Context Navigation

← Previous Period
Next Period →

Timeline

Jul 12, 2016:

11:44 PM Changeset in webkit [203153] by commit-queue@webkit.org

5 edits in trunk

[Fetch API] isRedirected should be conveyed in workers
https://bugs.webkit.org/show_bug.cgi?id=159676

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-12
Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

web-platform-tests/fetch/api/redirect/redirect-method-worker-expected.txt:

Source/WebCore:

Passing isRedirected value between threads.
Rebasing corresponding worker test, even though it is currently skipped (due to crashing flakiness).

platform/network/ResourceResponseBase.cpp:

(WebCore::ResourceResponseBase::crossThreadData):
(WebCore::ResourceResponseBase::fromCrossThreadData):

platform/network/ResourceResponseBase.h:

10:45 PM Changeset in webkit [203152] by Lucas Forschler

1 edit in trunk/Websites/test-results/init-database.sql

Fix SQL: quote hyphenated string.

9:50 PM Changeset in webkit [203151] by eric.carlson@apple.com

6 edits
2 adds in trunk

REGRESSION (r202509): media controls controls enabled AirPlay placeholder is shown
https://bugs.webkit.org/show_bug.cgi?id=159685
<rdar://problem/27198899>

Reviewed by Dean Jackson.

Source/WebCore:

Test: media/controls/airplay-controls.html

Modules/mediacontrols/mediaControlsApple.js:

(Controller.prototype.shouldShowControls): Split some of the logic out of shouldHaveControls.
(Controller.prototype.shouldHaveControls): Having controls != showing controls.
(Controller.prototype.updateControls): Call shouldShowControls, not shouldHaveControls.
(Controller.prototype.updateWirelessPlaybackStatus): Add 'appletv' to the class when active.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::getCurrentMediaControlsStatus): Call ensureMediaControlsShadowRoot
in case the controls haven't been created yet.

LayoutTests:

media/controls/airplay-controls-expected.txt: Added.
media/controls/airplay-controls.html: Added.

media/controls/controls-test-helpers.js:

(ControlsTest.prototype.get currentState): Put a try block around the call to get the current
status in case it fails.

platform/mac/TestExpectations: Skip the new test on Yosemite where AirPlay doesn't work.

9:47 PM Changeset in webkit [203150] by fred.wang@free.fr

8 edits
1 copy
1 add in trunk/Source/WebCore

Move parsing of mpadded attributes to a MathMLPaddedElement class
https://bugs.webkit.org/show_bug.cgi?id=159620

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-12
Reviewed by Brent Fulgham.

No new tests, behavior is unchanged.

CMakeLists.txt: Add MathMLPaddedElement files.
WebCore.xcodeproj/project.pbxproj: Ditto.
mathml/MathMLAllInOne.cpp: Ditto.
mathml/MathMLInlineContainerElement.cpp: Remove handling of mpadded.
mathml/MathMLPaddedElement.cpp: Added.

(WebCore::MathMLPaddedElement::MathMLPaddedElement):
(WebCore::MathMLPaddedElement::create):
(WebCore::MathMLPaddedElement::width): Expose width attribute as a MathMLLength until mpadded
pseudo-units are supported.
(WebCore::MathMLPaddedElement::height): Ditto.
(WebCore::MathMLPaddedElement::depth): Ditto
(WebCore::MathMLPaddedElement::lspace): Ditto.
(WebCore::MathMLPaddedElement::voffset): Ditto.
(WebCore::MathMLPaddedElement::parseAttribute): Make length attribute dirty.
(WebCore::MathMLPaddedElement::createElementRenderer): Moved code from MathMLInlineContainerElement.

mathml/MathMLPaddedElement.h: Added.
mathml/mathtags.in: Map mapdded to MathMLPaddedElement.
rendering/mathml/RenderMathMLPadded.cpp:

(WebCore::RenderMathMLPadded::resolveWidth): Helper function to resolve width.
(WebCore::RenderMathMLPadded::resolveAttributes): Helper function to resolve all attributes.
(WebCore::RenderMathMLPadded::computePreferredLogicalWidths): Use resolveWidth.
(WebCore::RenderMathMLPadded::layoutBlock): Use resolveAttributes.

rendering/mathml/RenderMathMLPadded.h: Add new helper functions to access attributes from

the MathMLPaddedElement class.

9:05 PM Changeset in webkit [203149] by akling@apple.com

3 edits in trunk/Source/WebCore

[Cocoa] Simulated memory warning doesn't trigger libcache purge.
<https://webkit.org/b/159688>

Reviewed by Chris Dumez.

Since simulated memory warnings will have the "is under memory pressure" flag set,
we were skipping the libcache purge call.

Add a separate flag that tracks whether we're under simulated pressure, and always
prod libcache in that case.

platform/MemoryPressureHandler.h:
platform/cocoa/MemoryPressureHandlerCocoa.mm:

(WebCore::MemoryPressureHandler::platformReleaseMemory):
(WebCore::MemoryPressureHandler::install):

8:30 PM Changeset in webkit [203148] by Lucas Forschler

2 edits
2 adds in trunk/Websites/test-results

<rdar://problem/22524456> Mitigate performance degradation of the flakiness dashboard

Rubber-stamped by Dean Johnson.

init-database.sql:

Rewrite the init-database.sql file to allow for table partitioning, based on insert date.
Some important things to note:

The main results table is unchanged, but will no longer contain any rows.
Partitioned tables will be generated on demand, and will inherit from 'results'
It is possible to query the 'results' table directly, and that will get data from all child tables.
This should keep us from requiring any client side code changes.

public_partition_maintenance: Added.

Maintenance script which will be called on a nightly schedule to purge expired data.
This data will be exported and compressed to a sub-folder, then dropped from the database.
I'm not sure how big it will be, so we'll likely need to keep an eye on it.

test-database.sql: Added.

Simple helper function to test that results partitions are created/deleted correctly.

6:25 PM Changeset in webkit [203147] by benjamin@webkit.org

9 edits
3 adds
6 deletes in trunk

[JSC] Array.prototype.join() fails some conformance tests
https://bugs.webkit.org/show_bug.cgi?id=159657

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-07-12
Reviewed by Saam Barati.

Source/JavaScriptCore:

There were a couple of failures:
-separator.toString() was called *before* we get the length

and process ToLength() on it.

-We were using toUInt32() on length instead of ToLength(),

failing on big integers and various negative numbers.

Additionally, I replaced the "fast" ArrayStorage path
by a fully generic implementation that does not depends on StringJoiner.

The reason is StringJoiner was doing poorly on sparse objects
in certain cases.
If you have a sparse object with a length > INT_MAX but very few
indices defined, and you join on the empty string, it should be possible
to join the array (albeit very slowly). With StringJoiner, we fail
because we try to allocate > INT_MAX empty strings in a contiguous vector.

runtime/ArrayPrototype.cpp:

(JSC::slowJoin):
(JSC::canUseFastJoin):
(JSC::fastJoin):
(JSC::arrayProtoFuncJoin):
(JSC::join): Deleted.

runtime/JSArray.h:

(JSC::toLength):

Source/WTF:

wtf/text/AtomicString.cpp:

(WTF::AtomicString::number):

wtf/text/AtomicString.h:

LayoutTests:

I removed 3 sputnik tests that are incorrect in the latest spec.
In ES5, Array.prototype.join() was using ToUint32 on the argument:

https://es5.github.io/#x15.4.4.5

In ES6, the function uses ToLength:

https://tc39.github.io/ecma262/#sec-array.prototype.join

The test use Infinity and very large integer as the length.
They are guaranteed to time out or run out of memory.
Even if we waited the hours it takes to run this, the results would be different
from what the tests expect.

js/array-join-expected.txt: Added.
js/array-join.html: Added.
js/script-tests/array-join.js: Added.

6:24 PM Changeset in webkit [203146] by Gyuyoung Kim

18 edits in trunk/Source/WebCore

Purge PassRefPtr in Modules/webdatabase
https://bugs.webkit.org/show_bug.cgi?id=159255

Reviewed by Benjamin Poulain.

As a step to remove PassRefPtr use, this patch cleans it up in Modules/webdatabase.

Additionally unnecessary spaces and tabs are removed too.

Modules/webdatabase/ChangeVersionWrapper.cpp:
Modules/webdatabase/DOMWindowWebDatabase.h:
Modules/webdatabase/Database.cpp:

(WebCore::Database::Database):
(WebCore::Database::~Database):
(WebCore::Database::scheduleTransaction):
(WebCore::Database::runTransaction):

Modules/webdatabase/Database.h:
Modules/webdatabase/DatabaseAuthorizer.cpp:

(WebCore::DatabaseAuthorizer::allowRead):

Modules/webdatabase/DatabaseManager.cpp:

(WebCore::DatabaseManager::openDatabase):
(WebCore::DatabaseManager::fullPathForDatabase):
(WebCore::DatabaseManager::detailsForNameAndOrigin):

Modules/webdatabase/DatabaseManager.h:
Modules/webdatabase/DatabaseTask.cpp:

(WebCore::DatabaseTransactionTask::DatabaseTransactionTask):

Modules/webdatabase/DatabaseTask.h:
Modules/webdatabase/SQLCallbackWrapper.h:

(WebCore::SQLCallbackWrapper::SQLCallbackWrapper):

Modules/webdatabase/SQLResultSetRowList.h:
Modules/webdatabase/SQLStatement.cpp:

(WebCore::SQLStatement::SQLStatement):
(WebCore::SQLStatement::sqlError):
(WebCore::SQLStatement::sqlResultSet):

Modules/webdatabase/SQLStatement.h:
Modules/webdatabase/SQLTransaction.h:
Modules/webdatabase/SQLTransactionBackend.cpp:

(WebCore::SQLTransactionBackend::create):
(WebCore::SQLTransactionBackend::SQLTransactionBackend):
(WebCore::SQLTransactionBackend::transactionError):

Modules/webdatabase/SQLTransactionBackend.h:

5:55 PM Changeset in webkit [203145] by Simon Fraser

2 edits in trunk/Source/WebKit2

[iOS WK2] After zooming and when under memory pressure, page tiles sometimes don't redraw while panning
https://bugs.webkit.org/show_bug.cgi?id=159697
rdar://problem/26314075

Reviewed by Benjamin Poulain.

When under memory pressure, and after pinching back to minimum scale, WebPage::updateVisibleContentRects()
would sometimes always bail under the "boundedScale != currentScale..." condition.

This happened because the visibleContentRectUpdateInfo.scale() is a double, but m_page->pageScaleFactor()
is a float, and the constraining between min and max scale (which are doubles) caused boundedScale
to be always different from currentScale.

Fix by using floats throughout.

No test because there's no way to simulate memory pressure for testing.

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::updateVisibleContentRects):

5:45 PM Changeset in webkit [203144] by mark.lam@apple.com

2 edits in trunk/Source/JavaScriptCore

Gardening: C Loop build fix after r203142.

Not reviewed.

interpreter/CLoopStackInlines.h:

(JSC::CLoopStack::isSafeToRecurse):

5:20 PM Changeset in webkit [203143] by Ryan Haddad

8 edits
2 copies
4 adds
3 deletes in trunk

Unreviewed, rolling out r203131.
https://bugs.webkit.org/show_bug.cgi?id=159698

This change caused an existing LayoutTest to time out on debug
testers (Requested by ryanhaddad on #webkit).

Reverted changeset:

"[JSC] Array.prototype.join() fails some conformance tests"
https://bugs.webkit.org/show_bug.cgi?id=159657
http://trac.webkit.org/changeset/203131

Patch by Commit Queue <commit-queue@webkit.org> on 2016-07-12

5:19 PM Changeset in webkit [203142] by mark.lam@apple.com

23 edits
1 add in trunk

We should use different stack limits for stack checks from JS and host code.
https://bugs.webkit.org/show_bug.cgi?id=159442
<rdar://problem/26889188>

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

We have 2 stack reservedZoneSizes:

Options::softReservedZoneSize()
Options::reservedZoneSize()

Respectively, there are used to define 2 stack limits based on these reserved
zone sizes:

VM::m_softStackLimit
VM::m_stackLimit

Options::reservedZoneSize() is the amount of the stack space that JSC guarantees
to the VM and client host code for it's use. Host code that has well known
stack usage characteristics (i.e. doesn't call arbitrary code) may do stack
checks against the VM::m_stackLimit limit (which is computed using
Options::reservedZoneSize()).

Options::softReservedZoneSize() is a more conservative amount of reserved stack
space. This is used to compute the VM::m_softStackLimit limit. Any code that
is difficult to have its stack usage characterized (i.e. may call arbitrary code)
may need more stack space for its work. Hence, these should do stack checks
against the VM::m_softStackLimit limit.

JS code and host code that may call into JS code falls into the category of code
that may call arbitrary code. Hence, they should do stack checks against the
VM::m_softStackLimit limit.

Accordingly, the VM now provides 2 recursion check functions:

VM::isSafeToRecurseSoft() will do a stack check against VM::m_softStackLimit. In addition, for C Loop builds, VM::isSafeToRecurseSoft() will also check the CLoopStack against VM::m_cloopStackLimit.

VM::isSafeToRecurse() will do a stack check against VM::m_stackLimit.

Also added a promise-infinite-recursion-should-not-crash.js test.

bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::emitNodeInTailPosition):
(JSC::BytecodeGenerator::emitNodeInConditionContext):

interpreter/CLoopStack.cpp:

(JSC::CLoopStack::grow):

interpreter/CLoopStack.h:

(JSC::CLoopStack::size):

interpreter/CLoopStackInlines.h:

(JSC::CLoopStack::ensureCapacityFor):
(JSC::CLoopStack::isSafeToRecurse):
(JSC::CLoopStack::topOfFrameFor):

interpreter/CachedCall.h:

(JSC::CachedCall::CachedCall):

interpreter/Interpreter.cpp:

(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):
(JSC::Interpreter::executeConstruct):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

parser/Parser.cpp:
runtime/Options.h:
runtime/ProxyObject.cpp:

(JSC::performProxyGet):
(JSC::ProxyObject::performInternalMethodGetOwnProperty):
(JSC::ProxyObject::performHasProperty):
(JSC::ProxyObject::getOwnPropertySlotCommon):
(JSC::ProxyObject::performPut):
(JSC::performProxyCall):
(JSC::performProxyConstruct):
(JSC::ProxyObject::performDelete):
(JSC::ProxyObject::performPreventExtensions):
(JSC::ProxyObject::performIsExtensible):
(JSC::ProxyObject::performDefineOwnProperty):
(JSC::ProxyObject::performGetOwnPropertyNames):
(JSC::ProxyObject::performSetPrototype):
(JSC::ProxyObject::performGetPrototype):

runtime/RegExp.cpp:

(JSC::RegExp::finishCreation):
(JSC::RegExp::compile):
(JSC::RegExp::compileMatchOnly):

runtime/StringRecursionChecker.h:

(JSC::StringRecursionChecker::performCheck):

runtime/VM.cpp:

(JSC::VM::setStackPointerAtVMEntry):
(JSC::VM::updateSoftReservedZoneSize):
(JSC::preCommitStackMemory):
(JSC::VM::updateStackLimits):
(JSC::VM::updateStackLimit): Deleted.

runtime/VM.h:

(JSC::VM::stackLimit):
(JSC::VM::softStackLimit):
(JSC::VM::addressOfSoftStackLimit):
(JSC::VM::setCLoopStackLimit):
(JSC::VM::isSafeToRecurse):
(JSC::VM::lastStackTop):
(JSC::VM::setException):

runtime/VMInlines.h:

(JSC::VM::ensureStackCapacityFor):
(JSC::VM::isSafeToRecurseSoft):
(JSC::VM::shouldTriggerTermination):

tests/stress/promise-infinite-recursion-should-not-crash.js: Added.

(testPromise):
(promiseFunc):

yarr/YarrPattern.cpp:

Tools:

In http://trac.webkit.org/r203067, we limited the amount of stack that tests will
run with to keep stack overflow tests sane. Turns out, we also need to teach the
LayoutTestRelay to pass env vars over to the iOS simulator. This is needed in
order to keep the js/regress-139548.html test happy with this patch.

Also fixed up run_webkit_tests.py to explicitly pass an int size value for the
JSC_maxPerThreadStackUsage option. Otherwise, it will pass a float value.

LayoutTestRelay/LayoutTestRelay/LTRelayController.m:

(-[LTRelayController _environmentVariables]):

Scripts/webkitpy/layout_tests/run_webkit_tests.py:

(main):

LayoutTests:

js/regress-141098-expected.txt:
js/script-tests/regress-141098.js:

(testEval):
(probeAndRecurse):

Gave all the test constants names.
Tweaked the constants to allow the test to run in the least amount of time, and also to behave consistently across all test configurations.
Re-enable eager tests now that the test should finish quickly.

5:05 PM Changeset in webkit [203141] by fpizlo@apple.com

4 edits in trunk

platformUserPreferredLanguages on Mac should not try to put the region into the language
https://bugs.webkit.org/show_bug.cgi?id=159693

Rubber stamped by Alexey Proskuryakov.

Source/WTF:

Currently, navigator.language is the thing that we use as the BCP-47 tag in our Intl code
when certain APIs are called without a locale argument. That mostly makes sense, and is
deeply wired into our engine.

In r200105, we made Intl aware of the region as a separate thing from the language by having
platformUserPreferredLanguages() return something like a BCP-47 tag that was
<language>-<region>. For example, if I told System Preferences that I want to speak English
but live in Poland then we'd get "en-pl". This had the effect of making Intl APIs format
dates using Polish formatting, for example.

But this is an odd change, since that same function also feeds into navigator.language.
"en-pl" isn't what we want there, since my System Preferences settings aren't supposed to
mean that I want to speak Polish-style English. There's no such thing.

It may be worthwhile to wire the region settings more elegantly into Intl, but if we do that,
it should be via a mechanism that is separate from navigator.language. So, this change simply
reverts r200105.

wtf/PlatformUserPreferredLanguagesMac.mm:

(WTF::httpStyleLanguageCode):
(WTF::platformUserPreferredLanguages):
(WTF::isValidICUCountryCode): Deleted.

Tools:

Revert the test change in r200105.

TestWebKitAPI/Tests/mac/NavigatorLanguage.mm:

(TestWebKitAPI::languageForSystemLanguage):

5:02 PM Changeset in webkit [203140] by bshafiei@apple.com

5 edits in branches/safari-602.1.40-branch/Source

Versioning.

4:57 PM Changeset in webkit [203139] by bshafiei@apple.com

1 copy in tags/Safari-602.1.40.6

New tag.

4:57 PM Changeset in webkit [203138] by bshafiei@apple.com

6 edits in branches/safari-602.1.40-branch/Source

Merged r203134. rdar://problem/27312176

4:49 PM Changeset in webkit [203137] by dino@apple.com

3 edits in trunk/LayoutTests

REGRESSION (202694): Audio and Video playback controls: Cannot find a position slider to adjust playback position using VO.
https://bugs.webkit.org/show_bug.cgi?id=159661
<rdar://problem/27285135>

Unreviewed. Slight tweak to test to hopefully avoid flakiness.

media/controls/default-size-should-show-scrubber-expected.txt:
media/controls/default-size-should-show-scrubber.html:

4:20 PM Changeset in webkit [203136] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking fast/css/ancestor-of-hovered-element-detached.html as flaky on Mac
https://bugs.webkit.org/show_bug.cgi?id=159173

Unreviewed test gardening.

platform/mac/TestExpectations:

4:16 PM Changeset in webkit [203135] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

REGRESSION(r192789): Web Inspector: Log Value context menu appears twice
https://bugs.webkit.org/show_bug.cgi?id=159681
<rdar://problem/27304804>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-12
Reviewed by Brian Burg.

In r192789 contextmenu events may bubble up so that multiple handlers
may append ContextMenuItems. In nested ObjectTrees / ObjectPreviews
this could result in duplicate items. Add a flag on the bubbling event
so that we only include Object Tree context menu items for the deepest
part of the Object Tree, but still allow bubbling up to the root.

UserInterface/Views/ObjectPreviewView.js:

(WebInspector.ObjectPreviewView.prototype._contextMenuHandler):
(WebInspector.ObjectPreviewView):

UserInterface/Views/ObjectTreeBaseTreeElement.js:

(WebInspector.ObjectTreeBaseTreeElement.prototype._contextMenuHandler):

4:14 PM Changeset in webkit [203134] by pvollan@apple.com

6 edits in trunk/Source

[Win] Fix for build error when trying to version stamp dll.
https://bugs.webkit.org/show_bug.cgi?id=159692

Reviewed by Brent Fulgham.

Use correct path to version stamp script.

Source/JavaScriptCore:

CMakeLists.txt:

Source/WebKit:

CMakeLists.txt:

Source/WTF:

wtf/CMakeLists.txt:

3:43 PM Changeset in webkit [203133] by Chris Dumez

8 edits in trunk/Source/WebKit2

[WK2][NetworkSession] Fix unsafe RunLoop::dispatch() in NetworkLoad constructor
https://bugs.webkit.org/show_bug.cgi?id=159691

Reviewed by Brady Eidson.

Remove unsafe RunLoop::dispatch() in NetworkLoad constructor. It captured |this| but there
was no guarantee the NetworkLoad would still be alive by the time the lambda gets executed.

Instead, the constructor now takes a NetworkSession& parameter so that the call sites
have to retrieve the NetworkSession for a given SessionID and deal with the fact that
there may be no such NetworkSession before constructing the NetworkLoad.

NetworkProcess/Downloads/DownloadManager.cpp:

(WebKit::DownloadManager::startDownload):

NetworkProcess/Downloads/PendingDownload.cpp:

(WebKit::PendingDownload::PendingDownload):

NetworkProcess/Downloads/PendingDownload.h:
NetworkProcess/NetworkLoad.cpp:

(WebKit::NetworkLoad::NetworkLoad):

NetworkProcess/NetworkLoad.h:
NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::startNetworkLoad):

NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:

(WebKit::NetworkCache::SpeculativeLoad::SpeculativeLoad):

3:21 PM Changeset in webkit [203132] by commit-queue@webkit.org

5 edits
2 adds in trunk

Web Inspector: ER: Copy as cURL
https://bugs.webkit.org/show_bug.cgi?id=159380

Patch by Johan K. Jensen <johan_jensen@apple.com> on 2016-07-12
Reviewed by Joseph Pecoraro.

Source/WebInspectorUI:

Inspired by https://chromium.googlesource.com/chromium/src/+/b7c1115dbae65030ad96e773d9a270465a05f5c4/third_party/WebKit/Source/devtools/front_end/network/NetworkLogView.js

This "Copy as cURL" feature only approximates the original request as only some parts of
that request is known to the frontend.

UserInterface/Models/Resource.js:

(WebInspector.Resource.prototype.generateCURLCommand.escapeStringPosix.escapeCharacter):
(WebInspector.Resource.prototype.generateCURLCommand.escapeStringPosix):
(WebInspector.Resource.prototype.generateCURLCommand):
(WebInspector.Resource):

UserInterface/Views/ResourceTimelineDataGridNode.js:

(WebInspector.ResourceTimelineDataGridNode.prototype.appendContextMenuItems):

LayoutTests:

http/tests/inspector/network/copy-as-curl-expected.txt: Added.
http/tests/inspector/network/copy-as-curl.html: Added.

3:08 PM Changeset in webkit [203131] by commit-queue@webkit.org

8 edits
3 adds
6 deletes in trunk

[JSC] Array.prototype.join() fails some conformance tests
https://bugs.webkit.org/show_bug.cgi?id=159657

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-07-12
Reviewed by Saam Barati.

Source/JavaScriptCore:

There were a couple of failures:
-separator.toString() was called *before* we get the length

and process ToLength() on it.

-We were using toUInt32() on length instead of ToLength(),

failing on big integers and various negative numbers.

Additionally, I replaced the "fast" ArrayStorage path
by a fully generic implementation that does not depends on StringJoiner.

runtime/ArrayPrototype.cpp:

(JSC::slowJoin):
(JSC::canUseFastJoin):
(JSC::fastJoin):
(JSC::arrayProtoFuncJoin):
(JSC::join): Deleted.

runtime/JSArray.h:

(JSC::toLength):

Source/WTF:

wtf/text/AtomicString.cpp:

(WTF::AtomicString::number):

wtf/text/AtomicString.h:

LayoutTests:

I removed 3 sputnik tests that are incorrect in the latest spec.
In ES5, Array.prototype.join() was using ToUint32 on the argument:

https://es5.github.io/#x15.4.4.5

In ES6, the function uses ToLength:

https://tc39.github.io/ecma262/#sec-array.prototype.join

js/array-join-expected.txt: Added.
js/array-join.html: Added.
js/script-tests/array-join.js: Added.

3:06 PM Changeset in webkit [203130] by mark.lam@apple.com

21 edits in trunk/Source/JavaScriptCore

More stack limit and reserved zone renaming.
https://bugs.webkit.org/show_bug.cgi?id=159690

Rubber-stamped by Geoffrey Garen.

We should rename the following:

osStackLimitWithReserve => softStackLimit
reservedZoneSize => softReservedZoneSize
errorModeReservedZoneSize => reservedZoneSize

API/tests/PingPongStackOverflowTest.cpp:

(testPingPongStackOverflow):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

interpreter/CLoopStack.cpp:

(JSC::CLoopStack::CLoopStack):
(JSC::CLoopStack::grow):
(JSC::CLoopStack::releaseExcessCapacity):
(JSC::CLoopStack::addToCommittedByteCount):
(JSC::CLoopStack::setSoftReservedZoneSize):
(JSC::CLoopStack::setReservedZoneSize): Deleted.

interpreter/CLoopStack.h:

(JSC::CLoopStack::size):

interpreter/CLoopStackInlines.h:

(JSC::CLoopStack::shrink):

jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):

jit/SetupVarargsFrame.cpp:

(JSC::emitSetupVarargsFrameFastCase):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/ErrorHandlingScope.cpp:

(JSC::ErrorHandlingScope::ErrorHandlingScope):
(JSC::ErrorHandlingScope::~ErrorHandlingScope):

runtime/ErrorHandlingScope.h:
runtime/Options.h:
runtime/RegExp.cpp:

(JSC::RegExp::finishCreation):
(JSC::RegExp::compile):
(JSC::RegExp::compileMatchOnly):

runtime/VM.cpp:

(JSC::VM::VM):
(JSC::VM::setStackPointerAtVMEntry):
(JSC::VM::updateSoftReservedZoneSize):
(JSC::VM::updateStackLimit):
(JSC::VM::updateReservedZoneSize): Deleted.

runtime/VM.h:

(JSC::VM::stackPointerAtVMEntry):
(JSC::VM::softReservedZoneSize):
(JSC::VM::softStackLimit):
(JSC::VM::addressOfSoftStackLimit):
(JSC::VM::cloopStackLimit):
(JSC::VM::setCLoopStackLimit):
(JSC::VM::isSafeToRecurse):
(JSC::VM::reservedZoneSize): Deleted.
(JSC::VM::osStackLimitWithReserve): Deleted.
(JSC::VM::addressOfOSStackLimitWithReserve): Deleted.

runtime/VMInlines.h:

(JSC::VM::ensureStackCapacityFor):

wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::startFunction):

2:51 PM Changeset in webkit [203129] by Chris Dumez

4 edits
4 adds in trunk

[WK2] Protect against bad database data in LocalStorageDatabase::importItems()
https://bugs.webkit.org/show_bug.cgi?id=159663
<rdar://problem/18995873>

Reviewed by Benjamin Poulain.

Source/WebKit2:

Protect against bad database data in LocalStorageDatabase::importItems(). We
crash if the database contains a null key or a null value so protect against
it given that we have evidence it can happen.

With this change, I can no longer reproduce the UIProcess crash on evernote.com
that is documented at <rdar://problem/18995873>.

UIProcess/Storage/LocalStorageDatabase.cpp:

(WebKit::LocalStorageDatabase::importItems):

Tools:

Add API test coverage.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/LocalStorageNullEntries.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/LocalStorageNullEntries.localstorage: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/LocalStorageNullEntries.localstorage-shm: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/LocalStorageNullEntries.mm: Added.

(-[LocalStorageNullEntriesMessageHandler userContentController:didReceiveScriptMessage:]):
(TEST):

2:09 PM Changeset in webkit [203128] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking storage/indexeddb/database-close-private.html as flaky on Mac
https://bugs.webkit.org/show_bug.cgi?id=158500

Unreviewed test gardening.

platform/mac/TestExpectations:

1:48 PM Changeset in webkit [203127] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking storage/indexeddb/modern/handle-user-delete.html as flaky on Yosemite Release
https://bugs.webkit.org/show_bug.cgi?id=158741

Unreviewed test gardening.

platform/mac/TestExpectations:

1:31 PM Changeset in webkit [203126] by bshafiei@apple.com

5 edits in branches/safari-602.1.40-branch/Source

Versioning.

1:25 PM Changeset in webkit [203125] by bshafiei@apple.com

1 copy in tags/Safari-602.1.40.5

New tag.

1:24 PM Changeset in webkit [203124] by bshafiei@apple.com

10 edits in branches/safari-602.1.40-branch

Merged r203111. rdar://problem/26358998

12:40 PM Changeset in webkit [203123] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking inspector/indexeddb/deleteDatabaseNamesWithSpace.html as a flaky timeout on Mac debug.
https://bugs.webkit.org/show_bug.cgi?id=159684

Unreviewed test gardening.

platform/mac/TestExpectations:

12:40 PM Changeset in webkit [203122] by Ryan Haddad

2 edits in trunk/LayoutTests

Update test expectations for rdar://problem/26590623 after r203117.

platform/mac/TestExpectations:

12:12 PM Changeset in webkit [203121] by Ryan Haddad

3 edits in trunk/LayoutTests

Marking imported/w3c/web-platform-tests/fetch/api/request/request-cache.html as flaky on Mac and ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=159683

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:
platform/mac/TestExpectations:

11:50 AM Changeset in webkit [203120] by dino@apple.com

3 edits
2 adds in trunk

REGRESSION (202694): Audio and Video playback controls: Cannot find a position slider to adjust playback position using VO.
https://bugs.webkit.org/show_bug.cgi?id=159661
<rdar://problem/27285135>

Reviewed by Eric Carlson.

Source/WebCore:

The change in r202694 caused MediaDocuments to not always
show their scrubber. The fix is to reduce the minimum amount
of size needed to show the scrubber.

Test: media/controls/default-size-should-show-scrubber.html

Modules/mediacontrols/mediaControlsApple.js: 80 pixels is enough

to show the scrubber.

LayoutTests:

Add a test that checks the scrubber is visible on a default media element.
Unfortunately this isn't quite an accurate test, since we really want to
examine a Media Document, but it's close enough.

media/controls/default-size-should-show-scrubber-expected.txt: Added.
media/controls/default-size-should-show-scrubber.html: Added.

11:48 AM Changeset in webkit [203119] by mmaxfield@apple.com

4 edits in trunk

Relax ordering requirements on StringView::CodePoints iterator
https://bugs.webkit.org/show_bug.cgi?id=159609

Reviewed by Darin Adler.

Source/WTF:

Previously, there was a requirement where if you use a CodePoints
iterator, you couldn't dereference twice in a row or increment
twice in a row. This restriction is unnecessary.

wtf/text/StringView.h:

(WTF::StringView::CodePoints::Iterator::Iterator):
(WTF::StringView::CodePoints::Iterator::advanceCurrentCodePoint):
(WTF::StringView::CodePoints::Iterator::operator*):
(WTF::StringView::CodePoints::Iterator::operator==):

Tools:

TestWebKitAPI/Tests/WTF/StringView.cpp:

(TestWebKitAPI::TEST):

10:43 AM Changeset in webkit [203118] by commit-queue@webkit.org

2 edits in trunk/Tools

Fixing Tools/Scripts/run-builtins-generator-tests after https://trac.webkit.org/changeset/202975
https://bugs.webkit.org/show_bug.cgi?id=159564

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-12
Reviewed by Brian Burg.

Scripts/webkitpy/codegen/main.py:

(BuiltinsGeneratorTests.generate_from_js_builtins): Changing --with-wrapper-files option to --wrappers.

10:17 AM Changeset in webkit [203117] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking http/tests/preload/single_download_preload_runner.html as a timeout
https://bugs.webkit.org/show_bug.cgi?id=159678

Unreviewed test gardening.

TestExpectations:

9:43 AM Changeset in webkit [203116] by fred.wang@free.fr

4 edits
2 moves in trunk/Source/WebCore

Move MathMLOperatorDictionary from rendering to DOM
https://bugs.webkit.org/show_bug.cgi?id=159619

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-12
Reviewed by Brent Fulgham.

No new tests, behavior is unchanged.

CMakeLists.txt: Use the new location of MathMLOperatorDictionary files.
WebCore.xcodeproj/project.pbxproj: Ditto.
mathml/MathMLAllInOne.cpp: Add MathMLOperatorDictionary.cpp
mathml/MathMLOperatorDictionary.cpp: Renamed from Source/WebCore/rendering/mathml/MathMLOperatorDictionary.cpp.
mathml/MathMLOperatorDictionary.h: Renamed from Source/WebCore/rendering/mathml/MathMLOperatorDictionary.h.

7:36 AM Changeset in webkit [203115] by Gyuyoung Kim

14 edits in trunk

Remove ENABLE_CSS3_TEXT_LINE_BREAK flag
https://bugs.webkit.org/show_bug.cgi?id=159671

Reviewed by Csaba Osztrogonác.

ENABLE_CSS3_TEXT_LINE_BREAK feature was implemented without guards.
https://bugs.webkit.org/show_bug.cgi?id=89235

So this guard can be removed in build scripts.

Source/cmake/OptionsMac.cmake:
Source/cmake/WebKitFeatures.cmake:

Source/JavaScriptCore:

Configurations/FeatureDefines.xcconfig:

Source/WebCore:

Configurations/FeatureDefines.xcconfig:

Source/WebKit/mac:

Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

Configurations/FeatureDefines.xcconfig:

Tools:

Scripts/webkitperl/FeatureList.pm:
TestWebKitAPI/Configurations/FeatureDefines.xcconfig:

6:05 AM Changeset in webkit [203114] by commit-queue@webkit.org

4 edits
2 adds in trunk/Source/WebInspectorUI

Web Inspector: Use separate files for TreeOutline/TreeElement and DataGrid/DataGridNode
https://bugs.webkit.org/show_bug.cgi?id=159659

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-12
Reviewed by Timothy Hatcher.

UserInterface/Main.html:
UserInterface/Views/DataGrid.js:
UserInterface/Views/DataGridNode.js: Added.
UserInterface/Views/TreeElement.js: Added.
UserInterface/Views/TreeOutline.js:

Extra the component classes to their own file.

6:04 AM Changeset in webkit [203113] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Unreviewed, rolling out r203059.
https://bugs.webkit.org/show_bug.cgi?id=159673

B and R channels now swapped on desktop GL builds (Requested
by philn on #webkit).

Reverted changeset:

"Red and blue colors are swapped in video rendered through
WebGL when GSTREAMER_GL is enabled"
https://bugs.webkit.org/show_bug.cgi?id=159621
http://trac.webkit.org/changeset/203059

4:29 AM Changeset in webkit [203112] by Csaba Osztrogonác

2 edits
2 adds in trunk/Source/WTF

JSCOnly bulidfix after r203078
https://bugs.webkit.org/show_bug.cgi?id=159669

Reviewed by Yusuke Suzuki.

wtf/PlatformJSCOnly.cmake:
wtf/text/jsconly/TextBreakIteratorInternalICUJSCOnly.cpp: Added.

(WTF::currentSearchLocaleID):
(WTF::currentTextBreakLocaleID):

4:14 AM Changeset in webkit [203111] by pvollan@apple.com

10 edits in trunk

[Win] DLLs are missing version information.
https://bugs.webkit.org/show_bug.cgi?id=159349

Reviewed by Brent Fulgham.

The version stamping will fail if the target path has forward slashes.

Source/cmake/tools/scripts/version-stamp.pl: Replace forward slashes with backslashes.

Source/JavaScriptCore:

Generate autoversion.h and run perl version stamp utility.

CMakeLists.txt:

Source/WebKit:

Run perl version stamp utility.

CMakeLists.txt:

Source/WTF:

Generate autoversion.h and run perl version stamp utility.

wtf/CMakeLists.txt:

WebKitLibraries:

The version stamping will fail if the target path has forward slashes.

win/tools/scripts/version-stamp.pl: Replace forward slashes with backslashes.

2:04 AM Changeset in webkit [203110] by yoav@yoav.ws

4 edits in trunk/Source/WebCore

js/dom/global-constructors-attributes.html is flaky: ResourceTiming runtime feature leaks between tests
https://bugs.webkit.org/show_bug.cgi?id=158902

Reviewed by Benjamin Poulain.

Adds a new reset() mechanism to RuntimeEnabledFeatures so that they could be brought back to the initial state.
This reset() is then called from DumpRenderTree and WebKitTestRunner.

No new tests but hopefully current tests will be less flaky.

bindings/generic/RuntimeEnabledFeatures.cpp:

(WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures):
(WebCore::RuntimeEnabledFeatures::reset):

bindings/generic/RuntimeEnabledFeatures.h:
testing/Internals.cpp:

(WebCore::Internals::resetToConsistentState): reset RuntimeEnabledFeatures.

Jul 11, 2016:

11:24 PM Changeset in webkit [203109] by Gyuyoung Kim

24 edits in trunk/Source

Purge PassRefPtr in platform/efl and platform/mac
https://bugs.webkit.org/show_bug.cgi?id=159548

Reviewed by Alex Christensen.

Remove all use of PassRefPtr and clean up unnecessary tabs and spaces.
Source/WebCore:

WebKit2 codes are also changed because of setBufferForType()'s modification.

No new tests, no behavior changes.

platform/PasteboardStrategy.h:
platform/PlatformPasteboard.h:
platform/PlatformSpeechSynthesizer.h:
platform/SerializedPlatformRepresentation.h:
platform/efl/PlatformSpeechSynthesisProviderEfl.cpp:

(WebCore::PlatformSpeechSynthesisProviderEfl::speak):

platform/efl/PlatformSpeechSynthesisProviderEfl.h:
platform/efl/PlatformSpeechSynthesizerEfl.cpp:

(WebCore::PlatformSpeechSynthesizer::speak):

platform/ios/PlatformPasteboardIOS.mm:

(WebCore::PlatformPasteboard::setBufferForType):

platform/ios/PlatformSpeechSynthesizerIOS.mm:

(SOFT_LINK_CONSTANT):
(-[WebSpeechSynthesisWrapper initWithSpeechSynthesizer:]):
(-[WebSpeechSynthesisWrapper mapSpeechRateToPlatformRate:]):
(-[WebSpeechSynthesisWrapper speakUtterance:]):
(-[WebSpeechSynthesisWrapper pause]):
(-[WebSpeechSynthesisWrapper resume]):
(-[WebSpeechSynthesisWrapper cancel]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didStartSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didFinishSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didPauseSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didContinueSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didCancelSpeechUtterance:]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:willSpeakRangeOfSpeechString:utterance:]):
(WebCore::PlatformSpeechSynthesizer::speak):

platform/mac/PasteboardMac.mm:

(WebCore::Pasteboard::write):

platform/mac/PlatformPasteboardMac.mm:

(WebCore::PlatformPasteboard::getTypes):
(WebCore::PlatformPasteboard::getPathnamesForType):
(WebCore::PlatformPasteboard::color):
(WebCore::PlatformPasteboard::copy):
(WebCore::PlatformPasteboard::setBufferForType):
(WebCore::PlatformPasteboard::setPathnamesForType):

platform/mac/PlatformSpeechSynthesizerMac.mm:

(-[WebSpeechSynthesisWrapper initWithSpeechSynthesizer:]):
(-[WebSpeechSynthesisWrapper speakUtterance:]):
(-[WebSpeechSynthesisWrapper pause]):
(-[WebSpeechSynthesisWrapper resume]):
(-[WebSpeechSynthesisWrapper cancel]):
(-[WebSpeechSynthesisWrapper speechSynthesizer:didFinishSpeaking:]):
(WebCore::PlatformSpeechSynthesizer::initializeVoiceList):
(WebCore::PlatformSpeechSynthesizer::speak):

platform/mac/SerializedPlatformRepresentationMac.h:
platform/mac/SerializedPlatformRepresentationMac.mm:

(WebCore::SerializedPlatformRepresentationMac::data):
(WebCore::jsValueWithValueInContext):

platform/mock/PlatformSpeechSynthesizerMock.cpp:

(WebCore::PlatformSpeechSynthesizerMock::speakingFinished):
(WebCore::PlatformSpeechSynthesizerMock::speak):
(WebCore::PlatformSpeechSynthesizerMock::cancel):

platform/mock/PlatformSpeechSynthesizerMock.h:

Source/WebKit/mac:

WebCoreSupport/WebPlatformStrategies.h:
WebCoreSupport/WebPlatformStrategies.mm:

(WebPlatformStrategies::setBufferForType):

Source/WebKit2:

WebKit2 codes are also changed because of setBufferForType()'s modification.

UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:

(WebKit::WebPasteboardProxy::setPasteboardBufferForType):

WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:

(WebKit::WebPlatformStrategies::setBufferForType):

WebProcess/WebCoreSupport/WebPlatformStrategies.h:

11:04 PM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

10:59 PM Changeset in webkit [203108] by fred.wang@free.fr

9 edits
1 copy
1 add in trunk/Source/WebCore

Move parsing of mspace attributes to a MathMLSpaceElement class
https://bugs.webkit.org/show_bug.cgi?id=156795

Patch by Frederic Wang <fwang@igalia.org> on 2016-07-11
Reviewed by Brent Fulgham.

No new tests, already covered by existing tests.

CMakeLists.txt: Add MathMLSpaceElement to the build system.
WebCore.xcodeproj/project.pbxproj: Ditto.
mathml/MathMLElement.cpp:

(WebCore::MathMLElement::cachedMathMLLength): Helper function to returned the cached parsed
value of a MathML length and parsing the corresponding attribute value if the cache is dirty.

mathml/MathMLElement.h: Add a dirty boolean to MathML Length structure. Declare cachedMathMLLength.
mathml/MathMLSpaceElement.cpp: New class for the <mspace> element.

(WebCore::MathMLSpaceElement::MathMLSpaceElement):
(WebCore::MathMLSpaceElement::create):
(WebCore::MathMLSpaceElement::parseAttribute): Make width, height, depth attributes dirty.
(WebCore::MathMLSpaceElement::createElementRenderer):

mathml/MathMLSpaceElement.h: New class for the <mspace> element.

We define MathML lengths for width, height and depth attributes are on the class and expose
with the corresponding helper functions via memoization.

mathml/MathMLTextElement.cpp: Remove handling of mspace from this class.

(WebCore::MathMLTextElement::createElementRenderer):

mathml/mathtags.in: Change the interface for mspace to use the new class.
rendering/mathml/RenderMathMLSpace.cpp: Do not store width/height/depth values on the

renderer and instead just use the corresponding MathML lengths on the element class.
(WebCore::RenderMathMLSpace::RenderMathMLSpace): Use MathMLSpaceElement and remove member
initialization.
(WebCore::RenderMathMLSpace::computePreferredLogicalWidths): Use spaceWidth().
(WebCore::RenderMathMLSpace::spaceWidth): Helper function to resolve the width attribute value.
(WebCore::RenderMathMLSpace::getSpaceHeightAndDepth): Ditto for height and depth.
(WebCore::RenderMathMLSpace::layoutBlock): Use the helper functions to get the mspace metrics.
(WebCore::RenderMathMLSpace::firstLineBaseline): Ditto.
(WebCore::RenderMathMLSpace::updateFromElement): Deleted.
(WebCore::RenderMathMLSpace::styleDidChange): Deleted.

rendering/mathml/RenderMathMLSpace.h: Use MathMLSpaceElement, replace members with helper

functions and and make element() usable from a const instance.

10:06 PM Changeset in webkit [203107] by commit-queue@webkit.org

7 edits
3 adds in trunk

ECMAScript 2016: %TypedArray%.prototype.includes implementation
https://bugs.webkit.org/show_bug.cgi?id=159385

Patch by Caio Lima <Caio Lima> on 2016-07-11
Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

This patch implements the ECMAScript 2016:
%TypedArray%.prototype.includes
following spec 22.2.3.14
https://tc39.github.io/ecma262/2016/#sec-%typedarray%.prototype.includes

runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncIncludes):

runtime/JSTypedArrayViewPrototype.cpp:

(JSC::typedArrayViewProtoFuncIncludes):
(JSC::JSTypedArrayViewPrototype::finishCreation):

LayoutTests:

This patch implements test case to ECMAScript 2016:
%TypedArray%.prototype.includes implementation
following spec 22.2.3.14
https://tc39.github.io/ecma262/2016/#sec-%typedarray%.prototype.includes

js/regress/script-tests/typed-array-includes.js: Added.

(assertProperError):
(testIntTypedArray):
(testFloatTypedArray):

js/typed-array-includes-expected.txt: Added.
js/typed-array-includes.html: Added.

9:47 PM Changeset in webkit [203106] by fred.wang@free.fr

5 edits in trunk/Source/WebCore

Create a MathMLLength struct to handle the parsing of MathML length.
https://bugs.webkit.org/show_bug.cgi?id=156792

Patch by Frederic Wang <fwang@igalia.org> on 2016-07-11
Reviewed by Brent Fulgham.

We introduce a structure for MathML lengths that will be used in the future to store the
parsed values in the MathElement class. We also rewrite the parsing function for MathML
lengths in order to improve efficiency and code reuse. This function is moved into the
MathElement class and only the conversion to LayoutUnit remains in the renderer classes.

No new tests, already covered by existing tests.

mathml/MathMLElement.cpp:

(WebCore::parseNamedSpace): Helper function to parse a named space.
(WebCore::MathMLElement::parseMathMLLength): Parsing function for MathML lengths.

mathml/MathMLElement.h: Declare new function and structure to handle MathML lengths.
rendering/mathml/RenderMathMLBlock.cpp:

(WebCore::toUserUnits): Helper function to resolve a MathML length.
(WebCore::parseMathMLLength): Remove the old parsing code and just use MathMLElement::parseMathMLLength and toUserUnits instead.
(WebCore::parseMathMLNamedSpace): Deleted.

rendering/mathml/RenderMathMLBlock.h: Remove unused function.

9:34 PM Changeset in webkit [203105] by fred.wang@free.fr

2 edits in trunk/LayoutTests

Disable some a failing test.

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-11

imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-1.html:

9:28 PM Changeset in webkit [203104] by fred.wang@free.fr

9 edits
13 adds in trunk

Add support for @href attribute in MathML
https://bugs.webkit.org/show_bug.cgi?id=85733

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-11
Reviewed by Brent Fulgham.

Source/WebCore:

We add support for the href attribute from MathML 3 but ignore the deprecated XLink version.
We also use the code from HTMLAnchorElement SVGAElement to make MathMLElement with a href
attribute behave as a link.
Finally, we adjust mathml.css based on rules from the html and svg user agent stylesheets.

Tests: mathml/mathml-in-html5/href-click-1.html

mathml/mathml-in-html5/href-click-2.html
mathml/presentation/href-enter.html
mathml/presentation/href-style.html
mathml/presentation/maction-toggle-href.html
mathml/presentation/semantics-href.html

css/mathml.css:

(:any-link): Set color and mouse cursor of links.
(:any-link:active): Set color of active links.
(:focus): Set outline of focused links.

mathml/MathMLElement.cpp:

(WebCore::MathMLElement::parseAttribute): Parse the href attribute.
(WebCore::MathMLElement::willRespondToMouseClickEvents): Based on HTMLAnchorElement/SVGAElement.
(WebCore::MathMLElement::defaultEventHandler): Based on HTMLAnchorElement/SVGAElement.
(WebCore::MathMLElement::canStartSelection): Based on HTMLAnchorElement/SVGAElement.
(WebCore::MathMLElement::isFocusable): Based on HTMLAnchorElement/SVGAElement.
(WebCore::MathMLElement::isKeyboardFocusable): Based on HTMLAnchorElement/SVGAElement.
(WebCore::MathMLElement::isMouseFocusable): Based on HTMLAnchorElement/SVGAElement.
(WebCore::MathMLElement::isURLAttribute): Based on HTMLAnchorElement/SVGAElement.
(WebCore::MathMLElement::supportsFocus): Based on HTMLAnchorElement/SVGAElement.
(WebCore::MathMLElement::tabIndex): Based on HTMLAnchorElement/SVGAElement.

mathml/MathMLElement.h: Define new members.
mathml/MathMLSelectElement.cpp:

(WebCore::MathMLSelectElement::willRespondToMouseClickEvents): We also verify whether
the parent class will respond.

mathml/mathattrs.in: Add href attribute.

LayoutTests:

We import some tests from the MathML in HTML5 test suite to
test clicks on href attributes and write similar tests.
We also test tab/enter keys and user agent style with links.

mathml/mathml-in-html5/href-click-1.html: Added. Verify mouse click on a MathML link.
mathml/mathml-in-html5/href-click-1-expected.html: Added.
mathml/mathml-in-html5/href-click-2.html: Added.

Verify mouse click on a descendant of a MathML link.

mathml/mathml-in-html5/href-click-2-expected.html: Added.
mathml/presentation/href-enter.html: Added.

Verify tab navigation and activing link with enter.

mathml/presentation/href-enter-expected.html: Added.
mathml/presentation/href-style.html: Added.

Verify default style of links and of focused links.

mathml/presentation/href-style-expected.html: Added.
mathml/presentation/maction-toggle-href.html: Added.

Verify conflicts between maction toggle and href link.

mathml/presentation/maction-toggle-href-expected.html: Added.
mathml/presentation/semantics-href.html: Added. Verify mouse click on a <semantics> link.
mathml/presentation/semantics-href-expected.html: Added.
platform/mac/TestExpectations: Disable MathML link tests that rely on keyboard events.
platform/ios-simulator/TestExpectations: Ditto.

9:03 PM Changeset in webkit [203103] by fred.wang@free.fr

2 edits
2 adds
2 deletes in trunk/LayoutTests

Replace reftest mathml/presentation/fractions-positions.html with script tests
https://bugs.webkit.org/show_bug.cgi?id=159558

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-11
Reviewed by Martin Robinson.

TestExpectations: Remove fractions-positions.html
imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-1.html: Added.
mathml/presentation/fractions-positions-expected.html: Removed.
mathml/presentation/fractions-positions.html: Removed.

8:30 PM Changeset in webkit [203102] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: ProfileView sometimes shows Top Functions data despite Top Functions being disabled
https://bugs.webkit.org/show_bug.cgi?id=159660
<rdar://problem/27291647>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-07-11
Reviewed by Timothy Hatcher.

UserInterface/Views/ScriptProfileTimelineView.js:

(WebInspector.ScriptProfileTimelineView.prototype._profileOrientationButtonClicked):
Pass the value of the setting, not the setting itself.

5:57 PM Changeset in webkit [203101] by benjamin@webkit.org

7 edits in trunk

[JSC] Array.from() and Array.of() try to build objects even if "this" is not a constructor
https://bugs.webkit.org/show_bug.cgi?id=159604

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

The spec says IsConstructor(), we were just checking if "this"
is any function.

builtins/ArrayConstructor.js:

(of):
(from):

LayoutTests:

js/array-from-expected.txt:
js/array-of-expected.txt:
js/script-tests/array-from.js:
js/script-tests/array-of.js:

5:16 PM Changeset in webkit [203100] by ggaren@apple.com

4 edits in trunk/Source/bmalloc

Crash due to abort() calling libc++.1.dylib: std::1::thread::detach()
https://bugs.webkit.org/show_bug.cgi?id=159655

Reviewed by Sam Weinig.

It's not entirely clear what was happening in these crashes, but our
use of detach() was 100% forward-looking, so we can just remove it for
now.

This patch removes the ability for the scavenger owner to die before
the scavenger thread dies (which was unused) and also removes the
ability for the scavenger thread to exit (which was used, but we
messed up and did thread joining lazily, so we never got any benefit
from thread exit.)

We can add these features back when we need them, and make them work then.

bmalloc/AsyncTask.h:

(bmalloc::Function>::AsyncTask): We start out in the running state now
because we know that starting our thread will run it.

(bmalloc::Function>::~AsyncTask): We don't support destruction anymore.

(bmalloc::Function>::runSlowCase): I removed the Exited state.

(bmalloc::Function>::threadRunLoop): I removed the Exited and
ExitRequested states.

bmalloc/Heap.h:

bmalloc/VMHeap.h:

4:53 PM Changeset in webkit [203099] by weinig@apple.com

3 edits in trunk/Source/WebCore

Speech Synthesis: getting list of voices no longer works
<rdar://problem/22954120>
https://bugs.webkit.org/show_bug.cgi?id=159656

Reviewed by Tim Horton.

platform/PlatformSpeechSynthesizer.h:
platform/mac/PlatformSpeechSynthesizerMac.mm:

Default initialize m_voiceListIsInitialized to false so it is
initialized on both Mac and iOS. Remove the explicit initialization
from the Mac.

4:44 PM Changeset in webkit [203098] by Simon Fraser

2 edits in trunk/Source/WebCore

<rdar://problem/27285599> REGRESSION: Assertion under CertificateInfo::trust() every time I focus a text field

Reviewed by Sam Weinig.

The assertion added to CertificateInfo::trust() in r203040 is wrong, and is triggered when
focusing a form field via calls to -[WKWebProcessPlugInFrame _serverTrust], so remove it.

platform/network/cf/CertificateInfo.h:

(WebCore::CertificateInfo::trust):

4:44 PM Changeset in webkit [203097] by Simon Fraser

3 edits
2 adds in trunk

Deleting in a text input inside an iframe causes the page to scroll incorrectly
https://bugs.webkit.org/show_bug.cgi?id=159654
rdar://problem/26805722

Reviewed by Zalan Bujtas.

Source/WebCore:

Editor::revealSelectionAfterEditingOperation() needs the same iOS-specific reveal
behavior as was added for typing in r202295.

Test: fast/forms/ios/delete-in-input-in-iframe.html

editing/Editor.cpp:

(WebCore::Editor::revealSelectionAfterEditingOperation):

LayoutTests:

fast/forms/ios/delete-in-input-in-iframe-expected.txt: Added.
fast/forms/ios/delete-in-input-in-iframe.html: Added.

4:39 PM Changeset in webkit [203096] by keith_miller@apple.com

4 edits
1 add in trunk/Source/JavaScriptCore

defineProperty on a index of a TypedArray should throw if configurable
https://bugs.webkit.org/show_bug.cgi?id=159653

Reviewed by Saam Barati.

When I fixed this before I misread the spec and thought it said we
should throw if the descriptor said the proprety is not
configurable. This is the opposite. We should throw if the
descriptor says the property is configurable.

runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):

tests/stress/typedarray-access-monomorphic-neutered.js:
tests/stress/typedarray-access-neutered.js:
tests/stress/typedarray-configure-index.js: Added.

(assert):
(assertThrows):
(makeDescriptor):
(test):

4:34 PM Changeset in webkit [203095] by jmarcell@apple.com

2 edits in trunk/Tools

SVN.create_patch should find svn-create-patch relative to the WebKit root.
https://bugs.webkit.org/show_bug.cgi?id=159652

Reviewed by Daniel Bates.

Scripts/webkitpy/common/checkout/scm/svn.py:

(SVN.create_patch): Use WebKitFinder to find the WebKit checkout so that we can find svn-create-patch relative to it.

4:29 PM Changeset in webkit [203094] by Chris Dumez

2 edits in trunk/Source/WebKit2

[WK2][iOS] Intermittent crash in [UIApplication beginBackgroundTaskWithName] expiration handler
https://bugs.webkit.org/show_bug.cgi?id=159648
<rdar://problem/27219361>

Reviewed by Anders Carlsson.

We see an intermittent crash in [UIApplication beginBackgroundTaskWithName] expiration handler.
From the traces, we noticed the expiration handler can get called on a non-main thread under
certain conditions, which our code is designed to deal with.

In particular, we get called on a non-main thread when UIKit fails to acquire the assertion.
Update our expiration handler to always notify the clients on the main thread.

UIProcess/ios/ProcessAssertionIOS.mm:

(-[WKProcessAssertionBackgroundTaskManager _updateBackgroundTask]):

4:25 PM Changeset in webkit [203093] by aestes@apple.com

2 edits in trunk/Source/WebCore

Fix indentation in FrameLoaderTypes.h
https://bugs.webkit.org/show_bug.cgi?id=159650

Reviewed by Brady Eidson.

loader/FrameLoaderTypes.h:

4:23 PM Changeset in webkit [203092] by mmaxfield@apple.com

9 edits
2 adds in trunk

Honor the second argument to FontFaceSet.load and FontFaceSet.check
https://bugs.webkit.org/show_bug.cgi?id=159607
<rdar://problem/27284902>

Reviewed by Zalan Bujtas.

Source/WebCore:

This second argument is used in conjunction with the unicode-range CSS property, so that
loading from a FontFaceSet only loads the fonts which actually match the characters given.
Previously, we hadn't implemented proper support for this unicode-range property, but now
that we have implemented it, we should honor this second argument.

Test: fast/text/unicode-range-javascript.html

css/CSSFontFace.cpp:

(WebCore::CSSFontFace::rangesMatchCodePoint):

css/CSSFontFace.h:
css/CSSFontFaceSet.cpp:

(WebCore::codePointsFromString):
(WebCore::CSSFontFaceSet::matchingFaces):

LayoutTests:

fast/text/font-face-set-document-expected.txt:
fast/text/font-face-set-document.html:
fast/text/font-face-set-javascript-expected.txt:
fast/text/font-face-set-javascript.html:
fast/text/unicode-range-javascript-expected.txt: Added.
fast/text/unicode-range-javascript.html: Added.

4:18 PM Changeset in webkit [203091] by Alan Bujtas

3 edits in trunk/Source/WebCore

Unable to edit fields or drag to select text in Dashboard widgets.
https://bugs.webkit.org/show_bug.cgi?id=159647
<rdar://problem/26941698>

Reviewed by Brent Fulgham.

RenderObject::computeAbsoluteRepaintRect's first paramenter is no longer in/out. Use the return
value to set the clip on the dashboard region.

Not testable.

rendering/RenderInline.cpp:

(WebCore::RenderInline::addAnnotatedRegions):

rendering/RenderObject.cpp:

(WebCore::RenderObject::addAnnotatedRegions):

4:05 PM Changeset in webkit [203090] by enrica@apple.com

2 edits in trunk/Source/WebKit/win

Build fix.

Unreviewed.

WebDropSource.cpp:

(generateMouseEvent):

3:51 PM Changeset in webkit [203089] by mitz@apple.com

2 edits in trunk/Source/WebKit2

Tried to fix the macOS build.

UIProcess/API/Cocoa/WKNavigationAction.mm:

(-[WKNavigationAction description]):

3:35 PM Changeset in webkit [203088] by Chris Dumez

2 edits in trunk/Source/WebCore

Potential null dereference under DocumentLoader::mainReceivedError()
https://bugs.webkit.org/show_bug.cgi?id=159640
<rdar://problem/27283372>

Reviewed by Brady Eidson.

Move frameLoader() null check a bit earlier in DocumentLoader::mainReceivedError()
as it was dereferenced before the check.

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::mainReceivedError):

3:08 PM Changeset in webkit [203087] by sbarati@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

some paths in Array.prototype.splice don't account for the array not having certain indexed properties
https://bugs.webkit.org/show_bug.cgi?id=159641
<rdar://problem/27171999>

Reviewed by Filip Pizlo and Keith Miller.

Array.prototype.splice was incorrectly putting properties on
the result array even if the |this| array didn't have those
properties. This is not the behavior of the spec. However, this
could also cause a crash because we can construct a program where
we would putByIndex on a typed array where the value we are
putting is JSValue(). This is bad because the typed array will
try to convert JSValue() into an integer.

runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncSplice):

tests/stress/array-prototype-splice-making-typed-array.js: Added.

(assert):
(test):

3:02 PM Changeset in webkit [203086] by mitz@apple.com

3 edits in trunk/Source/WebKit2

Cleaned up API availability.

Requested by Tim Horton.

UIProcess/API/Cocoa/WKNavigationAction.mm:
UIProcess/API/Cocoa/WKNavigationActionPrivate.h:

2:34 PM Changeset in webkit [203085] by enrica@apple.com

38 edits in trunk/Source

Add synthetic click origin to WKNavigationAction.
https://bugs.webkit.org/show_bug.cgi?id=159584
rdar://problem/25610422

Reviewed by Tim Horton.

Source/WebCore:

Adding plumbing code to pass synthetic click type
through WebCore.

dom/Element.cpp:

(WebCore::Element::dispatchMouseEvent):
(WebCore::Element::dispatchMouseForceWillBegin):

dom/MouseEvent.cpp:

(WebCore::MouseEvent::create):
(WebCore::MouseEvent::MouseEvent):
(WebCore::MouseEvent::initMouseEvent):
(WebCore::MouseEvent::cloneFor):

dom/MouseEvent.h:

(WebCore::MouseEvent::createForBindings):
(WebCore::MouseEvent::button):
(WebCore::MouseEvent::syntheticClickType):
(WebCore::MouseEvent::buttonDown):
(WebCore::MouseEvent::setRelatedTarget):

dom/SimulatedClick.cpp:
dom/WheelEvent.cpp:

(WebCore::WheelEvent::WheelEvent):

page/ContextMenuController.cpp:

(WebCore::ContextMenuController::showContextMenuAt):

page/DragController.cpp:

(WebCore::createMouseEvent):
(WebCore::DragController::DragController):

page/EventHandler.cpp:

(WebCore::EventHandler::dispatchDragEvent):
(WebCore::EventHandler::sendContextMenuEventForKey):
(WebCore::EventHandler::fakeMouseMoveEventTimerFired):

platform/PlatformMouseEvent.h:

(WebCore::PlatformMouseEvent::PlatformMouseEvent):
(WebCore::PlatformMouseEvent::clickCount):
(WebCore::PlatformMouseEvent::modifierFlags):
(WebCore::PlatformMouseEvent::force):
(WebCore::PlatformMouseEvent::syntheticClickType):

replay/SerializationMethods.cpp:

(JSC::EncodingTraits<PlatformMouseEvent>::decodeValue):

Source/WebKit/ios:

WebView/WebPDFViewPlaceholder.mm:

(-[WebPDFViewPlaceholder simulateClickOnLinkToURL:]):

Source/WebKit/mac:

WebView/WebFrame.mm:

(-[WebFrame _dragSourceEndedAt:operation:]):

WebView/WebPDFView.mm:

(-[WebPDFView PDFViewWillClickOnLink:withURL:]):

Source/WebKit/win:

WebDropSource.cpp:

(generateMouseEvent):

Source/WebKit2:

Adds a private property to WKNavigationAction to retrieve
the origin of the synthetic click.

Shared/NavigationActionData.cpp:

(WebKit::NavigationActionData::encode):
(WebKit::NavigationActionData::decode):

Shared/NavigationActionData.h:
Shared/WebEvent.h:

(WebKit::WebMouseEvent::button):
(WebKit::WebMouseEvent::menuTypeForEvent):
(WebKit::WebMouseEvent::force):
(WebKit::WebMouseEvent::syntheticClickType):

Shared/WebMouseEvent.cpp:

(WebKit::WebMouseEvent::WebMouseEvent):
(WebKit::WebMouseEvent::encode):
(WebKit::WebMouseEvent::decode):

Shared/mac/WebEventFactory.mm:

(WebKit::WebEventFactory::createWebMouseEvent):
(WebKit::WebEventFactory::createWebWheelEvent):

UIProcess/API/APINavigationAction.h:
UIProcess/API/Cocoa/WKNavigationAction.mm:

(toWKNavigationType):
(toWKSyntheticClickType):
(-[WKNavigationAction description]):
(-[WKNavigationAction sourceFrame]):
(-[WKNavigationAction request]):
(-[WKNavigationAction _syntheticClickType]):
(-[WKNavigationAction modifierFlags]):

UIProcess/API/Cocoa/WKNavigationActionPrivate.h:
UIProcess/WebPageProxy.h:
UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView _twoFingerSingleTapGestureRecognized:]):
(-[WKContentView _longPressRecognized:]):

UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::getSelectionContext):
(WebKit::WebPageProxy::handleTwoFingerTapAtPoint):
(WebKit::WebPageProxy::selectWithTwoTouches):

WebProcess/InjectedBundle/InjectedBundleNavigationAction.cpp:

(WebKit::mouseButtonForMouseEvent):
(WebKit::syntheticClickTypeForMouseEvent):
(WebKit::InjectedBundleNavigationAction::modifiersForNavigationAction):
(WebKit::InjectedBundleNavigationAction::mouseButtonForNavigationAction):
(WebKit::InjectedBundleNavigationAction::syntheticClickTypeForNavigationAction):
(WebKit::InjectedBundleNavigationAction::create):
(WebKit::InjectedBundleNavigationAction::InjectedBundleNavigationAction):

WebProcess/InjectedBundle/InjectedBundleNavigationAction.h:

(WebKit::InjectedBundleNavigationAction::navigationType):
(WebKit::InjectedBundleNavigationAction::modifiers):
(WebKit::InjectedBundleNavigationAction::mouseButton):
(WebKit::InjectedBundleNavigationAction::hitTestResult):
(WebKit::InjectedBundleNavigationAction::formElement):
(WebKit::InjectedBundleNavigationAction::syntheticClickType):
(WebKit::InjectedBundleNavigationAction::shouldOpenExternalURLs):
(WebKit::InjectedBundleNavigationAction::shouldTryAppLinks):

WebProcess/WebCoreSupport/WebChromeClient.cpp:

(WebKit::WebChromeClient::createWindow):

WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNewWindowAction):
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::navigateToPDFLinkWithSimulatedClick):
(WebKit::WebPage::contextMenuAtPointInWindow):
(WebKit::WebPage::dragEnded):
(WebKit::WebPage::simulateMouseDown):
(WebKit::WebPage::simulateMouseUp):
(WebKit::WebPage::simulateMouseMotion):
(WebKit::WebPage::setCompositionForTesting):

WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:
WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::handleSyntheticClick):
(WebKit::WebPage::completePendingSyntheticClickForContentChangeObserver):
(WebKit::WebPage::completeSyntheticClick):
(WebKit::WebPage::sendTapHighlightForNodeIfNecessary):
(WebKit::WebPage::handleTwoFingerTapAtPoint):
(WebKit::WebPage::potentialTapAtPosition):
(WebKit::WebPage::inspectorNodeSearchMovedToPosition):

2:10 PM Changeset in webkit [203084] by andersca@apple.com

15 edits in trunk/Source

Able to open multiple payment sheets in Safari at the same time
https://bugs.webkit.org/show_bug.cgi?id=159637
rdar://problem/26411339

Reviewed by Beth Dakin.

Source/WebCore:

Fold PaymentCoordinator::showPaymentUI into PaymentCoordinator::beginPaymentSession and
change the return value of the latter member function to a bool to indicate whether the
payment UI could be shown (or whether it's already showing).

Modules/applepay/ApplePaySession.cpp:

(WebCore::ApplePaySession::begin):
Check the return value of beginPaymentSession.

Modules/applepay/PaymentCoordinator.cpp:

(WebCore::PaymentCoordinator::beginPaymentSession):
This now takes a payment session and returns a boolean.
(WebCore::PaymentCoordinator::showPaymentUI): Deleted.

Modules/applepay/PaymentCoordinator.h:
Modules/applepay/PaymentCoordinatorClient.h:
loader/EmptyClients.cpp:

The showPaymentUI client function now returns a bool.

Source/WebKit/mac:

Update for WebCore changes.

WebCoreSupport/WebPaymentCoordinatorClient.h:
WebCoreSupport/WebPaymentCoordinatorClient.mm:

(WebPaymentCoordinatorClient::showPaymentUI):

Source/WebKit2:

UIProcess/ApplePay/WebPaymentCoordinatorProxy.cpp:

(WebKit::WebPaymentCoordinatorProxy::showPaymentUI):
Add result out parameter. Set the result to false if isShowingPaymentUI is true, otherwise set isShowingPaymentUI to true.

(WebKit::WebPaymentCoordinatorProxy::didReachFinalState):
Set isShowingPaymentUI to false.

UIProcess/ApplePay/WebPaymentCoordinatorProxy.h:
UIProcess/ApplePay/WebPaymentCoordinatorProxy.messages.in:
WebProcess/ApplePay/WebPaymentCoordinator.cpp:

(WebKit::WebPaymentCoordinator::showPaymentUI):

WebProcess/ApplePay/WebPaymentCoordinator.h:

The showPaymentUI message and client functions now return booleans.

2:04 PM Changeset in webkit [203083] by n_wang@apple.com

3 edits
2 adds in trunk

AX: Crash when backspacing in number field with spin button
https://bugs.webkit.org/show_bug.cgi?id=157830

Reviewed by Chris Fleizach.

Source/WebCore:

It's possible to access spin button parts after they've been detached from their parent, which can lead to crashes.
This adds in a number of redundant safeguards to prevent this and other cases in the future.

Test: accessibility/spinbutton-crash.html

accessibility/AccessibilitySpinButton.cpp:

(WebCore::AccessibilitySpinButton::incrementButton):
(WebCore::AccessibilitySpinButton::decrementButton):
(WebCore::AccessibilitySpinButton::addChildren):

LayoutTests:

accessibility/spinbutton-crash-expected.txt: Added.
accessibility/spinbutton-crash.html: Added.

1:53 PM Changeset in webkit [203082] by Chris Dumez

2 edits in trunk/Source/WebCore

Possible null dereference under EventHandler::dispatchMouseEvent()
https://bugs.webkit.org/show_bug.cgi?id=159632
<rdar://problem/27247619>

Reviewed by Andreas Kling.

FrameSelection::toNormalizedRange() can return null even when FrameSelection::isRange()
returns true so add a null check.

page/EventHandler.cpp:

(WebCore::EventHandler::dispatchMouseEvent):

1:48 PM Changeset in webkit [203081] by mark.lam@apple.com

33 edits
3 moves in trunk/Source/JavaScriptCore

Refactor JSStack to only be the stack data structure for the C Loop.
https://bugs.webkit.org/show_bug.cgi?id=159545

Reviewed by Geoffrey Garen.

Changes made:

Renamed JSStack to CLoopStack.
Made all of CLoopStack code to conditional on #if !ENABLE(JIT) i.e. they will only be in effect for the C Loop build.
Changed clients of JSStack to use new equivalent VM APIs:
1. JSStack::ensureCapacityFor() => VM::ensureStackCapacityFor()
2. JSStack::committedByteCount() => VM::committedStackByteCount()
Made VM::updateReservedZoneSize() call CLoopStack::setReservedZoneSize() instead of calling it from all the clients of VM::updateReservedZoneSize().
Removed all unnecessary references to JSStack.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
assembler/MaxFrameExtentForSlowPathCall.h:
bytecode/BytecodeConventions.h:
dfg/DFGGraph.h:
dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

ftl/FTLOSREntry.cpp:

(JSC::FTL::prepareOSREntry):

heap/Heap.cpp:

(JSC::Heap::finalizeUnconditionalFinalizers):
(JSC::Heap::willStartIterating):
(JSC::Heap::gatherJSStackRoots):
(JSC::Heap::stack): Deleted.

heap/Heap.h:
interpreter/CLoopStack.cpp: Copied from Source/JavaScriptCore/interpreter/JSStack.cpp.

(JSC::commitSize):
(JSC::CLoopStack::CLoopStack):
(JSC::CLoopStack::~CLoopStack):
(JSC::CLoopStack::grow):
(JSC::CLoopStack::gatherConservativeRoots):
(JSC::CLoopStack::sanitizeStack):
(JSC::CLoopStack::releaseExcessCapacity):
(JSC::CLoopStack::addToCommittedByteCount):
(JSC::CLoopStack::setReservedZoneSize):
(JSC::CLoopStack::committedByteCount):
(JSC::JSStack::JSStack): Deleted.
(JSC::JSStack::~JSStack): Deleted.
(JSC::JSStack::growSlowCase): Deleted.
(JSC::JSStack::gatherConservativeRoots): Deleted.
(JSC::JSStack::sanitizeStack): Deleted.
(JSC::JSStack::releaseExcessCapacity): Deleted.
(JSC::JSStack::addToCommittedByteCount): Deleted.
(JSC::JSStack::setReservedZoneSize): Deleted.
(JSC::JSStack::lowAddress): Deleted.
(JSC::JSStack::highAddress): Deleted.
(JSC::JSStack::committedByteCount): Deleted.

interpreter/CLoopStack.h: Copied from Source/JavaScriptCore/interpreter/JSStack.h.

(JSC::CLoopStack::containsAddress):
(JSC::CLoopStack::lowAddress):
(JSC::CLoopStack::highAddress):
(JSC::CLoopStack::reservationTop):
(JSC::JSStack::containsAddress): Deleted.
(JSC::JSStack::lowAddress): Deleted.
(JSC::JSStack::highAddress): Deleted.
(JSC::JSStack::reservationTop): Deleted.

interpreter/CLoopStackInlines.h: Copied from Source/JavaScriptCore/interpreter/JSStackInlines.h.

(JSC::CLoopStack::ensureCapacityFor):
(JSC::CLoopStack::topOfFrameFor):
(JSC::CLoopStack::topOfStack):
(JSC::CLoopStack::shrink):
(JSC::CLoopStack::setCLoopStackLimit):
(JSC::JSStack::ensureCapacityFor): Deleted.
(JSC::JSStack::topOfFrameFor): Deleted.
(JSC::JSStack::topOfStack): Deleted.
(JSC::JSStack::shrink): Deleted.
(JSC::JSStack::grow): Deleted.
(JSC::JSStack::setCLoopStackLimit): Deleted.

interpreter/CallFrame.cpp:

(JSC::CallFrame::unsafeCallSiteIndex):
(JSC::CallFrame::currentVPC):
(JSC::CallFrame::stack): Deleted.

interpreter/CallFrame.h:

(JSC::ExecState::callerFrameAndPC):
(JSC::ExecState::unsafeCallerFrameAndPC):

interpreter/Interpreter.cpp:

(JSC::sizeOfVarargs):
(JSC::sizeFrameForForwardArguments):
(JSC::sizeFrameForVarargs):
(JSC::Interpreter::Interpreter):

interpreter/Interpreter.h:

(JSC::Interpreter::cloopStack):
(JSC::Interpreter::getOpcode):
(JSC::Interpreter::isCallBytecode):
(JSC::Interpreter::stack): Deleted.

interpreter/JSStack.cpp: Removed.
interpreter/JSStack.h: Removed.
interpreter/JSStackInlines.h: Removed.
interpreter/StackVisitor.cpp:

(JSC::StackVisitor::Frame::dump):

jit/JIT.h:
jit/JITOperations.cpp:
jit/JSInterfaceJIT.h:
jit/SpecializedThunkJIT.h:
jit/ThunkGenerators.cpp:
llint/LLIntOffsetsExtractor.cpp:
llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::llint_stack_check_at_vm_entry):

llint/LLIntThunks.cpp:
llint/LowLevelInterpreter.cpp:

(JSC::CLoop::execute):

runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::arityCheckFor):

runtime/ErrorHandlingScope.cpp:

(JSC::ErrorHandlingScope::ErrorHandlingScope):
(JSC::ErrorHandlingScope::~ErrorHandlingScope):

runtime/JSGlobalObject.h:
runtime/MemoryStatistics.cpp:

(JSC::globalMemoryStatistics):

runtime/StackAlignment.h:
runtime/VM.cpp:

(JSC::VM::VM):
(JSC::VM::updateReservedZoneSize):
(JSC::sanitizeStackForVM):
(JSC::VM::committedStackByteCount):

runtime/VM.h:

(JSC::VM::reservedZoneSize):
(JSC::VM::osStackLimitWithReserve):
(JSC::VM::addressOfOSStackLimitWithReserve):

runtime/VMInlines.h:

(JSC::VM::ensureStackCapacityFor):
(JSC::VM::shouldTriggerTermination):

1:22 PM Changeset in webkit [203080] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Transition and Animation sections in Visual Styles sidebar should have more spacing to their left
https://bugs.webkit.org/show_bug.cgi?id=159633
<rdar://problem/27281805>

Reviewed by Timothy Hatcher.

UserInterface/Views/VisualStyleDetailsPanel.css:

(.visual-style-property-container.animation):

1:11 PM Changeset in webkit [203079] by Ryan Haddad

9 edits in trunk/Source

Unreviewed, rolling out r203064.
https://bugs.webkit.org/show_bug.cgi?id=159642

This change causes LayoutTest crashes on WK1 ASan (Requested
by ryanhaddad on #webkit).

Reverted changeset:

"Use refs for ResourceLoaders"
https://bugs.webkit.org/show_bug.cgi?id=159592
http://trac.webkit.org/changeset/203064

Patch by Commit Queue <commit-queue@webkit.org> on 2016-07-11

12:50 PM Changeset in webkit [203078] by mmaxfield@apple.com

7 edits in trunk

Implement grapheme cluster iterator on StringView
https://bugs.webkit.org/show_bug.cgi?id=159598

Reviewed by Anders Carlsson.

This is in preparation for honoring the second argument to FontFaceSet.load().

Source/WTF:

wtf/text/StringView.cpp:

(WTF::StringView::GraphemeClusters::Iterator::Impl::Impl):
(WTF::StringView::GraphemeClusters::Iterator::Impl::operator++):
(WTF::StringView::GraphemeClusters::Iterator::Impl::operator*):
(WTF::StringView::GraphemeClusters::Iterator::Impl::operator==):
(WTF::StringView::GraphemeClusters::Iterator::Impl::computeIndexEnd):
(WTF::StringView::GraphemeClusters::Iterator::Iterator):
(WTF::StringView::GraphemeClusters::Iterator::~Iterator):
(WTF::StringView::GraphemeClusters::Iterator::operator*):
(WTF::StringView::GraphemeClusters::Iterator::operator==):
(WTF::StringView::GraphemeClusters::Iterator::operator!=):

wtf/text/StringView.h:

(WTF::StringView::GraphemeClusters::GraphemeClusters):

text/TextBreakIterator.cpp:

(WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator):

text/TextBreakIterator.h:

Tools:

TestWebKitAPI/Tests/WTF/StringView.cpp:

(TestWebKitAPI::compareLoopIterations):
(TestWebKitAPI::TEST):

12:43 PM Changeset in webkit [203077] by Brent Fulgham

3 edits
2 adds in trunk

[WebGL] Check for existing buffer exists for enabled vertex array attributes before permitting glDrawArrays to execute
https://bugs.webkit.org/show_bug.cgi?id=159590
<rdar://problem/26865535>

Reviewed by Dean Jackson.

Source/WebCore:

Test: fast/canvas/webgl/webgl-drawarrays-crash-2.html

html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::validateVertexAttributes): If enabled array buffer attributes exist,
ensure that an array buffer has been bound.

LayoutTests:

fast/canvas/webgl/webgl-drawarrays-crash-2-expected.txt: Added.
fast/canvas/webgl/webgl-drawarrays-crash-2.html: Added.

12:13 PM Changeset in webkit [203076] by keith_miller@apple.com

10 edits
3 adds in trunk

STP TypedArray.subarray 5x slowdown compared to 9.1
https://bugs.webkit.org/show_bug.cgi?id=156404
Source/JavaScriptCore:

<rdar://problem/26493032>

Reviewed by Geoffrey Garen.

This patch moves the species constructor work for
%TypedArray%.prototype.subarray to a js wrapper. By moving the
species constructor work to JS we are able to completely optimize
it out in DFG. The actual work of creating a TypedArray is still
done in C++ since we are able to avoid calling into the
constructor, which is expensive. This patch also changes the error
message when a %TypedArray%.prototype function is passed a non-typed
array this value. Finally, we used to check that the this value
had not been detached, however, this behavior was incorrect.

builtins/BuiltinNames.h:
builtins/TypedArrayPrototype.js:

(globalPrivate.typedArraySpeciesConstructor):
(subarray):

runtime/ConstructData.cpp:

(JSC::construct):

runtime/ConstructData.h:
runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
(JSC::genericTypedArrayViewProtoFuncSubarray): Deleted.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

runtime/JSTypedArrayViewPrototype.cpp:

(JSC::typedArrayViewPrivateFuncLength):
(JSC::typedArrayViewPrivateFuncSubarrayCreate):
(JSC::JSTypedArrayViewPrototype::finishCreation):
(JSC::typedArrayViewProtoFuncSubarray): Deleted.

runtime/JSTypedArrayViewPrototype.h:

LayoutTests:

Reviewed by Geoffrey Garen.

Add new micro-benchmark for testing subarray performance with small subarray sizes.

js/regress/script-tests/typed-array-subarray.js: Added.

(createManySubs):
(go):

js/regress/typed-array-subarray-expected.txt: Added.
js/regress/typed-array-subarray.html: Added.

12:08 PM Changeset in webkit [203075] by n_wang@apple.com

33 edits in trunk

AX: WKWebView should have API to prevent pinch-to-zoom always being allowed
https://bugs.webkit.org/show_bug.cgi?id=158364

Reviewed by Anders Carlsson.

Source/WebCore:

Removed the internals settings for viewport force always user scalable.

Changes are covered in modified tests.

testing/Internals.cpp:

(WebCore::Internals::resetToConsistentState):
(WebCore::Internals::Internals):
(WebCore::Internals::composedTreeAsText):
(WebCore::Internals::setLinkPreloadSupport):
(WebCore::Internals::setViewportForceAlwaysUserScalable): Deleted.

testing/Internals.h:
testing/Internals.idl:

Source/WebKit2:

Added a property in WKWebViewConfiguration so that developers can toggle the ignoring
viewport scale limits setting.

Changes are covered in modified tests.

Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode):
(WebKit::WebPageCreationParameters::decode):

Shared/WebPageCreationParameters.h:
UIProcess/API/C/WKPage.cpp:

(WKPageSetResourceCachingDisabled):
(WKPageSetIgnoresViewportScaleLimits):

UIProcess/API/C/WKPagePrivate.h:
UIProcess/API/Cocoa/WKWebView.mm:

(shouldAllowPictureInPictureMediaPlayback):
(-[WKWebView _initializeWithConfiguration:]):
(-[WKWebView _navigationGestureDidEnd]):
(forceAlwaysUserScalableChangedCallback): Deleted.
(-[WKWebView _updateForceAlwaysUserScalable]): Deleted.

UIProcess/API/Cocoa/WKWebViewConfiguration.h:
UIProcess/API/Cocoa/WKWebViewConfiguration.mm:

(-[WKWebViewConfiguration init]):
(-[WKWebViewConfiguration encodeWithCoder:]):
(-[WKWebViewConfiguration initWithCoder:]):
(-[WKWebViewConfiguration copyWithZone:]):

UIProcess/API/Cocoa/WKWebViewInternal.h:
UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::creationParameters):

UIProcess/WebPageProxy.h:
UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::setViewportConfigurationMinimumLayoutSize):
(WebKit::WebPageProxy::setForceAlwaysUserScalable):
(WebKit::WebPageProxy::setMaximumUnobscuredSize):
(WebKit::WebPageProxy::updateForceAlwaysUserScalable): Deleted.

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:
WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::disableInspectorNodeSearch):
(WebKit::WebPage::setForceAlwaysUserScalable):
(WebKit::innerFrameQuad):
(WebKit::WebPage::updateForceAlwaysUserScalable): Deleted.

Tools:

Added a function in TestRunner so that we can toggle the ignoring viewport
scale limits setting. Also added a test option for that in order to change the
configuration of the webview in test.

WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
WebKitTestRunner/InjectedBundle/TestRunner.cpp:

(WTR::TestRunner::setNavigationGesturesEnabled):
(WTR::TestRunner::setIgnoresViewportScaleLimits):
(WTR::nextUIScriptCallbackID):

WebKitTestRunner/InjectedBundle/TestRunner.h:

(WTR::TestRunner::shouldDecideNavigationPolicyAfterDelay):

WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetStateToConsistentValues):
(WTR::updateTestOptionsFromTestHeader):
(WTR::TestController::setNavigationGesturesEnabled):
(WTR::TestController::setIgnoresViewportScaleLimits):
(WTR::TestController::platformWillRunTest):

WebKitTestRunner/TestController.h:

(WTR::TestController::setShouldDecideNavigationPolicyAfterDelay):

WebKitTestRunner/TestInvocation.cpp:

(WTR::TestInvocation::didReceiveMessageFromInjectedBundle):

WebKitTestRunner/TestOptions.h:
WebKitTestRunner/cocoa/TestControllerCocoa.mm:

(WTR::TestController::platformCreateWebView):

LayoutTests:

fast/viewport/ios/force-always-user-scalable.html:
fast/viewport/ios/user-scalable-does-not-scale-for-keyboard-focus-with-author-defined-scale.html:
fast/viewport/ios/user-scalable-scales-for-keyboard-focus-with-no-author-defined-scale.html:

11:51 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

11:46 AM Changeset in webkit [203074] by fred.wang@free.fr

14 edits
22 adds in trunk

Use parameters from the OpenType MATH table for <munderover>
https://bugs.webkit.org/show_bug.cgi?id=155756

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-11
Reviewed by Brent Fulgham.

Source/WebCore:

We follow the description from the MathML in HTML5 implementation
to improve the layout of <munderover> using some constants from the MATH table.

Tests: imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-1.html

imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-2.html
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-3.html
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-4.html
mathml/presentation/attributes-accent-accentunder-dynamic.html

mathml/mathattrs.in: Add accentunder attribute.
rendering/mathml/MathMLOperatorDictionary.h: Remove FIXME comment.
rendering/mathml/RenderMathMLUnderOver.cpp:

(WebCore::RenderMathMLUnderOver::hasAccent): Helper function to determine whether
the over/under script should be treated as an accent.
(WebCore::RenderMathMLUnderOver::getVerticalParameters): Helper function to read
some vertical parameters from the MATH table.
(WebCore::RenderMathMLUnderOver::layoutBlock): Take into account the new vertical
parameters for the layout of <munderover>.

rendering/mathml/RenderMathMLUnderOver.h: Define new helper functions.

LayoutTests:

Import some tests from the MathML in HTML5 test suite to verify
the layout of the <munderover> element. We also write a test to
verify dynamic change of accent/accentunder attributes and adjust
other tests.

imported/mathml-in-html5/fonts/math/limits-lowerlimitbaselinedropmin3000.woff: Added.
imported/mathml-in-html5/fonts/math/limits-lowerlimitgapmin11000.woff: Added.
imported/mathml-in-html5/fonts/math/limits-upperlimitbaselinerisemin5000.woff: Added.
imported/mathml-in-html5/fonts/math/limits-upperlimitgapmin7000.woff: Added.
imported/mathml-in-html5/fonts/math/stretchstack-bottomshiftdown3000.woff: Added.
imported/mathml-in-html5/fonts/math/stretchstack-gapabovemin7000.woff: Added.
imported/mathml-in-html5/fonts/math/stretchstack-gapbelowmin11000.woff: Added.
imported/mathml-in-html5/fonts/math/stretchstack-topshiftup5000.woff: Added.
imported/mathml-in-html5/fonts/math/underover-accentbaseheight4000-overbarextraascender3000.woff: Added.
imported/mathml-in-html5/fonts/math/underover-accentbaseheight4000-overbarverticalgap11000.woff: Added.
imported/mathml-in-html5/fonts/math/underover-accentbaseheight4000-underbarextradescender5000.woff: Added.
imported/mathml-in-html5/fonts/math/underover-accentbaseheight4000-underbarverticalgap7000.woff: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-1.html: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-2-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-2.html: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-3-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-3.html: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-4-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/scripts/underover-parameters-4.html: Added.
mathml/presentation/attributes-accent-accentunder-dynamic.html: Added.

Test dynamic changes of accent and accentunder.

mathml/presentation/attributes-accent-accentunder-dynamic-expected.html: Added.
mathml/presentation/scripts-underover.html: Remove one of the test since munderover

with an empty script is no longer equivalent to munder or mover.

mathml/presentation/scripts-underover-expected.html: Ditto.
platform/gtk/mathml/opentype/horizontal-expected.png: Updated due to change in

vertical metrics of scripts.

platform/gtk/mathml/opentype/horizontal-expected.txt: Ditto.
platform/gtk/mathml/opentype/horizontal-munderover-expected.png: Ditto.
platform/gtk/mathml/opentype/horizontal-munderover-expected.txt: Ditto.
platform/gtk/mathml/presentation/roots-expected.txt: Udapted due to script baseline fix.
platform/gtk/mathml/presentation/roots-expected.png: ditto.
mathml/presentation/underover-nonstretchy-or-vertical.html: Prevent the <mo> to be treated

as an accent so that we always get the same spacing as the reference. We also use the Ahem
font to make the result more reliable.

11:42 AM Changeset in webkit [203073] by fred.wang@free.fr

4 edits
9 adds in trunk

Use Stack* parameters from the OpenType MATH table
https://bugs.webkit.org/show_bug.cgi?id=155714

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-11
Reviewed by Brent Fulgham.

Source/WebCore:

Test: mathml/mathml-in-html5/frac-parameters-2.html

rendering/mathml/RenderMathMLFraction.cpp:

(WebCore::RenderMathMLFraction::updateFromElement): Set the stack parameters when
the line thickness is zero.
(WebCore::RenderMathMLFraction::layoutBlock): Correctly set the <mfrac> ascent and
the denominator vertical offset when the line thickness is zero.
(WebCore::RenderMathMLFraction::paint): Early return when we actually do not need to
paint any fraction bar.

rendering/mathml/RenderMathMLFraction.h: Define an isStack helper function and define

members corresponding to stack parameters.

LayoutTests:

We import a test from the MathML in HTML5 test suite to verify Stack* parameters.

imported/mathml-in-html5/fonts/math/stack-axisheight7000.woff: Added.
imported/mathml-in-html5/fonts/math/stack-bottomdisplaystyleshiftdown5000.woff: Added.
imported/mathml-in-html5/fonts/math/stack-bottomshiftdown6000.woff: Added.
imported/mathml-in-html5/fonts/math/stack-displaystylegapmin4000.woff: Added.
imported/mathml-in-html5/fonts/math/stack-gapmin8000.woff: Added.
imported/mathml-in-html5/fonts/math/stack-topdisplaystyleshiftup3000.woff: Added.
imported/mathml-in-html5/fonts/math/stack-topshiftup9000.woff: Added.
imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-2-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-2.html: Added.

11:38 AM Changeset in webkit [203072] by fred.wang@free.fr

12 edits
11 adds in trunk

Add support for mathvariants that cannot be emulated via CSS.
https://bugs.webkit.org/show_bug.cgi?id=108778

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-11
Reviewed by Brent Fulgham.

Source/WebCore:

Tests: mathml/mathml-in-html5/mathvariant-transforms-1.html

mathml/mathml-in-html5/mathvariant-transforms-2.html
mathml/presentation/mathvariant-inheritance.html
mathml/presentation/mathvariant-tokens.html

We remove the old code to emulate partial mathvariant support via CSS and add support
for all mathvariant values using the technique used for implicit italic on <mi> element.
We also rely on the MathMLStyle class introduced earlier to support custome MathML style
and manage inheritance of mathvariant values.
The function that tries and converts one base character into a transformed mathvariant
character is based on similar code from Gecko:
http://hg.mozilla.org/mozilla-central/file/tip/layout/generic/MathMLTextRunFactory.cpp
Note that we only support transform on token elements with a single character, which
should cover the most important use cases.

css/mathml.css: Remove the CSS rules to emulate some mathvariant values.

(math[mathvariant="normal"], mstyle[mathvariant="normal"], mo[mathvariant="normal"], mn[mathvariant="normal"], mi[mathvariant="normal"], mtext[mathvariant="normal"], mspace[mathvariant="normal"], ms[mathvariant="normal"]): Deleted.
(math[mathvariant="bold"], mstyle[mathvariant="bold"], mo[mathvariant="bold"], mn[mathvariant="bold"], mi[mathvariant="bold"], mtext[mathvariant="bold"], mspace[mathvariant="bold"], ms[mathvariant="bold"]): Deleted.
(math[mathvariant="italic"], mstyle[mathvariant="italic"], mo[mathvariant="italic"], mn[mathvariant="italic"], mi[mathvariant="italic"], mtext[mathvariant="italic"], mspace[mathvariant="italic"], ms[mathvariant="italic"]): Deleted.
(math[mathvariant="bold-italic"], mstyle[mathvariant="bold-italic"], mo[mathvariant="bold-italic"], mn[mathvariant="bold-italic"], mi[mathvariant="bold-italic"], mtext[mathvariant="bold-italic"], mspace[mathvariant="bold-italic"], ms[mathvariant="bold-italic"]): Deleted.

mathml/MathMLInlineContainerElement.cpp: We resolve mathml style when mathvariant changes.

(WebCore::MathMLInlineContainerElement::parseAttribute):

mathml/MathMLMathElement.cpp: ditto.

(WebCore::MathMLMathElement::parseAttribute):

mathml/MathMLTextElement.cpp: ditto.

(WebCore::MathMLTextElement::parseAttribute):

rendering/mathml/MathMLStyle.cpp: Add mathvariant property to the MathML style.

(WebCore::MathMLStyle::MathMLStyle): Init mathvariant to none.
(WebCore::MathMLStyle::getMathMLStyle): Helper function to retrieve the MathML style on a renderer.
(WebCore::MathMLStyle::updateStyleIfNeeded): Take into account change of mathvariant.
(WebCore::MathMLStyle::parseMathVariant): Helper function to parse a mathvariant attribute.
(WebCore::MathMLStyle::resolveMathMLStyle): Take into account mathvariant value: it is None
by default, inherited and can be modified via an attribute on <math>, <mstyle> or token
elements. We also refactor a bit to share logic between displaystyle and mathvariant.
(WebCore::MathMLStyle::setDisplayStyle): Deleted.

rendering/mathml/MathMLStyle.h: Add mathvariant members and update declarations.
rendering/mathml/RenderMathMLOperator.cpp:

(WebCore::RenderMathMLOperator::updateTokenContent): Call the function from the parent class
to consider mathvariant on <mo>.

rendering/mathml/RenderMathMLToken.cpp:

We implement a mathVariant function to transform a base character into its transformed mathvariant:

There are some regularity that allows to perform this via simple linear transforms.
However, there are also many exceptions and we rely on some sorted MathVariantMapping

tables to handle these cases.
(WebCore::ExtractKey): Helper function to perform binary searches on MathVariant tables.
(WebCore::MathVariantMappingSearch): ditto.
(WebCore::mathVariant): New function to perform mathvariant transforms.
(WebCore::RenderMathMLToken::updateMathVariantGlyph): Use the mathVariant function to
perform all transformations, not just the italic one.
(WebCore::transformToItalic): Deleted. Replaced with the more general mathVariant function.

LayoutTests:

Import a test from the MathML in HTML5 test suite to perform an exhaustive
verification of all the mathvariant transforms allowed.
We also add some tests to verify inheritance of the mathvariant style, the
effect on each token element and dynamic modification of mathvariant.
Finally, we modify one test now that mathvariant is no longer emulated via CSS.

mathml/mathml-in-html5/fonts/mathvariant-transforms.woff: Added.
mathml/mathml-in-html5/mathvariant-transforms-1-expected.html: Added.
mathml/mathml-in-html5/mathvariant-transforms-1.html: Added.
mathml/mathml-in-html5/mathvariant-transforms-2-expected.html: Added.
mathml/mathml-in-html5/mathvariant-transforms-2.html: Added.
mathml/presentation/attributes-mathvariant-expected.html: Update this test now that

mathvariant is correctly implemented using character transforms.

mathml/presentation/mathvariant-inheritance-expected.html: Added.
mathml/presentation/mathvariant-inheritance.html: Added.
mathml/presentation/mathvariant-tokens-expected.html: Added.
mathml/presentation/mathvariant-tokens.html: Added.
mathml/presentation/mathvariant-dynamic.html: Added.
mathml/presentation/mathvariant-dynamic-expected.html: Added.

11:31 AM Changeset in webkit [203071] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking media/controls/inline-elements-dropoff-order.html as failing on El Capitan
https://bugs.webkit.org/show_bug.cgi?id=151287

Unreviewed test gardening.

platform/mac/TestExpectations:

11:08 AM Changeset in webkit [203070] by Konstantin Tokarev

2 edits in trunk/Tools

[GTK] install-dependencies should not install packages built by jhbuild.
https://bugs.webkit.org/show_bug.cgi?id=159628

Reviewed by Michael Catanzaro.

gtk/install-dependencies:

Don't install icu, harfbuzz, orc, llvm, freetype, fontconfig.

11:05 AM Changeset in webkit [203069] by commit-queue@webkit.org

2 edits in trunk/Tools

System proxy settings not used when building deps with jhbuild
https://bugs.webkit.org/show_bug.cgi?id=159567

Patch by Olivier Blin <Olivier Blin> on 2016-07-11
Reviewed by Michael Catanzaro.

This adds the gsettings-desktop-schemas-devel build dep to enable
the libgiognomeproxy.so gio module in glib-networking, which uses
GSettings on org.gnome.system.proxy.
This is needed to query system proxy settings for Gnome desktops.

dconf can be manually added to jhbuild to build the
libdconfsettings.so gio module for GSettings, so that
libgiognomeproxy.so can access system settings.

https://trac.webkit.org/wiki/WebKitGTK/StartHacking#Workingbehindaproxy

As an alternative to dconf settings, this commit also adds the
libproxy-devel build dep to enable the libgiolibproxy.so module in
glib-networking (suggested by Fujii Hironori).

It is useful to read proxy settings from environment variables.
From a Gnome desktop, one may unset the GNOME_DESKTOP_SESSION_ID
environment variable to force using the envvar module in libproxy.

gtk/install-dependencies:

10:46 AM Changeset in webkit [203068] by eric.carlson@apple.com

1 edit
2 adds in trunk/LayoutTests

Add a test for media control dropoff
https://bugs.webkit.org/show_bug.cgi?id=151287
<rdar://problem/23544666>

Unreviewed El Capitan-specific test results after r203057.

platform/mac-elcapitan/media/controls: Added.
platform/mac-elcapitan/media/controls/inline-elements-dropoff-order-expected.txt: Added.
platform/mac-yosemite/media/controls: Added.

10:04 AM Changeset in webkit [203067] by mark.lam@apple.com

6 edits in trunk

Change run-webkit-tests.py and run-jsc-stress-tests to use a smaller JS stack size for testing.
https://bugs.webkit.org/show_bug.cgi?id=159524

Reviewed by Michael Saboff.

Tools:

Forced tests to run with only a 1.5M JS stack size instead of the default 4M.
Also fixed up some tests to behave better to work with this new limit. This
should make stack overflow tests complete sooner.

Scripts/run-jsc-stress-tests:
Scripts/webkitpy/layout_tests/run_webkit_tests.py:

(main):

LayoutTests:

js/dom/deep-recursion-test.html:
js/script-tests/stack-overflow-arrity-catch.js:

(funcWith20Args):

9:33 AM Changeset in webkit [203066] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

Pause small video elements when returning to inline.
https://bugs.webkit.org/show_bug.cgi?id=159535

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-07-11
Reviewed by Jer Noble.

Will add a test in a later commit.

When exiting fullscreen, don't allow playback to continue inline if video is too small.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::isVideoTooSmallForInlinePlayback): Added.
(WebCore::HTMLMediaElement::exitFullscreen): Pause if video is too small.

html/HTMLMediaElement.h:

9:26 AM Changeset in webkit [203065] by nael.ouedraogo@crf.canon.fr

12 edits in trunk/Source/WebCore

toNative functions in JSDOMBinding.h should take an ExecState reference instead of pointer
https://bugs.webkit.org/show_bug.cgi?id=159298

Reviewed by Youenn Fablet.

Pass ExecState by reference instead of pointer.

bindings/js/IDBBindingUtilities.cpp:

(WebCore::idbKeyPathFromValue):

bindings/js/JSBlobCustom.cpp:

(WebCore::constructJSBlob):

bindings/js/JSDOMBinding.h: Pass ExecState by reference instead of pointer.

(WebCore::toJSSequence):
(WebCore::NativeValueTraits<String>::nativeValue):
(WebCore::NativeValueTraits<unsigned>::nativeValue):
(WebCore::NativeValueTraits<float>::nativeValue):
(WebCore::NativeValueTraits<double>::nativeValue):
(WebCore::toNativeArray):
(WebCore::toNativeArguments):

bindings/js/JSDOMConvert.h:

(WebCore::Converter<Vector<T>>::convert):

bindings/js/JSDictionary.cpp:

(WebCore::JSDictionary::convertValue):

bindings/js/JSFileCustom.cpp:

(WebCore::constructJSFile):

bindings/js/JSMessagePortCustom.cpp:

(WebCore::fillMessagePortArray):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateParametersCheck):
(JSValueToNative):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalSequence):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArray):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArrayIsEmpty):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
(WebCore::jsTestObjPrototypeFunctionMethodWithUnsignedLongSequence):
(WebCore::jsTestObjPrototypeFunctionStringArrayFunction):
(WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence):
(WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence2):
(WebCore::jsTestObjPrototypeFunctionStrictFunctionWithSequence):
(WebCore::jsTestObjPrototypeFunctionStrictFunctionWithArray):
(WebCore::jsTestObjPrototypeFunctionVariadicStringMethod):
(WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):

bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

(WebCore::constructJSTestOverloadedConstructors5):

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::jsTestTypedefsPrototypeFunctionFunc):
(WebCore::jsTestTypedefsPrototypeFunctionNullableArrayArg):
(WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction):
(WebCore::jsTestTypedefsPrototypeFunctionStringArrayFunction2):

9:01 AM Changeset in webkit [203064] by achristensen@apple.com

9 edits in trunk/Source

Use refs for ResourceLoaders
https://bugs.webkit.org/show_bug.cgi?id=159592

Reviewed by Chris Dumez.

Source/WebCore:

No new tests. No change in behavior except a fixed memory leak in WebKit1.

loader/LoaderStrategy.h:
loader/ResourceLoader.cpp:

(WebCore::ResourceLoader::finishNetworkLoad):
(WebCore::ResourceLoader::setDefersLoading):
(WebCore::ResourceLoader::frameLoader):
(WebCore::ResourceLoader::willSwitchToSubstituteResource):
(WebCore::ResourceLoader::willSendRequestInternal):

Source/WebKit:

WebCoreSupport/WebResourceLoadScheduler.cpp:

(webResourceLoadScheduler):
(WebResourceLoadScheduler::hostForURL):
(WebResourceLoadScheduler::WebResourceLoadScheduler):
(WebResourceLoadScheduler::loadResource):
(WebResourceLoadScheduler::schedulePluginStreamLoad):
(WebResourceLoadScheduler::scheduleLoad):
(WebResourceLoadScheduler::remove):
(WebResourceLoadScheduler::setDefersLoading):
(WebResourceLoadScheduler::crossOriginRedirectReceived):
(WebResourceLoadScheduler::servePendingRequests):
(WebResourceLoadScheduler::resumePendingRequests):
(WebResourceLoadScheduler::HostInformation::priorityToIndex):
(WebResourceLoadScheduler::HostInformation::schedule):
(WebResourceLoadScheduler::HostInformation::addLoadInProgress):
(WebResourceLoadScheduler::HostInformation::remove):

WebCoreSupport/WebResourceLoadScheduler.h:

(WebResourceLoadScheduler::HostInformation::name):
(WebResourceLoadScheduler::HostInformation::requestsPending):
m_nonHTTPProtocolHost used to be a leaked pointer, and now it's a member variable.

Source/WebKit2:

WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::scheduleInternallyFailedLoad):
(WebKit::WebLoaderStrategy::internallyFailedLoadTimerFired):
(WebKit::WebLoaderStrategy::startLocalLoad):
(WebKit::WebLoaderStrategy::remove):
(WebKit::WebLoaderStrategy::setDefersLoading):
(WebKit::WebLoaderStrategy::crossOriginRedirectReceived):

WebProcess/Network/WebLoaderStrategy.h:

8:55 AM Changeset in webkit [203063] by Michael Catanzaro

2 edits in trunk/Tools

[GTK] Whitespace fixes in install-dependencies script

Unreviewed.

gtk/install-dependencies:

8:54 AM Changeset in webkit [203062] by Michael Catanzaro

2 edits in trunk/Tools

[GTK] Install missing Fedora dependencies

Unreviewed.

gtk/install-dependencies:

8:25 AM Changeset in webkit [203061] by Antti Koivisto

3 edits in trunk/Source/WebKit2

Update stable cache version in NetworkCache::Storage::deleteOldVersions()
https://bugs.webkit.org/show_bug.cgi?id=159618
rdar://problem/26715745

Reviewed by Chris Dumez.

NetworkCache::Storage::deleteOldVersions() keeps the previous shipped cache version (4) for Mac around so
development WebKit doesn’t clobber system Safari cache. Update this to the current version so old caches
go away in customer systems.

NetworkProcess/cache/NetworkCacheStorage.cpp:

(WebKit::NetworkCache::Storage::deleteOldVersions):

NetworkProcess/cache/NetworkCacheStorage.h:

Move lastStableVersion to header next to the current version.

8:08 AM Changeset in webkit [203060] by commit-queue@webkit.org

6 edits in trunk

Using dpi unit in sizes attribute raises SIGSEGV
https://bugs.webkit.org/show_bug.cgi?id=159412

Patch by Fujii Hironori <Fujii Hironori> on 2016-07-11
Reviewed by Darin Adler.

Source/WebCore:

CSSParser::sourceSize returns a invalid CSSParser::SourceSize
whose length is a null value for a dpi unit value. Because
CSSParserValue::createCSSValue returns null for a dpi value.

Tests:

fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html
imported/w3c/web-platform-tests/html/semantics/embedded-content/the-img-element/sizes/parse-a-sizes-attribute.html

css/CSSParser.cpp:

(WebCore::CSSParser::sourceSize): Create a CSSPrimitiveValue of
CSS_UNKNOWN if CSSParserValue::createCSSValue returns null.

LayoutTests:

TestExpectations: Unskip fast/dom/HTMLImageElement/sizes.
fast/dom/HTMLImageElement/sizes/image-sizes-invalids-expected.txt: Updated.
fast/dom/HTMLImageElement/sizes/image-sizes-invalids.html: Added a dpi unit test case.

Renumbering element IDs.

7:52 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

7:44 AM Changeset in webkit [203059] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Red and blue colors are swapped in video rendered through WebGL when GSTREAMER_GL is enabled
https://bugs.webkit.org/show_bug.cgi?id=159621

Patch by Olivier Blin <Olivier Blin> on 2016-07-11
Reviewed by Philippe Normand.

When a video is rendered through WebGL, and GSTREAMER_GL is enabled, red and blue colors are swapped.
This occurs for example with the following videos:
http://www.scirra.com/labs/bugs/webglvideo/
http://www.dailymotion.com/embed/video/x4jiicp?autoplay=1

This is because ImageGStreamerCairo expects video frames in either
BGRA or ARGB, while when GSTREAMER_GL is enabled,
createVideoSinkGL() forces a RGBA format.

Without GSTREAMER_GL, the rendering is fine since
VideoSinkGStreamer uses either BGRA or ARGB.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::MediaPlayerPrivateGStreamerBase::createVideoSinkGL):

7:41 AM Changeset in webkit [203058] by Philippe Normand

7 edits in trunk/Source/WebCore

[GStreamer] remove WEBKIT_DEBUG support
https://bugs.webkit.org/show_bug.cgi?id=159553

Reviewed by Xabier Rodriguez-Calvar.

Remove the *_MEDIA_MESSAGE macros specific to the GStreamer
platform code and replace them with standard GST_DEBUG macros. In
Debug builds the WEBKIT_DEBUG=Media logs now only contain logs
related with the cross-platform Media element code. If GStreamer
logs are needed, the GST_DEBUG=webkit*:5 environment variable can
be used.

platform/graphics/gstreamer/GStreamerUtilities.h:
platform/graphics/gstreamer/InbandTextTrackPrivateGStreamer.cpp:

(WebCore::InbandTextTrackPrivateGStreamer::notifyTrackOfSample):
(WebCore::InbandTextTrackPrivateGStreamer::notifyTrackOfStreamChanged):

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::setAudioStreamProperties):
(WebCore::MediaPlayerPrivateGStreamer::load):
(WebCore::MediaPlayerPrivateGStreamer::commitLoad):
(WebCore::MediaPlayerPrivateGStreamer::playbackPosition):
(WebCore::MediaPlayerPrivateGStreamer::changePipelineState):
(WebCore::MediaPlayerPrivateGStreamer::play):
(WebCore::MediaPlayerPrivateGStreamer::pause):
(WebCore::MediaPlayerPrivateGStreamer::duration):
(WebCore::MediaPlayerPrivateGStreamer::seek):
(WebCore::MediaPlayerPrivateGStreamer::updatePlaybackRate):
(WebCore::MediaPlayerPrivateGStreamer::paused):
(WebCore::MediaPlayerPrivateGStreamer::newTextSample):
(WebCore::MediaPlayerPrivateGStreamer::handleMessage):
(WebCore::MediaPlayerPrivateGStreamer::processBufferingStats):
(WebCore::MediaPlayerPrivateGStreamer::fillTimerFired):
(WebCore::MediaPlayerPrivateGStreamer::maxTimeSeekable):
(WebCore::MediaPlayerPrivateGStreamer::maxTimeLoaded):
(WebCore::MediaPlayerPrivateGStreamer::didLoadingProgress):
(WebCore::MediaPlayerPrivateGStreamer::totalBytes):
(WebCore::MediaPlayerPrivateGStreamer::asyncStateChangeDone):
(WebCore::MediaPlayerPrivateGStreamer::updateStates):
(WebCore::MediaPlayerPrivateGStreamer::loadNextLocation):
(WebCore::MediaPlayerPrivateGStreamer::setDownloadBuffering):
(WebCore::MediaPlayerPrivateGStreamer::createAudioSink):
(WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::MediaPlayerPrivateGStreamerBase::naturalSize):
(WebCore::MediaPlayerPrivateGStreamerBase::setVolume):
(WebCore::MediaPlayerPrivateGStreamerBase::volumeChangedCallback):
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
(WebCore::MediaPlayerPrivateGStreamerBase::createVideoSinkGL):
(WebCore::MediaPlayerPrivateGStreamerBase::setStreamVolumeElement):

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:

(WebCore::MediaPlayerPrivateGStreamerOwr::~MediaPlayerPrivateGStreamerOwr):
(WebCore::MediaPlayerPrivateGStreamerOwr::play):
(WebCore::MediaPlayerPrivateGStreamerOwr::pause):
(WebCore::MediaPlayerPrivateGStreamerOwr::currentTime):
(WebCore::MediaPlayerPrivateGStreamerOwr::load):
(WebCore::MediaPlayerPrivateGStreamerOwr::internalLoad):
(WebCore::MediaPlayerPrivateGStreamerOwr::stop):
(WebCore::MediaPlayerPrivateGStreamerOwr::createGSTAudioSinkBin):
(WebCore::MediaPlayerPrivateGStreamerOwr::trackEnded):
(WebCore::MediaPlayerPrivateGStreamerOwr::trackMutedChanged):
(WebCore::MediaPlayerPrivateGStreamerOwr::trackSettingsChanged):
(WebCore::MediaPlayerPrivateGStreamerOwr::trackEnabledChanged):

platform/graphics/gstreamer/TrackPrivateBaseGStreamer.cpp:

(WebCore::TrackPrivateBaseGStreamer::getLanguageCode):
(WebCore::TrackPrivateBaseGStreamer::getTag):

7:37 AM Changeset in webkit [203057] by eric.carlson@apple.com

6 edits
4 adds in trunk

Add a test for media control dropoff
https://bugs.webkit.org/show_bug.cgi?id=151287
<rdar://problem/23544666>

Reviewed by Antoine Quint.

Source/WebCore:

Test: media/controls/inline-elements-dropoff-order.html

Modules/mediacontrols/mediaControlsApple.js: Expose more state to testing.
testing/InternalSettings.cpp:

(WebCore::InternalSettings::setAllowsAirPlayForMediaPlayback): Renamed from setWirelessPlaybackDisabled.
(WebCore::InternalSettings::setWirelessPlaybackDisabled): Deleted.

testing/InternalSettings.h:
testing/InternalSettings.idl:

LayoutTests:

media/controls/inline-elements-dropoff-order-expected.txt: Added.
media/controls/inline-elements-dropoff-order.html: Added.
platform/mac-yosemite/media/controls: Added.
platform/mac-yosemite/media/controls/inline-elements-dropoff-order-expected.txt: Added.
platform/mac-elcapitan/media/controls: Added.
platform/mac-elcapitan/media/controls/inline-elements-dropoff-order-expected.txt: Added.

7:35 AM Changeset in webkit [203056] by Philippe Normand

5 edits in trunk/Source/WebCore

[GStreamer][GL] crash within triggerRepaint
https://bugs.webkit.org/show_bug.cgi?id=159552

Reviewed by Xabier Rodriguez-Calvar.

Ensure the sizeChanged notification is emitted from the main
thread. When GStreamer-GL rendering is enabled the appsink draw
callbacks are fired in a non-main thread.

The WeakPtr support was moved to the player base class so that it
can be used there as well as in the MediaPlayerPrivateGStreamer
sub-class.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:

(WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):
(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer): Deleted.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:

(WebCore::MediaPlayerPrivateGStreamer::createWeakPtr): Deleted.

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

(WebCore::MediaPlayerPrivateGStreamerBase::createWeakPtr):

2:47 AM Changeset in webkit [203055] by fred.wang@free.fr

5 edits in trunk/LayoutTests

Update expectations for some MathML pixel tests on Windows.

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-11

platform/win/mathml/opentype/vertical-expected.txt:
platform/win/mathml/presentation/mo-stretch-expected.txt:
platform/win/mathml/presentation/roots-expected.txt:
platform/win/mathml/radical-fallback-expected.txt:

2:43 AM Changeset in webkit [203054] by fred.wang@free.fr

5 edits in trunk/LayoutTests

Update expectations for some MathML pixel tests on EFL.

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-11

platform/efl/mathml/opentype/vertical-expected.txt:
platform/efl/mathml/presentation/mo-stretch-expected.txt:
platform/efl/mathml/presentation/roots-expected.txt:
platform/efl/mathml/radical-fallback-expected.txt:

2:28 AM Changeset in webkit [203053] by Yusuke Suzuki

2 edits in trunk/Source/JavaScriptCore

REGRESSION(r202992): JSC varargs tests are broken
https://bugs.webkit.org/show_bug.cgi?id=159616

Reviewed by Csaba Osztrogonác.

The substitution miss in r202992 causes varargs tests failures in GTK port.

jit/SetupVarargsFrame.cpp:

(JSC::emitSetupVarargsFrameFastCase):

12:42 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

12:26 AM Changeset in webkit [203052] by Yusuke Suzuki

2 edits
1 add in trunk/Source/JavaScriptCore

[ES6] Promise.{all,race} no longer use @@species
https://bugs.webkit.org/show_bug.cgi?id=159615

Reviewed by Keith Miller.

As per the latest ES draft, Promise.{all,race} no longer use @@species.
So, this patch drops FIXMEs.

builtins/PromiseConstructor.js:

(all):
(race):

tests/stress/ignore-promise-species.js: Added.

(shouldBe):
(DerivedPromise.prototype.get Symbol):
(DerivedPromise):

Jul 10, 2016:

11:09 PM Changeset in webkit [203051] by bshafiei@apple.com

5 edits in branches/safari-602.1.40-branch/Source

Versioning.

11:05 PM Changeset in webkit [203050] by bshafiei@apple.com

1 copy in tags/Safari-602.1.40.4

New tag.

11:03 PM Changeset in webkit [203049] by bshafiei@apple.com

2 edits in branches/safari-602.1.40-branch/Source/WebKit2

Merged r203044. rdar://problem/27268111

11:01 PM Changeset in webkit [203048] by bshafiei@apple.com

5 edits in branches/safari-602.1.40-branch/Source

Versioning.

10:06 PM Changeset in webkit [203047] by Chris Dumez

14 edits
4 adds in trunk

Setting document.title reuses <title>'s textnode child
https://bugs.webkit.org/show_bug.cgi?id=28864
<rdar://problem/7186473>

Reviewed by Benjamin Poulain.

Source/WebCore:

Setting document.title should be equivalent to setting the 'textContent'
IDL attribute of the <title> element:

https://html.spec.whatwg.org/multipage/dom.html#document.title

In particular, this means we should always create a new Text node and
replace all the <title>'s children with this new Node, as per:

https://dom.spec.whatwg.org/#dom-node-textcontent

Previously, WebKit would in some cases reuse the existing <title>'s
Text node and merely update its data.

Firefox and Chrome behave as per the specification so this aligns our
behavior with other major browsers as well.

Test: fast/dom/title-setter-new-text-node.html

dom/Document.cpp:

(WebCore::Document::setTitle):

Call Node::setTextContent() instead of HTMLTitleElement::setText(), as per the specification.
Take an ExceptionCode parameter and pass it to Node::setTextContent() as it may throw.

dom/Document.h:
dom/Document.idl:

html/HTMLTitleElement.cpp:

(WebCore::HTMLTitleElement::setText):
Update implementation of HTMLTitleElement::setText() to call
setTextContent() as per the specification:

https://html.spec.whatwg.org/multipage/semantics.html#dom-title-text

html/HTMLTitleElement.h:
html/HTMLTitleElement.idl:

html/ImageDocument.cpp:

(WebCore::ImageDocument::finishedParsing):

svg/SVGTitleElement.cpp:
svg/SVGTitleElement.h:

Drop setText() setter which was duplicated from HTMLTitleElement::setText()
now that Document::setTitle() calls SVGTitleElement::setTextContent()
instead.

LayoutTests:

fast/dom/title-setter-new-text-node-expected.txt: Added.
fast/dom/title-setter-new-text-node.html: Added.

Add test coverage.

fast/dom/title-text-property-2-expected.txt:
fast/dom/title-text-property-expected.txt:
http/tests/globalhistory/history-delegate-basic-title-expected.txt:

Rebaseline a few tests now that we do not reuse the <title>'s text
node child.

9:28 PM Changeset in webkit [203046] by commit-queue@webkit.org

7 edits
3 deletes in trunk

Unreviewed, rolling out r203037.
https://bugs.webkit.org/show_bug.cgi?id=159614

The JSC tests are breaking in elcapitan-debug-tests-jsc and
elcapitan-release-tests-jsc (Requested by caiolima on
#webkit).

Reverted changeset:

"ECMAScript 2016: %TypedArray%.prototype.includes
implementation"
https://bugs.webkit.org/show_bug.cgi?id=159385
http://trac.webkit.org/changeset/203037

8:58 PM Changeset in webkit [203045] by Alan Bujtas

4 edits
2 adds in trunk

Fix LogicalSelectionOffsetCaches to work with detached render tree.
https://bugs.webkit.org/show_bug.cgi?id=159605
<rdar://problem/27248845>

Reviewed by Brent Fulgham.

Source/WebCore:

When the renderer that is being destroyed is on a selection boundary,
we need to ensure that all its cached pointers across the selection code (e.g. SelectionSubtreeData)
are getting reset. In order to do that, we call clearSelection() on the RenderView.
One of the last steps of clearing selection is to collect the selection gaps. Selection gaps uses this
LogicalSelectionOffsetCaches helper class to collect selection information across blocks.
LogicalSelectionOffsetCaches normally operates on rooted renderers. However we need to ensure sure that
it can also handle renderers that are no longer part of the render tree.

Test: fast/text/selection-on-a-detached-tree.html

rendering/LogicalSelectionOffsetCaches.h:

(WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::setBlock):
(WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::logicalLeftSelectionOffset):
(WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::logicalRightSelectionOffset):

rendering/RenderBlock.cpp:

(WebCore::RenderBlock::logicalLeftSelectionOffset):
(WebCore::RenderBlock::logicalRightSelectionOffset):

LayoutTests:

fast/text/selection-on-a-detached-tree-expected.txt: Added.
fast/text/selection-on-a-detached-tree.html: Added.

7:52 PM Changeset in webkit [203044] by Beth Dakin

1 edit
1 add in trunk/Source/WebKit2

Update mediaIcon.pdf
https://bugs.webkit.org/show_bug.cgi?id=159613
-and corresponding-
rdar://problem/27268111

Reviewed by Sam Weinig.

Resources/mediaIcon.pdf: Replaced.

4:28 PM Changeset in webkit [203043] by Chris Dumez

3 edits
4 adds in trunk

adoptNode() changes css class to lowercase for document loaded with XHR responseType = "document"
https://bugs.webkit.org/show_bug.cgi?id=159555
<rdar://problem/27252541>

Reviewed by Benjamin Poulain.

Source/WebCore:

Follow-up on r203018 which was incomplete. We need to update ElementData's
m_classNames / m_idForStyleResolution when the source document is in strict
mode and the destination document is in quirks mode as well.

Test: fast/dom/Document/adoptNode-quirks-mismatch2.html

dom/Element.cpp:

(WebCore::Element::didMoveToNewDocument):

LayoutTests:

Add test coverage.

fast/dom/Document/adoptNode-quirks-mismatch2-expected.txt: Added.
fast/dom/Document/adoptNode-quirks-mismatch2.html: Added.
fast/dom/Document/resources/document-noquirks-class.html: Added.
fast/dom/Document/resources/document-noquirks-id.html: Added.

2:46 PM Changeset in webkit [203042] by weinig@apple.com

5 edits in trunk/Source/WebCore

Rename isEmojiModifier to isEmojiFitzpatrickModifier to better capture its function
https://bugs.webkit.org/show_bug.cgi?id=159610

Reviewed by Dan Bernstein.

platform/graphics/FontCascade.cpp:

(WebCore::FontCascade::characterRangeCodePath):

platform/graphics/mac/ComplexTextController.cpp:

(WebCore::advanceByCombiningCharacterSequence):
Update for rename.

platform/text/CharacterProperties.h:

(WebCore::isEmojiGroupCandidate):
(WebCore::isEmojiFitzpatrickModifier):
(WebCore::isVariationSelector):
Rename isEmojiModifier -> isEmojiFitzpatrickModifier. Also add some comments
explaining what the characters these predicate act on to demystify them a bit.

rendering/RenderText.cpp:

(WebCore::RenderText::previousOffsetForBackwardDeletion):
Update for rename and rename a related variable.

11:50 AM Changeset in webkit [203041] by commit-queue@webkit.org

2 edits in trunk/Source/WebKit2

Add self to WebKit2 Owners
https://bugs.webkit.org/show_bug.cgi?id=159499

Patch by Alex Christensen <achristensen@webkit.org> on 2016-07-10
Reviewed by Sam Weinig.

Owners:

11:48 AM Changeset in webkit [203040] by commit-queue@webkit.org

4 edits in trunk/Source

Fix client certificate authentication after r200463
https://bugs.webkit.org/show_bug.cgi?id=159574
<rdar://problem/26931006>

Patch by Alex Christensen <achristensen@webkit.org> on 2016-07-10
Reviewed by Sam Weinig.

Source/WebCore:

No new tests. We really need a test for this

platform/network/cf/CertificateInfo.h:

(WebCore::CertificateInfo::CertificateInfo):
(WebCore::CertificateInfo::trust):
Make sure we only get the trust for Trust type CertificateInfos.
If we mix up our types, we get unexpected nullptrs, which will cause authentication to fail.

Source/WebKit2:

Shared/Authentication/mac/AuthenticationManager.mac.mm:

(WebKit::leafCertificate):
(WebKit::chain):
Handle the different types of CertificateInfos.

10:53 AM Changeset in webkit [203039] by mmaxfield@apple.com

2 edits in trunk/Source/WebCore

Fix Windows build after r203038

Unreviewed.

platform/text/TextAllInOne.cpp:

10:15 AM Changeset in webkit [203038] by mmaxfield@apple.com

43 edits
8 copies
6 moves
6 adds
3 deletes in trunk/Source

Move breaking iterator code to WTF
https://bugs.webkit.org/show_bug.cgi?id=159594

Reviewed by Alex Christensen.

This is in preparation for giving StringView a GraphemeClusters iterator.
Such an interator needs to be implemented on top of our breaking iterator
code.

Source/WebCore:

No new tests because there is no behavior change.

CMakeLists.txt:
PlatformEfl.cmake:
PlatformGTK.cmake:
PlatformMac.cmake:
PlatformWin.cmake:
WebCore.xcodeproj/project.pbxproj:
dom/CharacterData.cpp:
editing/TextCheckingHelper.cpp:
editing/TextIterator.cpp:
editing/VisibleUnits.cpp:
html/HTMLInputElement.cpp:
html/HTMLTextAreaElement.cpp:
html/InputType.cpp:
html/TextFieldInputType.cpp:
html/TextInputType.cpp:
platform/LocalizedStrings.cpp:
platform/graphics/StringTruncator.cpp:
platform/graphics/cg/ColorCG.cpp:

(WTF::RetainPtr<CGColorRef>>::createValueForKey):
(WebCore::RetainPtr<CGColorRef>>::createValueForKey): Deleted.

platform/graphics/mac/ComplexTextController.cpp:
platform/text/LineBreakIteratorPoolICU.h:

(WebCore::LineBreakIteratorPool::LineBreakIteratorPool): Deleted.
(WebCore::LineBreakIteratorPool::sharedPool): Deleted.
(WebCore::LineBreakIteratorPool::makeLocaleWithBreakKeyword): Deleted.
(WebCore::LineBreakIteratorPool::take): Deleted.
(WebCore::LineBreakIteratorPool::put): Deleted.

platform/text/TextBoundaries.cpp:
platform/text/TextBreakIterator.cpp:

(WebCore::initializeIterator): Deleted.
(WebCore::initializeIteratorWithRules): Deleted.
(WebCore::setTextForIterator): Deleted.
(WebCore::setContextAwareTextForIterator): Deleted.
(WebCore::wordBreakIterator): Deleted.
(WebCore::sentenceBreakIterator): Deleted.
(WebCore::cursorMovementIterator): Deleted.
(WebCore::acquireLineBreakIterator): Deleted.
(WebCore::releaseLineBreakIterator): Deleted.
(WebCore::mapLineIteratorModeToRules): Deleted.
(WebCore::isCJKLocale): Deleted.
(WebCore::openLineBreakIterator): Deleted.
(WebCore::closeLineBreakIterator): Deleted.
(WebCore::compareAndSwapNonSharedCharacterBreakIterator): Deleted.
(WebCore::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator): Deleted.
(WebCore::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator): Deleted.
(WebCore::textBreakFirst): Deleted.
(WebCore::textBreakLast): Deleted.
(WebCore::textBreakNext): Deleted.
(WebCore::textBreakPrevious): Deleted.
(WebCore::textBreakPreceding): Deleted.
(WebCore::textBreakFollowing): Deleted.
(WebCore::textBreakCurrent): Deleted.
(WebCore::isTextBreak): Deleted.
(WebCore::isWordTextBreak): Deleted.
(WebCore::numGraphemeClusters): Deleted.
(WebCore::numCharactersInGraphemeClusters): Deleted.

platform/text/TextBreakIterator.h:

(WebCore::LazyLineBreakIterator::LazyLineBreakIterator): Deleted.
(WebCore::LazyLineBreakIterator::~LazyLineBreakIterator): Deleted.
(WebCore::LazyLineBreakIterator::string): Deleted.
(WebCore::LazyLineBreakIterator::isLooseCJKMode): Deleted.
(WebCore::LazyLineBreakIterator::lastCharacter): Deleted.
(WebCore::LazyLineBreakIterator::secondToLastCharacter): Deleted.
(WebCore::LazyLineBreakIterator::setPriorContext): Deleted.
(WebCore::LazyLineBreakIterator::updatePriorContext): Deleted.
(WebCore::LazyLineBreakIterator::resetPriorContext): Deleted.
(WebCore::LazyLineBreakIterator::priorContextLength): Deleted.
(WebCore::LazyLineBreakIterator::get): Deleted.
(WebCore::LazyLineBreakIterator::resetStringAndReleaseIterator): Deleted.
(WebCore::NonSharedCharacterBreakIterator::operator TextBreakIterator*): Deleted.

platform/text/cf/HyphenationCF.cpp:
platform/text/efl/TextBreakIteratorInternalICUEfl.cpp:

(WebCore::currentSearchLocaleID): Deleted.
(WebCore::currentTextBreakLocaleID): Deleted.

platform/text/enchant/TextCheckerEnchant.cpp:
platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp:

(WebCore::currentSearchLocaleID): Deleted.
(WebCore::currentTextBreakLocaleID): Deleted.

platform/text/icu/UTextProvider.cpp:

(WebCore::fixPointer): Deleted.
(WebCore::uTextCloneImpl): Deleted.

platform/text/icu/UTextProvider.h:

(WebCore::uTextProviderContext): Deleted.
(WebCore::initializeContextAwareUTextProvider): Deleted.
(WebCore::uTextAccessPinIndex): Deleted.
(WebCore::uTextAccessInChunkOrOutOfRange): Deleted.

platform/text/icu/UTextProviderLatin1.cpp:

(WebCore::uTextLatin1Clone): Deleted.
(WebCore::uTextLatin1NativeLength): Deleted.
(WebCore::uTextLatin1Access): Deleted.
(WebCore::uTextLatin1Extract): Deleted.
(WebCore::uTextLatin1MapOffsetToNative): Deleted.
(WebCore::uTextLatin1MapNativeIndexToUTF16): Deleted.
(WebCore::uTextLatin1Close): Deleted.
(WebCore::openLatin1UTextProvider): Deleted.
(WebCore::textLatin1ContextAwareGetCurrentContext): Deleted.
(WebCore::textLatin1ContextAwareMoveInPrimaryContext): Deleted.
(WebCore::textLatin1ContextAwareSwitchToPrimaryContext): Deleted.
(WebCore::textLatin1ContextAwareMoveInPriorContext): Deleted.
(WebCore::textLatin1ContextAwareSwitchToPriorContext): Deleted.
(WebCore::uTextLatin1ContextAwareClone): Deleted.
(WebCore::uTextLatin1ContextAwareNativeLength): Deleted.
(WebCore::uTextLatin1ContextAwareAccess): Deleted.
(WebCore::uTextLatin1ContextAwareExtract): Deleted.
(WebCore::uTextLatin1ContextAwareClose): Deleted.
(WebCore::openLatin1ContextAwareUTextProvider): Deleted.

platform/text/icu/UTextProviderUTF16.cpp:

(WebCore::textUTF16ContextAwareGetCurrentContext): Deleted.
(WebCore::textUTF16ContextAwareMoveInPrimaryContext): Deleted.
(WebCore::textUTF16ContextAwareSwitchToPrimaryContext): Deleted.
(WebCore::textUTF16ContextAwareMoveInPriorContext): Deleted.
(WebCore::textUTF16ContextAwareSwitchToPriorContext): Deleted.
(WebCore::uTextUTF16ContextAwareClone): Deleted.
(WebCore::uTextUTF16ContextAwareNativeLength): Deleted.
(WebCore::uTextUTF16ContextAwareAccess): Deleted.
(WebCore::uTextUTF16ContextAwareExtract): Deleted.
(WebCore::uTextUTF16ContextAwareClose): Deleted.
(WebCore::openUTF16ContextAwareUTextProvider): Deleted.

platform/text/mac/TextBoundaries.mm:
platform/text/mac/TextBreakIteratorInternalICUMac.mm:

(WebCore::textBreakLocalePreference): Deleted.
(WebCore::topLanguagePreference): Deleted.
(WebCore::getLocale): Deleted.
(WebCore::getSearchLocale): Deleted.
(WebCore::currentSearchLocaleID): Deleted.
(WebCore::getTextBreakLocale): Deleted.
(WebCore::currentTextBreakLocaleID): Deleted.

platform/text/win/TextBreakIteratorInternalICUWin.cpp:

(WebCore::currentSearchLocaleID): Deleted.
(WebCore::currentTextBreakLocaleID): Deleted.

rendering/RenderBlock.cpp:
rendering/RenderText.cpp:
rendering/RenderText.h:
rendering/SimpleLineLayoutTextFragmentIterator.h:
rendering/break_lines.cpp:
rendering/break_lines.h:
rendering/line/LineBreaker.h:

Source/WTF:

WTF.xcodeproj/project.pbxproj:
icu/unicode/ubrk.h: Added.
icu/unicode/utext.h: Renamed from Source/WebCore/icu/unicode/utext.h.
wtf/CMakeLists.txt:
wtf/PlatformEfl.cmake:
wtf/PlatformGTK.cmake:
wtf/PlatformMac.cmake:
wtf/PlatformWin.cmake:
wtf/TinyLRUCache.h:
wtf/text/LineBreakIteratorPoolICU.h: Renamed from Source/WebCore/platform/text/LineBreakIteratorPoolICU.h.

(WTF::LineBreakIteratorPool::LineBreakIteratorPool):
(WTF::LineBreakIteratorPool::sharedPool):
(WTF::LineBreakIteratorPool::makeLocaleWithBreakKeyword):
(WTF::LineBreakIteratorPool::take):
(WTF::LineBreakIteratorPool::put):

wtf/text/TextBreakIterator.cpp: Renamed from Source/WebCore/platform/text/TextBreakIterator.cpp.

(WTF::initializeIterator):
(WTF::initializeIteratorWithRules):
(WTF::setTextForIterator):
(WTF::setContextAwareTextForIterator):
(WTF::wordBreakIterator):
(WTF::sentenceBreakIterator):
(WTF::cursorMovementIterator):
(WTF::acquireLineBreakIterator):
(WTF::releaseLineBreakIterator):
(WTF::mapLineIteratorModeToRules):
(WTF::isCJKLocale):
(WTF::openLineBreakIterator):
(WTF::closeLineBreakIterator):
(WTF::compareAndSwapNonSharedCharacterBreakIterator):
(WTF::NonSharedCharacterBreakIterator::NonSharedCharacterBreakIterator):
(WTF::NonSharedCharacterBreakIterator::~NonSharedCharacterBreakIterator):
(WTF::textBreakFirst):
(WTF::textBreakLast):
(WTF::textBreakNext):
(WTF::textBreakPrevious):
(WTF::textBreakPreceding):
(WTF::textBreakFollowing):
(WTF::textBreakCurrent):
(WTF::isTextBreak):
(WTF::isWordTextBreak):
(WTF::numGraphemeClusters):
(WTF::numCharactersInGraphemeClusters):

wtf/text/TextBreakIterator.h: Renamed from Source/WebCore/platform/text/TextBreakIterator.h.

(WTF::LazyLineBreakIterator::LazyLineBreakIterator):
(WTF::LazyLineBreakIterator::~LazyLineBreakIterator):
(WTF::LazyLineBreakIterator::string):
(WTF::LazyLineBreakIterator::isLooseCJKMode):
(WTF::LazyLineBreakIterator::lastCharacter):
(WTF::LazyLineBreakIterator::secondToLastCharacter):
(WTF::LazyLineBreakIterator::setPriorContext):
(WTF::LazyLineBreakIterator::updatePriorContext):
(WTF::LazyLineBreakIterator::resetPriorContext):
(WTF::LazyLineBreakIterator::priorContextLength):
(WTF::LazyLineBreakIterator::get):
(WTF::LazyLineBreakIterator::resetStringAndReleaseIterator):
(WTF::NonSharedCharacterBreakIterator::operator TextBreakIterator*):

wtf/text/TextBreakIteratorInternalICU.h: Renamed from Source/WebCore/platform/text/TextBreakIteratorInternalICU.h.
wtf/text/efl/TextBreakIteratorInternalICUEfl.cpp: Renamed from Source/WebCore/platform/text/efl/TextBreakIteratorInternalICUEfl.cpp.

(WebCore::currentSearchLocaleID):
(WebCore::currentTextBreakLocaleID):

wtf/text/gtk/TextBreakIteratorInternalICUGtk.cpp: Renamed from Source/WebCore/platform/text/gtk/TextBreakIteratorInternalICUGtk.cpp.

(WebCore::currentSearchLocaleID):
(WebCore::currentTextBreakLocaleID):

wtf/text/icu/UTextProvider.cpp: Renamed from Source/WebCore/platform/text/icu/UTextProvider.cpp.

(WTF::fixPointer):
(WTF::uTextCloneImpl):

wtf/text/icu/UTextProvider.h: Renamed from Source/WebCore/platform/text/icu/UTextProvider.h.

(WTF::uTextProviderContext):
(WTF::initializeContextAwareUTextProvider):
(WTF::uTextAccessPinIndex):
(WTF::uTextAccessInChunkOrOutOfRange):

wtf/text/icu/UTextProviderLatin1.cpp: Renamed from Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp.

(WTF::uTextLatin1Clone):
(WTF::uTextLatin1NativeLength):
(WTF::uTextLatin1Access):
(WTF::uTextLatin1Extract):
(WTF::uTextLatin1MapOffsetToNative):
(WTF::uTextLatin1MapNativeIndexToUTF16):
(WTF::uTextLatin1Close):
(WTF::openLatin1UTextProvider):
(WTF::textLatin1ContextAwareGetCurrentContext):
(WTF::textLatin1ContextAwareMoveInPrimaryContext):
(WTF::textLatin1ContextAwareSwitchToPrimaryContext):
(WTF::textLatin1ContextAwareMoveInPriorContext):
(WTF::textLatin1ContextAwareSwitchToPriorContext):
(WTF::uTextLatin1ContextAwareClone):
(WTF::uTextLatin1ContextAwareNativeLength):
(WTF::uTextLatin1ContextAwareAccess):
(WTF::uTextLatin1ContextAwareExtract):
(WTF::uTextLatin1ContextAwareClose):
(WTF::openLatin1ContextAwareUTextProvider):

wtf/text/icu/UTextProviderLatin1.h: Renamed from Source/WebCore/platform/text/icu/UTextProviderLatin1.h.
wtf/text/icu/UTextProviderUTF16.cpp: Renamed from Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp.

(WTF::textUTF16ContextAwareGetCurrentContext):
(WTF::textUTF16ContextAwareMoveInPrimaryContext):
(WTF::textUTF16ContextAwareSwitchToPrimaryContext):
(WTF::textUTF16ContextAwareMoveInPriorContext):
(WTF::textUTF16ContextAwareSwitchToPriorContext):
(WTF::uTextUTF16ContextAwareClone):
(WTF::uTextUTF16ContextAwareNativeLength):
(WTF::uTextUTF16ContextAwareAccess):
(WTF::uTextUTF16ContextAwareExtract):
(WTF::uTextUTF16ContextAwareClose):
(WTF::openUTF16ContextAwareUTextProvider):

wtf/text/icu/UTextProviderUTF16.h: Renamed from Source/WebCore/platform/text/icu/UTextProviderUTF16.h.
wtf/text/mac/TextBreakIteratorInternalICUMac.mm: Renamed from Source/WebCore/platform/text/mac/TextBreakIteratorInternalICUMac.mm.

(WTF::textBreakLocalePreference):
(WTF::topLanguagePreference):
(WTF::getLocale):
(WTF::getSearchLocale):
(WTF::currentSearchLocaleID):
(WTF::getTextBreakLocale):
(WTF::currentTextBreakLocaleID):

wtf/text/win/TextBreakIteratorInternalICUWin.cpp: Renamed from Source/WebCore/platform/text/win/TextBreakIteratorInternalICUWin.cpp.

(WebCore::currentSearchLocaleID):
(WebCore::currentTextBreakLocaleID):

1:24 AM Changeset in webkit [203037] by commit-queue@webkit.org

7 edits
3 adds in trunk

ECMAScript 2016: %TypedArray%.prototype.includes implementation
https://bugs.webkit.org/show_bug.cgi?id=159385

Patch by Caio Lima <Caio Lima> on 2016-07-10
Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

This patch implements the ECMAScript 2016:
%TypedArray%.prototype.includes
following spec 22.2.3.14
https://tc39.github.io/ecma262/2016/#sec-%typedarray%.prototype.includes

runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncIncludes):

runtime/JSTypedArrayViewPrototype.cpp:

(JSC::typedArrayViewProtoFuncIncludes):
(JSC::JSTypedArrayViewPrototype::finishCreation):

LayoutTests:

This patch implements test case to ECMAScript 2016:
%TypedArray%.prototype.includes implementation
following spec 22.2.3.14
https://tc39.github.io/ecma262/2016/#sec-%typedarray%.prototype.includes

js/regress/script-tests/typed-array-includes.js: Added.

(assertProperError):
(testIntTypedArray):
(testFloatTypedArray):

js/typed-array-includes-expected.txt: Added.
js/typed-array-includes.html: Added.

1:03 AM Changeset in webkit [203036] by Yusuke Suzuki

42 edits
2 adds in trunk

[GTK] Crash on https://diafygi.github.io/webcrypto-examples with ENABLE_SUBTLE_CRYPTO
https://bugs.webkit.org/show_bug.cgi?id=159189

Reviewed by Michael Catanzaro.

Source/WebCore:

Currently, we explicitly release the pointers of std::unique_ptr<CryptoAlgorithm> and std::unique_ptr<CryptoAlgorithmParameters>,
and delete them in the asynchronously called lambdas. In GnuTLS version, callback function is accidentally called twice,
and it incurs the double free problem.
In SubtleCrypto code, we have the rule that we must not call failureCallback when the error code is filled in synchronous execution.
So we drop the failureCallback calling code in GnuTLS subtle crypto code.

But, rather than carefully handling un-smart-pointer-managed raw pointer's life time, we should use ref counted pointer for that.
Using the raw delete is error-prone.

This patch also changes CryptoAlgorithm and CryptoAlgorithmParameters to RefCounted. And use Ref and RefPtr instead.
The change eliminates the ad-hoc delete code. And now, the lambdas can be called multiple times since once the result of the promise
is resolved or rejected, subsequent resolve / reject calls are ignored.

And this patch also fixes the incorrect call to the lambda that is already WTFMoved.

While we can see several return WTFMove(...), they are necessary since it uses implicit type conversions, like,
Ref<A> => RefPtr<A>, and Ref<Derived> => Ref<Base>.

bindings/js/JSCryptoAlgorithmDictionary.cpp:

(WebCore::createAesCbcParams):
(WebCore::createAesKeyGenParams):
(WebCore::createHmacParams):
(WebCore::createHmacKeyParams):
(WebCore::createRsaKeyGenParams):
(WebCore::createRsaKeyParamsWithHash):
(WebCore::createRsaOaepParams):
(WebCore::createRsaSsaParams):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForEncrypt):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForDecrypt):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForSign):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForVerify):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForDigest):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForGenerateKey):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForDeriveKey):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForDeriveBits):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForImportKey):
(WebCore::JSCryptoAlgorithmDictionary::createParametersForExportKey):

bindings/js/JSCryptoAlgorithmDictionary.h:
bindings/js/JSCryptoKeySerializationJWK.cpp:

(WebCore::createHMACParameters):
(WebCore::createRSAKeyParametersWithHash):
(WebCore::JSCryptoKeySerializationJWK::reconcileAlgorithm):

bindings/js/JSCryptoKeySerializationJWK.h:
bindings/js/JSSubtleCryptoCustom.cpp:

(WebCore::createAlgorithmFromJSValue):
(WebCore::importKey):
(WebCore::JSSubtleCrypto::importKey):
(WebCore::JSSubtleCrypto::wrapKey):
(WebCore::JSSubtleCrypto::unwrapKey):

crypto/CryptoAlgorithm.h:
crypto/CryptoAlgorithmParameters.h:
crypto/CryptoAlgorithmRegistry.cpp:

(WebCore::CryptoAlgorithmRegistry::create):

crypto/CryptoAlgorithmRegistry.h:
crypto/CryptoKeySerialization.h:
crypto/algorithms/CryptoAlgorithmAES_CBC.cpp:

(WebCore::CryptoAlgorithmAES_CBC::create):

crypto/algorithms/CryptoAlgorithmAES_CBC.h:
crypto/algorithms/CryptoAlgorithmAES_KW.cpp:

(WebCore::CryptoAlgorithmAES_KW::create):

crypto/algorithms/CryptoAlgorithmAES_KW.h:
crypto/algorithms/CryptoAlgorithmHMAC.cpp:

(WebCore::CryptoAlgorithmHMAC::create):

crypto/algorithms/CryptoAlgorithmHMAC.h:
crypto/algorithms/CryptoAlgorithmRSAES_PKCS1_v1_5.cpp:

(WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::create):

crypto/algorithms/CryptoAlgorithmRSAES_PKCS1_v1_5.h:
crypto/algorithms/CryptoAlgorithmRSASSA_PKCS1_v1_5.cpp:

(WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::create):

crypto/algorithms/CryptoAlgorithmRSASSA_PKCS1_v1_5.h:
crypto/algorithms/CryptoAlgorithmRSA_OAEP.cpp:

(WebCore::CryptoAlgorithmRSA_OAEP::create):

crypto/algorithms/CryptoAlgorithmRSA_OAEP.h:
crypto/algorithms/CryptoAlgorithmSHA1.cpp:

(WebCore::CryptoAlgorithmSHA1::create):

crypto/algorithms/CryptoAlgorithmSHA1.h:
crypto/algorithms/CryptoAlgorithmSHA224.cpp:

(WebCore::CryptoAlgorithmSHA224::create):

crypto/algorithms/CryptoAlgorithmSHA224.h:
crypto/algorithms/CryptoAlgorithmSHA256.cpp:

(WebCore::CryptoAlgorithmSHA256::create):

crypto/algorithms/CryptoAlgorithmSHA256.h:
crypto/algorithms/CryptoAlgorithmSHA384.cpp:

(WebCore::CryptoAlgorithmSHA384::create):

crypto/algorithms/CryptoAlgorithmSHA384.h:
crypto/algorithms/CryptoAlgorithmSHA512.cpp:

(WebCore::CryptoAlgorithmSHA512::create):

crypto/algorithms/CryptoAlgorithmSHA512.h:
crypto/gnutls/CryptoAlgorithmAES_CBCGnuTLS.cpp:

(WebCore::CryptoAlgorithmAES_CBC::platformEncrypt):
(WebCore::CryptoAlgorithmAES_CBC::platformDecrypt):

crypto/gnutls/CryptoAlgorithmAES_KWGnuTLS.cpp:

(WebCore::CryptoAlgorithmAES_KW::platformEncrypt):
(WebCore::CryptoAlgorithmAES_KW::platformDecrypt):

crypto/gnutls/CryptoAlgorithmHMACGnuTLS.cpp:

(WebCore::CryptoAlgorithmHMAC::platformSign):
(WebCore::CryptoAlgorithmHMAC::platformVerify):

crypto/gnutls/CryptoAlgorithmRSAES_PKCS1_v1_5GnuTLS.cpp:

(WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::platformEncrypt):
(WebCore::CryptoAlgorithmRSAES_PKCS1_v1_5::platformDecrypt):

crypto/gnutls/CryptoAlgorithmRSASSA_PKCS1_v1_5GnuTLS.cpp:

(WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformSign):
(WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformVerify):

crypto/gnutls/CryptoAlgorithmRSA_OAEPGnuTLS.cpp:

(WebCore::CryptoAlgorithmRSA_OAEP::platformEncrypt):
(WebCore::CryptoAlgorithmRSA_OAEP::platformDecrypt):

crypto/keys/CryptoKeySerializationRaw.cpp:

(WebCore::CryptoKeySerializationRaw::reconcileAlgorithm):

crypto/keys/CryptoKeySerializationRaw.h:

LayoutTests:

If you execute the added test with subtle-crypto-enabled GTK environment without this patch, this causes the crash.

crypto/subtle/unimplemented-unwrap-crash-expected.txt: Added.
crypto/subtle/unimplemented-unwrap-crash.html: Added.

Jul 9, 2016:

3:58 PM Changeset in webkit [203035] by rniwa@webkit.org

10 edits in trunk/Websites/perf.webkit.org

Perf dashboard can consume 50-70% of CPU on MacBook even if user is not interacting at all
https://bugs.webkit.org/show_bug.cgi?id=159597

Reviewed by Chris Dumez.

TimeSeriesChart and InteractiveTimeSeriesChart had been relying on continually polling on requestAnimationFrame
to update itself in response to its canvas resizing. Even though there as an early exit in the case there was
nothing to update, this is still causing a significant power drain when the user is not interacting at all.

Let TimeSeriesChart use the regular top-down render path like other components with exceptions of listening to
window's resize eventas well as when new JSONs are fetched from the server. The render() call to the latter case
will be coerced into a single callback on requestAnimationFrame to avoid DOM-mutation-layout churn.

public/v3/components/base.js:

(ComponentBase.isElementInViewport): Deleted.

public/v3/components/chart-pane-base.js:

(ChartPaneBase.prototype.render): Enqueue charts to render.

public/v3/components/chart-styles.js:

(ChartStyles.dashboardOptions): Removed updateOnRequestAnimationFrame which is no longer an available option.

public/v3/components/time-series-chart.js:

(TimeSeriesChart): Replaced the code to register itself for rAF by the code to listen to resize events on window.
(TimeSeriesChart._updateOnRAF): Deleted.
(TimeSeriesChart._updateAllCharts): Added.
(TimeSeriesChart.prototype._enqueueToRender): Added.
(TimeSeriesChart._renderEnqueuedCharts): Added.
(TimeSeriesChart.prototype.fetchMeasurementSets): Avoid calling fetchBetween when the range had been fetched.
Without this change, we can incur a significant number of redundant calls to render() when adjusting the domain
in charts page by the slider. When no new JSON is fetched, simply enqueue this chart to render on rAF.
(TimeSeriesChart.prototype._didFetchMeasurementSet): Enqueue this chart to render on rAF.
(TimeSeriesChart.prototype.render): Removed the check for isElementInViewport since we no longer get render() call
when this chart moves into the viewport (as we no longer listen to every rAF or scroll event).

public/v3/models/measurement-set.js:

(MeasurementSet.prototype.hasFetchedRange): Fixed various bugs revealed by the new use in fetchMeasurementSets.

public/v3/pages/chart-pane-status-view.js:

(ChartPaneStatusView.prototype._updateRevisionListForNewCurrentRepository): Removed the dead code. It was probably
copied from when this code was in InteractiveTimeSeries chart. There is no this._forceRender in this component.

public/v3/pages/dashboard-page.js:

(DashboardPage.prototype.render): Enqueue charts to render.

public/v3/pages/heading.js:

(SummaryPage.prototype.open): Removed the call to isElementInViewport. This wasn't really doing anything useful in
this component.

unit-tests/measurement-set-tests.js: Added tests for hasFetchedRange.

(.waitForMeasurementSet): Moved to be used in a newly added test case.

2:07 PM Changeset in webkit [203034] by fpizlo@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

REGRESSION(201900): validation failure for GetByOffset/PutByOffset in VALIDATE((node), node->child1().node() == node->child2().node()

node->child1()->result() == NodeResultStorage)

https://bugs.webkit.org/show_bug.cgi?id=159603

Reviewed by Keith Miller.

This removes an incorrect validation rule and replaces it with a FIXME about how to make this
aspect of IR easier to validate soundly.

It's not valid to assert that two children of a node are the same. It should always be valid
to take:

Foo(@x, @x)

and turn it into:

a: ValueRep(@x)
b: ValueRep(@x)
Foo(@a, @b)

or even something like:

y: Identity(@y)
Foo(@x, @y)

That's because it should be possible to rewire any data flow edge something that produces an
equivalent value.

The validation rule that this patch removes meant that such rewirings were invalid on
GetByOffset/PutByOffset. FixupPhase did such a rewiring sometimes.

dfg/DFGValidate.cpp:
tests/stress/get-by-offset-double.js: Added.

1:50 PM Changeset in webkit [203033] by keith_miller@apple.com

3 edits
4 adds in trunk

appendMemcpy might fail in concatAppendOne
https://bugs.webkit.org/show_bug.cgi?id=159601
Source/JavaScriptCore:

<rdar://problem/27211300>

Reviewed by Mark Lam.

There are multiple reasons why we might fail appendMemcpy. One
reason, which I suspect was the source of the crashes, is that one
of the Array prototypes has an indexed property. This patch
consolidates the two old cases by just creating an array then
attempting to memcpy append. If that fails, we fall back to
moveElements.

runtime/ArrayPrototype.cpp:

(JSC::concatAppendOne):

tests/stress/concat-with-holesMustForwardToPrototype.js: Added.

(arrayEq):

LayoutTests:

Reviewed by Mark Lam.

Add new microbenchmark testing the performance of concat
when appending one new element. This patch appears to be
about a 13% progression on this test.

js/regress/concat-append-one-expected.txt: Added.
js/regress/concat-append-one.html: Added.
js/regress/script-tests/concat-append-one.js: Added.

(test):

9:23 AM Changeset in webkit [203032] by mitz@apple.com

2 edits in trunk/Tools

Give git-add-reviewer an option to say “Rubber-stamped by” in non-interactive mode
https://bugs.webkit.org/show_bug.cgi?id=159600

Reviewed by Daniel Bates.

Scripts/git-add-reviewer:

Added the -srubber-stamp option.

(nonInteractive): Set the rubberstamp key in the item passed to addReviewer() based on the

new option.

8:47 AM Changeset in webkit [203031] by Antti Koivisto

3 edits in trunk/Source/WebCore

REGRESSION (r202931): breaks release builds with ASSERT_WITH_SECURITY_IMPLICATION for fuzzing
https://bugs.webkit.org/show_bug.cgi?id=159599
rdar://problem/27248835

Reviewed by Chris Dumez.

Make RenderStyle::deletionHasBegun() available with ENABLE(SECURITY_ASSERTIONS)

rendering/style/RenderStyle.cpp:

(WebCore::RenderStyle::~RenderStyle):

rendering/style/RenderStyle.h:

(WebCore::RenderStyle::deletionHasBegun):

8:39 AM Changeset in webkit [203030] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

REGRESSION: manifest.json generation takes multiple seconds on perf dashboard
https://bugs.webkit.org/show_bug.cgi?id=159596

Reviewed by Chris Dumez.

The most of CPU time was spent looking for a duplicate entry in an array of metrics by array_search.
This patch moves to postgres by using aggregate functions in the query. Also moved the code to convert
datetime to UNIX epoch timestamp from PHP to within postgres query.

These improvements reduce total runtime of Manifest::generate from ~4s to ~350ms on my machine.

public/include/manifest.php:

(Manifest::generate): No longer fetches test_configurations table as this is done in Manifest::platforms now.
Also moved calls to each method in the class to separate lines for easier instrumentation.
(Manifest::platforms): Group test configurations (current, baseline, target) by platform and metric.
Use the max of the last modified dates in UNIX epoch timestamps (ms to be compatible with JS's representation).
A given platform, metric pair is considered to be in the v1 dashboard if any test configuration is in.

5:57 AM Changeset in webkit [203029] by commit-queue@webkit.org

6 edits
2 adds in trunk

Make use of PrivateIdentifier to simplify Fetch Headers built-in checks
https://bugs.webkit.org/show_bug.cgi?id=159554

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-09
Reviewed by Alex Christensen.

Source/WebCore:

Test: fetch/header-constructor-overriden.html
Patch does not change visible behavior.

Modules/fetch/FetchHeaders.idl: Adding PrivateIdentifier to the Headers constructor.
Modules/fetch/FetchHeaders.js:

(initializeFetchHeaders): Checking directly with @Headers for improved clarity.

Modules/fetch/FetchResponse.js: Using @Headers to check whether creating a Headers object or not before

passsing it to C++ FetchResponse initialize method.
(initializeFetchResponse):

bindings/js/WebCoreBuiltinNames.h: Adding Headers private name.

LayoutTests:

fetch/header-constructor-overriden-expected.txt: Added.
fetch/header-constructor-overriden.html: Added.

12:33 AM Changeset in webkit [203028] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

[JSC] Fix the Template Raw Value of \ (escape) + LineTerminatorSequence
https://bugs.webkit.org/show_bug.cgi?id=159595

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-07-09
Reviewed by Yusuke Suzuki.

The spec (https://tc39.github.io/ecma262/#sec-static-semantics-tv-and-trv)
says:
"The TRV of LineContinuation::\LineTerminatorSequence is the sequence

consisting of the code unit value 0x005C followed by the code units
of TRV of LineTerminatorSequence."

We were not normalizing the LineTerminatorSequence in that case, but it should
be as it is the TRV of LineTerminatorSequence.

parser/Lexer.cpp:

(JSC::Lexer<T>::parseTemplateLiteral):

tests/stress/tagged-templates-raw-strings.js:

12:03 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

Jul 8, 2016:

11:37 PM Changeset in webkit [203027] by mitz@apple.com

8 copies
1 add in releases/Apple/Safari Technology Preview 8

Added a tag for Safari Technology Preview release 8.

11:37 PM Changeset in webkit [203026] by mitz@apple.com

8 copies
1 add in releases/Apple/Safari Technology Preview 7

Added a tag for Safari Technology Preview release 7.

11:37 PM Changeset in webkit [203025] by mitz@apple.com

8 copies
1 add in releases/Apple/Safari Technology Preview 6

Added a tag for Safari Technology Preview release 6.

11:37 PM Changeset in webkit [203024] by mitz@apple.com

8 copies
1 add in releases/Apple/Safari Technology Preview 5

Added a tag for Safari Technology Preview release 5.

11:37 PM Changeset in webkit [203023] by mitz@apple.com

8 copies
1 add in releases/Apple/Safari Technology Preview 4

Added a tag for Safari Technology Preview release 4.

11:37 PM Changeset in webkit [203022] by mitz@apple.com

8 copies
1 add in releases/Apple/Safari Technology Preview 3

Added a tag for Safari Technology Preview release 3.

11:37 PM Changeset in webkit [203021] by mitz@apple.com

8 copies
1 add in releases/Apple/Safari Technology Preview 2

Added a tag for Safari Technology Preview release 2.

11:35 PM Changeset in webkit [203020] by mitz@apple.com

8 copies
1 add in releases/Apple/Safari Technology Preview 1

Added a tag for Safari Technology Preview release 1.

8:32 PM Changeset in webkit [203019] by rniwa@webkit.org

3 edits in trunk/Websites/perf.webkit.org

bundle-v3-scripts.py should compress HTML/CSS templates
https://bugs.webkit.org/show_bug.cgi?id=159582

Reviewed by Joseph Pecoraro.

Strip leading and trailing whitespaces from HTML and CSS templates. This is a 8% progression on the file size.

Install.md: Updated the list of MIME types to apply deflate for newer versions of Apache.
tools/bundle-v3-scripts.py:

(main):
(compress_template): Added.

7:24 PM Changeset in webkit [203018] by Chris Dumez

4 edits
4 adds in trunk

adoptNode() changes css class to lowercase for document loaded with XHR responseType = "document"
https://bugs.webkit.org/show_bug.cgi?id=159555
<rdar://problem/27252541>

Reviewed by Ryosuke Niwa.

Source/WebCore:

When adopting an Element from another document which has a different quirks mode,
case-sensitivity for id and class attributes differs and we need to correctly
update members such as ElementData::m_classNames or ElementData::m_idForStyleResolution.

To address the issue, have Element override didMoveToNewDocument() and call
attributeChanged() for id and class attributes.

Test: fast/dom/Document/adoptNode-quirks-mismatch.html

dom/Element.cpp:

(WebCore::Element::didMoveToNewDocument):

dom/Element.h:

LayoutTests:

Add test coverage for id and class attributes.

fast/dom/Document/adoptNode-quirks-mismatch-expected.txt: Added.
fast/dom/Document/adoptNode-quirks-mismatch.html: Added.
fast/dom/Document/resources/document-quirks-class.html: Added.
fast/dom/Document/resources/document-quirks-id.html: Added.

7:24 PM Changeset in webkit [203017] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Command-Shift-S in the Styles sidebar should always show the save dialog
https://bugs.webkit.org/show_bug.cgi?id=156858
<rdar://problem/25859098>

Reviewed by Timothy Hatcher.

UserInterface/Views/CSSStyleDeclarationSection.js:

(WebInspector.CSSStyleDeclarationSection):

7:14 PM Changeset in webkit [203016] by dbates@webkit.org

3 edits in trunk/Source/WebCore

Cleanup: Remove use of PassRefPtr from class HTMLTableElement
https://bugs.webkit.org/show_bug.cgi?id=159587

Reviewed by Chris Dumez.

html/HTMLTableElement.cpp:

(WebCore::HTMLTableElement::setCaption): Take a rvalue reference to a RefPtr instead of a PassRefPtr.
(WebCore::HTMLTableElement::setTHead): Take a rvalue reference to a RefPtr instead of a PassRefPtr. Also
fix a style nit; add curly braces around the for-loop body since its body is more than a single line.
(WebCore::HTMLTableElement::createTHead): Use Ref::copyRef() instead of Ref::ptr() to pass the instantiated
table section to better convey that we are passing a copy of the table section.
(WebCore::HTMLTableElement::createCaption): Ditto.

html/HTMLTableElement.h:

6:29 PM Changeset in webkit [203015] by sbarati@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

We may add a ReadOnly property without setting the corresponding bit on Structure
https://bugs.webkit.org/show_bug.cgi?id=159542
<rdar://problem/27084591>

Reviewed by Benjamin Poulain.

The reason this usually is OK is due to happenstance. Often, instances that putDirectWithoutTransition
also happen to have a static property table. Having a static property table causes the
HasReadOnlyOrGetterSetterPropertiesExcludingProto on the structure to be set. However,
there are times where an object calls putDirectWithoutTransition, and it doesn't have a
static property hash table. The fix is simple, putDirectWithTransition needs to set the
HasReadOnlyOrGetterSetterPropertiesExcludingProto if it puts a ReadOnly property.

runtime/JSObject.h:

(JSC::JSObject::putDirectWithoutTransition):

tests/stress/proper-property-store-with-prototype-property-that-is-not-writable.js: Added.

(assert):

5:43 PM Changeset in webkit [203014] by commit-queue@webkit.org

3 edits in trunk/Source/WebKit2

When WKWebView prepares the session state blob, we should be able to filter it.
https://bugs.webkit.org/show_bug.cgi?id=159410

Add a SPI to WKWebView so that a client can decide how to filter backforward items
when WKWebView perparing session state.

Patch by Yongjun Zhang <yongjun_zhang@apple.com> on 2016-07-08
Reviewed by Brady Eidson.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _sessionStateWithFilter:]): When preparing session state, check each
backforward item against the filter block.

UIProcess/API/Cocoa/WKWebViewPrivate.h: Add the SPI _sessionStateWithFilter:

5:28 PM Changeset in webkit [203013] by dbates@webkit.org

4 edits in trunk/Source/WebCore

Move shouldInheritSecurityOriginFromOwner() from URL to Document
https://bugs.webkit.org/show_bug.cgi?id=158987

Reviewed by Alex Christensen.

The URL class should not have knowledge of the concept of an origin or the semantics of origin
inheritance as these are higher level concepts. We should make URL::shouldInheritSecurityOriginFromOwner()
a static non-member, non-friend function of Document because its implements the origin semantics
for a Document object as described in section Origin of the HTML5 spec., <https://html.spec.whatwg.org/multipage/browsers.html#origin> (8 July 2016).
These semantics only apply to Documents.

No functionality changed. So, no new tests.

dom/Document.cpp:

(WebCore::shouldInheritSecurityOriginFromOwner): Added.
(WebCore::Document::initSecurityContext): Modified to call WebCore::shouldInheritSecurityOriginFromOwner().
(WebCore::Document::initContentSecurityPolicy): Ditto.

platform/URL.cpp:

(WebCore::URL::shouldInheritSecurityOriginFromOwner): Deleted.

platform/URL.h:

5:24 PM Changeset in webkit [203012] by msaboff@apple.com

2 edits in trunk/Source/JavaScriptCore

ASSERTION FAILED: Heap::isMarked(cell) in SlotVisitor::appendToMarkStack(JSC::JSCell *)
https://bugs.webkit.org/show_bug.cgi?id=159588

Reviewed by Geoffrey Garen.

We were jettisoning a CodeBlock during GC that won't survive and its owning script
won't survive either. We can't install any code on the owning script as that involves
a write barrier that will "pull" the script back into the remembered set. Badness would
ensue. Added an early return in CodeBlock::jettison() when we are garbage collecting
and the owning script isn't marked.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::jettison):

5:19 PM Changeset in webkit [203011] by dbates@webkit.org

2 edits in trunk/Source/WebCore

Setting table.tFoot or calling table.createTFoot() should append HTML tfont element to the end of the table
https://bugs.webkit.org/show_bug.cgi?id=159583
<rdar://problem/27255292>

In HTMLTableElement::createTFoot() I inadvertently made use of WTFMove() to move the instantiated
HTMLTableSectionElement into the argument passed to setTFoot(). We should use Ref::copyRef() instead
because we want this function to return the instantiated table section.

html/HTMLTableElement.cpp:

(WebCore::HTMLTableElement::createTFoot):

5:15 PM Changeset in webkit [203010] by timothy_horton@apple.com

2 edits in trunk/Source/WebKit2

Mail messages don't start loading until scrolling completes
https://bugs.webkit.org/show_bug.cgi?id=159585
<rdar://problem/27088405>

Reviewed by Andy Estes.

UIProcess/Network/CustomProtocols/mac/CustomProtocolManagerProxyMac.mm:

(-[WKCustomProtocolLoader initWithCustomProtocolManagerProxy:customProtocolID:request:connection:]):
When scrolling, NSDefaultRunLoopMode isn't run, but NSRunLoopCommonModes are.
CFNetwork uses NSDefaultRunLoopMode if we tell NSURLConnection to "start immediately",
but we can instead schedule our NSURLConnection into NSRunLoopCommonModes
and start it ourselves, ensuring that it will be able to do work while scrolling is happening.

5:04 PM Changeset in webkit [203009] by dbates@webkit.org

11 edits in trunk

Setting table.tFoot or calling table.createTFoot() should append HTML tfont element to the end of the table
https://bugs.webkit.org/show_bug.cgi?id=159583
<rdar://problem/27255292>

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

Update expected result now that we append the HTML tfoot element to the end of the table.

web-platform-tests/html/semantics/tabular-data/the-table-element/tFoot-expected.txt:

Source/WebCore:

he HTML standard has long since been revised to describe that assignment to property table.tFoot
or invoking table.createTFoot() will append the HTML tfoot element to the end of the table. This
behavior is defined in <https://html.spec.whatwg.org/multipage/tables.html#dom-table-tfoot> (8 July 2016)
and <https://html.spec.whatwg.org/multipage/tables.html#dom-table-createtfoot> for the property
table.tFoot and table.createTFoot(), respectively. This change makes our behavior match the
behavior in Mozilla Firefox, Microsoft Edge, Microsoft Internet Explorer 8 and later.

html/HTMLTableElement.cpp:

(WebCore::HTMLTableElement::setTFoot): Append <tfoot> to the end of the table. Use RefPtr<>&& instead of PassRefPtr.
(WebCore::HTMLTableElement::createTFoot): Use RefPtr<>&& instead of PassRefPtr.

html/HTMLTableElement.h:

LayoutTests:

Update expected results now that we append the HTML tfoot element to the end of the table.

platform/efl/tables/mozilla/bugs/bug30418-expected.txt:
platform/gtk/tables/mozilla/bugs/bug30418-expected.txt:
platform/ios-simulator/tables/mozilla/bugs/bug30418-expected.txt:
platform/mac/tables/mozilla/bugs/bug30418-expected.txt:
platform/win/tables/mozilla/bugs/bug30418-expected.txt:

4:49 PM Changeset in webkit [203008] by jer.noble@apple.com

3 edits in trunk/Source/WebCore

Crash in layout test /media/video-buffered-range-contains-currentTime.html
https://bugs.webkit.org/show_bug.cgi?id=159109
<rdar://problem/26535750>

Reviewed by Alex Christensen.

Protect against _dataTasks being mutated and accessed on multiple simultaneous threads with a Lock.

platform/network/cocoa/WebCoreNSURLSession.h:
platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession dealloc]):
(-[WebCoreNSURLSession taskCompleted:]):
(-[WebCoreNSURLSession finishTasksAndInvalidate]):
(-[WebCoreNSURLSession invalidateAndCancel]):
(-[WebCoreNSURLSession getTasksWithCompletionHandler:]):
(-[WebCoreNSURLSession getAllTasksWithCompletionHandler:]):
(-[WebCoreNSURLSession dataTaskWithRequest:]):
(-[WebCoreNSURLSession dataTaskWithURL:]):

4:38 PM Changeset in webkit [203007] by bshafiei@apple.com

1 copy in tags/Safari-601.7.7

New tag.

3:58 PM Changeset in webkit [203006] by mark.lam@apple.com

59 edits in trunk/Source/JavaScriptCore

Move CallFrame header info from JSStack.h to CallFrame.h
https://bugs.webkit.org/show_bug.cgi?id=159549

Reviewed by Geoffrey Garen.

CallFrame.h is a much better location for CallFrame header info.

Replaced CallFrame::init() with ExecState::initGlobalExec() because normal
CallFrames are setup by a different mechanism now. Only the globalExec is still
using it. So, might as well change it to be specifically for the globalExec.

Removed the use of JSStack::containsAddress() in ExecState::initGlobalExec()
because it is not relevant to the globalExec.

Also removed some unused code: JSStack::gatherConservativeRoots() and
JSStack::sanitizeStack() is never called for JIT builds.

bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::generateImpl):

bytecode/VirtualRegister.h:

(JSC::VirtualRegister::isValid):
(JSC::VirtualRegister::isLocal):
(JSC::VirtualRegister::isArgument):
(JSC::VirtualRegister::isHeader):
(JSC::VirtualRegister::isConstant):
(JSC::VirtualRegister::toLocal):
(JSC::VirtualRegister::toArgument):

bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitCall):
(JSC::BytecodeGenerator::emitConstruct):

bytecompiler/BytecodeGenerator.h:

(JSC::CallArguments::thisRegister):
(JSC::CallArguments::argumentRegister):
(JSC::CallArguments::stackOffset):
(JSC::CallArguments::argumentCountIncludingThis):
(JSC::CallArguments::argumentsNode):
(JSC::BytecodeGenerator::registerFor):

bytecompiler/NodesCodegen.cpp:

(JSC::emitHomeObjectForCallee):
(JSC::emitGetSuperFunctionForConstruct):
(JSC::CallArguments::CallArguments):

dfg/DFGArgumentsEliminationPhase.cpp:
dfg/DFGArgumentsUtilities.cpp:

(JSC::DFG::argumentsInvolveStackSlot):
(JSC::DFG::emitCodeToGetArgumentsArrayLength):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::get):
(JSC::DFG::ByteCodeParser::findArgumentPositionForLocal):
(JSC::DFG::ByteCodeParser::flush):
(JSC::DFG::ByteCodeParser::addCallWithoutSettingResult):
(JSC::DFG::ByteCodeParser::getArgumentCount):
(JSC::DFG::ByteCodeParser::inlineCall):
(JSC::DFG::ByteCodeParser::handleInlining):
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::handlePutById):
(JSC::DFG::ByteCodeParser::parseBlock):
(JSC::DFG::ByteCodeParser::InlineStackEntry::InlineStackEntry):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGGraph.cpp:

(JSC::DFG::Graph::isLiveInBytecode):

dfg/DFGGraph.h:

(JSC::DFG::Graph::forAllLocalsLiveInBytecode):

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compileEntry):
(JSC::DFG::JITCompiler::compileSetupRegistersForEntry):
(JSC::DFG::JITCompiler::compileFunction):

dfg/DFGJITCompiler.h:

(JSC::DFG::JITCompiler::emitStoreCallSiteIndex):

dfg/DFGOSRAvailabilityAnalysisPhase.cpp:

(JSC::DFG::LocalOSRAvailabilityCalculator::executeNode):

dfg/DFGOSREntry.cpp:

(JSC::DFG::prepareOSREntry):

dfg/DFGOSRExitCompiler.cpp:

(JSC::DFG::OSRExitCompiler::emitRestoreArguments):

dfg/DFGOSRExitCompilerCommon.cpp:

(JSC::DFG::reifyInlinedCallFrames):

dfg/DFGOSRExitCompilerCommon.h:

(JSC::DFG::adjustFrameAndStackInOSRExitCompilerThunk):

dfg/DFGPreciseLocalClobberize.h:

(JSC::DFG::PreciseLocalClobberizeAdaptor::readTop):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::emitGetLength):
(JSC::DFG::SpeculativeJIT::emitGetCallee):
(JSC::DFG::SpeculativeJIT::emitGetArgumentStart):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStackLayoutPhase.cpp:

(JSC::DFG::StackLayoutPhase::run):

dfg/DFGThunks.cpp:

(JSC::DFG::osrEntryThunkGenerator):

ftl/FTLLink.cpp:

(JSC::FTL::link):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):
(JSC::FTL::DFG::LowerDFGToB3::compileGetMyArgumentByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileGetCallee):
(JSC::FTL::DFG::LowerDFGToB3::compileGetArgumentCountIncludingThis):
(JSC::FTL::DFG::LowerDFGToB3::compileGetScope):
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
(JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
(JSC::FTL::DFG::LowerDFGToB3::compileLogShadowChickenPrologue):
(JSC::FTL::DFG::LowerDFGToB3::getArgumentsLength):
(JSC::FTL::DFG::LowerDFGToB3::getCurrentCallee):
(JSC::FTL::DFG::LowerDFGToB3::getArgumentsStart):
(JSC::FTL::DFG::LowerDFGToB3::callPreflight):

ftl/FTLOSRExitCompiler.cpp:

(JSC::FTL::compileStub):

ftl/FTLSlowPathCall.h:

(JSC::FTL::callOperation):

interpreter/CallFrame.cpp:

(JSC::ExecState::initGlobalExec):
(JSC::CallFrame::callSiteBitsAreBytecodeOffset):
(JSC::CallFrame::callSiteAsRawBits):
(JSC::CallFrame::unsafeCallSiteAsRawBits):
(JSC::CallFrame::callSiteIndex):
(JSC::CallFrame::setCurrentVPC):
(JSC::CallFrame::callSiteBitsAsBytecodeOffset):

interpreter/CallFrame.h:

(JSC::CallSiteIndex::CallSiteIndex):
(JSC::ExecState::calleeAsValue):
(JSC::ExecState::callee):
(JSC::ExecState::unsafeCallee):
(JSC::ExecState::codeBlock):
(JSC::ExecState::unsafeCodeBlock):
(JSC::ExecState::scope):
(JSC::ExecState::setCallerFrame):
(JSC::ExecState::setScope):
(JSC::ExecState::argumentCount):
(JSC::ExecState::argumentCountIncludingThis):
(JSC::ExecState::argumentOffset):
(JSC::ExecState::argumentOffsetIncludingThis):
(JSC::ExecState::offsetFor):
(JSC::ExecState::noCaller):
(JSC::ExecState::setArgumentCountIncludingThis):
(JSC::ExecState::setCallee):
(JSC::ExecState::setCodeBlock):
(JSC::ExecState::setReturnPC):
(JSC::ExecState::argIndexForRegister):
(JSC::ExecState::callerFrameAndPC):
(JSC::ExecState::unsafeCallerFrameAndPC):
(JSC::ExecState::init): Deleted.

interpreter/Interpreter.cpp:

(JSC::Interpreter::dumpRegisters):

interpreter/Interpreter.h:

(JSC::calleeFrameForVarargs):

interpreter/JSStack.h:

(JSC::JSStack::containsAddress):
(JSC::JSStack::gatherConservativeRoots): Deleted.
(JSC::JSStack::sanitizeStack): Deleted.

jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::jitAssertArgumentCountSane):
(JSC::AssemblyHelpers::emitRandomThunk):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::restoreReturnAddressBeforeReturn):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeaderPtr):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeader32):
(JSC::AssemblyHelpers::emitGetFromCallFrameHeader64):
(JSC::AssemblyHelpers::emitPutToCallFrameHeader):
(JSC::AssemblyHelpers::emitPutToCallFrameHeaderBeforePrologue):
(JSC::AssemblyHelpers::emitPutPayloadToCallFrameHeaderBeforePrologue):
(JSC::AssemblyHelpers::emitPutTagToCallFrameHeaderBeforePrologue):
(JSC::AssemblyHelpers::calleeFrameSlot):

jit/CCallHelpers.cpp:

(JSC::CCallHelpers::logShadowChickenProloguePacket):

jit/CCallHelpers.h:

(JSC::CCallHelpers::prepareForTailCallSlow):

jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::CallFrameShuffler):
(JSC::CallFrameShuffler::dump):
(JSC::CallFrameShuffler::extendFrameIfNeeded):
(JSC::CallFrameShuffler::prepareForSlowPath):
(JSC::CallFrameShuffler::prepareForTailCall):
(JSC::CallFrameShuffler::prepareAny):

jit/CallFrameShuffler.h:

(JSC::CallFrameShuffler::snapshot):
(JSC::CallFrameShuffler::setCalleeJSValueRegs):
(JSC::CallFrameShuffler::assumeCalleeIsCell):
(JSC::CallFrameShuffler::numLocals):
(JSC::CallFrameShuffler::getOld):
(JSC::CallFrameShuffler::setOld):
(JSC::CallFrameShuffler::firstOld):
(JSC::CallFrameShuffler::lastOld):
(JSC::CallFrameShuffler::isValidOld):
(JSC::CallFrameShuffler::argCount):
(JSC::CallFrameShuffler::getNew):

jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):

jit/JIT.h:
jit/JITCall.cpp:

(JSC::JIT::compileSetupVarargsFrame):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):

jit/JITCall32_64.cpp:

(JSC::JIT::compileSetupVarargsFrame):
(JSC::JIT::compileCallEvalSlowCase):
(JSC::JIT::compileOpCall):

jit/JITInlines.h:

(JSC::JIT::getConstantOperand):
(JSC::JIT::emitPutIntToCallFrameHeader):
(JSC::JIT::updateTopCallFrame):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_get_scope):
(JSC::JIT::emit_op_argument_count):
(JSC::JIT::emit_op_get_rest_length):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileCTINativeCall):
(JSC::JIT::emit_op_get_scope):

jit/JSInterfaceJIT.h:

(JSC::JSInterfaceJIT::emitJumpIfNotType):
(JSC::JSInterfaceJIT::emitGetFromCallFrameHeaderPtr):
(JSC::JSInterfaceJIT::emitPutToCallFrameHeader):
(JSC::JSInterfaceJIT::emitPutCellToCallFrameHeader):

jit/SetupVarargsFrame.cpp:

(JSC::emitSetVarargsFrame):
(JSC::emitSetupVarargsFrameFastCase):

jit/SpecializedThunkJIT.h:

(JSC::SpecializedThunkJIT::SpecializedThunkJIT):

jit/ThunkGenerators.cpp:

(JSC::nativeForGenerator):
(JSC::arityFixupGenerator):
(JSC::boundThisNoArgsFunctionCallGenerator):

llint/LLIntData.cpp:

(JSC::LLInt::Data::performAssertions):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::genericCall):
(JSC::LLInt::varargsSetup):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

runtime/CommonSlowPaths.h:

(JSC::CommonSlowPaths::arityCheckFor):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

runtime/JSGlobalObject.h:
runtime/StackAlignment.h:

(JSC::roundArgumentCountToAlignFrame):
(JSC::roundLocalRegisterCountForFramePointerOffset):
(JSC::logStackAlignmentRegisters):

wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::startFunction):
(JSC::WASMFunctionCompiler::endFunction):
(JSC::WASMFunctionCompiler::boxArgumentsAndAdjustStackPointer):
(JSC::WASMFunctionCompiler::callAndUnboxResult):

wasm/WASMFunctionSyntaxChecker.h:

(JSC::WASMFunctionSyntaxChecker::updateTempStackHeightForCall):

2:06 PM Changeset in webkit [203005] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Prevent fullscreen video dimension state from being reset after configuring.
https://bugs.webkit.org/show_bug.cgi?id=159578

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-07-08
Reviewed by Jer Noble.

This change moves setVideoElement() to after setMediaElement(), since setMediaElement() resets the
mediaState, undoing the configuration done by setVideoElement().

This change is fragile, but minimal. The proper, more comprehinsive fix will come later from
https://bugs.webkit.org/show_bug.cgi?id=159580.

platform/ios/WebVideoFullscreenControllerAVKit.mm:

(WebVideoFullscreenControllerContext::setUpFullscreen):

1:52 PM Changeset in webkit [203004] by Chris Dumez

3 edits
6 adds in trunk

Object.defineProperty() should maintain existing getter / setter if not overridden in the new descriptor
https://bugs.webkit.org/show_bug.cgi?id=159576
<rdar://problem/27242197>

Reviewed by Mark Lam.

Source/JavaScriptCore:

Object.defineProperty() should maintain existing getter / setter if not
overridden in the new descriptor. Previously, if the property is a had
a custom getter / setter, and if the new descriptor only had a setter
(or only a getter), JSC would clear the existing getter (or setter).
This behavior did not match the EcmaScript specification or Firefox /
Chrome. This patch fixes the issue.

This fixes searching and search suggestions on www.iciba.com.

runtime/JSObject.cpp:

(JSC::validateAndApplyPropertyDescriptor):

LayoutTests:

Add test coverage.

js/dom/customAccessor-defineProperty-expected.txt: Added.
js/dom/customAccessor-defineProperty.html: Added.
js/dom/customAccessor-defineProperty_getterOnly-expected.txt: Added.
js/dom/customAccessor-defineProperty_getterOnly.html: Added.
js/dom/customAccessor-defineProperty_setterOnly-expected.txt: Added.
js/dom/customAccessor-defineProperty_setterOnly.html: Added.

1:14 PM Changeset in webkit [203003] by aestes@apple.com

35 edits
20 adds
18 deletes in trunk

[Content Filtering] Load blocked pages more like other error pages are loaded
https://bugs.webkit.org/show_bug.cgi?id=159485
<rdar://problem/26014076>

Reviewed by Brady Eidson.

Source/WebCore:

Content filter blocked pages were being loaded by cancelling the provisional load of the
page that was blocked and then scheduling a navigation to the content filter error page.
Some clients would not expect a new, Web process-initiated provisional navigation to start
after a cancellation, though, and this would put them in a bad state.

This patch changes blocked page loading to behave more like loading other error pages.
Specifically:

didFailProvisionalLoad is dispatched with a new, non-cancellation error code.
The blocked page is loaded immediately after dispatching didFailProvisionalLoad, which prevents FrameLoader from creating a new back-forward list item for the substitute data load.
A substitute data load initiated by the client for the blocked URL is ignored if ContentFilter will display its own error page.
A file: URL is used instead of a custom scheme for the base URL of the blocked page, since some clients expect this.

Updated existing tests to capture frame load delegate callbacks and the back forward list.
Added new API tests: ContentFiltering.LoadAlternate*.

English.lproj/Localizable.strings: Added a WebKitErrorFrameLoadBlockedByContentFilter description.
Resources/ContentFilterBlockedPage.html: Added.
WebCore.xcodeproj/project.pbxproj: Added ContentFilterBlockedPage.html as a frameowrk resource.
loader/ContentFilter.cpp:

(WebCore::ContentFilter::continueAfterWillSendRequest): Protected m_documentLoader,
since it might otherwise be deallocated inside ContentFilter::didDecide() if the load is blocked.
(WebCore::ContentFilter::stopFilteringMainResource): Only set m_state to Stopped if not
already Blocked, so that we don't forget this ContentFilter was blocked when calling
cancelMailResourceLoad() in didDecide().
(WebCore::ContentFilter::continueAfterResponseReceived): Protected m_documentLoader,
since it might otherwise be deallocated inside ContentFilter::didDecide() if the load is blocked.
(WebCore::ContentFilter::continueAfterDataReceived): Ditto.
(WebCore::ContentFilter::continueAfterNotifyFinished): Ditto.
(WebCore::ContentFilter::didDecide): Moved code from DocumentLoader::contentFilterDidBlock() to here.
Created a blockedByContentFilterError() and called cancelMainResourceLoad().
(WebCore::blockedPageURL): Returned a file: URL to ContentFilterBlockedPage.html in WebCore.framework.
(WebCore::ContentFilter::continueAfterSubstituteDataRequest): If the substitute data load
is for the same failingURL as the currently-displayed blocked page, ignore it.
(WebCore::ContentFilter::handleProvisionalLoadFailure): Load the blocked page if m_state is Blocked
and the ResourceError matches the error we used when previously calling cancelMainResourceLoad().
(WebCore::ContentFilter::unblockHandler): Deleted.
(WebCore::ContentFilter::replacementData): Deleted.
(WebCore::ContentFilter::unblockRequestDeniedScript): Deleted.

loader/ContentFilter.h:
loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::contentFilter): Returned m_contentFilter.
(WebCore::DocumentLoader::installContentFilterUnblockHandler): Deleted.
(WebCore::DocumentLoader::contentFilterDidBlock): Deleted.

loader/DocumentLoader.h:
loader/EmptyClients.h: Added a default implementation of blockedByContentFilterError().
loader/FrameLoader.cpp:

(WebCore::FrameLoader::load): If m_loadType was already RedirectWithLockedBackForwardList
and we are loading subsitute data for a failing URL, continue to use RedirectWithLockedBackForwardList.
This prevents a new back-forward list item from being created when loading a blocked page in a subframe.
(WebCore::FrameLoader::checkLoadCompleteForThisFrame):
Called ContentFilter::handleProvisionalLoadFailure() after dispatchDidFailProvisionalLoad().
(WebCore::FrameLoader::blockedByContentFilterError): Called FrameLoaderClient::blockedByContentFilterError().

loader/FrameLoader.h:
loader/FrameLoaderClient.h:
loader/NavigationScheduler.cpp:

(WebCore::ScheduledSubstituteDataLoad::ScheduledSubstituteDataLoad): Deleted.
(WebCore::NavigationScheduler::scheduleSubstituteDataLoad): Deleted.

loader/NavigationScheduler.h:
loader/PolicyChecker.cpp:

(WebCore::PolicyChecker::checkNavigationPolicy): Ignored a substitute data load for a
failing URL if ContentFilter::continueAfterSubstituteDataRequest() returns false.

Source/WebKit/mac:

Misc/WebKitErrors.h: Defined WebKitErrorFrameLoadBlockedByContentFilter.
Misc/WebKitErrors.m:

(registerErrors): Registered WebKitErrorDescriptionFrameLoadBlockedByContentFilter.

WebCoreSupport/WebFrameLoaderClient.h:
WebCoreSupport/WebFrameLoaderClient.mm:

(WebFrameLoaderClient::blockedByContentFilterError): Returned a ResourceError for WebKitErrorFrameLoadBlockedByContentFilter.

Source/WebKit2:

Shared/API/c/WKErrorRef.h: Defined kWKErrorCodeFrameLoadBlockedByContentFilter.
UIProcess/Cocoa/WebProcessProxyCocoa.mm:

(WebKit::WebProcessProxy::platformPathsWithAssumedReadAccess): Added the resource directories
of WebCore.framework and WebKit.framework as paths with assumed read access.

UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::hasAssumedReadAccessToURL): Checked platformPathsWithAssumedReadAccess()
as well as m_localPathsWithAssumedReadAccess.
(WebKit::WebProcessProxy::platformPathsWithAssumedReadAccess): Added a non-Cocoa implementation.

UIProcess/WebProcessProxy.h:
WebProcess/WebCoreSupport/WebErrors.h:
WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::blockedByContentFilterError): Called WebKit::blockedByContentFilterError().

WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
WebProcess/WebCoreSupport/mac/WebErrorsMac.mm:

(WebKit::blockedByContentFilterError): Returned a ResourceError for kWKErrorCodeFrameLoadBlockedByContentFilter.

Tools:

Added API tests for WebView and WKWebView to verify that alternate HTML loaded in response
to a content filtering provisional navigation failure is ignored in preference of
ContentFilter's own error page.

TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig:
TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/ContentFiltering.mm:

(-[LoadAlternateNavigationDelegate webView:didFailProvisionalNavigation:withError:]):
(-[LoadAlternateNavigationDelegate webView:didFinishNavigation:]):
(loadAlternateTest):
(TEST):

TestWebKitAPI/Tests/WebKit2Cocoa/ContentFilteringPlugIn.mm:

(-[MockContentFilterEnabler initWithCoder:]):

TestWebKitAPI/Tests/mac/ContentFiltering.mm: Added.

(-[LoadAlternateFrameLoadDelegate webView:didFailProvisionalLoadWithError:forFrame:]):
(-[LoadAlternateFrameLoadDelegate webView:didFinishLoadForFrame:]):
(TestWebKitAPI::loadAlternateTest):
(TestWebKitAPI::TEST):

LayoutTests:

Changed allow-* and block-* tests from ref tests to text tests so that they can capture
frame load delegate callbacks and the back forward list.

contentfiltering/allow-after-add-data-expected.html: Removed.
contentfiltering/allow-after-add-data-expected.txt: Added.
contentfiltering/allow-after-finished-adding-data-expected.html: Removed.
contentfiltering/allow-after-finished-adding-data-expected.txt: Added.
contentfiltering/allow-after-response-expected.html: Removed.
contentfiltering/allow-after-response-expected.txt: Added.
contentfiltering/allow-after-will-send-request-expected.html: Removed.
contentfiltering/allow-after-will-send-request-expected.txt: Added.
contentfiltering/allow-never-expected.html: Removed.
contentfiltering/allow-never-expected.txt: Added.
contentfiltering/block-after-add-data-expected.html: Removed.
contentfiltering/block-after-add-data-expected.txt: Added.
contentfiltering/block-after-add-data-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-add-data-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-add-data-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-add-data-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-finished-adding-data-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-finished-adding-data-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-response-expected.html: Removed.
contentfiltering/block-after-response-expected.txt: Added.
contentfiltering/block-after-response-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-response-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-response-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-response-then-deny-unblock-expected.txt: Added.
contentfiltering/block-after-will-send-request-expected.html: Removed.
contentfiltering/block-after-will-send-request-expected.txt: Added.
contentfiltering/block-after-will-send-request-then-allow-unblock-expected.html: Removed.
contentfiltering/block-after-will-send-request-then-allow-unblock-expected.txt: Added.
contentfiltering/block-after-will-send-request-then-deny-unblock-expected.html: Removed.
contentfiltering/block-after-will-send-request-then-deny-unblock-expected.txt: Added.
contentfiltering/block-never-expected.html: Removed.
contentfiltering/block-never-expected.txt: Added.
contentfiltering/resources/contentfiltering.js: Added testRunner calls to dump as text,

dump frame load callbacks, and dump the back forward list. Changed from loading data: URLs
to file: URLs in the test iframe.

12:40 PM Changeset in webkit [203002] by mmaxfield@apple.com

5 edits
2 adds in trunk

[Font Loading] The callback passed to document.fonts.ready should always be called
https://bugs.webkit.org/show_bug.cgi?id=158884

Reviewed by Dean Jackson.

Source/WebCore:

The boolean was simply not being reset when loads start.

Test: fast/text/font-face-set-ready-fire.html

css/FontFaceSet.cpp:

(WebCore::FontFaceSet::startedLoading):

css/FontFaceSet.h:

LayoutTests:

TestExpectations:
fast/text/font-face-set-ready-fire-expected.txt: Added.
fast/text/font-face-set-ready-fire.html: Added.

12:01 PM Changeset in webkit [203001] by andersca@apple.com

2 edits in trunk/Source/WebKit2

Fix 32-bit build.

PluginProcess/mac/PluginProcessShim.mm:

11:56 AM Changeset in webkit [203000] by msaboff@apple.com

3 edits in trunk/Source/JavaScriptCore

Dumping the object graph doesn't work with verbose GC logging
https://bugs.webkit.org/show_bug.cgi?id=159569

Reviewed by Mark Lam.

The current object graph logging code tries to revisits the graph. This doesn't work
correctly and asking around it isn't used. The only way to dump the true object graph
is to log while we GC and that has obvious performance implications.
Therefore I eliminated GCLogging::dumpObjectGraph() and related code.

heap/GCLogging.cpp:

(JSC::GCLogging::levelAsString):
(JSC::LoggingFunctor::LoggingFunctor): Deleted.
(JSC::LoggingFunctor::~LoggingFunctor): Deleted.
(JSC::LoggingFunctor::operator()): Deleted.
(JSC::LoggingFunctor::log): Deleted.
(JSC::LoggingFunctor::reviveCells): Deleted.
(JSC::LoggingFunctor::returnValue): Deleted.
(JSC::GCLogging::dumpObjectGraph): Deleted.

heap/Heap.cpp:

(JSC::Heap::didFinishCollection):

11:52 AM Changeset in webkit [202999] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline fast/shadow-dom/trusted-event-scoped-flags.html for ios-simulator after r202953.

Unreviewed test gardening.

platform/ios-simulator/fast/shadow-dom/trusted-event-scoped-flags-expected.txt:

11:52 AM Changeset in webkit [202998] by andersca@apple.com

4 edits in trunk/Source/WebKit2

REGRESSION (r196321): Adobe Reader DC + Safari : Zoom level pulldown is not displayed at the correct position
https://bugs.webkit.org/show_bug.cgi?id=159531
rdar://problem/26382579

Reviewed by Tim Horton.

There's code in the Adobe Acrobat framework that checks if the main bundle identifier is "com.apple.WebKit.PluginProcess"
and assumes that it's running inside the Adobe Reader app if it's something else. Since we're now using the XPC service
for all plug-ins, the bundle identifier is "com.apple.WebKit.Plugin.64", so the Acrobat framework assumes it's running in the app
and doesn't use any special tricks to show the popup menu.

Work around this by shimming CFStringCompare, and looking for the exact conditions when this can happen and return kCFCompareEqualTo
when all conditions are true.

PluginProcess/mac/PluginProcessMac.mm:

(WebKit::isAdobeAcrobatAddress):
(WebKit::stringCompare):
(WebKit::initializeShim):
(WebKit::PluginProcess::platformInitializeProcess):

PluginProcess/mac/PluginProcessShim.h:
PluginProcess/mac/PluginProcessShim.mm:

(WebKit::shimCFStringCompare):

11:48 AM Changeset in webkit [202997] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

speculateTypedArrayIsNotNeutered has an inverted speculation
https://bugs.webkit.org/show_bug.cgi?id=159571

Reviewed by Mark Lam.

For some confusing reason FTLLowerDFGToB3 takes the condition the
speculation wants to be false. This issue caused
typedarray-access-monomorphic-neutered.js to fail on the bots.

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):

11:34 AM Changeset in webkit [202996] by beidson@apple.com

2 edits in trunk/Source/WebKit2

Unreviewed: Fix case-sensitive filesystem build.

UIProcess/Storage/LocalStorageDatabaseTracker.cpp:

11:22 AM Changeset in webkit [202995] by commit-queue@webkit.org

35 edits
18 adds
20 deletes in trunk

Unreviewed, rolling out r202944.
https://bugs.webkit.org/show_bug.cgi?id=159570

caused some tests to crash under GuardMalloc (Requested by
estes on #webkit).

Reverted changeset:

"[Content Filtering] Load blocked pages more like other error
pages are loaded"
https://bugs.webkit.org/show_bug.cgi?id=159485
http://trac.webkit.org/changeset/202944

11:01 AM Changeset in webkit [202994] by jdiggs@igalia.com

4 edits in trunk/LayoutTests

AX: Eliminate test noise from roles-computedRoleString.html
https://bugs.webkit.org/show_bug.cgi?id=159563

Reviewed by Chris Fleizach.

Ensure we hide all the content, as the test intends to do.

accessibility/roles-computedRoleString-expected.txt: Updated.
accessibility/roles-computedRoleString.html: Updated.
platform/gtk/accessibility/roles-computedRoleString-expected.txt: Updated.

10:54 AM Changeset in webkit [202993] by Keith Rollin

4 edits in trunk/Source/WebKit2

Add always-on logging for downloads
https://bugs.webkit.org/show_bug.cgi?id=159521
<rdar://problem/26630645>

Reviewed by Alex Christensen.

Add logging statements that track when a download starts, when it
first receives data, and when the download is done (due to completion,
cancelation, or failure).

NetworkProcess/Downloads/Download.cpp:

(WebKit::Download::Download):
(WebKit::Download::didReceiveResponse):
(WebKit::Download::didReceiveData):
(WebKit::Download::didFinish):
(WebKit::Download::didFail):
(WebKit::Download::didCancel):
(WebKit::Download::isAlwaysOnLoggingAllowed):

NetworkProcess/Downloads/Download.h:

(WebKit::Download::Download):

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:dataTask:didBecomeDownloadTask:]):

10:54 AM Changeset in webkit [202992] by mark.lam@apple.com

16 edits in trunk/Source/JavaScriptCore

Rename jsCPUStackLimit to osStackLimitWithReserve and jsEmulatedStackLimit to cloopStackLimit.
https://bugs.webkit.org/show_bug.cgi?id=159544

Reviewed by Geoffrey Garen.

This patch does the following refactoring:

Rename jsCPUStackLimit to osStackLimitWithReserve.
Rename jsEmulatedStackLimit to cloopStackLimit.
Remove llintStackLimit (which previously is either an alias for jsCPUStackLimit or jsEmulatedStackLimit depending on whether we have a JIT or C Loop build). Instead, we'll change the LLINT to conditionally use the osStackLimitWithReserve or cloopStackLimit.

There are no semantic changes.

dfg/DFGJITCompiler.cpp:

(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::lower):

interpreter/JSStack.cpp:

(JSC::JSStack::JSStack):
(JSC::JSStack::growSlowCase):
(JSC::JSStack::lowAddress):
(JSC::JSStack::highAddress):

interpreter/JSStack.h:
interpreter/JSStackInlines.h:

(JSC::JSStack::ensureCapacityFor):
(JSC::JSStack::shrink):
(JSC::JSStack::grow):
(JSC::JSStack::setCLoopStackLimit):
(JSC::JSStack::setJSEmulatedStackLimit): Deleted.

jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):

jit/SetupVarargsFrame.cpp:

(JSC::emitSetupVarargsFrameFastCase):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/RegExp.cpp:

(JSC::RegExp::finishCreation):
(JSC::RegExp::compile):
(JSC::RegExp::compileMatchOnly):

runtime/VM.cpp:

(JSC::VM::updateStackLimit):

runtime/VM.h:

(JSC::VM::reservedZoneSize):
(JSC::VM::osStackLimitWithReserve):
(JSC::VM::addressOfOSStackLimitWithReserve):
(JSC::VM::cloopStackLimit):
(JSC::VM::setCLoopStackLimit):
(JSC::VM::isSafeToRecurse):
(JSC::VM::jsCPUStackLimit): Deleted.
(JSC::VM::addressOfJSCPUStackLimit): Deleted.
(JSC::VM::jsEmulatedStackLimit): Deleted.
(JSC::VM::setJSEmulatedStackLimit): Deleted.

wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::startFunction):

10:52 AM Changeset in webkit [202991] by commit-queue@webkit.org

2 edits in trunk/Tools

Remove mrobinson from the MathML watchlist
https://bugs.webkit.org/show_bug.cgi?id=159559

Patch by Martin Robinson <mrobinson@igalia.com> on 2016-07-08
Reviewed by Philippe Normand.

Scripts/webkitpy/common/config/watchlist: Remove my email from the watchlist.

10:48 AM Changeset in webkit [202990] by bshafiei@apple.com

1 copy in tags/Safari-602.1.40.3

New tag.

10:45 AM Changeset in webkit [202989] by bshafiei@apple.com

7 edits in branches/safari-602.1.40-branch/Source

Merged r202987. rdar://problem/27244394

10:42 AM Changeset in webkit [202988] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking some mathml tests as timeouts after r202983.

Unreviewed test gardening.

TestExpectations:

10:17 AM Changeset in webkit [202987] by commit-queue@webkit.org

7 edits in trunk/Source

Unreviewed, rolling out r202799.
https://bugs.webkit.org/show_bug.cgi?id=159568

Caused build failure (Requested by perarne on #webkit).

Reverted changeset:

"[Win] DLLs are missing version information."
https://bugs.webkit.org/show_bug.cgi?id=159349
http://trac.webkit.org/changeset/202799

10:15 AM Changeset in webkit [202986] by commit-queue@webkit.org

15 edits in trunk/Source/JavaScriptCore

Built-in generator should generate files with a default copyright
https://bugs.webkit.org/show_bug.cgi?id=159561

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-08
Reviewed by Alex Christensen.

Scripts/builtins/builtins_model.py:

(BuiltinsCollection._parse_copyright_lines): Adding default copyright to the parsed copyrights.

Scripts/builtins/builtins_templates.py:

(BuiltinsGeneratorTemplates): Adding a default copyright.

Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Combined.js-result: Rebasing with added default copyright.
Scripts/tests/builtins/expected/JavaScriptCore-Builtin.Promise-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Combined.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-Builtin.prototype-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Combined.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-BuiltinConstructor-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/JavaScriptCore-InternalClashingNames-Combined.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Ditto.

10:11 AM Changeset in webkit [202985] by Antti Koivisto

3 edits
3 adds in trunk

Regression(r201805): Crash with <use> resource that has Vary header
https://bugs.webkit.org/show_bug.cgi?id=159560
<rdar://problem/27034208>

Reviewed by Chris Dumez.

Source/WebCore:

In some situations (SVG <use> element for example) we may try to load resources from frameless documents.
Such loads always fail. The new vary header verification code path tried to access the frame earlier without
null check.

Test: http/tests/cache/vary-frameless-document.html

loader/cache/CachedResource.cpp:

(WebCore::CachedResource::failBeforeStarting):
(WebCore::addAdditionalRequestHeadersToRequest):

Null check frame.
Also move the resource type check here so all callers get the same behavior.

(WebCore::CachedResource::addAdditionalRequestHeaders):
(WebCore::CachedResource::load):
(WebCore::CachedResource::varyHeaderValuesMatch):

LayoutTests:

http/tests/cache/resources/svg-defs-vary.php: Added.
http/tests/cache/vary-frameless-document-expected.txt: Added.
http/tests/cache/vary-frameless-document.html: Added.

10:03 AM Changeset in webkit [202984] by beidson@apple.com

7 edits
2 adds in trunk

Clearing LocalStorage doesn't also delete -wal and -shm files.
<rdar://problem/27206772> and https://bugs.webkit.org/show_bug.cgi?id=159566

Reviewed by Brent Fulgham.
Also helpfully picked over by Andy "Never Forgets" Estes.

Source/WebCore:

Covered by new API test.

WebCore.xcodeproj/project.pbxproj:

platform/sql/SQLiteFileSystem.h:

Source/WebKit2:

UIProcess/Storage/LocalStorageDatabaseTracker.cpp:

(WebKit::LocalStorageDatabaseTracker::removeDatabaseWithOriginIdentifier):

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/LocalStorageClear.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/LocalStorageClear.mm: Added.

9:42 AM Changeset in webkit [202983] by Ryan Haddad

4 edits
2 deletes in trunk

Unreviewed, rolling out r202945.
https://bugs.webkit.org/show_bug.cgi?id=159565

The test for this change is failing on all platforms.
(Requested by ryanhaddad on #webkit).

Reverted changeset:

"[Font Loading] The callback passed to document.fonts.ready
should always be called"
https://bugs.webkit.org/show_bug.cgi?id=158884
http://trac.webkit.org/changeset/202945

Patch by Commit Queue <commit-queue@webkit.org> on 2016-07-08

9:27 AM Changeset in webkit [202982] by keith_miller@apple.com

16 edits
3 adds in trunk

TypedArrays need more isNeutered checks.
https://bugs.webkit.org/show_bug.cgi?id=159231

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

According to the ES6 spec if a user tries to get, set, or define a
property on a neutered TypedArray we should throw an
exception. Currently, if a user tries to get an out of bounds
access on a TypedArray we will always OSR. This makes handling
the exception easy as all we need to do is make out of bounds gets
in PolymorphicAccess go to the slow path, which will then throw
the appropriate exception. For the case of set, we need ensure we
don't OSR on each out of bounds put since, for some confusing
reason, people do this. Thus, for GetByVal in the DFG/FTL if the
user accesses out of bounds we then need to check if the view has
been neutered. If it is neutered then we will OSR.

Additionally, this patch adds a bunch of isNeutered checks to
various prototype functions for TypedArray, which are needed for
correctness.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
(JSC::DFG::SpeculativeJIT::compilePutByValForIntTypedArray):
(JSC::DFG::SpeculativeJIT::compilePutByValForFloatTypedArray):

dfg/DFGSpeculativeJIT.h:
ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::speculateTypedArrayIsNotNeutered):

jit/JITPropertyAccess.cpp:

(JSC::JIT::emitIntTypedArrayPutByVal):
(JSC::JIT::emitFloatTypedArrayPutByVal):

runtime/JSArrayBufferView.h:
runtime/JSCJSValue.h:

(JSC::encodedJSUndefined):
(JSC::encodedJSValue):

runtime/JSGenericTypedArrayView.h:
runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::throwNeuteredTypedArrayTypeError):
(JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlot):
(JSC::JSGenericTypedArrayView<Adaptor>::put):
(JSC::JSGenericTypedArrayView<Adaptor>::defineOwnProperty):
(JSC::JSGenericTypedArrayView<Adaptor>::deleteProperty):
(JSC::JSGenericTypedArrayView<Adaptor>::getOwnPropertySlotByIndex):
(JSC::JSGenericTypedArrayView<Adaptor>::putByIndex):
(JSC::JSGenericTypedArrayView<Adaptor>::deletePropertyByIndex):

runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncCopyWithin):
(JSC::genericTypedArrayViewProtoFuncFill):
(JSC::genericTypedArrayViewProtoFuncIndexOf):
(JSC::genericTypedArrayViewProtoFuncJoin):
(JSC::genericTypedArrayViewProtoFuncLastIndexOf):
(JSC::genericTypedArrayViewProtoFuncSlice):
(JSC::genericTypedArrayViewProtoFuncSubarray):

tests/stress/fold-typed-array-properties.js:
tests/stress/typedarray-access-monomorphic-neutered.js: Added.

(check):
(test):
(testFTL):

tests/stress/typedarray-access-neutered.js: Added.

(check):
(test):

tests/stress/typedarray-functions-with-neutered.js:

(defaultForArg):
(callWithArgs):
(checkArgumentsForType):
(checkArguments):

tests/stress/typedarray-view-string-properties-neutered.js: Added.

(call):
(test):

LayoutTests:

Update tests that assert that we can access indexed properties on
a neutered TypedArray.

fast/canvas/webgl/script-tests/arraybuffer-transfer-of-control.js:

(assertViewClosed):

js/dom/dfg-typed-array-neuter-expected.txt:
js/dom/script-tests/dfg-typed-array-neuter.js:

8:52 AM Changeset in webkit [202981] by nael.ouedraogo@crf.canon.fr

15 edits in trunk/Source/WebCore

ExecState should be passed by reference in JS bindings generator for custom constructors
https://bugs.webkit.org/show_bug.cgi?id=159357

Reviewed by Youenn Fablet.

Pass ExecState as a reference instead of pointer in JS bindings
code for custom constructors.

bindings/js/JSAudioContextCustom.cpp:

(WebCore::constructJSAudioContext):

bindings/js/JSBlobCustom.cpp:

(WebCore::constructJSBlob):

bindings/js/JSDOMFormDataCustom.cpp:

(WebCore::constructJSDOMFormData):
(WebCore::JSDOMFormData::append):

bindings/js/JSDataCueCustom.cpp:

(WebCore::constructJSDataCue):

bindings/js/JSFileCustom.cpp:

(WebCore::constructJSFile):

bindings/js/JSHTMLElementCustom.cpp:

(WebCore::constructJSHTMLElement):

bindings/js/JSMediaSessionCustom.cpp:

(WebCore::constructJSMediaSession):

bindings/js/JSMutationObserverCustom.cpp:

(WebCore::constructJSMutationObserver):

bindings/js/JSReadableStreamPrivateConstructors.cpp:

(WebCore::constructJSReadableStreamController):
(WebCore::constructJSReadableStreamReader):

bindings/js/JSWebKitPointCustom.cpp:

(WebCore::constructJSWebKitPoint):

bindings/js/JSWorkerCustom.cpp:

(WebCore::constructJSWorker):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateConstructorDefinition):

bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:

(WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::construct):

bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:

8:48 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

8:48 AM Changeset in webkit [202980] by Chris Dumez

7 edits in trunk

Expose crossOrigin attribute as a static property in HTMLMediaElement
https://bugs.webkit.org/show_bug.cgi?id=159459

Patch by Olivier Blin <Olivier Blin> on 2016-07-08
Reviewed by Chris Dumez.

The crossOrigin attribute is already used for MediaResourceLoader
(r119742 and r175050), but it was not exposed as a static property.

This fixes VR360 support in Dailymotion, since it uses the "in"
operator to detect if crossOrigin is supported by the
HTMLVideoElement, in order to enable VR360.

No new tests, rebaselined existing tests, 150 WPT tests are fixed.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setCrossOrigin):
(WebCore::HTMLMediaElement::crossOrigin):

html/HTMLMediaElement.h:
html/HTMLMediaElement.idl:

8:30 AM Changeset in webkit [202979] by fred.wang@free.fr

14 edits
13 adds in trunk

Use Fraction* parameters from the OpenType MATH table
https://bugs.webkit.org/show_bug.cgi?id=155639

Source/WebCore:

Patch by Frederic Wang <fwang@igalia.com> on 2016-03-20
Reviewed by Brent Fulgham.

We improve the RenderMathMLFraction so minimal vertical shifts and gaps
from the MATH table (or arbitrary fallback) are used for fractions.
We also change the interpretation of "thick" and "thin" linethickness values
to match Gecko's behavior and the one suggested in the MathML in HTML5 implementation note.

Test: imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-1.html

rendering/mathml/MathMLStyle.cpp:

(WebCore::MathMLStyle::updateStyleIfNeeded): set NeedsLayout after displaystyle change
so that dynamic MathML tests still work.

rendering/mathml/RenderMathMLFraction.cpp:

(WebCore::RenderMathMLFraction::RenderMathMLFraction): Init LayoutUnit members to zero.
(WebCore::RenderMathMLFraction::updateFromElement):
Set new members for fraction gaps and shifts using Fraction* constants or some fallback
values. Change the interpretation of "thick" and "thin".
(WebCore::RenderMathMLFraction::layoutBlock): Use new constants affecting vertical
positions of numerator and denominator.
(WebCore::RenderMathMLFraction::paint): Use m_ascent to set the vertical position
of the fraction bar.
(WebCore::RenderMathMLFraction::firstLineBaseline): We just return m_ascent.

rendering/mathml/RenderMathMLFraction.h: Make updateFromElement public so that

it can be used in MathMLStyle. Add LayoutUnit members for the ascent of the fraction
and for minimal shifts/gaps values.

LayoutTests:

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-08
Reviewed by Brent Fulgham.

We import a test from the MathML in HTML5 test suite to verify Fraction* parameters.
We also do some small test adjustments.

TestExpectations: We disable fractions-positions.html for now until it is replaced with a more reliable test.
imported/mathml-in-html5/fonts/math/fraction-axisheight7000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-denominatordisplaystylegapmin5000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-denominatordisplaystyleshiftdown6000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-denominatorgapmin4000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-denominatorshiftdown3000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-numeratordisplaystylegapmin8000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-numeratordisplaystyleshiftup2000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-numeratorgapmin9000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-numeratorshiftup11000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/math/fraction-rulethickness10000.woff: Added.
imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/fractions/frac-parameters-1.html: Added.
mathml/presentation/fractions-linethickness-expected.html: Adjust the test to interpret

"thick" and "thin" as suggested the MathML in HTML5 implementation note.

mathml/presentation/stretchy-depth-height-symmetric.html: Increase error tolerance.
platform/gtk/mathml/presentation/roots-expected.png: Handle small rendering changes.
platform/gtk/mathml/presentation/roots-expected.txt: Ditto.
platform/ios-simulator/mathml/presentation/roots-expected.txt: Ditto.
platform/mac/mathml/presentation/roots-expected.txt: Ditto.

8:03 AM Changeset in webkit [202978] by Konstantin Tokarev

3 edits in trunk/Tools

Removed Qt leftovers from Tools.
https://bugs.webkit.org/show_bug.cgi?id=159557

Reviewed by Csaba Osztrogonác.

BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:

Removed 'qt' platform config.

Scripts/webkitpy/common/net/bugzilla/bug.py:

Deleted non-functional e-mail address.

6:16 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

6:05 AM Changeset in webkit [202977] by fred.wang@free.fr

12 edits
10 adds in trunk

Use Radical* constants from the OpenType MATH table.
https://bugs.webkit.org/show_bug.cgi?id=155638

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-08
Reviewed by Brent Fulgham.

Source/WebCore:

Test: mathml/mathml-in-html5/root-parameters-1.html

We make the radical vertical gap depends on displaystyle.
This is the only remaining step to use all the Radical* constants from the MATH table.
We also introduce a ruleThicknessFallback function for future use.

rendering/mathml/RenderMathMLBlock.h:

(WebCore::RenderMathMLBlock::ruleThicknessFallback): Add this helper function since that
calculation is used in several places.

rendering/mathml/RenderMathMLRoot.cpp:

(WebCore::RenderMathMLRoot::updateStyle): Reorganize the way we set constant parameters,
add more comments and take into account the displaystyle for the vertical gap.

LayoutTests:

Import a test from the MathML in HTML5 test suite to verify all the Radical* parameters.
For test RadicalDegreeBottomRaisePercent, WebKit's drawing of one of the radical sign
is weird. This causes unexpected height of the radical and a fortiori wrong vertical
position of the index. For now, we tweak that height to make the test pass.

imported/mathml-in-html5/fonts/radical-degreebottomraisepercent25-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-displaystyleverticalgap7000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-extraascender3000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-kernafterdegreeminus5000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-kernbeforedegree4000-rulethickness1000.woff: Added.
imported/mathml-in-html5/fonts/radical-rulethickness8000.woff: Added.
imported/mathml-in-html5/fonts/radical-verticalgap6000-rulethickness1000.woff: Added.
imported/mathml-in-html5/mathml/presentation-markup/radicals/root-parameters-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/radicals/root-parameters-1.html: Added.
platform/gtk/mathml/radical-fallback-expected.png: Updated to take into account new rendering.
platform/gtk/mathml/radical-fallback-expected.txt: Ditto.
platform/mac/mathml/presentation/mo-stretch-expected.txt: Ditto.
platform/mac/mathml/presentation/roots-expected.txt: Ditto.
platform/mac/mathml/radical-fallback-expected.txt: Ditto.
platform/ios-simulator/mathml/presentation/mo-stretch-expected.txt: Ditto.
platform/ios-simulator/mathml/presentation/roots-expected.txt: Ditto.
platform/ios-simulator/mathml/radical-fallback-expected.txt: Ditto.

5:22 AM Changeset in webkit [202976] by commit-queue@webkit.org

4 edits in trunk

Unreviewed, rolling out r202967.
https://bugs.webkit.org/show_bug.cgi?id=159556

This patch caused crashes in https tests on Windows (Requested
by perarne on #webkit).

Reverted changeset:

"[Win] The test http/tests/security/contentSecurityPolicy
/upgrade-insecure-requests/basic-upgrade.https.html is
failing."
https://bugs.webkit.org/show_bug.cgi?id=159510
http://trac.webkit.org/changeset/202967

3:42 AM Changeset in webkit [202975] by commit-queue@webkit.org

20 edits
4 adds
4 deletes in trunk

Generate WebCore builtin wrapper files
https://bugs.webkit.org/show_bug.cgi?id=159461

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-08
Reviewed by Brian Burg.

Source/JavaScriptCore:

Updating builtin generator to generate wrapper files used in WebCore (See WebCore change log).
Rebasing builtins generator test results according generator changes by activating wrapper file generation for
WebCore builtins tests.

CMakeLists.txt:
DerivedSources.make:
JavaScriptCore.xcodeproj/project.pbxproj:
Scripts/builtins/builtins.py: Adding new generators.
Scripts/builtins/builtins_generate_internals_wrapper_header.py: Added to generate WebCoreJSBuiltinInternals.h.
Scripts/builtins/builtins_generate_internals_wrapper_implementation.py: Added to generate WebCoreJSBuiltinInternals.cpp.
Scripts/builtins/builtins_generate_wrapper_header.py: Added to generate WebCoreJSBuiltins.h.
Scripts/builtins/builtins_generate_wrapper_implementation.py: Added to generate WebCoreJSBuiltins.cpp.
Scripts/generate-js-builtins.py: Adding new option to activate generation of the wrapper files.

(generate_bindings_for_builtins_files):

Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result:
Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result:
Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result:
Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result:
Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result:

Source/WebCore:

No change of behavior.

Updating build system to handle new built-in generators without modifying WebCoreJSBuiltins* files.
The generator is now passed all built-ins at once so that wrapper files can be generated.
Removing WebCoreJSBuiltins* checked-in wrapper files.

CMakeLists.txt:
DerivedSources.make:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::addBuiltinGlobals):

bindings/js/JSDOMGlobalObject.h:
bindings/js/WebCoreJSBuiltinInternals.cpp: Removed.
bindings/js/WebCoreJSBuiltinInternals.h: Removed.
bindings/js/WebCoreJSBuiltins.cpp: Removed.
bindings/js/WebCoreJSBuiltins.h: Removed.

Tools:

Scripts/webkitpy/codegen/main.py:

(BuiltinsGeneratorTests.generate_from_js_builtins): Adding generate_wrapper option.
(BuiltinsGeneratorTests.run_tests): Using this option in WebCore test cases.

3:11 AM Changeset in webkit [202974] by Manuel Rego Casasnovas

14 edits
2 adds in trunk

[css-grid] Inline size is never indefinite during layout
https://bugs.webkit.org/show_bug.cgi?id=159253

Reviewed by Sergio Villar Senin.

Source/WebCore:

The issue is that the inline size of the grid container
is only indefinite while we're computing the intrinsic sizes.
During layout we should be able to resolve the percentage tracks
against that size. This makes Grid Layout compatible with regular blocks
regarding how inline percentages are resolved.

The patch passes the SizingOperation enum to RenderGrid::gridTrackSize().
That way we can know if we're computing the intrinsic sizes or not.

Test: fast/css-grid-layout/grid-container-percentage-columns.html

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::computeTrackSizesForDirection):
(WebCore::RenderGrid::computeIntrinsicLogicalWidths):
(WebCore::RenderGrid::computeIntrinsicLogicalHeight):
(WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
(WebCore::RenderGrid::gridTrackSize):
(WebCore::RenderGrid::minSizeForChild):
(WebCore::RenderGrid::spanningItemCrossesFlexibleSizedTracks):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctions):
(WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
(WebCore::RenderGrid::tracksAreWiderThanMinTrackBreadth):
(WebCore::RenderGrid::rawGridTrackSize): Deleted.

rendering/RenderGrid.h:

LayoutTests:

Created a new test verifying the expected behavior. Updated the results
in a few tests too.

fast/css-grid-layout/grid-columns-rows-get-set-expected.txt:
fast/css-grid-layout/grid-columns-rows-get-set-multiple-expected.txt:
fast/css-grid-layout/grid-columns-rows-get-set-multiple.html:
fast/css-grid-layout/grid-columns-rows-get-set.html:
fast/css-grid-layout/grid-container-percentage-columns-expected.txt: Added.
fast/css-grid-layout/grid-container-percentage-columns.html: Added.
fast/css-grid-layout/named-grid-line-get-set-expected.txt:
fast/css-grid-layout/named-grid-line-get-set.html:
fast/css-grid-layout/percent-track-breadths-regarding-container-size-expected.txt:
fast/css-grid-layout/percent-track-breadths-regarding-container-size.html:

The results of this test now show some FAIL messages becase of a bug in
RenderBox::hasDefiniteLogicalHeight() (http://webkit.org/b/159251).

fast/css-grid-layout/resources/grid-columns-rows-get-set-multiple.js:
fast/css-grid-layout/resources/grid-columns-rows-get-set.js:

2:37 AM Changeset in webkit [202973] by fred.wang@free.fr

8 edits
7 adds in trunk

Use OpenType MATH constant AxisHeight.
https://bugs.webkit.org/show_bug.cgi?id=133567

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-08
Reviewed by Brent Fulgham.

Source/WebCore:

We make RenderMathMLOperator and RenderMathMLTable use the OpenType MATH constant AxisHeight.
These are the only remaining cases to handle since RenderMathMLFraction already uses that constant.

Tests: imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-1.html

imported/mathml-in-html5/mathml/presentation-markup/tables/table-axis-height.html

rendering/mathml/RenderMathMLBlock.cpp: Make RenderMathMLTable use the math axis

for its vertical alignment and update a bit the comments.
(WebCore::axisHeight): Move the code in a static function that can be called by
RenderMathMLBlock and RenderMathMLTable.
(WebCore::RenderMathMLBlock::mathAxisHeight): Use axisHeight.
(WebCore::RenderMathMLTable::firstLineBaseline): Ditto.

rendering/mathml/RenderMathMLOperator.cpp:

(WebCore::RenderMathMLOperator::stretchTo):

LayoutTests:

Import tests from the MathML in HTML5 test suite to verify the AxisHeight parameter.

imported/mathml-in-html5/fonts/math/axisheight5000-verticalarrow14000.woff: Added.
imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-1-expected.txt: Added.
imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-1.html: Added.
imported/mathml-in-html5/mathml/presentation-markup/tables/table-axis-height.html: Added.
imported/mathml-in-html5/mathml/presentation-markup/operators/mo-axis-height-expected.txt: Added.

1:57 AM Changeset in webkit [202972] by Manuel Rego Casasnovas

6 edits in trunk

[css-grid] Disallow repeat() in grid-template shorthand
https://bugs.webkit.org/show_bug.cgi?id=159200

Reviewed by Sergio Villar Senin.

Source/WebCore:

As discussed on www-style, "repeat()" notation shouldn't be allowed
in the ASCII branch of the grid-template shorthand.
https://lists.w3.org/Archives/Public/www-style/2016May/0193.html

The patch uses an enum to invalidate "repeat()" when parsing
the grid-template shorthand.

Test: fast/css-grid-layout/grid-template-shorthand-get-set.html

css/CSSParser.cpp:

(WebCore::CSSParser::parseGridTemplateColumns): Add enum.
(WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns): Pass "DisallowRepeat"
when calling parseGridTemplateColumns().
(WebCore::CSSParser::parseGridTrackList): Use enum to allow/disallow repeat.

css/CSSParser.h: Define the new enum and modify method signatures to use it,

setting it to "AllowRepeat" by default.

LayoutTests:

Modified test to follow the new behavior including new cases.

fast/css-grid-layout/grid-template-shorthand-get-set-expected.txt:
fast/css-grid-layout/grid-template-shorthand-get-set.html:

12:35 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

12:17 AM Changeset in webkit [202971] by jiewen_tan@apple.com

4 edits in trunk/Source

Define DYLD_MACOSX_VERSION_10_12
https://bugs.webkit.org/show_bug.cgi?id=159525
<rdar://problem/26250296>

Reviewed by Brent Fulgham.

Source/WebKit/mac:

WebView/WebView.mm:

(shouldConvertInvalidURLsToBlank):
Replace 0x000A0C00 with DYLD_MACOSX_VERSION_10_12.

Source/WTF:

wtf/spi/darwin/dyldSPI.h:

12:15 AM Changeset in webkit [202970] by fred.wang@free.fr

10 edits
14 adds in trunk

Add support for movablelimits.
https://bugs.webkit.org/show_bug.cgi?id=155542

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-08
Reviewed by Brent Fulgham.

Source/WebCore:

Tests: mathml/presentation/displaystyle-1.html

mathml/presentation/displaystyle-2.html
mathml/presentation/displaystyle-3.html
mathml/presentation/mo-movablelimits-default.html
mathml/presentation/mo-movablelimits-dynamic.html
mathml/presentation/mo-movablelimits.html

mathml/MathMLTextElement.cpp:

(WebCore::MathMLTextElement::parseAttribute): Take into account change of movablelimits.

rendering/mathml/MathMLOperatorDictionary.h: Remove FIXME comment.
rendering/mathml/MathMLStyle.cpp:

(WebCore::MathMLStyle::updateStyleIfNeeded): Force relayout and width computation when a
displaystyle value change.

rendering/mathml/RenderMathMLOperator.h:

(WebCore::RenderMathMLOperator::shouldMoveLimits): Helper function to test if the operator
should have his limits moved when used as a base of munder/mover/munderover.

rendering/mathml/RenderMathMLScripts.cpp: Allow munderover/munder/mover elements to use

this class and take the same behavior as the corresponding msubsup/msub/sup except for
the *scriptshift attributes.
(WebCore::RenderMathMLScripts::RenderMathMLScripts):
(WebCore::RenderMathMLScripts::getBaseAndScripts):
(WebCore::RenderMathMLScripts::computePreferredLogicalWidths):
(WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded):
(WebCore::RenderMathMLScripts::layoutBlock):

rendering/mathml/RenderMathMLScripts.h: Allow some members to be accessible/overridden

by RenderMathMLUnderOver and add munderover/munder/mover in the kind.

rendering/mathml/RenderMathMLUnderOver.cpp:

(WebCore::RenderMathMLUnderOver::RenderMathMLUnderOver): We use the code from
RenderMathMLScripts to initialize m_kind.
(WebCore::RenderMathMLUnderOver::shouldMoveLimits): New function to determine if the base
should move its limits.
(WebCore::RenderMathMLUnderOver::computePreferredLogicalWidths): We use the code from
RenderMathMLScripts when the base should move its limits.
(WebCore::RenderMathMLUnderOver::layoutBlock): We use the code from RenderMathMLScripts when
the base should move its limits. Also improve the early return for invalid markup.
(WebCore::RenderMathMLUnderOver::unembellishedOperator): Deleted. We use the code from RenderMathMLScripts.
(WebCore::RenderMathMLUnderOver::firstLineBaseline): Deleted. We use the code from RenderMathMLScripts.

rendering/mathml/RenderMathMLUnderOver.h: We now inherit from RenderMathMLScripts and can

just remove members that exist in the parent. We define shouldMoveLimits() to determine
when the layout should be done the same as RenderMathMLScripts. For now, we try and be
safe with the rest of the code by continuing to claim that we are not a RenderMathMLScripts.

LayoutTests:

We import some reftests from Mozilla and write more tests in order to verify the effect of
movablelimits. We also adjust one existing test due to change in how munderover handles
invalid markup.

mathml/presentation/displaystyle-1.html: Added. Imported from Mozilla. This verifies the

inheritance of displaystyle via its effect on movablelimits.

mathml/presentation/displaystyle-1-expected.html: Added.
mathml/presentation/displaystyle-2.html: Added. Imported from Mozilla. Test the effect of

displaystyle on munder, mover and munderover with a movablelimits base.

mathml/presentation/displaystyle-2-expected.html: Added.
mathml/presentation/displaystyle-3.html: Added. Imported from Mozilla. Test dynamic change

of displaystyle via its effect on movablelimits.

mathml/presentation/displaystyle-3-expected.html: Added.
mathml/presentation/mo-movablelimits-default.html: Added. Test that the default

movablelimits value from the operator dictionary is correctly read.

mathml/presentation/mo-movablelimits-default-expected.html: Added.
mathml/presentation/mo-movablelimits-dynamic.html: Added. Imported from Mozilla.

Test dynamic change of movablelimits.

mathml/presentation/mo-movablelimits-dynamic-expected.html: Added.
mathml/presentation/mo-movablelimits.html: Added. Basic test to check the effect of

movablelimits on munder.

mathml/presentation/mo-movablelimits-expected.html: Added.
mathml/presentation/underover-scriptshifts.html: Added. This verifies that script shifts

do not have any effect on munderover/mover/munder elements when their limits are rendered
as postscripts.

mathml/presentation/underover-scriptshifts-expected.html: Added.

12:05 AM Changeset in webkit [202969] by Hunseop Jeong

2 edits
1 delete in trunk/Tools

[EFL] Fix build when media-stream is enabled.
https://bugs.webkit.org/show_bug.cgi?id=159206

Bump up the openwebrtc to find the correct package.

Reviewed by Gyuyoung Kim.

efl/jhbuild.modules:
efl/patches/openwebrtc-clang-warning-fix.patch: Removed.

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed