Context Navigation

← Previous Period
Next Period →

Timeline

Jul 27, 2019:

6:31 PM Changeset in webkit [247893] by sbarati@apple.com

7 edits in trunk/Source/WebCore

[WHLSL] Remove UnnamedType copy/move constructors and mark classes as final
https://bugs.webkit.org/show_bug.cgi?id=200188

Reviewed by Myles C. Maxfield.

Since they are ref counted, you should make taking a ref to them
instead of moving or copying them. This patch encodes that by deleting
the relevant copy/move constructors and assignment operators.

Modules/webgpu/WHLSL/AST/WHLSLArrayReferenceType.h:
Modules/webgpu/WHLSL/AST/WHLSLArrayType.h:

(WebCore::WHLSL::AST::ArrayType::ArrayType): Deleted.
(WebCore::WHLSL::AST::ArrayType::create): Deleted.
(WebCore::WHLSL::AST::ArrayType::type const): Deleted.
(WebCore::WHLSL::AST::ArrayType::type): Deleted.
(WebCore::WHLSL::AST::ArrayType::numElements const): Deleted.

Modules/webgpu/WHLSL/AST/WHLSLPointerType.h:

(WebCore::WHLSL::AST::PointerType::PointerType): Deleted.
(WebCore::WHLSL::AST::PointerType::create): Deleted.

Modules/webgpu/WHLSL/AST/WHLSLReferenceType.h:
Modules/webgpu/WHLSL/AST/WHLSLTypeReference.h:

(WebCore::WHLSL::AST::TypeReference::TypeReference): Deleted.
(WebCore::WHLSL::AST::TypeReference::create): Deleted.
(WebCore::WHLSL::AST::TypeReference::name): Deleted.
(WebCore::WHLSL::AST::TypeReference::typeArguments): Deleted.
(WebCore::WHLSL::AST::TypeReference::maybeResolvedType const): Deleted.
(WebCore::WHLSL::AST::TypeReference::resolvedType const): Deleted.
(WebCore::WHLSL::AST::TypeReference::setResolvedType): Deleted.

Modules/webgpu/WHLSL/AST/WHLSLUnnamedType.h:

5:47 PM Changeset in webkit [247892] by Justin Fan

17 edits in trunk/Source/WebCore

[WebGPU] Update GPUComputePipeline errors to match GPURenderPipeline implementation
https://bugs.webkit.org/show_bug.cgi?id=200097

Reviewed by Myles C. Maxfield.

Remove passing around a functionName in GPUComputePipeline creation in favor of setting it on the GPUErrorScopes.
Also, WebGPU objects no longer create new Ref<>s unless object creation succeeds.

No new tests. Covered by existing tests.

Modules/webgpu/WebGPUDevice.cpp:

(WebCore::WebGPUDevice::createBuffer const):
(WebCore::WebGPUDevice::createBufferMapped const):
(WebCore::WebGPUDevice::createComputePipeline const):

platform/graphics/gpu/GPUBuffer.h:
platform/graphics/gpu/GPUComputePipeline.h:
platform/graphics/gpu/GPUDevice.cpp:

(WebCore::GPUDevice::tryCreateBuffer):
(WebCore::GPUDevice::tryCreateComputePipeline const):

platform/graphics/gpu/GPUDevice.h:
platform/graphics/gpu/GPUErrorScopes.cpp:

(WebCore::GPUErrorScopes::generatePrefixedError): Only validaton errors have messages right now.

platform/graphics/gpu/GPUErrorScopes.h:
platform/graphics/gpu/cocoa/GPUBufferMetal.mm:

(WebCore::GPUBuffer::validateBufferUsage):
(WebCore::GPUBuffer::tryCreate):
(WebCore::GPUBuffer::GPUBuffer):

platform/graphics/gpu/cocoa/GPUComputePipelineMetal.mm:

(WebCore::trySetMetalFunctions):
(WebCore::trySetFunctions):
(WebCore::convertComputePipelineDescriptor):
(WebCore::tryCreateMTLComputePipelineState):
(WebCore::GPUComputePipeline::tryCreate):
(WebCore::GPUComputePipeline::GPUComputePipeline):

platform/graphics/gpu/cocoa/GPURenderPipelineMetal.mm:

(WebCore::trySetMetalFunctions):
(WebCore::trySetFunctions):

These classes were made RefCounted in a previous patch; remove their move ctors to fix build.

Modules/webgpu/WHLSL/AST/WHLSLArrayReferenceType.h:
Modules/webgpu/WHLSL/AST/WHLSLArrayType.h:
Modules/webgpu/WHLSL/AST/WHLSLPointerType.h:
Modules/webgpu/WHLSL/AST/WHLSLReferenceType.h:
Modules/webgpu/WHLSL/AST/WHLSLTypeReference.h:
Modules/webgpu/WHLSL/AST/WHLSLUnnamedType.h:

5:42 PM Changeset in webkit [247891] by commit-queue@webkit.org

4 edits
4 adds in trunk

Expose the aria-label attribute for <video> elements.
https://bugs.webkit.org/show_bug.cgi?id=200169
<rdar://problem/51754558>

Patch by Andres Gonzalez <Andres Gonzalez> on 2019-07-27
Reviewed by Chris Fleizach.

Source/WebCore:

Tests: accessibility/ios-simulator/media-with-aria-label.html

accessibility/media-with-aria-label.html

We now expose the <video> element to accessibility clients as long as auto-play is not enabled.

accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper accessibilityIsWebInteractiveVideo]):

LayoutTests:

accessibility/ios-simulator/media-with-aria-label-expected.txt: Added.
accessibility/ios-simulator/media-with-aria-label.html: Added.
accessibility/media-with-aria-label-expected.txt: Added.
accessibility/media-with-aria-label.html: Added.
platform/win/TestExpectations:

6:41 AM Changeset in webkit [247890] by Chris Dumez

2 edits in trunk/Source/WebKit

Allow more syscalls in the WebContent process' sandbox profile
https://bugs.webkit.org/show_bug.cgi?id=200182
<rdar://problem/53594973>

Reviewed by Geoffrey Garen.

I reviewed all crash traces attached to the radar and found the following
syscalls that we not yet allowed by the WebContent process's sandbox
profile.

WebProcess/com.apple.WebProcess.sb.in:

12:08 AM Changeset in webkit [247889] by Justin Michaud

9 edits
3 adds in trunk

[X86] Emit BT instruction for shift + mask in B3
https://bugs.webkit.org/show_bug.cgi?id=199891

Reviewed by Keith Miller.

JSTests:

microbenchmarks/bit-test-constant.js: Added.

(let.glob.0.doTest):

microbenchmarks/bit-test-load.js: Added.

