Context Navigation

← Previous Period
Next Period →

Timeline

Apr 27, 2016:

11:54 PM Changeset in webkit [200177] by mark.lam@apple.com

8 edits in trunk/Source/JavaScriptCore

The GetterSetter structure needs a globalObject.
https://bugs.webkit.org/show_bug.cgi?id=157120

Reviewed by Filip Pizlo.

In r199170: <http://trac.webkit.org/r199170>, GetterSetter was promoted from
being a JSCell to a JSObject. JSObject methods expect their structure to have a
globalObject. For example, see JSObject::calculatedClassName(). GetterSetter
was previously using a singleton getterSetterStructure owned by the VM. That
singleton getterSetterStructure is not associated with any globalObjects. As a
result, JSObject::calculatedClassName() will run into a null globalObject when it
is called on a GetterSetter object.

This patch removes the VM singleton getterSetterStructure, and instead, creates
a getterSetterStructure for each JSGlobalObject.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGStructureRegistrationPhase.cpp:

(JSC::DFG::StructureRegistrationPhase::run):

runtime/GetterSetter.h:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::functionStructure):
(JSC::JSGlobalObject::boundFunctionStructure):
(JSC::JSGlobalObject::boundSlotBaseFunctionStructure):
(JSC::JSGlobalObject::getterSetterStructure):
(JSC::JSGlobalObject::nativeStdFunctionStructure):
(JSC::JSGlobalObject::namedFunctionStructure):
(JSC::JSGlobalObject::functionNameOffset):

runtime/VM.cpp:

(JSC::VM::VM):

runtime/VM.h:

11:49 PM Changeset in webkit [200176] by Carlos Garcia Campos

7 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r200173 - [GTK] Overlay scrollbars with steppers enabled render incorrectly
https://bugs.webkit.org/show_bug.cgi?id=156988

Reviewed by Michael Catanzaro.

Fix rendering of scrollbars when using GTK+ themes having stepper buttons.

platform/gtk/RenderThemeGadget.cpp:

(WebCore::RenderThemeBoxGadget::RenderThemeBoxGadget): Receive the box orientation as constructor parameter.
(WebCore::RenderThemeBoxGadget::preferredSize): Fix the preferred size calculation taking into account the box orientation.
(WebCore::RenderThemeScrollbarGadget::renderStepper): New method to render scrollbar steppers.

platform/gtk/RenderThemeGadget.h:

(WebCore::RenderThemeGadget::context): Make this public instead of protected.

platform/gtk/ScrollAnimatorGtk.cpp:

(WebCore::ScrollAnimatorGtk::updateOverlayScrollbarsOpacity): Invalidate the whole scrollbars instead of just
the thumb when opacity changes, because themes can actually render the trough or even stepper buttons when in
indicator mode too.

platform/gtk/ScrollbarThemeGtk.cpp:

(WebCore::ScrollbarThemeGtk::hasButtons): Properly implement this method instead of returning true unconditionally.
(WebCore::contentsGadgetForLayout): Pass orientation to RenderThemeBoxGadget constructor.
(WebCore::ScrollbarThemeGtk::trackRect): Fix the calculation of the track rect taking stepper buttons into account.
(WebCore::ScrollbarThemeGtk::backButtonRect): Fix the calculation of the stepper button rectangle.
(WebCore::ScrollbarThemeGtk::forwardButtonRect): Ditto.
(WebCore::ScrollbarThemeGtk::paint): Use RenderThemeScrollbarGadget::renderStepper() to render the stepper
buttons, and fix the calculation of the steppers button rectangle.
(WebCore::ScrollbarThemeGtk::handleMousePressEvent): Handle clicks on stepper buttons.
(WebCore::ScrollbarThemeGtk::scrollbarThickness): Fix the calculation of the scrollbar thickness.
(WebCore::ScrollbarThemeGtk::minimumThumbLength): Pass orientation to RenderThemeBoxGadget constructor.

platform/gtk/ScrollbarThemeGtk.h:
rendering/RenderThemeGtk.cpp:

(WebCore::menuListColor): Ditto.
(WebCore::RenderThemeGtk::popupInternalPaddingBox): Ditto.
(WebCore::RenderThemeGtk::paintMenuList): Ditto.

11:46 PM Changeset in webkit [200175] by ap@apple.com

2 edits in trunk/Tools

Don't throttle GuardMalloc on 8-core Macs
https://bugs.webkit.org/show_bug.cgi?id=157108

Reviewed by Alex Christensen.

This was making them slower unnecessarily.

Scripts/webkitpy/port/mac.py: (MacPort.default_child_processes):

11:23 PM Changeset in webkit [200174] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r200125 - [GTK] Fails to build randomly when generating LLIntDesiredOffsets.h
https://bugs.webkit.org/show_bug.cgi?id=155427

Reviewed by Carlos Garcia Campos.

If the build directory contains the -I string, the script that
generates LLIntDesiredOffsets.h will confuse it with an option to
declare an include directory.

In order to avoid that we should only use the arguments that start
with -I when extracting the list of include directories, instead
of using the ones that simply contain that string.

offlineasm/parser.rb:

11:20 PM Changeset in webkit [200173] by Carlos Garcia Campos

7 edits in trunk/Source/WebCore

[GTK] Overlay scrollbars with steppers enabled render incorrectly
https://bugs.webkit.org/show_bug.cgi?id=156988

Reviewed by Michael Catanzaro.

Fix rendering of scrollbars when using GTK+ themes having stepper buttons.

platform/gtk/RenderThemeGadget.cpp:

platform/gtk/RenderThemeGadget.h:

(WebCore::RenderThemeGadget::context): Make this public instead of protected.

platform/gtk/ScrollAnimatorGtk.cpp:

platform/gtk/ScrollbarThemeGtk.cpp:

platform/gtk/ScrollbarThemeGtk.h:
rendering/RenderThemeGtk.cpp:

(WebCore::menuListColor): Ditto.
(WebCore::RenderThemeGtk::popupInternalPaddingBox): Ditto.
(WebCore::RenderThemeGtk::paintMenuList): Ditto.

10:41 PM Changeset in webkit [200172] by mitz@apple.com

2 edits in trunk/Source/WebKit2

<rdar://problem/25915253> REGRESSION (r199628): Netflix playback fails in Safari Technology Preview with error code S7363-1260-FFFF58D8

Rubber-stamped by Tim Horton.

Reverted r199628.

Configurations/WebContentService.xcconfig:

10:27 PM Changeset in webkit [200171] by Simon Fraser

4 edits in trunk/Source/WebCore

SVG SMIL animations run at less than 60fps
https://bugs.webkit.org/show_bug.cgi?id=157119
rdar://problem/25971304

Reviewed by Tim Horton.

If you re-fetch current time while doing animation computations you're gonna have
a bad time.

More specifically, SMILTimeContainer::startTimer() re-fetched elapsedTime() when
computing the delay for the next timer fire, then clamped to 16.667ms, so the timer
would actually be scheduled at intervals greater than desired, causing a ~54fps framerate.

Fix by using the elapsedTime fetched at the start of animation processing.

Tested by iOS content-animation performance tests.

svg/SVGSVGElement.cpp:

(WebCore::SVGSVGElement::SVGSVGElement): Just cleanup.

svg/animation/SMILTimeContainer.cpp:

(WebCore::SMILTimeContainer::notifyIntervalsChanged):
(WebCore::SMILTimeContainer::resume):
(WebCore::SMILTimeContainer::startTimer):
(WebCore::SMILTimeContainer::updateAnimations):

svg/animation/SMILTimeContainer.h:

9:57 PM Changeset in webkit [200170] by bshafiei@apple.com

2 edits in tags/Safari-602.1.30/Source/WebCore

Merged r200151. rdar://problem/25964854

9:55 PM Changeset in webkit [200169] by bshafiei@apple.com

2 edits in tags/Safari-602.1.30/Source/JavaScriptCore

Merged r200147. rdar://problem/25963453

8:33 PM Changeset in webkit [200168] by beidson@apple.com

2 edits in trunk/Source/WebCore

Build fix followup to r200163

Unreviewed.

platform/efl/FileSystemEfl.cpp:

(WebCore::stringFromFileSystemRepresentation): At least stub this out for now until EFL folks can do better.

7:11 PM Changeset in webkit [200167] by ggaren@apple.com

5 edits in trunk/Source/bmalloc

Assertion failure in bmalloc::vmRevokePermissions(void*, unsigned long).
https://bugs.webkit.org/show_bug.cgi?id=157047

Reviewed by Darin Adler.

bmalloc/Chunk.h:

(bmalloc::Chunk::Chunk):
(bmalloc::Chunk::get):
(bmalloc::Chunk::offset):
(bmalloc::Chunk::address):
(bmalloc::Object::Object):
(bmalloc::Object::address):
(bmalloc::Object::line):
(bmalloc::Chunk::object): Deleted.
(bmalloc::Object::begin): Deleted.

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateSmallBumpRangesByObject):

bmalloc/Object.h:

(bmalloc::Object::chunk):
(bmalloc::Object::offset): Renamed begin() to address() because this is
not an iterator.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::allocateSmallChunk): Round up pageSize to a vmPageSize
multiple because pageSize might be smaller than vmPageSize, but we
think the VM system requires vmPageSize-aligned values.

6:54 PM Changeset in webkit [200166] by sbarati@apple.com

3 edits in trunk/Source/WebCore

Move the implementation of Settings::globalConstRedeclarationShouldThrow into the cpp file
https://bugs.webkit.org/show_bug.cgi?id=157109

Rubber-stamped by Geoffrey Garen.

page/Settings.cpp:

(WebCore::Settings::networkInterfaceName):
(WebCore::Settings::globalConstRedeclarationShouldThrow):

page/Settings.h:

(WebCore::Settings::shouldUseHighResolutionTimers):
(WebCore::Settings::backgroundShouldExtendBeyondPage):
(WebCore::Settings::globalConstRedeclarationShouldThrow): Deleted.

6:53 PM Changeset in webkit [200165] by dino@apple.com

4 edits
3 adds in trunk

RTL non-native <select> buttons should have arrows on the left
https://bugs.webkit.org/show_bug.cgi?id=157112
<rdar://problem/25894441>

Reviewed by Simon Fraser.

Source/WebCore:

The <select> elements that are completely rendered by WebCore
(i.e. not the native controls) always assumed that they
were left-to-right.

This change allows the button to handle both directions,
swapping the side the little arrows are rendered on, as
well as the padding of the text label.

Test: fast/forms/select-non-native-rendering-direction.html

rendering/RenderMenuList.cpp:

(RenderMenuList::clientPaddingLeft): This must take into account
the direction of the element.
(RenderMenuList::clientPaddingRight): Ditto.

rendering/RenderThemeMac.mm: Change the left and right constants

to use the terms before and after.
(WebCore::RenderThemeMac::paintMenuListButtonDecorations): The left
and right positions must take the direction into account, which
means different calculations.
(WebCore::RenderThemeMac::popupInternalPaddingBox): Similarly for
the padding that is used to position the text label.

LayoutTests:

New test that checks the layout of WebCore-drawn <select>
elements in right-to-left mode.

fast/forms/select-non-native-rendering-direction.html: Added.
platform/mac/fast/forms/select-non-native-rendering-direction-expected.png: Added.
platform/mac/fast/forms/select-non-native-rendering-direction-expected.txt: Added.

6:33 PM Changeset in webkit [200164] by Simon Fraser

5 edits in trunk/Source/WebCore

CSS and SVG animations should run at 60fps
https://bugs.webkit.org/show_bug.cgi?id=157113
rdar://problem/24337280
rdar://problem/24337328

Reviewed by Dean Jackson.

For both CSS and SVG animations we used a 0.025s frame interval, which translates to
40fps. That caused these animations to look extra janky compared with accelerated
animations.

So use a 16.667ms frame interval for both.

Tested by content-animation benchmark tests.

page/animation/AnimationController.cpp:
svg/animation/SMILTime.h:
svg/animation/SMILTimeContainer.cpp:

(WebCore::SMILTimeContainer::updateAnimations):

svg/animation/SVGSMILElement.cpp:

(WebCore::SVGSMILElement::calculateNextProgressTime):

6:16 PM Changeset in webkit [200163] by beidson@apple.com

45 edits in trunk

Modern IDB: Implement native IDBFactory.getAllDatabaseNames for WebInspector.
https://bugs.webkit.org/show_bug.cgi?id=157072

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (Covered by changes to existing test).

Implement a new "getAllDatabaseNames" call on IDBFactory.

It is not exposed to the DOM, and is meant solely for internal WebInspector use.

Modules/indexeddb/DOMWindowIndexedDatabase.h: Export some stuff to WebCoreTestSupport

Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::createObjectStore):

Modules/indexeddb/IDBDatabaseIdentifier.cpp:

(WebCore::IDBDatabaseIdentifier::databaseDirectoryRelativeToRoot):

Modules/indexeddb/IDBDatabaseIdentifier.h:

Modules/indexeddb/IDBFactory.cpp:

(WebCore::IDBFactory::getAllDatabaseNames):

Modules/indexeddb/IDBFactory.h:

Modules/indexeddb/client/IDBConnectionProxy.cpp:

(WebCore::IDBClient::IDBConnectionProxy::getAllDatabaseNames):

Modules/indexeddb/client/IDBConnectionProxy.h:

Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::getAllDatabaseNames):
(WebCore::IDBClient::IDBConnectionToServer::didGetAllDatabaseNames):

Modules/indexeddb/client/IDBConnectionToServer.h:
Modules/indexeddb/client/IDBConnectionToServerDelegate.h:

Modules/indexeddb/server/IDBConnectionToClient.cpp:

(WebCore::IDBServer::IDBConnectionToClient::didGetAllDatabaseNames):

Modules/indexeddb/server/IDBConnectionToClient.h:
Modules/indexeddb/server/IDBConnectionToClientDelegate.h:

Modules/indexeddb/server/IDBServer.cpp:

(WebCore::IDBServer::IDBServer::getAllDatabaseNames):
(WebCore::IDBServer::IDBServer::performGetAllDatabaseNames): Do the actual work of getting

the appropriate directory listing and converting the paths to database names.

(WebCore::IDBServer::IDBServer::didGetAllDatabaseNames):

Modules/indexeddb/server/IDBServer.h:

Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:

(WebCore::IDBServer::SQLiteIDBBackingStore::databaseNameFromEncodedFilename): Helper for IDBServer.

Modules/indexeddb/server/SQLiteIDBBackingStore.h:

Modules/indexeddb/shared/InProcessIDBServer.cpp:

(WebCore::InProcessIDBServer::getAllDatabaseNames):
(WebCore::InProcessIDBServer::didGetAllDatabaseNames):

Modules/indexeddb/shared/InProcessIDBServer.h:

inspector/InspectorIndexedDBAgent.cpp:

(WebCore::InspectorIndexedDBAgent::requestDatabaseNames): Use the new IDBFactory API to

asynchronously get the list of database names.

platform/CrossThreadCopier.cpp:

(WebCore::SecurityOriginData>::copy):
(WebCore::Vector<String>>::copy):

platform/CrossThreadCopier.h:

platform/FileSystem.cpp:

(WebCore::decodeFromFilename): Perform the reverse of encodeForFilename.

platform/FileSystem.h:

platform/cf/FileSystemCF.cpp:

(WebCore::stringFromFileSystemRepresentation):

platform/glib/FileSystemGlib.cpp:

(WebCore::stringFromFileSystemRepresentation):

platform/posix/FileSystemPOSIX.cpp:

(WebCore::lastComponentOfPathIgnoringTrailingSlash): Utility for peeling off the last component

of a multi-component path.

(WebCore::listDirectory): This was broken when returning filenames with UTF in them. Fix it.

platform/mac/WebCoreNSURLExtras.mm: Move the static hex digit utility functions to WTF.

(WebCore::userVisibleString):
(WebCore::isUserVisibleURL):
(WebCore::isHexDigit): Deleted.
(WebCore::hexDigit): Deleted.
(WebCore::hexDigitValue): Deleted.

Source/WebKit2:

Handle the process hop for the new getAllDatabaseNames call.

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.cpp:

(WebKit::WebIDBConnectionToClient::didGetAllDatabaseNames):
(WebKit::WebIDBConnectionToClient::getAllDatabaseNames):

DatabaseProcess/IndexedDB/WebIDBConnectionToClient.h:
DatabaseProcess/IndexedDB/WebIDBConnectionToClient.messages.in:

Shared/WebCrossThreadCopier.cpp:

(WebCore::SecurityOriginData>::copy): Deleted, as its in WebCore now.

Shared/WebCrossThreadCopier.h:

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::getAllDatabaseNames):
(WebKit::WebIDBConnectionToServer::didGetAllDatabaseNames):

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.h:
WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.messages.in:

Source/WTF:

Moved these Hex Digit utilities from WebCore URL code (???),
and add a checked version of getting the hex digit value.

wtf/HexNumber.h:

(WTF::isHexDigit):
(WTF::uncheckedHexDigit):
(WTF::hexDigitValue):
(WTF::uncheckedHexDigitValue):

LayoutTests:

Add more to this test and re-enable it.

TestExpectations:
inspector/indexeddb/requestDatabaseNames-expected.txt:
inspector/indexeddb/requestDatabaseNames.html:

4:53 PM Changeset in webkit [200162] by enrica@apple.com

5 edits in trunk/Source/WebCore

Refactor findExplodedTextNodeAtPoint to move core functionality in RenderBlockFlow.
https://bugs.webkit.org/show_bug.cgi?id=157076

Reviewed by Simon Fraser.

bindings/objc/DOMUIKitExtensions.mm:

(-[DOMNode findExplodedTextNodeAtPoint:]):

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::findClosestTextAtAbsolutePoint):

rendering/RenderBlockFlow.h:
rendering/RenderText.h:

4:51 PM Changeset in webkit [200161] by Simon Fraser

10 edits in trunk/Source

[iOS WK2] When determining tile size, check whether ancestor UIScrollViews are actually scrollable
https://bugs.webkit.org/show_bug.cgi?id=157107
rdar://problem/25943577

Reviewed by Tim Horton.
Source/WebCore:

Rename "enclosedInScrollView" to "enclosedInScrollableAncestorView" everywhere.

page/FrameView.cpp:

(WebCore::FrameView::adjustTiledBackingScrollability):

page/Page.h:

(WebCore::Page::enclosedInScrollableAncestorView):
(WebCore::Page::setEnclosedInScrollableAncestorView):
(WebCore::Page::enclosedInScrollView): Deleted.
(WebCore::Page::setEnclosedInScrollView): Deleted.

Source/WebKit2:

We should only fall back to 512x512 tiles if the WKWebView has a UIScrollView ancestor,
and that UIScrollView actually scrolls. This avoids falling back to small tiles in
MobileSafari.

Rename "enclosedInScrollView" to "enclosedInScrollableAncestorView" everywhere.

Shared/VisibleContentRectUpdateInfo.cpp:

(WebKit::VisibleContentRectUpdateInfo::encode):
(WebKit::VisibleContentRectUpdateInfo::decode):

Shared/VisibleContentRectUpdateInfo.h:

(WebKit::VisibleContentRectUpdateInfo::VisibleContentRectUpdateInfo):
(WebKit::VisibleContentRectUpdateInfo::enclosedInScrollableAncestorView):
(WebKit::operator==):
(WebKit::VisibleContentRectUpdateInfo::enclosedInScrollView): Deleted.

UIProcess/API/Cocoa/WKWebView.mm:

(scrollViewCanScroll):
(-[WKWebView _updateContentRectsWithState:]):

UIProcess/ios/WKContentView.h:
UIProcess/ios/WKContentView.mm:

(-[WKContentView didUpdateVisibleRect:unobscuredRect:unobscuredRectInScrollViewCoordinates:obscuredInset:scale:minimumScale:inStableState:isChangingObscuredInsetsInteractively:enclosedInScrollableAncestorView:]):
(-[WKContentView didUpdateVisibleRect:unobscuredRect:unobscuredRectInScrollViewCoordinates:obscuredInset:scale:minimumScale:inStableState:isChangingObscuredInsetsInteractively:enclosedInScrollView:]): Deleted.

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::updateVisibleContentRects):

4:51 PM Changeset in webkit [200160] by Simon Fraser

6 edits
1 add in trunk/LayoutTests

Test gardening; update results of tests that are marked as flakey.

TestExpectations:
platform/mac/transitions/cross-fade-background-image-expected.png:
platform/mac/transitions/cross-fade-background-image-expected.txt: Added.
platform/mac/transitions/cross-fade-border-image-expected.png:
platform/mac/transitions/cross-fade-border-image-expected.txt:
platform/mac/transitions/move-after-transition-expected.png:
platform/mac/transitions/move-after-transition-expected.txt:

4:32 PM Changeset in webkit [200159] by Michael Catanzaro

2 edits in trunk/Source/WebCore

[SOUP] Implement PlatformCookieJar::addCookie
https://bugs.webkit.org/show_bug.cgi?id=156295

Reviewed by Carlos Garcia Campos.

platform/network/soup/CookieJarSoup.cpp:

(WebCore::msToSoupDate):
(WebCore::toSoupCookie):
(WebCore::addCookie):

4:31 PM Changeset in webkit [200158] by Chris Dumez

6 edits in trunk/Source/WebCore

Let the bindings generator use WTF::Optional for optional parameters using [Clamp]
https://bugs.webkit.org/show_bug.cgi?id=157077

Reviewed by Darin Adler.

Let the bindings generator use WTF::Optional for optional parameters using [Clamp],
if they do not have a default value.

Modules/websockets/WebSocket.cpp:

(WebCore::WebSocket::close):

Modules/websockets/WebSocket.h:
Modules/websockets/WebSocket.idl:
bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameter): Deleted.

4:24 PM Changeset in webkit [200157] by adachan@apple.com

10 edits in trunk/Source

Set WebVideoFullscreenInterfaceMac up as a client of WebPlaybackSessionInterfaceMac to listen for playback state changes
https://bugs.webkit.org/show_bug.cgi?id=157008

Reviewed by Jer Noble.

Source/WebCore:

For WebVideoFullscreenInterfaceMac to be notified when the playback rate changes in
WebPlaybackSessionInterfaceMac, add a new WebPlaybackSessionInterfaceMacClient base
class that WebVideoFullscreenInterfaceMac implements, similar to the WebPlaybackSessionInterfaceAVKitClient
on iOS. WebVideoFullscreenInterfaceMac sets itself as a client of WebPlaybackSessionInterfaceMac
so WebPlaybackSessionInterfaceMac can notify WebVideoFullscreenInterfaceMac whenever the
playback rate changes.

platform/cocoa/WebVideoFullscreenModelVideoElement.mm:

(WebVideoFullscreenModelVideoElement::setWebVideoFullscreenInterface):
We should not change the WebPlaybackSessionModelMediaElement's interface here since WebPlaybackSessionManager
has already set that up when creating the context for this media element.
(WebVideoFullscreenModelVideoElement::setVideoElement):
We should not change the WebPlaybackSessionModelMediaElement's media element here because
this will be called with NULL when the fullscreen context is cleaned up, but the
WebPlaybackSessionModelMediaElement might still need to stay around. We'll make sure the
WebPlaybackSessionModelMediaElement's media element is set when setting up the fullscreen
context in WebVideoFullscreenManager::enterVideoFullscreenForVideoElement().

platform/mac/WebPlaybackSessionInterfaceMac.h:

(WebCore::WebPlaybackSessionInterfaceMacClient::~WebPlaybackSessionInterfaceMacClient):

platform/mac/WebPlaybackSessionInterfaceMac.mm:

(WebCore::WebPlaybackSessionInterfaceMac::setClient):
Set the client. Notify the client about the current playback state.
(WebCore::WebPlaybackSessionInterfaceMac::setRate):
If a client is set, let that client know about the change in playback rate.

platform/mac/WebVideoFullscreenInterfaceMac.h:
platform/mac/WebVideoFullscreenInterfaceMac.mm:

(WebCore::WebVideoFullscreenInterfaceMac::WebVideoFullscreenInterfaceMac):
Set itself as a client of WebPlaybackSessionInterfaceMac.
(WebCore::WebVideoFullscreenInterfaceMac::~WebVideoFullscreenInterfaceMac):
Make sure WebPlaybackSessionInterfaceMac won't hold onto a stale pointer to itself.
(WebCore::WebVideoFullscreenInterfaceMac::setRate):
We don't have to update the WebVideoFullscreenInterfaceMac's rate here anymore. The change
in playback rate in WebPlaybackSessionInterfaceMac should trigger
WebVideoFullscreenInterfaceMac::rateChanged() to be called.
(WebCore::WebVideoFullscreenInterfaceMac::rateChanged):
Pass in both the isPlaying state and the playback rate to WebVideoFullscreenInterfaceMacObjC.

Source/WebKit2:

Since WebVideoFullscreenInterfaceMac holds onto WebPlaybackSessionInterfaceMac, we can't let
WebPlaybackSessionManagerProxy unregister the context for that media element while
WebVideoFullscreenInterfaceMac is still using it. WebVideoFullscreenInterfaceMac should add
to the client count for that WebPlaybackSession context.

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::createModelAndInterface):
When the context for the media element is created with the WebVideoFullscreenManagerProxy, it should
add one to the client count for the media element context in WebPlaybackSessionManagerProxy.
(WebKit::WebVideoFullscreenManagerProxy::removeClientForContext):
When WebVideoFullscreenManagerProxy unregisters the context for this media element, it should
subtract one from the client count for the media element context in WebPlaybackSessionManagerProxy.

WebProcess/cocoa/WebPlaybackSessionManager.mm:

(WebKit::WebPlaybackSessionManager::clearPlaybackControlsManager):
Bail early if m_controlsManagerContextId is zero. Otherwise, we'd end up sending a
ClearPlaybackControlsManager message to the UI process inadvertently.
(WebKit::WebPlaybackSessionManager::contextIdForMediaElement):
Make sure the model element for the context ID is set to the media element.

WebProcess/cocoa/WebVideoFullscreenManager.mm:

(WebKit::WebVideoFullscreenManager::createModelAndInterface):
When the context for the media element is created with the WebVideoFullscreenManager, it should
add one to the client count for the media element context in WebPlaybackSessionManager.
(WebKit::WebVideoFullscreenManager::removeContext):
When WebVideoFullscreenManager unregisters the context for this media element, it should
subtract one from the client count for the media element context in WebPlaybackSessionManager.

3:53 PM Changeset in webkit [200156] by beidson@apple.com

2 edits in trunk/Source/WebCore

Modernize platform/CrossThreadCopier.h style.
https://bugs.webkit.org/show_bug.cgi?id=157106

Reviewed by Alex Christensen.

No new tests (No change in behavior).

platform/CrossThreadCopier.h:

(WebCore::CrossThreadCopierPassThrough::copy):
(WebCore::AllowCrossThreadAccessWrapper::AllowCrossThreadAccessWrapper):
(WebCore::AllowCrossThreadAccessWrapper::value):
(WebCore::AllowCrossThreadAccess):
(WebCore::AllowAccessLaterWrapper::AllowAccessLaterWrapper):
(WebCore::AllowAccessLaterWrapper::value):
(WebCore::AllowAccessLater):

3:50 PM Changeset in webkit [200155] by dbates@webkit.org

4 edits
2 copies
11 adds in trunk/LayoutTests

CSP: Add tests for setting allowContentSecurityPolicySourceStarToMatchAnyProtocol
https://bugs.webkit.org/show_bug.cgi?id=157100

Reviewed by Brent Fulgham.

Add tests to ensure that we do not regress the behavior of setting allowContentSecurityPolicySourceStarToMatchAnyProtocol.
For completeness, this setting was added in r200130 (https://bugs.webkit.org/show_bug.cgi?id=157005) to enable or disable
whether source * can match any protocol as part of a workaround for the iOS apps Ecobee and Quora.

fast/dom/HTMLImageElement/image-with-blob-url-allowed-by-csp-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html: Added.
fast/dom/HTMLImageElement/image-with-blob-url-allowed-by-csp-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html: Added.
fast/dom/HTMLImageElement/image-with-file-url-allowed-by-csp-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html: Added.
fast/dom/HTMLImageElement/image-with-file-url-allowed-by-csp-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html: Added.
fast/dom/HTMLLinkElement/link-with-blob-url-allowed-by-csp-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html: Added.
fast/dom/HTMLLinkElement/link-with-blob-url-allowed-by-csp-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html: Added.
fast/dom/HTMLLinkElement/link-with-data-url-allowed-by-csp-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html: Added.
fast/dom/HTMLLinkElement/link-with-data-url-allowed-by-csp-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html: Added.
fast/dom/HTMLLinkElement/link-with-file-url-allowed-by-csp-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html: Added.
fast/dom/HTMLLinkElement/link-with-file-url-allowed-by-csp-style-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html: Added.
fast/dom/HTMLLinkElement/resources/green-background-color.css: Added.

(#test):

media/video-with-file-url-allowed-by-csp-media-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled-expected.html: Copied from LayoutTests/media/video-with-file-url-blocked-by-csp-media-src-star.html.
media/video-with-file-url-allowed-by-csp-media-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html: Copied from LayoutTests/media/video-with-file-url-blocked-by-csp-media-src-star.html.
media/video-with-file-url-blocked-by-csp-media-src-star-expected.html: Substitute "blocked" for "allowed" since the purpose of the corresponding

test is to ensure that we block loading a file URL video.

media/video-with-file-url-blocked-by-csp-media-src-star.html: Substitute "blocked" for "allowed" since the purpose of this test is to ensure

that we block loading a file URL video. Additionally, register an oncanplaythrough handler instead of an onloadedmetadata handler and call testFinished()
to signal test completion on a zero timer as a means to help ensure that the first frame of the video is drawn should we regress the blocking of a video file URL.

platform/wk2/TestExpectations: Skip test LayoutTests/fast/dom/HTMLImageElement/image-with-blob-url-allowed-by-csp-img-src-star-with-AllowContentSecurityPolicySourceStarToMatchAnyProtocol-enabled.html

when using WebKitTestRunner because WebKitTestRunner does not support eventSender.beginDragWithFiles(). See need to fix
<https://bugs.webkit.org/show_bug.cgi?id=64285>.

3:48 PM Changeset in webkit [200154] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Missing CSS autocompletion suggestions for -webkit-user-select
https://bugs.webkit.org/show_bug.cgi?id=157104

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-04-27
Reviewed by Timothy Hatcher.

UserInterface/Models/CSSKeywordCompletions.js:

3:36 PM Changeset in webkit [200153] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking compositing/contents-scale/incremental-change.html as a flaky failure on ios-simulator-wk2
https://bugs.webkit.org/show_bug.cgi?id=157105

Unreviewed test gardening.

platform/ios-simulator-wk2/TestExpectations:

2:39 PM Changeset in webkit [200152] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

Remove download message receiver when NetworkProcess crashes
https://bugs.webkit.org/show_bug.cgi?id=157102
<rdar://problem/25550106>

Reviewed by Anders Carlsson.

UIProcess/Downloads/DownloadProxyMap.cpp:

(WebKit::DownloadProxyMap::processDidClose):
When the NetworkProcess crashes during a download, we want to remove the message receiver from the map
so we don't get an assertion in ~MessageReceiver in the UIProcess so we do not have a freed
message receiver in the map.

2:25 PM Changeset in webkit [200151] by fpizlo@apple.com

2 edits in trunk/Source/WebCore

Speculative fix for null pointer dereference.
rdar://problem/25964854

Reviewed by Michael Saboff.

platform/mac/Language.mm:

(WebCore::isValidICUCountryCode):

2:07 PM Changeset in webkit [200150] by mmaxfield@apple.com

2 edits in trunk/Source/WebCore

Clean up Font::removeFromSystemFallbackCache()
https://bugs.webkit.org/show_bug.cgi?id=157093

Reviewed by Darin Adler.

Fonts have a bit which represents whether or not the system fallback cache references them.
This bit gets set to 1 when they are inserted into the system fallback cache, but was not
being reset back to 0 when it was removed.

This is benign, since the old codepath has no effect. However, we can speed up the function
by properly updating this bit.

No new tests because there is no behavior change.

platform/graphics/Font.cpp:

(WebCore::Font::removeFromSystemFallbackCache):

1:54 PM Changeset in webkit [200149] by keith_miller@apple.com

40 edits
5 deletes in trunk

Unreviewed, Revert r199397 due to PLT regressions

Source/JavaScriptCore:

JavaScriptCore.xcodeproj/project.pbxproj:
builtins/ArrayPrototype.js:

(concatSlowPath): Deleted.
(concat): Deleted.

bytecode/BytecodeIntrinsicRegistry.cpp:

(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry): Deleted.

bytecode/BytecodeIntrinsicRegistry.h:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall): Deleted.

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC): Deleted.

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGOperations.cpp:
dfg/DFGOperations.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute): Deleted.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
(JSC::DFG::SpeculativeJIT::compileIsJSArray): Deleted.
(JSC::DFG::SpeculativeJIT::compileIsArrayObject): Deleted.
(JSC::DFG::SpeculativeJIT::compileIsArrayConstructor): Deleted.
(JSC::DFG::SpeculativeJIT::compileCallObjectConstructor): Deleted.

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation): Deleted.

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile): Deleted.

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile): Deleted.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileIsArrayObject): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileIsArrayConstructor): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::isArray): Deleted.

jit/JITOperations.h:
jsc.cpp:

(GlobalObject::finishCreation):
(functionDataLogValue): Deleted.

runtime/ArrayConstructor.cpp:

(JSC::ArrayConstructor::finishCreation):
(JSC::arrayConstructorPrivateFuncIsArrayConstructor):

runtime/ArrayConstructor.h:

(JSC::isArrayConstructor): Deleted.

runtime/ArrayPrototype.cpp:

(JSC::ArrayPrototype::finishCreation):
(JSC::arrayProtoFuncConcat):
(JSC::arrayProtoPrivateFuncIsJSArray): Deleted.
(JSC::moveElements): Deleted.
(JSC::arrayProtoPrivateFuncConcatMemcpy): Deleted.
(JSC::arrayProtoPrivateFuncAppendMemcpy): Deleted.

runtime/ArrayPrototype.h:
runtime/CommonIdentifiers.h:
runtime/Intrinsic.h:
runtime/JSArray.cpp:

(JSC::JSArray::fastConcatWith):
(JSC::JSArray::appendMemcpy): Deleted.

runtime/JSArray.h:

(JSC::JSArray::fastConcatType):
(JSC::JSArray::createStructure):
(JSC::isJSArray):

runtime/JSArrayInlines.h: Removed.

(JSC::JSArray::memCopyWithIndexingType): Deleted.
(JSC::JSArray::canFastCopy): Deleted.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

runtime/JSType.h:
runtime/ObjectConstructor.h:

(JSC::constructObject): Deleted.

tests/es6.yaml:
tests/stress/array-concat-spread-object.js: Removed.

(arrayEq): Deleted.

tests/stress/array-concat-spread-proxy-exception-check.js: Removed.

(arrayEq): Deleted.

tests/stress/array-concat-spread-proxy.js: Removed.

(arrayEq): Deleted.

tests/stress/array-concat-with-slow-indexingtypes.js: Removed.

(arrayEq): Deleted.

tests/stress/array-species-config-array-constructor.js:

LayoutTests:

js/Object-getOwnPropertyNames-expected.txt:
js/dom/array-prototype-properties-expected.txt:
js/script-tests/Object-getOwnPropertyNames.js:

1:49 PM Changeset in webkit [200148] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit2

Fix client certificate authentication with NSURLSession on iOS
https://bugs.webkit.org/show_bug.cgi?id=157094
<rdar://problem/25946859>

Patch by Alex Christensen <achristensen@webkit.org> on 2016-04-27
Reviewed by Darin Adler.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
We only want to create a non-persistent credential with the given user and password
and store the user and password in the CredentialStorage if there is a user and password.
We previously only skipped this if we were doing server trust evaluation, in which case
we will have a credential from serverTrustCredential which has no user or password.
When doing client certificate authentication on iOS, this completion handler is called with
a credential with session persistence and also no user or password, so we need to do the same thing.
The reason this was never hit on Mac was because the credential came from tryUseCertificateInfoForChallenge,
which always had persistence none.

1:37 PM Changeset in webkit [200147] by msaboff@apple.com

2 edits in trunk/Source/JavaScriptCore

REGRESSION(r200117): Crash in lowerDFGToB3::compileStringReplace()
https://bugs.webkit.org/show_bug.cgi?id=157099

Reviewed by Saam Barati.

Given that the DFGFixupPhase could mark the edge of child2 as StringUse,
we need to lower that edge appropriately.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):

1:11 PM Changeset in webkit [200146] by Ryan Haddad

4 edits in trunk/LayoutTests

Remove failure expectation for tests that now pass on ios-simulator.

Unreviewed test gardening.

I evaluated all of the unexpected passes from ios-simulator-wk2 and removed failure
expectations where appropriate. Some of the tests only pass on wk2, so some expectations
were moved to the ios-simulator-wk1 file.

platform/ios-simulator-wk1/TestExpectations:
platform/ios-simulator-wk2/TestExpectations:
platform/ios-simulator/TestExpectations:

12:45 PM Changeset in webkit [200145] by commit-queue@webkit.org

1 edit
6 adds in trunk/LayoutTests

Add layout tests for legacy HTTP headers in WebSockets
https://bugs.webkit.org/show_bug.cgi?id=157095

Patch by John Wilander <wilander@apple.com> on 2016-04-27
Reviewed by Alexey Proskuryakov.

http/tests/websocket/tests/hybi/handshake-ok-with-legacy-sec-websocket-response-headers-expected.txt: Added.
http/tests/websocket/tests/hybi/handshake-ok-with-legacy-sec-websocket-response-headers.html: Added.
http/tests/websocket/tests/hybi/handshake-ok-with-legacy-sec-websocket-response-headers_wsh.py: Added.

(web_socket_do_extra_handshake):
(web_socket_transfer_data):

Test for legacy response headers 'Sec-WebSocket-Location' and 'Sec-WebSocket-Origin'.

http/tests/websocket/tests/hybi/handshake-ok-with-legacy-websocket-response-headers-expected.txt: Added.
http/tests/websocket/tests/hybi/handshake-ok-with-legacy-websocket-response-headers.html: Added.
http/tests/websocket/tests/hybi/handshake-ok-with-legacy-websocket-response-headers_wsh.py: Added.

(web_socket_do_extra_handshake):
(web_socket_transfer_data):

Test for legacy response headers 'WebSocket-Location' and 'WebSocket-Origin'.

12:40 PM Changeset in webkit [200144] by adam.bergkvist@ericsson.com

6 edits
1 delete in trunk

WebRTC: RTCIceCandidate don't need a custom bindings
https://bugs.webkit.org/show_bug.cgi?id=157074

Reviewed by Eric Carlson.

Source/WebCore:

Removed custom constructor and replaced custom attribute getters with
nullable types. Removed custom binding from builds.

Testing: Updated existing test.

CMakeLists.txt:
Modules/mediastream/RTCIceCandidate.idl:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSRTCIceCandidateCustom.cpp: Removed.

(WebCore::constructJSRTCIceCandidate): Deleted.
(WebCore::JSRTCIceCandidate::sdpMid): Deleted.
(WebCore::JSRTCIceCandidate::sdpMLineIndex): Deleted.

LayoutTests:

fast/mediastream/RTCIceCandidate-expected.txt:

Updated with error messages from generated constructor binding.

12:39 PM Changeset in webkit [200143] by Claudio Saavedra

3 edits
2 copies
1 add
2 deletes in trunk/Source/WebKit2

[GTK][EFL] Move WK2 platform code to a common place
https://bugs.webkit.org/show_bug.cgi?id=157069

Reviewed by Carlos Garcia Campos.

Logging implementation can be shared between EFL and GTK, so move it to unix.
The GTK Module implementation doesn't depend on GTK anyhow so move it to glib.

Platform/efl/LoggingEfl.cpp: Removed.

(WebKit::logLevelString): Deleted.

Platform/glib/ModuleGlib.cpp: Renamed from Source/WebKit2/Platform/gtk/ModuleGtk.cpp.

(WebKit::Module::load):
(WebKit::Module::unload):
(WebKit::Module::platformFunctionPointer):

Platform/gtk/LoggingGtk.cpp:

(WebKit::logLevelString): Deleted.

Platform/gtk/ModuleGtk.cpp:

(WebKit::Module::load): Deleted.
(WebKit::Module::unload): Deleted.
(WebKit::Module::platformFunctionPointer): Deleted.

Platform/unix/LoggingUnix.cpp: Renamed from Source/WebKit2/Platform/gtk/LoggingGtk.cpp.

(WebKit::logLevelString):

PlatformEfl.cmake: Update.
PlatformGTK.cmake: Update

12:30 PM Changeset in webkit [200142] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit2

Fix assertion when downloading with NSURLSession after r198955
https://bugs.webkit.org/show_bug.cgi?id=157051

Patch by Alex Christensen <achristensen@webkit.org> on 2016-04-27
Reviewed by Brady Eidson.

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::continueDecidePendingDownloadDestination):

12:01 PM Changeset in webkit [200141] by Chris Dumez

3 edits in trunk/Source/WebCore

Unreviewed, rolling out r199383.

Seems to have caused a 0.5% PLT regression on iOS

Reverted changeset:

"[iOS] do not exit AirPlay when the screen locks"
https://bugs.webkit.org/show_bug.cgi?id=156502
http://trac.webkit.org/changeset/199383

12:00 PM Changeset in webkit [200140] by mmaxfield@apple.com

3 edits in trunk/Source/WebCore

Remove unnecessary HashMap from Font
https://bugs.webkit.org/show_bug.cgi?id=157090

Reviewed by Darin Adler.

There were only ever a maximum of 2 keys in the hashmap.

No new tests because there is no behavior change.

platform/graphics/Font.h:
platform/graphics/mac/SimpleFontDataCoreText.cpp:

(WebCore::Font::getCFStringAttributes):

12:00 PM Changeset in webkit [200139] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

Address feedback from https://bugs.webkit.org/show_bug.cgi?id=157048#c5.
https://bugs.webkit.org/show_bug.cgi?id=157096

Reviewed by Geoffrey Garen.

Check for USE(APPLE_INTERNAL_SDK) instead of has_include(<mach-o/dyld_priv.h>).
Rename webkitFirstSDKVersionWithInitConstructorSupport to firstSDKVersionWithInitConstructorSupport.

API/JSWrapperMap.mm:

(supportsInitMethodConstructors):

11:59 AM Changeset in webkit [200138] by mmaxfield@apple.com

3 edits in trunk/Source/WebCore

Rename DerivedFontData to DerivedFonts
https://bugs.webkit.org/show_bug.cgi?id=157092

Reviewed by Darin Adler.

This is a follow-up to r178510 where we named SimpleFontData to Font.
This patch didn't include renaming DerivedFontData to DerivedFonts.

No new tests because there is no behavior change.

platform/graphics/Font.cpp:

(WebCore::Font::verticalRightOrientationFont):
(WebCore::Font::uprightOrientationFont):
(WebCore::Font::smallCapsFont):
(WebCore::Font::noSynthesizableFeaturesFont):
(WebCore::Font::emphasisMarkFont):
(WebCore::Font::brokenIdeographFont):
(WebCore::Font::nonSyntheticItalicFont):
(WebCore::Font::DerivedFonts::~DerivedFonts):
(WebCore::Font::DerivedFontData::~DerivedFontData): Deleted.

platform/graphics/Font.h:

(WebCore::Font::DerivedFonts::DerivedFonts):
(WebCore::Font::DerivedFontData::DerivedFontData): Deleted.

11:57 AM Changeset in webkit [200137] by eric.carlson@apple.com

4 edits in trunk/LayoutTests

media/video-fullscreen-restriction-removed.html is flaky on Mac
https://bugs.webkit.org/show_bug.cgi?id=156983

Reviewed by Darin Adler.

media/video-fullscreen-restriction-removed-expected.txt:
media/video-fullscreen-restriction-removed.html: Start the test on 'canplaythrough' instead of 'loadedmetadata' so playback can begin immediately.

11:36 AM Changeset in webkit [200136] by mark.lam@apple.com

3 edits in trunk/Source/JavaScriptCore

Restrict the availability of some JSC options to local debug builds only.
https://bugs.webkit.org/show_bug.cgi?id=157058

Reviewed by Geoffrey Garen.

Each option will be given an availability flag.
The functionOverrides and useDollarVM (along with its alias, enableDollarVM) will have "Restricted" availability.
All other options will have “Normal” availability.
Any options with "Restricted" availability will only be accessible if function allowRestrictedOptions() returns true.
For now, allowRestrictedOptions() always returns false for release builds, and true for debug builds.

If an option is "Restricted" and restricted options are not allowed, the VM will
behave semantically as if that option does not exist at all:

Option dumps will not show the option.
Attempts to set the option will fail as if the option does not exist.

Behind the scene, the option does exist, and is set to its default value
(whatever that may be) once and only once on options initialization.

runtime/Options.cpp:

(JSC::allowRestrictedOptions):
(JSC::parse):
(JSC::overrideOptionWithHeuristic):
(JSC::Options::initialize):
(JSC::Options::setOptionWithoutAlias):
(JSC::Options::dumpOption):

runtime/Options.h:

(JSC::Option::type):
(JSC::Option::availability):
(JSC::Option::isOverridden):

11:21 AM Changeset in webkit [200135] by Ryan Haddad

1 edit
1 add in trunk/LayoutTests

Add ios-simulator baseline for LayoutTest fast/text/hyphenate-avoid-orphaned-word.html

Unreviewed test gardening.

platform/ios-simulator/fast/text/hyphenate-avoid-orphaned-word-expected.txt: Added.

11:03 AM Changeset in webkit [200134] by barraclough@apple.com

2 edits in trunk/Source/JavaScriptCore

Enable separated heap by default on ios
https://bugs.webkit.org/show_bug.cgi?id=156720
<rdar://problem/25841790>

Unreviewed rollout - caused memory regression.

runtime/Options.cpp:

(JSC::recomputeDependentOptions):

10:58 AM Changeset in webkit [200133] by benjamin@webkit.org

2 edits in trunk/Source/JavaScriptCore

Follow up for r200113 on 32bit

I forgot to do the 32bit counterpart of r200113.
The test fails on the bots.

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-27

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

10:53 AM Changeset in webkit [200132] by caitp@igalia.com

1 edit in trunk/Tools/Scripts/webkitpy/common/config/contributors.json

Add Caitlin Potter (:caitp) as a committer.

10:05 AM Changeset in webkit [200131] by Chris Dumez

11 edits in trunk/Source/WebCore

[Web IDL] Clean up support for [Clamp] IDL extended attribute
https://bugs.webkit.org/show_bug.cgi?id=157060

Reviewed by Darin Adler.

Clean up support for [Clamp] IDL extended attribute:

Move [Clamp] handling in the bindings generator from the parameter

conversion to JSValueToNative(). This has the benefit of
simplifying the parameter conversion code, adding support for [Clamp]
on non-readonly attributes, and improving consistency by handling
this in the same place as [EnforceRange].

Add 'Clamp' to the IntegerConversionConfiguration enumeration in

JSDOMbindings.h and add support for it to the various toInt*() /
toUInt*() functions, similary to [EnforceRange]. Call these from
the generated bindings.

bindings/js/JSDOMBinding.cpp:

(WebCore::toSmallerInt):
(WebCore::toSmallerUInt):
(WebCore::toInt32EnforceRange):
(WebCore::toInt32Clamp):
(WebCore::toUInt32Clamp):
(WebCore::toUInt32EnforceRange):
(WebCore::toInt64):
(WebCore::toUInt64):
(WebCore::toUInt8): Deleted.
(WebCore::toUInt16): Deleted.

bindings/js/JSDOMBinding.h:

(WebCore::toInt32):
(WebCore::toUInt32):

bindings/scripts/CodeGeneratorJS.pm:

(JSValueToNative):
(GenerateParametersCheck): Deleted.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:

(webkit_dom_test_obj_set_property):
(webkit_dom_test_obj_get_property):
(webkit_dom_test_obj_class_init):
(webkit_dom_test_obj_class_method_with_enforce_range):
(webkit_dom_test_obj_get_clamped_short_attr):
(webkit_dom_test_obj_set_clamped_short_attr):
(webkit_dom_test_obj_get_enforce_range_short_attr):
(webkit_dom_test_obj_set_enforce_range_short_attr):

bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjClampedShortAttr):
(WebCore::jsTestObjEnforceRangeShortAttr):
(WebCore::setJSTestObjClampedShortAttr):
(WebCore::setJSTestObjEnforceRangeShortAttr):
(WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
(WebCore::jsTestObjPrototypeFunctionClassMethodWithEnforceRange):
(WebCore::jsTestObjConstructorFunctionClassMethodWithOptional): Deleted.
(WebCore::jsTestObjConstructorFunctionClassMethod2): Deleted.

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):
(WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction): Deleted.

bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:

(-[DOMTestObj clampedShortAttr]):
(-[DOMTestObj setClampedShortAttr:]):
(-[DOMTestObj enforceRangeShortAttr]):
(-[DOMTestObj setEnforceRangeShortAttr:]):
(-[DOMTestObj classMethodWithEnforceRange:objArgsLong:]):

bindings/scripts/test/TestObj.idl:

9:48 AM Changeset in webkit [200130] by dbates@webkit.org

10 edits in trunk/Source

CSP: Add app-specific workaround for Ecobee and Quora
https://bugs.webkit.org/show_bug.cgi?id=157005
<rdar://problem/25560776>

Reviewed by Brent Fulgham.

Source/WebCore:

page/Settings.in: Add setting allowContentSecurityPolicySourceStarToMatchAnyProtocol (disabled by default).
page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allowContentSecurityPolicySourceStarToMatchAnyProtocol): Added.

page/csp/ContentSecurityPolicy.h:
page/csp/ContentSecurityPolicySourceList.cpp:

(WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar): Modified to return true
if ContentSecurityPolicy::allowContentSecurityPolicySourceStarToMatchAnyProtocol() evaluates to true.

platform/RuntimeApplicationChecks.h:
platform/RuntimeApplicationChecks.mm:

(WebCore::IOSApplication::isEcobee): Added.
(WebCore::IOSApplication::isQuora): Added.

Source/WebKit/mac:

Misc/WebKitVersionChecks.h:
WebView/WebView.mm:

(shouldAllowContentSecurityPolicySourceStarToMatchAnyProtocol): Added.
(-[WebView _preferencesChanged:]): Enable setting allowContentSecurityPolicySourceStarToMatchAnyProtocol
if applicable.

9:47 AM Changeset in webkit [200129] by Carlos Garcia Campos

15 edits
1 delete in trunk/Source

REGRESSION(r200094): [FreeType] Vertical text is broken after r200094
https://bugs.webkit.org/show_bug.cgi?id=157066

Reviewed by Martin Robinson.

Source/WebCore:

The problem is that Freetype implementation needs to call buildScaledFont() when orientation, SyntheticOblique
or size change, but the new static clone methods don't do that. I think it's the time to stop using our own
header for FontPlatformData for the FreeType implementation to make cross-platform changes easier and prevent
regressions like this in the future.

CMakeLists.txt: Compile FontPlatformData.cpp for all ports.
PlatformMac.cmake: Remove FontPlatformData.cpp.
PlatformWin.cmake: Ditto.
platform/graphics/FontPlatformData.cpp: We need our own clone methods in the FreeType backend.
platform/graphics/FontPlatformData.h: Move FreeType specific methods and members from the old header file.
platform/graphics/cairo/CairoUtilities.cpp:

(WebCore::CairoFtFaceLocker::CairoFtFaceLocker): Move CairoFtFaceLocker implementation here from
HarfBuzzFaceCairo.cpp to make it available to other classes, and make it handle the case of
cairo_ft_scaled_font_lock_face() returning nullptr.
(WebCore::CairoFtFaceLocker::~CairoFtFaceLocker):

platform/graphics/cairo/CairoUtilities.h:

(WebCore::CairoFtFaceLocker::ftFace):

platform/graphics/freetype/FontCacheFreeType.cpp:

(WebCore::findBestFontGivenFallbacks): Move the fallbacks implementation to FontPlatformData where it belongs
and here simply use FontPlatformData::fallbacks().

platform/graphics/freetype/FontPlatformData.h: Removed.
platform/graphics/freetype/FontPlatformDataFreeType.cpp:

(WebCore::FontPlatformData::FontPlatformData): Remove members already initialized in the header.
(WebCore::FontPlatformData::operator=): Add missing members to be copied.
(WebCore::FontPlatformData::~FontPlatformData): Do not free m_scaledFont manually since we are now using a smart pointer.
(WebCore::FontPlatformData::cloneWithOrientation): Call buildScaledFont() like setOrientation() did.
(WebCore::FontPlatformData::cloneWithSyntheticOblique): Call buildScaledFont() like setSyntheticOblique() did.
(WebCore::FontPlatformData::cloneWithSize): Call buildScaledFont().
(WebCore::FontPlatformData::fallbacks): Lazily initialize fallbacks if needed and return it.
(WebCore::FontPlatformData::platformIsEqual): Only compare FreeType specific members.
(WebCore::FontPlatformData::buildScaledFont): Use RefPtr for m_scaledFont.
(WebCore::FontPlatformData::hasCompatibleCharmap): Use CairoFtFaceLocker.
(WebCore::FontPlatformData::openTypeTable): Update to return RefPtr instead of PassRefPtr and use CairoFtFaceLocker.
(WebCore::FontPlatformData::operator==): Deleted.
(WebCore::FontPlatformData::setOrientation): Deleted.
(WebCore::FontPlatformData::setSyntheticOblique): Deleted.

platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp:

(WebCore::GlyphPage::fill): Use CairoFtFaceLocker.

platform/graphics/freetype/SimpleFontDataFreeType.cpp:

(WebCore::Font::platformInit): Ditto.
(WebCore::Font::canRenderCombiningCharacterSequence): Ditto.

platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:

(WebCore::harfBuzzCairoGetTable): Ditto.
(WebCore::CairoFtFaceLocker::CairoFtFaceLocker): Deleted.
(WebCore::CairoFtFaceLocker::lock): Deleted.
(WebCore::CairoFtFaceLocker::~CairoFtFaceLocker): Deleted.

Source/WebKit2:

Add Source/WebCore/platform/graphics/freetype to the list of include dirs, because now FontPlatformData.h
includes FcUniquePtr.h.

PlatformEfl.cmake:
PlatformGTK.cmake:

8:58 AM Changeset in webkit [200128] by bshafiei@apple.com

5 edits in trunk/Source

Versioning.

8:57 AM Changeset in webkit [200127] by bshafiei@apple.com

1 copy in tags/Safari-602.1.30

New tag.

6:14 AM Changeset in webkit [200126] by Hunseop Jeong

5 edits in trunk

[EFL][GTK] Volume slider only changes volume when thumb is released, not while dragging
https://bugs.webkit.org/show_bug.cgi?id=156970

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

Volume slider have to change the volume while dragging the thumb.

Test: media/video-volume-slider-drag.html

Modules/mediacontrols/mediaControlsBase.js:

(Controller.prototype.createControls): Use the 'input' event instead of the 'change' to
check the changed value correctly.
(Controller.prototype.handleMaxButtonClicked):
(Controller.prototype.handleVolumeSliderInput): Renamed from handleVolumeSliderChange.
(Controller.prototype.handleVolumeSliderChange): Deleted.

LayoutTests:

Removed the passed test.

platform/efl/TestExpectations:
platform/gtk/TestExpectations:

4:33 AM WebKitGTK/2.12.x edited by berto@igalia.com

(diff)

4:12 AM Changeset in webkit [200125] by berto@igalia.com

2 edits in trunk/Source/JavaScriptCore

[GTK] Fails to build randomly when generating LLIntDesiredOffsets.h
https://bugs.webkit.org/show_bug.cgi?id=155427

Reviewed by Carlos Garcia Campos.

If the build directory contains the -I string, the script that
generates LLIntDesiredOffsets.h will confuse it with an option to
declare an include directory.

In order to avoid that we should only use the arguments that start
with -I when extracting the list of include directories, instead
of using the ones that simply contain that string.

offlineasm/parser.rb:

3:02 AM Changeset in webkit [200124] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Unreviewed. Fix compatibility issue with 2.12.1 regarding local storage access from file URLs.

page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::canAccessStorage):

2:37 AM Changeset in webkit [200123] by youenn.fablet@crf.canon.fr

2 edits in trunk/Source/WebCore

[Fetch API] Remove FetchResponse::redirect overload
https://bugs.webkit.org/show_bug.cgi?id=157034

Reviewed by Darin Adler.

No change of behavior.

Modules/fetch/FetchResponse.h:

1:35 AM Changeset in webkit [200122] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

[Mac][cmake] Unreviewed speculative buildfix after r200116, just for fun.

PlatformMac.cmake:

12:12 AM Changeset in webkit [200121] by sbarati@apple.com

9 edits
10 adds in trunk/Source

JSC should have an option to allow global const redeclarations
https://bugs.webkit.org/show_bug.cgi?id=157006

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This patch implements an option that dictates whether
const redeclarations at the program level will throw.
This option defaults to true but allows users of JSC
to set it to false. This option is per VM. This is needed
for backwards compatibility with our old const implementation.

jsc.cpp:

(GlobalObject::finishCreation):
(functionShadowChickenFunctionsOnStack):
(functionSetGlobalConstRedeclarationShouldNotThrow):
(functionReadline):

runtime/Executable.cpp:

(JSC::ProgramExecutable::initializeGlobalProperties):

runtime/JSGlobalLexicalEnvironment.cpp:

(JSC::JSGlobalLexicalEnvironment::put):
(JSC::JSGlobalLexicalEnvironment::isConstVariable):

runtime/JSGlobalLexicalEnvironment.h:

(JSC::JSGlobalLexicalEnvironment::isEmpty):

runtime/VM.h:

(JSC::VM::setGlobalConstRedeclarationShouldThrow):
(JSC::VM::globalConstRedeclarationShouldThrow):

tests/stress/global-const-redeclaration-setting: Added.
tests/stress/global-const-redeclaration-setting-2.js: Added.

(assert):

tests/stress/global-const-redeclaration-setting-3.js: Added.

(assert):
(catch):

tests/stress/global-const-redeclaration-setting-4.js: Added.

(assert):
(catch):

tests/stress/global-const-redeclaration-setting-5.js: Added.

(assert):
(catch):

tests/stress/global-const-redeclaration-setting.js: Added.

(assert):

tests/stress/global-const-redeclaration-setting/first.js: Added.
tests/stress/global-const-redeclaration-setting/let.js: Added.
tests/stress/global-const-redeclaration-setting/second.js: Added.
tests/stress/global-const-redeclaration-setting/strict.js: Added.

Source/WebCore:

This patch makes the JS VM not throw global const redeclaration
errors when the application is iBooks.

bindings/js/JSDOMWindowBase.cpp:

(WebCore::JSDOMWindowBase::commonVM):

page/Settings.h:

(WebCore::Settings::shouldUseHighResolutionTimers):
(WebCore::Settings::globalConstRedeclarationShouldThrow):
(WebCore::Settings::backgroundShouldExtendBeyondPage):

Apr 26, 2016:

8:21 PM Changeset in webkit [200120] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Support legacy HTTP headers in WebSockets
https://bugs.webkit.org/show_bug.cgi?id=157057

Patch by John Wilander <wilander@apple.com> on 2016-04-26
Reviewed by Brent Fulgham.

No new tests since these headers are not officially supported and should not be used.

platform/network/HTTPHeaderNames.in:

Added four legacy headers needed to support older WebSockets servers.
Two of them are in the draft from August 2010: https://whatwg.org/specs/web-socket-protocol/

7:14 PM Changeset in webkit [200119] by commit-queue@webkit.org

4 edits in trunk/Source

Uncaught Exception: SecurityError: DOM Exception 18: An attempt was made to break through the security policy of the user agent.
https://bugs.webkit.org/show_bug.cgi?id=156991
<rdar://problem/25913475>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-04-26
Reviewed by Timothy Hatcher.

Source/WebKit/mac:

WebCoreSupport/WebInspectorClient.mm:

(-[WebInspectorWindowController init]):
Apply the same universal file access to WebKit1 Web Inspector views that
we apply to WebKit2 views. Explicitly always allow access to storage
for Web Inspector content just in case as we already allow universal
file access.

Source/WebKit2:

UIProcess/mac/WebInspectorProxyMac.mm:

(WebKit::WebInspectorProxy::platformCreateInspectorPage):
Explicitly always allow access to storage for Web Inspector content just
in case, as we already allow universal file access.

7:02 PM Changeset in webkit [200118] by dino@apple.com

12 edits in trunk

RTL native <select> buttons should have arrows on left
https://bugs.webkit.org/show_bug.cgi?id=157055
<rdar://problem/25894428>

Source/WebCore:

Reviewed by Myles Maxfield.

If the text direction is right-to-left, the select popup
buttons should have the arrows on the left side.

Test: fast/forms/select-writing-direction-natural.html

rendering/RenderThemeMac.h:
rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::popupButtonPadding): Takes a direction parameter.
(WebCore::RenderThemeMac::popupInternalPaddingBox): Checks the direction for the padding.
(WebCore::RenderThemeMac::setPopupButtonCellState): Tell the button to put the
arrows on the correct side.
(WebCore::RenderThemeMac::popupButton): Deleted an unnecessary comment.

LayoutTests:

Reviewed by Myles Maxfield.

fast/forms/select-writing-direction-natural.html: Removed some incorrect

text in the test.

platform/ios-simulator/fast/forms/select-writing-direction-natural-expected.txt:
platform/mac/fast/forms/select-writing-direction-natural-expected.png:
platform/mac/fast/forms/select-writing-direction-natural-expected.txt:
platform/mac/fast/text/international/bidi-menulist-expected.png:
platform/mac/fast/text/international/bidi-menulist-expected.txt:
platform/mac/fast/text/international/pop-up-button-text-alignment-and-direction-expected.png:
platform/mac/fast/text/international/pop-up-button-text-alignment-and-direction-expected.txt:

6:28 PM Changeset in webkit [200117] by msaboff@apple.com

36 edits
2 adds in trunk

[ES] Implement RegExp.prototype.@@replace and use it for String.prototype.replace
https://bugs.webkit.org/show_bug.cgi?id=156562

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Added builtins for String.prototype.replace as well as RegExp.prototype[Symbol.replace].

The String.prototype.replace also has an intrinsic, StringPrototypeReplaceIntrinsic.
This original intrinsic was copied to make StringPrototypeReplaceRegExpIntrinsic.
The difference between the two intrinsics is that StringPrototypeReplaceIntrinsic has
the same checks found in the new builtin hasObservableSideEffectsForStringReplace.
We implement these primordial checks for StringPrototypeReplaceIntrinsic in two places.
First, we do a trial check during ByteCode parsing time to see if the current
RegExp.prototype properties have changed from the original. If they have, we don't
inline the intrinsic. Later, in the fixup phase, we add nodes to the IR to emit the
checks at runtime.

The new intrinsic StringPrototypeReplaceRegExpIntrinsic is only available via the
private @replaceUsingRegExp, which is called in the String.prototype.replace builtin.
It is only called after hasObservableSideEffectsForStringReplace has been called

Both of these intrinsics are needed, because the JS code containing String.replace() calls
runs initially in the LLint and then the baseline JIT. Even after the function tiers up
to the DFG JIT, the inlining budget may not allow StringPrototypeReplaceIntrinsic to be inlined.
Having StringPrototypeReplaceRegExpIntrinsic allows for the String.prototype.replace builtin to
get reasonable performance before the other intrinsic is inlined or when it can't.

builtins/RegExpPrototype.js:

(match):
(getSubstitution):
(replace):
(search):
(split):

builtins/StringPrototype.js:

(repeat):
(hasObservableSideEffectsForStringReplace):
(intrinsic.StringPrototypeReplaceIntrinsic.replace):
(localeCompare):
New builtins for String.prototype.replace and RegExp.prototype[Symbol.replace].

bytecode/BytecodeIntrinsicRegistry.cpp:
bytecode/BytecodeIntrinsicRegistry.h:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupGetAndSetLocalsInBlock):
(JSC::DFG::FixupPhase::tryAddStringReplacePrimordialChecks):
(JSC::DFG::FixupPhase::checkArray):

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::getRegExpPrototypeProperty):

dfg/DFGGraph.h:

(JSC::DFG::Graph::getRegExpPrototypeProperty):

dfg/DFGNode.h:

(JSC::DFG::Node::hasHeapPrediction):

dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStrengthReductionPhase.cpp:

(JSC::DFG::StrengthReductionPhase::handleNode):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):

runtime/CommonIdentifiers.h:
runtime/Intrinsic.h:
runtime/RegExpPrototype.cpp:

(JSC::RegExpPrototype::finishCreation):

runtime/StringPrototype.cpp:

(JSC::StringPrototype::finishCreation):
(JSC::replace):
(JSC::stringProtoFuncReplaceUsingRegExp):
(JSC::stringProtoFuncReplaceUsingStringSearch):
(JSC::operationStringProtoFuncReplaceGeneric):
(JSC::stringProtoFuncReplace): Deleted.
Added StringReplaceRegExp intrinsic. Added checks for RegExp profiled arguments to StringReplace
that mirror what is in hasObservableSideEffectsForStringReplace(). If we aren't able to add the
checks, we OSR exit. Add Graph::getPrimordialRegExpPrototypeProperty() as a helper to get the
primordial values from RegExp.prototype.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init): Added @regExpPrototypeSymbolReplace and
@hasObservableSideEffectsForStringReplace here instead og String.prototype so that we reduce the
number of objects we have to traverse.

tests/es6.yaml: Changed expectations for the various replace related tests to passing.

tests/stress/regexp-replace-proxy.js:

(assert):
(let.getProxyNullExec.new.Proxy):
(let.getSetProxyNullExec.new.Proxy):
(get resetTracking):
(let.getSetProxyMatches_comma.new.Proxy):
(set get getSetProxyNullExec):
(let.getSetProxyReplace_phoneNumber.new.Proxy):
(set get getSetProxyMatches_comma):
(let.getSetProxyReplaceUnicode_digit_nonGreedy.new.Proxy):
(set get resetTracking):

tests/stress/string-replace-proxy.js:

(assert):
(let.getSetProxyReplace.new.Proxy.replace):
New tests.

LayoutTests:

Updated tests. Needed to update js/regress-141098.js test, because builtins are
only compilied when called. This test checks behavior at or near running out of
stack space. It turns out that String.replace is used by the -pre.js test harness
and I was running out of stack space when compiling the String.prototype.replace
builting. Therefore, I added a call to testPassed() to precompile String.replace.

js/Object-getOwnPropertyNames-expected.txt:
js/regress-141098-expected.txt:
js/script-tests/Object-getOwnPropertyNames.js:
js/script-tests/regress-141098.js:

(probeAndRecurse):

fast/profiler/nested-start-and-stop-profiler-expected.txt:
js/Object-getOwnPropertyNames-expected.txt:
js/dom/string-prototype-properties-expected.txt:
js/regress-141098-expected.txt:
js/script-tests/Object-getOwnPropertyNames.js:
js/script-tests/regress-141098.js:

(probeAndRecurse):

sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt:

6:25 PM Changeset in webkit [200116] by mmaxfield@apple.com

102 edits
1 add
1 delete in trunk

[WK2] [OS X] Create API for switching RTL scrollbar policy
https://bugs.webkit.org/show_bug.cgi?id=156948
<rdar://problem/25707757>

Reviewed by Darin Adler.

Source/WebCore:

There are two schools of thought for where to put scrollbars in RTL environments.
The first is that we should obey the content's "dir" attribute, specified on each
element. The second is that we should be consistent with the platform (AppKit's)
behavior.

There are some situations where the placement should be done according to the
content. For example, this policy would be used in web browsers.

However, there are also places where web content is designed to fit seamlessly
amongst native content. In this situation, the placement of the scrollbars should
be done according to the view.

Because WebKit doesn't know which of these situations it is operating within, this
patch adds a new API property, userInterfaceDirectionPolicy, to
WKWebViewConfigurationPolicy. This allows clients to instruct us which policy to
abide by. It is plumbed to the web process inside the WebPreferencesStore and is
ultimately held inside the Page's Settings object.

This Setting is consulted by RenderLayerModelObject, which serves as a good
centralized place for this policy implementation. This is the class which decides
if we should be consulting its RenderStyle or the platform itself when we decide
where to put the scrollbars.

Putting this decision inside the renderer is important because ScrollableArea
often needs to know if scrollbars should be put on the left, but ScrollableArea
doesn't know anything about RenderStyles. Therefore, the renderer must be the
intermediary between ScrollableArea and the RenderStyle. (ScrollableArea also
doesn't directly know anything about renderers either; however, each of the
subclasses knows about an appropriate renderer.) Therefore, ScrollableArea gets
a new virtual method which is implemented by the RenderLayerModelObject.

Tests: fast/scrolling/rtl-scrollbars*.html

WebCore.xcodeproj/project.pbxproj: ScrollableAreaMac.mm is no longer necessary.
page/FrameView.cpp:

(WebCore::FrameView::shouldPlaceBlockDirectionScrollbarOnLeft): Overridden
ScrollableArea function.

page/FrameView.h:
page/Settings.h:
page/Settings.in:
platform/ScrollView.cpp: Adding two new settings: One to know if we should

consult with the RenderStyle or the platform, and the other is whether or not
the platform considers itself to be RTL.
(WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin): Update to
use new mechanism.
(WebCore::ScrollView::updateScrollbars): Ditto.
(WebCore::ScrollView::scrollCornerRect): Ditto.
(WebCore::ScrollView::locationOfContents): Ditto.

platform/ScrollableArea.cpp:

(WebCore::ScrollableArea::verticalScrollbarIsOnLeft): Deleted. This was the old
mechanism.
(WebCore::ScrollableArea::systemLanguageIsRTL): Deleted. Ditto.

platform/ScrollableArea.h:
platform/mac/ScrollableAreaMac.mm: Removed.

(WebCore::ScrollableArea::verticalScrollbarIsOnLeft): Deleted.
(WebCore::ScrollableArea::systemLanguageIsRTL): Deleted.

platform/mac/ScrollbarThemeMac.mm:

(WebCore::ScrollbarThemeMac::didCreateScrollerImp): Update to use new
mechanism.

platform/text/WritingMode.h: These enums should match what's in WebKit2.
rendering/RenderBlock.cpp:

(WebCore::RenderBlock::logicalLeftOffsetForContent): Update to use new mechanism.
(WebCore::RenderBlock::logicalRightOffsetForContent): Ditto.

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::determineLogicalLeftPositionForChild): Ditto.

rendering/RenderBox.cpp: Ditto.

(WebCore::RenderBox::contentBoxRect):
(WebCore::RenderBox::overflowClipRect):
(WebCore::RenderBox::computePositionedLogicalWidth):
(WebCore::RenderBox::layoutOverflowRectForPropagation):

rendering/RenderBoxModelObject.cpp: Ditto.

(WebCore::RenderBoxModelObject::constrainingRectForStickyPosition):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::resize): Ditto.
(WebCore::cornerStart): Migrate to use references.
(WebCore::cornerRect): Ditto.
(WebCore::RenderLayer::scrollCornerRect): Ditto.
(WebCore::resizerCornerRect): Ditto.
(WebCore::RenderLayer::scrollCornerAndResizerRect): Ditto.
(WebCore::RenderLayer::verticalScrollbarStart): Update to use new mechanism.
(WebCore::RenderLayer::horizontalScrollbarStart): Ditto.
(WebCore::RenderLayer::offsetFromResizeCorner): Ditto.
(WebCore::RenderLayer::positionOverflowControls): Migrate to use references.
(WebCore::RenderLayer::computeScrollDimensions): Ditto.
(WebCore::RenderLayer::overflowControlsIntersectRect): Ditto.
(WebCore::RenderLayer::drawPlatformResizerImage): Update to use new mechanism.
(WebCore::RenderLayer::paintResizer): Migrate to use references.
(WebCore::RenderLayer::isPointInResizeControl): Ditto.
(WebCore::RenderLayer::hitTestOverflowControls): Ditto.
(WebCore::RenderLayer::hitTestResizerInFragments): Ditto.

rendering/RenderLayer.h: ScrollableArea override
rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::positionForClipLayer): Update to use new
mechanism.

rendering/RenderLayerModelObject.cpp:

(WebCore::RenderLayerModelObject::shouldPlaceBlockDirectionScrollbarOnLeft):
This is the meat of this patch. This is where we decide if we should be
interrogating the RenderStyle or the underlying platform.

rendering/RenderLayerModelObject.h:
rendering/RenderListBox.cpp: Update to use new mechanism.

(WebCore::RenderListBox::itemBoundingBoxRect):
(WebCore::RenderListBox::paintScrollbar):
(WebCore::RenderListBox::isPointInOverflowControl):
(WebCore::RenderListBox::listIndexAtOffset):
(WebCore::RenderListBox::controlClipRect):
(WebCore::RenderListBox::invalidateScrollbarRect):
(WebCore::RenderListBox::convertFromScrollbarToContainingView):
(WebCore::RenderListBox::convertFromContainingViewToScrollbar):

rendering/RenderListBox.h:
rendering/RenderView.cpp: Ditto.

(WebCore::RenderView::repaintViewRectangle):

rendering/style/RenderStyle.cpp:

(WebCore::RenderStyle::shouldPlaceBlockDirectionScrollbarOnLeft): This
function is now much dumber. It just inspects its own style.

testing/InternalSettings.cpp: Allow mocking.

(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::verticalScrollbarLocationPolicy):
(WebCore::InternalSettings::setVerticalScrollbarLocationPolicy):
(WebCore::InternalSettings::systemLayoutDirection):
(WebCore::InternalSettings::setSystemLayoutDirection):

testing/InternalSettings.h:
testing/InternalSettings.idl:

Source/WebKit2:

Add the new API.

Shared/WebPreferencesDefinitions.h:
UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _initializeWithConfiguration:]):

UIProcess/API/Cocoa/WKWebViewConfiguration.h:
UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]):
(-[WKWebViewConfiguration encodeWithCoder:]):
(-[WKWebViewConfiguration initWithCoder:]):
(-[WKWebViewConfiguration copyWithZone:]):

UIProcess/WebPageProxy.cpp:
WebProcess/Plugins/PDF/DeprecatedPDFPlugin.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

LayoutTests:

Update tests to use new RTL scrollbar mechanism.

fast/scrolling/rtl-scrollbars-animation-property.html:
fast/scrolling/rtl-scrollbars-elementFromPoint-static.html:
fast/scrolling/rtl-scrollbars-elementFromPoint.html:
fast/scrolling/rtl-scrollbars-expected.html:
fast/scrolling/rtl-scrollbars-iframe-offset-expected.html:
fast/scrolling/rtl-scrollbars-iframe-offset.html:
fast/scrolling/rtl-scrollbars-iframe-position-absolute.html:
fast/scrolling/rtl-scrollbars-iframe-scrolled-expected.html:
fast/scrolling/rtl-scrollbars-iframe-scrolled.html:
fast/scrolling/rtl-scrollbars-iframe.html:
fast/scrolling/rtl-scrollbars-listbox-expected.html:
fast/scrolling/rtl-scrollbars-listbox-scroll-expected.html:
fast/scrolling/rtl-scrollbars-listbox-scroll.html:
fast/scrolling/rtl-scrollbars-listbox-select-left-expected.html:
fast/scrolling/rtl-scrollbars-listbox-select-left.html:
fast/scrolling/rtl-scrollbars-listbox-select-right-expected.html:
fast/scrolling/rtl-scrollbars-listbox-select-right.html:
fast/scrolling/rtl-scrollbars-listbox-simple-expected-mismatch.html:
fast/scrolling/rtl-scrollbars-listbox-simple.html:
fast/scrolling/rtl-scrollbars-listbox.html:
fast/scrolling/rtl-scrollbars-overflow-contents-expected.html:
fast/scrolling/rtl-scrollbars-overflow-contents.html:
fast/scrolling/rtl-scrollbars-overflow-dir-rtl-expected.html:
fast/scrolling/rtl-scrollbars-overflow-dir-rtl.html:
fast/scrolling/rtl-scrollbars-overflow-elementFromPoint.html:
fast/scrolling/rtl-scrollbars-overflow-expected.html:
fast/scrolling/rtl-scrollbars-overflow-padding-expected.html:
fast/scrolling/rtl-scrollbars-overflow-padding.html:
fast/scrolling/rtl-scrollbars-overflow-position-absolute-expected.html:
fast/scrolling/rtl-scrollbars-overflow-position-absolute.html:
fast/scrolling/rtl-scrollbars-overflow-simple-expected-mismatch.html:
fast/scrolling/rtl-scrollbars-overflow-simple.html:
fast/scrolling/rtl-scrollbars-overflow-text-selection-scrolled-expected.html:
fast/scrolling/rtl-scrollbars-overflow-text-selection-scrolled.html:
fast/scrolling/rtl-scrollbars-overflow.html:
fast/scrolling/rtl-scrollbars-overlay-no-push-contents-expected.html:
fast/scrolling/rtl-scrollbars-overlay-no-push-contents.html:
fast/scrolling/rtl-scrollbars-position-absolute-expected.html:
fast/scrolling/rtl-scrollbars-position-absolute.html:
fast/scrolling/rtl-scrollbars-position-fixed-expected.html:
fast/scrolling/rtl-scrollbars-position-fixed.html:
fast/scrolling/rtl-scrollbars-positioning-expected.html:
fast/scrolling/rtl-scrollbars-positioning.html:
fast/scrolling/rtl-scrollbars-simple-expected-mismatch.html:
fast/scrolling/rtl-scrollbars-simple.html:
fast/scrolling/rtl-scrollbars-sticky-document-2-expected.html:
fast/scrolling/rtl-scrollbars-sticky-document-2.html:
fast/scrolling/rtl-scrollbars-sticky-document-expected.html:
fast/scrolling/rtl-scrollbars-sticky-document.html:
fast/scrolling/rtl-scrollbars-sticky-iframe-2-expected.html:
fast/scrolling/rtl-scrollbars-sticky-iframe-2.html:
fast/scrolling/rtl-scrollbars-sticky-iframe-expected.html:
fast/scrolling/rtl-scrollbars-sticky-iframe.html:
fast/scrolling/rtl-scrollbars-sticky-overflow-scroll-2-expected.html:
fast/scrolling/rtl-scrollbars-sticky-overflow-scroll-2.html:
fast/scrolling/rtl-scrollbars-sticky-overflow-scroll-expected.html:
fast/scrolling/rtl-scrollbars-sticky-overflow-scroll.html:
fast/scrolling/rtl-scrollbars-text-selection-expected.html:
fast/scrolling/rtl-scrollbars-text-selection-scrolled-expected.html:
fast/scrolling/rtl-scrollbars-text-selection-scrolled.html:
fast/scrolling/rtl-scrollbars-text-selection.html:
fast/scrolling/rtl-scrollbars.html:
platform/mac/fast/scrolling/rtl-scrollbars-animation-property-expected.png: Added.

5:47 PM Changeset in webkit [200115] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

Gardening: speculative build fix.

Not reviewed.

API/JSWrapperMap.mm:

5:30 PM Changeset in webkit [200114] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

Update the compatibility version check for the ObjC API's InitConstructorSupport to use dyld_get_program_sdk_version().
https://bugs.webkit.org/show_bug.cgi?id=157048

Reviewed by Geoffrey Garen.

API/JSWrapperMap.mm:

(supportsInitMethodConstructors):
(getJSExportProtocol):

4:26 PM Changeset in webkit [200113] by commit-queue@webkit.org

2 edits
1 add in trunk/Source/JavaScriptCore

[JSC] GetByVal on Undecided use its children before its OSR Exit
https://bugs.webkit.org/show_bug.cgi?id=157046

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-26
Reviewed by Mark Lam.

Very silly bug: GetByVal on Undecided uses its children before
the speculationCheck(). If we fail the speculation, we have already
lost how to recover the values.

The existing tests did not catch this because we tier up to B3
before such Exits happen. B3 has explicit liveness and did not suffer
from this bug.
The new test has a smaller warmup to exercise the OSR Exit in DFG
instead of FTL.

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

tests/stress/get-by-val-on-undecided-out-of-bounds.js: Added.

(string_appeared_here.opaqueGetByValKnownArray):

4:09 PM Changeset in webkit [200112] by Konstantin Tokarev

2 edits in trunk/Tools

Unreviewed: add myself to the committers list.

Scripts/webkitpy/common/config/contributors.json:

4:03 PM Changeset in webkit [200111] by rniwa@webkit.org

32 edits
50 adds in trunk/LayoutTests/imported/w3c

Update tests in web-platform-tests/html/semantics/scripting-1/
https://bugs.webkit.org/show_bug.cgi?id=157026

Reviewed by Darin Adler.

Reimported tests under web-platform-tests/html/semantics/scripting-1/ as of d5a4c5bdf8a1837b4fcf50bbd2efd4150ddafa99.

web-platform-tests/html/semantics/scripting-1/the-script-element/async_001-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_001.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_002-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_002.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_003-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_003.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_004-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_004.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_005-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_005.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_006-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_006.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_007-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_007.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_008-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_008.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_009-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_009.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_010-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_010.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_011-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/async_011.htm: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/external-script-utf8.js: Added.

(window.getSomeString):

web-platform-tests/html/semantics/scripting-1/the-script-element/external-script-windows1250.js: Added.

(window.getSomeString):

web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha/base-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha/base.html: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha/test.js: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha/w3c-import.log: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/beta: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/beta/test.js: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/beta/w3c-import.log: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/empty-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/empty-with-base-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/empty-with-base.html: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/empty.html: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/failure-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/failure.html: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/unreachable.js: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/w3c-import.log: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-02-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-02.html: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/script-not-found-not-executed-2.py: Added.

(main):

web-platform-tests/html/semantics/scripting-1/the-script-element/script-not-found-not-executed-expected.txt: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/script-not-found-not-executed.html: Added.
web-platform-tests/html/semantics/scripting-1/the-script-element/script-not-found-not-executed.py: Added.

(main):

web-platform-tests/html/semantics/scripting-1/the-script-element/serve-with-content-type.py: Added.

(main):

web-platform-tests/html/semantics/scripting-1/the-script-element/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/node-document-expected.txt:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/node-document.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/template-child-nodes.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-serializing-xhtml-documents/outerhtml.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-serializing-xhtml-documents/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-the-css-user-agent-style-sheet/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-the-steps-to-clone-a-node/template-clone-children.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-the-steps-to-clone-a-node/templates-copy-document-owner.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-the-steps-to-clone-a-node/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents-owner-document-type.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents-owner-test-001.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents-owner-test-002.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/innerhtml-on-templates/innerhtml.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/innerhtml-on-templates/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/resources/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/serializing-html-templates/outerhtml.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/serializing-html-templates/w3c-import.log:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/content-attribute.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/node-document-changes.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-content-node-document.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-content.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-body.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-head.html:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/w3c-import.log:

3:53 PM Changeset in webkit [200110] by Chris Dumez

8 edits in trunk/Source/WebCore

[Web IDL] Specify default values for optional parameters of type 'unsigned long'
https://bugs.webkit.org/show_bug.cgi?id=157043

Reviewed by Alex Christensen.

Specify default values for optional parameters of type 'unsigned long' and let
the bindings generator use WTF::Optional<> for the parameters that do not have
such default value.

Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::createScriptProcessor): Deleted.
(WebCore::AudioContext::createChannelSplitter): Deleted.
(WebCore::AudioContext::createChannelMerger): Deleted.

Modules/webaudio/AudioContext.h:
Modules/webaudio/AudioContext.idl:
bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameter): Deleted.

css/CSSStyleSheet.cpp:

(WebCore::CSSStyleSheet::addRule):

css/CSSStyleSheet.h:
inspector/InspectorStyleSheet.cpp:

(WebCore::InspectorStyleSheet::addRule):

3:16 PM Changeset in webkit [200109] by rniwa@webkit.org

2 edits in trunk/Tools

Fix text in log files autogenerated by import-w3c-tests
https://bugs.webkit.org/show_bug.cgi?id=157021

Unreviewed. Fixing the second typo.

Scripts/webkitpy/w3c/test_importer.py:

(TestImporter.write_import_log):

3:07 PM Changeset in webkit [200108] by rniwa@webkit.org

9 edits
2 adds in trunk

ASSERTION FAILED: m_templateInsertionModes.isEmpty() in WebCore::HTMLTreeBuilder::finished
https://bugs.webkit.org/show_bug.cgi?id=143519

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaselined the tests.

web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt:
web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset-expected.txt:
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt:

Source/WebCore:

The assertion failure was caused by our parser inconsistently following the spec. Fixed it by making our HTML parser
match the latest HTML5 specification. See inline comments below.

Tests: fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html

html5lib/generated/run-template-data.html
html5lib/generated/run-template-write.html
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset.html
imported/w3c/web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html

html/parser/HTMLTreeBuilder.cpp:

(WebCore::HTMLTreeBuilder::processStartTagForInBody): When parsing a template element for 'in body' insertion mode,
we process the token using the rules for 'in head' insertion mode, which sets the frameset-ok flag to "not ok".
In addition, 'in template' insertion mode should not special case a start tag whose tag name is "frame". Instead,
fallback to using 'in body' insertion mode.
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody
(WebCore::HTMLTreeBuilder::processStartTag): 'in frameset' insertion mode should not special case a start tag whose
tag name is "template": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inframeset
(WebCore::HTMLTreeBuilder::processEndTag): Ditto for an end tag whose name is "template".
(WebCore::HTMLTreeBuilder::processStartTagForInHead): When parsing a template element in 'in head' inserting mode,
we set the frameset-ok flag to "not ok": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead

LayoutTests:

Rebaselined the html5lib tests (now passes all the test cases!) and added a regression test for an assertion.

fast/dom/HTMLTemplateElement/parsing-template-with-frameset-expected.txt: Added.
fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html: Added.
html5lib/generated/run-template-data-expected.txt:
html5lib/generated/run-template-write-expected.txt:

2:47 PM Changeset in webkit [200107] by peavo@outlook.com

2 edits in trunk/Source/ThirdParty/ANGLE

[WinCairo][ANGLE] Display object is not created.
https://bugs.webkit.org/show_bug.cgi?id=157042

Reviewed by Alex Christensen.

The CreateDisplayFromAttribs function will not create a DisplayD3D object when the requested
type is EGL_PLATFORM_ANGLE_TYPE_DEFAULT_ANGLE, because ANGLE_ENABLE_OPENGL is not defined.
We should be able to create a DisplayD3D object without defining ANGLE_ENABLE_OPENGL.

src/libANGLE/Display.cpp:

1:09 PM Changeset in webkit [200106] by Beth Dakin

8 edits in trunk/Source

Check to make sure shouldRequestCandidates() before requesting candidates
https://bugs.webkit.org/show_bug.cgi?id=157038
-and corresponding-
rdar://problem/25910418

Reviewed by Tim Horton.

This patch limits requesting and showing candidates to cases where
shouldRequestCandidates() is true. This patch also caches the sequence number
returned by [NSSpellChecker requestCandidatesForSelectedRange:] to make sure
it is equal to the sequence number sent to the callback handler so that we do
not show candidates for old requests.

Source/WebKit/mac:

WebCoreSupport/WebEditorClient.h:
WebCoreSupport/WebEditorClient.mm:

(WebEditorClient::requestCandidatesForSelection):
(WebEditorClient::handleRequestedCandidates):

WebView/WebView.mm:

(-[WebView showCandidates:forString:inRect:forSelectedRange:view:completionHandler:]):
(-[WebView shouldRequestCandidates]):

WebView/WebViewInternal.h:

Source/WebKit2:

UIProcess/Cocoa/WebViewImpl.h:
UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::updateWebViewImplAdditions):
(WebKit::WebViewImpl::shouldRequestCandidates):
(WebKit::WebViewImpl::showCandidates):
(WebKit::WebViewImpl::requestCandidatesForSelectionIfNeeded):
(WebKit::WebViewImpl::handleRequestedCandidates):

1:01 PM Changeset in webkit [200105] by fpizlo@apple.com

4 edits in trunk

WebCore on Mac ignores the user's preferred region (country) while getting the language
https://bugs.webkit.org/show_bug.cgi?id=156993

Reviewed by Geoffrey Garen.

Source/WebCore:

This is tested by the NavigatorLanguage API test.

WebCore was previously getting the list of preferred languages, and for each one, deducing
the default region. That's wrong, since for example it doesn't respect the user's choice (in
System Preferences) to display dates/calenders/etc according to a different region (like how
I have my machine set to en-pl right now).

It might be possible for the country code we get via kCFLocaleCountryCode to be something
that our ICU doesn't handle. To defend against this, we search for the resulting country
code in ICU's ISO countries list. If it doesn't appear in that list, we fall back on old
behavior.

platform/mac/Language.mm:

(WebCore::httpStyleLanguageCode):
(WebCore::isValidICUCountryCode):
(WebCore::platformUserPreferredLanguages):

Tools:

Change the test expectations for this test. If the variant is not explicitly specified in
the AppleLanguage, then we use the locale's country code, which this test assumes is US.

TestWebKitAPI/Tests/mac/NavigatorLanguage.mm:

(TestWebKitAPI::languageForSystemLanguage):
(TestWebKitAPI::TEST):

12:49 PM Changeset in webkit [200104] by mmaxfield@apple.com

7 edits in trunk/Source/WebCore

Use auto-generated operators in FontPlatformData
https://bugs.webkit.org/show_bug.cgi?id=157037

Reviewed by Geoffrey Garen.

The only reason why they weren't used before is because Cairo was
using a raw pointer. However, RefPtr supports Cairo types, so this
patch migrates that pointer to a RefPtr. Therefore, we can remove
our custom operators (because they work the same way as auto-
generated ones do).

No new tests because there is no behavior change.

platform/graphics/FontPlatformData.cpp:

(WebCore::FontPlatformData::FontPlatformData): Deleted.
(WebCore::FontPlatformData::operator=): Deleted.

platform/graphics/FontPlatformData.h:

(WebCore::FontPlatformData::scaledFont):
(WebCore::FontPlatformData::hash):

platform/graphics/cocoa/FontPlatformDataCocoa.mm:

(WebCore::FontPlatformData::~FontPlatformData): Deleted.
(WebCore::FontPlatformData::platformDataInit): Deleted.
(WebCore::FontPlatformData::platformDataAssign): Deleted.

platform/graphics/win/FontPlatformDataCGWin.cpp:

(WebCore::FontPlatformData::~FontPlatformData): Deleted.
(WebCore::FontPlatformData::platformDataInit): Deleted.
(WebCore::FontPlatformData::platformDataAssign): Deleted.

platform/graphics/win/FontPlatformDataCairoWin.cpp:

(WebCore::FontPlatformData::platformDataInit):
(WebCore::FontPlatformData::FontPlatformData):
(WebCore::FontPlatformData::~FontPlatformData): Deleted.
(WebCore::FontPlatformData::platformDataAssign): Deleted.

platform/graphics/win/FontPlatformDataWin.cpp:

(WebCore::FontPlatformData::FontPlatformData): Deleted.

12:07 PM Changeset in webkit [200103] by Alan Bujtas

4 edits in trunk/Source/WebCore

Add renderer address and needslayout state to inlineboxtree dump.
https://bugs.webkit.org/show_bug.cgi?id=157035

Reviewed by Simon Fraser.

rendering/InlineBox.cpp:

(WebCore::InlineBox::showLineBox):

rendering/InlineTextBox.cpp:

(WebCore::InlineTextBox::showLineBox):

rendering/SimpleLineLayoutFunctions.cpp:

(WebCore::SimpleLineLayout::printPrefix):

11:40 AM Changeset in webkit [200102] by gskachkov@gmail.com

29 edits
1 add in trunk

calling super() a second time in a constructor should throw
https://bugs.webkit.org/show_bug.cgi?id=151113

Reviewed by Saam Barati and Keith Miller.

Source/JavaScriptCore:

Currently, our implementation checks if 'super()' was called in a constructor more
than once and raises a RuntimeError before the second call. According to the spec
we need to raise an error just after the second super() is finished and before
the new 'this' is assigned https://esdiscuss.org/topic/duplicate-super-call-behaviour.
To implement this behavior this patch adds a new op code, op_is_empty, that is used
to check if 'this' is empty.

bytecode/BytecodeList.json:
bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitIsEmpty):

bytecompiler/BytecodeGenerator.h:
bytecompiler/NodesCodegen.cpp:

(JSC::FunctionCallValueNode::emitBytecode):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileIsEmpty):

jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

jit/JIT.h:
jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_is_empty):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_is_empty):

llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
tests/stress/class-syntax-double-constructor.js: Added.

LayoutTests:

js/class-syntax-super-expected.txt:
js/script-tests/class-syntax-super.js:

11:35 AM Changeset in webkit [200101] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

Changed jsc options title to be more descriptive.
https://bugs.webkit.org/show_bug.cgi?id=157036

Reviewed by Joseph Pecoraro.

Let the title for --dumpOptions be "Modified JSC runtime options:" since it only
dumps overridden options. The title for --options will remain "All JSC runtime
options:" since it dumps all all options with verbose detail.

jsc.cpp:

(CommandLine::parseArguments):

11:27 AM Changeset in webkit [200100] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

[curl] Requests interrupted when using https via proxy
https://bugs.webkit.org/show_bug.cgi?id=157028

Patch by Fujii Hironori <Fujii Hironori> on 2016-04-26
Reviewed by Alex Christensen.

A proxy responds "200 Connection Established" to a CONNECT
method. This response doesn't have Content-Type, then the
request is canceled due to a unsupported MIME type. This is not
a real response from the recipient server. It should not be
processed normally. Just ignore the response.

platform/network/curl/ResourceHandleManager.cpp:

(WebCore::headerCallback):
Do nothing if httpCode is 0. This is the case of "200 Connection Established".

11:22 AM Changeset in webkit [200099] by Chris Dumez

4 edits in trunk/Source/WebCore

Drop Dictionary from CanUseWTFOptionalForParameter()
https://bugs.webkit.org/show_bug.cgi?id=157023

Reviewed by Darin Adler.

As per Web IDL, optional dictionary parameters are always considered to have
a default value of an empty dictionary, unless otherwise specified. There is
therefore never any need to use Optional<> for it. Just implement this
behavior in the bindings generator and drop blacklisting of Dictionary from
CanUseWTFOptionalForParameter().

bindings/scripts/CodeGeneratorJS.pm:

(GenerateParametersCheck):
(CanUseWTFOptionalForParameter): Deleted.

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjPrototypeFunctionOptionsObject):

11:20 AM Changeset in webkit [200098] by Antti Koivisto

117 edits in trunk/Source

RenderElement::style() should return const RenderStyle
https://bugs.webkit.org/show_bug.cgi?id=157016

Reviewed by Geoff Garen.

Style should be changed via setStyle, not by mutating it directly.

Pulling this string turns RenderStyle const in many places.

accessibility/AccessibilityObject.cpp:

(WebCore::startOfStyleRange):

accessibility/atk/WebKitAccessibleInterfaceText.cpp:

(getAttributeSetForAccessibilityObject):

bindings/objc/DOM.mm:

(-[DOMNode innerFrameQuad]):
(-[DOMNode computedFontSize]):

css/CSSComputedStyleDeclaration.cpp:

(WebCore::createPositionListForLayer):
(WebCore::positionOffsetValue):
(WebCore::ComputedStyleExtractor::currentColorOrValidColor):
(WebCore::getTransitionPropertyValue):
(WebCore::scrollSnapDestination):
(WebCore::scrollSnapPoints):
(WebCore::scrollSnapCoordinates):
(WebCore::logUnimplementedPropertyID):
(WebCore::fontFamilyFromStyle):
(WebCore::lineHeightFromStyle):
(WebCore::fontSizeFromStyle):
(WebCore::fontStyleFromStyle):
(WebCore::fontVariantFromStyle):
(WebCore::fontWeightFromStyle):
(WebCore::fontSynthesisFromStyle):
(WebCore::zoomAdjustedPaddingOrMarginPixelValue):
(WebCore::paddingOrMarginIsRendererDependent):
(WebCore::convertToRegionBreak):
(WebCore::isLayoutDependent):
(WebCore::updateStyleIfNeededForNode):
(WebCore::computeRenderStyleForProperty):
(WebCore::ComputedStyleExtractor::propertyValue):
(WebCore::CSSComputedStyleDeclaration::length):
(WebCore::CSSComputedStyleDeclaration::item):
(WebCore::ComputedStyleExtractor::propertyMatches):

css/CSSComputedStyleDeclaration.h:
css/CSSToLengthConversionData.cpp:

(WebCore::CSSToLengthConversionData::viewportWidthFactor):
(WebCore::CSSToLengthConversionData::viewportHeightFactor):
(WebCore::CSSToLengthConversionData::viewportMinFactor):
(WebCore::CSSToLengthConversionData::viewportMaxFactor):

css/CSSToLengthConversionData.h:

(WebCore::CSSToLengthConversionData::CSSToLengthConversionData):
(WebCore::CSSToLengthConversionData::style):
(WebCore::CSSToLengthConversionData::rootStyle):
(WebCore::CSSToLengthConversionData::computingFontSize):
(WebCore::CSSToLengthConversionData::copyWithAdjustedZoom):

css/CSSToStyleMap.cpp:

(WebCore::CSSToStyleMap::style):
(WebCore::CSSToStyleMap::rootElementStyle):

css/CSSToStyleMap.h:
css/MediaQueryEvaluator.cpp:

(WebCore::MediaQueryEvaluator::MediaQueryEvaluator):

css/MediaQueryEvaluator.h:
css/SVGCSSComputedStyleDeclaration.cpp:

(WebCore::strokeDashArrayToCSSValueList):
(WebCore::ComputedStyleExtractor::adjustSVGPaintForCurrentColor):
(WebCore::ComputedStyleExtractor::svgPropertyValue):

css/SourceSizeList.cpp:

(WebCore::match):
(WebCore::defaultLength):
(WebCore::computeLength):
(WebCore::parseSizesAttribute):

css/StyleBuilderCustom.h:

(WebCore::ApplyPropertyBorderImageModifier::applyValue):
(WebCore::ApplyPropertyBorderImageModifier::getValue):
(WebCore::StyleBuilderCustom::applyInheritClip):
(WebCore::StyleBuilderCustom::applyInheritCounter):
(WebCore::StyleBuilderCustom::applyValueContent):
(WebCore::StyleBuilderCustom::applyValueAlt):

css/StyleResolver.cpp:

(WebCore::StyleResolver::sweepMatchedPropertiesCache):
(WebCore::StyleResolver::State::State):
(WebCore::isAtShadowBoundary):
(WebCore::StyleResolver::styleForElement):
(WebCore::StyleResolver::keyframeStylesForAnimation):
(WebCore::StyleResolver::pseudoStyleForElement):
(WebCore::StyleResolver::applyProperty):
(WebCore::StyleResolver::checkForTextSizeAdjust):
(WebCore::StyleResolver::checkForZoomChange):
(WebCore::StyleResolver::checkForGenericFamilyChange):

css/StyleResolver.h:

(WebCore::StyleResolver::style):
(WebCore::StyleResolver::parentStyle):
(WebCore::StyleResolver::rootElementStyle):
(WebCore::StyleResolver::element):
(WebCore::StyleResolver::document):
(WebCore::StyleResolver::documentSettings):
(WebCore::StyleResolver::State::State):
(WebCore::StyleResolver::State::takeStyle):
(WebCore::StyleResolver::State::parentStyle):
(WebCore::StyleResolver::State::rootElementStyle):
(WebCore::StyleResolver::State::regionForStyling):
(WebCore::StyleResolver::State::elementLinkState):

dom/Document.cpp:

(WebCore::Document::updateLayoutIgnorePendingStylesheets):
(WebCore::Document::styleForElementIgnoringPendingStylesheets):
(WebCore::Document::setVisuallyOrdered):
(WebCore::Document::createParser):

dom/Document.h:
dom/Element.cpp:

(WebCore::Element::styleResolver):
(WebCore::Element::resolveStyle):
(WebCore::checkForEmptyStyleChange):
(WebCore::checkForSiblingStyleChanges):
(WebCore::beforeOrAfterPseudoElement):
(WebCore::Element::existingComputedStyle):
(WebCore::Element::resolveComputedStyle):
(WebCore::Element::computedStyle):
(WebCore::Element::didDetachRenderers):
(WebCore::Element::resolveCustomStyle):

dom/Element.h:
dom/Node.cpp:

(WebCore::computeEditabilityFromComputedStyle):
(WebCore::Node::pseudoAwareLastChild):
(WebCore::Node::computedStyle):

dom/Node.h:
dom/NodeRenderStyle.h:

(WebCore::Node::renderStyle):

dom/PseudoElement.cpp:

(WebCore::PseudoElement::clearHostElement):
(WebCore::PseudoElement::resolveCustomStyle):

dom/PseudoElement.h:
editing/ApplyBlockElementCommand.cpp:

(WebCore::isNewLineAtPosition):
(WebCore::ApplyBlockElementCommand::renderStyleOfEnclosingTextNode):
(WebCore::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded):
(WebCore::ApplyBlockElementCommand::endOfNextParagraphSplittingTextNodesIfNeeded):

editing/ApplyBlockElementCommand.h:
editing/EditingStyle.cpp:

(WebCore::EditingStyle::init):
(WebCore::EditingStyle::removeTextFillAndStrokeColorsIfNeeded):

editing/EditingStyle.h:
editing/Editor.h:
editing/SimplifyMarkupCommand.cpp:

(WebCore::SimplifyMarkupCommand::doApply):

editing/cocoa/EditorCocoa.mm:

(WebCore::Editor::styleForSelectionStart):
(WebCore::Editor::getTextDecorationAttributesRespectingTypingStyle):

editing/ios/EditorIOS.mm:

(WebCore::Editor::fontForSelection):
(WebCore::Editor::fontAttributesForSelectionStart):

editing/mac/EditorMac.mm:

(WebCore::Editor::fontForSelection):
(WebCore::Editor::fontAttributesForSelectionStart):

html/HTMLTitleElement.cpp:

(WebCore::HTMLTitleElement::computedTextWithDirection):

html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::FontProxy::fontsNeedUpdate):
(WebCore::CanvasRenderingContext2D::FontProxy::initialize):
(WebCore::CanvasRenderingContext2D::setFont):
(WebCore::CanvasRenderingContext2D::setTextBaseline):
(WebCore::CanvasRenderingContext2D::toTextDirection):
(WebCore::CanvasRenderingContext2D::drawTextInternal):

html/canvas/CanvasRenderingContext2D.h:
html/parser/HTMLResourcePreloader.cpp:

(WebCore::HTMLResourcePreloader::preload):
(WebCore::mediaAttributeMatches):

html/shadow/SliderThumbElement.cpp:

(WebCore::RenderSliderThumb::RenderSliderThumb):
(WebCore::RenderSliderThumb::updateAppearance):
(WebCore::RenderSliderContainer::layout):
(WebCore::SliderThumbElement::hostInput):
(WebCore::SliderThumbElement::resolveCustomStyle):
(WebCore::SliderContainerElement::createElementRenderer):
(WebCore::SliderContainerElement::resolveCustomStyle):

html/shadow/SliderThumbElement.h:
html/shadow/TextControlInnerElements.cpp:

(WebCore::TextControlInnerElement::create):
(WebCore::TextControlInnerElement::resolveCustomStyle):
(WebCore::TextControlInnerTextElement::renderer):
(WebCore::TextControlInnerTextElement::resolveCustomStyle):
(WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):
(WebCore::TextControlPlaceholderElement::resolveCustomStyle):

html/shadow/TextControlInnerElements.h:
page/EventHandler.cpp:

(WebCore::EventHandler::selectCursor):

page/animation/AnimationBase.cpp:

(WebCore::solveStepsFunction):
(WebCore::AnimationBase::AnimationBase):

page/animation/AnimationBase.h:

(WebCore::AnimationBase::~AnimationBase):
(WebCore::AnimationBase::renderer):
(WebCore::AnimationBase::animation):
(WebCore::AnimationBase::setAnimation):

page/animation/AnimationController.cpp:

(WebCore::AnimationController::cancelAnimations):
(WebCore::AnimationController::updateAnimations):

page/animation/AnimationController.h:
page/animation/CompositeAnimation.cpp:

(WebCore::CompositeAnimation::clearRenderer):
(WebCore::CompositeAnimation::updateTransitions):
(WebCore::CompositeAnimation::updateKeyframeAnimations):
(WebCore::CompositeAnimation::animate):

page/animation/CompositeAnimation.h:
page/animation/ImplicitAnimation.cpp:

(WebCore::ImplicitAnimation::ImplicitAnimation):
(WebCore::ImplicitAnimation::shouldSendEventForListener):
(WebCore::ImplicitAnimation::animate):
(WebCore::ImplicitAnimation::sendTransitionEvent):
(WebCore::ImplicitAnimation::reset):

page/animation/ImplicitAnimation.h:

(WebCore::ImplicitAnimation::create):

page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::KeyframeAnimation):
(WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty):
(WebCore::KeyframeAnimation::animate):

page/animation/KeyframeAnimation.h:
page/ios/FrameIOS.mm:

(WebCore::ancestorRespondingToScrollWheelEvents):

rendering/FlowThreadController.cpp:

(WebCore::FlowThreadController::styleDidChange):

rendering/InlineFlowBox.cpp:

(WebCore::clipRectForNinePieceImageStrip):

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::styleDidChange):
(WebCore::RenderBlock::lineHeight):
(WebCore::RenderBlock::firstLineBlock):
(WebCore::styleForFirstLetter):
(WebCore::RenderBlock::updateFirstLetterStyle):
(WebCore::RenderBlock::createFirstLetterRenderer):

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::adjustBlockChildForPagination):
(WebCore::calculateMinimumPageHeight):
(WebCore::RenderBlockFlow::adjustComputedFontSizes):

rendering/RenderBox.cpp:

(WebCore::RenderBox::styleDidChange):
(WebCore::RenderBox::borderRadii):
(WebCore::RenderBox::enclosingFloatPaintingLayer):
(WebCore::RenderBox::logicalVisualOverflowRectForPropagation):
(WebCore::RenderBox::visualOverflowRectForPropagation):
(WebCore::RenderBox::logicalLayoutOverflowRectForPropagation):
(WebCore::RenderBox::layoutOverflowRectForPropagation):

rendering/RenderBox.h:

(WebCore::RenderBox::applyTopLeftLocationOffset):
(WebCore::RenderBox::hasRenderOverflow):
(WebCore::RenderBox::hasVisualOverflow):

rendering/RenderBoxModelObject.cpp:

(WebCore::RenderBoxModelObject::backgroundRoundedRectAdjustedForBleedAvoidance):
(WebCore::applyBoxShadowForBackground):

rendering/RenderButton.cpp:

(WebCore::RenderButton::addChild):
(WebCore::RenderButton::styleWillChange):
(WebCore::RenderButton::styleDidChange):
(WebCore::RenderButton::setupInnerStyle):
(WebCore::RenderButton::layout):

rendering/RenderDeprecatedFlexibleBox.cpp:

(WebCore::RenderDeprecatedFlexibleBox::styleWillChange):

rendering/RenderElement.cpp:

(WebCore::RenderElement::createFor):
(WebCore::RenderElement::uncachedFirstLineStyle):
(WebCore::RenderElement::cachedFirstLineStyle):
(WebCore::RenderElement::firstLineStyle):
(WebCore::RenderElement::styleWillChange):
(WebCore::RenderElement::addControlStatesForRenderer):
(WebCore::RenderElement::getCachedPseudoStyle):
(WebCore::RenderElement::getMutableCachedPseudoStyle):
(WebCore::RenderElement::getUncachedPseudoStyle):
(WebCore::RenderElement::paintOutline):

rendering/RenderElement.h:

(WebCore::RenderElement::hasInitializedStyle):
(WebCore::RenderElement::style):
(WebCore::RenderElement::mutableStyle):
(WebCore::RenderElement::element):
(WebCore::RenderObject::isRenderInline):
(WebCore::RenderObject::style):
(WebCore::RenderObject::firstLineStyle):

rendering/RenderEmbeddedObject.cpp:

(WebCore::RenderEmbeddedObject::layout):

rendering/RenderFlowThread.cpp:

(WebCore::RenderFlowThread::RenderFlowThread):
(WebCore::RenderFlowThread::createFlowThreadStyle):

rendering/RenderFlowThread.h:
rendering/RenderImage.cpp:

(WebCore::RenderImage::layoutShadowControls):

rendering/RenderInline.cpp:

(WebCore::RenderInline::styleDidChange):
(WebCore::RenderInline::updateAlwaysCreateLineBoxes):
(WebCore::RenderInline::paintOutline):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::setupClipPath):

rendering/RenderListBox.cpp:

(WebCore::RenderListBox::paintScrollbar):
(WebCore::itemOffsetForAlignment):
(WebCore::RenderListBox::paintItemForeground):
(WebCore::RenderListBox::paintItemBackground):

rendering/RenderListMarker.cpp:

(WebCore::RenderListMarker::updateMargins):
(WebCore::RenderListMarker::lineHeight):

rendering/RenderMarquee.cpp:

(WebCore::RenderMarquee::computePosition):
(WebCore::RenderMarquee::updateMarqueeStyle):

rendering/RenderMenuList.cpp:

(WebCore::RenderMenuList::adjustInnerStyle):
(RenderMenuList::updateOptionsWidth):
(RenderMenuList::itemStyle):

rendering/RenderMultiColumnFlowThread.cpp:

(WebCore::isValidColumnSpanner):

rendering/RenderMultiColumnSpannerPlaceholder.cpp:

(WebCore::RenderMultiColumnSpannerPlaceholder::createAnonymous):

rendering/RenderMultiColumnSpannerPlaceholder.h:
rendering/RenderNamedFlowFragment.cpp:

(WebCore::RenderNamedFlowFragment::checkRegionStyle):
(WebCore::RenderNamedFlowFragment::computeStyleInRegion):

rendering/RenderNamedFlowFragment.h:
rendering/RenderObject.cpp:

(WebCore::RenderObject::innerLineHeight):
(WebCore::decorationColor):
(WebCore::RenderObject::getTextDecorationColorsAndStyles):

rendering/RenderObject.h:

(WebCore::RenderObject::minPreferredLogicalWidth):
(WebCore::RenderObject::maxPreferredLogicalWidth):

rendering/RenderTable.cpp:

(WebCore::RenderTable::computePreferredLogicalWidths):

rendering/RenderTableSection.cpp:

(WebCore::RenderTableSection::paintRowGroupBorderIfRequired):
(WebCore::physicalBorderForDirection):

rendering/RenderText.h:

(WebCore::RenderText::characterAt):
(WebCore::RenderText::style):
(WebCore::RenderText::firstLineStyle):
(WebCore::RenderText::getCachedPseudoStyle):

rendering/RenderTextControl.cpp:

(WebCore::RenderTextControl::styleDidChange):

rendering/RenderTextControlMultiLine.cpp:

(WebCore::RenderTextControlMultiLine::layoutSpecialExcludedChild):

rendering/RenderTextControlSingleLine.cpp:

(WebCore::RenderTextControlSingleLine::layout):
(WebCore::RenderTextControlSingleLine::styleDidChange):

rendering/RenderTextFragment.cpp:

(WebCore::RenderTextFragment::styleDidChange):

rendering/RenderThemeGtk.cpp:

(WebCore::RenderThemeGtk::paintMediaToggleClosedCaptionsButton):
(WebCore::borderRadiiFromStyle):
(WebCore::RenderThemeGtk::paintMediaSliderTrack):
(WebCore::RenderThemeGtk::paintMediaSliderThumb):
(WebCore::RenderThemeGtk::paintMediaVolumeSliderTrack):

rendering/SimpleLineLayoutFunctions.cpp:

(WebCore::SimpleLineLayout::paintFlow):
(WebCore::SimpleLineLayout::hitTestFlow):

rendering/TextAutoSizing.cpp:

(WebCore::TextAutoSizingKey::TextAutoSizingKey):

rendering/TextAutoSizing.h:

(WebCore::TextAutoSizingKey::style):
(WebCore::TextAutoSizingKey::isDeleted):

rendering/TextPaintStyle.cpp:

(WebCore::computeTextSelectionPaintStyle):

rendering/line/BreakingContext.h:
rendering/mathml/RenderMathMLRoot.cpp:

(WebCore::RenderMathMLRoot::layout):

rendering/style/RenderStyle.h:

(WebCore::RenderStyle::setColumnRuleWidth):
(WebCore::RenderStyle::resetColumnRule):
(WebCore::RenderStyle::setColumnSpan):
(WebCore::RenderStyle::inheritColumnPropertiesFrom):
(WebCore::RenderStyle::setTransform):
(WebCore::RenderStyle::setTransformOriginX):
(WebCore::RenderStyle::setTransformOriginY):

rendering/svg/SVGInlineTextBox.cpp:

(WebCore::SVGInlineTextBox::positionForOffset):
(WebCore::SVGInlineTextBox::selectionRectForTextFragment):
(WebCore::SVGInlineTextBox::localSelectionRect):
(WebCore::SVGInlineTextBox::paintSelectionBackground):
(WebCore::SVGInlineTextBox::paint):
(WebCore::SVGInlineTextBox::acquirePaintingResource):
(WebCore::SVGInlineTextBox::releasePaintingResource):
(WebCore::SVGInlineTextBox::prepareGraphicsContextForTextPainting):
(WebCore::SVGInlineTextBox::restoreGraphicsContextAfterTextPainting):
(WebCore::SVGInlineTextBox::constructTextRun):
(WebCore::SVGInlineTextBox::paintDecorationWithStyle):
(WebCore::SVGInlineTextBox::paintTextWithShadows):
(WebCore::SVGInlineTextBox::paintText):

rendering/svg/SVGInlineTextBox.h:
rendering/svg/SVGPathData.cpp:

(WebCore::updatePathFromCircleElement):
(WebCore::updatePathFromEllipseElement):
(WebCore::updatePathFromRectElement):

rendering/svg/SVGRenderingContext.cpp:

(WebCore::SVGRenderingContext::prepareToRenderSVGContent):

style/StyleTreeResolver.cpp:

(WebCore::Style::TreeResolver::Parent::Parent):
(WebCore::Style::TreeResolver::popScope):
(WebCore::Style::TreeResolver::styleForElement):
(WebCore::Style::TreeResolver::pushParent):
(WebCore::Style::TreeResolver::resolveComposedTree):

style/StyleTreeResolver.h:

(WebCore::Style::TreeResolver::scope):

style/StyleUpdate.cpp:

(WebCore::Style::Update::textUpdate):
(WebCore::Style::Update::elementStyle):
(WebCore::Style::Update::addElement):

style/StyleUpdate.h:

(WebCore::Style::Update::document):

svg/SVGElement.cpp:

(WebCore::SVGElement::synchronizeSystemLanguage):
(WebCore::SVGElement::resolveCustomStyle):
(WebCore::SVGElement::setUseOverrideComputedStyle):
(WebCore::SVGElement::computedStyle):

svg/SVGElement.h:
svg/SVGElementRareData.h:

(WebCore::SVGElementRareData::ensureAnimatedSMILStyleProperties):
(WebCore::SVGElementRareData::overrideComputedStyle):

svg/SVGGraphicsElement.cpp:

(WebCore::SVGGraphicsElement::animatedLocalTransform):

svg/SVGLengthContext.cpp:

(WebCore::SVGLengthContext::convertValueFromPercentageToUserUnits):
(WebCore::renderStyleForLengthResolving):
(WebCore::SVGLengthContext::convertValueFromUserUnitsToEMS):
(WebCore::SVGLengthContext::convertValueFromEMSToUserUnits):
(WebCore::SVGLengthContext::convertValueFromUserUnitsToEXS):
(WebCore::SVGLengthContext::convertValueFromEXSToUserUnits):

svg/SVGStopElement.cpp:

(WebCore::SVGStopElement::stopColorIncludingOpacity):

svg/SVGTextElement.cpp:

(WebCore::SVGTextElement::animatedLocalTransform):

10:46 AM Changeset in webkit [200097] by oliver@apple.com

2 edits in trunk/Source/JavaScriptCore

2016-04-26 Oliver Hunt <oliver@apple.com>

Enable separated heap by default on ios
https://bugs.webkit.org/show_bug.cgi?id=156720

Unreviewed roll-in of this change. There is only one
additional allocation involved in this logic, and that
is a duplicate mapping.

Either our tools are not report real memory usage
or this revision is not responsible for the regression.

runtime/Options.cpp: (JSC::recomputeDependentOptions):

10:38 AM Changeset in webkit [200096] by fpizlo@apple.com

6 edits
1 add in trunk/Source/JavaScriptCore

DFG backends shouldn't emit type checks at KnownBlah edges
https://bugs.webkit.org/show_bug.cgi?id=157025

Reviewed by Michael Saboff.

This fixes a crash I found when browsing Bing maps with forceEagerCompilation. I include a
100% repro test case.

The issue is that our code still doesn't fully appreciate the devious implications of
KnownBlah use kinds. Consider KnownCell for example. It means: "trust me, I know that this
value will be a cell". You aren't required to provide a proof when you use KnownCell. Often,
we use it as a result of a path-sensitive proof. The abstract interpreter is not
path-sensitive, so AI will be absolutely sure that the KnownCell use might see a non-cell.
This can lead to debug assertions (which this change removes) and it can lead to the backends
emitting a type check. That type check can be pure evil if the node that has this edge does
not have an exit origin. Such a node would have passed validation because the validater would
have thought that the node cannot exit (after all, according to the IR semantics, there is no
speculation at KnownCell).

This comprehensively fixes the issue by recognizing that Foo(KnownCell:@x) means: I have
already proved that by the time you start executing Foo, @x will already be a cell. I cannot
tell you how I proved this but you can rely on it anyway. AI now takes advantage of this
meaning and will always do filtering of KnownBlah edges regardless of whether the backend
actually emits any type checks for those edges. Since the filtering runs before the backend,
the backend will not emit any checks because it will know that the edge was already checked
(by whatever mechanism we used when we made the edge KnownBlah).

Note that it's good that we found this bug now. The DFG currently does very few
sparse-conditional or path-sensitive optimizations, but it will probably do more in the
future. The bug happens because GetByOffset and friends can achieve path-sensitive proofs via
watchpoints on the inferred type. Normally, AI can follow along with this proof. But in the
example program, and on Bing maps, we would GCSE one GetByOffset with another that had a
weaker proven type. That turned out to be completely sound - between the two GetByOffset's
there was a Branch to null check it. The inferred type of the second GetByOffset ended up
knowing that it cannot be null because null only occurred in some structures but not others.
If we added more sparse-conditional stuff to Branch, then AI would know how to follow along
with the proof but it would also create more situations where we'd have a path-sensitive
proof. So, it's good that we're now getting this right.

dfg/DFGAbstractInterpreter.h:

(JSC::DFG::AbstractInterpreter::filterEdgeByUse):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEdges):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeKnownEdgeTypes):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileCurrentBlock):

dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):

tests/stress/path-sensitive-known-cell-crash.js: Added.

(bar):
(foo):

10:28 AM Changeset in webkit [200095] by barraclough@apple.com

2 edits in trunk/Source/JavaScriptCore

Enable separated heap by default on ios
https://bugs.webkit.org/show_bug.cgi?id=156720

Unreviewed rollout - caused memory regression.

runtime/Options.cpp:

(JSC::recomputeDependentOptions):

10:20 AM Changeset in webkit [200094] by mmaxfield@apple.com

13 edits in trunk/Source/WebCore

Make FontPlatformData immutable
https://bugs.webkit.org/show_bug.cgi?id=157024

Reviewed by Darin Adler.

This patch deletes all functions which modify a FontPlatformData once
it has been created. This makes for a cleaner design.

No new tests because there is no behavior change.

platform/graphics/Font.cpp:

(WebCore::Font::verticalRightOrientationFont):
(WebCore::Font::nonSyntheticItalicFont):

platform/graphics/FontPlatformData.cpp:

(WebCore::FontPlatformData::FontPlatformData):
(WebCore::FontPlatformData::cloneWithOrientation):
(WebCore::FontPlatformData::cloneWithSyntheticOblique):

platform/graphics/FontPlatformData.h:

(WebCore::FontPlatformData::setIsSystemFont): Deleted.
(WebCore::FontPlatformData::setSize): Deleted.
(WebCore::FontPlatformData::setOrientation): Deleted.
(WebCore::FontPlatformData::setSyntheticOblique): Deleted.

platform/graphics/cocoa/FontCacheCoreText.cpp:

(WebCore::FontCache::systemFallbackForCharacters):

platform/graphics/cocoa/FontCascadeCocoa.mm:

(WebCore::FontCascade::drawGlyphs):

platform/graphics/cocoa/FontCocoa.mm:

(WebCore::Font::platformInit):
(WebCore::Font::platformCharWidthInit):
(WebCore::createDerivativeFont):
(WebCore::Font::createFontWithoutSynthesizableFeatures):
(WebCore::Font::platformCreateScaledFont):
(WebCore::Font::platformWidthForGlyph):

platform/graphics/cocoa/FontPlatformDataCocoa.mm:

(WebCore::FontPlatformData::openTypeTable):

platform/graphics/win/FontPlatformDataCairoWin.cpp:

(WebCore::FontPlatformData::platformDataInit):

10:19 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

10:17 AM Changeset in webkit [200093] by Ryan Haddad

2 edits in trunk/Source/WebCore

Unreviewed, rolling out r200089.

This change causes API test failures

Reverted changeset:

"WebCore on Mac ignores the user's preferred region (country)
while getting the language"
https://bugs.webkit.org/show_bug.cgi?id=156993
http://trac.webkit.org/changeset/200089

9:47 AM Changeset in webkit [200092] by commit-queue@webkit.org

4 edits in trunk/Source/JavaScriptCore

Improve jsc --help and making sampling options
https://bugs.webkit.org/show_bug.cgi?id=157015

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-04-26
Reviewed by Saam Barati.

Simplify sampling options to be easier to remember:

--reportSamplingProfilerData => --sample
--samplingProfilerTimingInterval => --sampleInterval

Update the --help to mention --sample, and restore the behavior of
--options outputing all possible options so you can discover which
options are available.

jsc.cpp:

(printUsageStatement):
(CommandLine::parseArguments):
Improve help and modify option dumping.

runtime/Options.h:
runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::SamplingProfiler):
Rename the sampling interval option.

9:45 AM Changeset in webkit [200091] by Brent Fulgham

2 edits in trunk/Source/WebCore

GuardMalloc crash in WebCore::HTMLFrameElementBase::marginHeight()
https://bugs.webkit.org/show_bug.cgi?id=157020
<rdar://problem/25148315>

Reviewed by Darin Adler.

Calls to setIntegralAttribute triggers event handling code, which can cause
the underlying m_frameOwnerElement member to be deleted. We could clone this
object, but since we only want the width and height we should just read them
while we know the object is in a good state, then execute the potentially
mutating methods.

Tested by imported/blink/fast/dom/HTMLBodyElement/body-inserting-iframe-crash.html.

html/HTMLBodyElement.cpp:

(WebCore::HTMLBodyElement::insertedInto): Read margin width and height before
calling setIntegralAttribute.

9:33 AM Changeset in webkit [200090] by rniwa@webkit.org

3 edits in trunk/Websites/perf.webkit.org

Chart status should always be computed against prior values
https://bugs.webkit.org/show_bug.cgi?id=157014

Reviewed by Darin Adler.

Compare the current value against the last baseline or target value that appear before the current value in time
so that the comparison stay the same even when new baseline and target values are reported. Also include the compared
baseline or target value in the label for clarity.

public/v3/components/chart-status-view.js:

(ChartStatusView.prototype._computeChartStatus):
(ChartStatusView.prototype._computeChartStatus.labelForDiff):
(ChartStatusView.prototype._findLastPointPriorToTime): Extracted from _relativeDifferenceToLaterPointInTimeSeries.
Now finds the last point before the current point's time if there is any, or the last point in baseline / target.
(ChartStatusView.prototype._relativeDifferenceToLaterPointInTimeSeries): Deleted.

public/v3/models/metric.js:

(Metric.prototype.makeFormatter): Don't use SI units for unit-less metrics.

9:22 AM Changeset in webkit [200089] by fpizlo@apple.com

2 edits in trunk/Source/WebCore

WebCore on Mac ignores the user's preferred region (country) while getting the language
https://bugs.webkit.org/show_bug.cgi?id=156993

Reviewed by Geoffrey Garen.

I don't know how to test this since this depends on user settings.

WebCore was previously getting the list of preferred languages, and for each one, deducing
the default region. That's wrong, since for example it doesn't respect the user's choice (in
System Preferences) to display dates/calenders/etc according to a different region (like how
I have my machine set to en-pl right now).

It might be possible for the country code we get via kCFLocaleCountryCode to be something
that our ICU doesn't handle. To defend against this, we search for the resulting country
code in ICU's ISO countries list. If it doesn't appear in that list, we fall back on old
behavior.

platform/mac/Language.mm:

(WebCore::httpStyleLanguageCode):
(WebCore::platformUserPreferredLanguages):

9:12 AM Changeset in webkit [200088] by Chris Dumez

5 edits in trunk/Source/WebCore

[Web IDL] Specify default values for optional parameters of TypedArray types
https://bugs.webkit.org/show_bug.cgi?id=157017

Reviewed by Darin Adler.

Specify default values for optional parameters of TypedArray types and let
the bindings generator use WTF::Optional<> for the ones that do not have a
default value.

bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameter): Deleted.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::webkitGenerateKeyRequest):
(WebCore::HTMLMediaElement::webkitAddKey):
(WebCore::HTMLMediaElement::webkitCancelKeyRequest): Deleted.

html/HTMLMediaElement.h:
html/HTMLMediaElement.idl:

9:07 AM Changeset in webkit [200087] by Chris Dumez

17 edits in trunk/Source/WebCore

[Web IDL] Specify default values for optional parameters of type 'long' / 'unrestricted double'
https://bugs.webkit.org/show_bug.cgi?id=157012

Reviewed by Darin Adler.

Specify default values for optional parameters of type 'long' / 'unrestricted double'
and let the bindings generator use WTF::Optional<> for the ones that do not have a
default value.

Modules/mediastream/RTCDTMFSender.cpp:

(WebCore::RTCDTMFSender::insertDTMF):
(WebCore::RTCDTMFSender::didPlayTone): Deleted.

Modules/mediastream/RTCDTMFSender.h:
Modules/webaudio/AudioBufferSourceNode.cpp:

(WebCore::AudioBufferSourceNode::start):
(WebCore::AudioBufferSourceNode::startPlaying): Deleted.

Modules/webaudio/AudioBufferSourceNode.h:
Modules/webaudio/AudioBufferSourceNode.idl:
Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::createDelay): Deleted.

Modules/webaudio/AudioContext.h:
Modules/webaudio/AudioContext.idl:
Modules/webaudio/AudioScheduledSourceNode.cpp:

(WebCore::AudioScheduledSourceNode::start): Deleted.
(WebCore::AudioScheduledSourceNode::stop): Deleted.

Modules/webaudio/AudioScheduledSourceNode.h:
Modules/webaudio/OscillatorNode.idl:
bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameter): Deleted.

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
(WebCore::jsTestObjConstructorFunctionClassMethodWithOptional):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithOptionalIntArgumentPromise):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArgAndDefaultValue): Deleted.
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString): Deleted.
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod4): Deleted.
(WebCore::jsTestObjConstructorFunctionClassMethod2): Deleted.
(WebCore::jsTestObjConstructorFunctionOverloadedMethod1): Deleted.
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise): Deleted.

html/HTMLInputElement.idl:
page/WindowTimers.idl:
testing/Internals.h:
testing/Internals.idl:

8:03 AM Changeset in webkit [200086] by commit-queue@webkit.org

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Clarify Heap Snapshot instance Retained Size by hiding retained size of non-dominated children
https://bugs.webkit.org/show_bug.cgi?id=157018

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-04-26
Reviewed by Timothy Hatcher.

UserInterface/Proxies/HeapSnapshotNodeProxy.js:

(WebInspector.HeapSnapshotNodeProxy):
(WebInspector.HeapSnapshotNodeProxy.deserialize):

UserInterface/Workers/HeapSnapshot/HeapSnapshot.js:

(HeapSnapshot.prototype.serializeNode):
Include dominatorNodeIdentifier in the default proxy properties.

UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:

(WebInspector.HeapSnapshotInstanceDataGridNode):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.get node):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.createCellContent):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._isDominatedByBase):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._isDominatedByNonBaseParent):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._populate):

UserInterface/Views/HeapSnapshotInstancesContentView.css:

(.heap-snapshot > .data-grid td .sub-retained):
Save the base HeapSnapshotInstanceDataGridNode so that it can be referenced by
children. When expanding an instance, hide the retained size for children
that are not dominated by the base object. Show the retained size for children
for children that are dominated. If dominated directly, show the size in the
normal black. If dominated transitively, show the size in a dimmed gray.

7:58 AM Changeset in webkit [200085] by peavo@outlook.com

2 edits in trunk/Source/ThirdParty/ANGLE

[WinCairo][WebGL] Enable ESSL and GLSL translators.
https://bugs.webkit.org/show_bug.cgi?id=157002

Reviewed by Darin Adler.

Enable support for ESSL and GLSL translators, and add missing files.

CMakeLists.txt:

7:49 AM Changeset in webkit [200084] by gskachkov@gmail.com

28 edits
1 delete in trunk

Unreviewed, rolling out r200083.
https://bugs.webkit.org/show_bug.cgi?id=157033

It brokes the debug build (Requested by gskachkov on

#webkit).

Reverted changeset:

"calling super() a second time in a constructor should throw"
https://bugs.webkit.org/show_bug.cgi?id=151113
http://trac.webkit.org/changeset/200083

Patch by Commit Queue <commit-queue@webkit.org> on 2016-04-26

7:19 AM Changeset in webkit [200083] by gskachkov@gmail.com

28 edits
1 add in trunk

calling super() a second time in a constructor should throw
https://bugs.webkit.org/show_bug.cgi?id=151113

Reviewed by Saam Barati and Keith Miller.

Source/JavaScriptCore:

bytecode/BytecodeList.json:
bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::emitIsEmpty):

bytecompiler/BytecodeGenerator.h:
bytecompiler/NodesCodegen.cpp:

(JSC::FunctionCallValueNode::emitBytecode):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileIsEmpty):

jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

jit/JIT.h:
jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_is_empty):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_is_empty):

llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
tests/stress/class-syntax-double-constructor.js: Added.

LayoutTests:

js/class-syntax-super-expected.txt:
js/script-tests/class-syntax-super.js:

6:52 AM Changeset in webkit [200082] by timothy@apple.com

2 edits in trunk/Websites/webkit.org

Remove hard-wraps from the feature policy markdown so it renders full width on the site.

feature-policy.md:

6:34 AM WebKitGTK/2.12.x edited by Carlos Garcia Campos

(diff)

6:32 AM Changeset in webkit [200081] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r200046 - [GTK] Crashes if DISPLAY is unset
https://bugs.webkit.org/show_bug.cgi?id=156972

Reviewed by Carlos Garcia Campos.

If DISPLAY is unset then m_display will be NULL, crashing WebKit
when XCloseDisplay is called in the PlatformDisplayX11 destructor.

platform/graphics/x11/PlatformDisplayX11.cpp:

(WebCore::PlatformDisplayX11::~PlatformDisplayX11):

6:20 AM Changeset in webkit [200080] by youenn.fablet@crf.canon.fr

7 edits in trunk

Drop [UsePointersEvenForNonNullableObjectArguments] from SpeechSynthesis
https://bugs.webkit.org/show_bug.cgi?id=156901

Reviewed by Darin Adler.

Source/WebCore:

SpeechSynthesis.speak will now throw in case of bad parameters instead of silently failing.
Started refactoring to use more references where possible.

Covered by updated test.

Modules/speech/SpeechSynthesis.cpp:

(WebCore::SpeechSynthesis::startSpeakingImmediately): Refactored to get a reference.
(WebCore::SpeechSynthesis::speak):
(WebCore::SpeechSynthesis::fireEvent):
(WebCore::SpeechSynthesis::handleSpeakingCompleted): Removing first item in utteranceQueue unconditionally,
since that would crash in Debug mode otherwise.
(WebCore::SpeechSynthesis::boundaryEventOccurred):
(WebCore::SpeechSynthesis::didStartSpeaking):
(WebCore::SpeechSynthesis::didPauseSpeaking):
(WebCore::SpeechSynthesis::didResumeSpeaking):
(WebCore::SpeechSynthesis::didFinishSpeaking):
(WebCore::SpeechSynthesis::speakingErrorOccurred):

Modules/speech/SpeechSynthesis.h:
Modules/speech/SpeechSynthesis.idl:

LayoutTests:

Updated test to handle speak throwing behavior in case of bad parameters.

fast/speechsynthesis/speech-synthesis-crash-on-bad-utterance-expected.txt:
fast/speechsynthesis/speech-synthesis-crash-on-bad-utterance.html:

6:17 AM Changeset in webkit [200079] by youenn.fablet@crf.canon.fr

2 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from WebKitNamedFlow
https://bugs.webkit.org/show_bug.cgi?id=156979

Reviewed by Chris Dumez.

No change of behavior.

dom/WebKitNamedFlow.idl: Marking contentNode parameter as nullable.

6:03 AM Changeset in webkit [200078] by youenn.fablet@crf.canon.fr

5 edits in trunk

Drop [UsePointersEvenForNonNullableObjectArguments] from EventTarget
https://bugs.webkit.org/show_bug.cgi?id=156977

Reviewed by Chris Dumez.

Source/WebCore:

No change of behavior.

dom/EventTarget.idl:

LayoutTests:

fast/events/dispatchEvent-crash-expected.txt:
fast/events/dispatchEvent-crash.html: Ensuring exceptions are logged.

1:16 AM Changeset in webkit [200077] by Gyuyoung Kim

2 edits in trunk/Source/WebKit2

[EFL] Update expectation result in ewk_context_preferred_languages API test
https://bugs.webkit.org/show_bug.cgi?id=157027

Reviewed by Carlos Garcia Campos.

platformLanguage() has been returning lower case value since r199815. Thus existing expected result
needs to be updated together.

UIProcess/API/efl/tests/test_ewk2_context.cpp: Change en-US with en-us.

(TEST_F):

12:28 AM Changeset in webkit [200076] by zandobersek@gmail.com

3 edits in trunk/Source/WebKit2

Mark two methods in the CoordinatedGraphicsScene and the
ThreadedCoordinatedLayerTreeHost classes as overrides, fixing
the compiler warnings.

Rubber-stamped by Carlos Garcia Campos.

Shared/CoordinatedGraphics/CoordinatedGraphicsScene.h:
WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.h:

Apr 25, 2016:

10:56 PM Changeset in webkit [200075] by rniwa@webkit.org

46 edits in trunk

Remove the build flag for template elements
https://bugs.webkit.org/show_bug.cgi?id=157022

Reviewed by Daniel Bates.

Source/cmake/OptionsEfl.cmake:
Source/cmake/OptionsMac.cmake:
Source/cmake/OptionsWin.cmake:
Source/cmake/WebKitFeatures.cmake:
Source/cmake/tools/vsprops/FeatureDefines.props:
Source/cmake/tools/vsprops/FeatureDefinesCairo.props:

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig:

Source/WebCore:

Removed the build flag.

Configurations/FeatureDefines.xcconfig:
DerivedSources.cpp:
bindings/js/JSHTMLTemplateElementCustom.cpp:

(WebCore::JSHTMLTemplateElement::content):

css/html.css:

(summary::-webkit-details-marker):
(template):
(bdi, output):

dom/ContainerNode.cpp:

(WebCore::isInTemplateContent):
(WebCore::containsConsideringHostElements):
(WebCore::ContainerNode::parserInsertBefore):
(WebCore::ContainerNode::parserAppendChild):

dom/Document.cpp:

(WebCore::Document::Document):
(WebCore::Document::~Document):
(WebCore::Document::getCachedLocale):
(WebCore::Document::ensureTemplateDocument):
(WebCore::Document::fonts):

dom/Document.h:

(WebCore::Document::setTemplateDocumentHost):
(WebCore::Document::templateDocumentHost):
(WebCore::Document::hasDisabledFieldsetElement):
(WebCore::Document::textEncoding):
(WebCore::Document::templateDocument):

dom/Element.cpp:

(WebCore::Element::setInnerHTML):

dom/Node.cpp:

(WebCore::Node::containsIncludingHostElements):
(WebCore::Node::pseudoAwarePreviousSibling):

dom/TemplateContentDocumentFragment.h:
editing/MarkupAccumulator.cpp:

(WebCore::MarkupAccumulator::serializeNodesWithNamespaces):

editing/markup.cpp:

(WebCore::createFragmentForInnerOuterHTML):

html/HTMLTagNames.in:
html/HTMLTemplateElement.cpp:

(WebCore::HTMLTemplateElement::didMoveToNewDocument):

html/HTMLTemplateElement.h:
html/HTMLTemplateElement.idl:
html/parser/HTMLConstructionSite.cpp:

(WebCore::insert):
(WebCore::HTMLConstructionSite::insertTextNode):
(WebCore::HTMLConstructionSite::ownerDocumentForCurrentNode):
(WebCore::HTMLConstructionSite::findFosterSite):

html/parser/HTMLElementStack.cpp:

(WebCore::HTMLNames::isScopeMarker):
(WebCore::HTMLNames::isTableScopeMarker):
(WebCore::HTMLNames::isTableBodyScopeMarker):
(WebCore::HTMLNames::isTableRowScopeMarker):
(WebCore::HTMLElementStack::inSelectScope):
(WebCore::HTMLElementStack::hasTemplateInHTMLScope):
(WebCore::HTMLElementStack::htmlElement):

html/parser/HTMLElementStack.h:
html/parser/HTMLPreloadScanner.cpp:

(WebCore::TokenPreloadScanner::scan):

html/parser/HTMLPreloadScanner.h:
html/parser/HTMLStackItem.h:

(WebCore::isSpecialNode):

html/parser/HTMLTreeBuilder.cpp:

(WebCore::HTMLTreeBuilder::isParsingTemplateContents):
(WebCore::HTMLTreeBuilder::isParsingFragmentOrTemplateContents):
(WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
(WebCore::HTMLTreeBuilder::processStartTagForInBody):
(WebCore::HTMLTreeBuilder::didCreateCustomOrCallbackElement):
(WebCore::HTMLTreeBuilder::processTemplateStartTag):
(WebCore::HTMLTreeBuilder::processEndOfFileForInTemplateContents):
(WebCore::HTMLTreeBuilder::processColgroupEndTagForInColumnGroup):
(WebCore::HTMLTreeBuilder::processStartTagForInTable):
(WebCore::HTMLTreeBuilder::processStartTag):
(WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
(WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):
(WebCore::HTMLTreeBuilder::processEndTagForInCell):
(WebCore::HTMLTreeBuilder::processEndTagForInBody):
(WebCore::HTMLTreeBuilder::processEndTag):
(WebCore::HTMLTreeBuilder::processCharacterBuffer):
(WebCore::HTMLTreeBuilder::processEndOfFile):
(WebCore::HTMLTreeBuilder::processStartTagForInHead):
(WebCore::HTMLTreeBuilder::finished):

html/parser/HTMLTreeBuilder.h:
inspector/InspectorDOMAgent.cpp:

(WebCore::InspectorDOMAgent::buildObjectForNode):

inspector/InspectorInstrumentation.h:

(WebCore::InspectorInstrumentation::instrumentingAgentsForDocument):

xml/parser/XMLDocumentParserLibxml2.cpp:

(WebCore::XMLDocumentParser::startElementNs):

Source/WebKit/mac:

Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

Configurations/FeatureDefines.xcconfig:

Source/WTF:

wtf/FeatureDefines.h:

Tools:

Removed the build option.

Scripts/webkitperl/FeatureList.pm:

10:07 PM Changeset in webkit [200074] by jiewen_tan@apple.com

2 edits in trunk/Source/WebCore

[iOS] ftp links crash @ WebCore::FTPDirectoryDocumentParser::appendEntry
https://bugs.webkit.org/show_bug.cgi?id=157019
<rdar://problem/24292650>

Reviewed by Chris Dumez.

Create separate Ref<Element> object for every row element instead of reusing
one because Ref<>'s operator=() does not allow assignment after a WTFMove().

html/FTPDirectoryDocument.cpp:

(WebCore::FTPDirectoryDocumentParser::appendEntry):

9:29 PM Changeset in webkit [200073] by rniwa@webkit.org

2 edits in trunk/Tools

Fix text in log files autogenerated by import-w3c-tests
https://bugs.webkit.org/show_bug.cgi?id=157021

Reviewed by Chris Dumez.

s/Webkit/WebKit/ and end each sentence with a period.

Scripts/webkitpy/w3c/test_importer.py:

(TestImporter.write_import_log):

9:22 PM Changeset in webkit [200072] by rniwa@webkit.org

3 edits
57 adds
1 delete in trunk/LayoutTests

Update template element tests
https://bugs.webkit.org/show_bug.cgi?id=154996

Reviewed by Daniel Bates.

LayoutTests/imported/w3c:

Reimported W3C tests for template elements as of d5a4c5bdf8a1837b4fcf50bbd2efd4150ddafa99.
Also moved the parser tests from html-templates to web-platform-tests/html/syntax to match the upstream directory structure.

html-templates: Removed.
html-templates/parsing-html-templates: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-a-foster-parent-element-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-a-foster-parent-element.html: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-not-a-foster-parent-element-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-not-a-foster-parent-element.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-body-token-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-body-token.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-frameset-token-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-frameset-token.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-head-token-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-head-token.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-html-token-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-html-token.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-body-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-body.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-html-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-html.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode: Removed.
html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one.html: Removed.
html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode: Removed.
html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode/end-tag-table-expected.txt: Removed.
html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode/end-tag-table.html: Removed.
html-templates/parsing-html-templates/appending-to-a-template: Removed.
html-templates/parsing-html-templates/appending-to-a-template/template-child-nodes-expected.txt: Removed.
html-templates/parsing-html-templates/appending-to-a-template/template-child-nodes.html: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context-expected.txt: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context.html: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context-expected.txt: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context.html: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context-expected.txt: Removed.
html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context.html: Removed.
html-templates/parsing-html-templates/creating-an-element-for-the-token: Removed.
html-templates/parsing-html-templates/creating-an-element-for-the-token/template-owner-document-expected.txt: Removed.
html-templates/parsing-html-templates/creating-an-element-for-the-token/template-owner-document.html: Removed.
html-templates/resources: Removed.
html-templates/resources/end-template-tag-in-body.html: Removed.
html-templates/resources/end-template-tag-in-head.html: Removed.
html-templates/resources/frameset-end-tag.html: Removed.
html-templates/resources/head-template-contents-div-no-end-tag.html: Removed.
html-templates/resources/head-template-contents-table-no-end-tag.html: Removed.
html-templates/resources/html-start-tag.html: Removed.
html-templates/resources/template-child-nodes-div.xhtml: Removed.
html-templates/resources/template-child-nodes-nested.xhtml: Removed.
html-templates/resources/template-contents-attribute.html: Removed.
html-templates/resources/template-contents-body.html: Removed.
html-templates/resources/template-contents-div-no-end-tag.html: Removed.
html-templates/resources/template-contents-empty.html: Removed.
html-templates/resources/template-contents-frameset.html: Removed.
html-templates/resources/template-contents-head.html: Removed.
html-templates/resources/template-contents-html.html: Removed.
html-templates/resources/template-contents-nested.html: Removed.
html-templates/resources/template-contents-table-no-end-tag.html: Removed.
html-templates/resources/template-contents-text.html: Removed.
html-templates/resources/template-contents.html: Removed.
html-templates/resources/template-descendant-body.html: Removed.
html-templates/resources/template-descendant-frameset.html: Removed.
html-templates/resources/template-descendant-head.html: Removed.
html-templates/resources/two-templates.html: Removed.
html-templates/testcommon.js: Removed.
web-platform-tests/html/syntax: Added.
web-platform-tests/html/syntax/parsing: Added.
web-platform-tests/html/syntax/parsing/template: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-a-foster-parent-element-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-a-foster-parent-element.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-not-a-foster-parent-element-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-not-a-foster-parent-element.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-body-token-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-body-token.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-frameset-token-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-frameset-token.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-head-token-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-head-token.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-html-token-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-html-token.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-body-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-body.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-html-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-html.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/end-tag-table-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/end-tag-table.html: Added.
web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/appending-to-a-template: Added.
web-platform-tests/html/syntax/parsing/template/appending-to-a-template/template-child-nodes-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/appending-to-a-template/template-child-nodes.html: Added.
web-platform-tests/html/syntax/parsing/template/appending-to-a-template/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context.html: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context.html: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context.html: Added.
web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/w3c-import.log: Added.
web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token: Added.
web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/template-owner-document-expected.txt: Added.
web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/template-owner-document.html: Added.
web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/w3c-import.log: Added.

LayoutTests:

platform/mac/TestExpectations:

9:08 PM Changeset in webkit [200071] by commit-queue@webkit.org

2 edits
1 add in trunk/Source/JavaScriptCore

[JSC] Constant folding of UInt32ToNumber is incorrect
https://bugs.webkit.org/show_bug.cgi?id=157011
rdar://problem/25769641

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-25
Reviewed by Geoffrey Garen.

UInt32ToNumber should return the unsigned 32bit value of
its child. The abstract interpreter fails to do that when handling
Int52.

None of the tests caught that because the bytecode generator already
fold the operation if given a constant. If the constant is not visible
from the bytecode generator (for example because it comes from an inlined call),
then the abstract interpreter folding was producing invalid results.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

tests/stress/uint32-to-number-constant-folding.js: Added.

(uint32ToNumberMinusOne):
(uint32ToNumberMinusOnePlusInteger):
(inlineMinusOne):
(uint32ToNumberOnHiddenMinusOne):
(uint32ToNumberOnHiddenMinusOnePlusInteger):
(inlineLargeNegativeNumber1):
(inlineLargeNegativeNumber2):
(inlineLargeNegativeNumber3):
(uint32ToNumberOnHiddenLargeNegativeNumber1):
(uint32ToNumberOnHiddenLargeNegativeNumber2):
(uint32ToNumberOnHiddenLargeNegativeNumber3):

8:53 PM Changeset in webkit [200070] by mmaxfield@apple.com

13 edits in trunk

[Cocoa] Guarantee FontPlatformData's m_cgFont is never nullptr
https://bugs.webkit.org/show_bug.cgi?id=156929

Reviewed by Darin Adler.

Source/WebCore:

After some investigation, it turns out that there is no place where it is meaningful
to pass us a null CoreText font. Therefore, the CoreGraphics font is also never null.

We should simply check for these null values at the ingestion site in order to
make the guarantee internally of having non-null values.

platform/graphics/FontPlatformData.cpp:

(WebCore::FontPlatformData::FontPlatformData): Because the pointer is never null, we
can delete the code which handles that case.

platform/graphics/FontPlatformData.h:
platform/graphics/cocoa/FontPlatformDataCocoa.mm: Ditto.

(WebCore::webFallbackFontFamily): Deleted.
(WebCore::FontPlatformData::setFallbackCGFont): Deleted.

platform/graphics/mac/ComplexTextControllerCoreText.mm:

(WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Asking the
CTRun for its kCTFontAttributeName will always return non-null.

platform/graphics/mac/FontCustomPlatformData.cpp:

(WebCore::FontCustomPlatformData::fontPlatformData): Once we have a font descriptor,
CTFontCreateWithFontDescriptor() will always return non-null. We check if the font
descriptor is null elsewhere.

platform/mac/DragImageMac.mm: The fonts in this file are gotten by asking for the

system font, which will always return non-null.
(WebCore::fontFromNSFont):
(WebCore::widthWithFont):
(WebCore::drawAtPoint):
(WebCore::createDragImageForLink):

Source/WebKit/mac:

Misc/WebKitNSStringExtras.mm:

(-[NSString _web_drawAtPoint:font:textColor:allowingFontSmoothing:]): Drawing
a string with a null font shouldn't do anything.

Misc/WebStringTruncator.mm: We can't truncate a string if we don't have a font

to use.
(+[WebStringTruncator centerTruncateString:toWidth:]):
(+[WebStringTruncator centerTruncateString:toWidth:withFont:]):
(+[WebStringTruncator rightTruncateString:toWidth:withFont:]):
(+[WebStringTruncator widthOfString:font:]):

Tools:

TestWebKitAPI/Tests/mac/StringTruncator.mm:

(TestWebKitAPI::TEST):

8:52 PM Changeset in webkit [200069] by mmaxfield@apple.com

3 edits in trunk/LayoutTests

Cloning a textarea does not clone the textarea's value
https://bugs.webkit.org/show_bug.cgi?id=156637

Reviewed by Chris Dumez.

https://dom.spec.whatwg.org/#concept-node-clone describes that the value
of a node shouldn't be copied when cloning the node.

fast/forms/checkValidity-cloneNode-crash-expected.txt:
fast/forms/checkValidity-cloneNode-crash.html:

8:22 PM Changeset in webkit [200068] by commit-queue@webkit.org

4 edits in trunk/Source

Heap corruption is detected when destructing JSGlobalObject
https://bugs.webkit.org/show_bug.cgi?id=156831

Patch by Fujii Hironori <Fujii Hironori> on 2016-04-25
Reviewed by Mark Lam.

WebKit uses CRT static library on Windows. Each copy of the CRT
library has its own heap manager, allocating memory in one CRT
library and passing the pointer across a DLL boundary to be freed
by a different copy of the CRT library is a potential cause for
heap corruption.

Potential Errors Passing CRT Objects Across DLL Boundaries
<https://msdn.microsoft.com/en-us/library/ms235460(v=vs.140).aspx>

JSGlobalObject::createRareDataIfNeeded is inlined but
JSGlobalObject::~JSGlobalObject is not. Then, the heap of
allocating JSGlobalObjectRareData is WebKit.dll, but deallocating
JavaScriptCore.dll. Adding WTF_MAKE_FAST_ALLOCATED to
JSGlobalObjectRareData ensures heap consistency of it. WTF::Lock
also needs WTF_MAKE_FAST_ALLOCATED because it is allocated from
the inlined constructor of JSGlobalObjectRareData.

Source/JavaScriptCore:

Test: fast/dom/insertedIntoDocument-iframe.html

runtime/JSGlobalObject.h:

Add WTF_MAKE_FAST_ALLOCATED to JSGlobalObjectRareData.

Source/WTF:

wtf/Lock.h: Add WTF_MAKE_FAST_ALLOCATED.

6:00 PM Changeset in webkit [200067] by Matt Baker

15 edits in trunk/Source/WebInspectorUI

Web Inspector: hook up grid row filtering in the new Timelines UI
https://bugs.webkit.org/show_bug.cgi?id=154924
<rdar://problem/24934607>

Reviewed by Timothy Hatcher.

Re-implement timeline data grid filtering that previously existed in the
navigation sidebar. This patch adds support for filter text, scope bars,
and filtering based on ruler selection.

Multi-column filter support is now part of DataGrid. The grid checks compares
filter text against cell data of type string. DataGridNode subclasses may
provide custom string data for columns that format complex objects (such
as SourceCodeLocations). Cells containing data of type number are not
considered for filtering at this time.

UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid):
(WebInspector.DataGrid.prototype.set filterText):
(WebInspector.DataGrid.prototype.get filterDelegate):
(WebInspector.DataGrid.prototype.set filterDelegate):
(WebInspector.DataGrid.prototype.filterDidChange):
Called internally by the grid whenever the filter text or delegate changes.
Also called by clients that implement a filter delegate, to inform the
grid that a custom filter has changed.

(WebInspector.DataGrid.prototype.hasCustomFilters):
(WebInspector.DataGrid.prototype.matchNodeAgainstCustomFilters):
Calls the filter delegate, if it exists, and provides a hook for
subclasses to provide custom filtering.

(WebInspector.DataGrid.prototype._applyFiltersToNode.matchTextFilter):
(WebInspector.DataGrid.prototype._applyFiltersToNode.makeVisible):
(WebInspector.DataGrid.prototype._applyFiltersToNode):
Filters data grid nodes and fires filter events as needed.
(WebInspector.DataGrid.prototype._hasFilterDelegate):
Helper function.
(WebInspector.DataGrid.prototype._updateVisibleRows):
Exclude hidden nodes from revealed rows.
(WebInspector.DataGrid.prototype._updateFilter):
Filtering entry point, called on an animation frame. Updates visible
rows if any node was filtered/unfiltered.

(WebInspector.DataGridNode):
(WebInspector.DataGridNode.prototype.get filterableData):
Gets an array of filterable strings for the node.
(WebInspector.DataGridNode.prototype.refresh):
Resets cached filterable strings.
(WebInspector.DataGridNode.prototype.filterableDataForColumn):
Can be overridden by subclasses to provide filterable text for complex
cell data, like as objects formatted as document fragments.

UserInterface/Views/LayoutTimelineDataGridNode.js:

(WebInspector.LayoutTimelineDataGridNode.prototype.get data):

UserInterface/Views/LayoutTimelineView.js:

(WebInspector.LayoutTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.LayoutTimelineView.prototype.filterDidChange):
Update highlight after grid filter change.
(WebInspector.LayoutTimelineView.prototype._dataGridSelectedNodeChanged):
Update highlight when selection changes.
(WebInspector.LayoutTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.LayoutTimelineView.prototype.treeElementDeselected): Deleted.
(WebInspector.LayoutTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.LayoutTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/NetworkTimelineView.js:

(WebInspector.NetworkTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.NetworkTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.NetworkTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.NetworkTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/OverviewTimelineView.js:

(WebInspector.OverviewTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.OverviewTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/RenderingFrameTimelineView.js:

(WebInspector.RenderingFrameTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.RenderingFrameTimelineView.prototype.get filterStartTime):
(WebInspector.RenderingFrameTimelineView.prototype.get filterEndTime):
Convert selection indices into filter start and end times.
(WebInspector.RenderingFrameTimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
Perform custom filtering on rendering frame duration.
(WebInspector.RenderingFrameTimelineView.prototype._scopeBarSelectionDidChange):
Inform grid of custom filter change.
(WebInspector.RenderingFrameTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.RenderingFrameTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/ResourceTimelineDataGridNode.js:

(WebInspector.ResourceTimelineDataGridNode.prototype.filterableDataForColumn):
Use URL string for filtering "name" column.

UserInterface/Views/ScriptClusterTimelineView.js:

(WebInspector.ScriptClusterTimelineView.prototype.updateFilter):
Forwarding for TimelineView API.
(WebInspector.ScriptClusterTimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
(WebInspector.ScriptClusterTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
Renamed to matchDataGridNodeAgainstCustomFilters.
(WebInspector.ScriptClusterTimelineView.prototype._scriptClusterViewCurrentContentViewDidChange): Deleted.
Removed FIXME comment. Updating TimelineView times is sufficient to trigger filtering.

UserInterface/Views/ScriptDetailsTimelineView.js:

(WebInspector.ScriptDetailsTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

UserInterface/Views/ScriptTimelineDataGridNode.js:

(WebInspector.ScriptTimelineDataGridNode.prototype.filterableDataForColumn):
Use main title and subtitle strings for filtering "name" column.
(WebInspector.ScriptTimelineDataGridNode.prototype._createNameCellDocumentFragment):
(WebInspector.ScriptTimelineDataGridNode.prototype._subtitle):
Break out for use in filterableDataForColumn.

UserInterface/Views/TimelineDataGrid.js:

(WebInspector.TimelineDataGrid):
Cleanup variable names.
(WebInspector.TimelineDataGrid.prototype.hasCustomFilters):
Always true because filtering on ruler selection always occurs.
(WebInspector.TimelineDataGrid.prototype.matchNodeAgainstCustomFilters):
Match nodes against scope bar filters.
(WebInspector.TimelineDataGrid.prototype._scopeBarSelectedItemsDidChange):
Inform grid of custom filter change.
(WebInspector.TimelineDataGrid.prototype.treeElementMatchesActiveScopeFilters): Deleted.
Re-implemented as _nodeMatchesActiveScopeFilters.
(WebInspector.TimelineDataGrid.prototype._updateScopeBarForcedVisibility): Deleted.
Old UI. No longer needed.

UserInterface/Views/TimelineDataGridNode.js:

(WebInspector.TimelineDataGridNode.prototype.filterableDataForColumn):
Filter strings for SourceCodeLocation and CallFrame objects.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView):
Listen for FilterBar changes and TimelineView record filtering.
(WebInspector.TimelineRecordingContentView.prototype._filterDidChange):
Update grid filters when filter bar changes.
(WebInspector.TimelineRecordingContentView.prototype._recordWasFiltered):
Update overview when records are filtered/unfiltered.
(WebInspector.TimelineRecordingContentView.prototype.filterDidChange): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.recordWasFiltered): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.matchTreeElementAgainstCustomFilters.checkTimeBounds): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
Re-implemented in DataGrid.
(WebInspector.TimelineRecordingContentView.prototype._updateTimes): Deleted.
FIXME comment removed. Filtering occurs when TimelineView times are updated.
(WebInspector.TimelineRecordingContentView.prototype._timeRangeSelectionChanged): Deleted.

UserInterface/Views/TimelineView.js:

(WebInspector.TimelineView):
(WebInspector.TimelineView.prototype.get navigationItems):
Used by TimelineRecordingContentView to add scope bar items to the
lower content browser's navigation bar.

(WebInspector.TimelineView.prototype.set startTime):
(WebInspector.TimelineView.prototype.set endTime):
(WebInspector.TimelineView.prototype.set currentTime):
Update grid filter when recording times change.
(WebInspector.TimelineView.prototype.get filterStartTime):
(WebInspector.TimelineView.prototype.get filterEndTime):
Let subclasses (RenderingFrameTimelineView) provide filter start/end times.
(WebInspector.TimelineView.prototype.setupDataGrid):
Register the grid used by the TimelineView subclass, allowing the base
class to hook into common event listeners and provide boilerplate functionality.

(WebInspector.TimelineView.prototype.updateFilter):
For data grid views, updates grid filters and sets new filter text.
(WebInspector.TimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
(WebInspector.TimelineView.prototype.dataGridMatchNodeAgainstCustomFilters.checkTimeBounds):
(WebInspector.TimelineView.prototype.dataGridMatchNodeAgainstCustomFilters):
DataGrid filter delegate. Lets subclasses apply custom filters first,
then filters based on ruler selection if needed.

(WebInspector.TimelineView.prototype.filterDidChange):
Hook for subclasses to respond to filter changes.
(WebInspector.TimelineView.prototype._filterTimesDidChange.delayedWork):
(WebInspector.TimelineView.prototype._filterTimesDidChange):
Helper function for coalescing ruler selection updates into a single
filter update.

(WebInspector.TimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.TimelineView.prototype.filterUpdated): Deleted.
No longer needed.

5:50 PM Changeset in webkit [200066] by Chris Dumez

3 edits in trunk/Source/WebCore

Crash under MemoryCache::remove()
https://bugs.webkit.org/show_bug.cgi?id=157000
<rdar://problem/23344660>

Reviewed by Andreas Kling.

MemoryCache::evictResources() was caching the number of resources ('size')
in the cache for a particular sessionID, and then proceed to call
MemoryCache::remove() 'size' times using the first item in the HashMap
each time. This was unsafe because resources may be ref'ing each other
and therefore removing one may cause other resources to get removed as
well. In such case, we would call remove() too many times and crash because
we dereferenced resources.begin()->value (with the HashMap being empty).

This patch avoids the issue by copying the resources to a Vector and
ref'ing them first, before going on to remove each one from the cache.

loader/cache/MemoryCache.cpp:

(WebCore::MemoryCache::forEachSessionResource):
(WebCore::MemoryCache::evictResources):

loader/cache/MemoryCache.h:

5:44 PM Changeset in webkit [200065] by Joseph Pecoraro

11 edits
2 adds in trunk

Web Inspector: React.js JSXTransformer produces bogus error locations
https://bugs.webkit.org/show_bug.cgi?id=150010
<rdar://problem/23062233>

Reviewed by Timothy Hatcher.

Source/WebInspectorUI:

Show dynamically added <script> elements added to a frame as resources.
For cases where the scripts had source map resources or error messages
we have a root from which to associate them to.

Localizations/en.lproj/localizedStrings.js:

"Script Element %d" tree element title.

UserInterface/Models/Frame.js:

(WebInspector.Frame.prototype.commitProvisionalLoad):
(WebInspector.Frame.prototype.get extraScripts):
(WebInspector.Frame.prototype.addExtraScript):
Have a frame keep a list of its extra scripts.

UserInterface/Models/Script.js:

(WebInspector.Script):
(WebInspector.Script.prototype.get displayName):
(WebInspector.Script.prototype.get dynamicallyAddedScriptElement):
Identify dynamically added script elements and associate them
with the frame, instead of the frame's main resource.

UserInterface/Views/FrameTreeElement.js:

(WebInspector.FrameTreeElement.prototype.onpopulate):
(WebInspector.FrameTreeElement.prototype._extraScriptAdded):
Show named / source mapped dynamic script elements under a frame.

UserInterface/Views/ResourceSidebarPanel.js:

(WebInspector.ResourceSidebarPanel.prototype._scriptWasAdded):
Dynamically added script element Scripts will be added by the frame that
owns them.

UserInterface/Views/ScriptTreeElement.js:

(WebInspector.ScriptTreeElement):
Don't include a subtitle for dynamicallyAddedScriptElement, details match
the frame that owns them.

LayoutTests:

inspector/model/frame-extra-scripts-expected.txt: Added.
inspector/model/frame-extra-scripts.html: Added.

Add a test for a WebInspector.Frame's extraScripts list.

inspector/model/script-resource-relationship-expected.txt
inspector/model/script-resource-relationship.html

Add a test for a dynamicallyAddedScriptElement.
Remove debug logging.

5:44 PM Changeset in webkit [200064] by Joseph Pecoraro

11 edits in trunk/Source/WebInspectorUI

Web Inspector: Line error widget showed in the wrong resource
https://bugs.webkit.org/show_bug.cgi?id=150009
<rdar://problem/23062199>

Reviewed by Timothy Hatcher.

This addresses a few long standing issues:

IssueMessage and ConsoleMessage should not fight eachother
Displayed issue messages now correctly have format string formatting, e.g. console.error("Foo %s", str)
IssueMessage wraps a ConsoleMessage, so we don't duplicate everything
Gives ConsoleMessage a sourceCodeLocation (lazy)
- Since a sourceCodeLocation can have the exact SourceCode, if it was a Script without a Resource, we can only show the error in the Script's editor.

UserInterface/Models/CallFrame.js:

(WebInspector.CallFrame.fromPayload):
Prefer the script identifier lookup first. And from the Script go
to a resource if possible. This allows us to distinguish a location
that should be in a Script that doesn't have a Resource when there
exists a Resource with the same URL. This will soon be the case
for dyanamic <script> elements append to a document.

UserInterface/Controllers/IssueManager.js:

(WebInspector.IssueManager.issueMatchSourceCode):
Consolidate all the different checks to this one function.

(WebInspector.IssueManager.prototype.issueWasAdded):
Create IssueMessages with ConsoleMessages.

(WebInspector.IssueManager.prototype.issuesForSourceCode):
Simplify now that we have the better check.

UserInterface/Controllers/LogManager.js:

(WebInspector.LogManager.prototype.messageWasAdded):
Once a ConsoleMessage has been created (and modified parameters for us)
create the IssueMessage if it was an issue.

UserInterface/Models/ConsoleMessage.js:

(WebInspector.ConsoleMessage.prototype.get sourceCodeLocation):
Lazily create a source code from the best possible location. This can
be the top call frame or the url/line/column combination.

UserInterface/Models/IssueMessage.js:

(WebInspector.IssueMessage):
Creation and most properties just call through to a ConsoleMessage.
The type and text are Issue specific. Anything that uses location
data should use the sourceCodeLocation.

(WebInspector.IssueMessage.prototype.saveIdentityToCookie):
Fix implementation that didn't account for a null sourceCodeLocation.

(WebInspector.IssueMessage.prototype._formatTextIfNecessary):
Basic text format message formatting.

UserInterface/Protocol/ConsoleObserver.js:

(WebInspector.ConsoleObserver.prototype.messageAdded):
No longer call IssueMessage from the observer. Let LogManager trigger issues.

UserInterface/Views/ContentView.js:

(WebInspector.ContentView.createFromRepresentedObject):
(WebInspector.ContentView.resolvedRepresentedObjectForRepresentedObject):
(WebInspector.ContentView.isViewable):
An IssueMessage represented object for an IssueMessageTreeElement should be
restorable by just going to the sourceCodeLocation it references. This is
identical to a Breakpoint.

UserInterface/Views/IssueTreeElement.js:

(WebInspector.IssueTreeElement.prototype._updateTitles):
(WebInspector.IssueTreeElement):

UserInterface/Views/ResourceContentView.js:

(WebInspector.ResourceContentView.prototype._issueWasAdded):

UserInterface/Views/SourceCodeTextEditor.js:

(WebInspector.SourceCodeTextEditor.prototype._issueWasAdded):
(WebInspector.SourceCodeTextEditor.prototype._addIssue):
(WebInspector.SourceCodeTextEditor.prototype._reinsertAllIssues):
(WebInspector.SourceCodeTextEditor.prototype._matchesIssue): Deleted.
Update to use Issue's sourceCodeLocation or IssueManager's new APIs.

5:23 PM Changeset in webkit [200063] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking fast/layers/no-clipping-overflow-hidden-added-after-transform.html as flaky on mac-wk1
https://bugs.webkit.org/show_bug.cgi?id=157007

Unreviewed test gardening.

platform/mac-wk1/TestExpectations:

5:13 PM Changeset in webkit [200062] by Chris Dumez

4 edits in trunk/Source/WebCore

Crash under WebCore::MutationObserver::deliverAllMutations()
https://bugs.webkit.org/show_bug.cgi?id=156997
<rdar://problem/16542323>

Reviewed by Ryosuke Niwa.

The crash traces indicate that we may derefence a null pointer when
dereferencing MutationCallback::scriptExecutationContext() in
MutationObserver::canDeliver(). This can happen when the script
execution context gets destroyed as a JSMutationCallback is an
ActiveDOMObject, which is a ContextDestructionObserver.

This patch refactors the code so that MutationObserver::canDeliver()
now simply asks JSMutationCallback if it can invoke its callback.
JSMutationCallback makes this decision using
ActiveDOMCallback::canInvokeCallback() which does a proper null
check of the ScriptExecutationContext. This avoids some code
duplication and fixes the crash.

bindings/js/JSMutationCallback.h:
dom/MutationCallback.h:
dom/MutationObserver.cpp:

(WebCore::MutationObserver::canDeliver):

5:12 PM Changeset in webkit [200061] by beidson@apple.com

2 edits in trunk/Source/WebCore

Fix a flaky test after r200032

fileapi/File.cpp:

(WebCore::File::lastModified): This used to return a date object which did a WTF::timeClip on the double,

but now that we're returning a raw double we need to WTF::timeClip it ourselves.

4:50 PM Changeset in webkit [200060] by ggaren@apple.com

9 edits in trunk/PerformanceTests

bmalloc: Misc improvements to MallocBench
https://bugs.webkit.org/show_bug.cgi?id=157004

Reviewed by Darin Adler.

MallocBench/run-malloc-benchmarks: Added --memory and --memory_warning

modes for focused memory testing.

MallocBench/MallocBench/Benchmark.cpp:

(Benchmark::printReport): Clarified output.

(Benchmark::currentMemoryBytes): Added compressed memory because top
does the same. (It always happens to zero in the benchmarks we run. But
this is good for sanity.)

MallocBench/MallocBench/CommandLine.cpp: Moved up to 8 runs to reduce

variance.

MallocBench/MallocBench/alloc_free.cpp:

(benchmark_alloc_free): Cycle a single allocation in order to stress
the effect of merging on calls to madvise.

MallocBench/MallocBench/big.cpp:

(benchmark_big): Graduated to 8kB-128kB because medium tests up to 8 and
our large allocator doesn't kick in until 64kB.

MallocBench/MallocBench/medium.cpp:

(benchmark_medium): Test all the way down to 1kB because our large
allocator used to service 1kB allocations and 1kB is an interesting
middle size where memory is unusually large but allocation throughput
still matters.

MallocBench/MallocBench/stress.cpp:

(benchmark_stress): Reduced the churn count to match stress_aligned
because this test was taking too long to complete.

MallocBench/MallocBench/stress_aligned.cpp:

(benchmark_stress_aligned): Our new large allocator can handle even
more absurdly large values.

4:41 PM Changeset in webkit [200059] by commit-queue@webkit.org

3 edits in trunk/Tools

[Tools] whitelist all-uppercase JSTokenType enum in JavaScriptCore
https://bugs.webkit.org/show_bug.cgi?id=156976

Patch by Caitlin Potter <caitp@igalia.com> on 2016-04-25
Reviewed by Darin Adler.

Mitigate style-checker spam on bugs which introduce new JavaScript
token types.

Scripts/webkitpy/style/checkers/cpp.py:

(_EnumState.init):
(_EnumState.process_clean_line):

Scripts/webkitpy/style/checkers/cpp_unittest.py:

(NoNonVirtualDestructorsTest.test_enum_casing):

4:39 PM Changeset in webkit [200058] by Chris Dumez

8 edits in trunk/Source/WebCore

[Web IDL] Specify default values for optional parameters of type 'float' / 'unrestricted float'
https://bugs.webkit.org/show_bug.cgi?id=156995

Reviewed by Darin Adler.

Specify default values for optional parameters of type 'float' / 'unrestricted float'
and let the bindings generator use WTF::Optional<> for the ones that do not have a
default value.

bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameter): Deleted.

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::jsTestTypedefsPrototypeFunctionSetShadow):

html/canvas/CanvasRenderingContext2D.cpp:

(WebCore::CanvasRenderingContext2D::setStrokeColor):
(WebCore::CanvasRenderingContext2D::setFillColor):
(WebCore::CanvasRenderingContext2D::setShadow):
(WebCore::CanvasRenderingContext2D::fillText):
(WebCore::CanvasRenderingContext2D::strokeText):
(WebCore::CanvasRenderingContext2D::drawTextInternal):
(WebCore::CanvasRenderingContext2D::clearShadow): Deleted.
(WebCore::normalizeSpaces): Deleted.
(WebCore::CanvasRenderingContext2D::measureText): Deleted.

html/canvas/CanvasRenderingContext2D.h:
html/canvas/CanvasRenderingContext2D.idl:
testing/Internals.idl:

4:34 PM Changeset in webkit [200057] by Beth Dakin

2 edits in trunk/Source/WebKit/mac

WebEditorClient should properly write to m_rangeForCandidates
https://bugs.webkit.org/show_bug.cgi?id=157003
-and corresponding-
rdar://problem/25910418

Reviewed by Tim Horton.

Actually write to m_rangeForCandidates instead of declaring a local variable
of the same name. :-/

WebCoreSupport/WebEditorClient.mm:

(WebEditorClient::requestCandidatesForSelection):

4:13 PM Changeset in webkit [200056] by Brent Fulgham

6 edits in trunk

Add port 4190 (managesieve) to port blacklist
https://bugs.webkit.org/show_bug.cgi?id=156986
<rdar://problem/9119470>

Reviewed by Daniel Bates.

Source/WebCore:

Tested by security/block-test.html.

platform/URL.cpp:

(WebCore::portAllowed): Add 4190 to the port blacklist.

LayoutTests:

platform/mac/security/block-test-expected.txt
security/block-test-expected.txt:
security/block-test.html:

4:04 PM Changeset in webkit [200055] by Ryan Haddad

73 edits
1 add in trunk/LayoutTests

Rebaseline editing tests for ios-simulator-wk1

Unreviewed test gardening

platform/ios-simulator-wk1/editing/deleting/delete-at-paragraph-boundaries-002-expected.txt:
+71 more

3:40 PM Changeset in webkit [200054] by n_wang@apple.com

3 edits
2 adds in trunk

AX: Crash at -[WebAccessibilityObjectWrapper accessibilityAttributeValue:] + 4391
https://bugs.webkit.org/show_bug.cgi?id=156987

Reviewed by Chris Fleizach.

Source/WebCore:

When we hit test on a slider indicator asking for the value when the parent slider's
accessibility object is not created or the parent slider has been removed, it will cause
crash. Fixed it by adding a check to see if the object is detached from the parent.

Test: accessibility/mac/slider-thumb-value-crash.html

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

LayoutTests:

accessibility/mac/slider-thumb-value-crash-expected.txt: Added.
accessibility/mac/slider-thumb-value-crash.html: Added.

3:40 PM Changeset in webkit [200053] by Simon Fraser

3 edits in trunk/Tools

Fix issues with content-animation performance tests
https://bugs.webkit.org/show_bug.cgi?id=157001

Reviewed by Sam Weinig.

Add patch content for svg-animation.html, and fix the paths in the patch so
it applies correctly.

Add the patch file to the .plan file.

Scripts/webkitpy/benchmark_runner/data/patches/ContentAnimation.patch:
Scripts/webkitpy/benchmark_runner/data/plans/content-animation.plan:

2:58 PM Changeset in webkit [200052] by jer.noble@apple.com

2 edits in trunk/Source/WebCore

WebKitPlaybackSessionModelMediaElement should initialize the interface added by setWebPlaybackSessionInterface() with initial data
https://bugs.webkit.org/show_bug.cgi?id=156996

Reviewed by Beth Dakin.

Notify the interface of the current values in the media element when the model is given an interface.

platform/cocoa/WebPlaybackSessionModelMediaElement.mm:

(WebPlaybackSessionModelMediaElement::setWebPlaybackSessionInterface):

2:38 PM Changeset in webkit [200051] by beidson@apple.com

2 edits in trunk/LayoutTests

Attempt to fix a flaky test after r200032
https://bugs.webkit.org/show_bug.cgi?id=156994

http/tests/local/fileapi/script-tests/file-last-modified-after-delete.js: Missed renaming this along with all the others.

2:13 PM Changeset in webkit [200050] by Chris Dumez

2 edits in trunk/Source/WebKit2

Crash under -[WKWebView _mayAutomaticallyShowVideoPictureInPicture] + 32 (WKWebView.mm:309)
https://bugs.webkit.org/show_bug.cgi?id=156990
<rdar://problem/25904376>

Reviewed by Jer Noble.

In case of WebProcess crash, WebPageProxy::processDidCrash() will call resetState() which
will nullify WebPageProxy::m_videoFullscreenManager. In WebPageProxy::reattachToWebProcess(),
we then call updateViewState() before re-initializing m_videoFullscreenManager, and
updateViewState() ends up calling [WKWebView _mayAutomaticallyShowVideoPictureInPicture]
which dereferences WebPageProxy::m_videoFullscreenManager without null check. This patch
adds a null check for m_videoFullscreenManager in _mayAutomaticallyShowVideoPictureInPicture.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _mayAutomaticallyShowVideoPictureInPicture]):

2:07 PM Changeset in webkit [200049] by Simon Fraser

2 edits
1 add in trunk/PerformanceTests

Add a content animation test that uses SVG animation.
https://bugs.webkit.org/show_bug.cgi?id=156827

Animation/svg-animation.html: Added.
Skipped:

1:59 PM Changeset in webkit [200048] by msaboff@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

Crash using @tryGetById in DFG
https://bugs.webkit.org/show_bug.cgi?id=156992

Reviewed by Filip Pizlo.

We need to spill live registers when compiling TryGetById in DFG.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileTryGetById):

tests/stress/regress-156992.js: New test.

(tryMultipleGetByIds):
(test):

1:56 PM Changeset in webkit [200047] by Simon Fraser

9 edits
4 adds in trunk

Toggling animation-play-state can re-start a finished animation
https://bugs.webkit.org/show_bug.cgi?id=156731

Reviewed by Dean Jackson.

Source/WebCore:

After an animation completed, CompositeAnimation::updateKeyframeAnimations() cleared
all state that the animation had run on the element, so changing the value of some
animation property triggered the animation to run again. This is wrong, since animation-name
still applied to the element.

Fix by keeping state for keyframe animations in the Done state in the m_keyframeAnimations
map. This allows for the removal of the index property on KeyframeAnimation.

Tests: animations/change-completed-animation-transform.html

animations/change-completed-animation.html

page/animation/AnimationBase.cpp:

(WebCore::AnimationBase::timeToNextService):

page/animation/AnimationBase.h:

(WebCore::AnimationBase::isAnimatingProperty):

page/animation/CompositeAnimation.cpp: Add animations that should stick around to AnimationNameMap,

and swap with m_keyframeAnimations at the end.
(WebCore::CompositeAnimation::updateKeyframeAnimations):

page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::KeyframeAnimation):
(WebCore::KeyframeAnimation::getAnimatedStyle):

page/animation/KeyframeAnimation.h:

LayoutTests:

animations/animation-direction-reverse-expected.txt:
animations/animation-direction-reverse.html: This is a progression. The test was detecting a

restarted animation.

animations/change-completed-animation-expected.txt: Added.
animations/change-completed-animation-transform-expected.html: Added.
animations/change-completed-animation-transform.html: Added. Ref test that ensures that the final

state for normal and accelerated animations is correct.

animations/change-completed-animation.html: Added. Tests that changing a property doesn't trigger

another animation, by detecting a second animationstart event.

1:51 PM WebKitGTK/2.12.x edited by berto@igalia.com

(diff)

1:48 PM Changeset in webkit [200046] by berto@igalia.com

2 edits in trunk/Source/WebCore

[GTK] Crashes if DISPLAY is unset
https://bugs.webkit.org/show_bug.cgi?id=156972

Reviewed by Carlos Garcia Campos.

If DISPLAY is unset then m_display will be NULL, crashing WebKit
when XCloseDisplay is called in the PlatformDisplayX11 destructor.

platform/graphics/x11/PlatformDisplayX11.cpp:

(WebCore::PlatformDisplayX11::~PlatformDisplayX11):

1:33 PM Changeset in webkit [200045] by beidson@apple.com

2 edits in trunk/Tools

Tweaking IndexedDB watchlist and adding myself to it.

Scripts/webkitpy/common/config/watchlist:

1:07 PM Changeset in webkit [200044] by Ryan Haddad

2 edits in trunk/Source/WebCore

Update JS bindings test results after r200037

Unreviewed test gardening.

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):

1:06 PM Changeset in webkit [200043] by Simon Fraser

8 edits
2 adds in trunk

play-state not parsed as part of animation shorthand
https://bugs.webkit.org/show_bug.cgi?id=156959

Reviewed by Darin Adler.

Source/WebCore:

We failed to parse animation-play-state as part of the animation shorthand, contrary
to the spec and other browsers.

Fix for both the prefixed and unprefixed properties. There is some compat risk here,
but only changing unprefixed behavior will probably lead to more author confusion.

Test: animations/play-state-in-shorthand.html

css/CSSParser.cpp:

(WebCore::CSSParser::parseAnimationShorthand):

css/CSSPropertyNames.in:
css/StylePropertyShorthand.cpp:

(WebCore::animationShorthandForParsing): Remove the long comment which is no longer relevant
now that the behavior has been written into the spec.

LayoutTests:

animations/animation-shorthand-expected.txt:
animations/animation-shorthand.html:
animations/play-state-in-shorthand-expected.txt: Added.
animations/play-state-in-shorthand.html: Added.
animations/resources/animation-test-helpers.js:

(getPropertyValue):
(comparePropertyValue):

1:06 PM Changeset in webkit [200042] by Simon Fraser

4 edits
2 adds in trunk

Negative animation-delay is treated as 0s
https://bugs.webkit.org/show_bug.cgi?id=141008

Reviewed by Daniel Bates.

Source/WebCore:

Fix keyframe animations which start in the paused state.

Explicitly move such animations from the new to the paused state, and
set m_pauseTime to 0, rather than leaving it at -1. Fix getElapsedTime()
to compute a correct time elapsed time for such animations, which takes
negative delay into account correctly.

Fix assertions which need to account for the new transition of New -> PlayStatePaused.

Test: animations/play-state-start-paused.html

page/animation/AnimationBase.cpp:

(WebCore::AnimationBase::updateStateMachine):
(WebCore::AnimationBase::getElapsedTime):

page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::animate):

LayoutTests:

Ref test that has an initially-paused animation on 'left' and with a
3d transform.

animations/play-state-start-paused-expected.html: Added.
animations/play-state-start-paused.html: Added.

12:49 PM Changeset in webkit [200041] by Antti Koivisto

393 edits in trunk/Source/WebCore

Inline RenderStyle into RenderElement
https://bugs.webkit.org/show_bug.cgi?id=156981

Reviewed by Andreas Kling.

We can save memory and reduce indirection of style access by inlining RenderStyle to RenderElement.

This patch also makes RenderStyle moveable and switches from std::unique_ptr<RenderStyle> to RenderStyle&&
in many places where ownership is passed.

Modules/plugins/PluginReplacement.h:

(WebCore::PluginReplacement::scriptObject):
(WebCore::PluginReplacement::willCreateRenderer):

Modules/plugins/QuickTimePluginReplacement.h:
Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::~QuickTimePluginReplacement):
(WebCore::QuickTimePluginReplacement::createElementRenderer):

Modules/plugins/YouTubePluginReplacement.cpp:

(WebCore::YouTubePluginReplacement::YouTubePluginReplacement):
(WebCore::YouTubePluginReplacement::createElementRenderer):

Modules/plugins/YouTubePluginReplacement.h:
css/StyleResolver.cpp:

(WebCore::StyleResolver::styleForElement):
(WebCore::StyleResolver::styleForKeyframe):
(WebCore::StyleResolver::pseudoStyleForElement):
(WebCore::StyleResolver::styleForPage):
(WebCore::StyleResolver::defaultStyleForElement):
(WebCore::StyleResolver::addToMatchedPropertiesCache):
(WebCore::StyleResolver::applyPropertyToStyle):

dom/Document.cpp:

(WebCore::Document::recalcStyle):
(WebCore::Document::webkitWillEnterFullScreenForElement):
(WebCore::Document::setFullScreenRenderer):

dom/Element.cpp:

(WebCore::Element::rendererIsNeeded):
(WebCore::Element::createElementRenderer):

dom/Element.h:

(WebCore::Element::copyNonAttributePropertiesFromElement):

dom/PseudoElement.cpp:

(WebCore::PseudoElement::resolveCustomStyle):
(WebCore::PseudoElement::didAttachRenderers):
(WebCore::PseudoElement::didRecalcStyle):

html/BaseButtonInputType.cpp:

(WebCore::BaseButtonInputType::appendFormData):
(WebCore::BaseButtonInputType::createInputRenderer):

html/BaseButtonInputType.h:
html/FileInputType.cpp:

(WebCore::FileInputType::handleDOMActivateEvent):
(WebCore::FileInputType::createInputRenderer):

html/FileInputType.h:
html/HTMLAppletElement.cpp:

(WebCore::HTMLAppletElement::rendererIsNeeded):
(WebCore::HTMLAppletElement::createElementRenderer):

...

12:43 PM Changeset in webkit [200040] by dbates@webkit.org

3 edits in trunk/Tools

Unreviewed, rolling out r199916.
https://bugs.webkit.org/show_bug.cgi?id=156989

Might break buildbot when master is restarted (Requested by
Srinivasan Vijayaraghava, Guest100, on #webkit).

Reverted changeset:

"Add JSC test results in json format to a buildbot log"
https://bugs.webkit.org/show_bug.cgi?id=156920
http://trac.webkit.org/changeset/199916

Patch by Commit Queue <commit-queue@webkit.org> on 2016-04-25

12:37 PM Changeset in webkit [200039] by eric.carlson@apple.com

2 edits in trunk/Source/WebCore

Stop listening for "media can start" notifications when media player is cleared
https://bugs.webkit.org/show_bug.cgi?id=156985
<rdar://problem/23158505>

Reviewed by Jer Noble.

No new tests, I have not been able to create a test that reliably reproduces this.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::loadInternal): Add logging.
(WebCore::HTMLMediaElement::selectMediaResource): Assert and return early if there is

no media player.

(WebCore::HTMLMediaElement::clearMediaPlayer): Stop listening for can start notifications.
(WebCore::HTMLMediaElement::visibilityStateChanged): Add logging.
(WebCore::HTMLMediaElement::mediaCanStart): Ditto.

12:08 PM Changeset in webkit [200038] by sbarati@apple.com

8 edits in trunk/Source/JavaScriptCore

We don't have to parse a function's parameters every time if the function is in the source provider cache
https://bugs.webkit.org/show_bug.cgi?id=156943

Reviewed by Filip Pizlo.

This patch makes a few changes to make parsing inner functions
faster.

First, we were always parsing an inner function's parameter
list using the templatized TreeBuiler. This means if our parent scope
was building an AST, we ended up building AST nodes for the inner
function's parameter list even though these nodes would go unused.
This patch fixes that to *always* build an inner function's parameter
list using the SyntaxChecker. (Note that this is consistent now with
always building an inner function's body with a SyntaxChecker.)

Second, we were always parsing an inner function's parameter list
even if we had that function saved in the source provider cache.
I've fixed that bug and made it so that we skip over the parsing
of a function's parameter list when it's in the source provider
cache. We could probably enhance this in the future to skip
over the entirety of a function starting at the "function"
keyword or any other start of the function (depending on
the function type: arrow function, method, etc).

This patch also renames a few fields. First, I fixed a typo
from "tocken" => "token" for a few field names. Secondly,
I renamed a field that was called 'bodyStartColumn' to
'parametersStartColumn' because the field really held the
parameter list's start column.

I'm benchmarking this as a 1.5-2% octane/jquery speedup
on a 15" MBP.

parser/ASTBuilder.h:

(JSC::ASTBuilder::createFunctionExpr):
(JSC::ASTBuilder::createMethodDefinition):
(JSC::ASTBuilder::createArrowFunctionExpr):
(JSC::ASTBuilder::createGetterOrSetterProperty):
(JSC::ASTBuilder::createFuncDeclStatement):

parser/Lexer.cpp:

(JSC::Lexer<T>::lex):

parser/Lexer.h:

(JSC::Lexer::currentPosition):
(JSC::Lexer::positionBeforeLastNewline):
(JSC::Lexer::lastTokenLocation):
(JSC::Lexer::setLastLineNumber):
(JSC::Lexer::lastLineNumber):
(JSC::Lexer::prevTerminator):

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
(JSC::Parser<LexerType>::parseFunctionBody):
(JSC::stringForFunctionMode):
(JSC::Parser<LexerType>::parseFunctionParameters):
(JSC::Parser<LexerType>::parseFunctionInfo):

parser/Parser.h:

(JSC::Scope::usedVariablesContains):
(JSC::Scope::forEachUsedVariable):
(JSC::Scope::useVariable):
(JSC::Scope::copyCapturedVariablesToVector):
(JSC::Scope::fillParametersForSourceProviderCache):
(JSC::Scope::restoreFromSourceProviderCache):

parser/ParserFunctionInfo.h:
parser/SourceProviderCacheItem.h:

(JSC::SourceProviderCacheItem::endFunctionToken):
(JSC::SourceProviderCacheItem::usedVariables):
(JSC::SourceProviderCacheItem::SourceProviderCacheItem):

11:38 AM Changeset in webkit [200037] by Chris Dumez

5 edits in trunk/Source/WebCore

[Web IDL] Specify default values for parameters of type 'unsigned short'
https://bugs.webkit.org/show_bug.cgi?id=156967

Reviewed by Darin Adler.

Specify default values for parameters of type 'unsigned short' and let
the bindings generator use WTF::Optional<> for the ones without a
default value.

bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameter):
(GenerateParametersCheck):

testing/Internals.cpp:

(WebCore::Internals::layerTreeAsText): Deleted.
(WebCore::Internals::displayListForElement): Deleted.
(WebCore::Internals::replayDisplayListForElement): Deleted.

testing/Internals.h:
testing/Internals.idl:

11:38 AM Changeset in webkit [200036] by peavo@outlook.com

11 edits
2 adds in trunk/Source

[Win][IndexedDB] Fix build errors.
https://bugs.webkit.org/show_bug.cgi?id=156713

Reviewed by Alex Christensen.

Fix compile and link errors when building with IndexedDB enabled.

Source/WebCore:

Modules/indexeddb/IDBCursor.h:
Modules/indexeddb/IDBTransaction.cpp:
Modules/indexeddb/server/MemoryBackingStoreTransaction.h:
Modules/indexeddb/server/MemoryIDBBackingStore.h:
PlatformWin.cmake:
platform/win/FileSystemWin.cpp:

(WebCore::hardLinkOrCopyFile):

Source/WebKit:

PlatformWin.cmake:

Source/WebKit/win:

WebView.cpp:

(WebView::notifyPreferencesChanged):

storage: Added.
storage/WebDatabaseProvider.cpp: Added.

(WebDatabaseProvider::indexedDatabaseDirectoryPath):

11:20 AM Changeset in webkit [200035] by ggaren@apple.com

4 edits in trunk/Source/bmalloc

2016-04-25 Geoffrey Garen <ggaren@apple.com>

bmalloc: vm allocations should plant guard pages
https://bugs.webkit.org/show_bug.cgi?id=156937

Rolling back in r199936 with a fix for the memory regression.

10:48 AM Changeset in webkit [200034] by mark.lam@apple.com

37 edits in trunk/Source/JavaScriptCore

Renaming SpecInt32, SpecInt52, MachineInt to SpecInt32Only, SpecInt52Only, AnyInt.
https://bugs.webkit.org/show_bug.cgi?id=156941

Reviewed by Filip Pizlo.

While looking at https://bugs.webkit.org/show_bug.cgi?id=153431, it was decided
that SpecInt32Only, SpecInt52Only, and AnyInt would be better names for
SpecInt32, SpecInt52, and MachineInt. Let's do a bulk rename.

This is only a renaming patch, and deletion of a piece of unused code. There are
no semantic changes.

bindings/ScriptValue.cpp:

(Inspector::jsToInspectorValue):

bytecode/SpeculatedType.cpp:

(JSC::dumpSpeculation):
(JSC::speculationToAbbreviatedString):
(JSC::speculationFromValue):
(JSC::leastUpperBoundOfStrictlyEquivalentSpeculations):
(JSC::typeOfDoubleNegation):
(JSC::typeOfDoubleRounding):

bytecode/SpeculatedType.h:

(JSC::isInt32Speculation):
(JSC::isInt32OrBooleanSpeculation):
(JSC::isInt32SpeculationForArithmetic):
(JSC::isInt32OrBooleanSpeculationForArithmetic):
(JSC::isInt32OrBooleanSpeculationExpectingDefined):
(JSC::isInt52Speculation):
(JSC::isAnyIntSpeculation):
(JSC::isAnyIntAsDoubleSpeculation):
(JSC::isDoubleRealSpeculation):
(JSC::isMachineIntSpeculation): Deleted.
(JSC::isInt52AsDoubleSpeculation): Deleted.
(JSC::isIntegerSpeculation): Deleted.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::fixTypeForRepresentation):
(JSC::DFG::AbstractValue::checkConsistency):
(JSC::DFG::AbstractValue::resultType):

dfg/DFGAbstractValue.h:

(JSC::DFG::AbstractValue::validateType):

dfg/DFGArgumentsUtilities.cpp:

(JSC::DFG::emitCodeToGetArgumentsArrayLength):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupToThis):
(JSC::DFG::FixupPhase::observeUseKindOnNode):
(JSC::DFG::FixupPhase::fixIntConvertingEdge):
(JSC::DFG::FixupPhase::fixIntOrBooleanEdge):
(JSC::DFG::FixupPhase::fixDoubleOrBooleanEdge):
(JSC::DFG::FixupPhase::truncateConstantToInt32):
(JSC::DFG::FixupPhase::attemptToMakeIntegerAdd):
(JSC::DFG::FixupPhase::prependGetArrayLength):
(JSC::DFG::FixupPhase::fixupChecksInBlock):

dfg/DFGGraph.h:

(JSC::DFG::Graph::addShouldSpeculateInt32):
(JSC::DFG::Graph::addShouldSpeculateAnyInt):
(JSC::DFG::Graph::binaryArithShouldSpeculateInt32):
(JSC::DFG::Graph::binaryArithShouldSpeculateAnyInt):
(JSC::DFG::Graph::unaryArithShouldSpeculateInt32):
(JSC::DFG::Graph::unaryArithShouldSpeculateAnyInt):
(JSC::DFG::Graph::addShouldSpeculateMachineInt): Deleted.
(JSC::DFG::Graph::binaryArithShouldSpeculateMachineInt): Deleted.
(JSC::DFG::Graph::unaryArithShouldSpeculateMachineInt): Deleted.

dfg/DFGInPlaceAbstractState.cpp:

(JSC::DFG::InPlaceAbstractState::initialize):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::noticeOSREntry):

dfg/DFGNode.cpp:

(JSC::DFG::Node::convertToIdentityOn):

dfg/DFGNode.h:

(JSC::DFG::Node::asNumber):
(JSC::DFG::Node::isAnyIntConstant):
(JSC::DFG::Node::asAnyInt):
(JSC::DFG::Node::isBooleanConstant):
(JSC::DFG::Node::shouldSpeculateInt32OrBooleanExpectingDefined):
(JSC::DFG::Node::shouldSpeculateAnyInt):
(JSC::DFG::Node::shouldSpeculateDouble):
(JSC::DFG::Node::shouldSpeculateNumber):
(JSC::DFG::Node::isMachineIntConstant): Deleted.
(JSC::DFG::Node::asMachineInt): Deleted.
(JSC::DFG::Node::shouldSpeculateMachineInt): Deleted.

dfg/DFGOSREntry.cpp:

(JSC::DFG::OSREntryData::dumpInContext):
(JSC::DFG::prepareOSREntry):

dfg/DFGOSREntry.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSSALoweringPhase.cpp:

(JSC::DFG::SSALoweringPhase::handleNode):
(JSC::DFG::SSALoweringPhase::lowerBoundsCheck):

dfg/DFGSafeToExecute.h:

(JSC::DFG::SafeToExecuteEdge::operator()):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::silentFill):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileArithAdd):
(JSC::DFG::SpeculativeJIT::compileArithSub):
(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::speculateInt32):
(JSC::DFG::SpeculativeJIT::speculateNumber):
(JSC::DFG::SpeculativeJIT::speculateMisc):
(JSC::DFG::SpeculativeJIT::speculate):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::spill):
(JSC::DFG::SpeculativeJIT::isKnownInteger):
(JSC::DFG::SpeculativeJIT::isKnownCell):
(JSC::DFG::SpeculativeJIT::isKnownNotInteger):
(JSC::DFG::SpeculativeJIT::isKnownNotNumber):
(JSC::DFG::SpeculativeJIT::isKnownNotCell):
(JSC::DFG::SpeculativeJIT::isKnownNotOther):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::fillSpeculateInt32Internal):
(JSC::DFG::SpeculativeJIT::fillSpeculateInt52):
(JSC::DFG::SpeculativeJIT::fillSpeculateDouble):
(JSC::DFG::SpeculativeJIT::emitBranch):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::blessBoolean):
(JSC::DFG::SpeculativeJIT::convertAnyInt):
(JSC::DFG::SpeculativeJIT::speculateAnyInt):
(JSC::DFG::SpeculativeJIT::speculateDoubleRepAnyInt):
(JSC::DFG::SpeculativeJIT::convertMachineInt): Deleted.
(JSC::DFG::SpeculativeJIT::speculateMachineInt): Deleted.
(JSC::DFG::SpeculativeJIT::speculateDoubleRepMachineInt): Deleted.

dfg/DFGUseKind.cpp:

(WTF::printInternal):

dfg/DFGUseKind.h:

(JSC::DFG::typeFilterFor):
(JSC::DFG::isNumerical):
(JSC::DFG::isDouble):

dfg/DFGValidate.cpp:
dfg/DFGVariableAccessData.cpp:

(JSC::DFG::VariableAccessData::makePredictionForDoubleFormat):
(JSC::DFG::VariableAccessData::couldRepresentInt52Impl):
(JSC::DFG::VariableAccessData::flushFormat):

ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileInt52Constant):
(JSC::FTL::DFG::LowerDFGToB3::compileInt52Rep):
(JSC::FTL::DFG::LowerDFGToB3::compileArithAddOrSub):
(JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):
(JSC::FTL::DFG::LowerDFGToB3::lowInt32):
(JSC::FTL::DFG::LowerDFGToB3::strictInt52ToInt32):
(JSC::FTL::DFG::LowerDFGToB3::isInt32):
(JSC::FTL::DFG::LowerDFGToB3::isNotInt32):
(JSC::FTL::DFG::LowerDFGToB3::jsValueToStrictInt52):
(JSC::FTL::DFG::LowerDFGToB3::doubleToStrictInt52):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateCellOrOther):
(JSC::FTL::DFG::LowerDFGToB3::speculateAnyInt):
(JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepReal):
(JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepAnyInt):
(JSC::FTL::DFG::LowerDFGToB3::speculateMachineInt): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::speculateDoubleRepMachineInt): Deleted.

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_profile_type):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::emit_op_profile_type):

runtime/JSCJSValue.h:
runtime/JSCJSValueInlines.h:

(JSC::isInt52):
(JSC::JSValue::isAnyInt):
(JSC::JSValue::asAnyInt):
(JSC::JSValue::isMachineInt): Deleted.
(JSC::JSValue::asMachineInt): Deleted.

runtime/RuntimeType.cpp:

(JSC::runtimeTypeForValue):
(JSC::runtimeTypeAsString):

runtime/RuntimeType.h:
runtime/TypeSet.cpp:

(JSC::TypeSet::dumpTypes):
(JSC::TypeSet::displayName):
(JSC::TypeSet::inspectorTypeSet):
(JSC::TypeSet::toJSONString):

10:33 AM Changeset in webkit [200033] by mitz@apple.com

3 edits in trunk/Source/WebKit2

Fix a couple of mistakes from r199700.

Rubber-stamped by Anders Carlsson.

UIProcess/API/Cocoa/WKPreferencesPrivate.h: Added availability attributes to new properties.
WebKit2.xcodeproj/project.pbxproj: Demoted _WKExperimentalFeatureInternal.h from Private to Project.

10:31 AM Changeset in webkit [200032] by beidson@apple.com

14 edits
3 adds in trunk

Implement latest File object spec (including its constructor).
https://bugs.webkit.org/show_bug.cgi?id=156511

Reviewed by Darin Adler.

Source/WebCore:

Test: fast/files/file-constructor.html

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:

bindings/js/JSDictionary.cpp:

(WebCore::JSDictionary::convertValue):

bindings/js/JSDictionary.h:

bindings/js/JSFileCustom.cpp: Added.

(WebCore::constructJSFile):

fileapi/File.cpp:

(WebCore::File::File):
(WebCore::File::lastModified):
(WebCore::File::lastModifiedDate): Deleted.

fileapi/File.h:
fileapi/File.idl:

LayoutTests:

fast/files/file-constructor-expected.txt: Added.
fast/files/file-constructor.html: Added.

http/tests/local/fileapi/file-last-modified-after-delete-expected.txt:
http/tests/local/fileapi/script-tests/file-last-modified-after-delete.js:

http/tests/local/fileapi/file-last-modified-expected.txt:
http/tests/local/fileapi/script-tests/file-last-modified.js:

imported/blink/storage/indexeddb/blob-basics-metadata-expected.txt:

10:03 AM Changeset in webkit [200031] by Antti Koivisto

2 edits in trunk/Source/WebCore

REGRESSION(r156846): Crashes with guard malloc
https://bugs.webkit.org/show_bug.cgi?id=156984

Reviewed by Andreas Kling.

RenderElement::cachedFirstLineStyle() returns pointer to local std::unique_ptr.

rendering/RenderElement.cpp:

(WebCore::RenderElement::uncachedFirstLineStyle):
(WebCore::RenderElement::cachedFirstLineStyle):
(WebCore::RenderElement::firstLineStyle):
(WebCore::firstLineStyleForCachedUncachedType): Deleted.

Don't try to use a single function for the cached and uncached cases. Separate the cases into the calling functions.

9:27 AM Changeset in webkit [200030] by dbates@webkit.org

4 edits
4 adds in trunk

REGRESSION (r196012): Subresource may be blocked by Content Security Policy if it only matches 'self'
https://bugs.webkit.org/show_bug.cgi?id=156935
<rdar://problem/25351286>

Reviewed by Darin Adler.

Source/WebCore:

Fixes an issue where subresource load may be blocked by the Content Security Policy (CSP) if its URL only
matched 'self'. In particular, the load would be blocked if initiated from a document that inherited the
origin of its owner document (e.g. the document contained in <iframe src="about:blank"></iframe>).

Following r196012 we compute and cache 'self' and its protocol on instantiation of a ContentSecurityPolicy
object for use when matching a URL against it. These cached values become out-of-date if the document
subsequently inherits the origin of its owner document. Therefore matches against 'self' will fail and
CSP will block a load if its not otherwise allowed by the policy. Previously we would compute 'self' when
parsing the definition of a source list and compute the protocol for 'self' each time we tried to match a
URL against 'self'. So, 'self' would always be up-to-date with respect to the origin of the document.

Tests: http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html

http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html

page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Extract out logic for computing and caching
'self' and its protocol into ContentSecurityPolicy::updateSourceSelf() and make use of this function.
(WebCore::ContentSecurityPolicy::updateSourceSelf): Computes and caches 'self' and its protocol with
respect to the specified SecurityOrigin.
(WebCore::ContentSecurityPolicy::applyPolicyToScriptExecutionContext): Call ContentSecurityPolicy::updateSourceSelf()
to ensure that we have an up-to-date representation for 'self' and the protocol of 'self' which can
become out-of-date if the document inherited the origin of its owner document.

page/csp/ContentSecurityPolicy.h:

LayoutTests:

Add tests to ensure that we match 'self' correctly in an iframe with an about:blank document.

http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script-expected.txt: Added.
http/tests/security/contentSecurityPolicy/iframe-blank-url-programmatically-add-external-script.html: Added.
http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script-expected.txt: Added.
http/tests/security/contentSecurityPolicy/iframe-srcdoc-external-script.html: Added.

9:26 AM Changeset in webkit [200029] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking media/video-fullscreen-restriction-removed.html as flaky on Mac
https://bugs.webkit.org/show_bug.cgi?id=156983

Unreviewed test gardening.

platform/mac/TestExpectations:

8:57 AM Changeset in webkit [200028] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199807 - Crash under WebCore::TextIterator::subrange()
https://bugs.webkit.org/show_bug.cgi?id=156809
<rdar://problem/21102730>

Reviewed by Ryosuke Niwa.

TextIterator::rangeFromLocationAndLength() may return null. However, we
failed to do a null check before calling TextIterator::subrange() with
that range.

No new tests, do not know how to reproduce.

editing/AlternativeTextController.cpp:

(WebCore::AlternativeTextController::applyAlternativeTextToRange):

8:55 AM Changeset in webkit [200027] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199781 - Potential overflow in RenderLayer::hitTestList()
https://bugs.webkit.org/show_bug.cgi?id=156804

Reviewed by Simon Fraser.

Use size_t type instead of int to iterate over the Vector to make sure
we don't overflow. This is a speculative fix for <rdar://problem/23249479>.

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::hitTestList):

8:54 AM Changeset in webkit [200026] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199769 - [Cairo] Crash in GraphicsContext::drawFocusRing when painting is disabled
https://bugs.webkit.org/show_bug.cgi?id=156785

Reviewed by Žan Doberšek.

This happens for example when view state changes to focus and paint is called from
FrameView::updateControlTints() with a graphics context that doesn't have a platform context. Layout test
fast/images/image-map-outline-with-scale-transform.html sometimes crashes because of this.

platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::drawFocusRing): Return early if painting is disabled.

8:53 AM Changeset in webkit [200025] by Carlos Garcia Campos

7 edits in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r199759 - bmalloc: fix up overflow checks
https://bugs.webkit.org/show_bug.cgi?id=156780

Reviewed by Mark Lam.

We used to try to avoid overflow in large object math by setting a very
high limit on the largest large object. But that's a bit error-prone
since the check is far away from the math that might overflow -- and
we were missing some cases.

This patch removes the limit and instead checks at each math site.

bmalloc/Allocator.cpp:

(bmalloc::Allocator::tryAllocate):
(bmalloc::Allocator::allocate):
(bmalloc::Allocator::reallocate):
(bmalloc::Allocator::allocateSlowCase): Remove the limit. tryAllocateLarge
will check for overflow for us.

bmalloc/Chunk.h: This ASSERT was just totally wrong.

bmalloc/Heap.cpp:

(bmalloc::Heap::tryAllocateLarge): Check for overflow when adding.

bmalloc/Sizes.h:

bmalloc/VMAllocate.h:

(bmalloc::tryVMAllocate): Check for overflow when adding.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::tryAllocateLargeChunk): Check for overflow when adding.

8:53 AM Changeset in webkit [200024] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r199756 - Unreviewed, try to fix an ASSERT seen on the bots.

bmalloc/Heap.cpp: (bmalloc::Heap::tryAllocateLarge): This ASSERT is supposed to be about alignment, not size. Oops.

8:50 AM Changeset in webkit [200023] by Carlos Garcia Campos

20 edits
1 add
10 deletes in releases/WebKitGTK/webkit-2.12/Source/bmalloc

Merge r199746 - bmalloc: Merge the large and xlarge allocators
https://bugs.webkit.org/show_bug.cgi?id=156734

Reviewed by Andreas Kling.

This give us better defense against worst case memory usage:

Baseline Patch Δ

Peak Memory:

nimlang 198,132kB 181,468kB ^{1.09x smaller}

It also eliminates inline metadata for large objects, fixing the
regression introduced in r198675, and more:

run-malloc-benchmarks Baseline:~/OpenSource/WebKitBuildBaseline/Release/ Patch:~/OpenSource/WebKitBuild/Release/

Baseline Patch Δ

Memory at End:

big 10,880kB 3,328kB ^{3.27x smaller

facebook 3,112kB 2,868kB} 1.09x smaller
fragment --parallel 1,848kB 760kB ^{2.43x smaller

fragment_iterate --parallel 4,908kB 776kB} 6.32x smaller
big --parallel 48,076kB 11,892kB ^{4.04x smaller}

Overall memory use looks OK:

run-malloc-benchmarks --memory_warning Baseline:~/OpenSource/WebKitBuildBaseline/Release/ Patch:~/OpenSource/WebKitBuild/Release/

Baseline Patch Δ

Memory at End:

<arithmetic mean> 13,992kB 13,987kB ^{1.0x smaller}

Overall throughput looks OK:

run-malloc-benchmarks Baseline:~/OpenSource/WebKitBuildBaseline/Release/ Patch:~/OpenSource/WebKitBuild/Release/

Baseline Patch Δ

Execution Time:

<arithmetic mean> 103ms 104ms ! 1.01x slower

We're a bit slower on the "all-out large allocations on all cores"
benchmark, but I think that's an OK price to pay:

Baseline Patch Δ

Execution Time:

big --parallel 125ms 136ms ! 1.09x slower

This patch net removes 1.5k lines of code. It turns out that large
allocations are rare, and free memory fragments are also rare, so the
combination is super rare, and a simple O(n) algorithm that ensures good
memory behavior is the best option.

Fun fact: In practice, the odds that the old code would save memory
were *worse* than the odds that it would contain a bug that wasted
memory. :)

bmalloc.xcodeproj/project.pbxproj:

bmalloc/Allocator.cpp:

(bmalloc::Allocator::tryAllocate): largeMax is the new xLargeMax since
xLargeMax is gone now.

(bmalloc::Allocator::allocate): I moved the rounding code into allocateLarge,
so we don't have to do it here.

(bmalloc::Allocator::reallocate):
(bmalloc::Allocator::allocateSlowCase):
(bmalloc::Allocator::allocateXLarge): Deleted. No more XLarge case.

bmalloc/Allocator.h:

bmalloc/BeginTag.h: Removed.
bmalloc/BoundaryTag.h: Removed.

bmalloc/Chunk.h:

(bmalloc::ChunkHash::hash): Added a hash function. The best hash function
is a unique and monotonically increasing integer, and that's exactly what
we typically get from the high bits of a Chunk, since the OS allocates
Chunks at unique and increasing addresses.
(bmalloc::Chunk::boundaryTags): Deleted.
(bmalloc::Chunk::objectType): Deleted.
(bmalloc::Chunk::beginTag): Deleted.
(bmalloc::Chunk::endTag): Deleted.

bmalloc/Deallocator.cpp:

(bmalloc::Deallocator::deallocateSlowCase): We no longer know for sure,
by looking at its bit pattern, whether a pointer is small or large.
Instead, any pointer with large alignment *might* be large, and when
we occasionally encounter such an object, we have to consult a hash
table in the Heap to find out for sure. This turns out to be just as
cheap in practice.

We don't deallocate large objects on the fast path anymore. We can't,
because large objects have out-of-line metadata now.

(bmalloc::Deallocator::deallocateXLarge): Deleted.

bmalloc/Deallocator.h:

(bmalloc::Deallocator::deallocateFastCase): See deallocateSlowCase.

bmalloc/EndTag.h: Removed.
bmalloc/FreeList.cpp: Removed.
bmalloc/FreeList.h: Removed.

bmalloc/Heap.cpp:

(bmalloc::Heap::allocateSmallPage): Be sure to track each chunk in
the object type map, so we can distinguish small vs large objects.

(bmalloc::Heap::deallocateSmallLine): No need to check object type
because we know object type now by virtue of being on the small object
path.

(bmalloc::Heap::splitAndAllocate): Be sure to track each chunk in
the object type map, so we can distinguish small vs large objects. Large
objects can split across chunks, so we need to add each large object's
chunk as it is allocated.

(bmalloc::Heap::tryAllocateLarge):
(bmalloc::Heap::allocateLarge):
(bmalloc::Heap::isLarge):
(bmalloc::Heap::largeSize):
(bmalloc::Heap::shrinkLarge):
(bmalloc::Heap::deallocateLarge): Merged in existing XLarge logic for
large objects.

(bmalloc::Heap::scavengeXLargeObjects): Deleted.
(bmalloc::Heap::allocateXLarge): Deleted.
(bmalloc::Heap::tryAllocateXLarge): Deleted.
(bmalloc::Heap::xLargeSize): Deleted.
(bmalloc::Heap::shrinkXLarge): Deleted.
(bmalloc::Heap::deallocateXLarge): Deleted.

bmalloc/Heap.h:

(bmalloc::Heap::LargeObjectHash::hash):

bmalloc/LargeObject.h: Removed.

bmalloc/Map.h: Added.

(bmalloc::Map::size):
(bmalloc::Map::capacity):
(bmalloc::Map::get):
(bmalloc::Map::set):
(bmalloc::Map::remove):
(bmalloc::Map::shouldGrow):
(bmalloc::Map::shouldShrink):
(bmalloc::Map::find):
(bmalloc::Hash>::rehash): Simple hash table.

bmalloc/Object.h:

bmalloc/ObjectType.cpp:

(bmalloc::objectType):

bmalloc/ObjectType.h:

(bmalloc::mightBeLarge): See deallocateSlowCase.
(bmalloc::isXLarge): Deleted.

bmalloc/SegregatedFreeList.cpp: Removed.
bmalloc/SegregatedFreeList.h: Removed.

bmalloc/Sizes.h: Upped smallMax to 64kB. Upping to 32kB is pretty

reasonable, since sizes between 16kB and 32kB share page sizes. I went
all the way up to 64kB because the GC uses 64kB blocks, and also just
for extra padding to ensure that large allocations are indeed rare.

bmalloc/SortedVector.h: Removed.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::tryAllocateLargeChunk):
(bmalloc::VMHeap::allocateSmallChunk):
(bmalloc::VMHeap::VMHeap): Deleted.
(bmalloc::VMHeap::allocateChunk): Deleted.

bmalloc/VMHeap.h:

(bmalloc::VMHeap::deallocateSmallPage):
(bmalloc::VMHeap::allocateLargeObject): Deleted.
(bmalloc::VMHeap::deallocateLargeObject): Deleted. Nixed all the boundary
tag logic since metadata is out of line now.

bmalloc/VMState.h: Removed. Instead of an abstract state, we track

the precise amount of committed physical pages at the head of a VM
range. This allows us to merge aggressively without triggering an madvise
storm most of the time.

bmalloc/Vector.h:

(bmalloc::Vector<T>::Vector):
(bmalloc::Vector<T>::insert):
(bmalloc::Vector<T>::remove):
(bmalloc::Vector<T>::resize): Filled out some missing helpers.

bmalloc/XLargeMap.cpp:

(bmalloc::XLargeMap::remove):
(bmalloc::XLargeMap::add):
(bmalloc::XLargeMap::removePhysical):
(bmalloc::XLargeMap::takeFree): Deleted.
(bmalloc::XLargeMap::addFree): Deleted.
(bmalloc::XLargeMap::addAllocated): Deleted.
(bmalloc::XLargeMap::getAllocated): Deleted.
(bmalloc::XLargeMap::takeAllocated): Deleted.
(bmalloc::XLargeMap::shrinkToFit): Deleted.
(bmalloc::XLargeMap::takePhysical): Deleted.
(bmalloc::XLargeMap::addVirtual): Deleted.

bmalloc/XLargeMap.h:

(bmalloc::XLargeMap::Allocation::operator<): Deleted. We don't track
object sizes anymore -- just free space. (The Heap tracks object sizes.)
We use plain old linear search for free space. (See intro.)

bmalloc/XLargeRange.h:

(bmalloc::XLargeRange::physicalSize):
(bmalloc::XLargeRange::setPhysicalSize):
(bmalloc::merge):
(bmalloc::XLargeRange::split):
(bmalloc::XLargeRange::vmState): Deleted.
(bmalloc::XLargeRange::setVMState): Deleted. See VMState.h.

8:47 AM Changeset in webkit [200022] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199727 - [Cairo] GraphicsContext::drawFocusRing methods are not consistent to each other
https://bugs.webkit.org/show_bug.cgi?id=156742

Reviewed by Martin Robinson.

We are rendering the focus ring differently depending on whether a path is used or a vector of rectangles. This
is causing that some reftests fail because they assume we always render the focus ring the same way. For example
fast/images/image-map-outline-in-positioned-container.html, when rendering the test
GraphicsContext::drawFocusRing is called with a path, and when rendering the reference it's called with a vector
of rectangles, producing different results.

platform/graphics/cairo/GraphicsContextCairo.cpp:

(WebCore::GraphicsContext::drawFocusRing): When receiving a vector of rectangles, build a Path from the given
rectangles and call drawFocusRing() with the built path to ensure consistency.

8:46 AM Changeset in webkit [200021] by Carlos Garcia Campos

4 edits
1 add in releases/WebKitGTK/webkit-2.12

Merge r199715 - [GTK] accessibility/gtk/entry-and-password.html is failing since r194847
https://bugs.webkit.org/show_bug.cgi?id=153062

Reviewed by Carlos Garcia Campos.

Source/WebCore:

The changes in r194847 include using WebCore's rendering for the CapsLock indicator.
As a side effect, password inputs gained a TextControlInnerTextElement child from
the Shadow DOM. If we include that child in the accessibility tree, the child will
emit focus and text notifications that suggest the user is no longer in the control.
This can be especially problematic for screen reader users with key echo enabled
when typing in a password input. To fix this, prune TextControlInnerTextElement
children from the accessibility tree for ATK.

No new tests as existing coverage caught this regression. Also modified the
auto-fill-crash.html test whose expectations include the children count for
a text input.

accessibility/atk/AccessibilityObjectAtk.cpp:

(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

LayoutTests:

The auto-fill-crash.html test has expectations which include the children
count for the text input. These expectations were incorrect for ATK where
accessible text inputs lack accessible text children.

accessibility/auto-fill-crash.html: Modified to take platform into account.
platform/gtk/TestExpectations: Unskipped entry-and-password.html.
platform/gtk/accessibility/auto-fill-crash-expected.txt: Added.

8:41 AM Changeset in webkit [200020] by Carlos Garcia Campos

14 edits in releases/WebKitGTK/webkit-2.12

Merge r199703 - [GTK] Possible off-by-one in hyphenation code
https://bugs.webkit.org/show_bug.cgi?id=156661

Patch by Martin Robinson <mrobinson@igalia.com> on 2016-04-18
Reviewed by Michael Catanzaro.

Source/WebCore:

No new tests. This is covered by older tests.

platform/text/hyphen/HyphenationLibHyphen.cpp:

(WebCore::lastHyphenLocation): Fix an off by one error in hyphen location.

LayoutTests:

platform/gtk/TestExpectations: Unskip a test that is now passing.
platform/gtk/fast/text/hyphenate-character-expected.png:
platform/gtk/fast/text/hyphenate-character-expected.txt:
platform/gtk/fast/text/hyphenate-first-word-expected.png:
platform/gtk/fast/text/hyphenate-first-word-expected.txt:
platform/gtk/fast/text/hyphenate-limit-before-after-expected.png:
platform/gtk/fast/text/hyphenate-limit-before-after-expected.txt:
platform/gtk/fast/text/hyphenate-limit-lines-expected.png:
platform/gtk/fast/text/hyphenate-limit-lines-expected.txt:
platform/gtk/fast/text/hyphenate-locale-expected.png:
platform/gtk/fast/text/hyphenate-locale-expected.txt:

8:39 AM Changeset in webkit [200019] by Carlos Garcia Campos

8 edits in releases/WebKitGTK/webkit-2.12

Merge r199696 - Remove support for X-Frame-Options in <meta>
https://bugs.webkit.org/show_bug.cgi?id=156625
<rdar://problem/25748714>

Rubberstamped by Darin Adler.

dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Revise messaging based on Darin's comments.

8:34 AM Changeset in webkit [200018] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199670 - [l10n] Updated Greek translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=156677

Patch by Tom Tryfonidis <tomtryf@gmail.com> on 2016-04-18
Rubber-stamped by Michael Catanzaro.

el.po:

8:32 AM Changeset in webkit [200017] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r199664 - Pending API Request URL is wrong after reloading
https://bugs.webkit.org/show_bug.cgi?id=139342

Reviewed by Darin Adler.

Source/WebKit2:

It happens when reloading a web view loaded with anything but a
URL, because the bf list is not updated for those cases and
WebPageProxy::reload() is setting the current bf list item URL as
pending API request URL. This also causes that progress is
reported wrongly, because
WebPageProxy::decidePolicyForNavigationAction() resets the pending
API request URL when it's different than the requested URL. The
page load transaction causes the progress to be changed, reporting
1.0 (the previous one), but later something < 1.0 is reported
again by the progress tracker.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::reload): Use the current active URL as
pending API request URL, falling back to the current bf list item
URL when empty.

Tools:

Update test case to check that the active URL should remain the
same after a reload.

TestWebKitAPI/Tests/WebKit2/PendingAPIRequestURL.cpp:

(TestWebKitAPI::TEST):

8:31 AM Changeset in webkit [200016] by Carlos Garcia Campos

7 edits
1 add in releases/WebKitGTK/webkit-2.12

Merge r199660 - Pending API request URL no set when loading Data, Alternate HTML or plain text
https://bugs.webkit.org/show_bug.cgi?id=136916

Reviewed by Darin Adler.

Source/WebKit2:

Set pending API request URL for all load methods in
WebPageProxy. This ensures that right after calling those methods,
the active URL is the requested one and that
PageLoadState::isLoading() returns true.

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::loadAlternateHTMLString):
(WebKit::WebPageProxy::loadPlainTextString):
(WebKit::WebPageProxy::loadWebArchiveData):

Tools:

Add new test to check that active URL is the requested one right
after calling WKPage load methods.

TestWebKitAPI/PlatformEfl.cmake:
TestWebKitAPI/PlatformGTK.cmake:
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2/PendingAPIRequestURL.cpp: Added.

(TestWebKitAPI::TEST):

TestWebKitAPI/gtk/WebKit2Gtk/WebViewTest.cpp:

(WebViewTest::loadPlainText): Remove FIXME.
(WebViewTest::loadBytes): Ditto.
(WebViewTest::loadAlternateHTML): Ditto.

8:30 AM Changeset in webkit [200015] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r199659 - [GTK] Menu list button doesn't use the text color from the theme
https://bugs.webkit.org/show_bug.cgi?id=118234

Reviewed by Darin Adler.

ManualTests/gtk/theme.html: Add a disabled combo test.

Source/WebCore:

Set the combo box color accroding to the theme when adjusting the menu list style like Mac port does.

rendering/RenderThemeGtk.cpp:

(WebCore::menuListColor):
(WebCore::RenderThemeGtk::adjustMenuListStyle):

8:23 AM Changeset in webkit [200014] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Tools

Merge r199653 - [GTK] Test /webkit2/WebKitWebView/mouse-target fails with overlay scrollbars
https://bugs.webkit.org/show_bug.cgi?id=156621

Reviewed by Martin Robinson.

This is a problem of the test itself, we are using an overflow that is not actually scrollable, but that shows
scrollbar troughs when not using overlay scrollbars because it's marked as scrollable. It would be easier to
simply use the main frame scrollbars to test that and it will work no matter of scrollbars are overlay or not.

TestWebKitAPI/Tests/WebKit2Gtk/TestUIClient.cpp:

(testWebViewMouseTarget): Remove the div and move the mouse over the main frame scrollbar to test scrolbars hit test.

8:15 AM Changeset in webkit [200013] by Carlos Garcia Campos

11 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199637 - Localization files with empty Language: block build with gettext 0.19
https://bugs.webkit.org/show_bug.cgi?id=133611

Reviewed by Darin Adler.

Fix the language tags. Note that the build error is not actually important here as it only
occurs with an older version of gettext, but presumably it's bad for the language tags to be
wrong.

as.po:
en_CA.po:
gu.po: Also correct the translation team to Gujarati.
hu.po:
id.po:
ko.po:
lv.po:
pa.po:
ru.po:
sl.po:

8:14 AM Changeset in webkit [200012] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199629 - [GTK] [l10n] Updated Turkish translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=156667

Patch by Muhammet Kara <muhammetk@gmail.com> on 2016-04-16
Rubber-stamped by Michael Catanzaro.

tr.po:

8:13 AM Changeset in webkit [200011] by Carlos Garcia Campos

1 edit
1 add in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199624 - Submit the first version of Finnish translation
https://bugs.webkit.org/show_bug.cgi?id=153406

Patch by Jiri Grönroos <jiri.gronroos+l10n@iki.fi> on 2016-04-16
Rubber-stamped by Michael Catanzaro. For FINLAN.

fi.po: Added. Note it's pretty incomplete as of yet.

8:12 AM Changeset in webkit [200010] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199623 - [GTK] [l10n] Updated Bulgarian translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=156656

Patch by Zahari Yurukov <zahari.yurukov@gmail.com> on 2016-04-16
Rubber-stamped by Michael Catanzaro.

bg.po:

6:49 AM Changeset in webkit [200009] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199607 - ASSERT when loading github.com
https://bugs.webkit.org/show_bug.cgi?id=156604
<rdar://problem/19890634>

Reviewed by Darin Adler.

Source/WebCore:

HTMLFormControlElement::m_isValid is a cache of the results of the valid() function.
When cloning the node, we were preserving each individual item, but not the state
of the cache. Therefore, the cache and the attributes didn't agree with each other.

Test: fast/forms/checkValidity-cloneNode-crash.html

html/HTMLInputElement.cpp:

(WebCore::HTMLInputElement::copyNonAttributePropertiesFromElement):

LayoutTests:

fast/forms/checkValidity-cloneNode-crash-expected.txt: Added.
fast/forms/checkValidity-cloneNode-crash.html: Added.

6:42 AM Changeset in webkit [200008] by Carlos Garcia Campos

8 edits
6 moves
4 adds
4 deletes in releases/WebKitGTK/webkit-2.12

Merge r199605 - Remove support for X-Frame-Options in <meta>
https://bugs.webkit.org/show_bug.cgi?id=156625
<rdar://problem/25748714>

Reviewed by Darin Adler.

Source/WebCore:

Follow RFC7034 (Section 4), which recommends that 'X-Frame-Options' be ignored when delivered as part of
a '<meta http-equiv="...">' tag. This brings us in line with Firefox, Edge, and Blink.

Tests: http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html

http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html

dom/Document.cpp:

(WebCore::Document::processHttpEquiv): Log error message instead of blocking the load.

LayoutTests:

Revise tests to match our desired behavior based on RFC 7034 (Section 4).

http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-in-body.html:
http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe-parent-same-origin-deny.html:
http/tests/security/XFrameOptions/resources/x-frame-options-deny-meta-tag-subframe.html:
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-expected.txt: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body-expected.txt: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow-expected.txt: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny-expected.txt: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html: Removed.
http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html: Removed.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-expected.txt: Added.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body-expected.txt: Added.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-in-body.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow-expected.txt: Added.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-allow.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny-expected.txt: Added.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag-parent-same-origin-deny.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html.
http/tests/security/XFrameOptions/x-frame-options-ignore-deny-meta-tag.html: Copied from LayoutTests/http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html.
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-expected.txt: Removed.
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored-expected.txt: Added.
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options-ignored.html: Copied from LayoutTests/http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options.html.
http/tests/security/xssAuditor/meta-tag-http-refresh-x-frame-options.html: Removed.
inspector/console/x-frame-options-message-expected.txt: Rebaselined.
platform/win/TestExpectations:

6:31 AM Changeset in webkit [200007] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r199599 - Mark NetworkLoad as FastAllocated
https://bugs.webkit.org/show_bug.cgi?id=156628

Reviewed by Alex Christensen.

Mark NetworkLoad as FastAllocated for performance.

NetworkProcess/NetworkLoad.h:

6:30 AM Changeset in webkit [200006] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199598 - Calling SVGAnimatedPropertyTearOff::animationEnded() will crash if the SVG property is not animating
https://bugs.webkit.org/show_bug.cgi?id=156549

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-04-15
Reviewed by Darin Adler.

A speculative fix for a crash which may happen when calling animationEnded()
of any SVGAnimatedProperty while it is not animating.

svg/SVGAnimatedTypeAnimator.h:

(WebCore::SVGAnimatedTypeAnimator::executeAction):

6:27 AM Changeset in webkit [200005] by Carlos Garcia Campos

3 edits in releases/WebKitGTK/webkit-2.12/Source/JavaScriptCore

Merge r199586 - Tail call optimizations lead to crashes on ARM Thumb + Linux
https://bugs.webkit.org/show_bug.cgi?id=150083

Patch by Zan Dobersek <zdobersek@igalia.com> on 2016-04-15
Reviewed by Csaba Osztrogonác.

assembler/AbstractMacroAssembler.h:

(JSC::AbstractMacroAssembler::repatchNearCall): In case of a tail call relink to the
data location of the destination, and not the executable address. This is needed for
the ARM Thumb2 platform where both the source and destination addresses of a jump relink
must not have the bottom bit decorated, as asserted in ARMv7Assembler::relinkJump().

jit/Repatch.cpp:

(JSC::linkPolymorphicCall): Similarly, when linking a tail call we must link to the
address that has a non-decorated bottom bit, as asserted in ARMv7Assembler::linkJumpAbsolute().

6:13 AM Changeset in webkit [200004] by Carlos Garcia Campos

8 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199585 - Selection.deleteFromDocument should not leave a selection character
https://bugs.webkit.org/show_bug.cgi?id=151442

Reviewed by Michael Catanzaro.

Source/WebCore:

This is a merge of Blink r172511:
https://codereview.chromium.org/255453003

Let Selection.deleteFromDocument not delete a character when the
selection is a caret.

Selection.deleteFromDocument delete a character when the selection
is a caret.
However, current standard says that Selection.deleteFromDocument
does nothing when the selection is a caret:
https://dvcs.w3.org/hg/editing/raw-file/tip/editing.html#dom-selection-deletefromdocument
Both IE10 and FireFox seem following the spec.

Test: imported/blink/editing/selection/deleteFromDocument-undo-crash.html

page/DOMSelection.cpp:

(WebCore::DOMSelection::deleteFromDocument): Deleted.

LayoutTests:

editing/selection/deleteFromDocument-expected.txt:
editing/selection/deleteFromDocument.html:
imported/blink/editing/selection/deleteFromDocument-undo-crash-expected.txt: Added.
imported/blink/editing/selection/deleteFromDocument-undo-crash.html: Added.
TestExpectations: Skip imported/blink/editing/selection/deleteFromDocument-undo-crash.html in Debug.
platform/gtk/TestExpectations: Unskip imported/blink/editing/selection/deleteFromDocument-crash.html.
platform/win/TestExpectations: Ditto.

6:08 AM Changeset in webkit [200003] by Carlos Garcia Campos

4 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199561 - CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::CachedResource::addClientToSet + 27
https://bugs.webkit.org/show_bug.cgi?id=156602
<rdar://problem/18921091>

Reviewed by Simon Fraser.

Source/WebCore:

The CSS property list-style-image is inherited, so a transition on a parent
might cause a transition on a child. On that child, the value might be between
two generated crossfade images which haven't yet resolved, causing a crash.

Test: transitions/crossfade-transition.html

css/CSSCrossfadeValue.cpp:

(WebCore::CSSCrossfadeValue::blend): Return null if there are no cached images.

page/animation/CSSPropertyAnimation.cpp:

(WebCore::blendFunc): If we don't have an actual image to blend between, fall
out to the default case.

LayoutTests:

Tests that an animation between two inherited crossfade elements will not crash.

transitions/crossfade-transition-expected.txt: Added.
transitions/crossfade-transition.html: Added.

6:04 AM Changeset in webkit [200002] by Carlos Garcia Campos

5 edits
6 adds
2 deletes in releases/WebKitGTK/webkit-2.12

Merge r199553 - Allow listbox content and scrollbar to intrude padding area.
https://bugs.webkit.org/show_bug.cgi?id=128489

Reviewed by Myles C. Maxfield.

Source/WebCore:

Originally when the RenderListBox::controlClipRect method was implemented (see [1]), it used
to allow its content (<option>'s) to intrude padding to get rendered. Overlay scrollbars were also
allowed to paint over the padding area, if necessary.

[2] changed this behavior to restrict list-box'es content within the content box rect (excluding padding and border).

This had two consequences:
1) it made WebKit disallow list-box' content to intrude the padding area, diverging from other vendors.
like Firefox and Chrome.
2) Since overlay scrollbar might get painted over the padding area, if any, [2] could result
in the scrollbar being clipped out if padding-right is set (or padding-left in case of RTL content).

Patch changed WebKit back so that it allows list-box' content and overlay scrollbars to intrude the
padding area, matching other browsers vendors

[1] https://trac.webkit.org/changeset/18819/trunk/WebCore/rendering/RenderListBox.cpp
[2] https://trac.webkit.org/changeset/19037/trunk/WebCore/rendering/RenderListBox.cpp

Tests: fast/forms/listbox-selection-3.html

fast/forms/listbox-padding-clip-selected.html
fast/forms/listbox-padding-clip-expected-mismatch.html (renamed from listbox-padding-clip-overlay-expected.html)
fast/forms/listbox-padding-clip-overlay-expected-mismatch.html (renamed from listbox-padding-clip-expected.html)

rendering/RenderListBox.cpp:

(WebCore::RenderListBox::numVisibleItems): changed to allow list-box items to get rendered on the padding-bottom area.
This matches Firefox and Chrome.
(WebCore::RenderListBox::listIndexAtOffset): relax the check for a given list-box item at a specific offset in the vertical axis.
This means if an list-box item has its content painted into the padding-bottom area, it will be actionable by mouse clicking.
This matches Firefox and Chrome.
(WebCore::RenderListBox::controlClipRect): clips list-box content against the padding box rect rather than the content box rect,
to allow its list-box items' content intrude the padding area.
This matches Firefox and Chrome.

LayoutTests:

fast/forms/listbox-selection-3-expected.txt: Added.
fast/forms/listbox-selection-3.html: Added.
fast/forms/listbox-padding-clip-selected.html: Added.
fast/forms/listbox-padding-clip-selected-expected.html: Added.
fast/forms/listbox-padding-clip-expected-mismatch.html: Renamed from listbox-padding-clip-overlay-expected.html.
fast/forms/listbox-padding-clip-overlay-expected-mismatch.html: Renamed from listbox-padding-clip-expected.html.

6:04 AM Changeset in webkit [200001] by Carlos Garcia Campos

1 edit
4 adds in releases/WebKitGTK/webkit-2.12/LayoutTests

Merge r199086 - Test listbox clipping to contents rect
https://bugs.webkit.org/show_bug.cgi?id=156265

Reviewed by Simon Fraser.

These tests create some <select><option></option></select>s with padding.
These list boxes use the zapfino "f" character (because it draws wildly
far outside of its layout box) to create a case where text inside the list
box would naturally intersect with the padding. This overflow should be
clipped so that the padding is undisturbed.

fast/forms/listbox-padding-clip-expected.html: Added.
fast/forms/listbox-padding-clip-overlay-expected.html: Added.
fast/forms/listbox-padding-clip-overlay.html: Added.
fast/forms/listbox-padding-clip.html: Added.
platform/ios-simulator/TestExpectations: Skip on iOS

5:54 AM Changeset in webkit [200000] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199552 - Collapsed border cache invalidation can lead to O(n^{2) during style resolve

https://bugs.webkit.org/show_bug.cgi?id=156570}

Reviewed by Darin Adler.

RenderTable::invalidateCollapsedBorders traverses all cells. It is called when table cell border changes.
This can result in O(n^{2) during style resolve.}

rendering/RenderTable.cpp:

(WebCore::RenderTable::layout):
(WebCore::RenderTable::invalidateCollapsedBorders):

For cell border style change invalidate the hasEmptyCollapsedBorder bits only for the neighbouring cells.
They are the only ones that can be affected.

rendering/RenderTable.h:

(WebCore::RenderTable::collapsedBordersAreValid):
(WebCore::RenderTable::collapsedEmptyBorderIsPresent):
(WebCore::RenderTable::currentBorderValue):

rendering/RenderTableCell.cpp:

(WebCore::RenderTableCell::styleDidChange):

5:50 AM Changeset in webkit [199999] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199516 - Text on compositing layer with negative letter-spacing is truncated.
https://bugs.webkit.org/show_bug.cgi?id=156550
<rdar://problem/24212140>

Reviewed by Antti Koivisto.

Negative letter-spacing affects the right edge of content's visual overflow (for both RTL and LTR).
This is similar to how normal line layout adjusts it at InlineFlowBox::addTextBoxVisualOverflow().

Source/WebCore:

Test: fast/text/negative-letter-spacing-visual-overflow.html

rendering/SimpleLineLayoutFunctions.cpp:

(WebCore::SimpleLineLayout::computeOverflow):
(WebCore::SimpleLineLayout::paintFlow):
(WebCore::SimpleLineLayout::collectFlowOverflow):

LayoutTests:

fast/text/negative-letter-spacing-visual-overflow-expected.html: Added.
fast/text/negative-letter-spacing-visual-overflow.html: Added.

5:48 AM Changeset in webkit [199998] by Carlos Garcia Campos

7 edits
4 adds in releases/WebKitGTK/webkit-2.12

Merge r199512 - Non-resizable text field looks resizable
https://bugs.webkit.org/show_bug.cgi?id=152271

Reviewed by Darin Adler.

Source/WebCore:

The 'resizability' of an HTML element is controlled by its 'resize' CSS property value.
By default it is 'none', but certain HTML elements, including <textarea>, have it
set to 'both' by default (defined in html.css). These values mean no resize at all, and
resizable in both vertical and horizontal axis, respectively.
Additionally, 'vertical' and 'horizontal' values are also valid.

Problem here is that the way WebKit handles the 'resize' property on single line
input elements (e.g. <input>) is different than other engines (read Gecko, Blink and Presto):

Match: WebKit, Firefox, Presto and Blink all force single line input elements to be non-resizable,

regardless of either the 'resize' properly is set or not.

Mismatch: WebKit is the only engine that actually paints the resize control on single line

input elements, even it having no effect.

On WebKit, this happens because the 'resize' property is wrongly implemented as 'inheritable',
differently from other engines. In the way WebKit contructs its RenderTree, 'resize' property
ends up spilling out of <input> and entering its shadow representation, carrying the 'resize'
property on.

Patch fixes this by making the 'resize' properly be non-inherited, matching other vendors
and the spec [1].

[1] https://drafts.csswg.org/css-ui/#resize

Tests: fast/css/resize-not-inherited.html

fast/css/resize-single-line-input-no-paint.html

rendering/style/RenderStyle.h:
rendering/style/StyleRareInheritedData.cpp:

(WebCore::StyleRareInheritedData::StyleRareInheritedData):
(WebCore::StyleRareInheritedData::operator==):

rendering/style/StyleRareInheritedData.h:
rendering/style/StyleRareNonInheritedData.cpp:

(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator==):

rendering/style/StyleRareNonInheritedData.h:

LayoutTests:

fast/css/resize-not-inherited-expected.html: Added.
fast/css/resize-not-inherited.html: Added.
fast/css/resize-single-line-input-no-paint-expected.html: Added.
fast/css/resize-single-line-input-no-paint.html: Added.

5:36 AM Changeset in webkit [199997] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199385 - Fixed uninitialization of Node::DataUnion with GCC 4.8.
https://bugs.webkit.org/show_bug.cgi?id=156507

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-04-12
Reviewed by Michael Catanzaro.

This change fixes run time crashes caused by access to uninitialized
memory in Node::renderer().

No new tests needed.

dom/Node.h:

5:17 AM Changeset in webkit [199996] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199313 - fast/loader/opaque-base-url.html crashing during mac and ios debug tests
https://bugs.webkit.org/show_bug.cgi?id=156179
<rdar://problem/25507719>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Navigate to about:blank if the provided src of an iframe/frame cannot be
resolved to a valid URL.

Test: fast/loader/iframe-src-invalid-url.html

loader/SubframeLoader.cpp:

(WebCore::SubframeLoader::requestFrame):

LayoutTests:

fast/loader/iframe-src-invalid-url-expected.txt: Added.
fast/loader/iframe-src-invalid-url.html: Added.

5:14 AM Changeset in webkit [199995] by Carlos Garcia Campos

3 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199304 - REGRESSION (r193857): Text selection causes text to disappear.
https://bugs.webkit.org/show_bug.cgi?id=156448
rdar://problem/25578952

Reviewed by Simon Fraser.

Apparently when the end position of the selection range is smaller than the start position, we need
to repaint the entire text as it indicates selection clearing.

Source/WebCore:

Test: fast/text/text-disappear-on-deselect.html

rendering/TextPainter.cpp:

(WebCore::TextPainter::paintText):

LayoutTests:

fast/text/text-disappear-on-deselect-expected.html: Added.
fast/text/text-disappear-on-deselect.html: Added.

5:11 AM Changeset in webkit [199994] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199278 - Fixed compilation of JPEGImageDecoder with libjpeg v9.
https://bugs.webkit.org/show_bug.cgi?id=156445

Patch by Konstantin Tokarev <Konstantin Tokarev> on 2016-04-09
Reviewed by Michael Catanzaro.

ICU defines TRUE and FALSE macros, breaking libjpeg v9 headers.

No new tests needed.

platform/image-decoders/jpeg/JPEGImageDecoder.h:

5:01 AM Changeset in webkit [199993] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199243 - Timing attack on SVG feComposite filter circumvents same-origin policy
https://bugs.webkit.org/show_bug.cgi?id=154338

Patch by Said Abou-Hallawa <sabouhallawa@apple,com> on 2016-04-08
Reviewed by Oliver Hunt.

Ensure the FEComposite arithmetic filter is clamping the resulted color
components in a constant time.

platform/graphics/filters/FEComposite.cpp:

(WebCore::clampByte):
(WebCore::computeArithmeticPixels):

4:57 AM Changeset in webkit [199992] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebKit2

Merge r199204 - Clearing the application cache doesn't work.
https://bugs.webkit.org/show_bug.cgi?id=156354
rdar://problem/22369239

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-04-07
Reviewed by Brady Eidson.

Use the correct "ApplicationCache" directory.
Delete the caches, not just the entries.

UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::WebsiteDataStore::fetchData):
(WebKit::WebsiteDataStore::removeData):

4:21 AM Changeset in webkit [199991] by Carlos Garcia Campos

11 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199181 - Wheel event callback removing the window causes crash in WebCore.
https://bugs.webkit.org/show_bug.cgi?id=150871
<rdar://problem/23418283>

Reviewed by Simon Fraser.

Source/WebCore:

Null check the FrameView before using it, since the iframe may have been removed
from its parent document inside the event handler.

The new test triggered a cross-load side-effect, where wheel event filtering wasn't
reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
which resets the filtering.

Since the Frame destructor invokes EventHandler::clear, which invokes MainFrame methods,
we run the risk of attempting to dereference destroyed MainFrame elements of the current
Frame object. Instead, clear the EventHandler in the MainFrame destructor.

Finally, confirm that the mainFrame member is not being destroyed in the handful of
places that might attempt to access the mainFrame during object destruction (essentially
cleanup methods).

Test: fast/events/wheel-event-destroys-frame.html

loader/FrameLoader.cpp:

(WebCore::FrameLoader::clear): Protect against accessing mainFrame content during destruction.

page/EventHandler.cpp:

(WebCore::EventHandler::clear): Call 'clearLatchedState' instead of endFilteringDeltas.
(WebCore::EventHandler::clearLatchedState): Null-check the filter before calling it.

page/Frame.cpp:

(WebCore::Frame::~Frame): Do not call 'setView' in the destructor for a MainFrame.
(WebCore::Frame::setView): Check for a null event handler before invoking it.
(WebCore::Frame::setMainFrameWasDestroyed): Added. Mark that the MainFrame
member of the Frame is being destroyed (if the current Frame is a MainFrame) and clear
the EventHandler member so that it doesn't attempt to access mainFrame content.
(WebCore::Frame::mainFrame): When accessing the mainFrame member, assert that the
mainFrame is not being destroyed.

page/MainFrame.cpp:

(WebCore::MainFrame::~MainFrame): Set the m_recentWheelEventDeltaFilter to nullptr to
prevent attempts to access it during object destruction. Call the new 'setMainFrameWasDestroyed'
method to reset eventHandler and mark the MainFrame as being in the process of destruction.

page/WheelEventDeltaFilter.cpp:

(WebCore::WheelEventDeltaFilter::filteredDelta): Add logging.

page/mac/EventHandlerMac.mm:

(WebCore::EventHandler::platformCompleteWheelEvent): Add null check.

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::scrollTo): Add logging.

LayoutTests:

fast/events/wheel-event-destroys-frame-expected.txt: Added.
fast/events/wheel-event-destroys-frame.html: Added.
platform/ios-simulator/TestExpectations: Skip wheel-event test on iOS.

4:21 AM Changeset in webkit [199990] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199155 - FrameView::qualifiesAsVisuallyNonEmpty() returns false when loading a Google search results page before search results are loaded, even though the header is visible
https://bugs.webkit.org/show_bug.cgi?id=156339
<rdar://problem/24491381>

Reviewed by Andreas Kling.

Jeff's testing indicates lowering the document height threshold improves things visually during page loading.

page/FrameView.cpp:

(WebCore::FrameView::qualifiesAsVisuallyNonEmpty):

Lower document height threshold to from 200 to 48 pixels.

3:59 AM Changeset in webkit [199989] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199116 - CRASH in AudioDestinationNode::render()
https://bugs.webkit.org/show_bug.cgi?id=156308
<rdar://problem/25468815>

Reviewed by Eric Carlson.

AudioDestinationNode::render() will crash when passed in a zero-length frame count. Rather than get into
this bad state, ASSERT() and bail out early in this case.

Also, address the situation in AudioDestinationIOS::render which can cause this 0-frame count to occur.

Modules/webaudio/AudioDestinationNode.cpp:

(WebCore::AudioDestinationNode::render):

platform/audio/ios/AudioDestinationIOS.cpp:

(WebCore::AudioDestinationIOS::render):

3:32 AM Changeset in webkit [199988] by Carlos Garcia Campos

10 edits in releases/WebKitGTK/webkit-2.12

Merge r199110 - REGRESSION(r195463): [GTK] accessibility/roles-computedRoleString.html and accessibility/roles-exposed.html failing
https://bugs.webkit.org/show_bug.cgi?id=153696

Reviewed by Chris Fleizach.

Source/WebCore:

The failures were due to always mapping style format groups to GroupRole, even for
RenderInline objects. The fix is to expose inline style format groups as InlineRole,
add handling of GroupRole style groups to the ATK code, and InlineRole style groups
to the Mac code.

No new tests because we have sufficient coverage. Updated roles-computedRoleString.html
to reflect new exposure.

accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::determineAccessibilityRole):

accessibility/atk/WebKitAccessibleWrapperAtk.cpp:

(atkRole):

accessibility/mac/AccessibilityObjectMac.mm:

(WebCore::AccessibilityObject::accessibilityPlatformIncludesObject):

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(createAccessibilityRoleMap):
(-[WebAccessibilityObjectWrapper subrole]):

LayoutTests:

Now that RenderInline style format groups are exposed as InlineRole, there is
no longer a corresponding computed role for ins, samp, and var elements. Updated
the roles-computedRoleString.html test and expectations accordingly. Also added
the now-correct results for Gtk for both of the previously-failing tests.

accessibility/roles-computedRoleString-expected.txt: Updated.
accessibility/roles-computedRoleString.html: Updated.
platform/gtk/TestExpectations: Unskip the two tests which are now passing.
platform/gtk/accessibility/roles-computedRoleString-expected.txt: Updated.
platform/gtk/accessibility/roles-exposed-expected.txt: Updated.

3:30 AM Changeset in webkit [199987] by Carlos Garcia Campos

4 edits in releases/WebKitGTK/webkit-2.12

Merge r199107 - Implement operator== and operator!= for Optional<>
https://bugs.webkit.org/show_bug.cgi?id=156266

Reviewed by Anders Carlsson.
Source/WTF:

Implement non-member operator== and operator!= variants for Optional<>.

wtf/Optional.h:

(WTF::operator==):
(WTF::operator!=):

Tools:

TestWebKitAPI/Tests/WTF/Optional.cpp:

(TestWebKitAPI::TEST):

3:26 AM Changeset in webkit [199986] by youenn.fablet@crf.canon.fr

2 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from TextTrack
https://bugs.webkit.org/show_bug.cgi?id=156899

Reviewed by Chris Dumez.

No behavior changes.

html/track/TextTrack.idl: Marking cue and region parameter as nullable.

Also marking cues and activeCues as nullable attributes.

3:23 AM Changeset in webkit [199985] by youenn.fablet@crf.canon.fr

13 edits
3 adds in trunk

Drop [UsePointersEvenForNonNullableObjectArguments] from File API interfaces
https://bugs.webkit.org/show_bug.cgi?id=156898

Reviewed by Chris Dumez.

Source/WebCore:

Making FileReaderSync API API throwing a TypeError in case of null parameters, in lieu of a NOT_FOUND_ERR.
Making FileReader API taking nullable parameters as a temporary fix.

Test: fast/files/workers/worker-file-reader-sync-bad-parameter.html

Modules/websockets/WebSocketChannel.cpp:

(WebCore::WebSocketChannel::processOutgoingFrameQueue): Updated to cope with FileReaderLoader::start taking a Blob&.

fileapi/FileReader.cpp:

(WebCore::FileReader::readAsArrayBuffer): Updated to cope with readInternal taking a Blob&.
(WebCore::FileReader::readAsBinaryString): Ditto.
(WebCore::FileReader::readAsText): Ditto.
(WebCore::FileReader::readAsDataURL): Ditto.
(WebCore::FileReader::readInternal): Updated to cope with FileReaderLoader::start taking a Blob&.

fileapi/FileReader.h:
fileapi/FileReader.idl: Marking the readXX methods as taking a nullable blob parameter to keep compatibility, at least temporarily.
fileapi/FileReaderLoader.cpp:

(WebCore::FileReaderLoader::start): It now takes a Blob& as input.

fileapi/FileReaderLoader.h:
fileapi/FileReaderSync.cpp:

(WebCore::FileReaderSync::readAsArrayBuffer): Taking a Blob& as input.
(WebCore::FileReaderSync::readAsBinaryString): Ditto.
(WebCore::FileReaderSync::readAsText): Ditto.
(WebCore::FileReaderSync::readAsDataURL): Ditto.
(WebCore::FileReaderSync::startLoading) Ditto.

fileapi/FileReaderSync.h:

(WebCore::FileReaderSync::readAsText): Ditto.

fileapi/FileReaderSync.idl:

LayoutTests:

Checking FileReaderSync send method in case of null or undefined blob parameter.
worker-read-blob-sync.html and worker-read-file-sync check the case of badly typed parameters.
In all cases, TypeError is thrown.

fast/files/workers/resources/worker-file-reader-sync-bad-parameter.js: Added.

(test):

fast/files/workers/worker-file-reader-sync-bad-parameter-expected.txt: Added.
fast/files/workers/worker-file-reader-sync-bad-parameter.html: Added.
fast/files/workers/worker-read-blob-sync-expected.txt: Rebasing expectation.
fast/files/workers/worker-read-file-sync-expected.txt: Ditto.

3:08 AM Changeset in webkit [199984] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore

Merge r199113 - Add ASSERT_WITH_SECURITY_IMPLICATION when a float box is referenced by multiple RootInlineBoxes.
https://bugs.webkit.org/show_bug.cgi?id=156297
<rdar://problem/25580844>

Reviewed by Brent Fulgham.

See http://trac.webkit.org/changeset/199101

No change in functionality.

rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::appendFloatingObjectToLastLine):
(WebCore::RenderBlockFlow::reattachCleanLineFloats):
(WebCore::RenderBlockFlow::determineStartPosition):

3:07 AM Changeset in webkit [199983] by Carlos Garcia Campos

4 edits
2 adds in releases/WebKitGTK/webkit-2.12

Merge r199101 - ASSERTION FAILED: !floatingObject->originatingLine() in WebCore::RenderBlockFlow::linkToEndLineIfNeeded
https://bugs.webkit.org/show_bug.cgi?id=153001

Reviewed by Dan Bernstein.

Float boxes are always attached to the line where we see them first.
Float box can only be attached to one line.
RenderBlockFlow can perform partial layout on dirty lines only.

In certain cases, the last dirty line can "pull up" float boxes from the first clean line.
It simply means that due to some layout changes on previous lines now we see those floats on this last dirty line first.
If after placing the float we still find it on the same position, the line below is still considered clean.
Source/WebCore:

Remove the float box from its original line if the line above already placed it.

Test: fast/block/float/float-moves-between-lines.html

rendering/RenderBlockFlow.h:
rendering/RenderBlockLineLayout.cpp:

(WebCore::RenderBlockFlow::reattachCleanLineFloats):
(WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
(WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange): Deleted.

LayoutTests:

Remove the float box from its original line if the line above already placed it.

fast/block/float/float-moves-between-lines-expected.txt: Added.
fast/block/float/float-moves-between-lines.html: Added.

3:03 AM Changeset in webkit [199982] by Carlos Garcia Campos

2 edits in releases/WebKitGTK/webkit-2.12/Source/WebCore/platform/gtk/po

Merge r199100 - [GTK] [l10n] Updated Italian translation of WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=156283

Patch by Milo Casagrande <milo@milo.name> on 2016-04-06
Rubber-stamped by Michael Catanzaro.

it.po:

2:54 AM Changeset in webkit [199981] by Manuel Rego Casasnovas

5 edits
2 adds in trunk

[css-grid] Fix grid-template-columns|rows computed style with content alignment
https://bugs.webkit.org/show_bug.cgi?id=156793

Reviewed by Darin Adler.

Source/WebCore:

Computed style of grid-template-columns and grid-template-rows properties
was including the distribution offset because of content alignment.
We should subtract that offset, like we do for the case of gaps,
when we're calculating the computed style.

Test: fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment.html

css/CSSComputedStyleDeclaration.cpp:

(WebCore::valueForGridTrackList):

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::offsetBetweenTracks):
(WebCore::RenderGrid::populateGridPositions): Deleted FIXME.

rendering/RenderGrid.h:

LayoutTests:

fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment-expected.txt: Added.
fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment.html: Added.

2:50 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

2:49 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

2:46 AM Changeset in webkit [199980] by fred.wang@free.fr

19 edits
8 adds
4 deletes in trunk

Refactor RenderMathMLMenclose.
https://bugs.webkit.org/show_bug.cgi?id=155019

Patch by Frederic Wang <fwang@igalia.com> on 2016-04-25
Reviewed by Sergio Villar Senin.

Source/WebCore:

Tests: mathml/presentation/menclose-notation-equivalence.html

mathml/presentation/menclose-notation-values.html

We rewrite RenderMathMLMenclose so that layout functions correctly override the
behavior of RenderMathMLRow. We try and rely on the draft of the MathML in HTML5
implementation note, to make easier to get consistency with other rendering engines
in the future. All notations are now drawn with GraphicContext functions instead of
mixing them with CSS style. To save memory space, the list of known notations are
now saved on a short integer using bit masks instead of a vector of string names.
Finally, we remove support for the radical notation so that we no longer need to
create an anonymous RenderMathMLRoot.

mathml/MathMLMencloseElement.cpp: Remove code for some special notations and just

reimplement parsing of the notation attribute.
(WebCore::MathMLMencloseElement::MathMLMencloseElement): By default, the notation is longdiv.
(WebCore::MathMLMencloseElement::parseAttribute): By default, the list of notation is empty.
If there is no notation attribute, the default value longdiv is used.
Otherwise, we parse the notation attribute and add each notation, using some equivalences
for box, actuarial and madruwb.
(WebCore::MathMLMencloseElement::isPresentationAttribute): Deleted. No need to define
specific style for some notation.
(WebCore::MathMLMencloseElement::finishParsingChildren): Deleted. No need to add an
anonymous square root.
(WebCore::MathMLMencloseElement::collectStyleForPresentationAttribute): Deleted. No need to
define specific style for some notation.
(WebCore::MathMLMencloseElement::longDivLeftPadding): Deleted. RenderMathMLMenclose uses an
arbitrary size instead of measure a glyph.

mathml/MathMLMencloseElement.h: Define simple bit mask for each notation, add a short

integer to store the list of notations together with helper functions. Remove old code.

rendering/mathml/RenderMathMLMenclose.cpp: Rewrite RenderMathMLMenclose so that layout

functions correctly override the behavior of RenderMathMLRow.
(WebCore::RenderMathMLMenclose::RenderMathMLMenclose): Init m_ascent to 0.
(WebCore::RenderMathMLMenclose::ruleThickness): For now, we use the fallback value used by
for other bars. We may refine that in the future.
(WebCore::RenderMathMLMenclose::getSpaceAroundContent): Helper function to retrieve the
space to add around the content, depending on the notations specified. Note that for
notation circle, this spacing depends on the content size.
(WebCore::RenderMathMLMenclose::computePreferredLogicalWidths): Reimplement this function.
This is just adding left/right spacing around the content.
(WebCore::RenderMathMLMenclose::layoutBlock): Reimplement this function. We do the normal
RenderMathMLRow layout, adjust spacing and child position and
calculate m_ascent and m_contentRect.
(WebCore::RenderMathMLMenclose::firstLineBaseline): Implement this function.
We just return m_ascent.
(WebCore::drawLine): Helper function to draw a line using strokePath.
(WebCore::RenderMathMLMenclose::paint): We reimplement this function to draw
all notations using GraphicContext.
(WebCore::RenderMathMLMenclose::addChild): Deleted. No need to manage anonymous renderers.
(WebCore::RenderMathMLMenclose::updateLogicalHeight): Deleted. Height is now calculated
in layoutBlock.
(WebCore::RenderMathMLMenclose::checkNotationalValuesValidity): Deleted.

rendering/mathml/RenderMathMLMenclose.h: Update member definitions.
rendering/mathml/RenderMathMLRoot.cpp: We no longer need anonymous roots.

(WebCore::RenderMathMLRoot::RenderMathMLRoot): Deleted.

rendering/mathml/RenderMathMLRoot.h: We no longer need anonymous roots.
rendering/mathml/RenderMathMLRow.cpp: Allow to get the exact metrics of the chid row,

for use in RenderMathMLRoot.
(WebCore::RenderMathMLRow::computeLineVerticalStretch): rename parameters.
(WebCore::RenderMathMLRow::layoutRowItems): Set parameters to the final ascent, descent and
logical width of the chid row. Set the temporary logical width for RenderMathMenclose before
laying the children out.
(WebCore::RenderMathMLRow::layoutBlock): Rename parameters ; add a dummy logicalWidth
parameter.

rendering/mathml/RenderMathMLRow.h: Make some functions accessible or overridable by

RenderMathMLRoot. Make layoutRowItems return the final ascent, descent and logical width
after the chid row is laid out.

rendering/mathml/RenderMathMLSquareRoot.cpp: We no longer need anonymous roots.

(WebCore::RenderMathMLSquareRoot::RenderMathMLSquareRoot): Deleted.
(WebCore::RenderMathMLSquareRoot::createAnonymousWithParentRenderer): Deleted.

rendering/mathml/RenderMathMLSquareRoot.h: We no longer need anonymous roots.

LayoutTests:

mathml/presentation/menclose-notation-attribute-set1.html: Removed.

This is replaced with menclose-notation-values.

mathml/presentation/menclose-notation-attribute-set1-expected.txt: Removed.

This is replaced with menclose-notation-values.

mathml/presentation/menclose-notation-attribute-set2-expected-mismatch.html: Removed.

This is replaced with menclose-notation-values.

mathml/presentation/menclose-notation-attribute-set2.html: Removed.

This is replaced with menclose-notation-values.

mathml/presentation/menclose-notation-values.html: Added.

This test verifies the rendering of various menclose notations.

mathml/presentation/menclose-notation-equivalence.html: Added.

This test verifies some equivalence for the notation attribute value.

mathml/presentation/menclose-notation-equivalence-expected.html: Added.
mathml/presentation/menclose-notation-radical.html: Update the test now that support for

the radical notation is removed.

mathml/presentation/menclose-notation-radical-expected.html: ditto.
platform/gtk/mathml/presentation/menclose-notation-default-longdiv-expected.png: Update

reference due to small changes in longdiv implementation.

platform/gtk/mathml/presentation/menclose-notation-default-longdiv-expected.txt: ditto.
platform/mac/mathml/presentation/menclose-notation-default-longdiv-expected.png: ditto.
platform/mac/mathml/presentation/menclose-notation-default-longdiv-expected.txt: ditto.
platform/ios-simulator/mathml/presentation/menclose-notation-default-longdiv-expected.txt: ditto
platform/gtk/mathml/presentation/menclose-notation-values-expected.png: Added.
platform/gtk/mathml/presentation/menclose-notation-values-expected.txt: Added.
platform/mac/mathml/presentation/menclose-notation-values-expected.png: Added.
platform/mac/mathml/presentation/menclose-notation-values-expected.txt: Added.
platform/ios-simulator/mathml/presentation/menclose-notation-values-expected.txt: Added.

12:39 AM Changeset in webkit [199979] by Carlos Garcia Campos

6 edits in releases/WebKitGTK/webkit-2.12

Merge r199099 - REGRESSION(r196629): Messages text size only changes for sending text, conversation text size does not change
https://bugs.webkit.org/show_bug.cgi?id=156287
<rdar://problem/24264756>

Reviewed by Andreas Kling.

Source/WebCore:

css/RuleFeature.cpp:

(WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
(WebCore::makeAttributeSelectorKey):

Include attribute value to the key. Otherwise we may deduplicate selectors that are not indentical.

(WebCore::RuleFeatureSet::collectFeatures):
(WebCore::RuleFeatureSet::add):

Use HashMap::ensure().

css/RuleFeature.h:

LayoutTests:

fast/css/style-invalidation-attribute-change-descendants-expected.txt:
fast/css/style-invalidation-attribute-change-descendants.html:

12:07 AM WebKitGTK/Gardening/Calendar edited by Carlos Garcia Campos

(diff)

12:04 AM Changeset in webkit [199978] by fred.wang@free.fr

2 edits in trunk/Source/WebCore

Minor refactoring in RenderMathMLOperator
https://bugs.webkit.org/show_bug.cgi?id=156906

Patch by Frederic Wang <fwang@igalia.com> on 2016-04-25
Reviewed by Martin Robinson.

No new tests, this is only minor refactoring that does not change the behavior.

rendering/mathml/RenderMathMLOperator.cpp:

(WebCore::RenderMathMLOperator::getGlyphAssemblyFallBack):
We rename the "state" integer to an "expected" enum indicating the next expected part.
(WebCore::RenderMathMLOperator::paintGlyph): We add a missing dot at the end of a sequence.
We also replace ceil(x+1) with ceil(x)+1 to get rid of the temporary variable.

Apr 24, 2016:

11:34 PM Changeset in webkit [199977] by Hunseop Jeong

3 edits in trunk/Source/WebKit2

[EFL] Update the ewk_settings_offline_web_application_cache_enabled_get() expected value after r199854.
https://bugs.webkit.org/show_bug.cgi?id=156968

Reviewed by Gyuyoung Kim.

UIProcess/API/C/WKPreferencesRef.h: Update the comment.
UIProcess/API/efl/tests/test_ewk2_settings.cpp:

(TEST_F):

10:59 PM Changeset in webkit [199976] by Chris Dumez

19 edits
1 delete in trunk/Source/WebCore

[Web IDL] Specify default values for boolean parameters
https://bugs.webkit.org/show_bug.cgi?id=156964

Reviewed by Darin Adler.

Specify default values for boolean parameters in our IDL files and
let the bindings generator use WTF::Optional<> for the ones without
a default value.

CMakeLists.txt:
Modules/indexeddb/IDBKeyRange.cpp:
Modules/indexeddb/IDBKeyRange.h:
Modules/indexeddb/IDBKeyRange.idl:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSBindingsAllInOne.cpp:

bindings/js/JSDOMTokenListCustom.cpp: Removed.

We no longer need these custom bindings as the bindings generator
will now provide the implementation with an Optional<bool>, given
that the parameter has no default value.

bindings/scripts/CodeGeneratorJS.pm:

(CanUseWTFOptionalForParameterType): Deleted.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:

(webkit_dom_test_obj_method_with_optional_boolean):
(webkit_dom_test_obj_method_with_optional_boolean_is_false):

bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBoolean):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalBooleanIsFalse):

bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:

(-[DOMTestObj methodWithOptionalBoolean:]):
(-[DOMTestObj methodWithOptionalBooleanIsFalse:]):

bindings/scripts/test/TestObj.idl:
dom/Document.h:
dom/Document.idl:
dom/Element.idl:
dom/EventTarget.idl:
html/DOMTokenList.idl:

10:56 PM Changeset in webkit [199975] by Gyuyoung Kim

2 edits in trunk/LayoutTests

[EFL] Some media tests have been failed after bumping gstreamer ver.

Unreviewed EFL gardening. Mark failing tests to timeout or failure.

platform/efl/TestExpectations:

8:09 PM Changeset in webkit [199974] by Matt Baker

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Can't sort by name/source code location columns in Timeline data grids
https://bugs.webkit.org/show_bug.cgi?id=156965
<rdar://problem/25898716>

Reviewed by Timothy Hatcher.

Add support for sorting SourceCodeLocation objects to TimelineDataGrid,
and include a grid delegate so that views can extend sorting logic for
other document fragment columns.

UserInterface/Views/NetworkTimelineView.js:

(WebInspector.NetworkTimelineView):
(WebInspector.NetworkTimelineView.prototype.dataGridSortComparator):
Sort "name" column by display name first, then resource URL.

UserInterface/Views/ScriptDetailsTimelineView.js:

(WebInspector.ScriptDetailsTimelineView):
(WebInspector.ScriptDetailsTimelineView.prototype.dataGridSortComparator):
Sort "name" column by display name first, then subtitle.

UserInterface/Views/ScriptTimelineDataGridNode.js:

(WebInspector.ScriptTimelineDataGridNode.prototype.get subtitle):
Make subtitle accessible externally for sorting.
(WebInspector.ScriptTimelineDataGridNode.prototype._createNameCellDocumentFragment):
(WebInspector.ScriptTimelineDataGridNode):

UserInterface/Views/TimelineDataGrid.js:

(WebInspector.TimelineDataGrid):
(WebInspector.TimelineDataGrid.prototype.get sortDelegate):
(WebInspector.TimelineDataGrid.prototype.set sortDelegate):
Fire a SortChanged event if the delegate changed and the grid is sorted.
(WebInspector.TimelineDataGrid.prototype._sort):
If a sort delegate exists, and it returns a numeric value, skip the
default compare.

(WebInspector.TimelineDataGrid.prototype._sortComparator):
Add support for sorting SourceCodeLocation columns.

6:40 PM Changeset in webkit [199973] by Chris Dumez

2 edits in trunk/LayoutTests/imported/w3c

Unreviewed, revert part of r199970 that shouldn't have been committed.

web-platform-tests/IndexedDB/idbfactory_open9.htm:

6:17 PM WebKitIDL edited by Chris Dumez

Drop [Default] (diff)

6:03 PM Changeset in webkit [199972] by Matt Baker

4 edits in trunk/Source/WebInspectorUI

Web Inspector: Error when selecting a bar in the Frames timeline
https://bugs.webkit.org/show_bug.cgi?id=156960
<rdar://problem/25897955>

Reviewed by Timothy Hatcher.

Fixes timeline grid node selection when record selected in the overview.
Adds general purpose findNode method to DataGrid.

UserInterface/Views/DataGrid.js:

(WebInspector.DataGrid.prototype.findNode):
Basic find function for locating a grid node in linear time.

UserInterface/Views/TimelineRecordingContentView.js:

(WebInspector.TimelineRecordingContentView.prototype._recordSelected):
Remove tree outline references, call generic select method.

UserInterface/Views/TimelineView.js:

(WebInspector.TimelineView.prototype.selectRecord):
If a data grid was set, deselect current selection and select the node
associated with the timeline record.

5:59 PM Changeset in webkit [199971] by Matt Baker

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Events in JavaScript & Events timeline have no profile children
https://bugs.webkit.org/show_bug.cgi?id=156627
<rdar://problem/25749740>

Reviewed by Timothy Hatcher.

ProfileNodeDataGridNode should handle populate events when expanded.
This was previously done by ProfileNodeTreeElement, which is no longer
used in the Timelines tab.

UserInterface/Views/ProfileDataGridNode.js:

(WebInspector.ProfileDataGridNode.prototype._updateChildrenForModifiers):
(WebInspector.ProfileDataGridNode.prototype._populate):
(WebInspector.ProfileDataGridNode):
DataGridNode sets shouldRefreshChildren to false after populating
child nodes. No need to track with a separate flag.

UserInterface/Views/ProfileNodeDataGridNode.js:

(WebInspector.ProfileNodeDataGridNode):
(WebInspector.ProfileNodeDataGridNode.prototype._populate):

5:27 PM Changeset in webkit [199970] by Chris Dumez

23 edits in trunk

Autogenerated IDBFactory.open() does the wrong thing if you pass an explicit 'undefined' as the second argument
https://bugs.webkit.org/show_bug.cgi?id=156939

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Re-sync tests from upstream b1818929.

IndexedDB-private-browsing/idbfactory_open9-expected.txt:
IndexedDB-private-browsing/idbfactory_open9.html:
web-platform-tests/IndexedDB/idbfactory_open9-expected.txt:
web-platform-tests/IndexedDB/idbfactory_open9.htm:

Source/WebCore:

As per WebIDL, if undefined is passed by JS for an optional parameter then
we should use its default value if it has one, or use the special value
"missing":
http://heycam.github.io/webidl/#es-overloads (step 10.4)

Our bindings generator was already mapping undefined to the parameter's
default value when present. However, it was missing the notion of
"missing" value when there no default value. This patch adds supports
for its by passing Optional<>(Nullopt) to the implementation in such
case. This means that the implementation will need to use WTF::Optional<>
type for parameters that do not have a default value. Thankfully though,
in most cases, we will be able to specify a default value in the IDL
so cases where we will need to use WTF::Optional<> will actually be
rare.

To avoid having to do too much refactoring in this patch, the support
for WTF::Optional is currently blacklisted for most IDL types. I will
gradually stop blacklisting each type in follow-up patches, as I either:

Add default parameter values in our IDL (preferred)
Use WTF::Optional<> in our implementation (when we cannot specify a default value).

This patch fixes a bug with IDBFactory.open()'s second parameter (version)
for which undefined should not throw and indicate that the version
should not be changed. We now use WTF::Optional in the implementation to
distinguish this case and not throw.

No new tests, existing tests were updated / rebaselined.

Modules/indexeddb/IDBFactory.cpp:

(WebCore::IDBFactory::open):
(WebCore::IDBFactory::openInternal): Deleted.

Modules/indexeddb/IDBFactory.h:
bindings/scripts/CodeGeneratorJS.pm:

(ShouldUseWTFOptionalForParameterType):
(GenerateParametersCheck):

fileapi/Blob.idl:
inspector/InspectorIndexedDBAgent.cpp:

LayoutTests:

Update / rebaseline existing test now that passing undefined as second parameter to
IDBFactory.open() no longer throws.

storage/indexeddb/intversion-bad-parameters-expected.txt:
storage/indexeddb/intversion-bad-parameters-private-expected.txt:
storage/indexeddb/resources/intversion-bad-parameters.js:

(deleteSuccess):

10:23 AM Changeset in webkit [199969] by Chris Dumez

145 edits in trunk

[WebIDL] Drop [Default] WebKit-IDL extended attribute
https://bugs.webkit.org/show_bug.cgi?id=156955

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline some tests now that a different exception type is thrown
for some of our APIs when passing null.

web-platform-tests/dom/interfaces-expected.txt:
web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

Drop [Default] WebKit-IDL extended attribute in favor of the standard
WebIDL syntax for parameters' default value.

Here is what it looks like:
[Default=NullString] optional DOMString a -> optional DOMString a = null
[Default=NullString] optional DOMString? a -> optional DOMString? a = null
[Default=Undefined] optional DOMString a -> optional DOMString a = "undefined"
[Default=Undefined] optional DOMString? a -> optional DOMString? a = null
[Default=Undefined] optional long a -> optional long a = 0
[Default=Undefined] optional bool a -> optional bool a = false
[Default=Undefined] optional unrestricted double a -> optional unrestricted double a = NaN
[Default=Undefined] optional unrestricted float a -> optional unrestricted float a = NaN
[Default=Undefined] optional sequence<DOMString> a -> optional sequence<DOMString> a = []

These do not cause any Web-Exposed behavior change. However, when getting
rid of [Default] started passing more parameters by derefence instead of
pointer (as is expected for parameters not marked as nullable). As a result,
I had to mark a few parameters as nullable in the IDL to maintain the
previous behavior. In some cases, the implementation was already throwing
when passing null. In such cases, I have not marked the type as nullable
so that the generated bindings now throw the exception instead of our
implementation code. In some cases, the exception being thrown is now
different. This is why some of the layout tests had to be rebaselined.

No new tests, existing tests have been rebaselined. No significant Web
exposed behavior change is expected from this patch, beside exceptions
type sometimes being different.

Modules/encryptedmedia/MediaKeys.idl:
Modules/fetch/FetchRequest.idl:
Modules/gamepad/deprecated/GamepadList.idl:
Modules/indexeddb/IDBDatabase.idl:
Modules/mediastream/RTCStatsResponse.idl:
Modules/notifications/Notification.idl:
Modules/speech/SpeechSynthesisUtterance.idl:
Modules/webaudio/AudioNode.idl:
Modules/websockets/WebSocket.idl:
bindings/scripts/CodeGeneratorJS.pm:

(GenerateParametersCheck):

bindings/scripts/IDLAttributes.txt:
bindings/scripts/IDLParser.pm:

(parseDefault):
(parseDefaultValue):

bindings/scripts/test/TestInterface.idl:
bindings/scripts/test/TestNamedConstructor.idl:
bindings/scripts/test/TestObj.idl:
bindings/scripts/test/TestOverrideBuiltins.idl:
css/CSSKeyframesRule.idl:
css/CSSMediaRule.idl:
css/CSSPrimitiveValue.idl:
css/CSSRuleList.idl:
css/CSSStyleDeclaration.idl:
css/CSSStyleSheet.idl:
css/CSSSupportsRule.idl:
css/CSSValueList.idl:
css/MediaList.idl:
css/MediaQueryList.idl:
css/MediaQueryListListener.idl:
css/StyleMedia.idl:
css/StyleSheetList.idl:
css/WebKitCSSFilterValue.idl:
css/WebKitCSSMatrix.idl:
css/WebKitCSSTransformValue.idl:
dom/ClientRectList.idl:
dom/Comment.idl:
dom/CompositionEvent.idl:
dom/CustomEvent.h:
dom/CustomEvent.idl:
dom/DOMImplementation.idl:
dom/DOMStringList.idl:
dom/DataTransferItem.idl:
dom/DataTransferItemList.idl:
dom/DeviceMotionEvent.idl:
dom/DeviceOrientationEvent.idl:
dom/Document.cpp:

(WebCore::Document::adoptNode):

dom/Document.idl:
dom/Element.cpp:

(WebCore::Element::setAttributeNode):
(WebCore::Element::setAttributeNodeNS):
(WebCore::Element::removeAttributeNode):
(WebCore::Element::parseAttributeName): Deleted.

dom/Element.h:
dom/Element.idl:
dom/Event.idl:
dom/HashChangeEvent.idl:
dom/KeyboardEvent.idl:
dom/MessageEvent.idl:
dom/MouseEvent.idl:
dom/MutationEvent.idl:
dom/NamedNodeMap.cpp:

(WebCore::NamedNodeMap::setNamedItem):
(WebCore::NamedNodeMap::setNamedItemNS):
(WebCore::NamedNodeMap::item): Deleted.

dom/NamedNodeMap.h:
dom/NamedNodeMap.idl:
dom/Node.idl:
dom/NodeFilter.idl:
dom/NonElementParentNode.idl:
dom/OverflowEvent.idl:
dom/Range.idl:
dom/Text.idl:
dom/TextEvent.idl:
dom/TouchEvent.idl:
dom/UIEvent.idl:
dom/WheelEvent.idl:
html/DOMFormData.idl:
html/HTMLAllCollection.idl:
html/HTMLAudioElement.idl:
html/HTMLCanvasElement.idl:
html/HTMLCollection.idl:
html/HTMLDocument.idl:
html/HTMLElement.cpp:

(WebCore::HTMLElement::insertAdjacentElement):
(WebCore::contextElementForInsertion): Deleted.

html/HTMLElement.h:
html/HTMLElement.idl:
html/HTMLFormControlsCollection.idl:
html/HTMLInputElement.idl:
html/HTMLMediaElement.idl:
html/HTMLOptionElement.idl:
html/HTMLOptionsCollection.idl:
html/HTMLSelectElement.idl:
html/HTMLTableElement.idl:
html/HTMLTableRowElement.idl:
html/HTMLTableSectionElement.idl:
html/HTMLTextAreaElement.idl:
html/ImageData.idl:
html/canvas/CanvasGradient.idl:
html/canvas/CanvasRenderingContext2D.idl:
html/canvas/DOMPath.idl:
html/canvas/OESVertexArrayObject.idl:
page/DOMSelection.cpp:

(WebCore::DOMSelection::extend):
(WebCore::DOMSelection::getRangeAt): Deleted.

page/DOMSelection.h:
page/DOMSelection.idl:
page/DOMWindow.idl:
page/History.idl:
page/Performance.idl:
page/WindowTimers.idl:
plugins/DOMMimeTypeArray.idl:
plugins/DOMPlugin.idl:
plugins/DOMPluginArray.idl:
storage/StorageEvent.idl:
svg/SVGAnimationElement.idl:
svg/SVGDocument.idl:
svg/SVGElement.idl:
svg/SVGFEDropShadowElement.idl:
svg/SVGFEGaussianBlurElement.idl:
svg/SVGFEMorphologyElement.idl:
svg/SVGFilterElement.idl:
svg/SVGGraphicsElement.idl:
svg/SVGMarkerElement.idl:
svg/SVGPathElement.idl:
svg/SVGSVGElement.idl:
svg/SVGTests.idl:
svg/SVGTextContentElement.idl:
xml/DOMParser.idl:
xml/XMLSerializer.cpp:

(WebCore::XMLSerializer::serializeToString):

xml/XMLSerializer.h:
xml/XMLSerializer.idl:
xml/XPathEvaluator.idl:
xml/XPathExpression.idl:
xml/XPathNSResolver.idl:
xml/XPathResult.idl:
xml/XSLTProcessor.idl:

Tools:

WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:

LayoutTests:

Rebaseline some tests now that a different exception type is thrown
for some of our APIs when passing null.

editing/selection/extend-expected.txt:
fast/dom/Element/attr-param-typechecking-expected.txt:
fast/dom/NamedNodeMap-setNamedItem-crash-expected.txt:
fast/dynamic/insertAdjacentElement-expected.txt:

10:07 AM Changeset in webkit [199968] by Yusuke Suzuki

3 edits in trunk/Source/JavaScriptCore

[JSC] Optimize JSON.parse string fast path
https://bugs.webkit.org/show_bug.cgi?id=156953

Reviewed by Mark Lam.

This patch further optimizes the string parsing fast path.
Previously, we generated the WTF::String to hold the ownership of the token's string.
And always copied the token in LiteralParser side.
Instead, we hold the ownership of the token String by the StringBuilder in LiteralParser::Lexer,
and remove the processing in the string parsing fast path.
This patch gives us stable 1 - 2.5% improvement in Kraken json-parse-financial.

Baseline Modified

json-parse-financial 41.383+-0.248 ^{40.894+-0.189} definitely 1.0120x faster

runtime/LiteralParser.cpp:

(JSC::LiteralParser<CharType>::tryJSONPParse):
(JSC::LiteralParser<CharType>::Lexer::lex):
(JSC::LiteralParser<CharType>::Lexer::lexStringSlow):
(JSC::LiteralParser<CharType>::parse):
(JSC::LiteralParser<CharType>::Lexer::lexString): Deleted.

runtime/LiteralParser.h:

(JSC::LiteralParser::tryLiteralParse):
(JSC::LiteralParser::Lexer::currentToken):
(JSC::LiteralParser::Lexer::LiteralParserTokenPtr::LiteralParserTokenPtr):
(JSC::LiteralParser::Lexer::LiteralParserTokenPtr::operator->):

10:05 AM Changeset in webkit [199967] by fpizlo@apple.com

27 edits
5 adds in trunk

[INTL] Implement String.prototype.localeCompare in ECMA-402
https://bugs.webkit.org/show_bug.cgi?id=147607

Patch by Filip Pizlo <fpizlo@apple.com> and Andy VanWagoner <thetalecrafter@gmail.com> on 2016-04-24
Reviewed by Darin Adler.
Source/JavaScriptCore:

Part of this change is just rolling 194394 back in.

The other part is making that not a regression on CDjs. Other than the fact that it uses
bound functions, the problem with this new localeCompare implementation is that it uses
the arguments object. It uses it in a way that *seems* like ArgumentsEliminationPhase
ought to handle, but to my surprise it didn't:

If we have a ForceExit GetByVal on the arguments object, we would previously assume that it escaped. That's false since we just exit at ForceExit. On the other hand we probably should be pruning unreachable paths before we get here, but that's a separate issue. I don't want to play with phase order right now.

If we have a OutOfBounds GetByVal on the arguments object, then the best that would previously happen is that we'd compile it into an in-bounds arguments access. That's quite bad, as Andy's localeCompare illustrates: it uses out-of-bounds access on the arguments object to detect if an argument was passed. This change introduces an OutOfBounds version of GetMyArgumentByVal for this purpose.

This change required registering sane chain watchpoints. In the process, I noticed that the
old way of doing it had a race condition: we might register watchpoints for the structure
that had become insane. This change introduces a double-checking idiom that I believe works
because once the structure becomes insane it can't go back to sane and watchpoints
registration already involves executing the hardest possible fences.

builtins/StringPrototype.js:

(repeat):
(localeCompare):
(search):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGArgumentsEliminationPhase.cpp:
dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::refine):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGConstantFoldingPhase.cpp:

(JSC::DFG::ConstantFoldingPhase::foldConstants):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGPreciseLocalClobberize.h:

(JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):

dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValOnString):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGValidate.cpp:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):

ftl/FTLTypedPointer.h:

(JSC::FTL::TypedPointer::TypedPointer):
(JSC::FTL::TypedPointer::operator bool):
(JSC::FTL::TypedPointer::heap):
(JSC::FTL::TypedPointer::operator!): Deleted.

runtime/StringPrototype.cpp:

(JSC::StringPrototype::finishCreation):

LayoutTests:

js/dom/script-tests/string-prototype-properties.js:
js/dom/string-prototype-properties-expected.txt:
js/regress/locale-compare.html: Added.
js/regress/locale-compare-expected.txt: Added.
js/regress/scripts-tests/locale-compare.js: Added.
js/script-tests/string-localeCompare.js:
js/string-localeCompare-expected.txt:
js/string-localeCompare.html:

9:20 AM Changeset in webkit [199966] by bshafiei@apple.com

5 edits in tags/Safari-602.1.29.1/Source

Versioning.

9:18 AM Changeset in webkit [199965] by bshafiei@apple.com

1 copy in tags/Safari-602.1.29.1

New tag.

6:54 AM Changeset in webkit [199964] by Antti Koivisto

423 edits in trunk/Source/WebCore

RenderStyle should not be reference counted
https://bugs.webkit.org/show_bug.cgi?id=156846

Reviewed by Andreas Kling.

RenderStyle reference counts its substructures. We no longer share RenderStyle objects between normal renderers
so there is no reason to refcount the RenderStyles themselves too. Making it a non-refcounted type clarifies
ownership relations, reduces branchiness and saves some memory.

This patches switches mostly mechanically from Ref/RefPtr<RenderStyle> to std::unique_ptr<RenderStyle>. In
the future RenderStyle can be given regular value semantics.

Modules/plugins/PluginReplacement.h:

(WebCore::PluginReplacement::scriptObject):
(WebCore::PluginReplacement::willCreateRenderer):

Modules/plugins/QuickTimePluginReplacement.h:
Modules/plugins/QuickTimePluginReplacement.mm:

(WebCore::QuickTimePluginReplacement::~QuickTimePluginReplacement):
(WebCore::QuickTimePluginReplacement::createElementRenderer):

Modules/plugins/YouTubePluginReplacement.cpp:

(WebCore::YouTubePluginReplacement::YouTubePluginReplacement):
(WebCore::YouTubePluginReplacement::createElementRenderer):

Modules/plugins/YouTubePluginReplacement.h:
css/CSSComputedStyleDeclaration.cpp:

(WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
(WebCore::ComputedStyleExtractor::useFixedFontDefaultSize):
(WebCore::updateStyleIfNeededForNode):
(WebCore::computeRenderStyleForProperty):
(WebCore::ComputedStyleExtractor::customPropertyValue):
(WebCore::ComputedStyleExtractor::propertyValue):

css/MediaQueryEvaluator.cpp:

(WebCore::MediaQueryEvaluator::MediaQueryEvaluator):
(WebCore::MediaQueryEvaluator::eval):

css/MediaQueryEvaluator.h:

Clarify in code that MediaQueryEvaluator does not own the style.

css/MediaQueryMatcher.cpp:

(WebCore::MediaQueryMatcher::mediaType):
(WebCore::MediaQueryMatcher::documentElementUserAgentStyle):
(WebCore::MediaQueryMatcher::evaluate):
(WebCore::MediaQueryMatcher::matchMedia):
(WebCore::MediaQueryMatcher::styleResolverChanged):
(WebCore::MediaQueryMatcher::prepareEvaluator): Deleted.

css/MediaQueryMatcher.h:
css/StyleMedia.cpp:

(WebCore::StyleMedia::matchMedium):

css/StyleResolver.cpp:

(WebCore::StyleResolver::State::clear):
(WebCore::StyleResolver::State::updateConversionData):
(WebCore::StyleResolver::State::setStyle):
(WebCore::StyleResolver::State::setParentStyle):

State owns the style explicitly set by setParentStyle but not the one given via constructor.

(WebCore::isAtShadowBoundary):
(WebCore::StyleResolver::styleForElement):
(WebCore::StyleResolver::styleForKeyframe):
(WebCore::StyleResolver::keyframeStylesForAnimation):
(WebCore::StyleResolver::pseudoStyleForElement):
(WebCore::StyleResolver::styleForPage):
(WebCore::StyleResolver::defaultStyleForElement):
(WebCore::StyleResolver::applyMatchedProperties):
(WebCore::StyleResolver::applyPropertyToStyle):

css/StyleResolver.h:

(WebCore::ElementStyle::ElementStyle):
(WebCore::StyleResolver::style):
(WebCore::StyleResolver::parentStyle):
(WebCore::StyleResolver::setOverrideDocumentElementStyle):
(WebCore::StyleResolver::State::document):
(WebCore::StyleResolver::State::element):
(WebCore::StyleResolver::State::style):
(WebCore::StyleResolver::State::takeStyle):
(WebCore::StyleResolver::State::parentStyle):
(WebCore::StyleResolver::State::rootElementStyle):
(WebCore::StyleResolver::State::regionForStyling):
(WebCore::StyleResolver::State::setParentStyle): Deleted.

dom/Document.cpp:

(WebCore::Document::recalcStyle):
(WebCore::Document::updateLayoutIgnorePendingStylesheets):
(WebCore::Document::styleForElementIgnoringPendingStylesheets):
(WebCore::Document::isPageBoxVisible):
(WebCore::Document::pageSizeAndMarginsInPixels):
(WebCore::Document::addAutoSizingNode):
(WebCore::Document::validateAutoSizingNodes):
(WebCore::Document::resetAutoSizingNodes):
(WebCore::Document::setFullScreenRenderer):

dom/Document.h:
dom/Element.cpp:

(WebCore::Element::rendererIsNeeded):
(WebCore::Element::createElementRenderer):
(WebCore::Element::resolveComputedStyle):

dom/Element.h:

(WebCore::Element::copyNonAttributePropertiesFromElement):

dom/ElementRareData.h:

...

page/animation/AnimationBase.h:
page/animation/AnimationController.cpp:

(WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
(WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
(WebCore::AnimationControllerPrivate::computeExtentOfAnimation):
(WebCore::AnimationController::cancelAnimations):
(WebCore::AnimationController::updateAnimations):

std::unique_ptr<RenderStyle& animatedStyle argument is now expected no be initially null and
is only set if a new style is created.

(WebCore::AnimationController::getAnimatedStyleForRenderer):

page/animation/AnimationController.h:
page/animation/AnimationControllerPrivate.h:
page/animation/CompositeAnimation.cpp:

(WebCore::CompositeAnimation::updateTransitions):
(WebCore::CompositeAnimation::updateKeyframeAnimations):
(WebCore::CompositeAnimation::animate):
(WebCore::CompositeAnimation::getAnimatedStyle):

page/animation/CompositeAnimation.h:
page/animation/ImplicitAnimation.cpp:

(WebCore::ImplicitAnimation::ImplicitAnimation):
(WebCore::ImplicitAnimation::shouldSendEventForListener):
(WebCore::ImplicitAnimation::animate):
(WebCore::ImplicitAnimation::getAnimatedStyle):
(WebCore::ImplicitAnimation::onAnimationEnd):
(WebCore::ImplicitAnimation::reset):

page/animation/ImplicitAnimation.h:
page/animation/KeyframeAnimation.cpp:

(WebCore::KeyframeAnimation::KeyframeAnimation):
(WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty):
(WebCore::KeyframeAnimation::animate):
(WebCore::KeyframeAnimation::getAnimatedStyle):

page/animation/KeyframeAnimation.h:
rendering/RenderAttachment.cpp:

(WebCore::RenderAttachment::RenderAttachment):

rendering/RenderAttachment.h:
rendering/RenderBlock.cpp:

(WebCore::RenderBlock::RenderBlock):
(WebCore::RenderBlock::styleDidChange):
(WebCore::RenderBlock::clone):
(WebCore::RenderBlock::updateFirstLetterStyle):
(WebCore::RenderBlock::createFirstLetterRenderer):

rendering/RenderBlock.h:
rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::MarginInfo::MarginInfo):
(WebCore::RenderBlockFlow::RenderBlockFlow):

rendering/RenderBlockFlow.h:
rendering/RenderBox.cpp:

(WebCore::skipBodyBackground):
(WebCore::RenderBox::RenderBox):

rendering/RenderBox.h:
rendering/RenderBoxModelObject.cpp:

(WebCore::RenderBoxModelObject::suspendAnimations):
(WebCore::RenderBoxModelObject::RenderBoxModelObject):

rendering/RenderBoxModelObject.h:
rendering/RenderButton.cpp:

(WebCore::RenderButton::RenderButton):
(WebCore::RenderButton::setupInnerStyle):

rendering/RenderButton.h:
rendering/RenderCombineText.h:
rendering/RenderDeprecatedFlexibleBox.cpp:

(WebCore::RenderDeprecatedFlexibleBox::RenderDeprecatedFlexibleBox):

rendering/RenderDeprecatedFlexibleBox.h:
rendering/RenderDetailsMarker.cpp:

(WebCore::RenderDetailsMarker::RenderDetailsMarker):

rendering/RenderDetailsMarker.h:
rendering/RenderElement.cpp:

(WebCore::controlStatesRendererMap):
(WebCore::RenderElement::RenderElement):
(WebCore::RenderElement::~RenderElement):
(WebCore::RenderElement::createFor):
(WebCore::firstLineStyleForCachedUncachedType):
(WebCore::RenderElement::uncachedFirstLineStyle):
(WebCore::RenderElement::cachedFirstLineStyle):
(WebCore::RenderElement::initializeStyle):
(WebCore::RenderElement::setStyle):
(WebCore::RenderElement::propagateStyleToAnonymousChildren):
(WebCore::RenderElement::styleDidChange):
(WebCore::RenderElement::getCachedPseudoStyle):

Return plain pointer as the cache owns the style.

(WebCore::RenderElement::getUncachedPseudoStyle):

return std::unique_ptr<RenderStyle>

(WebCore::RenderElement::selectionColor):
(WebCore::RenderElement::selectionPseudoStyle):
(WebCore::RenderElement::selectionBackgroundColor):

rendering/RenderElement.h:

(WebCore::RenderElement::hasInitializedStyle):
(WebCore::RenderElement::style):
(WebCore::RenderElement::element):
(WebCore::RenderElement::setStyleInternal):

rendering/RenderEmbeddedObject.cpp:

...

(WebCore::RenderImage::imageResource):

rendering/RenderInline.cpp:

(WebCore::RenderInline::RenderInline):
(WebCore::updateStyleOfAnonymousBlockContinuations):
(WebCore::RenderInline::styleDidChange):

Continuations now get their own RenderStyles.

(WebCore::RenderInline::addChildIgnoringContinuation):
(WebCore::RenderInline::clone):

rendering/RenderInline.h:
rendering/RenderLayer.cpp:

(WebCore::RenderLayer::currentTransform):
(WebCore::RenderLayer::calculateClipRects):

rendering/RenderLayer.h:

...

rendering/style/KeyframeList.cpp:

(WebCore::KeyframeList::operator==):
(WebCore::KeyframeList::insert):

KeyframeValue is now movable but not copyable type. Adjust accordingly.

rendering/style/KeyframeList.h:

(WebCore::KeyframeValue::KeyframeValue):
(WebCore::KeyframeValue::setKey):
(WebCore::KeyframeValue::style):
(WebCore::KeyframeValue::setStyle):
(WebCore::KeyframeList::animationName):
(WebCore::KeyframeList::addProperty):
(WebCore::KeyframeList::containsProperty):

rendering/style/RenderStyle.cpp:

(WebCore::defaultStyle):
(WebCore::RenderStyle::create):
(WebCore::RenderStyle::createDefaultStyle):
(WebCore::RenderStyle::createAnonymousStyleWithDisplay):
(WebCore::RenderStyle::clone):
(WebCore::RenderStyle::createStyleInheritingFromPseudoStyle):

Return std::unique_ptr<RenderStyle> instead of Ref<RenderStyle>.

(WebCore::RenderStyle::RenderStyle):
(WebCore::RenderStyle::~RenderStyle):
(WebCore::resolveAlignmentData):
(WebCore::RenderStyle::operator==):
(WebCore::RenderStyle::hasUniquePseudoStyle):
(WebCore::RenderStyle::getCachedPseudoStyle):
(WebCore::RenderStyle::addCachedPseudoStyle):
(WebCore::RenderStyle::isStyleAvailable): Deleted.

rendering/style/RenderStyle.h:

(WebCore::RenderStyle::setStyleType):
(WebCore::RenderStyle::cachedPseudoStyles):
(WebCore::RenderStyle::initialIsolation):
(WebCore::RenderStyle::isPlaceholderStyle):
(WebCore::RenderStyle::setIsPlaceholderStyle):

Add placeholder style bit to rareNonInheritedData. We no longer rely on RenderStyle identity for this test.

(WebCore::RenderStyle::noninheritedFlagsMemoryOffset):

rendering/style/SVGRenderStyle.cpp:

(WebCore::defaultSVGStyle):
(WebCore::SVGRenderStyle::createDefaultStyle):

rendering/style/StyleRareNonInheritedData.cpp:

(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator==):
(WebCore::StyleRareNonInheritedData::contentDataEquivalent):

rendering/style/StyleRareNonInheritedData.h:

...

(WebCore::findRenderingRoot):
(WebCore::findRenderingRoots):
(WebCore::RenderTreeUpdater::commit):

Style::Update is no longer const as we move the styles from it to the render tree.

(WebCore::pseudoStyleCacheIsInvalid):
(WebCore::RenderTreeUpdater::updateElementRenderer):
(WebCore::moveToFlowThreadIfNeeded):
(WebCore::RenderTreeUpdater::createRenderer):
(WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):

style/RenderTreeUpdater.h:
style/StyleResolveForDocument.cpp:

(WebCore::Style::resolveForDocument):

style/StyleResolveForDocument.h:
style/StyleSharingResolver.cpp:

(WebCore::Style::elementHasDirectionAuto):
(WebCore::Style::SharingResolver::resolve):

style/StyleSharingResolver.h:
style/StyleTreeResolver.cpp:

(WebCore::Style::ensurePlaceholderStyle):

Set the placeholder.

(WebCore::Style::TreeResolver::Parent::Parent):
(WebCore::Style::TreeResolver::pushScope):
(WebCore::Style::TreeResolver::pushEnclosingScope):
(WebCore::Style::TreeResolver::popScope):

Set and clear StyleResolver overrideDocumentElementStyle as needed. It is owned by the TreeResolver.

(WebCore::Style::TreeResolver::styleForElement):

Clone the placeholder style.

(WebCore::Style::TreeResolver::resolveElement):
(WebCore::Style::TreeResolver::pushParent):
(WebCore::Style::TreeResolver::resolveComposedTree):
(WebCore::Style::TreeResolver::resolve):

Adopt to the std::unique_ptr and ElementStyle move semantics.

style/StyleTreeResolver.h:

(WebCore::Style::TreeResolver::scope):

style/StyleUpdate.cpp:

(WebCore::Style::Update::elementUpdate):
(WebCore::Style::Update::textUpdate):
(WebCore::Style::Update::elementStyle):
(WebCore::Style::Update::addElement):
(WebCore::Style::Update::addText):

style/StyleUpdate.h:

(WebCore::Style::Update::roots):
(WebCore::Style::Update::document):

svg/SVGAElement.cpp:

(WebCore::SVGAElement::svgAttributeChanged):
(WebCore::SVGAElement::createElementRenderer):

...

5:45 AM Changeset in webkit [199963] by youenn.fablet@crf.canon.fr

2 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from MediaControlsHost
https://bugs.webkit.org/show_bug.cgi?id=156903

Reviewed by Chris Dumez.

No change of behavior.

Modules/mediacontrols/MediaControlsHost.idl: Marking some parameters as nullable.

5:45 AM Changeset in webkit [199962] by youenn.fablet@crf.canon.fr

2 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from WebGLRenderingContext
https://bugs.webkit.org/show_bug.cgi?id=156909

Reviewed by Chris Dumez.

No change of behavior.

Marking a lot of method parameters as nullable.

html/canvas/WebGLRenderingContextBase.idl:

5:37 AM Changeset in webkit [199961] by youenn.fablet@crf.canon.fr

4 edits in trunk/Source/WebCore

Drop [UsePointersEvenForNonNullableObjectArguments] from WebSocket
https://bugs.webkit.org/show_bug.cgi?id=156897

Reviewed by Chris Dumez.

No change of behavior.

Updating WebSocket::send methods to take references, except for ArrayBufferView, which is not yet supported by the binding generator.

Modules/websockets/WebSocket.cpp:

(WebCore::WebSocket::send):

Modules/websockets/WebSocket.h:
Modules/websockets/WebSocket.idl:

Apr 23, 2016:

7:49 PM Changeset in webkit [199960] by aestes@apple.com

20 edits in trunk/Source

Fix issues found by the clang static analyzer
https://bugs.webkit.org/show_bug.cgi?id=156956

Reviewed by Alexey Proskuryakov.

Source/WebCore:

editing/cocoa/DataDetection.mm:

(WebCore::DataDetection::detectContentInRange): Stored tz in a RetainPtr.

platform/cf/KeyedDecoderCF.cpp:

(WebCore::KeyedDecoderCF::KeyedDecoderCF): If dynamic_cf_cast returned nullptr, the result of
CFPropertyListCreateWithData would leak. Stored the CFPropertyListRef in a RetainPtr, then leaked/adopted it
into m_rootDictionary (to avoid retain count churn) if it is a CFDictionary.

platform/ios/WebAVPlayerController.mm:

(-[WebAVPlayerController dealloc]): Released _externalPlaybackAirPlayDeviceLocalizedName.
(-[WebAVMediaSelectionOption dealloc]): Added to release _localizedDisplayName.

platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(-[WebAVPlayerLayer dealloc]): Released _pixelBufferAttributes.

platform/network/cocoa/WebCoreNSURLSession.h: Removed the readwrite attributes from properties, since

properties are readwrite by default.

platform/network/cocoa/WebCoreNSURLSession.mm: Removed @dynamic, which isn't necessary just for defining a custom getter.

(-[WebCoreNSURLSessionDataTask dealloc]): Added to release copied ivars.

Source/WebKit/mac:

WebView/WebDeviceOrientationProviderMock.mm:

(-[WebDeviceOrientationProviderMock dealloc]): [super dealloc] should be called last.

Source/WebKit2:

UIProcess/API/Cocoa/WKPreviewActionItem.mm:

(-[WKPreviewAction dealloc]): Added to release _identifier.

UIProcess/_WKWebViewPrintFormatter.mm:

(-[_WKWebViewPrintFormatter dealloc]): Released _frameToPrint.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView inputView]): -createPeripheralWithView: returned a retained object, but the method name did not
match Cocoa conventions. Called -initWithView: instead.
(-[WKContentView _showAttachmentSheet]): Stored the _WKActivatedElementInfo in a RetainPtr.
(-[WKContentView _dataForPreviewItemController:atPosition:type:]): Ditto.
(+[WKAutocorrectionContext autocorrectionContextWithData:markedText:selectedText:afterText:selectedRangeInMarkedText:]):
The properties contextBeforeSelection, selectedText, markedText, and contextAfterSelection have the 'copy'
annotation in UIWKAutocorrectionContext, so the additional copy made here would be leaked. Removed the extra copy.
(-[WKAutocorrectionContext dealloc]): Deleted.

UIProcess/ios/forms/WKFormInputControl.h: Removed -createPeripheralWithView: and declared -initWithView:.
UIProcess/ios/forms/WKFormInputControl.mm:

(-[WKFormInputControl initWithView:]): Changed to return instancetype.
(+[WKFormInputControl createPeripheralWithView:]): Deleted.

UIProcess/ios/forms/WKFormSelectControl.h: Removed -createPeripheralWithView: and declared -initWithView:.
UIProcess/ios/forms/WKFormSelectControl.mm:

(+[WKFormSelectControl createPeripheralWithView:]): Deleted.

UIProcess/mac/LegacySessionStateCoding.cpp:

(WebKit::decodeLegacySessionState): If dynamic_cf_cast returned nullptr, the result of
CFPropertyListCreateWithData would leak. Stored the CFPropertyListRef in a RetainPtr before calling dynamic_cf_cast.

UIProcess/mac/ServicesController.mm:

(WebKit::ServicesController::refreshExistingServices): Used a RetainPtr for attachment and cell.

UIProcess/mac/WebContextMenuProxyMac.mm:

(WebKit::WebContextMenuProxyMac::setupServicesMenu): Used a RetainPtr for groupEntry.

7:27 PM Changeset in webkit [199959] by Csaba Osztrogonác

2 edits in trunk/Tools

Really enable INDEXED_DATABASE on Apple Mac cmake build
https://bugs.webkit.org/show_bug.cgi?id=156902

Reviewed by Michael Catanzaro.

Scripts/webkitperl/FeatureList.pm:

7:25 PM Changeset in webkit [199958] by aestes@apple.com

3 edits in trunk/Tools

check-webkit-style: fix false-positive warnings about @synchronized
https://bugs.webkit.org/show_bug.cgi?id=156957

Reviewed by Dan Bernstein.

Scripts/webkitpy/style/checkers/cpp.py:

(check_spacing_for_function_call): Ignore @synchronized lines.
(check_braces): Ditto.

Scripts/webkitpy/style/checkers/cpp_unittest.py:

(CppStyleTest.test_brace_at_begin_of_line): Added a test case.

5:13 PM Changeset in webkit [199957] by bshafiei@apple.com

2 edits in tags/Safari-602.1.29.0.1/Source/WebCore

Merged r199956. rdar://problem/25894586

4:51 PM Changeset in webkit [199956] by mitz@apple.com

2 edits in trunk/Source/WebCore

<rdar://problem/25894586> A project has failed to build because WTF_MAKE_FAST_ALLOCATED was not defined

Rubber-stamped by Chris Dumez.

Reverted the IntSize part of r199735, to let IntSize.h keep being used in another project.

platform/graphics/IntSize.h:

(WebCore::IntSize::IntSize):

2:33 PM Changeset in webkit [199955] by Chris Dumez

22 edits in trunk/Source

Tie the DiagnosticLoggingClient's lifetime to the Page
https://bugs.webkit.org/show_bug.cgi?id=156938
<rdar://problem/25851499>

Reviewed by Antti Koivisto.

Source/WebCore:

Tie the DiagnosticLoggingClient's lifetime to the Page rather than to the
MainFrame. The diagnostic logging client in WebKit2 requires the WebPage
to be alive in order to send IPC to the UIProcess. The WebPage owns the
Page and Page is not refCounted so the lifetime of the
DiagnosticLoggingClient should now be tied to the one of the WebPage as
well.

Previously, the DiagnosticLoggingClient would stay alive as long as the
MainFrame and could apparently in rare cases outlive the WebPage, thus
crashing when trying to send the IPC.

history/PageCache.cpp:

(WebCore::logPageCacheFailureDiagnosticMessage):
(WebCore::canCachePage):

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::loadResource):
(WebCore::logMediaLoadRequest):
(WebCore::HTMLMediaElement::updatePlayState):
(WebCore::HTMLMediaElement::mediaPlayerEngineFailedToLoad):

loader/EmptyClients.h:
loader/FrameLoader.cpp:

(WebCore::logNavigation):
(WebCore::FrameLoader::checkLoadCompleteForThisFrame):
(WebCore::FrameLoader::continueLoadAfterNavigationPolicy):

loader/ResourceLoader.cpp:

(WebCore::logResourceResponseSource):

loader/SubframeLoader.cpp:

(WebCore::logPluginRequest):

loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::willSendRequestInternal):
(WebCore::SubresourceLoader::didReceiveResponse):
(WebCore::logResourceLoaded):

loader/cache/CachedResourceLoader.cpp:

(WebCore::logMemoryCacheResourceRequest):
(WebCore::logResourceRevalidationDecision):

page/DiagnosticLoggingClient.h:
page/MainFrame.cpp:

(WebCore::MainFrame::MainFrame): Deleted.
(WebCore::MainFrame::~MainFrame): Deleted.
(WebCore::MainFrame::diagnosticLoggingClient): Deleted.

page/MainFrame.h:
page/Page.cpp:

(WebCore::Page::Page):
(WebCore::Page::~Page):
(WebCore::Page::diagnosticLoggingClient):

page/Page.h:

Source/WebKit2:

WebProcess/WebCoreSupport/WebDiagnosticLoggingClient.cpp:

(WebKit::WebDiagnosticLoggingClient::pageDestroyed):
(WebKit::WebDiagnosticLoggingClient::mainFrameDestroyed): Deleted.

WebProcess/WebCoreSupport/WebDiagnosticLoggingClient.h:
WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::willStartUserTriggeredZooming):

10:45 AM Changeset in webkit [199954] by bshafiei@apple.com

11 edits in tags/Safari-602.1.29.0.1/Source/WebKit2

Merged r199951. rdar://problem/25893246

10:44 AM Changeset in webkit [199953] by bshafiei@apple.com

5 edits in tags/Safari-602.1.29.0.1/Source

Versioning.

10:41 AM Changeset in webkit [199952] by bshafiei@apple.com

1 copy in tags/Safari-602.1.29.0.1

New tag.

10:37 AM Changeset in webkit [199951] by mitz@apple.com

11 edits in trunk/Source/WebKit2

<rdar://problem/25893246> WebKit2 has failed to build: error: use of undeclared identifier 'm_playbackSessionManager'

Fixed the non-AVKit build.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _isShowingVideoPictureInPicture]):
(-[WKWebView _mayAutomaticallyShowVideoPictureInPicture]):

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::fullScreenManager):
(WebKit::WebPageProxy::playbackSessionManager):

UIProcess/WebPageProxy.h:
UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::applicationDidBecomeActive):

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::createScrollingCoordinator):
(WebKit::WebChromeClient::supportsVideoFullscreen):

WebProcess/WebCoreSupport/WebChromeClient.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::inspectorUI):
(WebKit::WebPage::playbackSessionManager):

WebProcess/WebPage/WebPage.h:
WebProcess/cocoa/WebVideoFullscreenManager.h:
WebProcess/cocoa/WebVideoFullscreenManager.mm:

10:05 AM Changeset in webkit [199950] by barraclough@apple.com

4 edits in trunk/Source/bmalloc

bmalloc: vm allocations should plant guard pages
https://bugs.webkit.org/show_bug.cgi?id=156937

Rolling out - looks like this is memory regression.

bmalloc/Object.h:

(bmalloc::Object::operator+):
(bmalloc::Object::operator<=):
(bmalloc::Object::operator-): Deleted.

bmalloc/VMAllocate.h:

(bmalloc::vmDeallocate):
(bmalloc::vmRevokePermissions): Deleted.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::allocateSmallChunk):

9:38 AM Changeset in webkit [199949] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, unbreak cloop.

runtime/VM.cpp:

(JSC::VM::getHostFunction):

8:18 AM Changeset in webkit [199948] by Michael Catanzaro

2 edits in trunk/Source/WebCore/platform/gtk/po

Updated Hungarian translation
https://bugs.webkit.org/show_bug.cgi?id=156952

Patch by Gabor Kelemen <kelemeng@ubuntu.com> on 2016-04-23
Rubber-stamped by Michael Catanzaro.

hu.po:

2:12 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed