowser/win/WebKitLegacyBrowserWindow.h:
• MiniBrowser/win/WinMain.cpp:

(wWinMain):

4:23 PM Changeset in webkit [246813] by Kocsen Chung

• 7 edits in branches/safari-608.1.31.0-branch/Source

Versioning.

4:22 PM Changeset in webkit [246812] by Kocsen Chung

• 1 copy in tags/Safari-608.1.31.0.2

Tag Safari-608.1.31.0.2.

3:13 PM Changeset in webkit [246811] by keith_miller@apple.com

• 2 edits in trunk/Source/WebCore

Unreviewed, windows build fix.

• bindings/js/JSDOMGlobalObject.h:

2:47 PM Changeset in webkit [246810] by dbates@webkit.org

• 3 edits
  2 adds in trunk

[iOS] Should not process key events in non-editable elements using IME
​https://bugs.webkit.org/show_bug.cgi?id=199122
<rdar://problem/52006654>

Reviewed by Brent Fulgham.

Source/WebKit:

Use the non-Input Method code path (the one we use for US keyboard input) for all key events
targeting a non-editable element. Such key events will never require Input Method support
(i.e. show candidate suggestions). Moreover, this behavior matches the behavior on Mac.

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView handleKeyWebEvent:withCompletionHandler:]):

LayoutTests:

Add a test to ensure that we do not process key events as being handled by the Input Manager
when using a Chinese keyboard layout and targeting a non-editable element.

• fast/events/ios/keydown-keyup-keypress-keys-in-non-editable-using-chinese-keyboard-expected.txt: Added.
• fast/events/ios/keydown-keyup-keypress-keys-in-non-editable-using-chinese-keyboard.html: Added.

2:35 PM Changeset in webkit [246809] by abarth@webkit.org

• 2 edits in trunk/Source/WTF

[fuchsia] Update to newer zx_clock_get syscall
​https://bugs.webkit.org/show_bug.cgi?id=199191

Reviewed by Sam Weinig.

Fuchsia has changed the zx_clock_get syscall to return the clock value
via an out parameter rather than via its return value. This change
makes zx_clock_get consistent with all the other syscalls.

This patch updates our use of zx_clock_get to use the new syscall. The
old syscall is no longer supported by Fuchsia.

• wtf/fuchsia/CPUTimeFuchsia.cpp:

(WTF::CPUTime::get): Switch to using the out parameter.
(WTF::CPUTime::forCurrentThread): Switch to using the out parameter.

2:19 PM Changeset in webkit [246808] by keith_miller@apple.com

• 4 edits in trunk/Source/WebCore

Add didBecomePrototype() calls to global context prototypes
​https://bugs.webkit.org/show_bug.cgi?id=199202

Reviewed by Mark Lam.

This fixes some crashes related to asserting that all prototypes
have been marked as such in JSC from
​https://trac.webkit.org/changeset/246801. It's ok to call
didBecomePrototype here as we setting up the world state right now
so we won't be having a bad time.

We don't automatically call didBecomePrototype() for
setPrototypeWithoutTransition because existing objects may already
have this structure so it seems more reasonable to be explicit
there.

• bindings/js/JSWindowProxy.cpp:

(WebCore::JSWindowProxy::setWindow):

• bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::initScript):

• worklets/WorkletScriptController.cpp:

(WebCore::WorkletScriptController::initScriptWithSubclass):

2:08 PM Changeset in webkit [246807] by commit-queue@webkit.org

• 18 edits in trunk/Source

Make HTTPCookieAcceptPolicy an enum class
​https://bugs.webkit.org/show_bug.cgi?id=199081

Patch by Alex Christensen <​achristensen@webkit.org> on 2019-06-25
Source/WebCore/PAL:

Reviewed by Michael Catanzaro

• pal/spi/cf/CFNetworkSPI.h:

Source/WebKit:

Reviewed by Michael Catanzaro.

Doing so reveals some interesting bugs in the C API that are also fixed:
WKPreferencesGetIncrementalRenderingSuppressionTimeout was using its toAPI function to convert a double to a double because HTTPCookieAcceptPolicy used to be an unsigned integer.
toAPI(WebCore::MouseButton) was also using the toAPI(HTTPCookieAcceptPolicy) because HTTPCookieAcceptPolicy used to be an unsigned integer.
Yikes! Type safety is our friend.

• NetworkProcess/Cookies/WebCookieManager.messages.in:
• NetworkProcess/Cookies/mac/WebCookieManagerMac.mm:

(WebKit::toCFHTTPCookieStorageAcceptPolicy):
(WebKit::WebCookieManager::platformSetHTTPCookieAcceptPolicy):
(WebKit::WebCookieManager::platformGetHTTPCookieAcceptPolicy):

• Shared/API/c/WKSharedAPICast.h:

(WebKit::toAPI):

• Shared/HTTPCookieAcceptPolicy.h:

(): Deleted.

• UIProcess/API/C/WKAPICast.h:

(WebKit::toHTTPCookieAcceptPolicy):
(WebKit::toAPI):

• UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesGetIncrementalRenderingSuppressionTimeout):

• UIProcess/API/Cocoa/WKProcessPool.mm:

(toHTTPCookieAcceptPolicy):

• UIProcess/WebCookieManagerProxy.cpp:

(WebKit::WebCookieManagerProxy::didGetHTTPCookieAcceptPolicy):

• UIProcess/WebCookieManagerProxy.h:
• UIProcess/WebCookieManagerProxy.messages.in:

1:51 PM Changeset in webkit [246806] by Truitt Savell

• 2 edits in trunk/LayoutTests

[macOS WK2] REGRESSION (r242313): Layout Test scrollingcoordinator/mac/multiple-fixed.html is a flaky time out and image diff
​https://bugs.webkit.org/show_bug.cgi?id=195635

Unreviewed test gardening.

• platform/mac/TestExpectations:

1:51 PM Changeset in webkit [246805] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebKit

Wrong title for Data Detectors tap action menu
​https://bugs.webkit.org/show_bug.cgi?id=199198
<rdar://problem/51957842>

Reviewed by Wenson Hsieh.

• UIProcess/ios/WKActionSheetAssistant.mm:

(-[WKActionSheetAssistant showDataDetectorsSheet]):
Always pass the results array through to DataDetectors; they need it
to figure out the title too!

1:48 PM Changeset in webkit [246804] by wilander@apple.com

• 5 edits in trunk/LayoutTests

Migrate LayoutTests/http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store* test cases to setEnableFeature() and jsTestIsAsync
​https://bugs.webkit.org/show_bug.cgi?id=199180
<rdar://problem/52085369>

Reviewed by Brent Fulgham.

• http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store-expected.txt:
• http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store-one-hour-expected.txt:
• http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store-one-hour.html:
• http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store.html:

1:18 PM Changeset in webkit [246803] by Kocsen Chung

• 7 edits in tags/Safari-608.1.28.2/Source

Versioning.

12:51 PM Changeset in webkit [246802] by Kocsen Chung

• 1 copy in tags/Safari-608.1.28.2

New tag.

12:49 PM Changeset in webkit [246801] by keith_miller@apple.com

• 5 edits in trunk/Source/JavaScriptCore

Structure::create should call didBecomePrototype()
​https://bugs.webkit.org/show_bug.cgi?id=196315

Reviewed by Filip Pizlo.

Structure::create should also assert that the indexing type makes sense
for the prototype being used.

• runtime/JSObject.h:
• runtime/Structure.cpp:

(JSC::Structure::isValidPrototype):
(JSC::Structure::changePrototypeTransition):

• runtime/Structure.h:

(JSC::Structure::create): Deleted.

• runtime/StructureInlines.h:

(JSC::Structure::create):
(JSC::Structure::setPrototypeWithoutTransition):

11:48 AM Changeset in webkit [246800] by Wenson Hsieh

• 7 edits in trunk

[iOS] Occasional crash under -[UIPreviewTarget initWithContainer:center:transform:] when generating a drag preview
​https://bugs.webkit.org/show_bug.cgi?id=199192
<rdar://problem/51554509>

Reviewed by Tim Horton.

Source/WebKit:

Tweak our preview generation code (for both the context menu and dragging) to be robust in the case where the
content view's unscaled view is nil; this may happen in the case after the web content process is terminated
and -cleanupInteraction is called, but before -setupInteraction is subsequently called.

Additionally, make our logic for creating targeted previews robust in the case where the view is removed from
the view hierarchy right before the platform asks for a targeted preview.

Test: DragAndDropTests.WebProcessTerminationDuringDrag

DragAndDropTests.WebViewRemovedFromViewHierarchyDuringDrag

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView containerViewForTargetedPreviews]):
(-[WKContentView _deliverDelayedDropPreviewIfPossible:]):
(-[WKContentView dragInteraction:previewForLiftingItem:session:]):
(-[WKContentView _ensureTargetedPreview]):

Tools:

Tweak the drag and drop simulator to ask for drag cancellation previews, and use this to write a couple tests to
verify that we gracefully handle web process termination and web view unparenting mid-drag.

• TestWebKitAPI/Tests/ios/DragAndDropTestsIOS.mm:

(TestWebKitAPI::TEST):

• TestWebKitAPI/cocoa/DragAndDropSimulator.h:
• TestWebKitAPI/ios/DragAndDropSimulatorIOS.mm:

(-[DragAndDropSimulator _resetSimulatedState]):
(-[DragAndDropSimulator _concludeDropAndPerformOperationIfNecessary]):
(-[DragAndDropSimulator _advanceProgress]):
(-[DragAndDropSimulator liftPreviews]):
(-[DragAndDropSimulator cancellationPreviews]):
(-[DragAndDropSimulator setSessionWillBeginBlock:]):
(-[DragAndDropSimulator sessionWillBeginBlock]):
(-[DragAndDropSimulator _webView:dataInteraction:sessionWillBegin:]):

11:47 AM Changeset in webkit [246799] by Truitt Savell

• 2 edits in trunk/LayoutTests

Layout Test imported/mozilla/svg/text/textpath-selection.svg is flaky.
​https://bugs.webkit.org/show_bug.cgi?id=199196

Unreviewed Test Gardening.

Patch by Russell Epstein <​russell_e@apple.com> on 2019-06-25

• platform/ios-wk2/TestExpectations:

11:36 AM Changeset in webkit [246798] by Joseph Pecoraro

• 24 edits in trunk

Web Inspector: Implement console.timeLog
​https://bugs.webkit.org/show_bug.cgi?id=199184

Reviewed by Devin Rousso.

Source/JavaScriptCore:

• inspector/JSGlobalObjectConsoleClient.cpp:

(Inspector::JSGlobalObjectConsoleClient::timeLog):

• inspector/JSGlobalObjectConsoleClient.h:
• inspector/agents/InspectorConsoleAgent.cpp:

(Inspector::InspectorConsoleAgent::logTiming):
(Inspector::InspectorConsoleAgent::stopTiming):

• inspector/agents/InspectorConsoleAgent.h:
• runtime/ConsoleClient.h:
• runtime/ConsoleObject.cpp:

(JSC::ConsoleObject::finishCreation):
(JSC::consoleProtoFuncTimeLog):

Source/WebCore:

Updated existing tests.

• inspector/InspectorInstrumentation.cpp:

(WebCore::InspectorInstrumentation::logConsoleTimingImpl):

• inspector/InspectorInstrumentation.h:

(WebCore::InspectorInstrumentation::logConsoleTiming):

• page/PageConsoleClient.cpp:

(WebCore::PageConsoleClient::timeLog):

• page/PageConsoleClient.h:
• workers/WorkerConsoleClient.cpp:

(WebCore::WorkerConsoleClient::timeLog):

• workers/WorkerConsoleClient.h:
• worklets/WorkletConsoleClient.cpp:

(WebCore::WorkletConsoleClient::timeLog):

• worklets/WorkletConsoleClient.h:

Source/WebInspectorUI:

• UserInterface/Views/ConsoleMessageView.js:

(WI.ConsoleMessageView.prototype._appendMessageTextAndArguments):
Time messages (like timeLog) do not include their messageText
in their parameters list. So to behave more like normal logs
build a parameter list that includes it at the front.

LayoutTests:

• inspector/console/console-time-expected.txt:
• inspector/console/console-time.html:

Add new timeLog tests.

• js/console-expected.txt:

New timeLog method.

• platform/gtk/TestExpectations:
• platform/mac/TestExpectations:

Unskip test.

11:09 AM Changeset in webkit [246797] by youenn@apple.com

• 4 edits
  1 add in trunk/Source

Close sockets with too high file descriptor
​https://bugs.webkit.org/show_bug.cgi?id=199116

Reviewed by Eric Carlson.

Source/ThirdParty/libwebrtc:

• Source/webrtc/rtc_base/physicalsocketserver.cc:
• WebKit/0001-Close-sockets-with-file-descriptors-above-FD_SETSIZE.patch: Added.

Source/WebKit:

Log the case of failing to open a socket.

• NetworkProcess/webrtc/NetworkRTCProvider.cpp:

(WebKit::NetworkRTCProvider::createSocket):

11:01 AM Changeset in webkit [246796] by bshafiei@apple.com

• 7 edits in branches/safari-608.1.31.0-branch/Source

Versioning.

10:29 AM Changeset in webkit [246795] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebKit

When Caps Lock is enabled on the Smart Keyboard, can't scroll with space or arrow keys
​https://bugs.webkit.org/show_bug.cgi?id=199187
<rdar://problem/51521709>

Reviewed by Anders Carlsson.

• UIProcess/ios/WKKeyboardScrollingAnimator.mm:

(-[WKKeyboardScrollingAnimator keyboardScrollForEvent:]):
When deciding whether a key event should start a scroll, ignore all
modifiers other than the ones we actually care about (including Caps Lock).

10:00 AM Changeset in webkit [246794] by Kocsen Chung

• 7 edits in branches/safari-607-branch/Source

Versioning.

9:17 AM Changeset in webkit [246793] by aakash_jain@apple.com

• 3 edits in trunk/Tools

[ews-build] UploadTestResults and ExtractTestResults clobber results in case of multiple layout test runs in a build
​https://bugs.webkit.org/show_bug.cgi?id=199178

Reviewed by Jonathan Bedard.

• BuildSlaveSupport/ews-build/steps.py:

(UploadTestResults.init): Add an optional identifier and append the identifier to the file name.
(ExtractTestResults.init): Ditto.

• BuildSlaveSupport/ews-build/steps_unittest.py: Added unit tests.

9:08 AM Changeset in webkit [246792] by Michael Catanzaro

• 2 edits in trunk/Source/JavaScriptCore

REGRESSION(r245586): static assertion failed: Match result and EncodedMatchResult should be the same size
​https://bugs.webkit.org/show_bug.cgi?id=198518

Reviewed by Keith Miller.

r245586 made some bad assumptions about the size of size_t, which we can solve using the
CPU(ADDRESS32) guard that I didn't know about.

This solution was developed by Mark Lam and Keith Miller. I'm just preparing the patch.

• runtime/MatchResult.h:

7:59 AM Changeset in webkit [246791] by Michael Catanzaro

• 4 edits in trunk

Add user agent quirk for bankofamerica.com
​https://bugs.webkit.org/show_bug.cgi?id=199154

Reviewed by Carlos Garcia Campos.

Source/WebCore:

This suppresses an unsupported browser warning.

• platform/UserAgentQuirks.cpp:

(WebCore::urlRequiresMacintoshPlatform):

Tools:

• TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:

(TestWebKitAPI::TEST):

7:56 AM Changeset in webkit [246790] by Michael Catanzaro

• 32 edits in trunk

Fully rename WebKitGTK+ -> WebKitGTK everywhere
​https://bugs.webkit.org/show_bug.cgi?id=199159

Reviewed by Carlos Garcia Campos.

.:

• Source/cmake/FindGLIB.cmake:

Source/WebCore:

• accessibility/atk/WebKitAccessibleInterfaceText.cpp:

(webkitAccessibleTextGetStringAtOffset):

• platform/UserAgentQuirks.cpp:

(WebCore::urlRequiresMacintoshPlatform):

• platform/network/soup/NetworkStorageSessionSoup.cpp:

(WebCore::NetworkStorageSession::saveCredentialToPersistentStorage):

• rendering/RenderThemeGtk.cpp:

(WebCore::RenderThemeGtk::adjustTextFieldStyle const):

Source/WebKit:

• UIProcess/API/glib/APIWebsiteDataStoreGLib.cpp:

Source/WTF:

• wtf/URLParser.cpp:

(WTF::URLParser::internationalDomainNameTranscoder):

Tools:

• BuildSlaveSupport/gtk/README:
• MiniBrowser/gtk/BrowserWindow.c:
• MiniBrowser/gtk/main.c:

(aboutURISchemeRequestCallback):

• Scripts/webkitpy/common/config/contributionareas.py:
• Scripts/webkitpy/common/config/contributors.json:
• Scripts/webkitpy/tool/commands/analyzechangelog_unittest.py:
• TestWebKitAPI/Tests/WebKitGLib/TestCookieManager.cpp:
• TestWebKitAPI/Tests/WebKitGLib/TestResources.cpp:

(testWebViewResources):

• TestWebKitAPI/Tests/WebKitGLib/TestUIClient.cpp:

(testWebViewMouseTarget):

• TestWebKitAPI/Tests/WebKitGLib/TestWebExtensions.cpp:

(testWebExtensionGetTitle):
(testDocumentLoadedSignal):
(testWebExtensionFormControlsAssociated):

• TestWebKitAPI/Tests/WebKitGLib/TestWebKitSettings.cpp:

(testWebKitSettingsUserAgent):

• TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp:

(testWebViewRunJavaScript):

• TestWebKitAPI/Tests/WebKitGtk/InspectorTestServer.cpp:

(main):

• TestWebKitAPI/Tests/WebKitGtk/TestContextMenu.cpp:

(prepareContextMenuTestView):
(testContextMenuPopulateMenu):
(testContextMenuCustomMenu):
(testContextMenuDisableMenu):
(testContextMenuSubMenu):
(testContextMenuDismissed):
(testContextMenuWebExtensionMenu):
(testContextMenuWebExtensionNode):

• TestWebKitAPI/Tests/WebKitGtk/TestInspector.cpp:

(testInspectorDefault):
(testInspectorManualAttachDetach):
(testInspectorCustomContainerDestroyed):

• TestWebKitAPI/Tests/WebKitGtk/TestPrinting.cpp:

(testWebViewPrint):
(testPrintOperationPrint):
(testPrintOperationErrors):

• gtk/install-dependencies:
• gtk/jhbuild.modules:
• gtkdoc/generate-gtkdoc:
• wpe/install-dependencies:

7:47 AM Changeset in webkit [246789] by Michael Catanzaro

• 4 edits in trunk

Require GCC 7
​https://bugs.webkit.org/show_bug.cgi?id=198914

Reviewed by Darin Adler.

.:

• CMakeLists.txt:

Source/WTF:

Remove now-stale GCC version check.

• wtf/Compiler.h:

2:13 AM Changeset in webkit [246788] by Fujii Hironori

• 2 edits in trunk/LayoutTests

Unreviewed test gardening

• TestExpectations: Added webkit.org/b/184066 to imported/w3c/web-platform-tests/IndexedDB/nested-cloning-large-multiple.html and others.

Added webkit.org/b/184065 to imported/w3c/web-platform-tests/IndexedDB/keypath-exceptions.htm.

2:00 AM Changeset in webkit [246787] by Fujii Hironori

• 2 edits in trunk/LayoutTests

[WinCairo] Unreviewed test gardening

• platform/wincairo/TestExpectations: Added webkit.org/b/199186 to fonts/use-typo-metrics-1.html.

Removed duplicated storage/indexeddb/key-type-array-private.html and storage/indexeddb/key-type-array.html.

1:42 AM Changeset in webkit [246786] by commit-queue@webkit.org

• 4 edits in trunk/Source/WebCore

Introduce LinkLoadParameters
​https://bugs.webkit.org/show_bug.cgi?id=198960

Patch by Rob Buis <​rbuis@igalia.com> on 2019-06-25
Reviewed by Frédéric Wang.

Avoid the long parameters lists in LinkLoader by moving them
to LinkLoadParameters.

No new tests because there is no behavior change.

• html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::process):

• loader/LinkLoader.cpp:

(WebCore::LinkLoader::loadLinksFromHeader):
(WebCore::LinkLoader::preconnectIfNeeded):
(WebCore::LinkLoader::preloadIfNeeded):
(WebCore::LinkLoader::prefetchIfNeeded):
(WebCore::LinkLoader::loadLink):

• loader/LinkLoader.h:

12:25 AM Changeset in webkit [246785] by bshafiei@apple.com

• 12 edits in tags/Safari-608.1.30.2

Revert r246530. rdar://problem/52020968

12:23 AM Changeset in webkit [246784] by bshafiei@apple.com

• 7 edits in tags/Safari-608.1.30.2/Source

Versioning.

12:19 AM Changeset in webkit [246783] by bshafiei@apple.com

• 1 copy in tags/Safari-608.1.30.2

New tag.

Jun 24, 2019:

9:15 PM Changeset in webkit [246782] by Ryan Haddad

• 2 edits in branches/safari-607-branch/Tools

Cherry-pick r245975. rdar://problem/52090309

WebKitTestRunner sometimes freezes under -[NSWindow release]
​https://bugs.webkit.org/show_bug.cgi?id=198422

Reviewed by Tim Horton.

The window remains key until it's out of the allWindows vector, and AppKit is not
happy about deallocating key windows. Fixed by updating allWindows in -close
instead of -release.

Added isMainFrame assertions in code that manipulates allWindows for a good measure.

• WebKitTestRunner/mac/WebKitTestRunnerWindow.mm: (+[WebKitTestRunnerWindow _WTR_keyWindow]): (-[WebKitTestRunnerWindow initWithContentRect:styleMask:backing:defer:]): (-[WebKitTestRunnerWindow close]): (-[WebKitTestRunnerWindow dealloc]):

git-svn-id: ​http://svn.webkit.org/repository/webkit/trunk@245975 268f45cc-cd09-0410-ab3c-d52691b4dbfc

9:06 PM Changeset in webkit [246781] by Wenson Hsieh

• 8 edits
  1 move
  1 add
  1 delete in trunk

[Text autosizing] [iPadOS] Revise our heuristics to determine idempotent text autosizing candidates
​https://bugs.webkit.org/show_bug.cgi?id=198763
<rdar://problem/51826266>

Reviewed by Simon Fraser.

Source/WebCore:

This patch adjusts existing text autosizing heuristics, based on a survey of text on websites in the Alexa top
500 that shrink down to fit the viewport when requesting the desktop version of the site. The new heuristic is
derived from training decision trees against the dataset obtained from this survey, and balances false positives
(cases where layout is broken due to autosizing) against overall accuracy (measured using cross-validation).

See below for more details. Additionally, please refer to the link in the radar for more details, as well as
resources used to generate, validate, and analyze these decision trees.

Test: fast/text-autosizing/ios/idempotentmode/idempotent-autosizing-candidates.html

• css/StyleResolver.cpp:

(WebCore::StyleResolver::adjustRenderStyleForTextAutosizing):

• rendering/style/RenderStyle.cpp:

(WebCore::RenderStyle::isIdempotentTextAutosizingCandidate const):

Rename AutosizeStatus::shouldSkipSubtree to RenderStyle::isIdempotentTextAutosizingCandidate. We relocate this
logic to RenderStyle, such that we're able to ask the element's RenderStyle questions when determining whether
the element should be autosized.

Of course, this patch additionally revamps the heuristic used to determine whether it is safe to autosize an
element. Our current heuristic in trunk simply checks for the presence of inline block display, out of flow
positioning and a fixed height ancestor; if any of these conditions are satisfied, we opt the element out of
text autosizing. This is an excellent strategy for boosting some runs of text while avoiding autosizing in the
vast majority of cases where increasing font size may lead to layout breakage (e.g. overlapping or clipped text,
content unexpectedly flowing to the next line, etc.). However, it also avoids boosting font sizes in many
scenarios where boosting font sizes is desired; for concrete examples, see the (currently 24) radars about small
font sizes that are duped to <rdar://problem/51826266>.

To help analyze and identify trends in autosizable and non-autosizable text, we assembled a dataset of elements
with text from the Alexa top 500 that either: (1) were too small and could be boosted safely, or (2) would break
layout if boosted. With this labeled dataset, we then trained binary decision trees to classify the data. Each
decision tree was trained with a number of hyperparameters: namely, maximum depth, minimum leaf size, and the
amount of bias towards negative samples (i.e. the ratio of the weight of a non-autosizable sample relative to
the weight of an autosizable sample).

For each 3-tuple of these hyperparameters (800 in total: max depth between 3 and 10, min leaf size between 1 and
10 and bias between 1 and 10), for 5000 iterations each, we split the full dataset into a training dataset and
a cross-validation dataset, trained a decision tree using the training set, and tested against the cross-
validation set to compute average precision, recall, and overall accuracy for each tuple of hyperparameters.

The decision tree introduced in this patch was generated using a hand-picked set of hyperparameters (max depth
10, min leaf size 4, and negative bias 2) to provide a balance between precision scores (limiting layout
breakage) and recall score (ensuring that small text is mostly autosized), while optimizing for overall
accuracy. Cross-validation scores predict that the overall accuracy of this classifier is approximately 70%, up
from the current accuracy in trunk (~53%).

• rendering/style/RenderStyle.h:

Grow the width of autosizeStatus from 4 to 8 (notably, this does not increase the size of RenderStyle).

• rendering/style/TextSizeAdjustment.cpp:

(WebCore::AutosizeStatus::updateStatus):
(WebCore::AutosizeStatus::shouldSkipSubtree const): Deleted.

• rendering/style/TextSizeAdjustment.h:

Introduce new text autosizing state flags, and remove some existing ones.

LayoutTests:

Rebaseline an existing text autosizing test, and introduce some new test cases that correspond to several common
patterns of autosizable (or non-autosizable) text on websites that were surveyed.

• fast/text-autosizing/ios/idempotentmode/idempotent-autosizing-after-changing-initial-scale.html:
• fast/text-autosizing/ios/idempotentmode/idempotent-autosizing-candidates-expected.txt: Added.
• fast/text-autosizing/ios/idempotentmode/idempotent-autosizing-candidates.html: Renamed from LayoutTests/fast/text-autosizing/ios/idempotentmode/idempotent-autosizing-skip.html.

Rename this existing layout test too, to avoid using the term "skip" in the name of a layout test.

• fast/text-autosizing/ios/idempotentmode/idempotent-autosizing-skip-expected.txt: Removed.

6:21 PM Changeset in webkit [246780] by commit-queue@webkit.org

• 103 edits
  1 delete in trunk

Unreviewed, rolling out r246714.
​https://bugs.webkit.org/show_bug.cgi?id=199179

revert to do patch in a different way. (Requested by keith_mi_
on #webkit).

Reverted changeset:

"All prototypes should call didBecomePrototype()"
​https://bugs.webkit.org/show_bug.cgi?id=196315
​https://trac.webkit.org/changeset/246714

6:07 PM Changeset in webkit [246779] by Kocsen Chung

• 1 copy in tags/Safari-608.1.31.0.1

Tag Safari-608.1.31.0.1.

6:05 PM Changeset in webkit [246778] by Kocsen Chung

• 1 copy in tags/Safari-608.1.31.1.1

Tag Safari-608.1.31.1.1.

5:56 PM Changeset in webkit [246777] by Kocsen Chung

• 7 edits in tags/Safari-607.3.5/Source

Versioning.

5:49 PM Changeset in webkit [246776] by Kocsen Chung

• 1 copy in tags/Safari-607.3.5

Tag Safari-607.3.5.

5:26 PM Changeset in webkit [246775] by beidson@apple.com

• 9 edits in trunk

Revert "-[WKWebsiteDataStore removeDataOfTypes:modifiedSince:completionHandler:] doesn't delete _WKWebsiteDataTypeCredentials"

See <rdar://problem/52077293>

This reverts commit d86464be5509e2e6dbc7356cfd802e6b4e14b350.

5:06 PM Changeset in webkit [246774] by Alan Coon

• 12 edits in branches/safari-608.1.31.0-branch

Revert r246530. rdar://problem/52020968

5:00 PM Changeset in webkit [246773] by Kocsen Chung

• 12 edits in branches/safari-608.1.31.1-branch

Revert r246530. rdar://problem/52020968

4:52 PM Changeset in webkit [246772] by Alan Coon

• 1 edit in branches/safari-607-branch/Source/JavaScriptCore/bytecode/CodeBlock.cpp

Apply patch. rdar://problem/51927634

4:46 PM Changeset in webkit [246771] by Kocsen Chung

• 7 edits in branches/safari-608.1.31.1-branch/Source

Versioning.

4:45 PM Changeset in webkit [246770] by sihui_liu@apple.com

• 6 edits in trunk

REGRESSION (r244436): IndexedDB Uint8Array returned as ArrayBuffer
​https://bugs.webkit.org/show_bug.cgi?id=198738
<rdar://problem/51614053>

Reviewed by Brady Eidson.

In InexedDB, two binary keys are the same as long as their data is the same.

Modified tests: storage/indexeddb/key-type-binary.html

storage/indexeddb/key-type-binary-private.html

• bindings/js/IDBBindingUtilities.cpp:

(WebCore::injectIDBKeyIntoScriptValue):

• bindings/js/SerializedScriptValue.cpp:

(WebCore::CloneDeserializer::readArrayBufferView):

4:37 PM Changeset in webkit [246769] by Kocsen Chung

• 1 copy in branches/safari-608.1.31.1-branch

New branch.

4:26 PM Changeset in webkit [246768] by sihui_liu@apple.com

• 5 edits in trunk/Source/WebCore

Remove WebSQL quirk for nytimes.com
​https://bugs.webkit.org/show_bug.cgi?id=199175

Reviewed by Geoffrey Garen.

Removed unused code.

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateRuntimeEnableConditionalString):

• bindings/scripts/IDLAttributes.json:
• page/Quirks.cpp:

(WebCore::Quirks::hasBrokenEncryptedMediaAPISupportQuirk const):
(WebCore::Quirks::hasWebSQLSupportQuirk const): Deleted.

• page/Quirks.h:

4:00 PM Changeset in webkit [246767] by beidson@apple.com

• 4 edits in trunk/Source

Null deref in WebFrameLoaderClient::dispatchDidReceiveServerRedirectForProvisionalLoad.
<rdar://problem/51535942> and ​https://bugs.webkit.org/show_bug.cgi?id=199123

Reviewed by Andy Estes.

Source/WebCore:

• loader/FrameLoaderStateMachine.h:

(WebCore::FrameLoaderStateMachine::stateForDebugging const):

Source/WebKit:

• WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDidReceiveServerRedirectForProvisionalLoad): Properly detect this null DocumentLoader

and try to learn more about the state of things.

3:44 PM Changeset in webkit [246766] by Simon Fraser

• 4 edits
  2 adds in trunk

REGRESSION (r246725 ): Crashes on twitch.tv
​https://bugs.webkit.org/show_bug.cgi?id=199176
Source/WebCore:

rdar://problem/52071249

Reviewed by Zalan Bujtas.

With a composited negative z-index child inside a scroller, we can register the overflow scroll
proxy node before we've traversed the overflow layer, so it that layer hasn't got its OverflowScrollingNode
yet. Thus, AsyncScrollingCoordinator::setRelatedOverflowScrollingNodes() can be called with an empty vector.
Avoid crashing when this happens.

Test: scrollingcoordinator/scrolling-tree/scroller-with-negative-z-child.html

• page/scrolling/AsyncScrollingCoordinator.cpp:

(WebCore::AsyncScrollingCoordinator::setRelatedOverflowScrollingNodes):

• page/scrolling/cocoa/ScrollingTreeOverflowScrollProxyNode.mm:

(WebCore::ScrollingTreeOverflowScrollProxyNode::commitStateBeforeChildren):

LayoutTests:

Reviewed by Zalan Bujtas.

• scrollingcoordinator/scrolling-tree/scroller-with-negative-z-child-expected.txt: Added.
• scrollingcoordinator/scrolling-tree/scroller-with-negative-z-child.html: Added.

3:29 PM Changeset in webkit [246765] by commit-queue@webkit.org

• 8 edits in trunk

Add Array.prototype.{flat,flatMap} to unscopables
​https://bugs.webkit.org/show_bug.cgi?id=194322

Patch by Alexey Shvayka <Alexey Shvayka> on 2019-06-24
Reviewed by Keith Miller.

JSTests:

• stress/unscopables.js: Fix test.
• test262/expectations.yaml: Mark 2 test cases as passing.

Source/JavaScriptCore:

• runtime/ArrayPrototype.cpp:

(JSC::ArrayPrototype::finishCreation):

LayoutTests:

• js/array-unscopables-properties-expected.txt:
• js/script-tests/array-unscopables-properties.js:

3:22 PM Changeset in webkit [246764] by Chris Dumez

• 5 edits in trunk/Source

Pages using Google's anti-flicker optimization may take ~5 seconds to do initial paint
​https://bugs.webkit.org/show_bug.cgi?id=199173
<rdar://problem/45968770>

Reviewed by Geoffrey Garen.

Source/WebCore:

Pages using Google's anti-flicker optimization [1] take ~5 seconds to do initial paint when
analytics.js load is blocked by a content blocker.

To address the issue, this patch introduces a quirk behind an experimental feature flag that
calls window.dataLayer.hide.end() on the page when the load of ​https://www.google-analytics.com/analytics.js
is blocked by a content blocker. Note that this is more robust than dropping the 'async-hide'
class from document.documentElement since the class name is customizable by the caller.
A message is logged in the console when the quirk causes window.dataLayer.hide.end() to get called
early.

[1] ​https://developers.google.com/optimize/

• contentextensions/ContentExtensionsBackend.cpp:

(WebCore::ContentExtensions::ContentExtensionsBackend::processContentRuleListsForLoad):

• page/Settings.yaml:

Source/WebKit:

Add experimental feature for the quirk.

• Shared/WebPreferences.yaml:

2:37 PM Changeset in webkit [246763] by wilander@apple.com

• 9 edits in trunk/Source

Remove IsITPFirstPartyWebsiteDataRemovalEnabled as runtime check
​https://bugs.webkit.org/show_bug.cgi?id=199164
<rdar://problem/52061147>

Reviewed by Brent Fulgham.

Source/WebCore:

No new tests. Just a removal of a runtime feature check. The functionality
already has a layout test.

We've had this toggle as a safety thing since mid-March. No need for it any longer.

• page/RuntimeEnabledFeatures.h:

(WebCore::RuntimeEnabledFeatures::isITPDatabaseEnabled const):
(WebCore::RuntimeEnabledFeatures::setIsITPFirstPartyWebsiteDataRemovalEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::isITPFirstPartyWebsiteDataRemovalEnabled const): Deleted.

Source/WebKit:

We've had this toggle as a safety thing since mid-March. No need for it any longer.

• NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.cpp:

(WebKit::ResourceLoadStatisticsMemoryStore::shouldRemoveAllButCookiesFor const):

• NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::initializeNetworkProcess):

• NetworkProcess/NetworkProcessCreationParameters.cpp:

(WebKit::NetworkProcessCreationParameters::encode const):
(WebKit::NetworkProcessCreationParameters::decode):

• NetworkProcess/NetworkProcessCreationParameters.h:
• Shared/WebPreferences.yaml:
• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::platformInitializeNetworkProcess):

1:16 PM Changeset in webkit [246762] by Alan Coon

• 2 edits in branches/safari-608.1.31.0-branch/Source/WebCore

Cherry-pick r246706. rdar://problem/51161612

Nullptr crash in DeleteSelectionCommand::handleGeneralDelete
​https://bugs.webkit.org/show_bug.cgi?id=199126

Reviewed by Wenson Hsieh.

Added null checks to handleGeneralDelete as well as mergeParagraphs which runs after handleGeneralDelete to be defensive.

Unfortunately no new tests since there is no reproducible test case.

• editing/DeleteSelectionCommand.cpp: (WebCore::DeleteSelectionCommand::handleGeneralDelete): (WebCore::DeleteSelectionCommand::mergeParagraphs):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@246706 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:09 PM Changeset in webkit [246761] by Alan Coon

• 7 edits in branches/safari-608.1.31.2-branch/Source

Versioning.

1:04 PM Changeset in webkit [246760] by Alan Coon

• 7 edits in branches/safari-608.1.31.0-branch/Source

Versioning.

12:57 PM Changeset in webkit [246759] by jer.noble@apple.com

• 13 edits
  4 adds in trunk

iOS 12.2 Drawing portrait video to canvas is sideways
​https://bugs.webkit.org/show_bug.cgi?id=196772
<rdar://problem/49781802>

Reviewed by Eric Carlson.

Source/WebCore:

Test: media/video-orientation-canvas.html

Move rotation code into its own ImageRotationSessionVT class for re-use across
all existing classes with rotation operations. Should slightly increase performance
for painting rotated media files, as the rotation only occurs once per frame, rather
than once per drawing operation.

• WebCore.xcodeproj/project.pbxproj:
• platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.h:

(WebCore::ImageDecoderAVFObjC::RotationProperties::isIdentity const): Deleted.

• platform/graphics/avfoundation/objc/ImageDecoderAVFObjC.mm:

(WebCore::ImageDecoderAVFObjC::readTrackMetadata):
(WebCore::ImageDecoderAVFObjC::storeSampleBuffer):
(WebCore::ImageDecoderAVFObjC::setTrack):
(WebCore::transformToRotationProperties): Deleted.

• platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
• platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::tracksChanged):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastPixelBuffer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput):

• platform/graphics/cv/ImageRotationSessionVT.h: Added.

(WebCore::ImageRotationSessionVT::RotationProperties::isIdentity const):
(WebCore::ImageRotationSessionVT::rotationProperties const):
(WebCore::ImageRotationSessionVT::rotatedSize):

• platform/graphics/cv/ImageRotationSessionVT.mm: Added.

(WebCore::transformToRotationProperties):
(WebCore::ImageRotationSessionVT::ImageRotationSessionVT):
(WebCore::ImageRotationSessionVT::rotate):

• platform/mediastream/mac/RealtimeOutgoingVideoSourceCocoa.cpp:
• platform/mediastream/mac/RealtimeOutgoingVideoSourceCocoa.h:
• platform/mediastream/mac/RealtimeOutgoingVideoSourceCocoa.mm:

(WebCore::rotationToAngle):
(WebCore::RealtimeOutgoingVideoSourceCocoa::rotatePixelBuffer):
(WebCore::computeRotatedWidthAndHeight): Deleted.

LayoutTests:

• media/content/no-rotation.mp4:
• media/media-source/only-bcp47-language-tags-accepted-as-valid-expected.txt:
• media/video-orientation-canvas-expected.txt: Added.
• media/video-orientation-canvas.html: Added.
• media/video-test.js:

(waitFor):

12:51 PM Changeset in webkit [246758] by Alan Coon

• 1 copy in branches/safari-608.1.31.2-branch

New branch.

12:47 PM Changeset in webkit [246757] by dbates@webkit.org

• 9 edits in trunk

m_focusedElement != &element in WebPage::elementDidBlur() sometimes
​https://bugs.webkit.org/show_bug.cgi?id=198928
<rdar://problem/51814327>

Reviewed by Brent Fulgham.

Source/WebKit:

This can happen when the focused editable element is inside a nested frame and a person
taps outside that frame. For reasons that seem lost to time, WebKit2 on iOS would mutate
the focused frame whenever computing selection positioning information (say, for a tap).
This "quirk" was added in r163476, but that code has go through multiple iterations and
is no longer comparable to the current code. Yet, the original mutation of the focused
frame remained. As a result the UI process and Web process go out of sync with respect
to what each thinks is the focused element and this visually manifest itself in at least
two ways:

1. A non-sensical DOM focus event would be dispatched at the frame tapped, but we would keep the focused element focused.

2. Because we would keep the focused element focused in (1), even though its frame is not focused, the keyboard would be active (software keyboard on screen or candidate bar on screen if a hardware keyboard is attached), but appear unresponsive: any keys pressed would not cause text to be typed into the editable field.

Because of (1) it was possible for m_focusedElement != &element in WebPage::elementDidBlur().
When this happens the UI process would never receive an ElementDidBlur message and hence would
not clear out the focused element state and hide the keyboard.

We neither do this frame focus mutation in Legacy WebKit on iOS nor Mac. Let's remove this quirk.
If it turns out that it causes a compatibility issue then we will be in a better position to
understand its purpose and consider bringing this quirk back, if needed.

• Shared/ios/InteractionInformationRequest.cpp:

(WebKit::InteractionInformationRequest::encode const):
(WebKit::InteractionInformationRequest::decode):
(WebKit::InteractionInformationRequest::isValidForRequest):
(WebKit::InteractionInformationRequest::isApproximatelyValidForRequest):

• Shared/ios/InteractionInformationRequest.h:
• UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _requestActivatedElementAtPosition:completionBlock:]):

• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _webTouchEventsRecognized:]):
Remove the readOnly field.

• WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::selectionPositionInformation): Remove code to mutate the focused frame.

LayoutTests:

Update test result now that we do not mutate the focused frame on tap.

• TestExpectations: Skip problematic test editing/deleting/smart-delete-paragraph-003.html;

See <​https://bugs.webkit.org/show_bug.cgi?id=198928#c16>, <​https://bugs.webkit.org/show_bug.cgi?id=198928#c17>,
and <​https://bugs.webkit.org/show_bug.cgi?id=199039> for more details.

• fast/events/ios/should-be-able-to-dismiss-form-accessory-after-tapping-outside-iframe-with-focused-field-expected.txt:

12:47 PM Changeset in webkit [246756] by Alan Coon

• 1 copy in branches/safari-608.1.31.0-branch

New branch.

12:37 PM Changeset in webkit [246755] by Alan Bujtas

• 3 edits in trunk/Source/WebCore

[StyleResolver] Pass RenderStyle& instead of RenderStyle* to updateFont() related functions.
​https://bugs.webkit.org/show_bug.cgi?id=199167
<rdar://problem/52062669>

Reviewed by Antti Koivisto.

It is expected to have a valid RenderStyle object here (and existing code relies on it).

• css/StyleResolver.cpp:

(WebCore::checkForOrientationChange):
(WebCore::StyleResolver::updateFont):
(WebCore::StyleResolver::checkForTextSizeAdjust):
(WebCore::StyleResolver::checkForZoomChange):
(WebCore::StyleResolver::checkForGenericFamilyChange):

• css/StyleResolver.h:

12:32 PM Changeset in webkit [246754] by pvollan@apple.com

• 2 edits in trunk/Source/WebKit

[Cocoa] Avoid creating a PlatformMediaSessionManager when the WebProcess is suspended or resumed
​https://bugs.webkit.org/show_bug.cgi?id=199160

Reviewed by Brent Fulgham.

When the WebProcess suspends or resumes, the PlatformMediaSessionManager is notified about this.
Avoid creating a new PlatformMediaSessionManager if it does not already exist.

• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::actualPrepareToSuspend):
(WebKit::WebProcess::cancelPrepareToSuspend):
(WebKit::WebProcess::processDidResume):

12:02 PM Changeset in webkit [246753] by graouts@webkit.org

• 4 edits
  1 add in trunk/LayoutTests

[Pointer Events WPT] Unskip imported/w3c/web-platform-tests/pointerevents/pointerlock/pointerevent_coordinates_when_locked.html
​https://bugs.webkit.org/show_bug.cgi?id=197007

Reviewed by Dean Jackson.

LayoutTests/imported/w3c:

Update the test from the Web Platform Tests repository following the fix for ​https://github.com/web-platform-tests/wpt/issues/16406.

• web-platform-tests/pointerevents/pointerlock/pointerevent_coordinates_when_locked-expected.txt: Added.
• web-platform-tests/pointerevents/pointerlock/pointerevent_coordinates_when_locked.html:

LayoutTests:

This test now works reliably, even if it fails the actual assertions.

• platform/mac/TestExpectations:

12:00 PM Changeset in webkit [246752] by graouts@webkit.org

• 7 edits
  1 add
  3 deletes in trunk

[Pointer Events WPT] Unskip imported/w3c/web-platform-tests/pointerevents/pointerevent_lostpointercapture_is_first.html
​https://bugs.webkit.org/show_bug.cgi?id=197005

Reviewed by Dean Jackson.

LayoutTests/imported/w3c:

• web-platform-tests/pointerevents/pointerevent_lostpointercapture_is_first-expected.txt: Added.
• web-platform-tests/resources/testdriver-vendor.js:

(dispatchMouseActions): We need to disable dragMode for the eventSender or else the "pointermove" events in the test will
not be dispatched as there is no mouseUp() call in the test's event sequence.

Source/WebCore:

We were calling processPendingPointerCapture() at the wrong time, calling in after dispatching a PointerEvent rather than before.
We now do this correctly in the consolidated PointerCaptureController::dispatchEvent() method, which we call for dispatching all
PointerEvents, save for gotpointercapture and lostpointercapture since these should not yield the processing of the pending pointer
capture per the spec.

This uncovered a couple of new issues. First, since we would now call processPendingPointerCapture() and dispatch a lostpointercapture
event earlier, the alternative lostpointercapture dispatch when an element is removed (which is dispatched asynchronously on the
document) would be dispatched *after* dispatching the event in processPendingPointerCapture(). We now check in processPendingPointerCapture()
whether the event target is connected to fix this. This makes sure pointerevent_lostpointercapture_for_disconnected_node.html doesn't regress.

Finally, we must also call processPendingPointerCapture() when implicitly releasing pointer capture during handling of a "pointerup" event.
This ensures that pointerevent_releasepointercapture_invalid_pointerid.html doesn't regress.

As a result of all these changes, we now pass imported/w3c/web-platform-tests/pointerevents/pointerevent_lostpointercapture_is_first.html reliably.

• page/PointerCaptureController.cpp:

(WebCore::PointerCaptureController::dispatchEventForTouchAtIndex):
(WebCore::PointerCaptureController::dispatchEvent): We now more closely adhere to the spec when determining what the pointer capture target is by
only checking for the target override. We can now do this safely since we call processPendingPointerCapture() before and not after event dispatch.
(WebCore::PointerCaptureController::pointerEventWasDispatched):
(WebCore::PointerCaptureController::processPendingPointerCapture): Cache the pending target override to make sure that dispatching a "gotpointercapture"
or "lostpointercapture" event during this function does not alter it until the next call is made when the next event is dispatched.

LayoutTests:

• platform/mac-wk1/imported/w3c/web-platform-tests/pointerevents/pointerevent_mouse_capture_change_hover-expected.txt: Removed.
• platform/mac-highsierra-wk1/imported/w3c/web-platform-tests/pointerevents/pointerevent_mouse_capture_change_hover-expected.txt: Removed.
• platform/mac-highsierra/imported/w3c/web-platform-tests/pointerevents/pointerevent_mouse_capture_change_hover-expected.txt: Removed.

Since we've fixed the issue with event dispatch in WK1, we can remove these platform-specific expectations.

• platform/mac/TestExpectations: We no longer skip this test which works reliably.
• pointerevents/mouse/pointer-capture.html: We modify this test to correctly expect the "gotpointercapture" event only once the next

pointer event has been dispatched.

11:59 AM Changeset in webkit [246751] by Michael Catanzaro

• 2 edits in trunk/Tools

contributors.json not canonicalized since r243297
​https://bugs.webkit.org/show_bug.cgi?id=199161

Reviewed by Alexey Proskuryakov.

Canonicalize it using 'validate-committer-lists --canonicalize'

• Scripts/webkitpy/common/config/contributors.json:

11:56 AM Changeset in webkit [246750] by Kocsen Chung

• 7 edits in branches/safari-607-branch/Source

Versioning.

11:52 AM Changeset in webkit [246749] by Kocsen Chung

• 7 edits
  4 adds in branches/safari-607-branch

Cherry-pick r246372. rdar://problem/51927634

[JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call
​https://bugs.webkit.org/show_bug.cgi?id=198770

Reviewed by Saam Barati.

JSTests:

• stress/poly-call-stub-slow-path-should-restore-callee-saves-when-doing-tail-call.js: Added. (test):

Source/JavaScriptCore:

Polymorphic call stub is a bit specially patched in JS call site. Typical JS call site for tail calls
are the following.

if (callee == patchableCallee) {

restore callee saves for tail call
prepare for tail call
jump to the target function

}
restore callee saves for slow path
call the slow path function

And linking patches patchableCallee, target function, and slow path function. But polymorphic call stub
patches the above if statement with the jump to the stub.

jump to the polymorphic call stub

This is because polymorphic call stub wants to use CallFrameShuffler to get scratch registers. As a result,
"restore callee saves for tail call" thing needs to be done in the polymorphic call stubs. While it is
correctly done for the major cases, we have slowPath skips, and that path missed restoring callee saves.
This skip happens if the callee is non JSCell or non JS function, so typically, InternalFunction is handled
in that path.

This patch does that skips after restoring callee saves.

• bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::CallLinkInfo):
• bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::setUpCall): (JSC::CallLinkInfo::calleeGPR): (JSC::CallLinkInfo::setCalleeGPR): Deleted.
• jit/Repatch.cpp: (JSC::revertCall): (JSC::linkVirtualFor): (JSC::linkPolymorphicCall):
• jit/Repatch.h:
• jit/ThunkGenerators.cpp: (JSC::virtualThunkFor):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@246372 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:52 AM Changeset in webkit [246748] by Kocsen Chung

• 4 edits
  1 add in branches/safari-607-branch

Cherry-pick r243966. rdar://problem/51927634

[JSC] CallLinkInfo should clear Callee or CodeBlock even if it is unlinked by jettison
​https://bugs.webkit.org/show_bug.cgi?id=196683

Reviewed by Saam Barati.

JSTests:

• stress/clear-callee-or-codeblock-in-calllinkinfo-even-cleared-by-jettison.js: Added. (foo):

Source/JavaScriptCore:

In r243626, we stop repatching CallLinkInfo when the CallLinkInfo is held by jettisoned CodeBlock.
But we still need to clear the Callee or CodeBlock since they are now dead. Otherwise, CodeBlock's
visitWeak eventually accesses this dead cells and crashes because the owner CodeBlock of CallLinkInfo
can be still live.

We also move all repatching operations from CallLinkInfo.cpp to Repatch.cpp for consistency because the
other repatching operations in CallLinkInfo are implemented in Repatch.cpp side.

• bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::setCallee): (JSC::CallLinkInfo::clearCallee):
• jit/Repatch.cpp: (JSC::linkFor): (JSC::revertCall):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243966 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:52 AM Changeset in webkit [246747] by Kocsen Chung

• 6 edits
  1 add in branches/safari-607-branch

Cherry-pick r243626. rdar://problem/51927634

CodeBlock::jettison() should disallow repatching its own calls
​https://bugs.webkit.org/show_bug.cgi?id=196359
<rdar://problem/48973663>

Reviewed by Saam Barati.

JSTests:

• stress/call-link-info-osrexit-repatch.js: Added. (foo):

Source/JavaScriptCore:

CodeBlock::jettison() calls CommonData::invalidate, which replaces the hlt
instruction with the jump to OSR exit. However, if the hlt was immediately
followed by a call to the CodeBlock being jettisoned, we would write over the
OSR exit address while unlinking all the incoming CallLinkInfos later in
CodeBlock::jettison().

Change it so that we set a flag, clearedByJettison, in all the CallLinkInfos
owned by the CodeBlock being jettisoned. If the flag is set, we will avoid
repatching the call during unlinking. This is safe because this call will never
be reachable again after the CodeBlock is jettisoned.

• bytecode/CallLinkInfo.cpp: (JSC::CallLinkInfo::CallLinkInfo): (JSC::CallLinkInfo::setCallee): (JSC::CallLinkInfo::clearCallee): (JSC::CallLinkInfo::setCodeBlock): (JSC::CallLinkInfo::clearCodeBlock):
• bytecode/CallLinkInfo.h: (JSC::CallLinkInfo::clearedByJettison): (JSC::CallLinkInfo::setClearedByJettison):
• bytecode/CodeBlock.cpp: (JSC::CodeBlock::jettison):
• jit/Repatch.cpp: (JSC::revertCall):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@243626 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:52 AM Changeset in webkit [246746] by Kocsen Chung

• 2 edits in branches/safari-607-branch/Source/JavaScriptCore

Cherry-pick r246507. rdar://problem/51927645

Concurrent GC should check the conn before starting a new collection cycle
​https://bugs.webkit.org/show_bug.cgi?id=198913
<rdar://problem/49515149>

Reviewed by Filip Pizlo.

Heap::requestCollection tries to steal the conn as an optimization to avoid waking up the collector
thread if it's idle. We determine if the collector is idle by ensuring that there are no pending collections
and that the current GC phase is NotRunning. However, that's not safe immediately after the concurrent
GC has finished processing the last pending request. The collector thread will runEndPhase and immediately
start runNotRunningPhase, without checking if it still has the conn. If the mutator has stolen the conn in
the mean time, this will lead to both threads collecting concurrently, and eventually we'll crash in checkConn,
since the collector is running but doesn't have the conn anymore.

To solve this, we check if we still have the conn after holding the lock in runNotRunningPhase, in case the mutator
has stolen the conn. Ideally, we wouldn't let the mutator steal the conn in the first place, but that doesn't seem
trivial to determine.

• heap/Heap.cpp: (JSC::Heap::runNotRunningPhase):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@246507 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:52 AM Changeset in webkit [246745] by Kocsen Chung

• 12 edits
  2 adds in branches/safari-607-branch

Cherry-pick r246505. rdar://problem/51927642

[JSC] Introduce DisposableCallSiteIndex to enforce type-safety
​https://bugs.webkit.org/show_bug.cgi?id=197378

Reviewed by Saam Barati.

JSTests:

• stress/disposable-call-site-index-with-call-and-this.js: Added. (foo): (bar):
• stress/disposable-call-site-index.js: Added. (foo): (bar):

Source/JavaScriptCore:

Some of CallSiteIndex are disposable. This is because some of CallSiteIndex are allocated and freed at runtime (not DFG/FTL compile time).
The example is CallSiteIndex for exception handler in GCAwareJITStubRoutineWithExceptionHandler. If we do not allocate and free CallSiteIndex,
we will create a new CallSiteIndex continuously and leak memory.

The other CallSiteIndex are not simply disposable because the ownership model is not unique one. They can be shared between multiple clients.
But not disposing them is OK because they are static one: they are allocated when compiling DFG/FTL, and we do not allocate such CallSiteIndex
at runtime.

To make this difference explicit and avoid disposing non-disposable CallSiteIndex accidentally, we introduce DisposableCallSiteIndex type, and
enforce type-safety to some degree.

We also correctly update the DisposableCallSiteIndex => CodeOrigin table when we are reusing the previously used DisposableCallSiteIndex.

• bytecode/CodeBlock.cpp: (JSC::CodeBlock::newExceptionHandlingCallSiteIndex): (JSC::CodeBlock::removeExceptionHandlerForCallSite):
• bytecode/CodeBlock.h:
• bytecode/PolymorphicAccess.cpp: (JSC::AccessGenerationState::callSiteIndexForExceptionHandling): (JSC::PolymorphicAccess::regenerate):
• bytecode/PolymorphicAccess.h: (JSC::AccessGenerationState::callSiteIndexForExceptionHandling): Deleted.
• dfg/DFGCommonData.cpp: (JSC::DFG::CommonData::addUniqueCallSiteIndex): (JSC::DFG::CommonData::addDisposableCallSiteIndex): (JSC::DFG::CommonData::removeDisposableCallSiteIndex): (JSC::DFG::CommonData::removeCallSiteIndex): Deleted.
• dfg/DFGCommonData.h:
• interpreter/CallFrame.h: (JSC::DisposableCallSiteIndex::DisposableCallSiteIndex): (JSC::DisposableCallSiteIndex::fromCallSiteIndex):
• jit/GCAwareJITStubRoutine.cpp: (JSC::GCAwareJITStubRoutineWithExceptionHandler::GCAwareJITStubRoutineWithExceptionHandler): (JSC::GCAwareJITStubRoutineWithExceptionHandler::observeZeroRefCount): (JSC::createJITStubRoutine):
• jit/GCAwareJITStubRoutine.h:
• jit/JITInlineCacheGenerator.h:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@246505 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:49 AM Changeset in webkit [246744] by ysuzuki@apple.com

• 2 edits in trunk/Source/bmalloc

[bmalloc] IsoHeap shared tier threshold is small
​https://bugs.webkit.org/show_bug.cgi?id=199145

Reviewed by Saam Barati.

We accidentally picked 3 for the shared tier threshold. While this is OK because the important part of IsoHeap shared tier is putting
small # of shared objects before tiering up to the page-based allocation, increasing this threshold can potentially improve memory footprint.
This patch increases this threshold from 3 to 8. A/B test says that this offers stable 0.25% improvement in PLUM2.

• bmalloc/IsoHeapImpl.h:

11:20 AM Changeset in webkit [246743] by dean_johnson@apple.com

• 2 edits in trunk/Websites/perf.webkit.org

[perf.webkit.org] Update summary page calculations to use mean instead of median
​https://bugs.webkit.org/show_bug.cgi?id=199050

Reviewed by Dewei Zhu.

• public/v3/pages/summary-page.js:

(SummaryPageConfigurationGroup): Updated 'median' references to 'mean'.
(SummaryPageConfigurationGroup.set _startAndEndPointForTimeRange): Factored out logic for finding data
points in a timeSeries, within a specified timeRange.
(SummaryPageConfigurationGroup.set _meanForTimeRange): New. Returns the mean of a timeSeries across a
given timeRange.

11:18 AM Changeset in webkit [246742] by Jonathan Bedard

• 2 edits in trunk/Tools

webkitpy: Build style should be lower-case
​https://bugs.webkit.org/show_bug.cgi?id=199158

Reviewed by Aakash Jain.

• Scripts/webkitpy/test/main.py:

(Tester._run_tests): Make all styles lower-case.

11:06 AM Changeset in webkit [246741] by aakash_jain@apple.com

• 3 edits in trunk/Tools

[ews-build] Remove iOS queue from old EWS and dashboard
​https://bugs.webkit.org/show_bug.cgi?id=199150

Reviewed by Jonathan Bedard.

• BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BubbleQueueServer.js:
• QueueStatusServer/config/queues.py:

10:38 AM Changeset in webkit [246740] by mark.lam@apple.com

• 5 edits
  1 add in trunk

ArraySlice needs to keep the source array alive.
​https://bugs.webkit.org/show_bug.cgi?id=197374
<rdar://problem/50304429>

Reviewed by Michael Saboff and Filip Pizlo.

JSTests:

• stress/array-slice-must-keep-source-array-alive.js: Added.

Source/JavaScriptCore:

The implementation of the FTL ArraySlice intrinsics may GC while allocating the
result array and its butterfly. Previously, ArraySlice already keeps the source
butterfly alive in order to copy from it to the new butterfly after the allocation.
Unfortunately, this is not enough. We also need to keep the source array alive
so that GC will scan the values in the butterfly as well. Note: the butterfly
does not have a visitChildren() method to do this scan. It's the parent object's
responsibility to do the scanning.

This patch fixes this by introducing a keepAlive() utility method, and we use it
to keep the source array alive while allocating the result array and butterfly.

keepAlive() works by using a patchpoint to communicate to B3 that a value (the
source array in this case) is still in use. It also uses a fence to keep B3 from
relocating the patchpoint, which may defeat the fix.

For the DFG's SpeculativeJIT::compileArraySlice(), we may have lucked out and the
source array cell is kept alive. This patch makes it explicit that we should
keep its cell alive till after the result array has been allocated.

For the Baseline JIT and LLInt, we use the arrayProtoFuncSlice() runtime function
and there is no issue because the source array (in "thisObj") is in the element
copying loop that follows the allocation of the result array. However, for
documentation purposes, this patch adds a call to HeapCell::use() to indicate that
the source array need to kept alive at least until after the allocation of the
result array.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileArraySlice):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileArraySlice):
(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
(JSC::FTL::DFG::LowerDFGToB3::keepAlive):

• runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncSlice):

10:37 AM Changeset in webkit [246739] by Ryan Haddad

• 2 edits in trunk/Tools

API Test [Mojave+ WK2 Debug ] TestWebKitAPI.WKAttachmentTestsMac.InsertDroppedFilePromisesAsAttachments is a flaky crash
​https://bugs.webkit.org/show_bug.cgi?id=198795

Unreviewed test gardening.

• TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:

(TestWebKitAPI::TEST): Disable flaky test.

8:26 AM Changeset in webkit [246738] by aakash_jain@apple.com

• 3 edits in trunk/Tools

[ews-build] Enable iOS-12-Build queue on new EWS
​https://bugs.webkit.org/show_bug.cgi?id=199149

Reviewed by Jonathan Bedard.

• BuildSlaveSupport/ews-build/config.json: Enable iOS-12-Build-EWS trigger. Also temporarily share ews152 and ews154 with

this queue.

• BuildSlaveSupport/ews-app/ews/views/statusbubble.py:

(StatusBubble): Enable ios status-bubble. Also display the ios bubble first (left). Going forward
will keep the builders to the left and testers to the right.

8:11 AM Changeset in webkit [246737] by aakash_jain@apple.com

• 3 edits in trunk/Tools

[ews-build] Upload test results after running layout-tests
​https://bugs.webkit.org/show_bug.cgi?id=199120

Reviewed by Jonathan Bedard.

• BuildSlaveSupport/ews-build/steps.py:

(RunWebKitTests.evaluateCommand):

• BuildSlaveSupport/ews-build/steps_unittest.py: Added unit-tests.

8:03 AM Changeset in webkit [246736] by commit-queue@webkit.org

• 4 edits
  2 adds in trunk

Web Inspector: AXI: Audit: image label test is throwing spurious errors on elements with existing alt attr, but no value: <img alt>
​https://bugs.webkit.org/show_bug.cgi?id=194754

Patch by Greg Doolittle <​gr3g@apple.com> on 2019-06-24
Reviewed by Chris Fleizach.

Source/WebCore:

Test: accessibility/img-alt-attribute-unassigned-value.html

• accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::computedRoleString const):

LayoutTests:

• accessibility/img-alt-attribute-unassigned-value-expected.txt: Added.
• accessibility/img-alt-attribute-unassigned-value.html: Added.
• inspector/dom/getAccessibilityPropertiesForNode-expected.txt:

7:58 AM Changeset in webkit [246735] by aakash_jain@apple.com

• 2 edits in trunk/Tools

[ews-build] EWS should provide option to download layout test results zip file
​https://bugs.webkit.org/show_bug.cgi?id=199121

Reviewed by Jonathan Bedard.

• BuildSlaveSupport/ews-build/steps.py:

(ExtractTestResults.resultsDownloadURL): Method to return layout test result zip file url.
(ExtractTestResults.addCustomURLs): Add url to download layout test results zip file.

7:52 AM Changeset in webkit [246734] by Adrian Perez de Castro

• 5 edits in trunk/Source

[WPE][GTK] Fixes for compilation with unified builds disabled
​https://bugs.webkit.org/show_bug.cgi?id=199155

Reviewed by Michael Catanzaro.

Source/WebCore:

No new tests needed.

• rendering/LayerAncestorClippingStack.h: Add missing inclusion of RenderLayer.h

Source/WebKit:

• NetworkProcess/glib/DNSCache.cpp: Add missing inclusion of wtf/glib/RunLoopSourcePriority.h
• NetworkProcess/glib/DNSCache.h: Add missing forward declaration for GInetAddress

7:35 AM Changeset in webkit [246733] by Michael Catanzaro

• 4 edits in trunk

Add user agent quirk for Google Drive
​https://bugs.webkit.org/show_bug.cgi?id=199153

Reviewed by Carlos Garcia Campos.

Source/WebCore:

This suppresses an unsupported browser warning.

• platform/UserAgentQuirks.cpp:

(WebCore::urlRequiresMacintoshPlatform):
(WebCore::urlRequiresLinuxDesktopPlatform):

Tools:

• TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:

(TestWebKitAPI::TEST):

7:34 AM Changeset in webkit [246732] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebKit

[GTK] Navigation gesture should use dark fallback bg color on dark themes
​https://bugs.webkit.org/show_bug.cgi?id=199104

Patch by Alexander Mikhaylenko <​exalm7659@gmail.com> on 2019-06-24
Reviewed by Michael Catanzaro.

Use theme_base_color instead of white background for swipe gesture fallback if no snapshot is found and
the page did not specify a color. This allows it to use dark colors for dark themes. If the color was
not found, still fall back to white.

• UIProcess/gtk/ViewGestureControllerGtk.cpp:

(WebKit::ViewGestureController::beginSwipeGesture):

5:31 AM WebKitGTK/2.24.x edited by Michael Catanzaro

(diff)

4:33 AM Changeset in webkit [246731] by cturner@igalia.com

• 2 edits in trunk/Source/WebCore

[GStreamer][MSE] Pausing video sometimes causes skip to finish
​https://bugs.webkit.org/show_bug.cgi?id=197355

Reviewed by Philippe Normand.

Covered by existing tests.

• platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:

(WebCore::MediaPlayerPrivateGStreamerMSE::currentMediaTime const):
Assuming that when m_eosPending is on and we're paused() that the
network resource is fully loaded and the end is reached is clearly
wrong. Whether this is now correct is unclear...

4:27 AM Changeset in webkit [246730] by cturner@igalia.com

• 3 edits in trunk/Source/WebCore

[GStreamer] Volume level sometimes changes inappropriately
​https://bugs.webkit.org/show_bug.cgi?id=197358

Reviewed by Xabier Rodriguez-Calvar.

Be consistent with our application of volume scaling. We were
setting volumes using cubic interpolation in setVolume() and using
the inverse in volume(); however setting initial volumes was done
linearly in setStreamVolumeElement, which was causing strange
jumps in the volume level at non-deterministic times. The fix
looks to be that we should use linear interpolation consistently,
since PulseAudio already applies cubic scaling to software
volumes.

Covered by existing tests.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::paused const): Bump the
logging here to LOG level, it's very spammy at DEBUG.

• platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::MediaPlayerPrivateGStreamerBase::setVolume): Switch to
linear interpolation.
(WebCore::MediaPlayerPrivateGStreamerBase::volume const): Ditto.
(WebCore::MediaPlayerPrivateGStreamerBase::notifyPlayerOfVolumeChange):
Ditto.
(WebCore::MediaPlayerPrivateGStreamerBase::setStreamVolumeElement):
Ditto, and be consistent here with the API, do not set the raw
volume managed by MediaElement.

3:45 AM Changeset in webkit [246729] by graouts@webkit.org

• 16 edits
  1 copy
  7 adds
  1 delete in trunk

[Pointer Events] Respect pointer capture when dispatching mouse boundary events and updating :hover
​https://bugs.webkit.org/show_bug.cgi?id=198999
<rdar://problem/51979477>

Unreviewed.

Rolling back all changes made for this bug (r246728 + r246716 + r246674) as it regressed one test
(imported/w3c/web-platform-tests/pointerevents/pointerevent_mouse_pointercapture_in_frame.html).

LayoutTests/imported/w3c:

• web-platform-tests/pointerevents/pointerevent_boundary_events_at_implicit_release_hoverable_pointers-expected.txt:
• web-platform-tests/pointerevents/pointerevent_click_during_capture-expected.txt:
• web-platform-tests/pointerevents/pointerevent_mouse_capture_change_hover-expected.txt:
• web-platform-tests/pointerevents/pointerevent_setpointercapture_relatedtarget-expected.txt:

Source/WebCore:

• dom/Document.cpp:

(WebCore::Document::prepareMouseEvent):
(WebCore::Document::updateHoverActiveState):

• page/EventHandler.cpp:

(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::handleMouseMoveEvent):
(WebCore::EventHandler::handleMouseReleaseEvent):
(WebCore::EventHandler::setCapturingMouseEventsElement):

• page/EventHandler.h:
• page/PointerCaptureController.cpp:

(WebCore::PointerCaptureController::releasePointerCapture):
(WebCore::PointerCaptureController::hasPointerCapture):
(WebCore::PointerCaptureController::dispatchEventForTouchAtIndex):
(WebCore::PointerCaptureController::dispatchEvent):
(WebCore::PointerCaptureController::processPendingPointerCapture):
(WebCore::PointerCaptureController::pointerCaptureElement): Deleted.

• page/PointerCaptureController.h:
• rendering/HitTestRequest.h:

(WebCore::HitTestRequest::includesAllElementsUnderPoint const):
(WebCore::HitTestRequest::pointerCaptureElementChanged const): Deleted.

LayoutTests:

• platform/mac-highsierra-wk1/imported/w3c/web-platform-tests/pointerevents/pointerevent_mouse_capture_change_hover-expected.txt: Added.
• platform/mac-highsierra/imported/w3c/web-platform-tests/pointerevents/pointerevent_mouse_capture_change_hover-expected.txt: Added.
• platform/mac-wk1/imported/w3c/web-platform-tests/pointerevents/pointerevent_boundary_events_at_implicit_release_hoverable_pointers-expected.txt:
• platform/mac-wk1/imported/w3c/web-platform-tests/pointerevents/pointerevent_click_during_capture-expected.txt: Removed.
• platform/mac-wk1/imported/w3c/web-platform-tests/pointerevents/pointerevent_mouse_pointercapture_in_frame-expected.txt: Added.
• platform/mac-wk1/imported/w3c/web-platform-tests/pointerevents/pointerevent_setpointercapture_relatedtarget-expected.txt:

3:00 AM Changeset in webkit [246728] by graouts@webkit.org

• 2 edits in trunk/Source/WebCore

[Pointer Events] Respect pointer capture when dispatching mouse boundary events and updating :hover
​https://bugs.webkit.org/show_bug.cgi?id=198999
<rdar://problem/52005663>

Reviewed by Dean Jackson.

We should only set the mouse events capturing element in EventHandler if we're dealing with mouse-originated Pointer Events (part 2).

• page/PointerCaptureController.cpp:

(WebCore::PointerCaptureController::releasePointerCapture):