(let.glob.0.let.arr.new.Int32Array.8.doTest):
(i):

microbenchmarks/bit-test-nonconstant.js: Added.

(let.glob.0.doTest):

Source/JavaScriptCore:

Add a new BranchTestBit air opcode, matching the intel bt instruction
Select this instruction for the following patterns: if (a & (1<<b)) if ((a>>b)&1) if ((~a>>b)&1) if (~a & (1<<b))
15% perf progression on the nonconstant microbenchmark, neutral otherwise.
Note: we cannot fuse loads when we have bitBase=Load, bitOffset=Tmp, since the X86 instruction has different behaviour in this mode. It will read past the current dword/qword instead of wrapping around.

assembler/MacroAssemblerX86Common.h:

(JSC::MacroAssemblerX86Common::branchTestBit32):

assembler/MacroAssemblerX86_64.h:

(JSC::MacroAssemblerX86_64::branchTestBit64):

assembler/X86Assembler.h:

(JSC::X86Assembler::bt_ir):
(JSC::X86Assembler::bt_im):
(JSC::X86Assembler::btw_ir):
(JSC::X86Assembler::btw_im):

assembler/testmasm.cpp:

(JSC::int64Operands):
(JSC::testBranchTestBit32RegReg):
(JSC::testBranchTestBit32RegImm):
(JSC::testBranchTestBit32AddrImm):
(JSC::testBranchTestBit64RegReg):
(JSC::testBranchTestBit64RegImm):
(JSC::testBranchTestBit64AddrImm):
(JSC::run):

b3/B3LowerToAir.cpp:
b3/air/AirOpcode.opcodes:
b3/testb3.cpp:

(JSC::B3::testBranchBitTest32TmpImm):
(JSC::B3::testBranchBitTest32AddrImm):
(JSC::B3::testBranchBitTest32TmpTmp):
(JSC::B3::testBranchBitTest64TmpTmp):
(JSC::B3::testBranchBitTest64AddrTmp):
(JSC::B3::run):

Jul 26, 2019:

9:55 PM Changeset in webkit [247888] by ysuzuki@apple.com

8 edits
1 add in trunk

[JSC] Potential GC fix for JSPropertyNameEnumerator
https://bugs.webkit.org/show_bug.cgi?id=200151

Reviewed by Mark Lam.

JSTests:

stress/for-in-stress.js: Added.

(keys):

Source/JavaScriptCore:

We have been seeing some JSPropertyNameEnumerator::visitChildren crashes for a long time. The crash frequency itself is not high, but it has existed for a long time.
The crash happens when visiting m_propertyNames. It is also possible that this crash is caused by random corruption somewhere, but JSPropertyNameEnumerator
has some tricky (and potentially dangerous) implementations anyway.

JSPropertyNameEnumerator have Vector<WriteBarrier<JSString>> and it is extended in finishCreation with a lock. We should use Auxiliary memory for this use case. And we should set this memory in the constructor so that we do not extend it in finishCreation, and we do not need a lock.
JSPropertyNameEnumerator gets StructureID before allocating JSPropertyNameEnumerator. This is potentially dangerous because the conservative scan cannot find the Structure* since we could only have StructureID. Since allocation code happens after StructureID is retrieved, it is possible that the allocation causes GC and Structure* is collected.

In this patch, we align JSPropertyNameEnumerator implementation to the modern one to avoid using Vector<WriteBarrier<JSString>>. And we can make JSPropertyNameEnumerator
a non-destructible cell. Since JSCell's destructor is one of the cause of various issues, we should avoid it if we can.

No behavior change. This patch adds a test stressing JSPropertyNameEnumerator.

dfg/DFGOperations.cpp:
runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/JSPropertyNameEnumerator.cpp:

(JSC::JSPropertyNameEnumerator::create):
(JSC::JSPropertyNameEnumerator::JSPropertyNameEnumerator):
(JSC::JSPropertyNameEnumerator::finishCreation):
(JSC::JSPropertyNameEnumerator::visitChildren):
(JSC::JSPropertyNameEnumerator::destroy): Deleted.

runtime/JSPropertyNameEnumerator.h:
runtime/VM.cpp:

(JSC::VM::emptyPropertyNameEnumeratorSlow):

runtime/VM.h:

(JSC::VM::emptyPropertyNameEnumerator):

7:18 PM Changeset in webkit [247887] by sbarati@apple.com

2 edits in trunk/Source/WebCore

Unreviewed. Remove invalid assertion after r247878.
We were essentially asserting all UnnamedType* were
unique. But my patch made this no longer the case by
design to make things faster.

Modules/webgpu/WHLSL/Metal/WHLSLTypeNamer.cpp:

(WebCore::WHLSL::Metal::TypeNamer::insert):

5:43 PM Changeset in webkit [247886] by mark.lam@apple.com

16 edits in trunk/Source

Add crash diagnostics for debugging unexpected zapped cells.
https://bugs.webkit.org/show_bug.cgi?id=200149
<rdar://problem/53570112>

Reviewed by Yusuke Suzuki, Saam Barati, and Michael Saboff.

Source/JavaScriptCore:

Add a check for zapped cells in SlotVisitor::appendToMarkStack() and
SlotVisitor::visitChildren(). If a zapped cell is detected, we will crash with
some diagnostic info.

To facilitate this, we've made the following changes:

Changed FreeCell to preserve the 1st 8 bytes. This is fine to do because all cells are at least 16 bytes long.
Changed HeapCell::zap() to only zap the structureID. Leave the rest of the cell header info intact (including the cell JSType).
Changed HeapCell::zap() to record the reason for zapping the cell. We stash the reason immediately after the first 8 bytes. This is the same location as FreeCell::scrambledNext. However, since a cell is not expected to be zapped and on the free list at the same time, it is also fine to do this.
Added a few utility functions to MarkedBlock for checking if a cell points into the block.
Added VMInspector and JSDollarVM utilities to dump in-use subspace hashes.
Added some comments to document the hashes of known subspaces.

heap/FreeList.h:

(JSC::FreeCell::offsetOfScrambledNext):

heap/HeapCell.h:

(JSC::HeapCell::zap):
(JSC::HeapCell::isZapped const):

heap/MarkedBlock.cpp:

(JSC::MarkedBlock::Handle::stopAllocating):

heap/MarkedBlock.h:

(JSC::MarkedBlock::Handle::start const):
(JSC::MarkedBlock::Handle::end const):
(JSC::MarkedBlock::Handle::contains const):

heap/MarkedBlockInlines.h:

(JSC::MarkedBlock::Handle::specializedSweep):

heap/MarkedSpace.h:

(JSC::MarkedSpace::forEachSubspace):

heap/SlotVisitor.cpp:

(JSC::SlotVisitor::appendToMarkStack):
(JSC::SlotVisitor::visitChildren):
(JSC::SlotVisitor::reportZappedCellAndCrash):

heap/SlotVisitor.h:
jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::emitAllocateWithNonNullAllocator):

runtime/VM.cpp:

(JSC::VM::VM):

tools/JSDollarVM.cpp:

(JSC::functionDumpSubspaceHashes):
(JSC::JSDollarVM::finishCreation):

tools/VMInspector.cpp:

(JSC::VMInspector::dumpSubspaceHashes):

tools/VMInspector.h:

Source/WebCore:

No new tests because this is a feature for debugging crashes. It has been tested
manually by modifying the code to force a crash at the point of interest.

Added some comments to document the hashes of known subspaces.

bindings/js/WebCoreJSClientData.cpp:

(WebCore::JSVMClientData::JSVMClientData):

5:03 PM Changeset in webkit [247885] by jiewen_tan@apple.com

6 edits in trunk

NavigationSOAuthorizationSession should check the active URL of the responding page after waking up from waiting
https://bugs.webkit.org/show_bug.cgi?id=200150
<rdar://problem/53280170>

Reviewed by Brent Fulgham.

Source/WebKit:

NavigationSOAuthorizationSession should check the active URL of the responding page after waking up from waiting
as the page might have already changed the location.

UIProcess/Cocoa/SOAuthorization/NavigationSOAuthorizationSession.h:
UIProcess/Cocoa/SOAuthorization/NavigationSOAuthorizationSession.mm:

(WebKit::NavigationSOAuthorizationSession::shouldStartInternal):
(WebKit::NavigationSOAuthorizationSession::webViewDidMoveToWindow):
(WebKit::NavigationSOAuthorizationSession::pageActiveURLDidChangeDuringWaiting const):

UIProcess/Cocoa/SOAuthorization/SubFrameSOAuthorizationSession.mm:

(WebKit::SubFrameSOAuthorizationSession::abortInternal):

Tools:

TestWebKitAPI/Tests/WebKitCocoa/TestSOAuthorization.mm:

(TestWebKitAPI::TEST):

4:58 PM Changeset in webkit [247884] by Jonathan Bedard

2 edits in trunk/Tools

Follow-up fix: results.webkit.org: Suite results shouldn't be the landing page
https://bugs.webkit.org/show_bug.cgi?id=200090

Unreviewed follow-up fix.

resultsdbpy/resultsdbpy/view/view_routes.py:

(ViewRoutes.init): Keep /search endpoint for existing links

4:48 PM Changeset in webkit [247883] by Konstantin Tokarev

2 edits in trunk/Source/WebKitLegacy/win

[Win] Remove unused methods from WebPluginInfoProvider
https://bugs.webkit.org/show_bug.cgi?id=200178

Reviewed by Brent Fulgham.

These methods are guarded with PLATFORM(MAC) and have no definitions.
Also remove unused friend declaration.

WebCoreSupport/WebPluginInfoProvider.h:

4:39 PM Changeset in webkit [247882] by Alan Coon

1 copy in tags/Safari-608.1.39

Tag Safari-608.1.39.

4:38 PM Changeset in webkit [247881] by rniwa@webkit.org

3 edits
6 adds in trunk

Moving right by word boundary right before an object element followed by a br element hangs
https://bugs.webkit.org/show_bug.cgi?id=200144

Reviewed by Simon Fraser.

Source/WebCore:

The bug was caused by an infinite loop inside wordBreakIteratorForMinOffsetBoundary when it's trying to
find the previous word boundary at the beginning of a word after the object element and the br element.
In this case, previousBox is at the br element after the object element in the preceding line, and
logicallyPreviousBox ends up returning the same inline box (that of the br element), causing a hang.

Here's how. In logicallyPreviousBox, previousRootInlineBoxCandidatePosition returns a legacy position
immediately after the object element. The root inline box for this position (previousRoot) is the one
that contains the object element and the br element. However, when previousTextOrLineBreakBox is called
on this root inline box, "box" argument of the function is set to nullptr, and as a result, the function
finds and returns the same inline box of the br element that was passed to logicallyPreviousBox.

Fixed the bug by passing the starting inline box to previousRootInlineBoxCandidatePosition when its
root inline box is the previous root inline box (previousRoot). Also applied the same fix to
logicallyNextBox even though we don't have a reproduction for that case for now (RTL test case is
unaffected by nextRootInlineBoxCandidatePosition).

Tests: editing/selection/move-by-word-visually-across-object-element-1.html

editing/selection/move-by-word-visually-across-object-element-2.html
editing/selection/move-by-word-visually-across-object-element-3.html

editing/VisibleUnits.cpp:

(WebCore::logicallyPreviousBox): Fixed the bug.
(WebCore::logicallyNextBox): Ditto.

LayoutTests:

Added regression tests. The second test case involes non-word characters "%)" which are skipped like whitespaces
for the purposes of moving right or left by word granularity. The third test case involves RTL text.

editing/selection/move-by-word-visually-across-object-element-1-expected.txt: Added.
editing/selection/move-by-word-visually-across-object-element-1.html: Added.
editing/selection/move-by-word-visually-across-object-element-2-expected.txt: Added.
editing/selection/move-by-word-visually-across-object-element-2.html: Added.
editing/selection/move-by-word-visually-across-object-element-3-expected.txt: Added.
editing/selection/move-by-word-visually-across-object-element-3.html: Added.

3:53 PM Changeset in webkit [247880] by beidson@apple.com

3 edits
2 adds in trunk

Do not fire readystatechange events at documents about to get replaced by javascript URLs.
<rdar://problem/51665406> and https://bugs.webkit.org/show_bug.cgi?id=198786

Reviewed by Ryosuke Niwa.

Source/WebCore:

Test: http/tests/dom/ready-state-on-javascript-replace.html

We were firing too many readystatechange events, more than other browsers.
Our behavior on this test with this patch now matches Chrome.

(There was even an ancient FIXME alluding to this referencing a spec issue, and that issues has long been resolvedv)

loader/FrameLoader.cpp:

(WebCore::FrameLoader::stopLoading):

LayoutTests:

http/tests/dom/ready-state-on-javascript-replace-expected.txt: Added.
http/tests/dom/ready-state-on-javascript-replace.html: Added.

2:27 PM Changeset in webkit [247879] by Alan Bujtas

2 edits in trunk/Source/WebCore

[iPadOS] wix.com cannot select a template to edit or view
https://bugs.webkit.org/show_bug.cgi?id=200174
<rdar://problem/53281296>

Reviewed by Simon Fraser.

Opt out of simulated mouse event sending for template selection on wix.com.
When wix.com receives a simulated mouse event during the touch events, it calls preventDefault() which prevents us from running the hover heuristics -> no click.

page/Quirks.cpp:

(WebCore::Quirks::shouldDispatchSimulatedMouseEvents const):

2:26 PM Changeset in webkit [247878] by sbarati@apple.com

47 edits in trunk/Source/WebCore

[WHLSL] UnnamedType should be reference counted
https://bugs.webkit.org/show_bug.cgi?id=200098

Reviewed by Dean Jackson.

This patch makes UnnamedType reference counted. The motivation for doing this
is I measured how many times we were cloning UnnamedTypes, and I found we were
doing it ~433,000 times in some of Justin's demos. This is hugely wasteful,
given that an UnnamedType is immutable in the sense that once the type is
resolved, it will never change. So instead of repeatedly cloning the same
type, and having Expression point to a UniqueRef of UnnamedType, we should
instead make UnnamedType reference counted, and have expressions point to a
potentially shared UnnamedType.

Doing this is hugely beneficial to WHLSL compile times. On Justin's demos,
these are the results I'm getting:

hello-triangle: neutral
hello-cube: 55% faster
compute-blur: 35% faster
textured-cube: 49% faster

Modules/webgpu/WHLSL/AST/WHLSLArrayReferenceType.h:

(WebCore::WHLSL::AST::ArrayReferenceType::ArrayReferenceType):
(WebCore::WHLSL::AST::ArrayReferenceType::create):

Modules/webgpu/WHLSL/AST/WHLSLArrayType.h:

(WebCore::WHLSL::AST::ArrayType::ArrayType):
(WebCore::WHLSL::AST::ArrayType::create):

Modules/webgpu/WHLSL/AST/WHLSLEnumerationDefinition.h:

(WebCore::WHLSL::AST::EnumerationDefinition::EnumerationDefinition):

Modules/webgpu/WHLSL/AST/WHLSLExpression.h:

(WebCore::WHLSL::AST::Expression::setType):
(WebCore::WHLSL::AST::Expression::copyTypeTo const):

Modules/webgpu/WHLSL/AST/WHLSLFloatLiteral.h:

(WebCore::WHLSL::AST::FloatLiteral::clone const):

Modules/webgpu/WHLSL/AST/WHLSLFloatLiteralType.cpp:

(WebCore::WHLSL::AST::FloatLiteralType::FloatLiteralType):
(WebCore::WHLSL::AST::FloatLiteralType::clone const):

Modules/webgpu/WHLSL/AST/WHLSLFloatLiteralType.h:
Modules/webgpu/WHLSL/AST/WHLSLFunctionDeclaration.h:

(WebCore::WHLSL::AST::FunctionDeclaration::FunctionDeclaration):

Modules/webgpu/WHLSL/AST/WHLSLIntegerLiteral.h:

(WebCore::WHLSL::AST::IntegerLiteral::clone const):

Modules/webgpu/WHLSL/AST/WHLSLIntegerLiteralType.cpp:

(WebCore::WHLSL::AST::IntegerLiteralType::IntegerLiteralType):
(WebCore::WHLSL::AST::IntegerLiteralType::clone const):

Modules/webgpu/WHLSL/AST/WHLSLIntegerLiteralType.h:
Modules/webgpu/WHLSL/AST/WHLSLNullLiteral.h:

(WebCore::WHLSL::AST::NullLiteral::clone const):

Modules/webgpu/WHLSL/AST/WHLSLPointerType.h:

(WebCore::WHLSL::AST::PointerType::PointerType):
(WebCore::WHLSL::AST::PointerType::create):

Modules/webgpu/WHLSL/AST/WHLSLReadModifyWriteExpression.h:

(WebCore::WHLSL::AST::ReadModifyWriteExpression::ReadModifyWriteExpression):

Modules/webgpu/WHLSL/AST/WHLSLReferenceType.h:

(WebCore::WHLSL::AST::ReferenceType::ReferenceType):

Modules/webgpu/WHLSL/AST/WHLSLResolvableType.h:

(WebCore::WHLSL::AST::ResolvableType::resolve):

Modules/webgpu/WHLSL/AST/WHLSLStructureElement.h:

(WebCore::WHLSL::AST::StructureElement::StructureElement):

Modules/webgpu/WHLSL/AST/WHLSLTypeArgument.cpp:

(WebCore::WHLSL::AST::clone):

Modules/webgpu/WHLSL/AST/WHLSLTypeArgument.h:
Modules/webgpu/WHLSL/AST/WHLSLTypeDefinition.h:

(WebCore::WHLSL::AST::TypeDefinition::TypeDefinition):

Modules/webgpu/WHLSL/AST/WHLSLTypeReference.cpp:

(WebCore::WHLSL::AST::TypeReference::wrap):

Modules/webgpu/WHLSL/AST/WHLSLTypeReference.h:

(WebCore::WHLSL::AST::TypeReference::create):
(WebCore::WHLSL::AST::TypeReference::cloneTypeReference const): Deleted.

Modules/webgpu/WHLSL/AST/WHLSLUnnamedType.h:
Modules/webgpu/WHLSL/AST/WHLSLUnsignedIntegerLiteral.h:

(WebCore::WHLSL::AST::UnsignedIntegerLiteral::clone const):

Modules/webgpu/WHLSL/AST/WHLSLUnsignedIntegerLiteralType.cpp:

(WebCore::WHLSL::AST::UnsignedIntegerLiteralType::UnsignedIntegerLiteralType):
(WebCore::WHLSL::AST::UnsignedIntegerLiteralType::clone const):

Modules/webgpu/WHLSL/AST/WHLSLUnsignedIntegerLiteralType.h:
Modules/webgpu/WHLSL/AST/WHLSLVariableDeclaration.h:
Modules/webgpu/WHLSL/Metal/WHLSLNativeFunctionWriter.cpp:

(WebCore::WHLSL::Metal::vectorInnerType):

Modules/webgpu/WHLSL/Metal/WHLSLNativeTypeWriter.cpp:

(WebCore::WHLSL::Metal::writeNativeType):

Modules/webgpu/WHLSL/WHLSLAutoInitializeVariables.cpp:

(WebCore::WHLSL::AutoInitialize::visit):

Modules/webgpu/WHLSL/WHLSLCheckDuplicateFunctions.cpp:

(WebCore::WHLSL::DuplicateFunctionKey::hash const):

Modules/webgpu/WHLSL/WHLSLChecker.cpp:

(WebCore::WHLSL::resolveWithOperatorAnderIndexer):
(WebCore::WHLSL::resolveWithOperatorLength):
(WebCore::WHLSL::resolveWithReferenceComparator):
(WebCore::WHLSL::resolveByInstantiation):
(WebCore::WHLSL::checkOperatorOverload):
(WebCore::WHLSL::Checker::assignTypes):
(WebCore::WHLSL::matchAndCommit):
(WebCore::WHLSL::commit):
(WebCore::WHLSL::Checker::assignConcreteType):
(WebCore::WHLSL::Checker::assignType):
(WebCore::WHLSL::Checker::forwardType):
(WebCore::WHLSL::Checker::visit):
(WebCore::WHLSL::getUnnamedType):
(WebCore::WHLSL::argumentTypeForAndOverload):
(WebCore::WHLSL::Checker::finishVisiting):
(WebCore::WHLSL::Checker::isBoolType):

Modules/webgpu/WHLSL/WHLSLInferTypes.cpp:

(WebCore::WHLSL::matchAndCommit):
(WebCore::WHLSL::commit):
(WebCore::WHLSL::inferTypesForTypeArguments):
(WebCore::WHLSL::inferTypesForCallImpl):

Modules/webgpu/WHLSL/WHLSLInferTypes.h:
Modules/webgpu/WHLSL/WHLSLIntrinsics.cpp:

(WebCore::WHLSL::Intrinsics::addVector):
(WebCore::WHLSL::Intrinsics::addMatrix):
(WebCore::WHLSL::Intrinsics::addTexture):

Modules/webgpu/WHLSL/WHLSLParser.cpp:

(WebCore::WHLSL::Parser::parseTypeArgument):
(WebCore::WHLSL::Parser::parseType):
(WebCore::WHLSL::Parser::parseEnumerationDefinition):
(WebCore::WHLSL::Parser::parseVariableDeclaration):
(WebCore::WHLSL::Parser::parseVariableDeclarations):

Modules/webgpu/WHLSL/WHLSLParser.h:
Modules/webgpu/WHLSL/WHLSLPreserveVariableLifetimes.cpp:

(WebCore::WHLSL::PreserveLifetimes::PreserveLifetimes):
(WebCore::WHLSL::PreserveLifetimes::makeStructVariableReference):
(WebCore::WHLSL::PreserveLifetimes::assignVariableIntoStruct):
(WebCore::WHLSL::preserveVariableLifetimes):

Modules/webgpu/WHLSL/WHLSLPropertyResolver.cpp:

(WebCore::WHLSL::wrapAnderCallArgument):
(WebCore::WHLSL::anderCallArgument):
(WebCore::WHLSL::setterCall):
(WebCore::WHLSL::getterCall):
(WebCore::WHLSL::modify):
(WebCore::WHLSL::PropertyResolver::visit):
(WebCore::WHLSL::PropertyResolver::simplifyRightValue):
(WebCore::WHLSL::LeftValueSimplifier::finishVisiting):

Modules/webgpu/WHLSL/WHLSLResolveOverloadImpl.cpp:

(WebCore::WHLSL::conversionCost):

Modules/webgpu/WHLSL/WHLSLResolvingType.h:

(WebCore::WHLSL::ResolvingType::ResolvingType):
(WebCore::WHLSL::ResolvingType::getUnnamedType):
(WebCore::WHLSL::ResolvingType::visit):

Modules/webgpu/WHLSL/WHLSLSynthesizeArrayOperatorLength.cpp:

(WebCore::WHLSL::synthesizeArrayOperatorLength):

Modules/webgpu/WHLSL/WHLSLSynthesizeConstructors.cpp:

(WebCore::WHLSL::synthesizeConstructors):

Modules/webgpu/WHLSL/WHLSLSynthesizeEnumerationFunctions.cpp:

(WebCore::WHLSL::synthesizeEnumerationFunctions):

Modules/webgpu/WHLSL/WHLSLSynthesizeStructureAccessors.cpp:

(WebCore::WHLSL::synthesizeStructureAccessors):

Modules/webgpu/WHLSL/WHLSLVisitor.cpp:

(WebCore::WHLSL::Visitor::visit):

2:23 PM Changeset in webkit [247877] by Jonathan Bedard

4 edits in trunk/Tools

results.webkit.org: Add switch to filter results by expectation
https://bugs.webkit.org/show_bug.cgi?id=200134

Rubber-stamped by Aakash Jain.

Users of the results database should be able to easily differentiate tests which are expected
to fail verse tests which are unexpectedly failing.

resultsdbpy/resultsdbpy/view/static/js/timeline.js:

(Timeline.render): Respect the willFilterExpected variable.
(LegendLabel): Generates html for label in the legend.
(Legend): Add switch for filter results.

resultsdbpy/resultsdbpy/view/templates/search.html: GIve Legend callback to re-render timelines.
resultsdbpy/resultsdbpy/view/templates/suite_results.html:

2:08 PM Changeset in webkit [247876] by Chris Dumez

2 edits in trunk/Source/WebKit

Crashes under XPCServiceMain() / mach_msg_trap() due to sandboxing
https://bugs.webkit.org/show_bug.cgi?id=200173
<rdar://problem/53594973>

Reviewed by Per Arne Vollan.

Allow a few more syscalls as they appear to be needed by mach_msg_trap().

WebProcess/com.apple.WebProcess.sb.in:

1:52 PM Changeset in webkit [247875] by dbates@webkit.org

2 edits in trunk/Source/WebKit

[iOS] REGRESSION: Keyboard dismisses and reappears when typing 2FA pin on appleid.apple.com
https://bugs.webkit.org/show_bug.cgi?id=200171
<rdar://problem/50245251>

Reviewed by Wenson Hsieh.

Take out an InputViewUpdateDeferrer token (if we don't already have one) to temporarily defer
tearing down the input view (keyboard) before bluring the previously focused element as part
of switching between focused elements. This avoid a noticeable flash caused by UIKit animating
out and animating in the keyboard should the newly focused element require the keyboard. We
only take out the InputViewUpdateDeferrer until we fall off the end of _elementDidFocus: (or
bail early). Once we fall of the end UIKit will update input view UI.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _elementDidFocus:userIsInteracting:blurPreviousNode:activityStateChanges:userObject:]):

1:46 PM Changeset in webkit [247874] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

[curl] Heap corruption in ~CurlResponse
https://bugs.webkit.org/show_bug.cgi?id=198320

Patch by Takashi Komori <Takashi.Komori@sony.com> on 2019-07-26
Reviewed by Fujii Hironori.

Stop sharing object which was reffered by two threads to fix crash bug.

No tests needed, no functionality changes.

platform/network/curl/CurlRequest.cpp:

(WebCore::CurlRequest::start):
(WebCore::CurlRequest::invokeDidReceiveResponseForFile):

platform/network/curl/CurlRequest.h:

1:34 PM Changeset in webkit [247873] by youenn@apple.com

4 edits in trunk/Source/WebCore

slides.google.com: opening speaker notes while presenting causes a fatal error in the web app on iPad
https://bugs.webkit.org/show_bug.cgi?id=199933
<rdar://problem/53034345>

Reviewed by Darin Adler.

docs.google.com might sometimes try to window.open an about URL that not about:blank or about:srcdoc.
In that case, WebKit is opening a window but is considering that the window is cross origin with its opener.
This breaks docs.google.com as they want to access the website.
Add a site-specific hack so as to treat all about URLs being opened through window.open as about:blank.

Manually tested on docs.google.com website.

page/DOMWindow.cpp:

(WebCore::DOMWindow::createWindow):
(WebCore::DOMWindow::open):

page/Quirks.cpp:

(WebCore::Quirks::needsYouTubeOverflowScrollQuirk const):
(WebCore::Quirks::shouldOpenAsAboutBlank const):

page/Quirks.h:

12:34 PM Changeset in webkit [247872] by Chris Dumez

2 edits in trunk/Source/WebKit

Avoid WebContent process SIGKILL when using kevent()
https://bugs.webkit.org/show_bug.cgi?id=200170
<rdar://problem/51559921>

Reviewed by Per Arne Vollan.

Avoid WebContent process SIGKILL when using kevent() by updated its sandboxing profile.

WebProcess/com.apple.WebProcess.sb.in:

12:22 PM Changeset in webkit [247871] by aakash_jain@apple.com

4 edits in trunk/Tools

[ews-build] Use update-webkit script in Style EWS
https://bugs.webkit.org/show_bug.cgi?id=193196

Reviewed by Jonathan Bedard.

BuildSlaveSupport/ews-build/factories.py:

(StyleFactory): Updated to use CheckOutSource step as well.

BuildSlaveSupport/ews-build/steps.py: Added build-step to UpdateWorkingDirectory.
BuildSlaveSupport/ews-build/steps_unittest.py: Added unit-tests.

12:19 PM Changeset in webkit [247870] by Jonathan Bedard

3 edits in trunk/Tools

results.webkit.org: Support buildbot 0.8 CI links
https://bugs.webkit.org/show_bug.cgi?id=200146

Reviewed by Aakash Jain.

resultsdbpy/resultsdbpy/model/ci_context.py:

(BuildbotEightURLFactory): Buildbot 0.8 link factory.
(BuildbotEightURLFactory.init):
(BuildbotEightURLFactory.url):

resultsdbpy/resultsdbpy/model/ci_context_unittest.py:

(URLFactoryTest.test_old_builder_url):
(URLFactoryTest):
(URLFactoryTest.test_old_worker_url):

12:17 PM Changeset in webkit [247869] by Jonathan Bedard

4 edits in trunk/Tools

results.webkit.org: Suite results shouldn't be the landing page
https://bugs.webkit.org/show_bug.cgi?id=200090

Reviewed by Aakash Jain.

resultsdbpy/resultsdbpy/view/templates/suite_results.html: Remove search bar.
resultsdbpy/resultsdbpy/view/view_routes.py:

(ViewRoutes.init): Make search the landing page instead of suite results.

resultsdbpy/resultsdbpy/view/view_routes_unittest.py:

(WebSiteUnittest.test_main):

11:27 AM Changeset in webkit [247868] by Chris Dumez

17 edits
2 moves in trunk

[iOS] WebPage::TouchEventSync() & WebPage::GetPositionInformation() sync IPC causes UIProcess hangs
https://bugs.webkit.org/show_bug.cgi?id=200138
<rdar://problem/52698157>

Reviewed by Geoffrey Garen.

Source/WebKit:

Revert most of r247822 and use an alternative approach to address hangs. In this patch, the proposal
is to add a SendSyncOption::ForceDispatchWhenDestinationIsWaitingForUnboundedSyncReply flag on the
WebPage::TouchEventSync() & WebPage::GetPositionInformation() sendSync() calls in the UIProcess.
Those will cause this IPCs to get dispatched right away in the WebContent process, even if the
WebContent process is itself currently stuck on unbounded (i.e. potentially slow) synchronous IPC
(JS alerts / prompts & sync XHR). Because re-entering WebCore on sync IPC is generally unsafe, this
patch also updates the WebPage::getPositionInformation() & WebPage::touchEventSync() to return early
(i.e. cancelled) if they get called while the WebContent process is stuck on a slow sendSync.

This approach should address the UIProcess hangs caused by the WebPage::TouchEventSync() and
WebPage::GetPositionInformation() sync IPC messages when the WebContent process is busy on a slow XHR
or a JS prompt / alert. It should be safe because we do not re-enter WebCore. The only drawback is that
those IPCs will be cancelled (early return with default value) when the WebContent process is busy.
However, I am being told that this is likely acceptable in practice.

Platform/IPC/Connection.cpp:

(IPC::Connection::SyncMessageState::processIncomingMessage):
(IPC::Connection::sendMessage):
(IPC::Connection::sendSyncMessage):
(IPC::Connection::dispatchMessage):

Platform/IPC/Connection.h:

(IPC::UnboundedSynchronousIPCScope::UnboundedSynchronousIPCScope):
(IPC::UnboundedSynchronousIPCScope::~UnboundedSynchronousIPCScope):
(IPC::UnboundedSynchronousIPCScope::hasOngoingUnboundedSyncIPC):

Platform/IPC/Decoder.cpp:

(IPC::Decoder::shouldDispatchMessageWhenWaitingForSyncReply const):

Platform/IPC/Decoder.h:
Platform/IPC/Encoder.cpp:

(IPC::Encoder::shouldDispatchMessageWhenWaitingForSyncReply const):
(IPC::Encoder::setShouldDispatchMessageWhenWaitingForSyncReply):
(IPC::Encoder::wrapForTesting):

Platform/IPC/Encoder.h:
Platform/IPC/MessageFlags.h:
UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::testProcessIncomingSyncMessagesWhenWaitingForSyncReply):

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::handleTouchEventSynchronously):

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView ensurePositionInformationIsUpToDate:]):

WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::loadResourceSynchronously):

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::testProcessIncomingSyncMessagesWhenWaitingForSyncReply):
(WebKit::WebChromeClient::runJavaScriptAlert):
(WebKit::WebChromeClient::runJavaScriptConfirm):
(WebKit::WebChromeClient::runJavaScriptPrompt):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::layerVolatilityTimerFired):
(WebKit::WebPage::markLayersVolatile):
(WebKit::WebPage::cancelMarkLayersVolatile):
(WebKit::WebPage::touchEventSync):
(WebKit::WebPage::didCompletePageTransition):
(WebKit::WebPage::updatePreferences):
(WebKit::WebPage::testProcessIncomingSyncMessagesWhenWaitingForSyncReply):

WebProcess/WebPage/WebPage.h:

(WebKit::WebPage::sendSyncWithDelayedReply):

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::getPositionInformation):

LayoutTests:

Update existing layout test accordingly.

fast/misc/{testProcessIncomingSyncMessagesWhenWaitingForUnboundedReply-expected.txt: Renamed from LayoutTests/fast/misc/testProcessIncomingSyncMessagesWhenWaitingForSyncReply-expected.txt.
fast/misc/{testProcessIncomingSyncMessagesWhenWaitingForUnboundedReply.html: Renamed from LayoutTests/fast/misc/testProcessIncomingSyncMessagesWhenWaitingForSyncReply.html.

11:25 AM Changeset in webkit [247867] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: AXI: Audit: Typo of "some" as "somee"
https://bugs.webkit.org/show_bug.cgi?id=200166

Patch by Greg Doolittle <gr3g@apple.com> on 2019-07-26
Reviewed by Devin Rousso.

Localizations/en.lproj/localizedStrings.js:
UserInterface/Controllers/AuditManager.js:

(WI.AuditManager.prototype._addDefaultTests):
(WI.AuditManager):

11:22 AM Changeset in webkit [247866] by Alan Bujtas

22 edits in trunk

Unable to tap/double tap to open files/folders in Google Drive in Safari
https://bugs.webkit.org/show_bug.cgi?id=200096
<rdar://problem/52748552>

Reviewed by Wenson Hsieh.

Source/WebKit:

This patch reverts to the original double-tap-for-double-click implementation (see r244775 and r246347 for more information).

Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode const):
(WebKit::WebPageCreationParameters::decode):

Shared/WebPageCreationParameters.h:
UIProcess/PageClient.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::creationParameters):

UIProcess/WebPageProxy.h:
UIProcess/ios/PageClientImplIOS.h:
UIProcess/ios/PageClientImplIOS.mm:

(WebKit::PageClientImpl::doubleTapForDoubleClickDelay): Deleted.
(WebKit::PageClientImpl::doubleTapForDoubleClickRadius): Deleted.

UIProcess/ios/WKContentViewInteraction.h:
UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView setupInteraction]):
(-[WKContentView cleanupInteraction]):
(-[WKContentView _removeDefaultGestureRecognizers]):
(-[WKContentView _addDefaultGestureRecognizers]):
(-[WKContentView gestureRecognizer:shouldRecognizeSimultaneouslyWithGestureRecognizer:]): Do not recognize the single and double gestures the same time.
(-[WKContentView gestureRecognizerShouldBegin:]):
(-[WKContentView _doubleTapRecognizedForDoubleClick:]):
(-[WKContentView _didStartProvisionalLoadForMainFrame]):
(-[WKContentView _ensureNonBlockingDoubleTapGestureRecognizer]): Deleted.
(-[WKContentView _doubleTapForDoubleClickDelay]): Deleted.
(-[WKContentView _doubleTapForDoubleClickRadius]): Deleted.

UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::handleDoubleTapForDoubleClickAtPoint):

WebProcess/WebPage/WebPage.cpp:
WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:
WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::handleDoubleTapForDoubleClickAtPoint):
(WebKit::WebPage::commitPotentialTap):
(WebKit::WebPage::handlePotentialDoubleTapForDoubleClickAtPoint): Deleted.

LayoutTests:

Rebaseline (progression).
Payment request tests activate elements by tapping on them at a high speed, triggering double clicks instead. Let's slow them down a bit.

fast/events/touch/ios/double-tap-for-double-click3-expected.txt:
http/tests/adClickAttribution/anchor-tag-attributes-validation.html:
http/tests/resources/payment-request.js:

(activateThen):

resources/ui-helper.js:

(window.UIHelper.activateElementAtHumanSpeed.return.new.Promise):
(window.UIHelper.activateElementAtHumanSpeed):

tests-options.json:

10:58 AM Changeset in webkit [247865] by Dewei Zhu

2 edits in trunk/Websites/perf.webkit.org

Fix a bug that cannot update builder password on builders administrative page.
https://bugs.webkit.org/show_bug.cgi?id=200154

Reviewed by Ryosuke Niwa.

'builders' administrative page should be able to update password for a builder.

public/admin/builders.php: Should be able to update builder password.

10:18 AM Changeset in webkit [247864] by commit-queue@webkit.org

3 edits in trunk/Source/WebKit

AX: web process should load correct bundle path for MACCATALYST
https://bugs.webkit.org/show_bug.cgi?id=200122

Patch by Eric Liang <ericliang@apple.com> on 2019-07-26
Reviewed by Brent Fulgham.

Added the path to accessibility bundle for Mac Catalyst.
Added sandbox profile to read accessibility settings.

WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::registerWithAccessibility):

WebProcess/com.apple.WebProcess.sb.in:

9:08 AM Changeset in webkit [247863] by Jonathan Bedard

2 edits in trunk/Tools

Follow-up fix: results.webkit.org: Color should be the worst result, count should include all results
https://bugs.webkit.org/show_bug.cgi?id=200127

Unreviewed follow-up fix.

resultsdbpy/resultsdbpy/view/static/js/timeline.js:

(Dot.toString): Use self instead of this in render callback.

2:00 AM Changeset in webkit [247862] by commit-queue@webkit.org

4 edits in trunk/Source

REGRESSION(r246496): [GTK] Tapping the web view scrolls up a bit
https://bugs.webkit.org/show_bug.cgi?id=200084

Patch by Alexander Mikhaylenko <exalm7659@gmail.com> on 2019-07-26
Reviewed by Carlos Garcia Campos.

gdk_event_get_scroll_direction() returns false, but also sets direction to GDK_SCROLL_UP if
the direction was GDK_SCROLL_SMOOTH. Relying on zero deltas in this case is not correct, because
they can also be zero with GDK_SCROLL_SMOOTH. In this case, set the direction manually to avoid
that.

See https://gitlab.gnome.org/GNOME/gtk/issues/2048

Source/WebCore:

platform/gtk/PlatformWheelEventGtk.cpp:

(WebCore::PlatformWheelEvent::PlatformWheelEvent):

Source/WebKit:

Shared/gtk/WebEventFactory.cpp:

(WebKit::WebEventFactory::createWebWheelEvent):

1:52 AM Changeset in webkit [247861] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit

[WPE] Support disk cache dumping like GTK
https://bugs.webkit.org/show_bug.cgi?id=200157

Patch by Loïc Yhuel <loic.yhuel@softathome.com> on 2019-07-26
Reviewed by Carlos Garcia Campos.

Creating or touching "dump" would create the dump.json.

NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::Cache::Cache):

12:29 AM Changeset in webkit [247860] by commit-queue@webkit.org

16 edits
4 adds in trunk

Make storing cross-origin top-level prefetches in HTTP cache optional
https://bugs.webkit.org/show_bug.cgi?id=199499

Patch by Rob Buis <rbuis@igalia.com> on 2019-07-26
Reviewed by Youenn Fablet.

Source/WebCore:

Add Internals API for adding an event listener to prefetch load.

Test: http/wpt/prefetch/link-prefetch-skip-disk-cache.html

bindings/js/JSEventListener.h:
dom/EventTarget.h:

(WebCore::EventTarget::addEventListener):

dom/Node.h:
html/HTMLLinkElement.h:
testing/Internals.cpp:

(WebCore::Internals::addPrefetchLoadEventListener):

testing/Internals.h:
testing/Internals.idl:

Source/WebKit:

Currently when we navigate we check if there is a cross-origin top-level
prefetch we can use for the navigation. The current solution uses the
HTTP cache as a way to store the prefetch and to immediately use it for
the navigation load. However this solution fails in case the prefetch is
not cacheable.

Instead of this, simulate a HTTP Cache entry to process the load and
afterwards try to store the navigation load into the HTTP cache, where
normal store decisions will be applied.

Test: http/wpt/prefetch/link-prefetch-skip-disk-cache.html

NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::retrieveCacheEntry):
(WebKit::NetworkResourceLoader::retrieveCacheEntryInternal):

NetworkProcess/NetworkResourceLoader.h:

LayoutTests:

Remove unneeded Cache-Control headers and verify that Cache-Control
effects whether the navigation gets stored in the disk cache or not.

http/tests/cache/resources/prefetched-main-resource-iframe.php:
http/tests/cache/resources/prefetched-main-resource.php:
http/wpt/prefetch/link-prefetch-skip-disk-cache-expected.txt: Added.
http/wpt/prefetch/link-prefetch-skip-disk-cache.html: Added.
http/wpt/prefetch/resources/main-resource-skip-disk-cache.py: Added.

(main):

http/wpt/prefetch/resources/navigate-skip-disk-cache.html: Added.
platform/mac-wk1/TestExpectations:
platform/win/TestExpectations:

12:24 AM Changeset in webkit [247859] by bshafiei@apple.com

11 edits in branches/safari-608.1-branch/Source

Cherry-pick r247755. rdar://problem/53575424

AX: CrashTracer: com.apple.WebKit.WebContent at WebKit: WebKit::WebSpeechSynthesisClient::speak
https://bugs.webkit.org/show_bug.cgi?id=199988

Reviewed by Per Arne Vollan.

Source/WebCore:

Implement the reset state to cancel current speech jobs.

Modules/speech/SpeechSynthesis.cpp: (WebCore::SpeechSynthesis::startSpeakingImmediately): (WebCore::SpeechSynthesis::cancel):
platform/PlatformSpeechSynthesizer.h:
platform/ios/PlatformSpeechSynthesizerIOS.mm: (WebCore::PlatformSpeechSynthesizer::resetState):
platform/mac/PlatformSpeechSynthesizerMac.mm: (WebCore::PlatformSpeechSynthesizer::resetState):

Source/WebKit:

Improvements to WebSpeechSynthesis to avoid crashing and improve correctness.

Reset and cancel speech jobs on page close or reload (otherwise the synthesizer keeps talking after your page is gone)
Have a separate speech finish callback mechanism, use the start speaking callback when the synthesizer tells us.
Move an assert on utterance state to only apply when we use the in process synthesizer.

UIProcess/Cocoa/WebPageProxyCocoa.mm: (WebKit::WebPageProxy::didStartSpeaking):
UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::reload): (WebKit::WebPageProxy::resetState): (WebKit::WebPageProxy::resetSpeechSynthesizer): (WebKit::WebPageProxy::speechSynthesisSetFinishedCallback): (WebKit::WebPageProxy::speechSynthesisSpeak):
UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:
WebProcess/WebCoreSupport/WebSpeechSynthesisClient.cpp: (WebKit::WebSpeechSynthesisClient::speak):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@247755 268f45cc-cd09-0410-ab3c-d52691b4dbfc

12:24 AM Changeset in webkit [247858] by bshafiei@apple.com

2 edits in branches/safari-608.1-branch/Source/WebCore

Cherry-pick r247734. rdar://problem/53575398

Fix crashes in ScrollingStateNode::insertChild()
https://bugs.webkit.org/show_bug.cgi?id=200023
rdar://problem/53265378

Reviewed by Darin Adler.

Crash data suggest that ScrollingStateNode::insertChild() can be passed an index that
is larger than the size of the vector, causing crashes.

Fix defensively by falling back to append() if the passed index is equal to or larger
than the size of the children vector.

page/scrolling/ScrollingStateNode.cpp: (WebCore::ScrollingStateNode::insertChild):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@247734 268f45cc-cd09-0410-ab3c-d52691b4dbfc

12:24 AM Changeset in webkit [247857] by bshafiei@apple.com

7 edits
1 add in branches/safari-608.1-branch

Cherry-pick r247702. rdar://problem/53575418

[iOS] [WK1] UIWebView always jumps to the top left corner when scrolling to reveal the selection
https://bugs.webkit.org/show_bug.cgi?id=200013
<rdar://problem/52526901>

Reviewed by Simon Fraser.

Source/WebCore:

After <https://trac.webkit.org/r244141>, we no longer attempt to scroll to reveal the text selection in
UIWebView after changing the selection, due to how we use the legacy document view rect in legacy WebKit when
computing the visual viewport. This causes the viewRect in RenderLayer::scrollRectToVisible to be the same size
as the content size, which then causes us to always scroll to the origin when revealing the selection.

To make selection revealing work again in legacy WebKit, conditionally restore the old behavior of using the
unobscured content rect as the view rect, only in the case where scrolling is delegated and the platform widget
is present.

Test: WebKitLegacy.ScrollToRevealSelection

page/FrameView.cpp: (WebCore::FrameView::viewRectExpandedByContentInsets const): (WebCore::FrameView::visualViewportRectExpandedByContentInsets const): Deleted.

Additionally rename visualViewportRectExpandedByContentInsets to viewRectExpandedByContentInsets, to reflect the
fact that this may either be the visual viewport rect or unobscured content rect.

page/FrameView.h:
rendering/RenderLayer.cpp: (WebCore::RenderLayer::scrollRectToVisible):

Tools:

Add a new API test to verify that inserting text in UIWebView causes the document to scroll.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKitLegacy/ios/ScrollToRevealSelection.mm: Added. (-[LegacyLoadingDelegate webViewDidFinishLoad:]): (-[LegacyLoadingDelegate waitForDidFinishLoad]):
TestWebKitAPI/ios/UIKitSPI.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@247702 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed