Timeline

Jul 24, 2021:

1:11 PM Changeset in webkit [280285] by ysuzuki@apple.com

• 12 edits in trunk/Source/JavaScriptCore

[JSC] Change most of enum in Yarr to enum-class
​https://bugs.webkit.org/show_bug.cgi?id=228264

Reviewed by Mark Lam.

This patch simply changes most of enum to enum-class in Yarr.
We also remove YarrJIT YarrGenerator's template parameter since
it is not worth doubling code. We can just hold Yarr::JITCompileMode as m_compileMode.

• runtime/RegExp.cpp:

(JSC::RegExp::compile):
(JSC::RegExp::matchConcurrently):
(JSC::RegExp::compileMatchOnly):

• runtime/RegExp.h:
• runtime/RegExpInlines.h:

(JSC::RegExp::hasCodeFor):
(JSC::RegExp::compileIfNecessary):
(JSC::RegExp::matchInline):
(JSC::RegExp::hasMatchOnlyCodeFor):
(JSC::RegExp::compileIfNecessaryMatchOnly):

• yarr/Yarr.h:

(): Deleted.

• yarr/YarrInterpreter.cpp:

(JSC::Yarr::Interpreter::backtrackPatternCharacter):
(JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
(JSC::Yarr::Interpreter::matchCharacterClass):
(JSC::Yarr::Interpreter::backtrackCharacterClass):
(JSC::Yarr::Interpreter::matchBackReference):
(JSC::Yarr::Interpreter::backtrackBackReference):
(JSC::Yarr::Interpreter::parenthesesDoBacktrack):
(JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
(JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
(JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
(JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
(JSC::Yarr::Interpreter::matchParenthesesTerminalBegin):
(JSC::Yarr::Interpreter::matchParenthesesTerminalEnd):
(JSC::Yarr::Interpreter::backtrackParenthesesTerminalBegin):
(JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
(JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
(JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
(JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
(JSC::Yarr::Interpreter::matchParentheses):
(JSC::Yarr::Interpreter::backtrackParentheses):
(JSC::Yarr::Interpreter::matchDisjunction):
(JSC::Yarr::Interpreter::matchNonZeroDisjunction):
(JSC::Yarr::ByteCompiler::atomParenthesesOnceBegin):
(JSC::Yarr::ByteCompiler::atomParenthesesTerminalBegin):
(JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
(JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
(JSC::Yarr::ByteCompiler::atomParentheticalAssertionEnd):
(JSC::Yarr::ByteCompiler::closeAlternative):
(JSC::Yarr::ByteCompiler::closeBodyAlternative):
(JSC::Yarr::ByteCompiler::atomParenthesesSubpatternEnd):
(JSC::Yarr::ByteCompiler::atomParenthesesOnceEnd):
(JSC::Yarr::ByteCompiler::atomParenthesesTerminalEnd):
(JSC::Yarr::ByteCompiler::emitDisjunction):
(JSC::Yarr::ByteCompiler::dumpDisjunction):

• yarr/YarrInterpreter.h:

(JSC::Yarr::ByteTerm::ByteTerm):
(JSC::Yarr::ByteTerm::BOL):
(JSC::Yarr::ByteTerm::CheckInput):
(JSC::Yarr::ByteTerm::UncheckInput):
(JSC::Yarr::ByteTerm::EOL):
(JSC::Yarr::ByteTerm::WordBoundary):
(JSC::Yarr::ByteTerm::BackReference):
(JSC::Yarr::ByteTerm::BodyAlternativeBegin):
(JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
(JSC::Yarr::ByteTerm::BodyAlternativeEnd):
(JSC::Yarr::ByteTerm::AlternativeBegin):
(JSC::Yarr::ByteTerm::AlternativeDisjunction):
(JSC::Yarr::ByteTerm::AlternativeEnd):
(JSC::Yarr::ByteTerm::SubpatternBegin):
(JSC::Yarr::ByteTerm::SubpatternEnd):
(JSC::Yarr::ByteTerm::DotStarEnclosure):

• yarr/YarrJIT.cpp:

(JSC::Yarr::jitCompile):

• yarr/YarrJIT.h:
• yarr/YarrParser.h:

(JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
(JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
(JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
(JSC::Yarr::Parser::CharacterClassParserDelegate::end):

• yarr/YarrPattern.cpp:

(JSC::Yarr::YarrPatternConstructor::atomParenthesesSubpatternBegin):
(JSC::Yarr::YarrPatternConstructor::atomParentheticalAssertionBegin):
(JSC::Yarr::YarrPatternConstructor::atomBackReference):
(JSC::Yarr::YarrPatternConstructor::copyTerm):
(JSC::Yarr::YarrPatternConstructor::quantifyAtom):
(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
(JSC::Yarr::YarrPatternConstructor::containsCapturingTerms):
(JSC::Yarr::YarrPatternConstructor::optimizeDotStarWrappedExpressions):
(JSC::Yarr::PatternTerm::dumpQuantifier):
(JSC::Yarr::PatternTerm::dump):

• yarr/YarrPattern.h:

(JSC::Yarr::PatternTerm::PatternTerm):
(JSC::Yarr::PatternTerm::ForwardReference):
(JSC::Yarr::PatternTerm::BOL):
(JSC::Yarr::PatternTerm::EOL):
(JSC::Yarr::PatternTerm::WordBoundary):
(JSC::Yarr::PatternTerm::isFixedWidthCharacterClass const):
(JSC::Yarr::PatternTerm::containsAnyCaptures):
(JSC::Yarr::PatternTerm::quantify):

1:23 AM Changeset in webkit [280284] by Devin Rousso

• 8 edits
  2 copies
  4 adds in trunk

[Apple Pay] Do not add coupon code ApplePayErrorCode values for systems that do not support it
​https://bugs.webkit.org/show_bug.cgi?id=228243

Reviewed by Wenson Hsieh.

Source/WebCore:

Test: http/tests/ssl/applepay/ApplePayError.html

• Modules/applepay/ApplePayErrorCode.idl:
• Modules/applepay/ApplePayErrorCode.h:

Source/WebKit:

• Platform/cocoa/PaymentAuthorizationPresenter.mm:

(WebKit::toPKPaymentErrorCode):

LayoutTests:

• http/tests/ssl/applepay/ApplePayError.html:
• http/tests/ssl/applepay/ApplePayError-expected.txt:
• platform/ios-14-wk2/http/tests/ssl/applepay/ApplePayError-expected.txt: Added.
• platform/mac-bigsur-wk2/http/tests/ssl/applepay/ApplePayError-expected.txt: Added.

1:20 AM Changeset in webkit [280283] by Devin Rousso

• 4 edits in trunk

[iOS] REGRESSION(r277505): -[WKWebView underPageBackgroundColor] also changes the scroll bar color
​https://bugs.webkit.org/show_bug.cgi?id=228259
<rdar://problem/80116822>

Reviewed by Tim Horton.

Source/WebKit:

If an application overrides the -underPageBackgroundColor with a dark color on a page that
has a light background color, the scroll bar will appear light to match the overridden value
of -underPageBackgroundColor instead of dark to match the page's background color.

Test: WKWebViewUnderPageBackgroundColor.MatchesScrollView

• UIProcess/API/ios/WKWebViewIOS.mm:

(baseScrollViewBackgroundColor):
(scrollViewBackgroundColor):
(-[WKWebView _updateScrollViewBackground]):
Add a flag to indicate whether the underPageBackgroundColor (which can be overridden by
API) or pageExtendedBackgroundColor should be used when calculating the value provided to
-[UIScrollView setBackgroundColor:] and -[UIScrollView setIndicatorStyle:]. The former
uses the underPageBackgroundColor since that is why that API exists and the latter uses
the pageExtendedBackgroundColor` since it is based on what is shown in the page, which is
what the scroll bar is drawn on top of.

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/WKWebViewUnderPageBackgroundColor.mm:

(TEST.WKWebViewUnderPageBackgroundColor.MatchesScrollView):

Jul 23, 2021:

8:48 PM Changeset in webkit [280282] by Andres Gonzalez

• 9 edits
  2 adds in trunk

Add a method to WebAccessibilityObjectWrapper so that clients can retrieve the text of each line and their corresponding bounding rectangles.
​https://bugs.webkit.org/show_bug.cgi?id=228251
Source/WebCore:

rdar://77184036

Reviewed by Chris Fleizach.

Test: accessibility/ios-simulator/element-line-rects-and-text.html

Accessibility clients often need to retrieve a line of text and its
corresponding bounding rectangle screen coordinates. There was not a
clear way of doing this. This patch provides lineRectsAndText as the
mechanism to retrieve the lines of text and their corresponding
rectangles for a given accessibility object. This is the iOS
implementation. MacOS implementation will be done in a separate patch.

• accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper stringsForSimpleRange:attributed:]):
(-[WebAccessibilityObjectWrapper arrayOfTextForTextMarkers:attributed:]):
(-[WebAccessibilityObjectWrapper lineRectsAndText]):
(-[WebAccessibilityObjectWrapper lineRectsForTextMarkerRange:]):

Tools:

Reviewed by Chris Fleizach.

• WebKitTestRunner/InjectedBundle/AccessibilityUIElement.cpp:

(WTR::AccessibilityUIElement::lineRectsAndText const):

• WebKitTestRunner/InjectedBundle/AccessibilityUIElement.h:
• WebKitTestRunner/InjectedBundle/Bindings/AccessibilityUIElement.idl:
• WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:

(WTR::AccessibilityUIElement::lineRectsAndText const):

• WebKitTestRunner/InjectedBundle/mac/AccessibilityCommonMac.mm:

(WTR::makeJSArray):

LayoutTests:

Reviewed by Chris Fleizach.

• accessibility/ios-simulator/element-line-rects-and-text-expected.txt: Added.
• accessibility/ios-simulator/element-line-rects-and-text.html: Added.

8:40 PM Changeset in webkit [280281] by ysuzuki@apple.com

• 1 edit
  1 add in trunk/JSTests

[JSC] Add Speedometer2 jQuery-TodoMVC RegExp microbenchmark
​https://bugs.webkit.org/show_bug.cgi?id=228257

Reviewed by Mark Lam.

I instrumented JSC and extracted executed RegExp evaluations from Speedometer2/jQuery-TodoMVC
to easily test RegExp performance.

• microbenchmarks/jquery-todomvc-regexp.js: Added.

(x00.test):

6:56 PM Changeset in webkit [280280] by Alexey Shvayka

• 11 edits
  6 adds in trunk

[WebIDL] Properly validate and merge descriptors in [Replaceable] setter
​https://bugs.webkit.org/show_bug.cgi?id=227662

Reviewed by Sam Weinig.

Source/JavaScriptCore:

Extracts createDataProperty() method to keep WebIDL code generator as simple as possible,
and also to emphasize a subtle difference between
{ Value: X } and
{ Value: X, Writable: true, Enumerable: true, Configurable: true }.

• runtime/JSONObject.cpp:

(JSC::Walker::walk):

• runtime/JSObject.cpp:

(JSC::definePropertyOnReceiverSlow):

• runtime/JSObject.h:
• runtime/JSObjectInlines.h:

(JSC::JSObject::createDataProperty):

• runtime/Lookup.h:

(JSC::replaceStaticPropertySlot): Deleted.

Source/WebCore:

The previous implementation relied on an invariant that structure property is absent
when [Replaceable] setter is called, which is no longer guaranteed after the introduction
of Object.defineProperty.

This patch replaces putDirect() with defineOwnProperty(), fixing the compliance with
invariants of internal methods [1]: an accessor property once observed as non-configurable
can't be reconfigured to have Value. Both Chrome and Firefox properly validate descriptors.

Although DefineOwnProperty failure is silently ignored by Chrome and the spec [2], WebKit now
throws a TypeError, which is a desired behavior for built-ins and was proven to be web-compatible
by Firefox. With WebKit being the second implementation that throws, the spec can be tightened.

After r264574, attributeChangeTransition() is called during defineOwnProperty(), ensuring inline
caching is correct. Also, this change adjusts window.opener setter [3].

[1] ​https://tc39.es/ecma262/#sec-invariants-of-the-essential-internal-methods
[2] ​https://heycam.github.io/webidl/#dfn-attribute-setter (step 4.5.5)
[3] ​https://html.spec.whatwg.org/multipage/browsers.html#dom-opener

Tests: fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html

fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html
fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html

• bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::setOpener):
(WebCore::JSDOMWindow::setOpenDatabase):

• bindings/scripts/CodeGeneratorJS.pm:

(AttributeSetterNeedsPropertyName):
(GenerateAttributeSetterBodyDefinition):
(GenerateAttributeSetterTrampolineDefinition):

• bindings/scripts/test/JS/JSTestObj.cpp:

LayoutTests:

• fast/dom/replaceable-setter-throws-if-defineownproperty-fails-expected.txt: Added.
• fast/dom/replaceable-setter-throws-if-defineownproperty-fails.html: Added.
• fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1-expected.txt: Added.
• fast/dom/window-opener-setter-throws-if-defineownproperty-fails-1.html: Added.
• fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2-expected.txt: Added.
• fast/dom/window-opener-setter-throws-if-defineownproperty-fails-2.html: Added.

6:43 PM Changeset in webkit [280279] by Russell Epstein

• 1 copy in tags/Safari-612.1.24.0.5

Tag Safari-612.1.24.0.5.

6:16 PM Changeset in webkit [280278] by Russell Epstein

• 1 copy in tags/Safari-612.1.24.11.3

Tag Safari-612.1.24.11.3.

6:14 PM Changeset in webkit [280277] by Russell Epstein

• 4 edits in branches/safari-612.1.24.11-branch

Cherry-pick r280274. rdar://problem/81044139

Make WKContentRuleListStore respond to same selectors as _WKUserContentExtensionStore
​https://bugs.webkit.org/show_bug.cgi?id=228253
Source/WebKit:

<rdar://81038849>

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-07-23
Reviewed by Brian Weinstein.

We have an unfortunate situation where an old framework is calling code in a new framework that is giving it a WKContentRuleListStore
where it expects a _WKUserContentExtensionStore. As one of several mitigations for this problem, make the selectors able to be called.
Luckily it doesn't do much with the results. It just checks if they're null or not, and it passes any errors along. I added tests that do this.

• UIProcess/API/Cocoa/WKContentRuleListStore.mm: (-[WKContentRuleListStore compileContentExtensionForIdentifier:encodedContentExtension:completionHandler:]): (-[WKContentRuleListStore lookupContentExtensionForIdentifier:completionHandler:]): (-[WKContentRuleListStore removeContentExtensionForIdentifier:completionHandler:]):

Tools:

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-07-23
Reviewed by Brian Weinstein.

• TestWebKitAPI/Tests/WebKitCocoa/WKContentExtensionStore.mm: (TEST_F):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280274 268f45cc-cd09-0410-ab3c-d52691b4dbfc

6:10 PM Changeset in webkit [280276] by Russell Epstein

• 8 edits in branches/safari-612.1.24.11-branch/Source

Versioning.

WebKit-7612.1.24.11.3

6:02 PM Changeset in webkit [280275] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[BigSur wk1 Debug ] imported/w3c/web-platform-tests/IndexedDB/idb_binary_key_conversion.htm is a flaky timeout .
​https://bugs.webkit.org/show_bug.cgi?id=228260.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

5:39 PM Changeset in webkit [280274] by commit-queue@webkit.org

• 4 edits in trunk

Make WKContentRuleListStore respond to same selectors as _WKUserContentExtensionStore
​https://bugs.webkit.org/show_bug.cgi?id=228253
Source/WebKit:

<rdar://81038849>

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-07-23
Reviewed by Brian Weinstein.

We have an unfortunate situation where an old framework is calling code in a new framework that is giving it a WKContentRuleListStore
where it expects a _WKUserContentExtensionStore. As one of several mitigations for this problem, make the selectors able to be called.
Luckily it doesn't do much with the results. It just checks if they're null or not, and it passes any errors along. I added tests that do this.

• UIProcess/API/Cocoa/WKContentRuleListStore.mm:

(-[WKContentRuleListStore compileContentExtensionForIdentifier:encodedContentExtension:completionHandler:]):
(-[WKContentRuleListStore lookupContentExtensionForIdentifier:completionHandler:]):
(-[WKContentRuleListStore removeContentExtensionForIdentifier:completionHandler:]):

Tools:

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-07-23
Reviewed by Brian Weinstein.

• TestWebKitAPI/Tests/WebKitCocoa/WKContentExtensionStore.mm:

(TEST_F):

5:03 PM Changeset in webkit [280273] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ Mac wk2 Debug ] inspector/canvas/create-context-webgl.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=228256.

Unreviewed test gardening.

• platform/mac-wk2/TestExpectations:

4:40 PM Changeset in webkit [280272] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ iOS ] fast/mediastream/mediastreamtrack-audio-clone.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=228255

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

4:21 PM Changeset in webkit [280271] by Wenson Hsieh

• 8 edits
  2 adds in trunk

REGRESSION (r279751): WebContent process often crashes when hovering over content on apple.com
​https://bugs.webkit.org/show_bug.cgi?id=228247
rdar://81010093

Reviewed by Tim Horton.

Source/WebCore:

Add an internal testing hook that can be used to trigger text recognition for the given element. While we should
eventually combine this with another testing hook to simulate VisionKit text recognition results, the new test
using this internal hook shouldn't make its way into VisionKit anyways, so this isn't necessary for now.

See WebKit ChangeLog for more details.

Test: fast/images/text-recognition/text-recognition-in-transparent-video.html

• testing/Internals.cpp:

(WebCore::Internals::requestTextRecognition):

• testing/Internals.h:
• testing/Internals.idl:

Source/WebKit:

After r279751, the snapshot fallback codepath I added in createShareableBitmap to handle the edge case of
fully transparent images causes us to now take snapshots when hovering over fully transparent video elements,
and attempt to recognize text in them. This is because RenderVideo is a RenderImage subclass without a cached
image, so we'll end up going down the transparent renderer codepath instead of bailing with a null bitmap.

However, since CachedImages are null for video elements, before we even get to VisionKit, we end up crashing
with a nullptr-deref inside WebPage::requestTextRecognition, which assumes that RenderImage::cachedImage()
is non-null.

To address this, we make two minor adjustments (see below).

• WebProcess/WebCoreSupport/ShareableBitmapUtilities.cpp:

(WebKit::createShareableBitmap):

Limit the snapshotting fallback to non-media images (i.e. non-RenderMedia).

• WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::requestTextRecognition):

Make this robust in the case where CachedImage is null, to avoid the possibility for similar crashes in the
future.

LayoutTests:

• fast/images/text-recognition/text-recognition-in-transparent-video-expected.txt: Added.
• fast/images/text-recognition/text-recognition-in-transparent-video.html: Added.

4:16 PM Changeset in webkit [280270] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

REGRESSION: [ Mac ] media/video-buffering-allowed.html is flaky timeout.
​https://bugs.webkit.org/show_bug.cgi?id=217621

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

4:13 PM Changeset in webkit [280269] by Russell Epstein

• 8 edits in branches/safari-612.1.24.0-branch/Source

Versioning.

WebKit-7612.1.24.0.5

3:57 PM Changeset in webkit [280268] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ BigSur wk2 Release arm64 ] fast/css-grid-layout floating-empty-grids.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=228252.

Unreviewed test gardening.

• platform/mac-wk2/TestExpectations:

3:55 PM Changeset in webkit [280267] by Russell Epstein

• 1 copy in tags/Safari-612.1.25

Tag Safari-612.1.25.

3:53 PM Changeset in webkit [280266] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

REGRESSION: [iOS] ASSERTION FAILED: !m_messageReceiverMapCount under WebKit::RemoteAudioHardwareListener::~RemoteAudioHardwareListener()
​https://bugs.webkit.org/show_bug.cgi?id=228038

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

3:50 PM Changeset in webkit [280265] by Russell Epstein

• 1 copy in tags/Safari-612.1.24.11.2

Tag Safari-612.1.24.11.2.

3:49 PM Changeset in webkit [280264] by Russell Epstein

• 8 edits in branches/safari-612.1.24.11-branch/Source

Versioning.

WebKit-7612.1.24.11.2

3:39 PM Changeset in webkit [280263] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[iOS 14] imported/w3c/web-platform-tests/webstorage/event_case_sensitive.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=226789

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

3:20 PM Changeset in webkit [280262] by Eric Hutchison

• 1 edit in trunk/LayoutTests/platform/mac-wk2/TestExpectations

Need a short description (OOPS!).
Need the bug URL (OOPS!).

Reviewed by NOBODY (OOPS!).

• platform/mac-wk2/TestExpectations:

3:08 PM Changeset in webkit [280261] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ BigSur wk2 Release arm64 ] fast/selectors/selection-window-inactive.html is a flaky failure .
​https://bugs.webkit.org/show_bug.cgi?id=228248.

Unreviewed test gardening.

• platform/mac-wk2/TestExpectations:

3:05 PM Changeset in webkit [280260] by Chris Dumez

• 12 edits in trunk/Source

SharedBuffer::takeData() is a bit dangerous
​https://bugs.webkit.org/show_bug.cgi?id=228161

Reviewed by Darin Adler.

Source/WebCore:

SharedBuffer::takeData() is a bit dangerous since SharedBuffer is RefCounted and several object may be sharing ownership
of the buffer. Having one owner call takeData() in case ownership is shared leads to bugs such as Bug 228096.

To address the issue, I made SharedBuffer::takeData() private and introduced a new SharedBuffer::extractData() member
function which calls takeData() only if the SharedBuffer is not shared (RefCount is 1) and falls back to calling copyData()
otherwise. I also optimized copyData() a bit by iterating over the segments to build the vector, instead of calling the
potentially very slow SharedBuffer::data().

• Modules/fetch/FetchBodyConsumer.cpp:

(WebCore::FetchBodyConsumer::takeAsBlob):

• Modules/mediarecorder/MediaRecorder.cpp:

(WebCore::createDataAvailableEvent):

• editing/WebCorePasteboardFileReader.cpp:

(WebCore::WebCorePasteboardFileReader::readBuffer):

• editing/cocoa/WebContentReaderCocoa.mm:

(WebCore::createFragmentForImageAttachment):
(WebCore::WebContentReader::readImage):

• editing/gtk/WebContentReaderGtk.cpp:

(WebCore::WebContentReader::readImage):

• html/HTMLAttachmentElement.cpp:

(WebCore::HTMLAttachmentElement::updateEnclosingImageWithData):

• platform/SharedBuffer.cpp:

(WebCore::SharedBuffer::copyData):

• platform/SharedBuffer.h:

(WebCore::SharedBuffer::extractData):

• xml/XMLHttpRequest.cpp:

(WebCore::XMLHttpRequest::createResponseBlob):

Source/WTF:

Add Vector::uncheckedAppend() overload that takes in a Span.

• wtf/Vector.h:

(WTF::Vector::uncheckedAppend):
(WTF::Malloc>::uncheckedAppend):

2:43 PM Changeset in webkit [280259] by Russell Epstein

• 11 edits
  2 moves
  1 delete in branches/safari-612.1.25-branch/Source

Revert "Cherry-pick r280205. rdar://problem/80991517"

This reverts commit r280209.

2:01 PM Changeset in webkit [280258] by Robert Jenner

• 11 edits
  2 moves
  1 delete in trunk/Source

Unreviewed, reverting r280205.

Broke multiple WebAuthn tests.

Reverted changeset:

"REGRESSION (r278877) [Cocoa] WebAuthn stopped working for
non-Safari browsers"
​https://bugs.webkit.org/show_bug.cgi?id=228116
​https://commits.webkit.org/r280205

2:00 PM Changeset in webkit [280257] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[BigSur wk1 Release arm64] imported/w3c/web-platform-tests/workers/modules/shared-worker-import-csp.html is a flaky failure.
​https://bugs.webkit.org/show_bug.cgi?id=228245.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

1:13 PM Changeset in webkit [280256] by Alexey Shvayka

• 44 edits
  16 adds in trunk

[JSC] Call custom accessors / values with their holder's global object
​https://bugs.webkit.org/show_bug.cgi?id=225997

Reviewed by Yusuke Suzuki.

JSTests:

• stress/custom-get-set-proto-chain-put.js:
• stress/getter-setter-globalobject-in-ic-2.js: Added.

LayoutTests/imported/w3c:

• web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value-cross-realm-expected.txt: Added.
• web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value-cross-realm.html: Added.
• web-platform-tests/WebIDL/ecmascript-binding/invalid-this-value-cross-realm-expected.txt: Added.
• web-platform-tests/WebIDL/ecmascript-binding/invalid-this-value-cross-realm.html: Added.
• web-platform-tests/WebIDL/ecmascript-binding/support/create-realm.js: Added.
• web-platform-tests/WebIDL/ecmascript-binding/support/dummy-iframe.html: Added.
• web-platform-tests/html/browsers/origin/cross-origin-objects/window-location-and-location-href-cross-realm-set-expected.txt: Added.
• web-platform-tests/html/browsers/origin/cross-origin-objects/window-location-and-location-href-cross-realm-set.html: Added.

• web-platform-tests/html/webappapis/scripting/events/compile-event-handler-settings-objects-expected.txt:
• web-platform-tests/html/webappapis/scripting/processing-model-2/integration-with-the-javascript-job-queue/promise-job-incumbent-expected.txt:
• web-platform-tests/service-workers/service-worker/fetch-request-css-cross-origin.https-expected.txt:
• web-platform-tests/webrtc-encoded-transform/sframe-transform-readable.html:

All these are confirmed progressions.

• web-platform-tests/performance-timeline/supportedEntryTypes-cross-realm-access-expected.txt: Added.
• web-platform-tests/performance-timeline/supportedEntryTypes-cross-realm-access.html: Added.

Source/JavaScriptCore:

Just like JS built-ins, getter / setter functions of WebIDL attributes are created in realm
of their holder interface [1][2], which is their _current_ realm for throwing an error [3].

With this patch, custom properties get correct global object instead of lexical, including
when inline cached, aligning them with functions and regular accessors.

The latter allowed switching JS built-ins to CustomAccessor (e.g. Symbol#description),
which is slightly more efficient to call from C++, doesn't need reification on first access,
and has nicer signature.

Also, renames WASM accessors to drop "func" and removes unused function length parameter.

[1]: ​https://heycam.github.io/webidl/#dfn-attribute-getter (step 2)
[2]: ​https://heycam.github.io/webidl/#dfn-attribute-setter (step 5)
[3]: ​https://heycam.github.io/webidl/#ecmascript-throw

• bytecode/AccessCase.cpp:

(JSC::AccessCase::generateImpl):

• create_hash_table:
• interpreter/CallFrame.cpp:

(JSC::CallFrame::globalObjectOfClosestCodeBlock):

• interpreter/CallFrame.h:
• runtime/IntlCollatorPrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

• runtime/IntlDateTimeFormatPrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

• runtime/IntlLocalePrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

• runtime/IntlNumberFormatPrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

• runtime/JSDataViewPrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

• runtime/JSObject.cpp:

(JSC::JSObject::putInlineSlow):

• runtime/PropertySlot.cpp:

(JSC::PropertySlot::customGetter const):

• runtime/PropertySlot.h:

(JSC::PropertySlot::getValue const):

• runtime/SymbolPrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

• tools/JSDollarVM.cpp:
• wasm/js/WebAssemblyInstancePrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):
(JSC::JSC_DEFINE_HOST_FUNCTION): Deleted.

• wasm/js/WebAssemblyMemoryPrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

• wasm/js/WebAssemblyTablePrototype.cpp:

(JSC::JSC_DEFINE_CUSTOM_GETTER):

Source/WebCore:

This patch fixes cross-realm yet same-origin WebIDL attributes to throw errors in realm of
their accessor, while ensuring that window.location and location.href setters don't leak
cross-origin Object.prototype via thrown error.

Since Location setters relied on lexical global object to pass outgoing document.referrer,
they were updated to use IncumbentWindow as per spec [1]. callerGlobalObject() was reworked
to skip native / built-in callers and rely on VMEntryScope to accomodate top-level <script>
code navigating via Location setter, making the helper more versatile.

globalObjectOfClosestCodeBlock() fixed JSCustomSetterFunction instances and Location's
assign() / replace() methods to pass correct referrer.

Also, this change fixes static attributes like PerformanceObserver.supportedEntryTypes
to return wrappers of their realm instead of lexical.

[1] ​https://html.spec.whatwg.org/multipage/history.html#location-object-navigate (step 2)

Tests: imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/global-object-implicit-this-value-cross-realm.html

imported/w3c/web-platform-tests/WebIDL/ecmascript-binding/invalid-this-value-cross-realm.html
imported/w3c/web-platform-tests/html/browsers/origin/cross-origin-objects/window-location-and-location-href-cross-realm-set.html
imported/w3c/web-platform-tests/performance-timeline/supportedEntryTypes-cross-realm-access.html

• bindings/js/JSDOMGlobalObject.cpp:

(WebCore::callerGlobalObject): Deleted.

• bindings/js/JSDOMGlobalObject.h:
• bindings/js/JSDOMWindowBase.cpp:

(WebCore::incumbentDOMWindow):

• bindings/js/JSDOMWindowBase.h:
• bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::put):

• bindings/js/JSLocationCustom.cpp:

(WebCore::JSLocation::put):

• bindings/scripts/CodeGeneratorJS.pm:

(GenerateNamedGetterLambda):
(GenerateCallWithUsingReferences):
(GenerateCallWith):
Ensure IncumbentWindow comes before FirstWindow.

• bindings/scripts/test/JS/JSTestObj.cpp:
• bindings/scripts/test/TestObj.idl:

Remove attributes that relied on CallFrame since custom getters don't have it.

• page/Location.idl:

Remove [LegacyUnforgeable] from ancestorOrigins because it's set on the interface.

LayoutTests:

• fast/dom/HTMLObjectElement/object-as-frame-expected.txt:
• fast/dom/HTMLObjectElement/object-as-frame.html:
• fast/dom/HTMLObjectElement/resources: Added.
• fast/dom/HTMLObjectElement/resources/dummy-frame-1.html: Added.
• fast/dom/HTMLObjectElement/resources/dummy-frame-2.html: Added.
• fast/events/attribute-listener-cloned-from-frameless-doc-context-2.html:
• fast/events/attribute-listener-extracted-from-frameless-doc-context-2.html:

These tests used to pass as is, probably, due to combination of old (incorrect) behavior and
some implementation details of run-webkit-tests. They fail on MiniBrowser / Chrome / Firefox
unless modified not to use data:// protocol, which is not system under test.

• fast/frames/sandboxed-iframe-navigation-parent-expected.txt:
• fast/frames/sandboxed-iframe-navigation-parent.html:
• http/tests/security/frameNavigation/context-for-location-assign-expected.txt:

Revert the changes made in r174996. Location::assign() now uses correct (incumbent) Window
to set outgoing referrer and perform security checks, aligning WebKit with Chrome / Firefox.

• http/tests/security/frameNavigation/context-for-location-href-gopd-expected.txt: Added.
• http/tests/security/frameNavigation/context-for-location-href-gopd.html: Added.

1:04 PM Changeset in webkit [280255] by Eric Hutchison

• 2 edits in trunk/LayoutTests

Update test expectations for inspector/dom-debugger/event-breakpoint-with-navigation.html.
​https://bugs.webkit.org/show_bug.cgi?id=224291.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

12:57 PM Changeset in webkit [280254] by pvollan@apple.com

• 2 edits in trunk/Source/WebKit

[macOS] Reduce sandbox logging
​https://bugs.webkit.org/show_bug.cgi?id=228236

Reviewed by Tim Horton.

To improve performance, remove some sandbox logging in the WebContent process' sandbox.

• WebProcess/com.apple.WebProcess.sb.in:

11:52 AM Changeset in webkit [280253] by Chris Dumez

• 2 edits
  2 adds in trunk/LayoutTests

[iOS] imported/w3c/web-platform-tests/html/dom/idlharness.https.html is failing
​https://bugs.webkit.org/show_bug.cgi?id=228198
<rdar://problem/80982016>

Unreviewed, land iPad-specific baseline instead of marking the test as failing on iOS.
We are merely getting different results on iPhone and iPad because MediaSource is enabled
on iPad but not iPhone.

• platform/ios-wk2/TestExpectations:
• platform/ipad/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt: Added.

11:43 AM Changeset in webkit [280252] by Wenson Hsieh

• 3 edits in trunk/Source/WebKit

[watchOS] It should be possible to select contact AutoFill text suggestions in email and username fields
​https://bugs.webkit.org/show_bug.cgi?id=228237
rdar://77299680

Reviewed by Tim Horton.

After the changes in r278957, WKTextInputListViewController now presents modern Quickboard text input UI, as
well as contact AutoFill suggestions provided by Safari. For email and username fields (for which we currently
use PUICQuickboardController), this means that there's no longer any reason to prefer showing
PUICQuickboardController over WKTextInputListViewController, since both use modern text input UI (with support
for keychain AutoFill suggestions), but only the latter additionally supports contact AutoFill suggestions.

As such, we should change these to use WKTextInputListViewController instead of PUICQuickboardController. Note
that because contact AutoFill suggestions do not encompass passwords, it still makes more sense to pop directly
into PUICQuickboardController for password fields.

• Platform/spi/watchos/PepperUICoreSPI.h:
• UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView createQuickboardTextInputContext]):

Drive-by fix: additionally populate the placeholder of the text field in WKTextInputListViewController with
the input label text of the focused element (i.e., either placeholder text, the ARIA label, title, or text
content of an associated label).

(canUseQuickboardControllerFor):

11:36 AM Changeset in webkit [280251] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[iOS]imported/w3c/web-platform-tests/html/dom/idlharness.https.html is failing.
​https://bugs.webkit.org/show_bug.cgi?id=228198

Unreviewed test gardening.

• platform/ios-wk2/TestExpectations:

11:23 AM Changeset in webkit [280250] by commit-queue@webkit.org

• 5 edits
  4 adds in trunk

WebSocket traffic should be correctly assigned to either Developer or User.
​https://bugs.webkit.org/show_bug.cgi?id=227564
<rdar://problem/79307301>

Patch by Richard Houle <​rhoule@apple.com> on 2021-07-23
Reviewed by Kate Cheney.

Source/WebCore:

Tests: http/tests/app-privacy-report/websocket-isappinitiated.html

http/tests/app-privacy-report/websocket-isnotappinitiated.html

• Modules/websockets/ThreadableWebSocketChannel.cpp:

(WebCore::ThreadableWebSocketChannel::webSocketConnectRequest):

Source/WebKit:

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(WebKit::NetworkSessionCocoa::createWebSocketTask):

LayoutTests:

• http/tests/app-privacy-report/websocket-isappinitiated-expected.txt: Added.
• http/tests/app-privacy-report/websocket-isappinitiated.html: Added.
• http/tests/app-privacy-report/websocket-isnotappinitiated-expected.txt: Added.
• http/tests/app-privacy-report/websocket-isnotappinitiated.html: Added.

11:12 AM Changeset in webkit [280249] by Russell Epstein

• 2 edits in branches/safari-612.1.25-branch/Source/WebKit

Cherry-pick r280183. rdar://problem/81027380

REGRESSION (r279992): Crashes under RemoteLayerBackingStore::applyBackingStoreToLayer() in macCatalyst
​https://bugs.webkit.org/show_bug.cgi?id=228181
rdar://80923581

Reviewed by Dan Bates.

• Shared/RemoteLayerTree/RemoteLayerBackingStore.mm: (WebKit::RemoteLayerBackingStore::applyBackingStoreToLayer): r279992 reorganized this code to determine the contents object and then set it on the layer, instead of setting it directly; this means that the lifetime of the contents object must be extended.

Interestingly, the common case (the CAMachPort case), as well as the
case I was actually adding in r279992 both were safe, because of the use
of autorelease. (macCatalyst uses IOSurface as layer contents directly,
without CAMachPort, so uses the one path that r279992 broke).

It is unnecessary to use autorelease; instead just store the contents
object in a RetainPtr until it is set.

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280183 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:47 AM Changeset in webkit [280248] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[ BigSur wk1 Debug arm64 ] imported/w3c/web-platform-tests/IndexedDB/idbcursor-iterating-update.htm is a flaky timeout.
​https://bugs.webkit.org/show_bug.cgi?id=228238.

Unreviewed test gardening.

• platform/mac-wk1/TestExpectations:

10:33 AM Changeset in webkit [280247] by sihui_liu@apple.com

• 2 edits in trunk/Source/WebKit

Generate simulated crash when UI process fails to get network process connection
​https://bugs.webkit.org/show_bug.cgi?id=228203

Reviewed by Geoffrey Garen.

To help diagnose the issue that web process sometimes fails to get connection to the network process
(rdar://80760179), as UI process should have more information about it than web process.

• UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::getNetworkProcessConnection):

10:27 AM Changeset in webkit [280246] by Truitt Savell

• 13 edits
  5 copies
  98 adds in trunk

Migrate iOS 15 expectations to OpenSource and bump version numbers
​https://bugs.webkit.org/show_bug.cgi?id=228202

Reviewed by Ryan Haddad.

Tools:

• Scripts/webkitpy/port/ios.py:

(IOSPort):

• Scripts/webkitpy/port/ios_device_unittest.py:
• Scripts/webkitpy/port/ios_simulator_unittest.py:

(IOSSimulatorTest.make_port):
(IOSSimulatorTest.test_layout_test_searchpath_with_apple_additions):
(IOSSimulatorTest.test_layout_test_searchpath_without_apple_additions):
(IOSSimulatorTest.test_layout_searchpath_wih_device_type):

• Scripts/webkitpy/port/ios_testcase.py:

(IOSTest.make_port):

LayoutTests:

• platform/ios-14-wk2/TestExpectations: Added.
• platform/ios-14-wk2/fast/css/font-face-locally-installed-expected.txt: Copied from LayoutTests/platform/ios-wk2/fast/css/font-face-locally-installed-expected.txt.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/alert-in-event-handler-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/bufferedAmount-after-close-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/close-and-server-script-exception-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/fragmented-frames-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/handshake-fail-by-no-cr-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/handshake-fail-by-null-char-in-status-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/handshake-ok-with-http-version-beyond-1_1-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/interleaved-fragments-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/receive-arraybuffer-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/workers/close-code-and-reason-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/workers/receive-arraybuffer-expected.txt: Added.
• platform/ios-14-wk2/http/tests/websocket/tests/hybi/zero-length-text-expected.txt: Added.
• platform/ios-14-wk2/http/tests/workers/service/serviceworker-websocket.https-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/touch-events/idlharness.window-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/Send-65K-data.any-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/Send-binary-65K-arraybuffer.any-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/Send-binary-arraybuffer.any-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/Send-data.any-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/Send-paired-surrogates.any-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/basic-auth.any-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/basic-auth.any.worker-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/cookies/007-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-arraybuffer-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-blob-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-getting-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-large-expected.txt: Added.
• platform/ios-14-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-unicode-expected.txt: Added.
• platform/ios-14/TestExpectations: Added.
• platform/ios-14/fast/css/ios/system-color-for-css-value-expected.txt: Added.
• platform/ios-14/fast/forms/button-sizes-expected.txt: Copied from LayoutTests/platform/ios/fast/forms/button-sizes-expected.txt.
• platform/ios-14/fast/forms/input-button-sizes-expected.txt: Copied from LayoutTests/platform/ios/fast/forms/input-button-sizes-expected.txt.
• platform/ios-14/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.txt: Copied from LayoutTests/platform/ios/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.txt.
• platform/ios-14/fast/text/hyphenate-avoid-orphaned-word-expected.txt: Copied from LayoutTests/platform/ios/fast/text/hyphenate-avoid-orphaned-word-expected.txt.
• platform/ios-wk2/TestExpectations:
• platform/ios-wk2/fast/css/font-face-locally-installed-expected.txt:
• platform/ios-wk2/http/tests/websocket/tests/hybi/alert-in-event-handler-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/bufferedAmount-after-close-in-busy-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/close-and-server-script-exception-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/fragmented-frames-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/handshake-fail-by-no-cr-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/handshake-fail-by-null-char-in-status-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/handshake-ok-with-http-version-beyond-1_1-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/interleaved-fragments-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/receive-arraybuffer-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/workers/close-code-and-reason-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/workers/receive-arraybuffer-expected.txt: Added.
• platform/ios-wk2/http/tests/websocket/tests/hybi/zero-length-text-expected.txt: Added.
• platform/ios-wk2/http/tests/workers/service/serviceworker-websocket.https-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/touch-events/idlharness.window-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/Send-65K-data.any-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/Send-binary-65K-arraybuffer.any-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/Send-binary-arraybuffer.any-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/Send-data.any-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/Send-paired-surrogates.any-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/basic-auth.any-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/basic-auth.any.worker-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/cookies/007-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-arraybuffer-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-blob-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-getting-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-large-expected.txt: Added.
• platform/ios-wk2/imported/w3c/web-platform-tests/websockets/interfaces/WebSocket/bufferedAmount/bufferedAmount-unicode-expected.txt: Added.
• platform/ios/TestExpectations:
• platform/ios/fast/css/ios/system-color-for-css-value-expected.txt: Added.
• platform/ios/fast/forms/button-sizes-expected.txt:
• platform/ios/fast/forms/input-button-sizes-expected.txt:
• platform/ios/fast/forms/number/number-appearance-spinbutton-disabled-readonly-expected.txt:
• platform/ios/fast/text/hyphenate-avoid-orphaned-word-expected.txt:

9:51 AM Changeset in webkit [280245] by mmaxfield@apple.com

• 4 edits in trunk/Source/WebKit

[GPU Process] Migrate the DisplayList::Replayer::Delegate from RemoteImageBuffer to RemoteRenderingBackend
​https://bugs.webkit.org/show_bug.cgi?id=228219

Reviewed by Wenson Hsieh.

This is part 1 of ​https://bugs.webkit.org/show_bug.cgi?id=228216.

For this task, we need to count resource uses:

1. As the recorder in the web process records DisplayList items which reference resources, those uses need to increment a counter.
2. As the replayer in the GPU process replays DisplayList items which reference resources, those uses need to increment a parallel counter.

The most natural place for the counters to live is in RemoteResourceCacheProxy and RemoteResourceCache, respectively. These two classes
are accessible from the RemoteRenderingBackendProxy and RemoteRenderingBackend, respectively. The most natural interface between the
DisplayList classes like DisplayList::Recorder and DisplayList::Replayer and the higher level WebKit classes is to use their delegate
interfaces.

For 1 above, RemoteImageBufferProxy has access to the RemoteRenderingBackendProxy and is already a DisplayList::Recorder::Delegate, so
there's no problem there. However, for 2, messages are delivered first to the RemoteRenderingBackend, which is the place that has access to
the RemoteResourceCache. Making the RemoteRenderingBackend have the DisplayList::Replayer::Delegate would be a natural place to either
A) call the necessary function in the RemoteImageBuffer, or B) interact with the RemoteResourceCache to increment the necessary counter.

Indeed, this makes a lot of sense because, for 2 of the 3 delegate methods, RemoteImageBuffer just immediately turns around and forwards
the call to the RemoteRenderingBackend anyway. So, migrating this interface to RemoteRenderingBackend actually ends up making it a bit
simpler.

No new tests because there is no behavior change.

• GPUProcess/graphics/RemoteImageBuffer.h:

(WebKit::RemoteImageBuffer::apply):
(): Deleted.

• GPUProcess/graphics/RemoteRenderingBackend.cpp:

(WebKit::RemoteRenderingBackend::ReplayerDelegate::ReplayerDelegate):
(WebKit::RemoteRenderingBackend::ReplayerDelegate::apply):
(WebKit::RemoteRenderingBackend::ReplayerDelegate::didCreateMaskImageBuffer):
(WebKit::RemoteRenderingBackend::ReplayerDelegate::didResetMaskImageBuffer):
(WebKit::RemoteRenderingBackend::submit):

• GPUProcess/graphics/RemoteRenderingBackend.h:

9:07 AM Changeset in webkit [280244] by Aditya Keerthi

• 14 edits
  7 copies
  5 adds in trunk

[macOS] Repainting artifacts when moving input type=range slider thumb
​https://bugs.webkit.org/show_bug.cgi?id=228135
rdar://76247487

Reviewed by Tim Horton.

Source/WebCore:

• rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::adjustSliderThumbSize const):

The size of NSSliderCell's knob increased in Big Sur. Consequently, the
knob was being painted outside of its box. Unfortunately, there is
currently no way to obtain the size programmatically, so we are forced
to update the hardcoded size.

LayoutTests:

Rebaselined tests to account for the change to the size of the slider
thumb.

• fast/dom/HTMLInputElement/input-slider-update-expected.txt:
• fast/repaint/block-inputrange-repaint-expected.txt:
• fast/repaint/block-inputrange-repaint.html:
• fast/repaint/slider-thumb-drag-release-expected.txt:
• platform/gtk/fast/repaint/block-inputrange-repaint-expected.txt:
• platform/mac-catalina/fast/dom/HTMLInputElement/input-slider-update-expected.txt: Copied from LayoutTests/fast/dom/HTMLInputElement/input-slider-update-expected.txt.
• platform/mac-catalina/fast/forms/input-appearance-height-expected.txt: Copied from LayoutTests/platform/mac/fast/forms/input-appearance-height-expected.txt.
• platform/mac-catalina/fast/forms/range/input-appearance-range-expected.txt: Copied from LayoutTests/platform/mac/fast/forms/range/input-appearance-range-expected.txt.
• platform/mac-catalina/fast/forms/range/slider-padding-expected.txt: Copied from LayoutTests/platform/mac/fast/forms/range/slider-padding-expected.txt.
• platform/mac-catalina/fast/forms/range/slider-thumb-shared-style-expected.txt: Copied from LayoutTests/platform/mac/fast/forms/range/slider-thumb-shared-style-expected.txt.
• platform/mac-catalina/fast/forms/range/thumbslider-no-parent-slider-expected.txt: Copied from LayoutTests/platform/mac/fast/forms/range/thumbslider-no-parent-slider-expected.txt.
• platform/mac-catalina/fast/repaint/block-inputrange-repaint-expected.txt: Added.
• platform/mac-catalina/fast/repaint/slider-thumb-drag-release-expected.txt: Copied from LayoutTests/fast/repaint/slider-thumb-drag-release-expected.txt.
• platform/mac/fast/forms/box-shadow-override-expected.txt:
• platform/mac/fast/forms/input-appearance-height-expected.txt:
• platform/mac/fast/forms/range/input-appearance-range-expected.txt:
• platform/mac/fast/forms/range/slider-padding-expected.txt:
• platform/mac/fast/forms/range/slider-thumb-shared-style-expected.txt:
• platform/mac/fast/forms/range/thumbslider-no-parent-slider-expected.txt:

8:38 AM Changeset in webkit [280243] by commit-queue@webkit.org

• 4 edits in trunk/Source/WebCore

[GStreamer][1.19] Warnings due to AppSinkCallbacks struct growth
​https://bugs.webkit.org/show_bug.cgi?id=228229

Patch by Philippe Normand <​pnormand@igalia.com> on 2021-07-23
Reviewed by Xabier Rodriguez-Calvar.

A new callback was added, for event notifications.

• platform/audio/gstreamer/AudioFileReaderGStreamer.cpp:

(WebCore::AudioFileReader::handleNewDeinterleavePad):

• platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp:

(WebCore::AudioSourceProviderGStreamer::handleNewDeinterleavePad):

• platform/graphics/gstreamer/ImageDecoderGStreamer.cpp:

(WebCore::ImageDecoderGStreamer::InnerDecoder::connectDecoderPad):

4:39 AM Changeset in webkit [280242] by Devin Rousso

• 5 edits in trunk

[Modern Media Controls] [macOS] Only show total duration when the elapsed time is visible
​https://bugs.webkit.org/show_bug.cgi?id=228191
<rdar://problem/80529918>

Reviewed by Eric Carlson.

Source/WebCore:

When a <video> is narrow (~250px) WebKit will drop the elapsed time, meaning that only the
scrubber and duration are visible. It's not very helpful to show just the duration because
it never changes, requiring the user to do the mental math of dividing the scrubber width
by the total duration to figure out how much time is left (and has elapsed). Showing the
remaining time is better because it at least helps the user not have to figure out how much
longer the <video> will play (which is more useful/actionable than knowing the duration).

Test: media/modern-media-controls/time-control/time-control.html

• Modules/modern-media-controls/controls/time-control.js:

(TimeControl):
(TimeControl.prototype.handleEvent):
(TimeControl.prototype.get _canShowDurationTimeLabel): Added.
(TimeControl.prototype._durationOrRemainingTimeLabel):
(TimeControl.prototype._performIdealLayout):
Rename _showDurationTimeLabel to _shouldShowDurationTimeLabel and add another private
getter _canShowDurationTimeLabel that only is true when this.elapsedTimeLabel.visible.
Use both to decide whether duration or remaining is shown/updated/etc..

LayoutTests:

• media/modern-media-controls/time-control/time-control.html:
• media/modern-media-controls/time-control/time-control-expected.txt:

4:03 AM Changeset in webkit [280241] by Carlos Garcia Campos

• 1 copy in releases/WebKitGTK/webkit-2.32.3

WebKitGTK 2.32.3

4:03 AM Changeset in webkit [280240] by Carlos Garcia Campos

• 4 edits in releases/WebKitGTK/webkit-2.32

Unreviewed. Update OptionsGTK.cmake and NEWS for 2.32.3 release

.:

• Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

• gtk/NEWS: Add release notes for 2.32.3

3:51 AM Changeset in webkit [280239] by Philippe Normand

• 12 edits
  1 add
  1 delete in trunk

[GLib] Remove libportal dependency
​https://bugs.webkit.org/show_bug.cgi?id=228056

Reviewed by Carlos Garcia Campos.

.:

• Source/cmake/FindLIBPORTAL.cmake: Removed.
• Source/cmake/GStreamerChecks.cmake:

Source/WebCore:

The pure-GDBus approach allows us to request the input device (Monitor or Window) depending
on the CaptureDevice type and make the mouse cursor visible in the generated video stream.
Also requesting capture support within computeCaptureDevices() was a bad idea because this
being used by the enumerateMediaDevices API could potentially spam the user with permission
popups.

• platform/GStreamer.cmake:
• platform/mediastream/gstreamer/GStreamerCaptureDeviceManager.cpp:
• platform/mediastream/gstreamer/GStreamerCaptureDeviceManager.h:
• platform/mediastream/gstreamer/GStreamerDisplayCaptureDeviceManager.cpp: Added.

(WebCore::GStreamerDisplayCaptureDeviceManager::singleton):
(WebCore::GStreamerDisplayCaptureDeviceManager::GStreamerDisplayCaptureDeviceManager):
(WebCore::GStreamerDisplayCaptureDeviceManager::~GStreamerDisplayCaptureDeviceManager):
(WebCore::GStreamerDisplayCaptureDeviceManager::computeCaptureDevices):
(WebCore::GStreamerDisplayCaptureDeviceManager::createDisplayCaptureSource):
(WebCore::GStreamerDisplayCaptureDeviceManager::stopSource):
(WebCore::GStreamerDisplayCaptureDeviceManager::waitResponseSignal):

• platform/mediastream/gstreamer/GStreamerVideoCaptureSource.cpp:

(WebCore::GStreamerVideoCaptureSource::createPipewireSource):
(WebCore::GStreamerVideoCaptureSource::factory):
(WebCore::GStreamerVideoCaptureSource::displayFactory):
(WebCore::GStreamerVideoCaptureSource::GStreamerVideoCaptureSource):
(WebCore::GStreamerVideoCaptureSource::stopProducingData):

• platform/mediastream/gstreamer/GStreamerVideoCaptureSource.h:
• platform/mediastream/gstreamer/GStreamerVideoCapturer.cpp:
• platform/mediastream/gstreamer/GStreamerVideoCapturer.h:

Source/WTF:

• Scripts/Preferences/WebPreferencesExperimental.yaml: Enable screen capture on GStreamer

ports. The PIPEWIRE ifdef is redundant.

3:11 AM Changeset in webkit [280238] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r276352 - Use BlobURL::getOriginURL in more places
​https://bugs.webkit.org/show_bug.cgi?id=224857

Reviewed by Alex Christensen.

Covered by existing tests.

• loader/PolicyChecker.cpp:

(WebCore::FrameLoader::PolicyChecker::extendBlobURLLifetimeIfNecessary const):

3:11 AM Changeset in webkit [280237] by Carlos Garcia Campos

• 4 edits
  3 adds in releases/WebKitGTK/webkit-2.32

Merge r276012 - REGRESSION(Safari 14): iframe with blob url does not work with sandboxing
​https://bugs.webkit.org/show_bug.cgi?id=222312
<rdar://problem/74927624>

Reviewed by Chris Dumez.

Source/WebCore:

In ​https://trac.webkit.org/r275884, we correctly compute whether a blob is to be considered secure or not.
For that, we need to have the blob URL registered with its document origin.
Update PolicyChecker to properly register the temporoary blob URL with its document origin.

Test: http/tests/security/sandbox-iframe-and-blob.https.html

• loader/PolicyChecker.cpp:

(WebCore::FrameLoader::PolicyChecker::extendBlobURLLifetimeIfNecessary const):

LayoutTests:

• http/tests/security/resources/sandbox-iframe-and-blob-frame.html: Added.
• http/tests/security/sandbox-iframe-and-blob.https-expected.txt: Added.
• http/tests/security/sandbox-iframe-and-blob.https.html: Added.
• platform/win/TestExpectations:

3:11 AM Changeset in webkit [280236] by Carlos Garcia Campos

• 11 edits in releases/WebKitGTK/webkit-2.32

Merge r276230 - Blob URLs should use for their owner origin for CSP checks
​https://bugs.webkit.org/show_bug.cgi?id=224535
<rdar://76458106>

Reviewed by Alex Christensen.

Source/WebCore:

Before the patch, we were checking blob origin directly with ancestors.
As per ​https://w3c.github.io/webappsec-csp/#match-url-to-source-expression step 4.1,
we need to get the URL origin, which by spec is the origin of the blob creator.
We only do this for navigation loads as script loads should be kept the current way, as a cross-site scripting protection,
and to remain compatible with other browsers.

Make some refactoring to add helper routines to get origin and secure context state of blob URLs in BlobURL.
Make use of it in MixedContentChecker as a refactoring.
Make use of the helper routine in ContentSecurityPolicySource::matches to fix the bug.

Test: http/tests/security/frame-src-and-blob-download.https.html

• fileapi/BlobURL.cpp:

(WebCore::blobOwner):
(WebCore::BlobURL::getOriginURL):
(WebCore::BlobURL::isSecureBlobURL):

• fileapi/BlobURL.h:
• fileapi/ThreadableBlobRegistry.cpp:

(WebCore::isBlobURLContainsNullOrigin):

• loader/MixedContentChecker.cpp:

(WebCore::MixedContentChecker::isMixedContent):

• page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::isSecure):

• page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::urlMatchesSelf const):

• page/csp/ContentSecurityPolicy.h:
• page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::matches const):

LayoutTests:

• http/tests/security/frame-src-and-blob-download.https-expected.txt: Added.
• http/tests/security/frame-src-and-blob-download.https.html:
• http/tests/security/resources/frame-src-and-blob-download-frame.html: Added.
• platform/mac-wk1/TestExpectations:
• platform/win/TestExpectations:

2:03 AM Changeset in webkit [280235] by Adrian Perez de Castro

• 3 edits
  1 add in releases/WebKitGTK/webkit-2.32

Merge r278819 - ​https://bugs.webkit.org/show_bug.cgi?id=226576
<rdar://problem/78810362>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/short-circuit-read-modify-write-cant-write-dst-before-tdz-check.js: Added.

(let.result.eval.try.captureV):
(catch):

Source/JavaScriptCore:

ShortCircuitReadModifyResolveNode can't emit a value into
its result until after it emits a TDZ check. We were temporarily
storing the result of the get_from_scope into the dst. Then
we'd emit the TDZ check. The TDZ check can throw, and it could
lead to us returning TDZ from the eval itself. Instead, we need
to use a temporary to emit a TDZ check on. Only after the TDZ check
passes can we move the temporary into the result.

• bytecompiler/NodesCodegen.cpp:

(JSC::ShortCircuitReadModifyResolveNode::emitBytecode):

2:03 AM Changeset in webkit [280234] by Adrian Perez de Castro

• 4 edits
  1 add in releases/WebKitGTK/webkit-2.32

Merge r278578 - Short circuit read modify write nodes emit byte code that uses the wrong locals
​https://bugs.webkit.org/show_bug.cgi?id=226576
<rdar://problem/78810362>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/short-circuit-read-modify-should-use-the-write-virtual-registers.js: Added.

(eval):

Source/JavaScriptCore:

It's never a good idea to use the wrong local :-)

This patch also adds support for dumping predecessors of basic blocks
in the bytecode dump.

• bytecode/BytecodeDumper.cpp:

(JSC::CodeBlockBytecodeDumper<Block>::dumpGraph):

• bytecompiler/NodesCodegen.cpp:

(JSC::ShortCircuitReadModifyResolveNode::emitBytecode):
(JSC::ShortCircuitReadModifyDotNode::emitBytecode):
(JSC::ShortCircuitReadModifyBracketNode::emitBytecode):

2:00 AM Changeset in webkit [280233] by Adrian Perez de Castro

• 19 edits in releases/WebKitGTK/webkit-2.32/Source/JavaScriptCore

Merge r276609 - numCalleeLocals, numParameters, and numVars should be unsigned
​https://bugs.webkit.org/show_bug.cgi?id=224995

Patch by Keith Miller <​keith_miller@apple.com> on 2021-04-26
Reviewed by Mark Lam.

All of the various CodeBlock classes currently have the
numCalleeLocals and numVars marked as ints. I believe this is just
a historical artifact or because VirtualRegister's offset is an
int to make handling constants easier. Regardless, it's a bit
strange to not handle the sign conversion at the point of
comparison between a VirtualRegister offset and the local/var
count. This doesn't completely fix every place we use ints for
these values but starts on the right track. Lastly, I also added
some Check<unsigned>s to the wasm parser for sanity checking.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::setNumParameters):
(JSC::CodeBlock::ensureCatchLivenessIsComputedForBytecodeIndexSlow):

• bytecode/CodeBlock.h:

(JSC::CodeBlock::numParameters const):
(JSC::CodeBlock::numberOfArgumentsToSkip const):
(JSC::CodeBlock::numCalleeLocals const):
(JSC::CodeBlock::numVars const):
(JSC::CodeBlock::numTmps const):
(JSC::CodeBlock::addressOfNumParameters):
(JSC::CodeBlock::isTemporaryRegister):

• bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::numCalleeLocals const):
(JSC::UnlinkedCodeBlock::numVars const):

• bytecode/UnlinkedCodeBlockGenerator.h:

(JSC::UnlinkedCodeBlockGenerator::numCalleeLocals const):
(JSC::UnlinkedCodeBlockGenerator::numVars const):
(JSC::UnlinkedCodeBlockGenerator::setNumCalleeLocals):
(JSC::UnlinkedCodeBlockGenerator::setNumVars):
(JSC::UnlinkedCodeBlockGenerator::setNumParameters):

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::generate):
(JSC::BytecodeGenerator::emitPushFunctionNameScope):

• bytecompiler/BytecodeGeneratorBaseInlines.h:

(JSC::BytecodeGeneratorBase<Traits>::newRegister):

• dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
(JSC::DFG::ByteCodeParser::inliningCost):
(JSC::DFG::ByteCodeParser::parseBlock):

• dfg/DFGOSREntrypointCreationPhase.cpp:

(JSC::DFG::OSREntrypointCreationPhase::run):

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::checkArgumentTypes):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

• ftl/FTLOSREntry.cpp:

(JSC::FTL::prepareOSREntry):

• interpreter/CallFrameClosure.h:
• interpreter/ProtoCallFrameInlines.h:

(JSC::ProtoCallFrame::init):

• jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):

• runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::numberOfStackPaddingSlots):
(JSC::CommonSlowPaths::numberOfStackPaddingSlotsWithExtraSlots):

• wasm/WasmFunctionCodeBlock.h:

(JSC::Wasm::FunctionCodeBlock::numVars const):
(JSC::Wasm::FunctionCodeBlock::numCalleeLocals const):
(JSC::Wasm::FunctionCodeBlock::setNumVars):
(JSC::Wasm::FunctionCodeBlock::setNumCalleeLocals):

• wasm/WasmLLIntGenerator.cpp:

(JSC::Wasm::LLIntGenerator::push):
(JSC::Wasm::LLIntGenerator::getDropKeepCount):
(JSC::Wasm::LLIntGenerator::walkExpressionStack):
(JSC::Wasm::LLIntGenerator::checkConsistency):
(JSC::Wasm::LLIntGenerator::materializeConstantsAndLocals):
(JSC::Wasm::LLIntGenerator::splitStack):
(JSC::Wasm::LLIntGenerator::finalize):
(JSC::Wasm::LLIntGenerator::callInformationForCaller):
(JSC::Wasm::LLIntGenerator::addLoop):
(JSC::Wasm::LLIntGenerator::addTopLevel):
(JSC::Wasm::LLIntGenerator::addBlock):
(JSC::Wasm::LLIntGenerator::addIf):
(JSC::Wasm::LLIntGenerator::addElseToUnreachable):

1:59 AM Changeset in webkit [280232] by Carlos Garcia Campos

• 5 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r278964 - Protect Element before calling dispatchMouseEvent() on it
​https://bugs.webkit.org/show_bug.cgi?id=226767
<rdar://problem/79009112>

Reviewed by Ryosuke Niwa.

• page/EventHandler.cpp:

(WebCore::EventHandler::updateMouseEventTargetNode):
(WebCore::EventHandler::dispatchMouseEvent):

• page/PointerLockController.cpp:

(WebCore::PointerLockController::dispatchLockedMouseEvent):

• page/Quirks.cpp:

(WebCore::Quirks::triggerOptionalStorageAccessQuirk const):

1:48 AM Changeset in webkit [280231] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r278166 - Pass frame ref during navigationPolicyCompletionHandler
​https://bugs.webkit.org/show_bug.cgi?id=226268
<rdar://problem/78512383>

Reviewed by Ryosuke Niwa.

Pass the active frame to the navigationPolicyCompletionHandler lambda as a Ref to
ensure it is kept alive during the policy check and subsequent steps.

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::willSendRequest):

1:47 AM Changeset in webkit [280230] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r276611 - Remove redundant frameDetached() from the SVGImage destructor
​https://bugs.webkit.org/show_bug.cgi?id=221616
<rdar://problem/74149106>

Reviewed by Chris Dumez.

SVGImage was originally written such that it has two separate objects:
a page and a frame; see ​https://trac.webkit.org/r18470. So it made sense
at that time to clean up the page and the frame separately. The Frame
was cleaned up by telling the frame's loader that the frameDetached().

This code is not necessary right now since the page owns the main frame.
And its destructor recursively detaches itself from all the frames.

• svg/graphics/SVGImage.cpp:

(WebCore::SVGImage::~SVGImage):

1:29 AM Changeset in webkit [280229] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r276206 - Perform port blocking earlier in the load
​https://bugs.webkit.org/show_bug.cgi?id=224525
<rdar://problem/75440591>

Unreviewed follow-up (suggested by David Kilzer)

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::willSendRequest): Restore an m_frame nullptr check.,

1:29 AM Changeset in webkit [280228] by Carlos Garcia Campos

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.32/LayoutTests

Merge r276289 - [GTK][WPE] Unreviewed test gardening. Emit new port baselines after r276193.

• platform/gtk/TestExpectations:
• platform/gtk/security/block-test-expected.txt: Added.
• platform/wpe/security/block-test-expected.txt:

1:29 AM Changeset in webkit [280227] by Carlos Garcia Campos

• 2 edits
  2 adds in releases/WebKitGTK/webkit-2.32/LayoutTests

Merge r276215 - [GLIB] Unreviewed test gardening. Emit new baseline after r276193.

• platform/glib/TestExpectations:
• platform/glib/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt: Added.

1:29 AM Changeset in webkit [280226] by Carlos Garcia Campos

• 29 edits
  4 copies
  2 adds in releases/WebKitGTK/webkit-2.32

Merge r276193 - Perform port blocking earlier in the load
​https://bugs.webkit.org/show_bug.cgi?id=224525
<rdar://problem/75440591>

Reviewed by Darin Adler.

Source/WebCore:

WebKit blocks loads to URLs with any of the prohibited ports defined in
the engine. This blocking happens late in the load process, allowing
connections to be made (and observed). Instead, we should stop the load
early, at the same time we perform other checks.

Test: http/tests/security/form-blocked-port.html

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::isSafeToLoadURL): Add a check for prohibited ports,
and block (with relevant logging) if a load to a denied port is attempted.

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::willSendRequest): Ditto.

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadFrameRequest): Ditto.
(WebCore::FrameLoader::reportBlockedLoadFailed): Ditto.

• loader/FrameLoader.h:
• loader/PingLoader.cpp:

(WebCore::PingLoader::loadImage): Ditto.

• loader/ResourceLoader.cpp:

(WebCore::ResourceLoader::init): Ditto.

• loader/SubframeLoader.cpp:

(WebCore::FrameLoader::SubframeLoader::pluginIsLoadable): Ditto.
(WebCore::FrameLoader::SubframeLoader::loadSubframe): Ditto.

• loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::canRequest): Ditto.
(WebCore::CachedResourceLoader::canRequestAfterRedirection const): Ditto.

Tools:

Update URLScheme test to use a non-prohibited port for the test. Tests of
failed fetches are already handled in WPT and other tests, so using a valid
port here should continue to be a valid test.

• TestWebKitAPI/Tests/WebKitCocoa/WKURLSchemeHandler-1.mm:

(-[FrameSchemeHandler webView:startURLSchemeTask:]): Use allowed port or the test
instead of 123.

LayoutTests:

WebKit blocks loads to URLs with any of the prohibited ports defined in
the engine. This blocking happens late in the load process, allowing
connections to be made (and observed). Instead, we should stop the load
early, at the same time we perform other checks.

Note: The fact that we now block loads earlier means that we do not fire
'willSendRequestForFrame' for blocked ports, so WebKitTestRunner no longer
outputs a message to stdout. Those errors are reported in the JS console,
but since some test paths are specified to always output JS console messages
to stderrr (for example the WPT tests), we have to revise out test expectations
for a few cases.

• fast/loader/cancel-load-during-port-block-timer.html: Revised expectation to reflect new console error message.
• http/tests/cache/cancel-during-failure-crash-expected.txt: Ditto.
• http/tests/preload/download_resources_from_invalid_headers-expected.txt: Update to reflect a preflight is not executed for a blocked port.
• http/tests/preload/resources/nph-invalid_resources_from_header.pl: Update to reflect that we do not preload from restricted ports.
• http/tests/security/blocked-on-redirect-expected.txt: Revised expectation to match revised error message.
• http/tests/security/form-blocked-port.html: Added.
• http/tests/security/form-blocked-port-expected.txt: Added.
• http/tests/xmlhttprequest/cross-origin-redirect-responseURL-expected.txt: Revised expectation for revised error message.
• http/tests/xmlhttprequest/redirect-cross-origin-2-expected.txt: Ditto.
• http/tests/xmlhttprequest/redirect-cross-origin-expected.txt: Ditto.
• http/tests/xmlhttprequest/simple-cross-origin-denied-events.html: Instead of using a port WebKit blocks (7), use one that is not blocked but is unlikely to be active (as originally intended). This retains the expected test behavior since we now block loads to restricted ports earlier in the load process.
• http/tests/xmlhttprequest/simple-cross-origin-denied-events-post.html: Ditto.
• http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt: Update test output to reflect that we are attempting to load from port 8 instead of port 7.
• http/wpt/beacon/beacon-async-error-logging-expected.txt: Ditto.
• http/wpt/beacon/beacon-async-error-logging.html: Update to reflect a preflight is not executed for a blocked port.
• imported/w3c/web-platform-tests/fetch/api/request/request-bad-port.any-expected.txt: Since we block before executing the load, TestRunner no longer outputs an error message to stdout. Instead, they appear in stderr (since all 'wpt' tests are marked to dump console.log output to stderr).
• imported/w3c/web-platform-tests/fetch/api/request/request-bad-port.any.worker-expected.txt: Ditto.
• platform/mac-wk1/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt: Revise to reflect change in console logging (the functional test results are identical).
• platform/mac-wk1/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt: Ditto.
• platform/win/http/tests/xmlhttprequest/redirect-cross-origin-post-expected.txt: Ditto.
• platform/win/http/tests/xmlhttprequest/simple-cross-origin-denied-events-post-expected.txt: Ditto.
• platform/wk2/http/tests/security/blocked-on-redirect-expected.txt: Ditto.

1:29 AM Changeset in webkit [280225] by Carlos Garcia Campos

• 9 edits in releases/WebKitGTK/webkit-2.32

Merge r275831 - Block loading for port 10080
​https://bugs.webkit.org/show_bug.cgi?id=224432

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

• web-platform-tests/fetch/api/request/request-bad-port.any-expected.txt:
• web-platform-tests/fetch/api/request/request-bad-port.any.js:
• web-platform-tests/fetch/api/request/request-bad-port.any.worker-expected.txt:
• web-platform-tests/websockets/Create-blocked-port.any-expected.txt:
• web-platform-tests/websockets/Create-blocked-port.any.js:
• web-platform-tests/websockets/Create-blocked-port.any.worker-expected.txt:

Source/WTF:

Follow Chrome and Firefox by blocking port 10080.

• wtf/URL.cpp:

(WTF::portAllowed):

1:17 AM Changeset in webkit [280224] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/JavaScriptCore

Merge r276527 - [YARR Interpreter] Improper backtrack of parentheses with non-zero based greedy quantifiers
​https://bugs.webkit.org/show_bug.cgi?id=224983

Reviewed by Mark Lam.

When we backtrack a parentheses with a greedy non zero based quantifier,
we don't properly restore for the case where we hadn't reached the minimum count.
We now save the input position on entry and restore it when we backtrack for
this case. We also properly release the allocated ParenthesesDisjunctionContext's.

• yarr/YarrInterpreter.cpp:

(JSC::Yarr::Interpreter::matchParentheses):
(JSC::Yarr::Interpreter::backtrackParentheses):

1:14 AM Changeset in webkit [280223] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/JavaScriptCore

Merge r276524 - Fix B3 strength reduction for shl.
​https://bugs.webkit.org/show_bug.cgi?id=224913
rdar://76978874

Reviewed by Michael Saboff.

If the operation can potentially either underflow or overflow, then the result
can be any value.

• b3/B3ReduceStrength.cpp:

1:08 AM Changeset in webkit [280222] by Carlos Garcia Campos

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r273752 - Crash under KeyframeEffect::setTarget()
​https://bugs.webkit.org/show_bug.cgi?id=222591
<rdar://problem/74281295>

Reviewed by David Kilzer.

The Styleable returned by targetStyleable() holds a reference to the Element that at
this point is m_target (assuming it's non-null). However, once we set the new value
for m_target, if the only reference to the original target was held by this KeyframeEffect,
then that element will be deallocated and by the time we call didChangeTargetStyleable()
it will be gone.

To address, we create a RefPtr<Element> in the scope of KeyframeEffect::setTarget()
protecting the Styleable's element while didChangeTargetStyleable() is called.

• animation/KeyframeEffect.cpp:

(WebCore::KeyframeEffect::setTarget):

1:03 AM Changeset in webkit [280221] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebCore/platform/gtk/po

Updated Swedish translation
​https://bugs.webkit.org/show_bug.cgi?id=228206

Patch by Anders Jonsson <​anders.jonsson@norsjovallen.se> on 2021-07-23
Rubber-stamped by Carlos Garcia Campos.

• sv.po:

1:01 AM Changeset in webkit [280220] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebCore/platform/gtk/po

[GTK] [l10n] Updated Ukrainian translation of WebKitGTK+
​https://bugs.webkit.org/show_bug.cgi?id=228188

Patch by Yuri Chornoivan <​yurchor@ukr.net> on 2021-07-23
Rubber-stamped by Carlos Garcia Campos.

• uk.po:

12:59 AM Changeset in webkit [280219] by Carlos Garcia Campos

• 2 edits in trunk/Source/WebCore/platform/gtk/po

[l10n] [pt_BR] Updated Brazilian Portuguese translation
​https://bugs.webkit.org/show_bug.cgi?id=227623

Patch by Rafael Fontenelle <​rafaelff@gnome.org> on 2021-07-23
Rubber-stamped by Carlos Garcia Campos.

• pt_BR.po:

12:30 AM Changeset in webkit [280218] by commit-queue@webkit.org

• 2 edits in trunk/LayoutTests

Removed incorrect test from webgl tests.
​https://bugs.webkit.org/show_bug.cgi?id=220720

Patch by Eleni Maria Stea <hikiko> on 2021-07-23
Reviewed by Kenneth Russell.

The removed test was based on the incorrect assumption that
deleted buffer names remain valid until the object they used to
refer to is destroyed. According to the WebGL spec:
​https://www.khronos.org/registry/webgl/specs/1.0.3/ section:
5.14.5 isBuffer "Return false if the buffer's invalidated flag
is set", this is not true and names become invalid immediately.

• fast/canvas/webgl/oes-vertex-array-object.html: