Timeline

Aug 11, 2021:

9:35 PM Changeset in webkit [280957] by Peng Liu

• 7 edits in trunk/Source

Function _os_feature_enabled_impl() expects compile-time static strings as arguments
​https://bugs.webkit.org/show_bug.cgi?id=229017
<rdar://81813732>

Reviewed by Tim Horton.

There are multiple issues in the current implementation of isFeatureFlagEnabled().

1. _os_feature_enabled_impl() expects compile-time static strings as arguments.

So we should not use String here.

2. As Simon Fraser pointed out, String::characters8() is not null terminated.

Source/WebKit:

• Shared/Cocoa/WebPreferencesDefaultValuesCocoa.mm:

(WebKit::isFeatureFlagEnabled):

• Shared/WebPreferencesDefaultValues.cpp:

(WebKit::isFeatureFlagEnabled):

• Shared/WebPreferencesDefaultValues.h:

Source/WebKitLegacy/mac:

• WebView/WebPreferencesDefaultValues.h:
• WebView/WebPreferencesDefaultValues.mm:

(WebKit::isFeatureFlagEnabled):

9:29 PM Changeset in webkit [280956] by achristensen@apple.com

• 2 edits in trunk/Source/WebCore

Remove optimistic assertion added in r280931
​https://bugs.webkit.org/show_bug.cgi?id=229008

• page/PerformanceTiming.cpp:

(WebCore::PerformanceTiming::fetchStart const):
This assertion is hit in the test fast/dom/Window/property-access-on-cached-window-after-frame-removed.html
when accessing window.performance.fetchStart from a detached window object from a frame that has been removed from the DOM.

8:48 PM Changeset in webkit [280955] by Jean-Yves Avenard

• 2 edits in trunk/Source/WebKit

[Monterey] WebContent process immediately crash when GPU Process is disabled
​https://bugs.webkit.org/show_bug.cgi?id=228944
rdar://81727094

Reviewed by Brent Fulgham.

• WebProcess/com.apple.WebProcess.sb.in: Allow SYS_getpriority syscall.

7:47 PM Changeset in webkit [280954] by Lauro Moura

• 3 edits in trunk/LayoutTests

[GLIB] Gardening a few failures and passes

Unreviewed test gardening.

• platform/glib/TestExpectations:
• platform/wpe/TestExpectations:

7:43 PM Changeset in webkit [280953] by Chris Dumez

• 91 edits
  4 adds
  2 deletes in trunk

Add initial support for Cross-Origin-Embedder-Policy (COEP)
​https://bugs.webkit.org/show_bug.cgi?id=228754

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline COEP WPT tests now that we are passing more checks.

• web-platform-tests/html/cross-origin-embedder-policy/blob.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/coep-frame-javascript.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/coep-on-response-from-service-worker.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.tentative.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/cross-origin-isolated-permission.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/data.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/dedicated-worker-cache-storage.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/dedicated-worker.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/header-parsing.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/javascript.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/multi-globals/workers-coep-report.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/no-secure-context-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/none-sw-from-require-corp.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/none.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/reporting-to-endpoint.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/require-corp-about-blank-expected.txt: Removed.
• web-platform-tests/html/cross-origin-embedder-policy/require-corp-about-blank.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/require-corp-about-srcdoc-expected.txt: Removed.
• web-platform-tests/html/cross-origin-embedder-policy/require-corp-about-srcdoc.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/require-corp-load-from-cache-storage.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-none.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-require-corp.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/require-corp.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/sandbox.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/service-worker-cache-storage.https-expected.txt:
• web-platform-tests/html/cross-origin-embedder-policy/srcdoc.https-expected.txt:

Source/WebCore:

Add initial support for Cross-Origin-Embedder-Policy (COEP) behind a runtime feature flag, off by default:

• ​https://html.spec.whatwg.org/multipage/origin.html#coep

The COEP header has the following impacts:

• When a document with Cross-Origin-Embedder-Policy: require-corp loads an iframe or a worker script, if the network response for that iframe doesn't also contain Cross-Origin-Embedder-Policy: require-corp, then we fail the load.
• When a document with Cross-Origin-Embedder-Policy: require-corp loads cross-origin subresources, then either CORS must be used or the resource response must be allowed by Cross-Origin-Resource-Policy (CORP) header.

Support is only for WK2 and checks are done in the network process for better security. Support for workers and service
workers (including cache storage) is included.

Most of the Web-Platform-Tests for COEP are passing with this patch. The exceptions are:

• Some tests relying on Blob are failing. Similarly to COOP, Blobs need to inherit COEP from their creator. This is currently unimplemented as the change will likely be non-trivial. I will follow-up to fix Blob support for both COOP and COEP.
• Tests in the credentialless/ folder are failing because we do not support Cross-Origin-Embedder-Policy: credentialless. This seems to be a fairly recent extension proposed by Google and it is not part of the HTML specification yet.
• Some tests expect violation reporting and they are failing and we do not implement reporting yet.

Note that self.crossOriginIsolated still returns false, even if the pages opts into both COOP & COEP, and APIs such
as SharedArrayBuffer still are not permitted to use. In order to support this, we will have to actually implement process
swapping so that we know a process is not actually shared by several origins.

Test: http/wpt/html/cross-origin-embedder-policy/require-corp.https.html

• Modules/cache/DOMCache.cpp:

(WebCore::DOMCache::queryCache):

• Modules/cache/DOMCacheEngine.cpp:

(WebCore::DOMCacheEngine::convertToException):

• Modules/cache/DOMCacheEngine.h:
• Modules/cache/RetrieveRecordsOptions.h:

(WebCore::RetrieveRecordsOptions::isolatedCopy const):
(WebCore::RetrieveRecordsOptions::encode const):
(WebCore::RetrieveRecordsOptions::decode):

• dom/Document.cpp:

(WebCore::Document::initSecurityContext):

• dom/SecurityContext.h:

(WebCore::SecurityContext::crossOriginEmbedderPolicy const):
(WebCore::SecurityContext::setCrossOriginEmbedderPolicy):

• loader/CrossOriginAccessControl.cpp:

(WebCore::shouldCrossOriginResourcePolicyCancelLoad):
(WebCore::validateCrossOriginResourcePolicy):

• loader/CrossOriginAccessControl.h:
• loader/CrossOriginEmbedderPolicy.cpp:

(WebCore::obtainCrossOriginEmbedderPolicy):
(WebCore::CrossOriginEmbedderPolicy::isolatedCopy const):

• loader/CrossOriginEmbedderPolicy.h:

(WebCore::CrossOriginEmbedderPolicy::encode const):
(WebCore::CrossOriginEmbedderPolicy::decode):

• loader/CrossOriginOpenerPolicy.cpp:

(WebCore::obtainCrossOriginOpenerPolicy):

• loader/DocumentThreadableLoader.cpp:

(WebCore::DocumentThreadableLoader::loadResourceSynchronously):
(WebCore::DocumentThreadableLoader::create):
(WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
(WebCore::DocumentThreadableLoader::crossOriginEmbedderPolicy const):

• loader/DocumentThreadableLoader.h:
• loader/DocumentWriter.cpp:

(WebCore::DocumentWriter::begin):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::didBeginDocument):

• loader/ResourceLoaderOptions.h:
• loader/WorkerThreadableLoader.cpp:

(WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):

• loader/cache/CachedResourceLoader.cpp:

(WebCore::CachedResourceLoader::requestResource):

• page/SecurityOrigin.h:
• platform/network/HTTPParsers.cpp:

(WebCore::parseCrossOriginResourcePolicyHeader):

• platform/network/HTTPParsers.h:
• workers/Worker.cpp:

(WebCore::Worker::notifyFinished):

• workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::WorkerGlobalScope):

• workers/WorkerGlobalScopeProxy.h:
• workers/WorkerMessagingProxy.cpp:

(WebCore::WorkerMessagingProxy::startWorkerGlobalScope):

• workers/WorkerMessagingProxy.h:
• workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadSynchronously):
(WebCore::WorkerScriptLoader::loadAsynchronously):
(WebCore::WorkerScriptLoader::didReceiveResponse):

• workers/WorkerScriptLoader.h:

(WebCore::WorkerScriptLoader::crossOriginEmbedderPolicy const):

• workers/WorkerThread.cpp:

(WebCore::WorkerParameters::isolatedCopy const):

• workers/WorkerThread.h:
• workers/service/ServiceWorkerContainer.cpp:

(WebCore::ServiceWorkerContainer::jobFinishedLoadingScript):

• workers/service/ServiceWorkerContainer.h:
• workers/service/ServiceWorkerContextData.cpp:

(WebCore::ServiceWorkerContextData::isolatedCopy const):

• workers/service/ServiceWorkerContextData.h:

(WebCore::ServiceWorkerContextData::encode const):
(WebCore::ServiceWorkerContextData::decode):

• workers/service/ServiceWorkerFetchResult.h:

(WebCore::ServiceWorkerFetchResult::isolatedCopy const):
(WebCore::serviceWorkerFetchError):
(WebCore::ServiceWorkerFetchResult::encode const):
(WebCore::ServiceWorkerFetchResult::decode):

• workers/service/ServiceWorkerJob.cpp:

(WebCore::ServiceWorkerJob::notifyFinished):

• workers/service/ServiceWorkerJobClient.h:
• workers/service/context/ServiceWorkerThread.cpp:

(WebCore::ServiceWorkerThread::ServiceWorkerThread):

• workers/service/server/RegistrationDatabase.cpp:

(WebCore::RegistrationDatabase::doPushChanges):
(WebCore::RegistrationDatabase::importRecords):

• workers/service/server/SWServer.cpp:

(WebCore::SWServer::addRegistrationFromStore):
(WebCore::SWServer::updateWorker):
(WebCore::SWServer::installContextData):

• workers/service/server/SWServer.h:
• workers/service/server/SWServerJobQueue.cpp:

(WebCore::SWServerJobQueue::scriptFetchFinished):

• workers/service/server/SWServerWorker.cpp:

(WebCore::SWServerWorker::SWServerWorker):
(WebCore::SWServerWorker::contextData const):

• workers/service/server/SWServerWorker.h:

Source/WebKit:

As mentioned in the WebCore changelog, we do all the COEP checks in the network process
instead of WebCore for added security. As a result, we need to pass more information
to the network process when doing loads in order to do those checks. The checks are done
in NetworkResourceLoader for navigations & worker script loads (similarly to CSP,
X-FrameOptions) and in NetworkLoadChecker for CORP checks of subresource loads (similarly
to CORS checks).

• NetworkProcess/NetworkLoadChecker.cpp:

(WebKit::NetworkLoadChecker::NetworkLoadChecker):
(WebKit::NetworkLoadChecker::validateResponse):

• NetworkProcess/NetworkLoadChecker.h:

(WebKit::NetworkLoadChecker::setParentCrossOriginEmbedderPolicy):
(WebKit::NetworkLoadChecker::setCrossOriginEmbedderPolicy):

• NetworkProcess/NetworkResourceLoadParameters.cpp:

(WebKit::NetworkResourceLoadParameters::parentOrigin const):
(WebKit::NetworkResourceLoadParameters::encode const):
(WebKit::NetworkResourceLoadParameters::decode):

• NetworkProcess/NetworkResourceLoadParameters.h:
• NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::shouldInterruptLoadForCSPFrameAncestorsOrXFrameOptions):
(WebKit::NetworkResourceLoader::shouldInterruptNavigationForCrossOriginEmbedderPolicy):
(WebKit::NetworkResourceLoader::shouldInterruptWorkerLoadForCrossOriginEmbedderPolicy):
(WebKit::NetworkResourceLoader::didReceiveResponse):
(WebKit::NetworkResourceLoader::willSendRedirectedRequest):

• NetworkProcess/NetworkResourceLoader.h:
• NetworkProcess/PingLoad.cpp:

(WebKit::PingLoad::PingLoad):
(WebKit::PingLoad::initialize):

• NetworkProcess/ServiceWorker/ServiceWorkerFetchTask.cpp:

(WebKit::ServiceWorkerFetchTask::didReceiveResponse):

• NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.cpp:

(WebKit::ServiceWorkerSoftUpdateLoader::processResponse):
(WebKit::ServiceWorkerSoftUpdateLoader::didFinishLoading):

• NetworkProcess/ServiceWorker/ServiceWorkerSoftUpdateLoader.h:
• NetworkProcess/cache/CacheStorageEngineCache.cpp:

(WebKit::CacheStorage::Cache::retrieveRecords):

• WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::addParametersShared):
(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):

Source/WTF:

Add experimental feature flag for Cross-Origin-Embedder-Policy (COEP), off by default.

• Scripts/Preferences/WebPreferencesExperimental.yaml:

LayoutTests:

Update test expectations now that we support COEP on WK2.

• TestExpectations:
• http/wpt/html/cross-origin-embedder-policy/require-corp.https-expected.txt: Added.
• http/wpt/html/cross-origin-embedder-policy/require-corp.https.html: Added.
• http/wpt/html/cross-origin-embedder-policy/require-corp.https.html.headers: Added.
• platform/mac-wk1/TestExpectations:
• platform/win/TestExpectations:

7:08 PM Changeset in webkit [280952] by Darin Adler

• 4 edits in trunk/Source

Add deduction guide to RetainPtr, use constexpr a bit more, and streamline the implementation
​https://bugs.webkit.org/show_bug.cgi?id=228852

Reviewed by Sam Weinig.

Source/WebKit:

• UIProcess/mac/WKTextFinderClient.mm:

(-[WKTextFinderClient findMatchesForString:relativeToMatch:findOptions:maxResults:resultCollector:]):
Test the deduction guide by writing RetainPtr instead of RetainPtr<NSProgress>.

Source/WTF:

• wtf/RetainPtr.h: Sort includes. Made many functions constexpr including the move

constructors and adoptCF. Use using instead of typedef in most places. Use
remove_pointer_t, conditional_t, is_convertible_v, is_same_v, and other such templates
to simplify expressions. Initialize the m_ptr data member and use the default constructor.
Removed unneeded StorageType synonym for CFTypeRef. Move some inline function bodies out
of the class template definition. Use if constexpr to get rid of the need for the overloaded
autoreleaseHelper function. Added a deduction guide so we can use expressions with the
type RetainPtr on the left side, and an Objective-C pointer or CFTypeRef on the right side,
and have the appropriate RetainPtr type deduced.

6:11 PM Changeset in webkit [280951] by Peng Liu

• 5 edits in trunk

[ BigSur Debug ] TestWebKitAPI.GPUProcess.CrashWhilePlayingAudioViaCreateMediaElementSource is flaky, hitting ASSERTION FAILED: !isInRoutingArbitrationForToken(token)
​https://bugs.webkit.org/show_bug.cgi?id=227728
<rdar://problem/80237464>

Reviewed by Jer Noble.

Source/WebKit:

After the GPU process crashes, the UI process will clean up the
SharedRoutingArbitrator, while a WebContent process might be resuming
the media playback and setup AudioSessionRoutingArbitrator.
There is a race condition here. If the WebContent process runs faster,
SharedRoutingArbitrator in the UI process will try to begin a duplicated
routing arbitration and lead to an assertion failure.

No new tests. Fixed following two API test failures:

• TestWebKitAPI.WebKit2.CrashGPUProcessWhileCapturing
• TestWebKitAPI.GPUProcess.CrashWhilePlayingAudioViaCreateMediaElementSource

• UIProcess/Media/cocoa/AudioSessionRoutingArbitratorProxyCocoa.mm:

(WebKit::AudioSessionRoutingArbitratorProxy::processDidTerminate):

• WebProcess/GPU/GPUProcessConnection.cpp:

(WebKit::GPUProcessConnection::didClose):

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/GPUProcess.mm:

(TEST):

6:00 PM Changeset in webkit [280950] by Alan Coon

• 1 copy in tags/Safari-612.1.27.0.7

Tag Safari-612.1.27.0.7.

5:58 PM Changeset in webkit [280949] by Alan Coon

• 1 copy in tags/Safari-612.1.26.1.5

Tag Safari-612.1.26.1.5.

5:46 PM Changeset in webkit [280948] by Jean-Yves Avenard

• 4 edits
  3 adds in trunk

Audio buffer may contain more frames than decoded.
​https://bugs.webkit.org/show_bug.cgi?id=228732
rdar://problem/81447014

Reviewed by Eric Carlson.

Source/WebCore:

It is necessary to call repeatedly ExtAudioFileRead until it explicitly indicates that
it reached EOF.
Test: webaudio/decode-audio-data-wav.html.

• platform/audio/cocoa/AudioFileReaderCocoa.cpp:

(WebCore::AudioFileReader::createBus): Ensure that all frames have been decoded and
trim length to the actual number of frames returned.
This was already done for the webm case.

LayoutTests:

• platform/mac/TestExpectations:
• webaudio/decode-audio-data-wav-expected.txt: Added.
• webaudio/decode-audio-data-wav.html: Added.
• webaudio/pinknoise.wav: Added. Generated with command

sox -b 16 -r 44100 -n pinknoise.wav synth 4 pinknoise

5:45 PM Changeset in webkit [280947] by Alan Coon

• 8 edits in branches/safari-612.1.26.1-branch/Source

Versioning.

WebKit-7612.1.26.1.5

5:39 PM Changeset in webkit [280946] by Alan Coon

• 1 copy in tags/Safari-612.1.27.0.20

Tag Safari-612.1.27.0.20.

5:35 PM Changeset in webkit [280945] by Alan Coon

• 1 copy in tags/Safari-612.1.27.2.2

Tag Safari-612.1.27.2.2.

5:32 PM Changeset in webkit [280944] by Alan Coon

• 1 copy in tags/Safari-612.1.27.3.3

Tag Safari-612.1.27.3.3.

5:30 PM Changeset in webkit [280943] by Alan Coon

• 9 edits in branches/safari-612.1.27.3-branch

Cherry-pick r280922. rdar://problem/81804209

Apply patch. rdar://problem/81804209

git-svn-id: ​https://svn.webkit.org/repository/webkit/branches/safari-612.1.27.0-branch@280922 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:27 PM Changeset in webkit [280942] by Alan Coon

• 9 edits in branches/safari-612.1.27.2-branch

Cherry-pick r280922. rdar://problem/81804209

Apply patch. rdar://problem/81804209

git-svn-id: ​https://svn.webkit.org/repository/webkit/branches/safari-612.1.27.0-branch@280922 268f45cc-cd09-0410-ab3c-d52691b4dbfc

5:24 PM Changeset in webkit [280941] by Alan Coon

• 8 edits in branches/safari-612.1.27.2-branch/Source

Versioning.

WebKit-7612.1.27.2.2

5:16 PM Changeset in webkit [280940] by Alan Coon

• 8 edits in branches/safari-612.1.27.3-branch/Source

Versioning.

WebKit-7612.1.27.3.3

5:07 PM Changeset in webkit [280939] by Alan Coon

• 8 edits in branches/safari-612.1.27.0.6-branch/Source

Versioning.

WebKit-7612.1.27.0.7

4:57 PM Changeset in webkit [280938] by Eric Hutchison

• 2 edits in trunk/LayoutTests

[BigSur wk2] webgl/2.0.0/conformance2/textures/image_bitmap_from_video/tex-2d-rgb565-rgb-unsigned_short_5_6_5.html.
​https://bugs.webkit.org/show_bug.cgi?id=229015.

Unreviewed test gardening.

• platform/mac-wk2/TestExpectations:

4:51 PM Changeset in webkit [280937] by Wenson Hsieh

• 4 edits in trunk/LayoutTests

[ iOS ] fast/scrolling/ios/click-events-during-momentum-scroll-in-overflow-after-tap-on-body.html is a flaky timeout
​https://bugs.webkit.org/show_bug.cgi?id=228672
rdar://81348960

Reviewed by Simon Fraser.

On rare occasion, this test times out when the synthesized swipe gesture fails to cause the scrollable overflow
container to scroll past an arbitrary scroll position threshold (previously 400px). Mitigate this by rewriting
the test, such that we'll swipe _until_ we scroll past the threshold (which has also been lowered to just
100px).

Additionally, rewrite parts of this test to be generally easier to follow; for example, remove the scroll event
listener and instead just synthesize swipe gestures until scroller.scrollTop crosses 100px.

• fast/scrolling/ios/click-events-during-momentum-scroll-in-overflow-after-tap-on-body-expected.txt:
• fast/scrolling/ios/click-events-during-momentum-scroll-in-overflow-after-tap-on-body.html:
• platform/ios-wk2/TestExpectations: Remove the failing test expectation.

3:54 PM Changeset in webkit [280936] by Peng Liu

• 6 edits in trunk/Source/WebKit

[BigSur] TestWebKitAPI.AudioRoutingArbitration.Updating fails after r280726
​https://bugs.webkit.org/show_bug.cgi?id=228966

Reviewed by Eric Carlson.

Add an IPC message RemoteAudioSessionProxy::SetIsPlayingToBluetoothOverride
for testing purpose, so that the test AudioRoutingArbitration.Updating will
work as expected when "Media in GPU Process" is enabled.

No new tests. Fix an API test failure.

• GPUProcess/media/RemoteAudioSessionProxy.cpp:

(WebKit::RemoteAudioSessionProxy::setCategory):
(WebKit::RemoteAudioSessionProxy::setIsPlayingToBluetoothOverride):

• GPUProcess/media/RemoteAudioSessionProxy.h:
• GPUProcess/media/RemoteAudioSessionProxy.messages.in:
• WebProcess/GPU/media/RemoteAudioSession.cpp:

(WebKit::RemoteAudioSession::setCategory):
(WebKit::RemoteAudioSession::setIsPlayingToBluetoothOverride):

• WebProcess/GPU/media/RemoteAudioSession.h:

3:33 PM Changeset in webkit [280935] by ddkilzer@apple.com

• 5 edits in trunk/Source/WebKit

ThreadSanitizer: data race in WTF::StringImpl::deref() under WebKit::NetworkCache::IOChannel::~IOChannel()
<​https://webkit.org/b/229003>
<rdar://problem/81795626>

Reviewed by Chris Dumez.

Covered by 3245 layout tests running with TSan including:

http/wpt/service-workers/file-upload.html

• NetworkProcess/cache/NetworkCacheIOChannel.h:

(WebKit::NetworkCache::IOChannel::open):

• Update to use #pragma once.
• Make an isolatedCopy() for m_path.

(WebKit::NetworkCache::IOChannel::IOChannel):

• Switch to using an rvalue reference.
• NetworkProcess/cache/NetworkCacheIOChannelCocoa.mm:

(WebKit::NetworkCache::IOChannel::IOChannel): Ditto.

• NetworkProcess/cache/NetworkCacheIOChannelCurl.cpp:

(WebKit::NetworkCache::IOChannel::IOChannel): Ditto.

• NetworkProcess/cache/NetworkCacheIOChannelGLib.cpp:

(WebKit::NetworkCache::IOChannel::IOChannel): Ditto.

• Switch to use m_path instead of filePath to prevent use-after-move.

3:25 PM Changeset in webkit [280934] by sihui_liu@apple.com

• 28 edits
  2 adds in trunk/Source

Suspend WorkQueue of ResourceLoadStatistics and LocalStorage sooner
​https://bugs.webkit.org/show_bug.cgi?id=228748
<rdar://problem/81626714>

Reviewed by Chris Dumez.

Source/WebKit:

When suspending ResourceLoadStatistics and LocalStorage, we dispatched a suspend task, which waits on a
condition, to their WorkQueue. That means the queue will be suspended after completing all tasks scheduled
before the suspend task. These tasks may take a long time to complete and assertion may be timed out.

When network process receives PrepareToSuspend message, we want the queues to suspend as soon as possible. To
achieve that, now we check if the queue needs to be suspended before each task, which ensures the queue
execute as most one task after suspend().

• NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.cpp:

(WebKit::ResourceLoadStatisticsDatabaseStore::ResourceLoadStatisticsDatabaseStore):

• NetworkProcess/Classifier/ResourceLoadStatisticsDatabaseStore.h:
• NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.cpp:

(WebKit::ResourceLoadStatisticsMemoryStore::ResourceLoadStatisticsMemoryStore):

• NetworkProcess/Classifier/ResourceLoadStatisticsMemoryStore.h:
• NetworkProcess/Classifier/ResourceLoadStatisticsStore.cpp:

(WebKit::ResourceLoadStatisticsStore::ResourceLoadStatisticsStore):

• NetworkProcess/Classifier/ResourceLoadStatisticsStore.h:

(WebKit::ResourceLoadStatisticsStore::workQueue):

• NetworkProcess/Classifier/WebResourceLoadStatisticsStore.cpp:

(WebKit::sharedStatisticsQueue):
(WebKit::WebResourceLoadStatisticsStore::suspend):
(WebKit::WebResourceLoadStatisticsStore::resume):
(WebKit::WTF_GUARDED_BY_LOCK): Deleted.

• NetworkProcess/Classifier/WebResourceLoadStatisticsStore.h:
• NetworkProcess/WebStorage/LocalStorageDatabase.cpp:

(WebKit::LocalStorageDatabase::create):
(WebKit::LocalStorageDatabase::LocalStorageDatabase):

• NetworkProcess/WebStorage/LocalStorageDatabase.h:
• NetworkProcess/WebStorage/LocalStorageNamespace.cpp:

(WebKit::LocalStorageNamespace::getOrCreateStorageArea):

• NetworkProcess/WebStorage/LocalStorageNamespace.h:
• NetworkProcess/WebStorage/SessionStorageNamespace.cpp:

(WebKit::SessionStorageNamespace::getOrCreateStorageArea):

• NetworkProcess/WebStorage/SessionStorageNamespace.h:
• NetworkProcess/WebStorage/StorageArea.cpp:

(WebKit::StorageArea::StorageArea):

• NetworkProcess/WebStorage/StorageArea.h:
• NetworkProcess/WebStorage/StorageManager.cpp:

(WebKit::StorageManager::createLocalStorageArea):
(WebKit::StorageManager::createTransientLocalStorageArea):
(WebKit::StorageManager::createSessionStorageArea):

• NetworkProcess/WebStorage/StorageManager.h:
• NetworkProcess/WebStorage/StorageManagerSet.cpp:

(WebKit::StorageManagerSet::StorageManagerSet):
(WebKit::StorageManagerSet::suspend):
(WebKit::StorageManagerSet::resume):

• NetworkProcess/WebStorage/StorageManagerSet.h:

(WebKit::StorageManagerSet::WTF_GUARDED_BY_LOCK): Deleted.

• NetworkProcess/WebStorage/TransientLocalStorageNamespace.cpp:

(WebKit::TransientLocalStorageNamespace::getOrCreateStorageArea):

• NetworkProcess/WebStorage/TransientLocalStorageNamespace.h:

Source/WTF:

Add SuspendableWorkQueue that would perform suspend check before each task.

• WTF.xcodeproj/project.pbxproj:
• wtf/CMakeLists.txt:
• wtf/Forward.h:
• wtf/SuspendableWorkQueue.cpp: Added.

(WTF::SuspendableWorkQueue::create):
(WTF::SuspendableWorkQueue::SuspendableWorkQueue):
(WTF::SuspendableWorkQueue::suspend):
(WTF::SuspendableWorkQueue::resume):
(WTF::SuspendableWorkQueue::dispatch):
(WTF::SuspendableWorkQueue::dispatchAfter):
(WTF::SuspendableWorkQueue::dispatchSync):
(WTF::SuspendableWorkQueue::invokeAllSuspensionCompletionHandlers):
(WTF::SuspendableWorkQueue::suspendIfNeeded):

• wtf/SuspendableWorkQueue.h: Added.
• wtf/WorkQueue.h:

(): Deleted.

3:21 PM Changeset in webkit [280933] by Chris Dumez

• 5 edits in trunk

<a rel="opener noopener" target="_blank"> should create a window without opener
​https://bugs.webkit.org/show_bug.cgi?id=229011

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline WPT tests that are now passing.

• web-platform-tests/html/semantics/links/links-created-by-a-and-area-elements/target_blank_implicit_noopener-expected.txt:
• web-platform-tests/html/semantics/links/links-created-by-a-and-area-elements/target_blank_implicit_noopener_base-expected.txt:

Source/WebCore:

<a rel="opener noopener" target="_blank"> should create a window without opener, as per:

• ​https://html.spec.whatwg.org/#get-an-element's-noopener (noopener is checked *before* opener).

Firefox and Chrome match the specification.

No new tests, rebaselined existing tests.

• html/HTMLAnchorElement.cpp:

(WebCore::HTMLAnchorElement::handleClick):

3:18 PM Changeset in webkit [280932] by Chris Dumez

• 5 edits in trunk/LayoutTests

http/tests/xmlhttprequest/interactive-state.html is flaky
​https://bugs.webkit.org/show_bug.cgi?id=229006
<rdar://80343834>

Reviewed by Alex Christensen.

• http/tests/xmlhttprequest/interactive-state-expected.txt:

Rebaseline test as the output is a bit different now.

• http/tests/xmlhttprequest/interactive-state.cgi:

Use sleep instead of writing a lot of data to make sure that
the data is processed in chunks.

• http/tests/xmlhttprequest/interactive-state.html:

Modernize test a bit.

• platform/mac-wk1/TestExpectations:

Unskip test as it should no longer be flaky.

3:05 PM Changeset in webkit [280931] by commit-queue@webkit.org

• 3 edits
  2 adds in trunk

REGRESSION (r278392) performance.measure should never throw an InvalidAccessError for fetchStart
​https://bugs.webkit.org/show_bug.cgi?id=229008
<rdar://79960877>

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-08-11
Reviewed by Chris Dumez.

Source/WebCore:

Test: http/tests/performance/performance-measure-fetch-start.html

PerformanceTiming::fetchStart is returning 0 when we get a main resource from the cache sometimes.
This is causing PerformanceUserTiming::convertMarkToTimestamp to throw an error, which it should.
Like PerformanceResourceTiming::fetchStart we need to fall back to ResourceLoadTiming::startTime
if the NetworkLoadMetrics doesn't have any useful data for us.

• page/PerformanceTiming.cpp:

(WebCore::PerformanceTiming::fetchStart const):

LayoutTests:

• http/tests/performance/performance-measure-fetch-start-expected.txt: Added.
• http/tests/performance/performance-measure-fetch-start.html: Added.

1:39 PM Changeset in webkit [280930] by wilander@apple.com

• 3 edits in trunk/Source/WebCore

PCM: Flip WebCore's FraudPreventionEnabled to true if HAVE(RSA_BSSA) to match the experimental setting
​https://bugs.webkit.org/show_bug.cgi?id=228961

Reviewed by Tim Horton.

Existing tests use the affected anchor attribute.

• page/RuntimeEnabledFeatures.h:
• page/Settings.yaml:

1:35 PM Changeset in webkit [280929] by Alan Coon

• 3 edits in branches/safari-612.1.27.0-branch/Source/ThirdParty/ANGLE

Cherry-pick r280926. rdar://problem/81810533

Avoid infinite recursion when command buffer creation fails
​https://bugs.webkit.org/show_bug.cgi?id=228978
<rdar://79224824>

Reviewed by Kenneth Russell.

In cases where the MTLCommandBuffer is not a valid metal object,
we can end up in an infinite recursive loop during draw call setup. Refactor setupDraw to take no more than two attempts through the setup function.

Testing: Ran WebGL tests, use case samples. Set up synthetic
repro forcing bail out path, saw WebGL content fail to render
instead of a web process crash.

• src/libANGLE/renderer/metal/ContextMtl.h:
• src/libANGLE/renderer/metal/ContextMtl.mm: (rx::ContextMtl::setupDraw): (rx::ContextMtl::setupDrawImpl):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280926 268f45cc-cd09-0410-ab3c-d52691b4dbfc

1:32 PM Changeset in webkit [280928] by commit-queue@webkit.org

• 8 edits
  4 adds in trunk

Start smooth keyboard scrolling animation when pageUp or pageDown key is pressed.
​https://bugs.webkit.org/show_bug.cgi?id=228156

Patch by Dana Estra <​destra@apple.com> on 2021-08-11
Reviewed by Tim Horton.

Source/WebCore:

UIProcess now no longer handles scrollPageUp and scrollPageDown events. They return to eventHandler as
unhandled and the keyboard scroll animation is started.

Tests: fast/scrolling/keyboard-scrolling-distance-downArrow.html

fast/scrolling/keyboard-scrolling-distance-pageDown.html

• page/EventHandler.cpp:

(WebCore::EventHandler::defaultKeyboardEventHandler):

• platform/KeyboardScrollingAnimator.cpp:

(WebCore::KeyboardScrollingAnimator::keyboardScrollForKeyboardEvent const):

Source/WebKit:

UIProcess now no longer handles scrollPageUp and scrollPageDown events. They return
to eventHandler as unhandled and the keyboard scroll animation is started.

• UIProcess/API/mac/WKWebViewMac.mm:

(-[WKWebView scrollPageDown:]):
(-[WKWebView scrollPageUp:]):

LayoutTests:

Tests check that at least 2 scroll events occur when the downArrow key or pageDown key is pressed, and
that with each event, the page's offset from its original position increases.

• fast/scrolling/keyboard-scrolling-distance-downArrow-expected.txt: Added.
• fast/scrolling/keyboard-scrolling-distance-downArrow.html: Added.
• fast/scrolling/keyboard-scrolling-distance-pageDown-expected.txt: Added.
• fast/scrolling/keyboard-scrolling-distance-pageDown.html: Added.

1:19 PM Changeset in webkit [280927] by Aditya Keerthi

• 5 edits
  2 adds in trunk

REGRESSION (r273072): Caps lock indicator in password field is too large
​https://bugs.webkit.org/show_bug.cgi?id=228970
rdar://81546781

Reviewed by Wenson Hsieh.

Source/WebCore:

r273072 made it so that flex items with an intrinsic size will honor
their aspect ratio when computing their content size. Prior to the
change, in taller password fields, the flex item representing the caps
lock indicator would be tall and narrow. The height would stretch to
fill the container, but the width would maintain its intrinsic width of
17px. Now that aspect ratio is accounted for, the width increases to
match the height, resulting in a much larger indicator in taller password
fields.

However, while r273072 regressed the appearance of the caps lock
indicator, it merely exposed an issue with the styling of the indicator.

Consider the following test case, which is a reduced version how the
caps lock indicator is styled:

<div style="display: flex; height: 100px">

<div style="content: url(17_x_17_blue_square.svg); align-self: stretch;"></div>

</div>

Prior to r273072, this displayed a 17x17 blue square (inside a 17x100
flex item). However, in Chrome, Firefox, and WebKit after r273072, this
shows a 100x100 blue square (inside a 100x100 flex item). This is the
expected behavior now that aspect ratio is accounted for.

Consequently, to fix the issue, the width of the indicator must be
limited to a maximum value. 17px was chosen to be the max-width, as the
indicator's width would not exceed 17px prior to r273072.

Test: fast/forms/caps-lock-indicator-width.html

• css/html.css:

(input::-webkit-caps-lock-indicator):

LayoutTests:

Added a layout test to verify that the width of the caps lock indicator
adapts to the height of the password field, but does not exceed a
maximum width.

The added test is skipped on WK1, since DumpRenderTree does not support
toggling caps lock state. Implementing the testing hook in DRT is made
difficult by the fact that, in WK1, the caps lock state is queried
directly from the OS, using GetCurrentKeyModifiers.

• fast/forms/caps-lock-indicator-width-expected.txt: Added.
• fast/forms/caps-lock-indicator-width.html: Added.
• platform/ios-wk1/TestExpectations:
• platform/mac-wk1/TestExpectations:

1:04 PM Changeset in webkit [280926] by Kyle Piddington

• 3 edits in trunk/Source/ThirdParty/ANGLE

Avoid infinite recursion when command buffer creation fails
​https://bugs.webkit.org/show_bug.cgi?id=228978
<rdar://79224824>

Reviewed by Kenneth Russell.

In cases where the MTLCommandBuffer is not a valid metal object,
we can end up in an infinite recursive loop during draw call setup. Refactor setupDraw to take no more than two attempts through the setup function.

Testing: Ran WebGL tests, use case samples. Set up synthetic
repro forcing bail out path, saw WebGL content fail to render
instead of a web process crash.

• src/libANGLE/renderer/metal/ContextMtl.h:
• src/libANGLE/renderer/metal/ContextMtl.mm:

(rx::ContextMtl::setupDraw):
(rx::ContextMtl::setupDrawImpl):

1:00 PM Changeset in webkit [280925] by achristensen@apple.com

• 2 edits in trunk/Source/WebKit

Fix iOS debug build after r280875
​https://bugs.webkit.org/show_bug.cgi?id=228683

• UIProcess/ios/WKContentView.mm:

(-[WKContentView _removeTemporaryFilesIfNecessary]):

12:44 PM Changeset in webkit [280924] by Chris Dumez

• 20 edits in trunk

Stop evaluating <script>s moved between Documents during fetching
​https://bugs.webkit.org/show_bug.cgi?id=202714
<rdar://problem/56208425>

Reviewed by Geoffrey Garen.

LayoutTests/imported/w3c:

Rebaseline WPT tests now that more checks are passing. Note that these checks were already passing in both Firefox and Chrome.

• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/after-prepare-iframe-fetch-error-external-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/after-prepare-iframe-fetch-error-external-module-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/after-prepare-iframe-parse-error-external-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/after-prepare-iframe-parse-error-external-module-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/after-prepare-iframe-parse-error-inline-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/after-prepare-iframe-success-external-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/after-prepare-iframe-success-external-module-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/after-prepare-iframe-success-inline-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/move-back-iframe-fetch-error-external-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/move-back-iframe-fetch-error-external-module-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/move-back-iframe-parse-error-external-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/move-back-iframe-parse-error-external-module-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/move-back-iframe-parse-error-inline-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/move-back-iframe-success-external-classic-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/move-back-iframe-success-external-module-expected.txt:
• web-platform-tests/html/semantics/scripting-1/the-script-element/moving-between-documents/move-back-iframe-success-inline-classic-expected.txt:

Source/WebCore:

Stop evaluating <script>s moved between Documents during fetching:

• ​https://github.com/whatwg/html/issues/2469
• ​https://github.com/whatwg/html/pull/2673

Both Firefox and Chrome already behave this way.

No new tests, rebaselined existing tests.

• dom/ScriptElement.cpp:

(WebCore::ScriptElement::prepareScript):
Set the element's preparation-time document to its node document, as per:

• ​https://html.spec.whatwg.org/multipage/scripting.html#prepare-a-script (step 11)

(WebCore::ScriptElement::executePendingScript):
If scriptElement's preparation-time document is not equal to scriptElement's node document, then return, as per:

• ​https://html.spec.whatwg.org/multipage/scripting.html#execute-the-script-block (step 2)

• dom/ScriptElement.h:

11:46 AM Changeset in webkit [280923] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ Win EWS ] fast/forms/input-baseline.html is flaky crashing.
​https://bugs.webkit.org/show_bug.cgi?id=229009

Unreviewed Windows test gardening to seed up EWS.

• platform/win/TestExpectations:

11:42 AM Changeset in webkit [280922] by Alan Coon

• 9 edits in branches/safari-612.1.27.0-branch

Apply patch. rdar://problem/81804209

11:28 AM Changeset in webkit [280921] by Alan Coon

• 1 copy in branches/safari-612.1.27.0.6-branch

New branch.

11:08 AM Changeset in webkit [280920] by youenn@apple.com

• 4 edits in trunk

Media element is not always autoplaying when going from background to foreground if it is initially not in viewport
​https://bugs.webkit.org/show_bug.cgi?id=228955
Source/WebCore:

Reviewed by Eric Carlson.

In case video element is autoplayable but is paused, we should try to autoplay even if we are not interrupted due to invisible autoplay.
Covered by API test.

• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::updateShouldAutoplay):

Tools:

rdar://81751653

Reviewed by Eric Carlson.

• TestWebKitAPI/Tests/WebKit/GetUserMedia.mm:

10:59 AM Changeset in webkit [280919] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ Win EWS ] http/tests/xmlhttprequest/xmlhttprequest-50ms-download-dispatch.html is flaky failing.
​https://bugs.webkit.org/show_bug.cgi?id=229007

Unreviewed Windows test gardening to seed up EWS.

• platform/win/TestExpectations:

10:48 AM Changeset in webkit [280918] by commit-queue@webkit.org

• 2 edits in trunk/LayoutTests

[Gstreamer] mark media/media-source/media-mp4-h264-sequence-mode.html as failing
​https://bugs.webkit.org/show_bug.cgi?id=228976

Unreviewed test gardening.

Patch by Arcady Goldmints-Orlov <Arcady Goldmints-Orlov> on 2021-08-11

• platform/glib/TestExpectations:

10:22 AM Changeset in webkit [280917] by Alan Coon

• 2 edits in branches/safari-611.3.10.0-branch/Source/WebCore/page

Apply patch. rdar://problem/80288774

10:20 AM Changeset in webkit [280916] by youenn@apple.com

• 3 edits in trunk/Source/WebCore

Remove --no-demangle XLinker option from WebCore
​https://bugs.webkit.org/show_bug.cgi?id=228949

Reviewed by Alexey Proskuryakov.

Remove options that were added inadvertently.
No change of behavior as this is changing the linker log only.

• Configurations/WebCore.xcconfig:
• Configurations/WebCoreTestSupport.xcconfig:

9:56 AM Changeset in webkit [280915] by achristensen@apple.com

• 2 edits in trunk/Source/WebKit

Fix iOS debug build after r280875

​​https://bugs.webkit.org/show_bug.cgi?id=228683

• UIProcess/ios/WKContentView.mm:

(-[WKContentView _removeTemporaryFilesIfNecessary]):

9:51 AM Changeset in webkit [280914] by pvollan@apple.com

• 2 edits in trunk/Source/WebKit

[macOS] Disable menu bar related code in the WebContent process
​https://bugs.webkit.org/show_bug.cgi?id=229002
<rdar://problem/80408291>

Reviewed by Brent Fulgham.

Disable some menu bar related code running in the WebContent process on macOS, since it only makes sense to execute it in the UI process.

• WebProcess/EntryPoint/Cocoa/XPCService/WebContentService/Info-OSX.plist:

9:39 AM Changeset in webkit [280913] by Chris Dumez

• 5 edits in trunk

HTMLMetaElement http-equiv should not be processed in shadow trees
​https://bugs.webkit.org/show_bug.cgi?id=228973

Reviewed by Geoffrey Garen.

LayoutTests/imported/w3c:

Rebaseline WPT test that is now passing.

• web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/not-in-shadow-tree-expected.txt:

Source/WebCore:

HTMLMetaElement http-equiv should not be processed in shadow trees:

• ​https://html.spec.whatwg.org/#attr-meta-http-equiv
• ​https://html.spec.whatwg.org/multipage/infrastructure.html#insert-an-element-into-a-document
• ​https://dom.spec.whatwg.org/#in-a-document-tree

Firefox and Chrome already match the specification here.

No new tests, rebaselined existing test.

• dom/Node.h:

(WebCore::Node::isInDocumentTree const):

• html/HTMLMetaElement.cpp:

(WebCore::HTMLMetaElement::attributeChanged):
(WebCore::HTMLMetaElement::process):

9:22 AM Changeset in webkit [280912] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ Win EWS ] fast/events/dropzone-005.html is flaky crashing.
​https://bugs.webkit.org/show_bug.cgi?id=229005

Unreviewed Windows test gardening to seed up EWS.

• platform/win/TestExpectations:

9:03 AM Changeset in webkit [280911] by Kocsen Chung

• 8 edits in branches/safari-612.1.27.0-branch/Source

Versioning.

WebKit-7612.1.27.0.20

8:40 AM Changeset in webkit [280910] by Chris Dumez

• 4 edits in trunk

HTMLStyleElement should create its style sheet even if its media attribute is invalid
​https://bugs.webkit.org/show_bug.cgi?id=228977

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Rebaseline WPT test that is now passing.

• web-platform-tests/html/semantics/document-metadata/the-style-element/style_non_matching_media-expected.txt:

Source/WebCore:

HTMLStyleElement should create its style sheet even if its media attribute is invalid.

WebKit currently didn't and this was causing us to fail the following WPT test:

• html/semantics/document-metadata/the-style-element/style_non_matching_media.html

This WPT test is passing in both Firefox and Chrome.

No new tests, rebaselined existing tests.

• dom/InlineStyleSheetOwner.cpp:

(WebCore::InlineStyleSheetOwner::createSheet):

8:39 AM Changeset in webkit [280909] by Chris Dumez

• 4 edits in trunk

Dynamically changing HTMLStyleElement.type should change the rendering accordingly
​https://bugs.webkit.org/show_bug.cgi?id=228980

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Rebaseline WPT test that is now passing.

• web-platform-tests/html/semantics/document-metadata/the-style-element/style_type_change-expected.txt:

Source/WebCore:

Dynamically changing HTMLStyleElement.type should change the rendering accordingly.

This is causing the following WPT test to fail in WebKit:

• html/semantics/document-metadata/the-style-element/style_type_change.html

This test is passing in both Firefox and Chrome.

No new tests, rebaselined existing test.

• html/HTMLStyleElement.cpp:

(WebCore::HTMLStyleElement::parseAttribute):

8:09 AM Changeset in webkit [280908] by youenn@apple.com

• 2 edits in trunk/Source/WTF

Enable WebRTC relay by default
​https://bugs.webkit.org/show_bug.cgi?id=229000
<rdar://78767922>

Reviewed by Eric Carlson.

• Scripts/Preferences/WebPreferencesExperimental.yaml:

7:13 AM Changeset in webkit [280907] by Lauro Moura

• 1 edit
  1 delete in trunk/LayoutTests/imported/w3c

Remove leftover offscreen canvas test case after r280084

Unreviewed test gardening.

This test was replaced by others in r280084 but not fully removed.

• web-platform-tests/html/canvas/offscreen/the-offscreen-canvas/2d.getcontext.extraargs.worker.html: Removed.

4:24 AM Changeset in webkit [280906] by Adrian Perez de Castro

• 3 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r275126 - [RenderTreeBuilder] No need to update the counters when the renderer is moved internally
​https://bugs.webkit.org/show_bug.cgi?id=223801
<rdar://75835208>

Reviewed by Ryosuke Niwa.

When the renderer re-parenting is initiated by an "internal move" (e.g. anonymous block parent is not needed anymore so all the descendants
are moved "one level" up), we don't need to re-compute the counters. Their state should not be any different after this re-parenting.

• rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::attachToRenderElementInternal):
(WebCore::RenderTreeBuilder::move):

• rendering/updating/RenderTreeBuilder.h:

4:24 AM Changeset in webkit [280905] by Adrian Perez de Castro

• 6 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274862 - Nullptr crash in HTMLConverter::convert
​https://bugs.webkit.org/show_bug.cgi?id=221719

Patch by Frédéric Wang <​fwang@igalia.com> on 2021-03-23
Reviewed by Ryosuke Niwa.

When the "Undo" command is called after DOM changes, one of the selection's position anchors
may have been moved to a new document. In that case, just clear the selection. Also add
asserts to ensure the selection is in good state after unapply and reapply commands.

• editing/CompositeEditCommand.cpp:

(WebCore::EditCommandComposition::unapply): Add security assert to ensure selection is in
good state.
(WebCore::EditCommandComposition::reapply): Ditto.

• editing/FrameSelection.cpp:

(WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance): If the selection's
position anchors have been moved to a new document then just clear the selection.
(WebCore::FrameSelection::isConnectedToDocument const): New method to verify that all the
positions of the visible selection are in m_document.

• editing/FrameSelection.h: Declare new method.
• editing/VisibleSelection.cpp:

(WebCore::VisibleSelection::document const): New method that returns a common document for
all positions or nullptr otherwise.

• editing/VisibleSelection.h: Declare new method.

4:20 AM Changeset in webkit [280904] by commit-queue@webkit.org

• 5 edits in trunk

Cherry-pick ANGLE: Revise WebGL's shaderSource validation
​https://bugs.webkit.org/show_bug.cgi?id=228951

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-08-11
Reviewed by Kenneth Russell.

Source/ThirdParty/ANGLE:

Cherry-pick ANGLE commit: b4fd46288aa65d61dc9c7140c7d1cdba3f4cdf9a
From: Kenneth Russell <​kbr@chromium.org>
Date: Wed, 27 Jan 2021 15:56:58 -0800
Revise WebGL's shaderSource validation.

Per discussion in the WebGL working group, shaderSource no longer
generates INVALID_VALUE for sources containing characters outside the
ESSL character set. Compilation and/or linking is still specified to
fail when illegal constructs are used.

With this change, ​https://github.com/KhronosGroup/WebGL/pull/3206
passes with the passthrough command decoder.

Revise WebGL compatibility tests to follow the new rules.

• src/libANGLE/validationES2.cpp:

(gl::ValidateShaderSource):

• src/tests/gl_tests/WebGLCompatibilityTest.cpp:

LayoutTests:

Fixes tests:
webgl/1.0.x/conformance/misc/invalid-passed-params.html
webgl/1.0.x/conformance/glsl/bugs/character-set.html
webgl/2.0.y/conformance/misc/invalid-passed-params.html
webgl/2.0.y/conformance/glsl/bugs/character-set.html

• TestExpectations:

3:50 AM Changeset in webkit [280903] by Adrian Perez de Castro

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.32

Merge r274849 - Nullptr crash in WebCore::RenderObject::RenderObjectBitfields::isLineBreak() where a NULL check is missing.
​https://bugs.webkit.org/show_bug.cgi?id=223409

Patch by Venky Dass <​yaranamavenkataramana@apple.com> on 2021-03-22
Reviewed by Ryosuke Niwa.

Source/WebCore:

When the check for LineBreak is performed the BR elmement NULL check is not performed. Which results in a crash
The fix therefore is to check for NULL.

Test: LayoutTests/editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html

• editing/InsertParagraphSeparatorCommand.cpp:

(WebCore::InsertParagraphSeparatorCommand::doApply):

LayoutTests:

Adding a regression test case.

• editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash-expected.txt: Added.
• editing/inserting/insert-paragraph-between-hr-and-br-assigned-to-slot-crash.html: Added.

3:50 AM Changeset in webkit [280902] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274824 - [Web Animations] nullptr crash in updatePlaybackRate() with no timeline
​https://bugs.webkit.org/show_bug.cgi?id=223095

Patch by Ian Gilbert <​iang@apple.com> on 2021-03-22
Reviewed by Ryosuke Niwa.

Changed to WebAnimation::remove() to use setTimeline() instead of setTimelineInternal()
to ensure the animation is in the correct play state.

No new tests as this relies on navigating while updating the playback rate and I was unable to make
a reliable test case.

• animation/WebAnimation.cpp:

(WebCore::WebAnimation::remove): Changed setTimelineInternal() to setTimeline() in order to
ensure the animation has the correct play state.

3:43 AM Changeset in webkit [280901] by Adrian Perez de Castro

• 10 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274818 - REGRESSION(r272433): Inspector should not instrument inside WebCore::Node::setRenderer
​https://bugs.webkit.org/show_bug.cgi?id=223559

Reviewed by Ryosuke Niwa and Devin Rousso.

Existing test coverage:

• inspector/css/nodeLayoutContextTypeChanged.html
• inspector/css/setLayoutContextTypeChangedMode.html

The previous approach to observing render changes was most likely a performance regression in a very hot code
path (Node::setRenderer). This patch resolves this by not instrumenting in this the hot path. Instead we call
inspector instrumentation inside the constructors/destructors of only the RenderObject subclasses we are
interested in observing layout changes for.

Additionally, layout change events are now added to a Vector of pending changes, which will be sent to the
front-end later in order to avoid evaluating JavaScript inside a destructor in WK1 with the new instrumentation
points.

• dom/Element.cpp:

(WebCore::Element::didChangeRenderer): Deleted.

• dom/Element.h:
• dom/Node.h:

(WebCore::Node::didChangeRenderer): Deleted.

• inspector/InspectorInstrumentation.cpp:

(WebCore::InspectorInstrumentation::nodeLayoutContextChangedImpl):

• inspector/InspectorInstrumentation.h:

(WebCore::InspectorInstrumentation::nodeLayoutContextChanged):

• inspector/agents/InspectorCSSAgent.cpp:

(WebCore::InspectorCSSAgent::InspectorCSSAgent):
(WebCore::InspectorCSSAgent::reset):
(WebCore::InspectorCSSAgent::nodeLayoutContextTypeChanged):
(WebCore::InspectorCSSAgent::layoutContextTypeChangedTimerFired):

• Moved layout change events behind a timer firing.
• inspector/agents/InspectorCSSAgent.h:
• rendering/RenderGrid.cpp:

(WebCore::RenderGrid::RenderGrid):
(WebCore::RenderGrid::~RenderGrid):

• Move instrumentation from Node::setRenderer to RenderGrid.
• rendering/RenderObject.h:

(WebCore::Node::setRenderer):

3:43 AM Changeset in webkit [280900] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274776 - Better validate JSArrays in AudioWorkletProcessor
​https://bugs.webkit.org/show_bug.cgi?id=223548

Reviewed by Geoffrey Garen.

Better validate JSArrays in AudioWorkletProcessor. Replaces debug assertions with runtime
checks for robustness.

• Modules/webaudio/AudioWorkletProcessor.cpp:

(WebCore::copyDataFromBusesToJSArray):
(WebCore::copyDataFromParameterMapToJSObject):
(WebCore::zeroJSArray):
(WebCore::AudioWorkletProcessor::buildJSArguments):

3:21 AM Changeset in webkit [280899] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274723 - Protect frame before calling didBeginDocument
​https://bugs.webkit.org/show_bug.cgi?id=217185

Patch by Rob Buis <​rbuis@igalia.com> on 2021-03-19
Reviewed by Alex Christensen.

Protect frame before calling didBeginDocument
since it could potentially delete the frame
through event handling.

• loader/DocumentWriter.cpp:

(WebCore::DocumentWriter::begin):

3:21 AM Changeset in webkit [280898] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274675 - Protect frame before calling setPrinting
​https://bugs.webkit.org/show_bug.cgi?id=222664

Patch by Rob Buis <​rbuis@igalia.com> on 2021-03-18
Reviewed by Ryosuke Niwa.

Protect frame before calling setPrinting
since it could potentially delete the frame
through event handling.

• page/PrintContext.cpp:

(WebCore::PrintContext::begin):

3:20 AM Changeset in webkit [280897] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274630 - Invalidate RenderTreePosition's next sibling with display:contents
​https://bugs.webkit.org/show_bug.cgi?id=218578

Reviewed by Antti Koivisto.

When inserting elements in the tree from JS it might happen that the renderTreePosition() in the RenderTreeUpdater
caches a nextSibling() value which is only temporarily correct because we sequentially process the descendants of a
given root node in RenderTreeUpdater::updateRenderTree(). One of those potentially incorrect scenarios is when
using display:contents. We can detect those cases because we would leave a parent element in RenderTreeUpdater::popParent()
without changing renderingParent() and so without changing renderTreePosition(). Once we are in that situation we
must invalidate the cached position so the next sibling is recomputed.

• rendering/updating/RenderTreeUpdater.cpp:

(WebCore::RenderTreeUpdater::popParent): Invalidate the render tree position's next sibling if the parent element is not
the renderingParent().

3:19 AM Changeset in webkit [280896] by Adrian Perez de Castro

• 4 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274626 - ASSERTION FAILED: node.isConnected() in matchSlottedPseudoElementRules
​https://bugs.webkit.org/show_bug.cgi?id=221440

Patch by Frédéric Wang <​fwang@igalia.com> on 2021-03-18
Reviewed by Ryosuke Niwa.

ReplaceSelectionCommand::doApply() removes a <br> from an element and immediately calls
highestNodeToRemoveInPruning() on that element. The former operation may destroy the
element's renderer and confuses the latter operation. This happens in particular for a
<summary> element which ends up being removed from the tree. This in turn causes unexpected
issues such as a debug assertion failure in matchSlottedPseudoElementRules. To address that
problem, ensure the document is laid out before calling highestNodeToRemoveInPruning().
This patch also increases and improves use of RefPtr<Node>.

• editing/CompositeEditCommand.cpp:

(WebCore::CompositeEditCommand::removeNodeAndPruneAncestors): Use auto & makeRefPtr.
(WebCore::CompositeEditCommand::prune): Store local highestNodeToRemove variable in a RefPtr.
(WebCore::CompositeEditCommand::cleanupAfterDeletion): Store local node variable in a RefPtr.
(WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Store local parentNode variable in a RefPtr.

• editing/Editing.cpp:

(WebCore::highestNodeToRemoveInPruning): Store local currentNode variable in a a RefPtr.

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::doApply): Use auto & makeRefPtr. Store local odeToRemove variable in a RefPtr.
Ensure the document is laid out before calling highestNodeToRemoveInPruning.

3:16 AM Changeset in webkit [280895] by Adrian Perez de Castro

• 3 edits
  1 add in releases/WebKitGTK/webkit-2.32

Merge r274539 - Object allocation sinking phase should prioritize materializations with no dependencies before materializations with no reverse dependencies
​https://bugs.webkit.org/show_bug.cgi?id=221069
<rdar://problem/73686589>

Reviewed by Yusuke Suzuki.

JSTests:

• stress/allocation-sinking-scope-materialization-order.js: Added.

(var3.var2.x):
(var3):

Source/JavaScriptCore:

Suppose we have two scope objects, A and B. Let's say A points to B, so B is
A's parent scope. A then depends on B. B has no dependencies here. When deciding
an order to materialize scope objects, we should always do it in reverse dependency
order. So above, we should materialize B, then A.

Inside object allocation sinking phase, when at an object materialization
site, we do track both dependencies and reverse dependencies. In the above
object graph, we'd attempt to materialize the objects in the right order,
always picking things with no dependencies first (and updating the list of
dependencies as we materialzed objects).

The code was using an std::list to track things to materialize, and it had
notions for materializing something first, and materializing something last.
However, there was a bug in how the code managed to insert things when
it first inserted last followed by inserting first. This patch simplifies
the code and makes it do the right thing.

• dfg/DFGObjectAllocationSinkingPhase.cpp:

3:15 AM Changeset in webkit [280894] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274437 - Do not collapse the anonymous block when it is a candidate container for the list marker
​https://bugs.webkit.org/show_bug.cgi?id=223196
<rdar://74574330>

Reviewed by Antti Koivisto.

Do not merge empty anonymous siblings when the callers says "do not collpase anonymous block". Those merge candidate
anonymous blocks may be candidate containers for some other conent (we expand on r238119 here).

• rendering/updating/RenderTreeBuilderBlock.cpp:

(WebCore::RenderTreeBuilder::Block::detach):

3:14 AM Changeset in webkit [280893] by Adrian Perez de Castro

• 3 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274398 - RenderLineBreak should stay inline level box even when display property says otherwise.
​https://bugs.webkit.org/show_bug.cgi?id=223151
<rdar://74339837>

Reviewed by Antti Koivisto.

In this patch we make sure that the RenderLineBreak object always stays inline.

While the display property applies to all elements (​https://drafts.csswg.org/css-display/#the-display-properties), the line
break element (<br>) seems to be an exception and all browsers handle <br style="display: block"> still as an inline level element.

Renderers can (and do see RenderSVGInline::updateFromStyle) diverge from this computed display value and say they always want to
be inline level boxes. This is ensured by RenderObject::setInline/isInline function pair.

Initially there were 2 setInline() calls:
One in RenderObject::setStyle(). It dealt with "block to inline" transition and
one call in RenderBox::setStyle().
In these functions we simply set the renderer's "inInline" bit to the computed style value (setInline(style.isDisplayInlineType)).
However derived renderer classes were able to override it by implementing the ::setStyle function and
explicitly set the "isInline" bit to true/false.

Over the years the second (RenderBox::setStyle) call transitioned to RenderBoxModelObject::updateFromStyle()
and the first (RenderObject::setStyle) call got moved to normalizeTreeAfterStyleChange() and their order got flipped.

Derived renderer classes can still explicitly set the "isInline" bit by implementing the ::updateFromStyle() function
(this is similar to what we had with ::setStyle).
However since the order is flipped, the "setInline()" call in normalizeTreeAfterStyleChange() now runs after
updateFromStyle() and it may re-reset the "isInline" bit back to the computed value (hence the FIXME).

The "setInline" call in normalizeTreeAfterStyleChange() is not needed anymore since the "isInline" bit is already updated by
the time we get here (as opposed to when it was initially introduced in RenderObject::setStyle, see above).

• rendering/RenderLineBreak.cpp:

(WebCore::RenderLineBreak::updateFromStyle):

• rendering/updating/RenderTreeBuilder.cpp:

(WebCore::RenderTreeBuilder::normalizeTreeAfterStyleChange):

3:13 AM Changeset in webkit [280892] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274387 - Mark the line dirty when list marker goes from inline to block
​https://bugs.webkit.org/show_bug.cgi?id=223132

Reviewed by Antti Koivisto.

This patch ensures that the line layout has a chance to clean up the inline boxes when the marker goes from inline to block.
Instead of deleting the inline box wrapper (InlineElement) here let's

1. mark both the renderer and the line dirty and let the inline layout code run its normal cleanup process on dirty lines.
2. detach the inline box wrapper from the now-block list marker.

• rendering/RenderListMarker.cpp:

(WebCore::RenderListMarker::styleDidChange):

• rendering/RootInlineBox.cpp:

(WebCore::RootInlineBox::verticalPositionForBox):

3:12 AM Changeset in webkit [280891] by Adrian Perez de Castro

• 3 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274361 - Use refptr to PeerConnectionFactoryInterface
​https://bugs.webkit.org/show_bug.cgi?id=222725

Patch by Rob Buis <​rbuis@igalia.com> on 2021-03-12
Reviewed by Youenn Fablet.

Use refptr instead of reference to PeerConnectionFactoryInterface.

• Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.cpp:

(WebCore::LibWebRTCMediaEndpoint::LibWebRTCMediaEndpoint):
(WebCore::LibWebRTCMediaEndpoint::addTrack):
(WebCore::LibWebRTCMediaEndpoint::createSourceAndRTCTrack):

• Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.h:

2:47 AM Changeset in webkit [280890] by Adrian Perez de Castro

• 6 edits in trunk/Source/WebCore

Non-unified build fixes, mid August 2021 edition
​https://bugs.webkit.org/show_bug.cgi?id=228985

Unreviewed non-unified build fixes.

• fileapi/ThreadableBlobRegistry.cpp: Add missing CrossOriginOpenerPolicy.h include.
• html/FormController.cpp: Add missing TypedElementDescendantIterator.h include.
• html/FormController.h: Add missing forward declaration for the Document type.
• loader/CrossOriginEmbedderPolicy.cpp: Add missing ResourceResponse.h include.
• loader/CrossOriginOpenerPolicy.cpp: Ditto.

12:53 AM Changeset in webkit [280889] by cathiechen

• 4 edits in trunk

REGRESSION (r277997): Max-height not applied for image
​https://bugs.webkit.org/show_bug.cgi?id=228872

Reviewed by Antti Koivisto.

Source/WebCore:

The image get stretched because constrainLogicalHeightByMinMax uses the intrinsic height for the minimum height.
According to [1], the automatic minimum size in the ratio-dependent axis of a box is its min-content size,
not the intrinsic size. To fix this, the ratio-dependent minimum height of a box should be computed from aspect-ratio
if it doesn't have any child, otherwise, then it should consider the intrinsic height.

[1] ​https://www.w3.org/TR/css-sizing-4/#aspect-ratio-minimum

• rendering/RenderBox.cpp:

(WebCore::RenderBox::constrainLogicalHeightByMinMax const): The minimum height is computed from aspect-ratio if it doesn't have any child.

LayoutTests:

• TestExpectations:

12:46 AM Changeset in webkit [280888] by Lauro Moura

• 2 edits in trunk/Tools

[WPE] Handle escape key in wpeKeySymForKeyRef
​https://bugs.webkit.org/show_bug.cgi?id=228981

Reviewed by Carlos Garcia Campos.

Some dialog tests were failing due to "escape" key ref being
translated to the 'e' keysym.

Covered by existing tests.

• WebKitTestRunner/wpe/EventSenderProxyWPE.cpp:

(WTR::wpeKeySymForKeyRef):

12:43 AM Changeset in webkit [280887] by commit-queue@webkit.org

• 2 edits in trunk/Source/WebCore

[SVG] Attribute change triggers redundant (and out of order) setNeedsLayout call
​https://bugs.webkit.org/show_bug.cgi?id=228125

Patch by Rob Buis <​rbuis@igalia.com> on 2021-08-11
Reviewed by Darin Adler.

As explained in the bug the setNeedsLayout call is redundant, however
keep using it for embedded SVG's to update width/height of the embedder.

• svg/SVGSVGElement.cpp:

(WebCore::SVGSVGElement::svgAttributeChanged):

12:39 AM Changeset in webkit [280886] by ysuzuki@apple.com

• 3 edits
  1 add in trunk

WTFCrash in JSC::Lexer<char16_t>::append8
​https://bugs.webkit.org/show_bug.cgi?id=228982

Reviewed by Mark Lam.

JSTests:

• stress/directive-includes-non-latin1.js: Added.

Source/JavaScriptCore:

sourceURL / sourceMapURL directive should not assume Latin1 characters.

• parser/Lexer.cpp:

(JSC::Lexer<T>::parseCommentDirectiveValue):

Aug 10, 2021:

11:57 PM Changeset in webkit [280885] by Peng Liu

• 2 edits in trunk/Source/WTF

Disable SYSTEM_FEATURE_FLAGS on iOS 14
​https://bugs.webkit.org/show_bug.cgi?id=228979
<rdar://problem/81764452>

Reviewed by Tim Horton.

Stop using feature flags mechanism on iOS 14 to avoid some issues on iOS simulators.

• wtf/PlatformHave.h:

11:10 PM Changeset in webkit [280884] by Peng Liu

• 2 edits in trunk/Source/WebKitLegacy/mac

REGRESSION (r280726): [ Big Sur wk1 ] 25 imported/w3c/web-platform-tests/fetch/ failing
​https://bugs.webkit.org/show_bug.cgi?id=228926

Reviewed by Jer Noble.

Revert a part of r280726 while investigating the test failures.

• WebView/WebPreferencesDefaultValues.mm:

(WebKit::isFeatureFlagEnabled):

10:28 PM Changeset in webkit [280883] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebKit

Unreviewed build fix after r280875

• UIProcess/ios/forms/WKFileUploadPanel.mm:

(-[WKFileUploadPanel documentPicker:didPickDocumentsAtURLs:]):

9:09 PM Changeset in webkit [280882] by Jonathan Bedard

• 3 edits in trunk/Tools

[webkitpy] Stop relying on device.plist for simulated device state
​https://bugs.webkit.org/show_bug.cgi?id=228974
<rdar://problem/81749547>

Reviewed by Stephanie Lewis.

• Scripts/webkitpy/xcode/simulated_device.py:

(SimulatedDeviceManager):
(SimulatedDeviceManager.populate_available_devices): Device state check is now shared between simulators.
(SimulatedDeviceManager._disambiguate_device_type): Only extract hardware family and type from candidate.
(SimulatedDevice.init): Device state check is now shared between simulators.
(SimulatedDevice.state): Use 'xcrun simctl list' instead of device.plist.

• Scripts/webkitpy/xcode/simulated_device_unittest.py:

(SimulatedDeviceTest.change_state_to): Deleted.
(SimulatedDeviceTest.test_swapping_devices): Deleted.

7:58 PM Changeset in webkit [280881] by Chris Dumez

• 34 edits in trunk

Add Cross-Origin-Opener-Policy support for Blob URLs
​https://bugs.webkit.org/show_bug.cgi?id=228924

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline WPT test that is now passing.

• web-platform-tests/html/cross-origin-opener-policy/blob-popup.https-expected.txt:

Source/WebCore:

Pass ScriptExecutionContext's cross-origin-opener-policy when registering a public
Blob URL and store it in the blob registry alongside the blob data. As a result,
we are able to service the right COOP headers on the blob response later on when
doing a load of this blob. In the future, we'll pass the cross-origin-embedder-policy
as well, once we support it.

No new tests, rebaselined existing test.

• Modules/fetch/FetchLoader.cpp:

(WebCore::FetchLoader::startLoadingBlobURL):

• dom/Document.h:
• dom/ScriptExecutionContext.cpp:

(WebCore::ScriptExecutionContext::crossOriginOpenerPolicy const):

• dom/ScriptExecutionContext.h:
• fileapi/Blob.cpp:

(WebCore::BlobURLRegistry::registerURL):
(WebCore::Blob::Blob):

• fileapi/FileReaderLoader.cpp:

(WebCore::FileReaderLoader::start):

• fileapi/ThreadableBlobRegistry.cpp:

(WebCore::ThreadableBlobRegistry::registerBlobURL):

• fileapi/ThreadableBlobRegistry.h:
• html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::loadResource):

• loader/CrossOriginEmbedderPolicy.cpp:

(WebCore::obtainCrossOriginEmbedderPolicy):
For WebKit1, the initial empty document seems to have an empty URL instead of
"about:blank" so I had to extend the check so that COEP properly gets enabled.

• loader/CrossOriginOpenerPolicy.cpp:

(WebCore::obtainCrossOriginOpenerPolicy):
For WebKit1, the initial empty document seems to have an empty URL instead of
"about:blank" so I had to extend the check so that COOP properly gets enabled.

(WebCore::crossOriginOpenerPolicyToString):
(WebCore::CrossOriginOpenerPolicy::isolatedCopy const):
(WebCore::addCrossOriginOpenerPolicyHeaders):

• loader/CrossOriginOpenerPolicy.h:

(WebCore::operator==):
(WebCore::CrossOriginOpenerPolicy::encode const):
(WebCore::CrossOriginOpenerPolicy::decode):

• platform/network/BlobData.cpp:

(WebCore::BlobData::clone const):

• platform/network/BlobData.h:

(WebCore::BlobData::crossOriginOpenerPolicy const):
(WebCore::BlobData::setCrossOriginOpenerPolicy):

• platform/network/BlobRegistry.h:
• platform/network/BlobRegistryImpl.cpp:

(WebCore::BlobRegistryImpl::registerBlobURL):
(WebCore::BlobRegistryImpl::registerBlobURLOptionallyFileBacked):

• platform/network/BlobRegistryImpl.h:
• platform/network/BlobResourceHandle.cpp:

(WebCore::BlobResourceHandle::notifyResponseOnSuccess):

Source/WebKit:

• NetworkProcess/NetworkConnectionToWebProcess.cpp:

(WebKit::NetworkConnectionToWebProcess::registerBlobURLFromURL):
(WebKit::NetworkConnectionToWebProcess::registerBlobURLOptionallyFileBacked):

• NetworkProcess/NetworkConnectionToWebProcess.h:
• NetworkProcess/NetworkConnectionToWebProcess.messages.in:
• NetworkProcess/NetworkDataTaskBlob.cpp:

(WebKit::NetworkDataTaskBlob::dispatchDidReceiveResponse):

• NetworkProcess/NetworkProcessPlatformStrategies.cpp:

(WebKit::NetworkProcessPlatformStrategies::createBlobRegistry):

• WebProcess/FileAPI/BlobRegistryProxy.cpp:

(WebKit::BlobRegistryProxy::registerBlobURL):

• WebProcess/FileAPI/BlobRegistryProxy.h:

Source/WebKitLegacy/mac:

• WebCoreSupport/WebPlatformStrategies.mm:

Source/WebKitLegacy/win:

• WebCoreSupport/WebPlatformStrategies.cpp:

6:55 PM Changeset in webkit [280880] by Lauro Moura

• 2 edits in trunk/LayoutTests

[WPE] Garden new css-counter imageonly failures

Unreviewed test gardening.

Some width issues in some specific cases of upper/lower roman style.

• platform/wpe/TestExpectations:

6:51 PM Changeset in webkit [280879] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebKit

Unreviewed build fix.

• NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(stringForTLSProtocolVersion):
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
Ignore some slightly less unconventional deprecation warnings.

6:34 PM Changeset in webkit [280878] by timothy_horton@apple.com

• 2 edits in trunk/Source/WebCore/PAL

Unreviewed build fix.

• pal/spi/ios/CelestialSPI.h:

Ignore unconventional deprecation warnings until they can be fixed properly.

5:54 PM Changeset in webkit [280877] by commit-queue@webkit.org

• 2 edits
  1 delete in trunk/LayoutTests

[GLIB] Update test expectations after r280742
​https://bugs.webkit.org/show_bug.cgi?id=228972

Unreviewed test gardening.

Patch by Arcady Goldmints-Orlov <Arcady Goldmints-Orlov> on 2021-08-10

• platform/glib/TestExpectations:
• platform/glib/compositing/backing/form-controls-backing-expected.txt: Removed.

5:54 PM Changeset in webkit [280876] by Alan Coon

• 1 copy in tags/Safari-612.1.27.0.6

Tag Safari-612.1.27.0.6.

5:12 PM Changeset in webkit [280875] by commit-queue@webkit.org

• 4 edits in trunk/Source/WebKit

WebKitBlobResource error 1 exactly after 60 seconds when trying to read file input
​https://bugs.webkit.org/show_bug.cgi?id=228683
<rdar://78448610>

Patch by Alex Christensen <​achristensen@webkit.org> on 2021-08-10
Reviewed by Tim Horton.

To prevent UIKit from deleting our files to upload after 60 seconds, copy them to a temporary directory,
then delete the files when cleaning up the WKContentView.

I manually verified this makes the files able to upload after more than 60 seconds, then deletes them when you close the tab.

• UIProcess/ios/WKContentView.h:
• UIProcess/ios/WKContentView.mm:

(-[WKContentView dealloc]):
(-[WKContentView _removeTemporaryFilesIfNecessary]):
(-[WKContentView _removeTemporaryFilesWhenDeallocated:]):

• UIProcess/ios/WKContentViewInteraction.h.orig: Added.
• UIProcess/ios/WKContentViewInteraction.mm.orig: Added.
• UIProcess/ios/forms/WKFileUploadPanel.mm:

(-[WKFileUploadPanel documentPicker:didPickDocumentsAtURLs:]):

5:00 PM Changeset in webkit [280874] by Alan Coon

• 8 edits in branches/safari-612.1.27.0-branch/Source

Versioning.

WebKit-7612.1.27.0.6

4:53 PM Changeset in webkit [280873] by Cameron McCormack

• 2 edits in trunk/Source/WebCore/PAL

Remove unused ColorSync SPI
​https://bugs.webkit.org/show_bug.cgi?id=228306
<rdar://problem/81136866>

Reviewed by Darin Adler.

We now use -[NSScreen canRepresentDisplayGamut:displayGamut] and
kMGQHasExtendedColorDisplay.

• pal/spi/cg/CoreGraphicsSPI.h:

4:51 PM Changeset in webkit [280872] by Wenson Hsieh

• 2 edits in trunk/Source/WebCore

[Live Text] Unable to start drag on image when the first piece of text inside the image is selected
​https://bugs.webkit.org/show_bug.cgi?id=228967
rdar://80471465

Reviewed by Tim Horton.

When selecting text inside an image element using Live Text, if the text selection contains the very first
character (in DOM order) that appears in the image element's shadow root, the user will be unable to start an
image drag on the same image by clicking another part of the image that does not contain Live Text. This happens
because DragController::startDrag to handle the drag as a selection drag rather than an image drag, which (in
turn) happens because DragController::draggableElement computes a drag source type of
DragSourceAction::Selection.

This occurs because FrameSelection::contains(const LayoutPoint&) returns true for any point inside the
shadow root of an image element with Live Text that does NOT hit-test to a text node, because we end up hit-
testing to the image overlay container div as our innerNode, which means that the DOM position for the given
point is going to be at the first position inside the image overlay container. Since this canonicalizes to the
beginning of the first text node (in DOM order) inside the image overlay, if that first text node happens to be
selected, we'll end up believing that the layout point (which is not over any text inside the image) is inside
the selection.

To avoid this, we make a minor adjustment to the logic in FrameSelection::contains, so that we handle text
inside image overlays by mapping the selected text range to absolute quads, and then checking whether the given
point (in absolute coordinates) is contained in any of those quads.

While we could theoretically use this approach for all selections, it's both more expensive than a hit-test and
might result in compatibility issues, so we just limit it to the case where we know (a-prior) that all
selectable text is arbitrarily positioned using transforms.

This change fixes an API test that currently fails on macOS: DragAndDropTests.DragElementWithImageOverlay

• editing/FrameSelection.cpp:

(WebCore::FrameSelection::contains const):

4:51 PM Changeset in webkit [280871] by Cameron McCormack

• 2 edits in trunk/Tools

Restore color profiles correctly on displays with multiple named modes
​https://bugs.webkit.org/show_bug.cgi?id=228313
<rdar://problem/81146417>

Reviewed by Alexey Proskuryakov.

Look up a device's current color profile by checking the default mode
rather than assuming it is "1". The device info dictionary returned
by ColorSyncDeviceCopyDeviceInfo has this shape:

{

CustomProfiles = {

ModeName1 = "​file:///path/to/custom/profile.ics";

};
FactoryProfiles = {

DeviceDefaultProfileID = "ModeName1";
ModeName1 = {

DeviceModeDescription = "Mode Name 1";
DeviceProfileURL = "​file:///path/to/factory/profile1.ics";

};
ModeName2 = {

DeviceModeDescription = "Mode Name 2";
DeviceProfileURL = "​file:///path/to/factory/profile2.ics";

};

};

}

where CustomProfiles is only present if a custom profile has been
selected, and the default mode name is "1". Displays connected over
HDMI don't use the default mode name.

• DumpRenderTree/mac/LayoutTestHelper.m:

(colorProfileURLForDisplay):

4:19 PM Changeset in webkit [280870] by Chris Dumez

• 15 edits in trunk

Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set
​https://bugs.webkit.org/show_bug.cgi?id=228965

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline WPT tests that are now passing.

• web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-1-expected.txt:
• web-platform-tests/html/semantics/document-metadata/the-meta-element/pragma-directives/attr-meta-http-equiv-refresh/allow-scripts-flag-changing-2-expected.txt:

Source/WebCore:

Meta HTTP refresh should not navigate if document has sandboxed automatic features browsing context flag set:

• ​https://html.spec.whatwg.org/multipage/semantics.html#shared-declarative-refresh-steps (Step 13)

Firefox and Chrome already behave this way.

No new tests, rebaselined existing tests.

• dom/Document.cpp:

(WebCore::Document::processMetaHttpEquiv):

• dom/Document.h:
• html/HTMLMetaElement.cpp:

(WebCore::HTMLMetaElement::process):

• loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::responseReceived):

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::receivedFirstData):
(WebCore::FrameLoader::scheduleRefreshIfNeeded):

• loader/FrameLoader.h:
• loader/FrameLoaderTypes.h:
• loader/NavigationScheduler.cpp:

(WebCore::ScheduledRedirect::ScheduledRedirect):
(WebCore::NavigationScheduler::scheduleRedirect):

• loader/NavigationScheduler.h:

LayoutTests:

Unskip tests that should no longer be flaky now that they are passing.

• TestExpectations:

3:41 PM Changeset in webkit [280869] by Jonathan Bedard

• 10 edits in trunk/Tools

[resultsdbpy] Add results-summary API
​https://bugs.webkit.org/show_bug.cgi?id=226894
<rdar://problem/79155181>

Reviewed by Aakash Jain.

• Scripts/libraries/resultsdbpy/resultsdbpy/init.py: Bump version.
• Scripts/libraries/resultsdbpy/resultsdbpy/controller/api_routes.py:

(APIRoutes.init): Add aggregate-results endpoint.

• Scripts/libraries/resultsdbpy/resultsdbpy/controller/commit_controller.py:

(commit_for_query): Add decorator which converts a set of arguments into a single commit.

• Scripts/libraries/resultsdbpy/resultsdbpy/controller/test_controller.py:

(TestController):
(TestController.summarize_test_results): Given a single commit and suite/test combination, compute
the liklihood of each potential result.

• Scripts/libraries/resultsdbpy/resultsdbpy/controller/test_controller_unittest.py:

(TestControllerTest.test_summarize_general): Added.
(TestControllerTest.test_summarize_specific): Added.
(TestControllerTest.test_summarize_expectations): Added.

• Scripts/libraries/resultsdbpy/resultsdbpy/model/commit_context.py:

(CommitContext.find_commits_in_range): Use ascended table if user only provides lower bound.

• Scripts/libraries/resultsdbpy/resultsdbpy/model/commit_context_unittest.py:

(CommitContextTest.test_stash_commits_before): Verify upper bound.
(CommitContextTest.test_svn_commits_before): Ditto.
(CommitContextTest.test_stash_commits_after): Verify lower bound.
(CommitContextTest.test_svn_commits_after): Ditto.

• Scripts/libraries/resultsdbpy/resultsdbpy/view/templates/documentation.html: Add aggregate-results

documentation.

• Scripts/libraries/resultsdbpy/setup.py: Bump version.

3:23 PM Changeset in webkit [280868] by Russell Epstein

• 1 copy in tags/Safari-612.1.27.0.5

Tag Safari-612.1.27.0.5.

3:17 PM Changeset in webkit [280867] by timothy_horton@apple.com

• 2 edits in trunk/Tools

macCatalyst: Flexible viewport tests that dump the window size fail because it doesn't match iPad
​https://bugs.webkit.org/show_bug.cgi?id=228964

Reviewed by Darin Adler.

• WebKitTestRunner/ios/TestControllerIOS.mm:

(WTR::TestController::platformConfigureViewForTest):
For platforms where we control the size of the window/scene, resize it
to match the chosen default testing iPad size (768x1024), but with the
default testing iPad's status bar subtracted out, and the current platform's
added in, so that the end result is a WKWebView of identical size to
one on the default testing iPad.

2:53 PM Changeset in webkit [280866] by stephan.szabo@sony.com

• 2 edits in trunk/Source/WTF

[WTF][PlayStation] REGRESSION(r280795) error: undefined symbol: WTF::logLevelString()
​https://bugs.webkit.org/show_bug.cgi?id=228959

Reviewed by Fujii Hironori.

As per followup win fix, for declspec platforms, LoggingUnix needs
to include LogInitialization to get the export declaration.

• wtf/unix/LoggingUnix.cpp:

2:37 PM Changeset in webkit [280865] by Andres Gonzalez

• 6 edits in trunk/Source/WebKit

Notify accessibility that WebProcess is suspended when in process cache.
​https://bugs.webkit.org/show_bug.cgi?id=228936
rdar://80911502

Reviewed by Chris Dumez.

Need to notify accessibility clients that a WebProcess in the process
cache is suspended. Otherwise accessibility clients may continue making
requests to the cached Webprocess and be waiting indefinitely for a
suspended process.
Deleted WebProcess::accessibilityProcessSuspendedNotification and
instead use IPC::AccessibilityProcessSuspendedNotification

• Platform/IPC/Connection.h:
• Platform/IPC/cocoa/ConnectionCocoa.mm:

(IPC::AccessibilityProcessSuspendedNotification):

• WebProcess/WebProcess.cpp:

(WebKit::WebProcess::setIsInProcessCache):
(WebKit::WebProcess::prepareToSuspend):
(WebKit::WebProcess::processDidResume):

• WebProcess/WebProcess.h:
• WebProcess/cocoa/WebProcessCocoa.mm:

(WebKit::WebProcess::accessibilityProcessSuspendedNotification): Deleted.

2:35 PM Changeset in webkit [280864] by Jonathan Bedard

• 10 edits in trunk/Tools

[git-webkit] Color log output
​https://bugs.webkit.org/show_bug.cgi?id=228662
<rdar://problem/81344181>

Reviewed by Dewei Zhu.

• Scripts/libraries/webkitcorepy/setup.py: Bump version.
• Scripts/libraries/webkitcorepy/webkitcorepy/init.py: Bump version, export Terminal.
• Scripts/libraries/webkitcorepy/webkitcorepy/terminal.py: Added.

(Terminal):
(Terminal.assert_writeable_stream): Assert that the provided object is a writable stream.
(Terminal.supports_color): Check if the provided file supports colored output.
(Terminal.isatty): Check if a stream is an atty, both according to the stream itself and our override.
(Terminal.override_atty): Allow callers to override and declare explicitly if a stream is an atty.
(Terminal.Text): Group text colors and styles.
(Terminal.Style): Group functions modifying style of a stream.
(Terminal.Style.enabled): Check if styled printing is enabled on a stream.
(Terminal.Style.disable): Disable styled printing on a stream.
(Terminal.Style.enable): Enable styled printing on a stream.
(Terminal.Style.is_styled): Check if a stream is currently styled.
(Terminal.Style.init): Construct a text style.
(Terminal.Style.repr): Output the terminal characters styling a stream.
(Terminal.Style.set): Apply style to a stream.
(Terminal.Style.apply): Apply style to a stream, unapply when exiting context.

• Scripts/libraries/webkitscmpy/setup.py:
• Scripts/libraries/webkitscmpy/webkitscmpy/init.py:
• Scripts/libraries/webkitscmpy/webkitscmpy/program/blame.py: Pass isatty to child process.
• Scripts/libraries/webkitscmpy/webkitscmpy/program/command.py:

(FilteredCommand.pager): Pass isatty to child process, ask 'more' to display colors.
(FilteredCommand.main): Color header and error.

• Scripts/libraries/webkitscmpy/webkitscmpy/program/log.py: Pass isatty to child process.
• Scripts/libraries/webkitscmpy/webkitscmpy/test/log_unittest.py: Override atty behavior.

2:28 PM Changeset in webkit [280863] by Russell Epstein

• 5 edits in branches/safari-611.3.10.0-branch/Source

Apply patch. rdar://problem/79924198

2:24 PM Changeset in webkit [280862] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ Win EWS ] fast/forms/search/search-zoom-computed-style-height.html is flaky crashing.
​https://bugs.webkit.org/show_bug.cgi?id=228968

Unreviewed Windows test gardening to seed up EWS.

• platform/win/TestExpectations:

1:49 PM Changeset in webkit [280861] by rniwa@webkit.org

• 2 edits in trunk/Source/WebCore

Deploy some more smart pointers in DOMWindow.cpp
​https://bugs.webkit.org/show_bug.cgi?id=228883

Reviewed by Darin Adler.

A follow up to r279661. Deploy even more smart pointers.

• page/DOMWindow.cpp:

(WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents):
(WebCore::DOMWindow::failedToRegisterDeviceMotionEventListener):
(WebCore::DOMWindow::dispatchEvent):

12:50 PM Changeset in webkit [280860] by Antti Koivisto

• 2 edits in trunk/Source/WebCore

Remove some dead code from LegacyInlineFlowBox::nodeAtPoint
​https://bugs.webkit.org/show_bug.cgi?id=228960

Reviewed by Alan Bujtas.

• rendering/LegacyInlineFlowBox.cpp:

(WebCore::LegacyInlineFlowBox::nodeAtPoint):

This hit test quirk got accidentally disabled 7 years ago (in ​http://trac.webkit.org/changeset/170875/webkit)
and this became dead code. No one has complained.

11:52 AM Changeset in webkit [280859] by Ben Nham

• 5 edits in trunk

Fix nested resource load tracepoints
​https://bugs.webkit.org/show_bug.cgi?id=228242

Reviewed by Alex Christensen.

Source/WebCore:

The main resource and subresource load tracepoints aren't interpreted correctly if there are
multiple resource loads in flight at the same time. To fix this, we pass the pointer to the
FrameLoader or SubresourceLoader to ktrace so that the tracing tool can use that pointer to
properly nest overlapping resource loading trace intervals.

One additional change I made is to move the SubresourceLoadWillStart tracepoint to after the
call to willSendRequestInternal. The reason for this is because I wanted to log the resource
ID associated with the subresource request, but we only generate that ID after the call to
willSendRequestInternal.

• loader/FrameLoader.cpp:

(WebCore::FrameLoader::provisionalLoadStarted):
(WebCore::FrameLoader::checkLoadCompleteForThisFrame):

• loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::willSendRequestInternal):
(WebCore::SubresourceLoader::didFinishLoading):
(WebCore::SubresourceLoader::didFail):
(WebCore::SubresourceLoader::didCancel):

Tools:

Use page and resource ids to properly handle nested main resource and subresource load
tracepoint intervals.

• Tracing/SystemTracePoints.plist:

11:17 AM Changeset in webkit [280858] by keith_miller@apple.com

• 7 edits in trunk/Source

CallFrame::returnPC should untag the return address before passing it to ReturnAddressPtr
​https://bugs.webkit.org/show_bug.cgi?id=228931

Reviewed by Mark Lam.

Source/JavaScriptCore:

Right now current debugging code expects that the JS return PC on
the stack is already unsigned. This is not true on arm64e.
This patch now properly unsigns the return PC before passing it to
the ReturnAddressPC constructor.

• assembler/MacroAssemblerCodeRef.h:

(JSC::ReturnAddressPtr::fromTaggedPC):

• interpreter/AbstractPC.cpp:

(JSC::AbstractPC::AbstractPC):

• interpreter/AbstractPC.h:

(JSC::AbstractPC::AbstractPC):
(JSC::AbstractPC::jitReturnAddress const):

• interpreter/CallFrame.h:

(JSC::CallFrame::returnPC const):

Source/WTF:

Add a new helper to untag the return pc from a stack frame.

• wtf/PtrTag.h:

(WTF::untagReturnPC):

11:06 AM Changeset in webkit [280857] by Russell Epstein

• 8 edits in branches/safari-612.1.27.0-branch

Cherry-pick r280826. rdar://problem/81749833

Partially revert r280256 behavior change since it broke Facetime
​https://bugs.webkit.org/show_bug.cgi?id=228943
rdar://81700268

Reviewed by Mark Lam.

Source/WebCore:

In r280256, custom accessors start getting holder's JSGlobalObject (this is right behavior).
We also introduced IncumbentWindow IDL attribute to get the caller's JSGlobalObject, which is
necessary in Location. At that time, we replaced all ActiveWindow to IncumbentWindow, but it
changes the JSGlobalObject of replace, assign, and reload since they are functions (not
custom accessors). We observed that, after this change, facetime Web page is broken: when opening
the link to Facetime, it should show the prompt of "Open in Facetime app" in iOS. But after this
change, it won't happen.

We revert the semantic change by using ActiveWindow for replace, assign, and reload. This is
not the correct semantics from the spec, but this is the same to one before r280256, and we
will change this once we find the way to bypass this issue.

• page/Location.cpp: (WebCore::Location::assign): (WebCore::Location::replace): (WebCore::Location::reload):
• page/Location.h:
• page/Location.idl:

LayoutTests:

• fast/frames/sandboxed-iframe-navigation-parent-expected.txt:
• fast/frames/sandboxed-iframe-navigation-parent.html:
• http/tests/security/frameNavigation/context-for-location-assign-expected.txt:

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280826 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:05 AM Changeset in webkit [280856] by Russell Epstein

• 8 edits in branches/safari-612.1.27.0-branch/Source

Versioning.

WebKit-7612.1.27.0.5

10:51 AM Changeset in webkit [280855] by Chris Dumez

• 14 edits
  1 move
  1 add
  1 delete in trunk

Document.baseURI is inaccurate for iframe srcdoc documents
​https://bugs.webkit.org/show_bug.cgi?id=228933

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline WPT tests now that more checks are passing.

• web-platform-tests/html/infrastructure/urls/terminology-0/document-base-url-expected.txt:
• web-platform-tests/html/semantics/document-metadata/the-base-element/base_about_blank-expected.txt:
• web-platform-tests/html/semantics/document-metadata/the-base-element/base_href_invalid-expected.txt:
• web-platform-tests/html/semantics/document-metadata/the-base-element/base_srcdoc-expected.txt:

Source/WebCore:

Document.baseURI is inaccurate for iframe srcdoc documents:

• ​https://html.spec.whatwg.org/#fallback-base-url

This aligns our behavior with both Chrome and Firefox.

No new tests, rebaselined existing tests.

• dom/Document.cpp:

(WebCore::Document::fallbackBaseURL const):
(WebCore::Document::updateBaseURL):
Extract "fallback base URL" logic out of updateBaseURL() and into its own function so that
it can be called from other places. Add logic to deal with iframe srcdoc documents to
our "fallback base URL" logic, as per:

• ​https://html.spec.whatwg.org/#fallback-base-url

(WebCore::Document::processBaseElement):
As per ​https://html.spec.whatwg.org/#set-the-frozen-base-url, we should use the document's fallback base URL
as base URL when parsing the base element's href attribute.

• dom/Document.h:

• html/HTMLBaseElement.cpp:

(WebCore::HTMLBaseElement::href const):
Per ​https://html.spec.whatwg.org/#dom-base-href, we should use the document's fallback base URL when
parsing the base element's href attribute. Also we should return the attribute value if the URL fails
parsing, not a null URL.

• xml/parser/XMLDocumentParserLibxml2.cpp:

(WebCore::openFunc):
Keep in sync with HTMLBaseElement::href(), as per comment.

Source/WebKitLegacy/mac:

• DOM/DOMHTMLBaseElement.mm:

(-[DOMHTMLBaseElement href]):

LayoutTests:

Update existing layout test to reflect behavior change.

• fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document.html: Removed.
• http/tests/misc/href-attribute-resolves-with-respect-to-document-expected.txt: Renamed from LayoutTests/fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document-expected.txt.
• http/tests/misc/href-attribute-resolves-with-respect-to-document.html: Added.

10:35 AM Changeset in webkit [280854] by commit-queue@webkit.org

• 9 edits in trunk

Scripts/generate-derived-sources.sh: line 19: [: binary operator expected while building Source/WebKit
​https://bugs.webkit.org/show_bug.cgi?id=228908

Patch by Kimmo Kinnunen <​kkinnunen@apple.com> on 2021-08-10
Reviewed by Per Arne Vollan.

Source/JavaScriptCore:

• Scripts/generate-derived-sources.sh:

Quote the use of CC so that future copy-paste does not make the same mistake
as this bug.

Source/WebCore:

• Scripts/generate-derived-sources.sh:

Quote the use of CC so that future copy-paste does not make the same mistake
as this bug.

Source/WebKit:

Change variable references in the sh script to quoted "$VAR".
[ -z $VAR ] with VAR="a b" would mean
[ -z a b ].

-z is unary operator, so the expression b would be in position

where test would expect an operator.
The correct form is [ -z "a b" ].

In general, sh scripts usually refer to variables using quotes.

• Scripts/generate-derived-sources.sh:

Fix a bug where multiple space separated paths in
WEBKITADDITIONS_HEADER_SEARCH_PATHS would cause
test expression to receive arguments after the -z arg.

Quote the use of CC so future copy-paste does not make the same mistake
as this bug.

Tools:

• DumpRenderTree/Scripts/generate-derived-sources.sh:
• WebKitTestRunner/Scripts/generate-derived-sources.sh:

Quote the use of CC so that future copy-paste does not make the same mistake
as this bug.

10:34 AM Changeset in webkit [280853] by Russell Epstein

• 4 edits in branches/safari-611.3.10.0-branch/Source/WebKit

Cherry-pick r279287. rdar://problem/80635807

Explicitly invalidate WKFullScreenViewController after a video exits fullscreen
​https://bugs.webkit.org/show_bug.cgi?id=227372

Reviewed by Eric Carlson.

Since WKFullScreenWindowController owns WKFullScreenViewController,
we had better let WKFullScreenWindowController manage the life cycle
of WKFullScreenViewController.

• UIProcess/ios/fullscreen/WKFullScreenViewController.h:
• UIProcess/ios/fullscreen/WKFullScreenViewController.mm: (-[WKFullScreenViewController initWithWebView:]): (-[WKFullScreenViewController invalidate]): (-[WKFullScreenViewController dealloc]): (-[WKFullScreenViewController showUI]): (-[WKFullScreenViewController hideUI]): (-[WKFullScreenViewController videoControlsManagerDidChange]): (-[WKFullScreenViewController setAnimatingViewAlpha:]): (-[WKFullScreenViewController setPrefersStatusBarHidden:]): (-[WKFullScreenViewController setPrefersHomeIndicatorAutoHidden:]): (-[WKFullScreenViewController setPlaying:]): (-[WKFullScreenViewController setPictureInPictureActive:]): (-[WKFullScreenViewController setAnimating:]): (-[WKFullScreenViewController _manager]): (-[WKFullScreenViewController _effectiveFullscreenInsets]): (-[WKFullScreenViewController _cancelAction:]): (-[WKFullScreenViewController _togglePiPAction:]): (-[WKFullScreenViewController _touchDetected:]): (-[WKFullScreenViewController _statusBarFrameDidChange:]): (-[WKFullScreenViewController _updateWebViewFullscreenInsets]): (-[WKFullScreenViewController _showPhishingAlert]):
• UIProcess/ios/fullscreen/WKFullScreenWindowControllerIOS.mm: (-[WKFullScreenWindowController _completedExitFullScreen]):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@279287 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:33 AM Changeset in webkit [280852] by Peng Liu

• 2 edits in trunk/Source/WebKit

RemoteImageDecoderAVF::clearFrameBufferCache() uses a weak pointer without checking its validity
​https://bugs.webkit.org/show_bug.cgi?id=228925

Reviewed by Eric Carlson.

Only use m_gpuProcessConnection when it is a valid pointer.

• WebProcess/GPU/media/RemoteImageDecoderAVF.cpp:

(WebKit::RemoteImageDecoderAVF::clearFrameBufferCache):

10:30 AM Changeset in webkit [280851] by Russell Epstein

• 1 edit in branches/safari-611.3.10.0-branch/Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm

Apply patch. rdar://problem/80636822

10:29 AM Changeset in webkit [280850] by Megan Gardner

• 2 edits in trunk/Source/WebKit

Don't instantiate a SYNotesActivationObserver to just say that it's not active or visible.
​https://bugs.webkit.org/show_bug.cgi?id=228929
rdar://81634182

Reviewed by Wenson Hsieh.

If we do not have an SYNotesActivationObserver then we do not need to make one to say that it is not visible
or that it's not occuding the screen. This is a performance optimization for all WebViews that are not
in Safari as well as all pages that do not have highlights to restore.

• UIProcess/Cocoa/WebPageProxyCocoa.mm:

(WebKit::WebPageProxy::appHighlightsVisibility):
(WebKit::WebPageProxy::appHighlightsOverlayRect):

10:08 AM Changeset in webkit [280849] by Russell Epstein

• 6 edits
  1 add in branches/safari-611.3.10.0-branch

Cherry-pick r280507. rdar://problem/79730568

Improve OSR entry into Wasm loops with arguments
​https://bugs.webkit.org/show_bug.cgi?id=228595

Reviewed by Yusuke Suzuki.

JSTests:

Just a straightforward test that counts to 1M in a loop, to exercise both OSR entry and a loop with an argument at the same time.
100k iterations was not enough to reliably complete an OSR entry.

• wasm/stress/osr-entry-with-loop-arguments.js: Added. (async test):

Source/JavaScriptCore:

This patch has two parts:

• improve the Wasm OSR code to fully support loop arguments (just some plumbing to make sure that the right values are propagated)
• improve the B3 validator to fix a hole I noticed while writing the first part: we were not detecting code that introduce Upsilons in the wrong blocks. Naturally, this caused hard to debug issues, as B3 has no well-defined semantics for a Phi that is reached before the corresponding Upsilon(s).

• b3/B3Validate.cpp:
• wasm/WasmAirIRGenerator.cpp: (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck): (JSC::Wasm::AirIRGenerator::addLoop):
• wasm/WasmB3IRGenerator.cpp: (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck): (JSC::Wasm::B3IRGenerator::addLoop):
• wasm/WasmLLIntGenerator.cpp: (JSC::Wasm::LLIntGenerator::addLoop):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@280507 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:08 AM Changeset in webkit [280848] by Russell Epstein

• 2 edits in branches/safari-611.3.10.0-branch/Source/WebKit

Cherry-pick r279254. rdar://problem/80635931

Crash in WebFrameLoaderClient::dispatchDidStartProvisionalLoad after provisionalLoader is gone.
​https://bugs.webkit.org/show_bug.cgi?id=226979

Patch by Venky Dass <​yaranamavenkataramana@apple.com> on 2021-06-24
Reviewed by Ryosuke Niwa.

• WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp: (WebKit::WebFrameLoaderClient::dispatchDidStartProvisionalLoad):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@279254 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:08 AM Changeset in webkit [280847] by Russell Epstein

• 3 edits
  1 add in branches/safari-611.3.10.0-branch

Cherry-pick r275472. rdar://problem/81710596

DFG arity fixup nodes should exit to the caller's call opcode
​https://bugs.webkit.org/show_bug.cgi?id=223278

Reviewed by Saam Barati.

JSTests:

• stress/dfg-arity-fixup-uses-callers-exit-origin.js: Added. (main.v22): (main.v30): (main.try.v40): (main.try.v47): (main.try.v56): (main.): (main):

Source/JavaScriptCore:

Right now when we do arity fixup in the DFG we model it in the
same way that it executes, which means all the nodes are part of
the callee. Unfortunately, this causes PhantomInsertionPhase to
think those nodes could be replacing previously defined
VirtualRegisters as they are part of the callee's header (always
alive). When PhantomInsertionPhase then inserts a Phantom it will
put that node in the caller's frame as that's the first ExitOK
node. The caller however may have no knowledge of that
VirtualRegister though. For example:

--> foo: loc10 is a local in foo.

...
1: MovHint(loc10)
2: SetLocal(loc10)

<-- foo loc10 ten is now out of scope for the InlineCallFrame of the caller.
...
Phantom will be inserted here refering to loc10, which doesn't make sense.
--> bar loc10 is an argument to bar and needs arity fixup.

... All of these nodes are ExitInvalid
3: MovHint(loc10, ExitInvalid)
4: SetLocal(loc10, ExitInvalid)
...

• dfg/DFGByteCodeParser.cpp: (JSC::DFG::ByteCodeParser::currentNodeOrigin): (JSC::DFG::ByteCodeParser::inlineCall):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@275472 268f45cc-cd09-0410-ab3c-d52691b4dbfc

9:56 AM Changeset in webkit [280846] by commit-queue@webkit.org

• 4 edits in trunk/LayoutTests

[GLIB] Update crypto test baselines after r280790
​https://bugs.webkit.org/show_bug.cgi?id=228957

Unreviewed test gardening.

Patch by Arcady Goldmints-Orlov <Arcady Goldmints-Orlov> on 2021-08-10

• platform/glib/TestExpectations:
• platform/glib/crypto/subtle/aes-cbc-cfb-decrypt-malformed-parameters-expected.txt:
• platform/glib/crypto/subtle/aes-cbc-cfb-encrypt-malformed-parameters-expected.txt:

9:35 AM Changeset in webkit [280845] by Russell Epstein

• 8 edits in branches/safari-611.3.10.0-branch/Source

Versioning.

WebKit-7611.4.0.1

9:27 AM Changeset in webkit [280844] by Russell Epstein

• 1 delete in branches/safari-611.4-branch

Delete branch.

9:25 AM Changeset in webkit [280843] by Russell Epstein

• 1 copy in branches/safari-611.4-branch

New branch.

9:15 AM Changeset in webkit [280842] by Ayumi Kojima

• 2 edits in trunk/LayoutTests

[ MacOS ] inspector/canvas/shaderProgram-add-remove-webgl2.html is flaky.
​https://bugs.webkit.org/show_bug.cgi?id=228934

Unreviewed test gardening.

• platform/mac-wk2/TestExpectations:

8:20 AM Changeset in webkit [280841] by ddkilzer@apple.com

• 2 edits in trunk/Source/WebKit

ThreadSanitizer: data race in WTF::StringImpl::deref() under WebKit::WebProcessPool::setMediaAccessibilityPreferences()
<​https://webkit.org/b/228932>

Reviewed by Chris Dumez.

Covered by numerous layout tests running with TSan including:

crypto/crypto-random-values-types.html

• UIProcess/Cocoa/WebProcessPoolCocoa.mm:

(WebKit::WebProcessPool::setMediaAccessibilityPreferences):

• Make an isolatedCopy() of Vector<String> object before passing it to the main thread.

7:31 AM Changeset in webkit [280840] by Devin Rousso

• 9 edits in trunk

[macOS] REGRESSION(r278850): modifying playbackRate via JS on a TouchBar mac only sometimes works and also causes the defaultPlaybackRate to change
​https://bugs.webkit.org/show_bug.cgi?id=228939
<rdar://problem/80427578>

Reviewed by Eric Carlson.

Source/WebCore:

Test: VideoControlsManager.VideoControlsManagerDoesNotChangeValuesExposedToJavaScript

• platform/mac/PlaybackSessionInterfaceMac.mm:

(WebCore::PlaybackSessionInterfaceMac::rateChanged):
Make sure to change the defaultPlaybackRate before the rate as otherwise the former will
override changes made to the latter (see r278850 (and r277203) for details as to why).

• platform/mac/WebPlaybackControlsManager.h:
• platform/mac/WebPlaybackControlsManager.mm:

(-[WebPlaybackControlsManager setDefaultPlaybackRate:]):
(-[WebPlaybackControlsManager setDefaultPlaybackRate:fromJavaScript:]): Added.
(-[WebPlaybackControlsManager setRate:]):
(-[WebPlaybackControlsManager setRate:fromJavaScript:]): Added.
Add a way to distinguish whether the change to the rate/defaultPlaybackRate came from JS
or some native call (e.g. AVKit). If the former, don't propagate the change to the playback
model (which eventually is the HTMLMediaElement in the WebProcess) as that's where the
value came from in the first place. Note that we still want to propagate the rate to the
defaultPlaybackRate (and vice versa when isPlaying) in the UIProcess for the reasons
described in r278850 (and r277203), but we don't want to expose it to JS.

• platform/ios/PlaybackSessionInterfaceAVKit.mm:

(WebCore::PlaybackSessionInterfaceAVKit::rateChanged):

• platform/ios/WebAVPlayerController.h:
• platform/ios/WebAVPlayerController.mm:

(-[WebAVPlayerController setDefaultPlaybackRate:]):
(-[WebAVPlayerController setDefaultPlaybackRate:fromJavaScript:]): Added.
(-[WebAVPlayerController setRate:]):
(-[WebAVPlayerController setRate:fromJavaScript:]): Added.
Drive-by: r278850 was based r277203 (which added the above), so fix that code now too.

Tools:

• TestWebKitAPI/Tests/WebKitCocoa/VideoControlsManager.mm:

(TestWebKitAPI::TEST.VideoControlsManager.VideoControlsManagerDoesNotChangeValuesExposedToJavaScript): Added.

2:35 AM Changeset in webkit [280839] by Adrian Perez de Castro

• 53 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274172 - [IPC Hardening] Protect against bad input in WebProcessProxy::createSpeechRecognitionServer() and MessageReceiverMap
​https://bugs.webkit.org/show_bug.cgi?id=222948
<rdar://problem/75191472>

Reviewed by Alex Christensen.

Update MessageReceiverMap so that:

1. Trying to remove a MessageReceiver that is not in the map does not do dangerous things.
2. It stores weak pointers to the receivers instead of raw pointers. This would avoid doing bad things when trying to remove a message receiver that's already been destroyed.

Add a MESSAGE_CHECK() in WebProcessProxy::createSpeechRecognitionServer() to
make sure the identifier is not already in the map. There used to be a debug
assertion but we should MESSAGE_CHECK() too since the value is coming from
IPC.

• GPUProcess/GPUConnectionToWebProcess.h:
• GPUProcess/GPUProcess.h:
• GPUProcess/media/RemoteAudioSessionProxy.h:
• GPUProcess/media/RemoteCDMFactoryProxy.h:
• GPUProcess/media/RemoteCDMProxy.h:
• GPUProcess/media/RemoteLegacyCDMFactoryProxy.h:
• GPUProcess/media/RemoteLegacyCDMProxy.h:
• GPUProcess/media/RemoteLegacyCDMSessionProxy.h:
• GPUProcess/media/RemoteMediaEngineConfigurationFactoryProxy.h:
• GPUProcess/media/RemoteMediaPlayerManagerProxy.h:
• GPUProcess/media/RemoteMediaPlayerProxy.h:
• GPUProcess/media/RemoteMediaResourceManager.h:
• GPUProcess/webrtc/RemoteSampleBufferDisplayLayer.h:
• NetworkProcess/NetworkProcess.h:
• NetworkProcess/ServiceWorker/WebSWServerConnection.h:
• NetworkProcess/ServiceWorker/WebSWServerToContextConnection.h:
• Platform/IPC/MessageReceiver.h:
• Platform/IPC/MessageReceiverMap.cpp:

(IPC::MessageReceiverMap::addMessageReceiver):
(IPC::MessageReceiverMap::removeMessageReceiver):
(IPC::MessageReceiverMap::dispatchMessage):
(IPC::MessageReceiverMap::dispatchSyncMessage):

• Platform/IPC/MessageReceiverMap.h:
• Shared/API/Cocoa/RemoteObjectRegistry.h:
• Shared/ApplePay/WebPaymentCoordinatorProxy.h:
• Shared/Authentication/AuthenticationManager.h:
• Shared/AuxiliaryProcess.h:
• UIProcess/GPU/GPUProcessProxy.h:
• UIProcess/Inspector/WebInspectorProxy.h:
• UIProcess/Inspector/WebInspectorUIExtensionControllerProxy.h:
• UIProcess/Media/AudioSessionRoutingArbitratorProxy.h:
• UIProcess/Network/CustomProtocols/LegacyCustomProtocolManagerProxy.h:
• UIProcess/Network/NetworkProcessProxy.h:
• UIProcess/ProvisionalPageProxy.h:
• UIProcess/SpeechRecognitionRemoteRealtimeMediaSourceManager.h:
• UIProcess/SpeechRecognitionServer.h:
• UIProcess/SuspendedPageProxy.h:
• UIProcess/WebAuthentication/WebAuthnProcessProxy.h:
• UIProcess/WebPageProxy.h:
• UIProcess/WebProcessPool.h:
• UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::createSpeechRecognitionServer):

• UIProcess/WebProcessProxy.h:
• WebAuthnProcess/WebAuthnProcess.h:
• WebProcess/GPU/GPUProcessConnection.h:
• WebProcess/GPU/graphics/RemoteRenderingBackendProxy.h:
• WebProcess/GPU/media/MediaPlayerPrivateRemote.h:
• WebProcess/GPU/media/MediaSourcePrivateRemote.h:
• WebProcess/GPU/media/SourceBufferPrivateRemote.h:
• WebProcess/GPU/webrtc/SampleBufferDisplayLayer.h:
• WebProcess/Inspector/WebInspectorUIExtensionController.h:
• WebProcess/Network/WebSocketChannel.h:
• WebProcess/Speech/SpeechRecognitionRealtimeMediaSourceManager.h:
• WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.h:
• WebProcess/WebPage/WebPage.h:
• WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
• WebProcess/WebStorage/StorageAreaMap.h:

2:33 AM Changeset in webkit [280838] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274160 - [IPC Hardening] IPC::decode(Decoder& decoder, RetainPtr<CFDictionaryRef>&) should make sure keys & values aren't null
​https://bugs.webkit.org/show_bug.cgi?id=222980

Reviewed by Geoffrey Garen.

[NSMutableDictionary setObject:forKey:] throws an exception when the given object or key is nil. The dictionary decoder
should therefore fail nicely when either of these is nil, instead of crashing.

• Shared/cf/ArgumentCodersCF.cpp:

(IPC::decode):

2:31 AM Changeset in webkit [280837] by Adrian Perez de Castro

• 3 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274158 - [IPC Hardening] SandboxExtension::HandleArray IPC decoder should not call Vector::resize()
​https://bugs.webkit.org/show_bug.cgi?id=222977
<rdar://problem/75218451>

Reviewed by Anders Carlsson.

SandboxExtension::HandleArray IPC decoder should not call Vector::resize() with an untrusted size
coming from IPC. Instead, call Vector::append(), like the Vector IPC decoder does.

• Shared/Cocoa/SandboxExtensionCocoa.mm:

(WebKit::SandboxExtension::HandleArray::append):
(WebKit::SandboxExtension::HandleArray::decode):

• Shared/SandboxExtension.h:

(WebKit::SandboxExtension::append):

2:29 AM Changeset in webkit [280836] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274153 - [IPC Hardening] Protect WebPageProxy::willSubmitForm() against bad Strings
​https://bugs.webkit.org/show_bug.cgi?id=222955
<rdar://problem/75195062>

Reviewed by Anders Carlsson.

The Strings passed in textFieldValues are used as keys in a HashMap later on so we need
to validate them.

• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::willSubmitForm):

2:28 AM Changeset in webkit [280835] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274146 - Suspend widget hierarchy updates while executing node insertion
​https://bugs.webkit.org/show_bug.cgi?id=222719

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-03-09
Reviewed by Ryosuke Niwa.

• dom/ContainerNode.cpp:

(WebCore::executeNodeInsertionWithScriptAssertion):

2:27 AM Changeset in webkit [280834] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274144 - [Multi-column] Adjust fragmented flow state of the out-of-flow descendants
​https://bugs.webkit.org/show_bug.cgi?id=222958
<rdar://74865741>

Reviewed by Antti Koivisto.

When a block container's style change from positioned to non-positioned and it is part of a multi-column context,
we need to make sure that the out-of-flow positined descendants' flow state are updated accordingly (as
they may not be part of the multi-column context anymore).

• rendering/RenderElement.cpp:

(WebCore::RenderElement::adjustFragmentedFlowStateOnContainingBlockChangeIfNeeded):

2:27 AM Changeset in webkit [280833] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r274131 - Crash in in ReplaceSelectionCommand::mergeEndIfNeeded()
​https://bugs.webkit.org/show_bug.cgi?id=222941

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Make a copy of Ref<HTMLBRElement> when inserting before start of paragraph.

• editing/ReplaceSelectionCommand.cpp:

(WebCore::ReplaceSelectionCommand::mergeEndIfNeeded):

2:22 AM Changeset in webkit [280832] by Adrian Perez de Castro

• 3 edits
  2 adds in releases/WebKitGTK/webkit-2.32

Merge r274064 - REGRESSION(r272900): Nullptr crash in ComposedTreeIterator::traverseNextInShadowTree() via ShadowRoot::hostChildElementDidChange
​https://bugs.webkit.org/show_bug.cgi?id=222720

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2021-03-08
Reviewed by Ryosuke Niwa.

Source/WebCore:

The list of assigned nodes contains weak pointers, we should check the node hasn't been destroyed.

Test: fast/html/details-set-inner-text-crash.html

• dom/ComposedTreeIterator.cpp:

(WebCore::ComposedTreeIterator::traverseNextInShadowTree):

LayoutTests:

• fast/html/details-set-inner-text-crash-expected.txt: Added.
• fast/html/details-set-inner-text-crash.html: Added.

2:22 AM Changeset in webkit [280831] by Adrian Perez de Castro

• 3 edits in releases/WebKitGTK/webkit-2.32/Source/WebKit

Merge r274027 - [IPC Hardening] Protect against bad navigationID in WebPageProxy::didDestroyNavigation()
​https://bugs.webkit.org/show_bug.cgi?id=222842
<rdar://problem/75119560>

Reviewed by Darin Adler.

• UIProcess/WebNavigationState.h:
• UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::didDestroyNavigation):

2:20 AM Changeset in webkit [280830] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r273938 - Deploy Ref<T> in SVGUseElement.cpp
​https://bugs.webkit.org/show_bug.cgi?id=222637

Patch by Julian Gonzalez <​julian_a_gonzalez@apple.com> on 2021-03-04
Reviewed by Ryosuke Niwa.

Remove usage of raw pointers in a few functions here
that showed issues in 222397.

Thanks to Darin Adler for the initial version of this patch
and Ryosuke Niwa for refinements.

• svg/SVGUseElement.cpp:

(WebCore::disassociateAndRemoveClones):
(WebCore::removeDisallowedElementsFromSubtree):
(WebCore::removeSymbolElementsFromSubtree):

2:19 AM Changeset in webkit [280829] by Adrian Perez de Castro

• 11 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r273935 - "precustomized" state of custom elements can become HTMLUnknownElement
​https://bugs.webkit.org/show_bug.cgi?id=221652

Reviewed by Darin Adler.

The bug was caused by createJSHTMLWrapper in JSHTMLElementWrapperFactory.cpp relying on
!isCustomElementUpgradeCandidate() to create HTMLUnknownElement as JS wrapper of the element.

This is problematic after r266269 since that change re-purposes CustomElementState::Failed
on a custom element as "precustomized" state instead of introducing another enum value in
CustomElementState as RareDataBitFields has no more bits available.

This patch fixes the problem by introducing a new NodeFlag::IsUnknownElement and using that
to check whether JSHTMLUnknownElement should be created for a given element or not. Note that
HTMLElement had a virtual function, isHTMLUnknownElement, to check this condition but invoking
a virtual function proved to incur too much runtime cost.

• dom/Node.h:

(WebCore::Node::isUnknownElement const): Added.
(WebCore::Node::isHTMLUnknownElement const): Added.
(WebCore::Node::isSVGUnknownElement const): Added.
(WebCore::Node::isMathMLUnknownElement const): Added.
(WebCore::Node::NodeFlag): Added NodeFlag::IsUnknownElement.

• dom/make_names.pl:

(printWrapperFactoryCppFile): Treat the element as HTMLUnknownElement only if isUnknownElement
returns true instead of isCustomElementUpgradeCandidate returning false.

• html/HTMLElement.h:

(WebCore::HTMLElement::isHTMLUnknownElement const): Deleted.

• html/HTMLUnknownElement.h:
• mathml/MathMLElement.cpp:

(WebCore::MathMLElement::MathMLElement): Added ConstructionType as an argument.

• mathml/MathMLElement.h:
• mathml/MathMLUnknownElement.h:

(WebCore::MathMLUnknownElement::MathMLUnknownElement): Set NodeFlag::IsUnknownElement.

• svg/SVGElement.cpp:

(WebCore::SVGElement::SVGElement): Added ConstructionType as an argument.

• svg/SVGElement.h:
• svg/SVGUnknownElement.h:

(WebCore::SVGUnknownElement::SVGUnknownElement): Set NodeFlag::IsUnknownElement.

1:57 AM Changeset in webkit [280828] by Adrian Perez de Castro

• 2 edits in releases/WebKitGTK/webkit-2.32/Source/WebCore

Merge r273692 - Protect AudioWorkletGlobalScope::registerProcessor() against re-entry
​https://bugs.webkit.org/show_bug.cgi?id=222567
<rdar://74860464>

Reviewed by Eric Carlson.

AudioWorkletGlobalScope::registerProcessor() checks if 'name' is in m_processorConstructorMap
then does some checks that potentially run JS and thus call registerProcessor() again (potentially
with the same name). To address this, we now check the map again after potentially running the
JS code.

• Modules/webaudio/AudioWorkletGlobalScope.cpp:

(WebCore::AudioWorkletGlobalScope::registerProcessor):

1:41 AM Changeset in webkit [280827] by cathiechen

• 4 edits
  4 adds in trunk/LayoutTests

Import css/css-sizing/aspect-ratio tests from WPT
​https://bugs.webkit.org/show_bug.cgi?id=228945

LayoutTests/imported/w3c:

Import css/css-sizing/aspect-ratio tests from WPT commit dd5aead14c.

Reviewed by Rob Buis.

• web-platform-tests/css/css-sizing/aspect-ratio/flex-aspect-ratio-029-expected.xht: Added.
• web-platform-tests/css/css-sizing/aspect-ratio/flex-aspect-ratio-029.html: Added.
• web-platform-tests/css/css-sizing/aspect-ratio/flex-aspect-ratio-030-expected.xht: Added.
• web-platform-tests/css/css-sizing/aspect-ratio/flex-aspect-ratio-030.html: Added.
• web-platform-tests/css/css-sizing/aspect-ratio/w3c-import.log:

LayoutTests:

Reviewed by Rob Buis.

• TestExpectations:

1:25 AM Changeset in webkit [280826] by ysuzuki@apple.com

• 8 edits in trunk

Partially revert r280256 behavior change since it broke Facetime
​https://bugs.webkit.org/show_bug.cgi?id=228943
rdar://81700268

Reviewed by Mark Lam.

Source/WebCore:

In r280256, custom accessors start getting holder's JSGlobalObject (this is right behavior).
We also introduced IncumbentWindow IDL attribute to get the caller's JSGlobalObject, which is
necessary in Location. At that time, we replaced all ActiveWindow to IncumbentWindow, but it
changes the JSGlobalObject of replace, assign, and reload since they are functions (not
custom accessors). We observed that, after this change, facetime Web page is broken: when opening
the link to Facetime, it should show the prompt of "Open in Facetime app" in iOS. But after this
change, it won't happen.

We revert the semantic change by using ActiveWindow for replace, assign, and reload. This is
not the correct semantics from the spec, but this is the same to one before r280256, and we
will change this once we find the way to bypass this issue.

• page/Location.cpp:

(WebCore::Location::assign):
(WebCore::Location::replace):
(WebCore::Location::reload):

• page/Location.h:
• page/Location.idl:

LayoutTests:

• fast/frames/sandboxed-iframe-navigation-parent-expected.txt:
• fast/frames/sandboxed-iframe-navigation-parent.html:
• http/tests/security/frameNavigation/context-for-location-assign-expected.txt: