Context Navigation

← Previous Period
Next Period →

Timeline

May 7, 2016:

11:39 PM Changeset in webkit [200552] by Darin Adler

12 edits in trunk

Change MutationObserver::observe to take an IDL dictionary, rather than WebCore::Dictionary
https://bugs.webkit.org/show_bug.cgi?id=157456

Reviewed by Chris Dumez.

Source/WebCore:

bindings/js/JSDOMConvert.h:

(WebCore::convertOptional): Use a specific Optional null rather than Nullopt so we
can compile the ternary operator.
(WebCore::convert<bool>): Added.
(WebCore::convert<Vector<String>>): Added. Later we probably need to change convert to use
a member function of a class template rather than a function template so we can make partial
specialization work and do this just once for all Vector<T>.

bindings/js/JSMutationObserverCustom.cpp:

(WebCore::JSMutationObserverOwner::isReachableFromOpaqueRoots): Streamlined code and removed
some local variables. Changed to call the new observedNodes rather than getObservedNodes.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateDictionaryImplementationContent): Fixed bug where we tried to call the version of
the convert function with a default value even when there was none.

bindings/scripts/test/TestObj.idl: Added a test case basically identical to what's needed

in MutationObserver.idl.

bindings/scripts/test/JS/JSTestObj.cpp: Regenerated.

dom/MutationObserver.cpp:

(WebCore::MutationObserver::observe): Chagned function to take a MutationObserver::Init
instead of a Dictionary.
(WebCore::MutationObserver::observationStarted): Changed argument type to a reference.
(WebCore::MutationObserver::observationEnded): Ditto.
(WebCore::MutationObserverMicrotask): Removed unneeded explicit constructor and destructor.
(WebCore::queueMutationObserverCompoundMicrotask): Got rid of unnneeded local variable.
(WebCore::MutationObserver::observedNodes): Renamed to remove the "get" prefix.

dom/MutationObserver.h: Reduced includes. Added MutationObserver::Init struct and

used it for the type of the argument to the observe function. Changed a few argument
types and removed unused forward declarations.

dom/MutationObserver.idl: Added MutationObserverInit and used it instead of Dictionary.

dom/MutationObserverRegistration.cpp:

(WebCore::MutationObserverRegistration::MutationObserverRegistration): Pass a reference.
(WebCore::MutationObserverRegistration::~MutationObserverRegistration): Ditto.

LayoutTests:

fast/dom/MutationObserver/observe-exceptions-expected.txt: Updated to expect

the specific TypeError generated by the bindings code rather than the generic
TypeError we got before generated inside the C++ DOM.

9:57 PM Changeset in webkit [200551] by rniwa@webkit.org

2 edits in trunk/Websites/perf.webkit.org

Add horizontal between categories of tests
https://bugs.webkit.org/show_bug.cgi?id=157386

Reviewed by Darin Adler.

Wrap tests in each category by tbody and add a horizontal bar between each category.

public/v3/pages/summary-page.js:

(SummaryPage.prototype._constructTable):
(SummaryPage.cssTemplate):

9:39 PM Changeset in webkit [200550] by Chris Dumez

29 edits
1 add in trunk/Source/WebCore

Reduce special handling of XPathNSResolver type in the bindings
https://bugs.webkit.org/show_bug.cgi?id=157454

Reviewed by Darin Adler.

Reduce special handling of XPathNSResolver type in the bindings.

CMakeLists.txt:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSBindingsAllInOne.cpp:

Add new JSXPathNSResolverCustom.cpp file.

bindings/js/JSDOMStringListCustom.cpp:

(WebCore::JSDOMStringList::toWrapped):
Take the ExecState by reference instead of pointer.

bindings/js/JSDOMWindowCustom.cpp:

(WebCore::JSDOMWindow::toWrapped):
Update to take an ExecState& parameter. The bindings now pass
an ExecState to all custom toWrapped() methods for consistency
and flexibility.

bindings/js/JSDictionary.cpp:

(WebCore::JSDictionary::convertValue):
Pass an ExecState now that those toWrapped() methods expect
it.

bindings/js/JSEventTargetCustom.cpp:

(WebCore::JSEventTarget::toWrapped):
Update to take an ExecState& parameter.

bindings/js/JSIDBDatabaseCustom.cpp:

(WebCore::JSIDBDatabase::transaction):
Pass ExecState by reference instead of pointer.

bindings/js/JSMessageEventCustom.cpp:

(WebCore::handleInitMessageEvent):
Pass ExecState to JSDOMWindow::toWrapped().

bindings/js/JSXPathNSResolverCustom.cpp: Added.

(WebCore::JSXPathNSResolver::toWrapped):
Provide a custom implementation of JSXPathNSResolver::toWrapped()
instead of having the custom code in the bindings generator.

bindings/scripts/CodeGeneratorJS.pm:

(AddIncludesForType):
Drop special includes for XPathNSResolver as they are no longer needed.

(GenerateHeader):
Drop special casing of certain types for generating the toWrapped()
declaration by:

Relying on GetNativeType() for the return value as certain types return a RefPtr instead of a raw pointer.
Adding an extra ExecState parameter when a custom implementation of toWrapped() is provided, given that some of them need it.

(GenerateParametersCheck):
Drop custom code for XPathNSResolver and use the normal code path for
this type now. The custom code now resides in the custom implementation
of JSXPathNSResolver::toWrapped(), in custom bindings.

(JSValueToNative):

Drop NodeFilter from the nativeType hash map as it was updated to be a callback interface a while back.
Add XPathNSResolver to nativeType hash map so that we now to use a RefPtr<> instead of a raw pointer in the bindings. We should probably add an IDL extended attribute for this at some point.
Drop special casing for DOMStringList which was outdated since there is no toDOMStringList() function. DOMStringList has a custom toWrapped() function instead nowadays so we now call this one instead. We apparently do not have any DOMStringList parameters outside our bindings tests at the moment, which is why no one noticed.
Pass an ExecState to toWrapped() if the interface has the JSCustomToNativeObject IDL extended attribute.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:
bindings/scripts/test/TestObj.idl:

Add bindings test coverage for having an operation with an
XPathNSResolver parameter.

dom/Document.idl:
xml/XPathEvaluator.idl:

Drop some unnecessary default parameter values.

xml/XPathNSResolver.idl:

Add JSCustomToNativeObject IDL extended attribute so that we can
provide our own custom implementation of JSXPathNSResolver::toWrapped(),
instead of having the custom code in the bindings generator.

dom/Document.cpp:

(WebCore::Document::createExpression):
(WebCore::Document::evaluate):

dom/Document.h:
inspector/InspectorNodeFinder.cpp:
xml/XPathEvaluator.cpp:

(WebCore::XPathEvaluator::createExpression):
(WebCore::XPathEvaluator::evaluate):

xml/XPathEvaluator.h:
xml/XPathExpression.cpp:

(WebCore::XPathExpression::createExpression):

xml/XPathExpression.h:
xml/XPathParser.cpp:

(WebCore::XPath::Parser::Parser):
(WebCore::XPath::Parser::parseStatement):

xml/XPathParser.h:

Take XPathNSResolver parameter as a Ref<XPathNSResolver>&& as this is
what the generated bindings now provide us, given that this sometimes
have to create a wrapper around a JSObject.

3:29 PM Changeset in webkit [200549] by Darin Adler

2 edits in trunk/Source/WebCore

Fix crash introduced by the last patch.

Fix suggested by Chris Dumez.

css/FontFace.cpp:

(WebCore::FontFace::FontFace): Roll out incorrect change. Things were getting
initialized in the wrong order in a change I had made to the FontFace constructor
that takes a CSSFontSelector.

2:36 PM Changeset in webkit [200548] by Chris Dumez

2 edits in trunk/Source/WebCore

Unreviewed, rebaseline bindings tests after r200547.

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::convert<TestObj::FontFaceDescriptors>):

2:14 PM Changeset in webkit [200547] by Darin Adler

18 edits
1 move in trunk

Next step on dictionary bindings, along with other bindings refinements
https://bugs.webkit.org/show_bug.cgi?id=157451

Reviewed by Chris Dumez.

Source/WebCore:

Converted one dictionary, the one passed to the constructor in FontFace.

WebCore.xcodeproj/project.pbxproj: Updated for name change of JSDOMBuild.h to

JSDOMConvert.h and also let Xcode update a file type.

bindings/js/JSDOMBinding.cpp:

(WebCore::propertyValue): Added.

bindings/js/JSDOMBinding.h: Use pragma once. Remove unnecessary forward declaration.

Move all declarations to the top of the file, separating them from definitions. This
is a small step toward better overview of what's in this file and paves the way for
future simplifications and improvements we can make after we observe patterns.
Also removed a couple unused functions.

bindings/js/JSDOMConvert.h: Renamed from JSDOMBuild.h.

Renamed function templates from build to convert. Added convertOptional.

bindings/js/ReadableStreamController.cpp:

(WebCore::callFunction): Use auto and remove some unneeded namespacing.
(WebCore::ReadableStreamController::invoke): Ditto. Also remove use of helper function
getPropertyFromObject, since this was the only call site and it was not very helpful.
(WebCore::ReadableStreamController::isControlledReadableStreamLocked): Ditto.
(WebCore::createReadableStream): Ditto.
(WebCore::getReadableStreamReader): Ditto.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateEnumerationImplementationContent): Updated for name change from build to
convert and JSDOMBuild.h to JSDOMConvert.h.
(GenerateDictionaryImplementationContent): Ditto. Also added code to handle optional
and added explicit exception checking, using local variables. Not clear longer term
if the local variable approach is OK since this will unnecessarily change types like
const String& to String.
(GenerateParametersCheck): Removed local variable $optional and use $parameter->isOptional
directly consistently. This is slightly clearer because the old code used a mix of the
two, and also is a better pattern for when we refactor this into smaller functions.
Note that this function name is not good any more--this is a lot more then parameter checks.
(GetNativeType): Return appropriate name for dictionary types.
(JSValueToNative): Updated for name change from build to convert and JSDOMBuild.h to
JSDOMConvert.h.

bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/JS/JSTestTypedefs.cpp:

Regenerated results.

bindings/scripts/test/TestObj.idl: Added another dictionary test case, just a copy

of the current state of the one in FontFace.idl.

css/CSSFontFace.cpp:

(WebCore::CSSFontFace::setUnicodeRange): Update for simplified UnicodeRange struct.
(WebCore::CSSFontFace::setFeatureSettings): Fix to correctly handle being called
with "normal". Also fix so it doesn't call fontPropertyChanged if nothing changed.
Also got rid of return value, which had no real value: it was returning false for
some bad inputs, but others would just lead to assertions, and the real reason this
was OK is that this function is only passed known-valid values.

css/CSSFontFace.h: Used prama once. Tweaked formatting. Removed return value from

the setFeatureSettings function. Changed UnicodeRange to be struct with public data
members instead a struct with a constructor and getter functions.

css/CSSFontSelector.cpp:

(WebCore::CSSFontSelector::addFontFaceRule): Updated since setFeatureSettings no
longer has a boolean return value.

css/CSSSegmentedFontFace.cpp:

(WebCore::appendFontWithInvalidUnicodeRangeIfLoading): Updated for simplified
UnicodeRange struct.

css/FontFace.cpp:

(WebCore::valueFromDictionary): Deleted.
(WebCore::FontFace::create): Updated to take the descriptors as a struct instead of
a WebCore::Dictionary. Also made that argument optional as specified in the current
specification draft.
(WebCore::FontFace::setFeatureSettings): Updated since setFeatureSettings no longer
has a boolean return value.
(WebCore::FontFace::unicodeRange): Updated for simplified UnicodeRange struct.

css/FontFace.h: Used pragma once. Removed unneeded includes and forward declarations.

Derived privately from CSSFontFace::Client. Added a FontFace::Descriptors struct and
used it as an argument to the create function as described above.

css/FontFace.idl: Added FontFaceDescriptors and changed the argument to the

constructor to be an optional FontFaceDescriptors instead of a Dictionary.

Tools:

Scripts/do-webcore-rename: Use this to rename JSDOMBuild.h to JSDOMConvert.h.

Also skip test expectations in a directory that this was modifying unnecessarily.

1:04 PM Changeset in webkit [200546] by youenn.fablet@crf.canon.fr

15 edits in trunk/Source/WebCore

Rework FontFace promise attribute handling
https://bugs.webkit.org/show_bug.cgi?id=157310

Reviewed by Myles C. Maxfield.

Making promise attributes cached attributes, so that they are created only once.
They are created in the custom binding code and passed to DOM class as needed.

Removed usage of ExecState& from DOM iterators.

No change should be visible from user scripts.

Modules/fetch/FetchHeaders.cpp:

(WebCore::FetchHeaders::Iterator::next): Removing ExecState parameter.

Modules/fetch/FetchHeaders.h:
bindings/js/JSDOMIterator.h:

(WebCore::keyValueIteratorForEach):
(WebCore::JSDOMIterator<JSWrapper>::next): Ditto.

bindings/js/JSDOMPromise.cpp:

(WebCore::DeferredWrapper::promise): Removed deferred() and added access to promise directly.

bindings/js/JSDOMPromise.h:
bindings/js/JSFontFaceCustom.cpp:

(WebCore::JSFontFace::loaded): Using cached attribute to call FontFace::loaded only once.

bindings/js/JSFontFaceSetCustom.cpp:

(WebCore::JSFontFaceSet::ready): Using cached attribute to call FontFaceSet::ready only once.

css/CSSFontFace.cpp:

(WebCore::CSSFontFace::wrapper): Removing ExecState parameter.

css/CSSFontFace.h:
css/FontFace.cpp:

(WebCore::FontFace::create): Ditto.
(WebCore::FontFace::FontFace): Ditto.
(WebCore::FontFace::fontStateChanged): Updating promise handling.
(WebCore::FontFace::registerLoaded): Resolving/rejecting promise if backing CSSFontFace loading is ended.
(WebCore::FontFace::load): Calling backing load.

css/FontFace.h:
css/FontFaceSet.cpp:

(WebCore::FontFaceSet::Iterator::next): Removing ExecState parameter.
(WebCore::FontFaceSet::load): Removing ExecState and ExceptionCode parameter.
(WebCore::FontFaceSet::registerReady): Resolving promise if ready otherwise storing it for resolving it later.
(WebCore::FontFaceSet::completedLoading): Resolving promise if any is stored.
(WebCore::FontFaceSet::create): Deleted.

css/FontFaceSet.h:
css/FontFaceSet.idl:

1:02 PM Changeset in webkit [200545] by commit-queue@webkit.org

2 edits in trunk/Source/WebCore

Fix an incorrect usage of OS(DARWIN) with PLATFORM(COCOA)
https://bugs.webkit.org/show_bug.cgi?id=157167

Patch by Jeremy Huddleston Sequoia <jeremyhu@apple.com> on 2016-05-07
Reviewed by Myles C. Maxfield.

platform/graphics/FontPlatformData.h:

(WebCore::FontPlatformData::hash):

9:51 AM Changeset in webkit [200544] by timothy@apple.com

7 edits
3 adds in trunk/PerformanceTests

Update Animometer design
https://bugs.webkit.org/show_bug.cgi?id=157449

Reviewed by Darin Adler.

Animometer/developer.html: Stop including runner/animometer.css.
Animometer/index.html: Udpated elements to fit new styles.

Animometer/resources/debug-runner/animometer.css:

Copy the old runner/animometer.css to here so the debug runner is unaffected.

Animometer/resources/runner/animometer.css:

New styles for the design. Drop flex box for broad browser support.

Animometer/resources/runner/animometer.js:

(ResultsTable.clear): Use textContent.
(window.sectionsManager.showSection): Add class to the body.
(window.sectionsManager.setSectionScore): Use textContent, not innerHTML.

Animometer/resources/runner/crystal.svg: Added.
Animometer/resources/runner/lines.svg: Added.
Animometer/resources/runner/logo.svg: Added.

Animometer/resources/runner/tests.js: Shorten test name and title case them.

9:20 AM Changeset in webkit [200543] by mark.lam@apple.com

6 edits
2 moves in trunk/Source/JavaScriptCore

Add JSC options bytecodeRangeToJITCompile and jitWhitelist.
https://bugs.webkit.org/show_bug.cgi?id=157428

Reviewed by Michael Saboff.

Added Options::bytecodeRangeToJITCompile and Options::jitWhitelist options.

Moved DFGFunctionWhitelist* to FunctionWhitelist* and made it generic so that it can be used for more than one whitelist instance. In this case, we now have two: the dfgWhitelist and the jitWhitelist.

Added "can compile" checks in LLInt::shouldJIT() to check Options::bytecodeRangeToJITCompile and Options::jitWhitelist.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
dfg/DFGDriver.cpp:

(JSC::DFG::getNumCompilations):
(JSC::DFG::ensureGlobalDFGWhitelist):
(JSC::DFG::compileImpl):

dfg/DFGFunctionWhitelist.cpp: Removed.
dfg/DFGFunctionWhitelist.h: Removed.

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::ensureGlobalJITWhitelist):
(JSC::LLInt::shouldJIT):

runtime/Options.h:

tools/FunctionWhitelist.cpp: Copied from Source/JavaScriptCore/dfg/DFGFunctionWhitelist.cpp.

(JSC::FunctionWhitelist::FunctionWhitelist):
(JSC::FunctionWhitelist::contains):
(JSC::DFG::FunctionWhitelist::ensureGlobalWhitelist): Deleted.
(JSC::DFG::FunctionWhitelist::FunctionWhitelist): Deleted.
(JSC::DFG::FunctionWhitelist::parseFunctionNamesInFile): Deleted.
(JSC::DFG::FunctionWhitelist::contains): Deleted.

tools/FunctionWhitelist.h: Copied from Source/JavaScriptCore/dfg/DFGFunctionWhitelist.h.

6:03 AM Changeset in webkit [200542] by jdiggs@igalia.com

6 edits in trunk

REGRESSION(r196222): [AX][GTK] accessibility/gtk/caret-offsets.html failing
https://bugs.webkit.org/show_bug.cgi?id=153956

Reviewed by Chris Fleizach.

Source/WebCore:

The reason the test began failing is that it was checking the new caret offset
synchronously. For most of the test cases, this was not a problem. But when the
caret was moved out of a focused link, the focus change (and associated repainting)
delayed the caret-moved event long enough to cause the associated test case to fail.
The test now uses shouldBecomeEqualToString() instead of shouldBeEqualToString().

The test also had a supposedly-correct expectation which was wrong: When moving the
caret to a valid accessible offset, the caret-moved event should be for that offset.
This was not the case for the list item test case because emitTextSelectionChange()
was not adjusting the offset for the RenderListMarker, the text of which is exposed
as part of the ATK_ROLE_LIST_ITEM object. This bug was also fixed and the test case
updated accordingly.

No new tests are needed. The previously-failing test is now passing.

editing/atk/FrameSelectionAtk.cpp:

(WebCore::emitTextSelectionChange):

LayoutTests:

Change the test to run asynchronously and update the expectations.

accessibility/gtk/caret-offsets-expected.txt: Updated.
accessibility/gtk/caret-offsets.html: Updated.
platform/gtk/TestExpectations: Unskipped the previously-failing test.

1:19 AM Changeset in webkit [200541] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

[JSC][32bit] stress/tagged-templates-template-object.js fails in debug
https://bugs.webkit.org/show_bug.cgi?id=157436

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-05-07
Reviewed by Filip Pizlo.

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):
The node OverridesHasInstance had a speculation after a jump.

May 6, 2016:

11:03 PM Changeset in webkit [200540] by Joseph Pecoraro

22 edits in trunk/Source

Rename HitTestRequest DisallowShadowContent to DisallowUserAgentShadowContent
https://bugs.webkit.org/show_bug.cgi?id=157447

Reviewed by Ryosuke Niwa.

Source/WebCore:

HitTesting is intended to reach nodes inside shadow content. This property
on the HitTestRequest is intended to avoid hit testing in UserAgent shadow
content. Rename the enum value, and cascading methods for clarity.

html/MediaElementSession.cpp:

(WebCore::isMainContent):

page/EventHandler.cpp:

(WebCore::EventHandler::eventMayStartDrag):
(WebCore::EventHandler::updateSelectionForMouseDrag):
(WebCore::EventHandler::hitTestResultAtPoint):
(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::handleMouseDoubleClickEvent):
(WebCore::EventHandler::mouseMoved):
(WebCore::EventHandler::handleMouseMoveEvent):
(WebCore::EventHandler::handleMouseReleaseEvent):
(WebCore::EventHandler::handleMouseForceEvent):
(WebCore::EventHandler::updateDragAndDrop):
(WebCore::EventHandler::isInsideScrollbar):
(WebCore::EventHandler::sendContextMenuEvent):
(WebCore::EventHandler::sendContextMenuEventForKey):
(WebCore::EventHandler::hoverTimerFired):
(WebCore::EventHandler::dragSourceEndedAt):
(WebCore::EventHandler::handleDrag):
(WebCore::EventHandler::dispatchSyntheticTouchEventIfEnabled):

page/EventHandler.h:
page/FocusController.cpp:

(WebCore::updateFocusCandidateIfNeeded):

rendering/HitTestRequest.h:

(WebCore::HitTestRequest::HitTestRequest):
(WebCore::HitTestRequest::disallowsUserAgentShadowContent):
(WebCore::HitTestRequest::disallowsShadowContent): Deleted.

rendering/HitTestResult.cpp:

(WebCore::HitTestResult::setToNonUserAgentShadowAncestor):
(WebCore::HitTestResult::addNodeToRectBasedTestResult):
(WebCore::HitTestResult::setToNonShadowAncestor): Deleted.

rendering/HitTestResult.h:
rendering/RenderEmbeddedObject.cpp:

(WebCore::RenderEmbeddedObject::isReplacementObscured):

rendering/RenderLayer.cpp:

(WebCore::RenderLayer::calculateClipRects):

rendering/svg/RenderSVGResourceClipper.cpp:

(WebCore::RenderSVGResourceClipper::hitTestClipContent):

testing/Internals.cpp:

(WebCore::Internals::nodesFromRect):

Source/WebKit/mac:

WebView/WebFrame.mm:

(-[WebFrame elementAtPoint:]):

WebView/WebHTMLView.mm:

(-[WebHTMLView elementAtPoint:allowShadowContent:]):

Source/WebKit/win:

WebView.cpp:

(WebView::gestureNotify):

Source/WebKit2:

WebProcess/WebPage/CoordinatedGraphics/WebPageCoordinatedGraphics.cpp:

(WebKit::WebPage::findZoomableAreaForPoint):

WebProcess/WebPage/WebFrame.cpp:

(WebKit::WebFrame::hitTest):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::determinePrimarySnapshottedPlugIn):

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::rangeForWebSelectionAtPosition):
(WebKit::WebPage::rangeForBlockAtPoint):
(WebKit::WebPage::getPositionInformation):

10:52 PM Changeset in webkit [200539] by Joseph Pecoraro

6 edits in trunk/Source

Web Inspector: Inspect Element and Element Selection searching should work with Shadow DOM Nodes
https://bugs.webkit.org/show_bug.cgi?id=157446
<rdar://problem/24688447>

Reviewed by Ryosuke Niwa.

Source/WebCore:

inspector/InspectorDOMAgent.cpp:

(WebCore::InspectorDOMAgent::innerParentNode):
The Inspector backend was informing the frontend that all ShadowRoots
were floating and had no parent. Get the host element for ShadowRoots.

rendering/HitTestResult.cpp:

(WebCore::moveOutOfUserAgentShadowTree):
(WebCore::HitTestResult::setToNonShadowAncestor):
EventHandler::mouseMoved is calling setToNonShadowAncestor before
notifying Page::chrome / Inspector about the moused over element.
This should be the deepest non-user-agent-shadow node.

Source/WebInspectorUI:

UserInterface/Models/DOMNode.js:

(WebInspector.DOMNode):
Shadow DOM nodes did not have a parent, and so when attempting
to create DOM Tree elements up the chain, we were failing at
shadow boundaries. Create the parent relationship, the parent
already treats it as a child.

UserInterface/Views/DOMTreeOutline.js:

(WebInspector.DOMTreeOutline.prototype._revealAndSelectNode):
Whenever we try to reveal and select an element in a shadow tree
but the setting to show shadow DOM is disabled, walk up until
we are out of the shadow tree.

10:44 PM Changeset in webkit [200538] by Joseph Pecoraro

4 edits in trunk/Source

Web Inspector: Misc CommandLineAPI cleanup
https://bugs.webkit.org/show_bug.cgi?id=157450

Reviewed by Ryosuke Niwa.

Source/JavaScriptCore:

inspector/InjectedScriptSource.js:

(BasicCommandLineAPI):
Fix mistake in r200533, and modernize related code.

Source/WebCore:

inspector/CommandLineAPIModuleSource.js:

(bind):

9:25 PM Changeset in webkit [200537] by peavo@outlook.com

3 edits in trunk/LayoutTests

[Win] Skip failing INTL test.
https://bugs.webkit.org/show_bug.cgi?id=157418

Reviewed by Alex Christensen.

Temporarily skip string-localeCompare.js, because AppleWin currently does not have INTL enabled.

js/script-tests/string-localeCompare.js:
platform/win/TestExpectations:

8:51 PM Changeset in webkit [200536] by rniwa@webkit.org

1 edit
2 adds in trunk/LayoutTests

MouseEvent's offsetX and offsetY should be based on relative target
https://bugs.webkit.org/show_bug.cgi?id=157444
<rdar://problem/24396408>

Reviewed by Darin Adler.

Add a W3C style testharness.js test for adjusting offsetX and offsetY to the adjusted target
since our existing behavior matches the spec as well as Chrome's behavior:
http://w3c.github.io/webcomponents/spec/shadow/#event-dispatch

fast/shadow-dom/MouseEvent-prototype-offsetX-offsetY-expected.txt: Added.
fast/shadow-dom/MouseEvent-prototype-offsetX-offsetY.html: Added.

8:08 PM Changeset in webkit [200535] by commit-queue@webkit.org

5 edits
2 adds in trunk

Web Inspector: Improve console.count()
https://bugs.webkit.org/show_bug.cgi?id=157439
<rdar://problem/26152654>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-06
Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

make console.count() increment an unnamed global counter.
make console.count(label) increment a counter with that label name.

inspector/agents/InspectorConsoleAgent.cpp:

(Inspector::InspectorConsoleAgent::count):

LayoutTests:

inspector/console/console-api-expected.txt:
inspector/console/console-count-expected.txt: Added.
inspector/console/console-count.html: Added.
inspector/console/console-time.html:

5:38 PM WebKitGTK/2.10.x edited by jdiggs@igalia.com

(diff)

5:25 PM WebKitGTK/2.12.x edited by jdiggs@igalia.com

(diff)

5:05 PM Changeset in webkit [200534] by Simon Fraser

43 edits
1 copy
2 moves
6 adds in trunk

Enable IOS_TEXT_AUTOSIZING on Mac and make it testable
https://bugs.webkit.org/show_bug.cgi?id=157432
rdar://problem/16406720

Reviewed by Dean Jackson.

Source/JavaScriptCore:

Enable IOS_TEXT_AUTOSIZING on Mac so it can be tested.

Configurations/FeatureDefines.xcconfig:

Source/WebCore:

Enable IOS_TEXT_AUTOSIZING on Mac so it can be tested.

Make the setTextAutosizingEnabled() Setting work, and plumb it through WK1 and WK2
preferences for WTR and DRT. Make textAutosizingWindowSizeOverride() work, for layout tests.
These two settings are shared with TEXT_AUTOSIZING.

Add a TextAutosizing log channel, which is useful for generated -expected.html results.

Move adjustComputedFontSizesOnBlocks() and related code from RenderObject to RenderElement
without changes.

An implication of this set of changes is that the way clients enable text autosizing
has changed. Previously, they set the "MinimumZoomFontSize" preference to 0.
Settings::defaultMinimumZoomFontSize() used to do this in order to enable text autosizing
on iPhone only, not iPad.

Now the preferred technique is to leave minimumZoomFontSize alone, and to use textAutosizingEnabled()
instead. Settings::defaultTextAutosizingEnabled() now does the check for iPhone.

UIWebView calls WebKitGetMinimumZoomFontSize() to setup the default minimum font zoom size,
which will now always return 15, but had no other code that toggled this. So it's safe to just rely
on Settings::defaultTextAutosizingEnabled() doing the right thing for iPhone/iPad.

Test: fast/text-autosizing/ios/autosize-width.html

Configurations/FeatureDefines.xcconfig:
dom/Document.cpp:

(WebCore::Document::addAutoSizingNode):

page/FrameView.cpp:

(WebCore::FrameView::layout):

page/Settings.cpp:

(WebCore::Settings::Settings): Deleted.
(WebCore::Settings::setTextAutosizingEnabled): Deleted.
(WebCore::Settings::setTextAutosizingWindowSizeOverride): Deleted.

page/Settings.h:

(WebCore::Settings::textAutosizingEnabled): Deleted.
(WebCore::Settings::textAutosizingWindowSizeOverride): Deleted.

page/Settings.in:
page/cocoa/SettingsCocoa.mm:

(WebCore::Settings::defaultMinimumZoomFontSize):
(WebCore::Settings::defaultTextAutosizingEnabled):

platform/Logging.h:
rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::adjustComputedFontSizes):

rendering/RenderElement.cpp:

(WebCore::includeNonFixedHeight):
(WebCore::RenderElement::adjustComputedFontSizesOnBlocks):
(WebCore::RenderElement::resetTextAutosizing):

rendering/RenderElement.h:
rendering/RenderObject.cpp:

(WebCore::includeNonFixedHeight): Deleted.
(WebCore::RenderObject::adjustComputedFontSizesOnBlocks): Deleted.
(WebCore::RenderObject::resetTextAutosizing): Deleted.

rendering/RenderObject.h:
rendering/TextAutoSizing.cpp:

(WebCore::TextAutoSizingValue::adjustNodeSizes):

testing/InternalSettings.cpp:

(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::setTextAutosizingEnabled):
(WebCore::InternalSettings::setTextAutosizingWindowSizeOverride):

testing/InternalSettings.h:

Source/WebKit/ios:

Enable IOS_TEXT_AUTOSIZING on Mac so it can be tested.

Add a TextAutosizing log channel, which is useful for generated -expected.html results.

Move adjustComputedFontSizesOnBlocks() and related code from RenderObject to RenderElement
without changes.

Now the preferred technique is to leave minimumZoomFontSize alone, and to use textAutosizingEnabled()
instead. Settings::defaultTextAutosizingEnabled() now does the check for iPhone.

Misc/WebUIKitSupport.mm:

(WebKitGetMinimumZoomFontSize):

Source/WebKit/mac:

Enable IOS_TEXT_AUTOSIZING on Mac so it can be tested.

Add a TextAutosizing log channel, which is useful for generated -expected.html results.

Move adjustComputedFontSizesOnBlocks() and related code from RenderObject to RenderElement
without changes.

Now the preferred technique is to leave minimumZoomFontSize alone, and to use textAutosizingEnabled()
instead. Settings::defaultTextAutosizingEnabled() now does the check for iPhone.

Configurations/FeatureDefines.xcconfig:
WebView/WebPreferenceKeysPrivate.h:
WebView/WebPreferences.mm:

(+[WebPreferences initialize]):
(-[WebPreferences _setTextAutosizingEnabled:]):
(-[WebPreferences _textAutosizingEnabled]):

WebView/WebPreferencesPrivate.h:

Source/WebKit2:

Enable IOS_TEXT_AUTOSIZING on Mac so it can be tested.

Add a TextAutosizing log channel, which is useful for generated -expected.html results.

Move adjustComputedFontSizesOnBlocks() and related code from RenderObject to RenderElement
without changes.

Now the preferred technique is to leave minimumZoomFontSize alone, and to use textAutosizingEnabled()
instead. Settings::defaultTextAutosizingEnabled() now does the check for iPhone.

Configurations/FeatureDefines.xcconfig:
Shared/WebPreferencesDefinitions.h:
UIProcess/API/Cocoa/WKPreferences.mm:

(-[WKPreferences _textAutosizingEnabled]):
(-[WKPreferences _setTextAutosizingEnabled:]):

UIProcess/API/Cocoa/WKPreferencesPrivate.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

Tools:

Enable IOS_TEXT_AUTOSIZING on Mac so it can be tested.

Add a TextAutosizing log channel, which is useful for generated -expected.html results.

Move adjustComputedFontSizesOnBlocks() and related code from RenderObject to RenderElement
without changes.

Now the preferred technique is to leave minimumZoomFontSize alone, and to use textAutosizingEnabled()
instead. Settings::defaultTextAutosizingEnabled() now does the check for iPhone.

DumpRenderTree/mac/DumpRenderTree.mm:

(resetWebPreferencesToConsistentValues):

DumpRenderTree/mac/TestRunnerMac.mm:

(TestRunner::setTextAutosizingEnabled):

TestWebKitAPI/Configurations/FeatureDefines.xcconfig:
WebKitTestRunner/ios/TestControllerIOS.mm:

(WTR::TestController::platformResetPreferencesToConsistentValues):

LayoutTests:

Enable fast/text-autosizing/ios/ on Mac and iOS

fast/text-autosizing/ios/autosize-width-expected.html: Added.
fast/text-autosizing/ios/autosize-width.html: Added.
platform/ios-simulator/TestExpectations:
platform/mac-wk2/TestExpectations:
platform/mac/TestExpectations:

4:32 PM Changeset in webkit [200533] by commit-queue@webkit.org

19 edits
2 adds in trunk

Web Inspector: Console: Variables defined with let/const aren't accessible outside of console's scope
https://bugs.webkit.org/show_bug.cgi?id=150752
<rdar://problem/23343385>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-06
Reviewed by Mark Lam.

Source/JavaScriptCore:

This approach allows Web Inspector to hang a "Scope Extension", a
WithObjectScope, off the GlobalObject. When resolving identifiers
in fails to resolve anything in the normal scope chain, consult
the scope extension.

This allows us to eliminate the with (commandLineAPI) { ... }
block in global console evaluations, and instead makes it a full
program evaluation, with the commandLineAPI available and safely
shadowed by actual variables as expected.

inspector/InjectedScriptSource.js:

(InjectedScript.prototype._evaluateOn):
Use the new evaluateWithScopeExtension and provide the CommandLineAPI
object as the scope extension object.

(BasicCommandLineAPI):
(BasicCommandLineAPI.inScopeVariables): Deleted.
Simplify now that we don't need to check for variable shadowing ourselves.

inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::evaluateWithScopeExtension):

inspector/JSInjectedScriptHost.h:
inspector/JSInjectedScriptHostPrototype.cpp:

(Inspector::JSInjectedScriptHostPrototype::finishCreation):
(Inspector::jsInjectedScriptHostPrototypeFunctionEvaluateWithScopeExtension):
Provide a new InjectedScriptHost method to evaluate a program
with a scope extension.

runtime/Completion.cpp:

(JSC::evaluateWithScopeExtension):

runtime/Completion.h:

General JSC::evaluate function to evaluate a program with a scope extension.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::setGlobalScopeExtension):
(JSC::JSGlobalObject::clearGlobalScopeExtension):
(JSC::JSGlobalObject::visitChildren):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::globalScopeExtension):
Hang a scope extension off the global object.

runtime/JSScope.cpp:

(JSC::JSScope::resolve):
Consult the scope extension when resolve fails to find anything normally.

Source/WebCore:

Test: inspector/runtime/evaluate-CommandLineAPI.html

inspector/CommandLineAPIModuleSource.js:

(bind):
(this.member.toString):
(CommandLineAPI):
(CommandLineAPIImpl.prototype):
(slice): Deleted.
(bound): Deleted.
(bound.toString): Deleted.
(inScopeVariables): Deleted.
(customToStringMethod): Deleted.
Simplify now that we don't need to do our own variable shadow checking.

LayoutTests:

inspector/runtime/evaluate-CommandLineAPI-expected.txt: Added.
inspector/runtime/evaluate-CommandLineAPI.html: Added.

New test covering the different cases of global evaluation with the
CommandLineAPI as a scope extension.

http/tests/inspector/console/cross-domain-inspected-node-access-expected.txt:
inspector/console/command-line-api-expected.txt:
inspector/debugger/js-stacktrace-expected.txt:
inspector/debugger/js-stacktrace.html:
inspector/model/stack-trace-expected.txt:
platform/mac/inspector/model/remote-object-expected.txt:

Update expectations now that global evaluations are treated as
program's [global code] and not evals [eval code]. Also some
line number changes.

4:21 PM Changeset in webkit [200532] by beidson@apple.com

3 edits in trunk/LayoutTests

Unreviewed IDB test gardening.

TestExpectations:
storage/indexeddb/pending-activity-workers-expected.txt: Updated expectations.

3:57 PM Changeset in webkit [200531] by mark.lam@apple.com

7 edits in trunk/Source/JavaScriptCore

Add JSC options reportBaselineCompileTimes and reportDFGCompileTimes.
https://bugs.webkit.org/show_bug.cgi?id=157427

Reviewed by Filip Pizlo and Keith Miller.

The compile times reporting options are now:

reportCompileTimes -> report compile times in all tiers.
reportBaselineCompileTimes -> report compile times in baseline JIT.
reportDFGCompileTimes -> report compile times in DFG and FTL.
reportFTLCompileTimes -> report compile times in FTL.

Also updated reportTotalCompileTimes() to collect stats that include the baseline
JIT. compileTimeStats() is now moved into JIT.cpp (from DFGPlan.cpp).

dfg/DFGPlan.cpp:

(JSC::DFG::Plan::reportCompileTimes):
(JSC::DFG::Plan::compileInThread):
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::cancel):
(JSC::DFG::Plan::compileTimeStats): Deleted.

dfg/DFGPlan.h:

(JSC::DFG::Plan::compileTimeStats): Deleted.

jit/JIT.cpp:

(JSC::ctiPatchCallByReturnAddress):
(JSC::JIT::privateCompile):
(JSC::JIT::stackPointerOffsetFor):
(JSC::JIT::reportCompileTimes):
(JSC::JIT::computeCompileTimes):
(JSC::JIT::compileTimeStats):

jit/JIT.h:

(JSC::JIT::shouldEmitProfiling):

jsc.cpp:

(runJSC):

runtime/Options.h:

3:47 PM Changeset in webkit [200530] by timothy_horton@apple.com

8 edits
2 adds in trunk

<attachment> element should understand UTIs
https://bugs.webkit.org/show_bug.cgi?id=157425
<rdar://problem/25585401>

Reviewed by Anders Carlsson.

UTIs are often much more specific than MIME types, so we should allow
clients of <attachment> to use them to get more accurate icons.

Test: fast/attachment/attachment-uti.html

platform/graphics/Icon.h:
platform/graphics/mac/IconMac.mm:

(WebCore::Icon::createIconForMIMEType): Deleted.
Remove the now-unused createIconForMIMEType.

platform/network/mac/UTIUtilities.h:
platform/network/mac/UTIUtilities.mm:

(WebCore::isDeclaredUTI):
Expose UTTypeIsDeclared as isDeclaredUTI.

rendering/RenderThemeIOS.mm:

(WebCore::iconForAttachment):

rendering/RenderThemeMac.mm:

(WebCore::iconForAttachment):
If the attachment's type is a UTI, request the icon for it directly.
If it's a MIME type, convert to a UTI before requesting.

fast/attachment/attachment-uti-expected.html: Added.
fast/attachment/attachment-uti.html: Added.

Add a test that UTIs render the same as their corresponding MIME types.

3:39 PM Changeset in webkit [200529] by Nikita Vasilyev

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Unexpected white border at the bottom of Debugger filter bar
https://bugs.webkit.org/show_bug.cgi?id=157430
<rdar://problem/26146602>

Reviewed by Timothy Hatcher.

Remove the semi-transparent white borders.

UserInterface/Views/NavigationBar.css:

(.navigation-bar): Deleted.

UserInterface/Views/SearchSidebarPanel.css:

(.sidebar > .panel.navigation.search > .search-bar): Deleted.

3:23 PM Changeset in webkit [200528] by Chris Dumez

19 edits in trunk

Clean up converting from JSValue to float / double in the bindings generator
https://bugs.webkit.org/show_bug.cgi?id=157407

Reviewed by Darin Adler.

Source/WebCore:

Clean up converting from JSValue to float / double in the bindings generator:

Handle all aspects of converting to float / double inside JSValueToNative() instead of relying partly on the call sites.
Add a build<>() template function to JSDOMBuild.h that is now called from the bindings to convert to float / double and deal with non-finite values.
Provide a better message with the TypeError that is thrown for non-finite values.

No new tests, rebaselined existing tests.

bindings/js/JSDOMBinding.cpp:

(WebCore::throwSequenceTypeError):
(WebCore::throwNonFiniteTypeError):

bindings/js/JSDOMBinding.h:
bindings/js/JSDOMBuild.h:

(WebCore::build):

bindings/scripts/CodeGenerator.pm:

(IsFloatingPointType):

bindings/scripts/CodeGeneratorJS.pm:

(JSValueToNative):
(GenerateImplementation): Deleted.
(GenerateParametersCheck): Deleted.
(GenerateReturnParameters): Deleted.

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::setJSTestObjStrictFloat):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalDoubleIsNaN):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalFloatIsNaN):
(WebCore::jsTestObjPrototypeFunctionStrictFunction):
(WebCore::jsTestObjPrototypeFunctionVariadicDoubleMethod):
(WebCore::jsTestObjPrototypeFunctionAny):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise):
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise):

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::jsTestTypedefsPrototypeFunctionSetShadow):

LayoutTests:

Rebaseline the tests now that we provide a more useful exception message.

fast/canvas/canvas-2d-imageData-create-nonfinite-expected.txt:
fast/canvas/canvas-getImageData-invalid-expected.txt:
fast/canvas/canvas-putImageData-expected.txt:
fast/canvas/canvas-putImageData.js:
fast/canvas/linearGradient-infinite-values-expected.txt:
fast/canvas/radialGradient-infinite-values-expected.txt:
fast/canvas/resources/canvas-2d-imageData-create-nonfinite.js:
fast/canvas/script-tests/canvas-getImageData-invalid.js:
fast/canvas/script-tests/linearGradient-infinite-values.js:
fast/canvas/script-tests/radialGradient-infinite-values.js:

3:06 PM Changeset in webkit [200527] by beidson@apple.com

4 edits in trunk/LayoutTests

Unreviewed IDB test gardening.

Fix a failing test, and add better classification/comments to a different failing test.

TestExpectations:
storage/indexeddb/dont-commit-on-blocked-expected.txt:
storage/indexeddb/dont-commit-on-blocked.html:

2:38 PM Changeset in webkit [200526] by beidson@apple.com

3 edits in trunk/LayoutTests

Unreviewed IDB test gardening.

Update the workers variant of "deletedatabase-delayed-by-open-and-versionchange" to the modern expected results.

TestExpectations:
storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-workers-expected.txt:

2:22 PM Changeset in webkit [200525] by beidson@apple.com

2 edits in trunk/LayoutTests

Unreviewed IDB test gardening.

Finish removing unsupported lines from the "unprefix" test.

storage/indexeddb/unprefix-private-expected.txt:

2:21 PM Changeset in webkit [200524] by dino@apple.com

31 edits
4 deletes in trunk

Regions, Shapes and Tracks don't need runtime features
https://bugs.webkit.org/show_bug.cgi?id=157426
<rdar://problem/26146262>

Reviewed by Simon Fraser.

Source/WebCore:

The following RuntimeEnabledFeatures can be removed since
we have no need to disable them (they are stable and have
shipped for a while):

CSS Regions
CSS Shapes
Media tracks

bindings/generic/RuntimeEnabledFeatures.cpp:

(WebCore::RuntimeEnabledFeatures::RuntimeEnabledFeatures): Deleted.

bindings/generic/RuntimeEnabledFeatures.h:

(WebCore::RuntimeEnabledFeatures::setCSSShapesEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::cssShapesEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::setCSSRegionsEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::cssRegionsEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::setCSSCompositingEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::cssCompositingEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::webkitVideoTrackEnabled): Deleted.
(WebCore::RuntimeEnabledFeatures::setWebkitVideoTrackEnabled): Deleted.

css/CSSParser.cpp:

(WebCore::isSimpleLengthPropertyID):
(WebCore::isValidKeywordPropertyAndValue):
(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parseFillProperty):
(WebCore::CSSParser::createRegionRule):
(WebCore::CSSParserContext::CSSParserContext): Deleted.
(WebCore::operator==): Deleted.
(WebCore::CSSParser::parseShapeProperty): Deleted.
(WebCore::CSSParser::cssRegionsEnabled): Deleted.
(WebCore::CSSParser::cssCompositingEnabled): Deleted.
(WebCore::CSSParser::parseFlowThread): Deleted.
(WebCore::CSSParser::parseRegionThread): Deleted.

css/CSSParser.h:
css/CSSParserMode.h:
dom/Document.cpp:

(WebCore::Document::webkitGetNamedFlows):
(WebCore::Document::cssRegionsEnabled): Deleted.
(WebCore::Document::cssCompositingEnabled): Deleted.

dom/Document.h:
dom/Element.cpp:

(WebCore::Element::unregisterNamedFlowContentElement):
(WebCore::Element::webkitRegionOverset):
(WebCore::Element::webkitGetRegionFlowRanges): Deleted.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::scheduleDelayedAction):
(WebCore::HTMLMediaElement::pendingActionTimerFired):
(WebCore::HTMLMediaElement::prepareForLoad):
(WebCore::HTMLMediaElement::loadInternal):
(WebCore::HTMLMediaElement::setReadyState):
(WebCore::HTMLMediaElement::playbackProgressTimerFired):
(WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
(WebCore::HTMLMediaElement::userCancelledLoad):
(WebCore::HTMLMediaElement::setVideoFullscreenLayer):
(WebCore::HTMLMediaElement::hasClosedCaptions):
(WebCore::HTMLMediaElement::setClosedCaptionsVisible):
(WebCore::HTMLMediaElement::configureTextTrackDisplay):
(WebCore::HTMLMediaElement::finishParsingChildren): Deleted.
(WebCore::HTMLMediaElement::audioTrackEnabledChanged): Deleted.
(WebCore::HTMLMediaElement::videoTrackSelectedChanged): Deleted.
(WebCore::HTMLMediaElement::mediaPlayerDidAddAudioTrack): Deleted.
(WebCore::HTMLMediaElement::mediaPlayerDidAddTextTrack): Deleted.
(WebCore::HTMLMediaElement::mediaPlayerDidAddVideoTrack): Deleted.
(WebCore::HTMLMediaElement::addAudioTrack): Deleted.
(WebCore::HTMLMediaElement::addTextTrack): Deleted.
(WebCore::HTMLMediaElement::addVideoTrack): Deleted.
(WebCore::HTMLMediaElement::removeAudioTrack): Deleted.
(WebCore::HTMLMediaElement::removeTextTrack): Deleted.
(WebCore::HTMLMediaElement::removeVideoTrack): Deleted.
(WebCore::HTMLMediaElement::audioTracks): Deleted.
(WebCore::HTMLMediaElement::textTracks): Deleted.
(WebCore::HTMLMediaElement::videoTracks): Deleted.
(WebCore::HTMLMediaElement::didAddTextTrack): Deleted.
(WebCore::HTMLMediaElement::didRemoveTextTrack): Deleted.

html/HTMLTrackElement.cpp:

(WebCore::HTMLTrackElement::parseAttribute):
(WebCore::HTMLTrackElement::scheduleLoad): Deleted.
(WebCore::HTMLTrackElement::canLoadURL): Deleted.

rendering/RenderBlockFlow.cpp:

(WebCore::RenderBlockFlow::createRenderNamedFlowFragmentIfNeeded):

testing/InternalSettings.cpp:

(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo): Deleted.
(WebCore::InternalSettings::setCSSShapesEnabled): Deleted.

testing/InternalSettings.h:
testing/InternalSettings.idl:

Source/WebKit/mac:

The following RuntimeEnabledFeatures can be removed since
we have no need to disable them (they are stable and have
shipped for a while):

CSS Regions
CSS Shapes
Media tracks

WebView/WebPreferenceKeysPrivate.h:
WebView/WebPreferences.mm:

(+[WebPreferences initialize]): Deleted.
(-[WebPreferences cssRegionsEnabled]): Deleted.
(-[WebPreferences setCSSRegionsEnabled:]): Deleted.
(-[WebPreferences cssCompositingEnabled]): Deleted.
(-[WebPreferences setCSSCompositingEnabled:]): Deleted.

WebView/WebPreferencesPrivate.h:
WebView/WebView.mm:

(-[WebView _preferencesChanged:]): Deleted.

Source/WebKit2:

The following RuntimeEnabledFeatures can be removed since
we have no need to disable them (they are stable and have
shipped for a while):

CSS Regions
CSS Shapes
Media tracks

Shared/WebPreferencesDefinitions.h:
UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetCSSRegionsEnabled): Deleted.
(WKPreferencesGetCSSRegionsEnabled): Deleted.

UIProcess/API/C/WKPreferencesRefPrivate.h:
WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner): Deleted.
(WebKit::InjectedBundle::setCSSRegionsEnabled): Deleted.
(WebKit::InjectedBundle::setCSSCompositingEnabled): Deleted.

WebProcess/InjectedBundle/InjectedBundle.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences): Deleted.

Tools:

The following RuntimeEnabledFeatures can be removed since
we have no need to disable them (they are stable and have
shipped for a while):

CSS Regions
CSS Shapes
Media tracks

DumpRenderTree/mac/DumpRenderTree.mm:

(resetWebPreferencesToConsistentValues): Deleted.

LayoutTests:

Remove these tests since their runtime flags no longer exist.

fast/regions/css-regions-disabled-expected.txt: Removed.
fast/regions/css-regions-disabled.html: Removed.
fast/shapes/css-shapes-disabled-expected.txt: Removed.
fast/shapes/css-shapes-disabled.html: Removed.

2:16 PM Changeset in webkit [200523] by beidson@apple.com

5 edits in trunk/LayoutTests

Unreviewed IDB test gardening.

Remove unsupported lines from the "unprefix" test.

TestExpectations:
storage/indexeddb/resources/unprefix.js:
storage/indexeddb/unprefix-expected.txt:
storage/indexeddb/unprefix-workers-expected.txt:

2:11 PM Changeset in webkit [200522] by beidson@apple.com

2 edits
2 deletes in trunk/LayoutTests

Unreviewed IDB test gardening.

Remove the Workers variant of a test that had been removed for being irrelevant.

TestExpectations:
storage/indexeddb/factory-basics-workers-expected.txt: Removed.
storage/indexeddb/factory-basics-workers.html: Removed.

2:04 PM Changeset in webkit [200521] by beidson@apple.com

43 edits in trunk

Modern IDB (Workers): Start running a lot of the workers tests.
https://bugs.webkit.org/show_bug.cgi?id=157424

Reviewed by Sam Weinig.

Source/WebCore:

No new tests (Covered by enabling a whole bunch of existing tests).

Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::stop): Call removeAllEventListeners() to clean up the Worker VM

before it shuts down.

Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::stop): Call removeAllEventListeners()

Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::IDBTransaction): Initialize with the correct VM.
(WebCore::IDBTransaction::stop): Call removeAllEventListeners()
(WebCore::IDBTransaction::operationDidComplete):

Modules/indexeddb/client/IDBConnectionProxy.cpp:

(WebCore::IDBClient::IDBConnectionProxy::takeIDBOpenDBRequest):
(WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest): Don't take the request from

the map, but rather let the request take itself from its appropriate thread.

Modules/indexeddb/client/IDBConnectionProxy.h:

Modules/indexeddb/client/TransactionOperation.h:

(WebCore::IDBClient::TransactionOperation::completed): Rework clearing out the completion

handler, as the handler itself might hold the last reference to this.

page/SecurityOrigin.h:

(WebCore::SecurityOrigin::hasUniversalAccess):

workers/WorkerGlobalScope.cpp:

(WebCore::WorkerGlobalScope::WorkerGlobalScope): If the parent context's SecurityOrigin had

universal access, grant it to this one.

LayoutTests:

Many tests that obviously pass need updated expectations for the details of error messages.

Others just work right out of the box.

TestExpectations: Enable some tests, and categorize remaining failures.

http/tests/security/cross-origin-worker-indexeddb-allowed-expected.txt:
http/tests/security/cross-origin-worker-indexeddb-allowed.html:
http/tests/security/cross-origin-worker-indexeddb-expected.txt:
http/tests/security/cross-origin-worker-indexeddb.html:
http/tests/security/resources/cross-origin-iframe-for-worker-indexeddb.html:
http/tests/security/resources/document-for-cross-origin-worker-indexeddb.html:
http/tests/security/resources/worker-for-indexeddb.js:
storage/indexeddb/basics-workers.html:
storage/indexeddb/cursor-advance-workers-expected.txt:
storage/indexeddb/cursor-advance-workers.html:
storage/indexeddb/deletedatabase-delayed-by-open-and-versionchange-workers.html:
storage/indexeddb/dont-commit-on-blocked-private.html:
storage/indexeddb/dont-commit-on-blocked.html:
storage/indexeddb/factory-basics-workers.html:
storage/indexeddb/index-basics-workers-expected.txt:
storage/indexeddb/index-basics-workers.html:
storage/indexeddb/modern/workers-disabled.html:
storage/indexeddb/objectstore-basics-workers-expected.txt:
storage/indexeddb/objectstore-basics-workers.html:
storage/indexeddb/open-twice-workers.html:
storage/indexeddb/pending-activity-workers.html:
storage/indexeddb/pending-version-change-on-exit-private.html:
storage/indexeddb/pending-version-change-on-exit.html:
storage/indexeddb/pending-version-change-stuck-private.html:
storage/indexeddb/pending-version-change-stuck-works-with-terminate-private.html:
storage/indexeddb/pending-version-change-stuck-works-with-terminate.html:
storage/indexeddb/pending-version-change-stuck.html:
storage/indexeddb/transaction-complete-workers-expected.txt:
storage/indexeddb/transaction-complete-workers-private-expected.txt:
storage/indexeddb/transaction-complete-workers-private.html:
storage/indexeddb/transaction-complete-workers.html:
storage/indexeddb/unprefix-workers.html:

2:01 PM Changeset in webkit [200520] by rniwa@webkit.org

4 edits
2 adds in trunk

FKA: No way to get focus from DOM to shadow DOM components (Was: HTML5 media controls not keyboard accessible)
https://bugs.webkit.org/show_bug.cgi?id=117857

Reviewed by Jer Noble.

Source/WebCore:

The bug was caused by hasCustomFocusLogic returning true on media elements.

Fix the bug by removing this function so that FocusController will walk into the shadow tree of media elements
to look for focusable elements. This will allow AT such as Voice Over to iterate through controls.

We don't seem to draw focus rings inside the media elements but that could be tweaked in a separate patch.

Test: media/tab-focus-inside-media-elements.html

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::hasCustomFocusLogic): Deleted.

html/HTMLMediaElement.h:

LayoutTests:

Added a regression test for moving focus into media elements by pressing tab key.

media/tab-focus-inside-media-elements-expected.txt: Added.
media/tab-focus-inside-media-elements.html: Added.

1:38 PM Changeset in webkit [200519] by andersca@apple.com

10 edits
1 delete in trunk/Source/WebCore

Tidy up the LinkRelAttribute code
https://bugs.webkit.org/show_bug.cgi?id=157429

Reviewed by Sam Weinig.

Get rid of IconURL.h and move the IconType enumeration inside LinkRelAttribute.
Remove the InvalidIcon enum declaration and use WTF::Optional instead.

WebCore.xcodeproj/project.pbxproj:
dom/IconURL.h: Removed.
html/HTMLLinkElement.cpp:

(WebCore::HTMLLinkElement::iconType):
(WebCore::HTMLLinkElement::addSubresourceAttributeURLs):

html/HTMLLinkElement.h:
html/LinkRelAttribute.cpp:

(WebCore::LinkRelAttribute::LinkRelAttribute):

html/LinkRelAttribute.h:
html/parser/HTMLPreloadScanner.cpp:

(WebCore::TokenPreloadScanner::StartTagScanner::relAttributeIsStyleSheet):

loader/FrameLoader.h:
loader/FrameLoaderClient.h:
loader/icon/IconController.cpp:

(WebCore::iconFromLinkElements):

1:37 PM Changeset in webkit [200518] by fpizlo@apple.com

1 edit
2 adds in trunk/LayoutTests

JS Function removed after parsing
https://bugs.webkit.org/show_bug.cgi?id=149175

Reviewed by Mark Lam.

This bug doesn't happen anymore, but the test case is still useful. This test will fail 1/5 of
the time if we regress.

js/dom/function-removed-after-parsing-expected.txt: Added.
js/dom/function-removed-after-parsing.html: Added.

12:54 PM Changeset in webkit [200517] by commit-queue@webkit.org

5 edits
2 deletes in trunk/Source/WebInspectorUI

Web Inspector: Remove HeapSnapshot Summary View
https://bugs.webkit.org/show_bug.cgi?id=157385

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-06
Reviewed by Timothy Hatcher.

Localizations/en.lproj/localizedStrings.js:
UserInterface/Main.html:
UserInterface/Views/HeapSnapshotClusterContentView.js:

(WebInspector.HeapSnapshotClusterContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype.get summaryContentView): Deleted.
(WebInspector.HeapSnapshotClusterContentView.prototype.showSummary): Deleted.
(WebInspector.HeapSnapshotClusterContentView.prototype._pathComponentForContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype._identifierForContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype._showContentViewForIdentifier):

UserInterface/Views/HeapSnapshotSummaryContentView.css: Removed.
UserInterface/Views/HeapSnapshotSummaryContentView.js: Removed.
UserInterface/Views/Variables.css:

(:root):

12:54 PM Changeset in webkit [200516] by jer.noble@apple.com

4 edits
2 adds in trunk

Muted media elements should be allowed to autoplay, even if RequireUserGestureForAudioRateChange is set.
https://bugs.webkit.org/show_bug.cgi?id=157404
<rdar://problem/26016802>

Reviewed by Eric Carlson.

Source/WebCore:

Test: media/audio-playback-restriction-play-muted.html

Add element.muted() as a critera of whether playback is permitted when
RequireUserGestureForAudioRateChange is set. Also, make sure to re-evaluate whether the
element should be playing when muted is changed without a user gesture.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setMuted):

html/MediaElementSession.cpp:

(WebCore::MediaElementSession::playbackPermitted):

LayoutTests:

media/audio-playback-restriction-play-muted-expected.txt: Added.
media/audio-playback-restriction-play-muted.html: Added.

12:25 PM Changeset in webkit [200515] by Ryan Haddad

2 edits in trunk/Tools

Increase delay when launching multiple ios-simulators in parallel
https://bugs.webkit.org/show_bug.cgi?id=157422

Reviewed by Alexey Proskuryakov.

Tests are intermittently failing when launching multiple simulators in parallel due to "You are opening
this application for the first time" confirmation dialogs. Increasing the delay to alleviate this issue.

Scripts/webkitpy/port/ios.py:

(IOSSimulatorPort.setup_test_run):

11:17 AM Changeset in webkit [200514] by adachan@apple.com

6 edits in trunk/Source/WebKit2

Create a fence in WebVideoFullscreenManagerProxy::setVideoLayerFrame() to pass to the web process
https://bugs.webkit.org/show_bug.cgi?id=157409

Reviewed by Tim Horton.

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenManagerProxy::setVideoLayerFrame):
Create a fence by calling DrawingAreaProxy::createFence() and pass it when sending the
WebVideoFullscreenManager::SetVideoLayerFrameFenced message.

UIProcess/DrawingAreaProxy.cpp:

(WebKit::DrawingAreaProxy::createFence):
Stub implementation. Assert not to be reached here since it's only implemented on Mac so far.

UIProcess/DrawingAreaProxy.h:

UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.h:
UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm:

(WebKit::TiledCoreAnimationDrawingAreaProxy::createFence):
Renamed from createFenceForGeometryUpdate() since we are using it for more than just updating geometry.
(WebKit::TiledCoreAnimationDrawingAreaProxy::sendUpdateGeometry):
Update due to method rename.

9:57 AM Changeset in webkit [200513] by dbates@webkit.org

2 edits in trunk/Source/WebKit/mac

Remove workaround for Apple Internal bots
<rdar://problem/25989808>

Reverts the workaround added in r200211 as it is no longer needed.

WebView/WebPDFView.h:

9:18 AM Changeset in webkit [200512] by peavo@outlook.com

2 edits in trunk/Tools

[Win] Remove WinXP support.
https://bugs.webkit.org/show_bug.cgi?id=157416

Reviewed by Brent Fulgham.

win/DLLLauncher/DLLLauncherMain.cpp:

(enableTerminationOnHeapCorruption):

8:53 AM Changeset in webkit [200511] by Brent Fulgham

4 edits in trunk/Source/WebCore

Don't use invalidated ResourceLoadStatistics iterators
https://bugs.webkit.org/show_bug.cgi?id=157412
<rdar://problem/26133153>

Reviewed by Chris Dumez.

ResourceLoadObserver::logFrameNavigation was using references bound to the 'value'
member of iterators from the ResourceLoadStatistics HashMap. When new entries were
added, these iterators were invalidated causing the references to refer to invalid
memory.

Renamed 'resourceStatisticsForPrimaryDomain' to 'ensureResourceStatisticsForPrimaryDomain'
to clarify that it may mutate the underlying HashMap, thereby invalidating any
existing iterators.

loader/ResourceLoadObserver.cpp:

(WebCore::ResourceLoadObserver::logFrameNavigation): Protect against HashMap
elements being copied/moved when new intries are added.

loader/ResourceLoadStatisticsStore.cpp:

(WebCore::ResourceLoadStatisticsStore::setResourceStatisticsForPrimaryDomain): Added.

loader/ResourceLoadStatisticsStore.h:

1:17 AM Changeset in webkit [200510] by Manuel Rego Casasnovas

329 edits in trunk

[css-grid] Unprefix CSS Grid Layout properties
https://bugs.webkit.org/show_bug.cgi?id=157137

Reviewed by Simon Fraser.

Remove "-webkit" prefix from all the grid layout properties,
including the display value.
Update the source code to remove the prefix where it was used too.

ManualTests/css-grid-layout-item-with-huge-span-crash.html:

PerformanceTests:

Layout/auto-grid-lots-of-data.html:
Layout/fixed-grid-lots-of-data.html:
Layout/fixed-grid-lots-of-stretched-data.html:

Source/WebCore:

css/CSSComputedStyleDeclaration.cpp:

(WebCore::isLayoutDependent):
(WebCore::ComputedStyleExtractor::propertyValue):

css/CSSParser.cpp:

(WebCore::isSimpleLengthPropertyID):
(WebCore::isValidKeywordPropertyAndValue):
(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parseGridGapShorthand):
(WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
(WebCore::CSSParser::parseGridTemplateShorthand):
(WebCore::CSSParser::parseGridShorthand):
(WebCore::CSSParser::parseGridAreaShorthand):

css/CSSPrimitiveValueMappings.h:

(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):

css/CSSPropertyNames.in:
css/CSSValueKeywords.in:
css/StyleBuilderCustom.h:

(WebCore::StyleBuilderCustom::applyInitialGridTemplateAreas):
(WebCore::StyleBuilderCustom::applyInheritGridTemplateAreas):
(WebCore::StyleBuilderCustom::applyValueGridTemplateAreas):
(WebCore::StyleBuilderCustom::applyInitialGridTemplateColumns):
(WebCore::StyleBuilderCustom::applyInheritGridTemplateColumns):
(WebCore::StyleBuilderCustom::applyValueGridTemplateColumns):
(WebCore::StyleBuilderCustom::applyInitialGridTemplateRows):
(WebCore::StyleBuilderCustom::applyInheritGridTemplateRows):
(WebCore::StyleBuilderCustom::applyValueGridTemplateRows):

css/StyleProperties.cpp:

(WebCore::StyleProperties::getPropertyValue):

Source/WebInspectorUI:

UserInterface/Models/CSSKeywordCompletions.js:

Tools:

TestWebKitAPI/Tests/WebCore/CSSParser.cpp:

(TestWebKitAPI::TEST):

LayoutTests:

css3/parse-align-content.html:
css3/parse-align-items.html:
css3/parse-align-self.html:
css3/parse-justify-content.html:
fast/css-grid-layout/absolute-positioning-definite-sizes.html:
fast/css-grid-layout/absolute-positioning-grid-container-containing-block.html:
fast/css-grid-layout/absolute-positioning-grid-container-parent.html:
fast/css-grid-layout/anonymous-grid-items-expected.html:
fast/css-grid-layout/anonymous-grid-items.html:
fast/css-grid-layout/auto-content-resolution-columns.html:
fast/css-grid-layout/auto-content-resolution-rows.html:
fast/css-grid-layout/breadth-size-resolution-grid.html:
fast/css-grid-layout/calc-resolution-grid-item.html:
fast/css-grid-layout/compute-intrinsic-widths-scrollbar.html:
fast/css-grid-layout/display-grid-set-get-expected.txt:
fast/css-grid-layout/explicit-grid-size.html:
fast/css-grid-layout/flex-and-content-sized-resolution-columns-expected.txt:
fast/css-grid-layout/flex-and-content-sized-resolution-columns.html:
fast/css-grid-layout/flex-and-intrinsic-sizes.html:
fast/css-grid-layout/flex-and-minmax-content-resolution-columns.html:
fast/css-grid-layout/flex-and-minmax-content-resolution-rows.html:
fast/css-grid-layout/flex-content-distribution.html:
fast/css-grid-layout/flex-content-resolution-columns.html:
fast/css-grid-layout/flex-content-resolution-rows.html:
fast/css-grid-layout/flex-content-sized-column-use-available-width.html:
fast/css-grid-layout/flex-content-sized-columns-resize.html:
fast/css-grid-layout/flex-factor-sum-less-than-1.html:
fast/css-grid-layout/float-not-protruding-into-next-grid-item.html:
fast/css-grid-layout/floating-empty-grids.html:
fast/css-grid-layout/grid-align-content-distribution-vertical-lr.html:
fast/css-grid-layout/grid-align-content-distribution-vertical-rl.html:
fast/css-grid-layout/grid-align-content-distribution.html:
fast/css-grid-layout/grid-align-content-vertical-lr.html:
fast/css-grid-layout/grid-align-content-vertical-rl.html:
fast/css-grid-layout/grid-align-content.html:
fast/css-grid-layout/grid-align-justify-margin-border-padding-vertical-lr.html:
fast/css-grid-layout/grid-align-justify-margin-border-padding-vertical-rl.html:
fast/css-grid-layout/grid-align-justify-margin-border-padding.html:
fast/css-grid-layout/grid-align-justify-overflow.html:
fast/css-grid-layout/grid-align-justify-stretch.html:
fast/css-grid-layout/grid-align-stretching-replaced-items.html:
fast/css-grid-layout/grid-align.html:
fast/css-grid-layout/grid-auto-columns-rows-auto-flow-resolution.html:
fast/css-grid-layout/grid-auto-columns-rows-get-set-expected.txt:
fast/css-grid-layout/grid-auto-columns-rows-get-set.html:
fast/css-grid-layout/grid-auto-columns-rows-resolution.html:
fast/css-grid-layout/grid-auto-columns-rows-update.html:
fast/css-grid-layout/grid-auto-flow-get-set-expected.txt:
fast/css-grid-layout/grid-auto-flow-get-set.html:
fast/css-grid-layout/grid-auto-flow-resolution.html:
fast/css-grid-layout/grid-auto-flow-sparse.html:
fast/css-grid-layout/grid-auto-flow-update.html:
fast/css-grid-layout/grid-automatic-minimum-for-auto-columns-expected.txt:
fast/css-grid-layout/grid-automatic-minimum-for-auto-columns.html:
fast/css-grid-layout/grid-automatic-minimum-for-auto-rows-expected.txt:
fast/css-grid-layout/grid-automatic-minimum-for-auto-rows.html:
fast/css-grid-layout/grid-columns-rows-get-set-expected.txt:
fast/css-grid-layout/grid-columns-rows-get-set-multiple-expected.txt:
fast/css-grid-layout/grid-columns-rows-get-set-multiple.html:
fast/css-grid-layout/grid-columns-rows-get-set.html:
fast/css-grid-layout/grid-container-change-named-grid-lines-recompute-child.html:
fast/css-grid-layout/grid-container-ignore-first-letter.html:
fast/css-grid-layout/grid-content-alignment-and-self-alignment-spanning.html:
fast/css-grid-layout/grid-content-alignment-and-self-alignment.html:
fast/css-grid-layout/grid-content-alignment-overflow.html:
fast/css-grid-layout/grid-content-alignment-stretch-only-valid-for-auto-sized-tracks.html:
fast/css-grid-layout/grid-content-alignment-stretch-with-different-sized-tracks.html:
fast/css-grid-layout/grid-content-alignment-with-span-vertical-lr.html:
fast/css-grid-layout/grid-content-alignment-with-span-vertical-rl.html:
fast/css-grid-layout/grid-content-alignment-with-span.html:
fast/css-grid-layout/grid-content-sized-columns-resolution-expected.txt:
fast/css-grid-layout/grid-content-sized-columns-resolution.html:
fast/css-grid-layout/grid-disable.html:
fast/css-grid-layout/grid-dynamic-updates-relayout.html:
fast/css-grid-layout/grid-element-auto-repeat-get-set-expected.txt:
fast/css-grid-layout/grid-element-auto-repeat-get-set.html:
fast/css-grid-layout/grid-element-border-grid-item.html:
fast/css-grid-layout/grid-element-border-padding-grid-item.html:
fast/css-grid-layout/grid-element-change-columns-repaint.html:
fast/css-grid-layout/grid-element-change-rows-repaint.html:
fast/css-grid-layout/grid-element-empty-row-column.html:
fast/css-grid-layout/grid-element-min-max-height.html:
fast/css-grid-layout/grid-element-min-max-width.html:
fast/css-grid-layout/grid-element-padding-grid-item.html:
fast/css-grid-layout/grid-element-padding-margin.html:
fast/css-grid-layout/grid-element-repeat-get-set-expected.txt:
fast/css-grid-layout/grid-element-repeat-get-set.html:
fast/css-grid-layout/grid-element-shrink-to-fit.html:
fast/css-grid-layout/grid-grow-tracks-to-their-max-expected.txt:
fast/css-grid-layout/grid-grow-tracks-to-their-max.html:
fast/css-grid-layout/grid-gutters-and-alignment.html:
fast/css-grid-layout/grid-gutters-and-flex-content.html:
fast/css-grid-layout/grid-gutters-and-tracks.html:
fast/css-grid-layout/grid-gutters-get-set-expected.txt:
fast/css-grid-layout/grid-gutters-get-set.html:
fast/css-grid-layout/grid-indefinite-calculated-height-crash-expected.txt:
fast/css-grid-layout/grid-indefinite-calculated-height-crash.html:
fast/css-grid-layout/grid-initialize-span-one-items-expected.txt:
fast/css-grid-layout/grid-initialize-span-one-items.html:
fast/css-grid-layout/grid-item-addition-auto-placement-update.html:
fast/css-grid-layout/grid-item-addition-track-breadth-update.html:
fast/css-grid-layout/grid-item-area-get-set-expected.txt:
fast/css-grid-layout/grid-item-area-get-set.html:
fast/css-grid-layout/grid-item-auto-margins-alignment-vertical-lr.html:
fast/css-grid-layout/grid-item-auto-margins-alignment-vertical-rl.html:
fast/css-grid-layout/grid-item-auto-margins-alignment.html:
fast/css-grid-layout/grid-item-auto-margins-and-stretch.html:
fast/css-grid-layout/grid-item-auto-margins-must-respect-specified-margins.html:
fast/css-grid-layout/grid-item-auto-placement-automatic-span.html:
fast/css-grid-layout/grid-item-auto-placement-definite-span.html:
fast/css-grid-layout/grid-item-auto-placement-fixed-row-column.html:
fast/css-grid-layout/grid-item-auto-sized-align-justify-margin-border-padding.html:
fast/css-grid-layout/grid-item-bad-named-area-auto-placement.html:
fast/css-grid-layout/grid-item-bad-resolution-double-span.html:
fast/css-grid-layout/grid-item-change-column-repaint.html:
fast/css-grid-layout/grid-item-change-row-repaint.html:
fast/css-grid-layout/grid-item-column-row-get-set-expected.txt:
fast/css-grid-layout/grid-item-column-row-get-set.html:
fast/css-grid-layout/grid-item-display.html:
fast/css-grid-layout/grid-item-end-after-get-set-expected.txt:
fast/css-grid-layout/grid-item-end-after-get-set.html:
fast/css-grid-layout/grid-item-margin-auto-columns-rows-horizontal-ltr.html:
fast/css-grid-layout/grid-item-margin-auto-columns-rows-horizontal-rtl.html:
fast/css-grid-layout/grid-item-margin-auto-columns-rows-vertical-ltr.html:
fast/css-grid-layout/grid-item-margin-auto-columns-rows-vertical-rtl.html:
fast/css-grid-layout/grid-item-margin-resolution.html:
fast/css-grid-layout/grid-item-margins-not-collapse.html:
fast/css-grid-layout/grid-item-multiple-minmax-content-resolution.html:
fast/css-grid-layout/grid-item-named-grid-area-resolution.html:
fast/css-grid-layout/grid-item-named-grid-line-resolution.html:
fast/css-grid-layout/grid-item-negative-indexes.html:
fast/css-grid-layout/grid-item-negative-integer-explicit-grid-resolution.html:
fast/css-grid-layout/grid-item-negative-position-resolution.html:
fast/css-grid-layout/grid-item-order-auto-flow-resolution.html:
fast/css-grid-layout/grid-item-order-in-content-sized-columns-resolution.html:
fast/css-grid-layout/grid-item-order-paint-order.html:
fast/css-grid-layout/grid-item-position-changed-dynamic.html:
fast/css-grid-layout/grid-item-removal-auto-placement-update.html:
fast/css-grid-layout/grid-item-removal-track-breadth-update.html:
fast/css-grid-layout/grid-item-spanning-resolution.html:
fast/css-grid-layout/grid-item-start-before-get-set-expected.txt:
fast/css-grid-layout/grid-item-start-before-get-set.html:
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding-vertical-lr.html:
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding-vertical-rl.html:
fast/css-grid-layout/grid-item-stretch-with-margins-borders-padding.html:
fast/css-grid-layout/grid-item-text-background-not-interleaved.html:
fast/css-grid-layout/grid-item-unknown-named-grid-line-resolution.html:
fast/css-grid-layout/grid-item-with-border-in-fr.html:
fast/css-grid-layout/grid-item-with-border-in-intrinsic.html:
fast/css-grid-layout/grid-item-with-percent-height-in-auto-height-grid-resolution.html:
fast/css-grid-layout/grid-item-with-percent-min-max-height-dynamic.html:
fast/css-grid-layout/grid-item-z-index-change-repaint-expected.html:
fast/css-grid-layout/grid-item-z-index-change-repaint.html:
fast/css-grid-layout/grid-item-z-index-stacking-context-expected.html:
fast/css-grid-layout/grid-item-z-index-stacking-context.html:
fast/css-grid-layout/grid-item-z-index-support.html:
fast/css-grid-layout/grid-items-should-not-be-stretched-when-height-or-width-or-margin-change.html:
fast/css-grid-layout/grid-justify-content-distribution-vertical-lr.html:
fast/css-grid-layout/grid-justify-content-distribution-vertical-rl.html:
fast/css-grid-layout/grid-justify-content-distribution.html:
fast/css-grid-layout/grid-justify-content-vertical-lr.html:
fast/css-grid-layout/grid-justify-content-vertical-rl.html:
fast/css-grid-layout/grid-justify-content.html:
fast/css-grid-layout/grid-percent-track-margin-border-padding.html:
fast/css-grid-layout/grid-percent-track-scrollbar.html:
fast/css-grid-layout/grid-positioned-children-writing-modes.html:
fast/css-grid-layout/grid-positioned-items-background-rtl.html:
fast/css-grid-layout/grid-positioned-items-background.html:
fast/css-grid-layout/grid-positioned-items-content-alignment-rtl.html:
fast/css-grid-layout/grid-positioned-items-content-alignment.html:
fast/css-grid-layout/grid-positioned-items-gaps-rtl.html:
fast/css-grid-layout/grid-positioned-items-gaps.html:
fast/css-grid-layout/grid-positioned-items-implicit-grid-line.html:
fast/css-grid-layout/grid-positioned-items-implicit-grid.html:
fast/css-grid-layout/grid-positioned-items-padding.html:
fast/css-grid-layout/grid-positioned-items-unknown-named-grid-line.html:
fast/css-grid-layout/grid-positioned-items-within-grid-implicit-track.html:
fast/css-grid-layout/grid-preferred-logical-widths.html:
fast/css-grid-layout/grid-repeat-calc-expected.txt:
fast/css-grid-layout/grid-repeat-calc.html:
fast/css-grid-layout/grid-shorthand-computed-style-crash.html:
fast/css-grid-layout/grid-shorthand-get-set-expected.txt:
fast/css-grid-layout/grid-shorthand-get-set.html:
fast/css-grid-layout/grid-sizing-positioned-items.html:
fast/css-grid-layout/grid-strict-ordering-crash.html:
fast/css-grid-layout/grid-template-areas-empty-string-crash.html:
fast/css-grid-layout/grid-template-areas-get-set-expected.txt:
fast/css-grid-layout/grid-template-areas-get-set.html:
fast/css-grid-layout/grid-template-areas-infinite-loop.html:
fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment-expected.txt:
fast/css-grid-layout/grid-template-columns-rows-computed-style-gaps-content-alignment.html:
fast/css-grid-layout/grid-template-shorthand-computed-style-crash.html:
fast/css-grid-layout/grid-template-shorthand-get-set-expected.txt:
fast/css-grid-layout/grid-template-shorthand-get-set.html:
fast/css-grid-layout/grid-update-sizes-after-distributing-all-expected.txt:
fast/css-grid-layout/grid-update-sizes-after-distributing-all.html:
fast/css-grid-layout/grid-was-populated-assert.html:
fast/css-grid-layout/grid-with-relative-font-length-crash.html:
fast/css-grid-layout/implicit-columns-auto-resolution.html:
fast/css-grid-layout/implicit-position-dynamic-change-expected.txt:
fast/css-grid-layout/implicit-position-dynamic-change.html:
fast/css-grid-layout/implicit-rows-auto-resolution.html:
fast/css-grid-layout/implicit-tracks-before-explicit.html:
fast/css-grid-layout/justify-self-cell.html:
fast/css-grid-layout/mark-as-infinitely-growable-expected.txt:
fast/css-grid-layout/mark-as-infinitely-growable.html:
fast/css-grid-layout/maximize-tracks-definite-indefinite-height.html:
fast/css-grid-layout/min-content-row-must-shrink-when-column-grows.html:
fast/css-grid-layout/min-height-border-box.html:
fast/css-grid-layout/min-width-height-auto-and-margins.html:
fast/css-grid-layout/min-width-height-auto-overflow.html:
fast/css-grid-layout/min-width-height-auto.html:
fast/css-grid-layout/min-width-margin-box.html:
fast/css-grid-layout/minmax-fixed-logical-height-only.html:
fast/css-grid-layout/minmax-fixed-logical-width-only.html:
fast/css-grid-layout/minmax-max-content-resolution-columns.html:
fast/css-grid-layout/minmax-max-content-resolution-rows.html:
fast/css-grid-layout/minmax-min-content-column-resolution-columns.html:
fast/css-grid-layout/minmax-min-content-column-resolution-rows.html:
fast/css-grid-layout/minmax-spanning-resolution-columns.html:
fast/css-grid-layout/minmax-spanning-resolution-rows.html:
fast/css-grid-layout/named-grid-line-get-set-expected.txt:
fast/css-grid-layout/named-grid-line-get-set.html:
fast/css-grid-layout/named-grid-lines-computed-style-implicit-tracks-expected.txt:
fast/css-grid-layout/named-grid-lines-computed-style-implicit-tracks.html:
fast/css-grid-layout/named-grid-lines-with-named-grid-areas-dynamic-get-set.html:
fast/css-grid-layout/named-grid-lines-with-named-grid-areas-get-set-expected.txt:
fast/css-grid-layout/named-grid-lines-with-named-grid-areas-get-set.html:
fast/css-grid-layout/named-grid-lines-with-named-grid-areas-resolution.html:
fast/css-grid-layout/non-grid-columns-rows-get-set-expected.txt:
fast/css-grid-layout/non-grid-columns-rows-get-set-multiple-expected.txt:
fast/css-grid-layout/non-grid-columns-rows-get-set-multiple.html:
fast/css-grid-layout/non-grid-columns-rows-get-set.html:
fast/css-grid-layout/non-grid-element-repeat-get-set-expected.txt:
fast/css-grid-layout/non-grid-element-repeat-get-set.html:
fast/css-grid-layout/non-named-grid-line-get-set-expected.txt:
fast/css-grid-layout/non-named-grid-line-get-set.html:
fast/css-grid-layout/percent-grid-item-in-percent-grid-track-in-percent-grid.html:
fast/css-grid-layout/percent-grid-item-in-percent-grid-track-update.html:
fast/css-grid-layout/percent-grid-item-in-percent-grid-track.html:
fast/css-grid-layout/percent-intrinsic-track-breadth.html:
fast/css-grid-layout/percent-of-indefinite-track-size-in-auto.html:
fast/css-grid-layout/percent-of-indefinite-track-size-in-minmax-crash.html:
fast/css-grid-layout/percent-of-indefinite-track-size.html:
fast/css-grid-layout/percent-padding-margin-resolution-grid-item-update.html:
fast/css-grid-layout/percent-padding-margin-resolution-grid-item.html:
fast/css-grid-layout/percent-resolution-grid-item.html:
fast/css-grid-layout/percent-track-breadths-regarding-container-size.html:
fast/css-grid-layout/place-cell-by-index.html:
fast/css-grid-layout/positioned-grid-items-should-not-create-implicit-tracks.html:
fast/css-grid-layout/positioned-grid-items-should-not-take-up-space.html:
fast/css-grid-layout/relayout-align-items-changed.html:
fast/css-grid-layout/relayout-align-self-changed.html:
fast/css-grid-layout/relayout-indefinite-heights.html:
fast/css-grid-layout/relayout-justify-items-changed.html:
fast/css-grid-layout/relayout-justify-self-changed.html:
fast/css-grid-layout/resources/display-grid-set-get.js:
fast/css-grid-layout/resources/grid-columns-rows-get-set-multiple.js:

(testInherit):
(testInitial):

fast/css-grid-layout/resources/grid-columns-rows-get-set.js:

(testInherit):
(testInitial):

fast/css-grid-layout/resources/grid-definitions-parsing-utils.js:

(testGridTemplatesValues):
(checkGridTemplatesSetJSValues):
(testGridTemplatesSetBadJSValues):
(checkGridAutoFlowSetCSSValue):
(checkGridAutoFlowSetJSValue):
(testGridAutoDefinitionsValues):
(testGridGapDefinitionsValues):

fast/css-grid-layout/resources/grid-item-column-row-parsing-utils.js:

(checkColumnRowValues):
(window.testColumnRowJSParsing):
(window.testColumnRowInvalidJSParsing):
(window.testColumnStartRowStartJSParsing):
(window.testColumnEndRowEndJSParsing):
(setupInheritTest):
(setupInitialTest):
(window.testColumnRowInheritJSParsing):
(window.testStartBeforeInheritJSParsing):
(window.testEndAfterInheritJSParsing):
(window.testColumnRowInitialJSParsing):
(window.testStartBeforeInitialJSParsing):
(window.testEndAfterInitialJSParsing):

fast/css-grid-layout/resources/grid-shorthand-parsing-utils.js:

(testGridDefinitionsValues):
(checkGridDefinitionsSetJSValues):
(testGridDefinitionsSetBadJSValues):

fast/css-grid-layout/resources/grid-template-shorthand-parsing-utils.js:

(testGridDefinitionsValues):
(checkGridDefinitionsSetJSValues):
(testGridDefinitionsSetBadJSValues):

fast/css-grid-layout/resources/grid.css:

(.grid):
(.inline-grid):
(.firstRowFirstColumn):
(.onlyFirstRowOnlyFirstColumn):
(.firstRowSecondColumn):
(.onlyFirstRowOnlySecondColumn):
(.firstRowThirdColumn):
(.firstRowFourthColumn):
(.secondRowFirstColumn):
(.onlySecondRowOnlyFirstColumn):
(.secondRowSecondColumn):
(.onlySecondRowOnlySecondColumn):
(.endSecondRowEndSecondColumn):
(.secondRowThirdColumn):
(.secondRowFourthColumn):
(.thirdRowFirstColumn):
(.thirdRowSecondColumn):
(.thirdRowThirdColumn):
(.fourthRowFirstColumn):
(.fourthRowSecondColumn):
(.firstAutoRowSecondAutoColumn):
(.autoLastRowAutoLastColumn):
(.autoSecondRowAutoFirstColumn):
(.firstRowBothColumn):
(.secondRowBothColumn):
(.bothRowFirstColumn):
(.bothRowSecondColumn):
(.bothRowBothColumn):
(.autoRowAutoColumn):
(.firstRowAutoColumn):
(.secondRowAutoColumn):
(.thirdRowAutoColumn):
(.autoRowFirstColumn):
(.autoRowSecondColumn):
(.autoRowThirdColumn):
(.autoRowAutoColumnSpanning2):
(.autoRowSpanning2AutoColumn):
(.autoRowSpanning2AutoColumnSpanning3):
(.autoRowSpanning3AutoColumnSpanning2):
(.autoRowFirstColumnSpanning2):
(.autoRowSecondColumnSpanning2):
(.firstRowSpanning2AutoColumn):
(.secondRowSpanning2AutoColumn):
(.gridAutoFlowColumnSparse):
(.gridAutoFlowColumnDense):
(.gridAutoFlowRowSparse):
(.gridAutoFlowRowDense):

fast/css-grid-layout/resources/non-grid-columns-rows-get-set-multiple.js:

(testInherit):
(testInitial):

fast/css-grid-layout/resources/non-grid-columns-rows-get-set.js:

(testInherit):
(testInitial):

fast/css-grid-layout/should-not-collapse-anonymous-blocks.html:
fast/css-grid-layout/swap-lines-if-start-is-further-endward-than-end-line-expected.html:
fast/css-grid-layout/swap-lines-if-start-is-further-endward-than-end-line.html:
fast/css-grid-layout/tracks-number-greatly-exceeding-available-size-crash.html:
fast/css/auto-min-size.html:
fast/css/first-letter-ignores-display-property.html:
fast/css/getComputedStyle/computed-style-expected.txt:
fast/css/getComputedStyle/computed-style-without-renderer-expected.txt:
fast/css/getComputedStyle/resources/property-names.js:
fast/css/parse-justify-items.html:
fast/events/key-events-in-editable-gridbox.html:
fast/repaint/align-items-overflow-change.html:
fast/repaint/align-self-change.html:
fast/repaint/align-self-overflow-change.html:
fast/repaint/justify-items-change.html:
fast/repaint/justify-items-legacy-change.html:
fast/repaint/justify-items-overflow-change.html:
fast/repaint/justify-self-change.html:
fast/repaint/justify-self-overflow-change.html:
fast/text-autosizing/cluster-inline-grid-flex-box-expected.html:
fast/text-autosizing/cluster-inline-grid-flex-box.html:
ietestcenter/css3/grid/display-grid-001-expected.htm:
ietestcenter/css3/grid/display-grid-001.htm:
ietestcenter/css3/grid/display-grid-002-expected.htm:
ietestcenter/css3/grid/display-grid-002.htm:
ietestcenter/css3/grid/grid-column-001-expected.htm:
ietestcenter/css3/grid/grid-column-001.htm:
ietestcenter/css3/grid/grid-column-002-expected.htm:
ietestcenter/css3/grid/grid-column-002.htm:
ietestcenter/css3/grid/grid-column-003-expected.htm:
ietestcenter/css3/grid/grid-column-003.htm:
ietestcenter/css3/grid/grid-columns-001-expected.htm:
ietestcenter/css3/grid/grid-columns-001.htm:
ietestcenter/css3/grid/grid-items-001-expected.htm:
ietestcenter/css3/grid/grid-items-001.htm:
ietestcenter/css3/grid/grid-items-002-expected.htm:
ietestcenter/css3/grid/grid-items-002.htm:
ietestcenter/css3/grid/grid-items-003-expected.htm:
ietestcenter/css3/grid/grid-items-003.htm:
ietestcenter/css3/grid/grid-items-004-expected.htm:
ietestcenter/css3/grid/grid-items-004.htm:
ietestcenter/css3/grid/grid-items-005-expected.htm:
ietestcenter/css3/grid/grid-items-005.htm:
svg/css/getComputedStyle-basic-expected.txt:

12:45 AM Changeset in webkit [200509] by n_wang@apple.com

5 edits
2 adds in trunk

AX: <attachment> element should have a replacement character
https://bugs.webkit.org/show_bug.cgi?id=157406

Reviewed by Chris Fleizach.

Source/WebCore:

Make sure attachment element is considered as a replaced node.

Test: accessibility/mac/attachment-element-replacement-character.html

editing/TextIterator.cpp:

(WebCore::isRendererReplacedElement):

LayoutTests:

accessibility/attachment-element-expected.txt:
accessibility/mac/attachment-element-replacement-character-expected.txt: Added.
accessibility/mac/attachment-element-replacement-character.html: Added.
editing/pasteboard/drag-and-drop-attachment-contenteditable-expected.txt:

12:27 AM Changeset in webkit [200508] by n_wang@apple.com

3 edits
2 adds in trunk

AX: String for document range is empty if end visible position anchors to a ignored replaced node
https://bugs.webkit.org/show_bug.cgi?id=157403

Reviewed by Chris Fleizach.

Source/WebCore:

The CharacterOffset that is converted from VisiblePositon is wrong when the VisiblePostion anchors
to an ignored replaced node. Fixed it by adjusting the offset of the CharacterOffset correctly in
such case.

Test: accessibility/mac/text-marker-string-for-document-end-replaced-node.html

accessibility/AXObjectCache.cpp:

(WebCore::characterOffsetsInOrder):
(WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
(WebCore::AXObjectCache::accessibilityObjectForTextMarkerData):

LayoutTests:

accessibility/mac/text-marker-string-for-document-end-replaced-node-expected.txt: Added.
accessibility/mac/text-marker-string-for-document-end-replaced-node.html: Added.

May 5, 2016:

11:25 PM Changeset in webkit [200507] by ddkilzer@apple.com

3 edits in trunk/Source/WebCore

[iOS] WebCore does not need to link to CoreAudio, GraphicsServices, SystemConfiguration frameworks
<https://webkit.org/b/157413>
<rdar://problem/26104189>

Reviewed by Gavin Barraclough.

Configurations/WebCore.xcconfig:

(OTHER_LDFLAGS_BASE_ios): Remove "-framework GraphicsServices".
(OTHER_LDFLAGS_PLATFORM[sdk=macosx*]): Add "-framework CoreAudio"
and "-framework SystemConfiguration".

WebCore.xcodeproj/project.pbxproj: Remove CoreAudio.framework

and SystemConfiguration.framework from the project file.

11:07 PM Changeset in webkit [200506] by ap@apple.com

2 edits in trunk/Tools

Partially revert http://trac.webkit.org/r200504
Improve HTTP test names in WebKitTestRunner's crash report information
https://bugs.webkit.org/show_bug.cgi?id=157389

WebKitTestRunner/cocoa/CrashReporterInfo.mm: Turns out that we can't have URLs

in crash reporter information.

8:14 PM Changeset in webkit [200505] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

REGRESSION(r200474): Exception in autocompletion - getCompletions not found
https://bugs.webkit.org/show_bug.cgi?id=157408

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-05
Reviewed by Timothy Hatcher.

UserInterface/Controllers/JavaScriptRuntimeCompletionProvider.js:

(WebInspector.JavaScriptRuntimeCompletionProvider.prototype.completionControllerCompletionsNeeded.evaluated):
This function was renamed, but this instance was missed.

7:40 PM Changeset in webkit [200504] by ap@apple.com

3 edits in trunk/Tools

Improve HTTP test names in WebKitTestRunner's crash report information
https://bugs.webkit.org/show_bug.cgi?id=157389

Reviewed by Alex Christensen.

WebKitTestRunner/InjectedBundle/cocoa/InjectedBundlePageCocoa.mm:

(WTR::InjectedBundlePage::platformDidStartProvisionalLoadForFrame): Added a FIXME.

WebKitTestRunner/cocoa/CrashReporterInfo.mm:

(WTR::testDescription): Don't bail out if the port is neither 8000 nor 8443; we
use other port numbers too. For http tests, return the complete URL string, not
just the path.

7:33 PM Changeset in webkit [200503] by beidson@apple.com

17 edits in trunk/Source

Modern IDB (Workers): Get everything to the right threads.
https://bugs.webkit.org/show_bug.cgi?id=157398

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (No current change in behavior, will be tested as bug 149953 is resolved, enabling IDB in workers).

dom/ScriptExecutionContext.h:

(WebCore::ScriptExecutionContext::postCrossThreadTask): Add a helper to post a CrossThreadTask to a context.

Modules/indexeddb/client/IDBConnectionProxy.cpp:

(WebCore::IDBClient::performCallbackOnCorrectThread): Helper to perform an IDB callback on either the main thread

or Worker thread as necessary.

(WebCore::IDBClient::IDBConnectionProxy::openDatabase):
(WebCore::IDBClient::IDBConnectionProxy::deleteDatabase):
(WebCore::IDBClient::IDBConnectionProxy::completeOpenDBRequest):
(WebCore::IDBClient::IDBConnectionProxy::createObjectStore):
(WebCore::IDBClient::IDBConnectionProxy::deleteObjectStore):
(WebCore::IDBClient::IDBConnectionProxy::clearObjectStore):
(WebCore::IDBClient::IDBConnectionProxy::createIndex):
(WebCore::IDBClient::IDBConnectionProxy::deleteIndex):
(WebCore::IDBClient::IDBConnectionProxy::putOrAdd):
(WebCore::IDBClient::IDBConnectionProxy::getRecord):
(WebCore::IDBClient::IDBConnectionProxy::getCount):
(WebCore::IDBClient::IDBConnectionProxy::deleteRecord):
(WebCore::IDBClient::IDBConnectionProxy::openCursor):
(WebCore::IDBClient::IDBConnectionProxy::iterateCursor):
(WebCore::IDBClient::IDBConnectionProxy::completeOperation):
(WebCore::IDBClient::IDBConnectionProxy::abortOpenAndUpgradeNeeded):
(WebCore::IDBClient::IDBConnectionProxy::fireVersionChangeEvent):
(WebCore::IDBClient::IDBConnectionProxy::didFireVersionChangeEvent):
(WebCore::IDBClient::IDBConnectionProxy::notifyOpenDBRequestBlocked):
(WebCore::IDBClient::IDBConnectionProxy::establishTransaction):
(WebCore::IDBClient::IDBConnectionProxy::didStartTransaction):
(WebCore::IDBClient::IDBConnectionProxy::commitTransaction):
(WebCore::IDBClient::IDBConnectionProxy::didCommitTransaction):
(WebCore::IDBClient::IDBConnectionProxy::abortTransaction):
(WebCore::IDBClient::IDBConnectionProxy::didAbortTransaction):
(WebCore::IDBClient::IDBConnectionProxy::didFinishHandlingVersionChangeTransaction):
(WebCore::IDBClient::IDBConnectionProxy::databaseConnectionClosed):
(WebCore::IDBClient::IDBConnectionProxy::scheduleMainThreadTasks):
(WebCore::IDBClient::IDBConnectionProxy::handleMainThreadTasks):

Modules/indexeddb/client/IDBConnectionProxy.h:

(WebCore::IDBClient::IDBConnectionProxy::callConnectionOnMainThread): Helper to marshall IDB operations from the

Worker thread to the main thread.

(WebCore::IDBClient::IDBConnectionProxy::postMainThreadTask):

Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::originThreadID):

Modules/indexeddb/IDBTransaction.h:

Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::putOrAdd):

Modules/indexeddb/client/IDBConnectionToServer.h:

Modules/indexeddb/client/IDBConnectionToServerDelegate.h:

Modules/indexeddb/client/TransactionOperation.cpp:

(WebCore::IDBClient::TransactionOperation::scriptExecutionContext):

Modules/indexeddb/client/TransactionOperation.h:

Modules/indexeddb/shared/IDBResourceIdentifier.cpp:

(WebCore::nextClientResourceNumber):

Modules/indexeddb/shared/InProcessIDBServer.cpp:

(WebCore::InProcessIDBServer::putOrAdd):

Modules/indexeddb/shared/InProcessIDBServer.h:

Source/WebKit2:

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:

(WebKit::WebIDBConnectionToServer::putOrAdd):

WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.h:

7:30 PM Changeset in webkit [200502] by commit-queue@webkit.org

10 edits in trunk/Source/JavaScriptCore

[JSC] Get rid of NonNegZeroDouble, it is broken
https://bugs.webkit.org/show_bug.cgi?id=157399
rdar://problem/25339647

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-05-05
Reviewed by Mark Lam.

The profile "NonNegZeroDouble" is fundamentally broken.

It is used by DFG to predict the result of ArithMul as being a Double
or Int32.
The problem is you are likely to mispredict, and when you do, you are
guaranteed to end up in a recompile loop.

The compile loops usually happen like this:
-We speculate you have Int32 despite producing doubles.
-We OSR exit on another node (ValueToInt32 for example) from the result of this ArithMul.
-When we compile this block again, ArithMul will do the same misprediction

because it unconditionally predicts Int32.

The flag NonNegZeroDouble was very unlikely to be set correctly
in the first place.

In LLINT, the flag is only set on the slow path.
Since double*double is on the fast path, those cases are ignored.

In Baseline, the flag is set for any case that falls back on double
multiplication. BUT, the DFG flag was only set for nodes that spend
many iteration in slow path, which obviously does not apply to double*double.

Given the perf drawbacks and the recompile loops, I removed
the whole flag for now.

bytecode/ValueProfile.cpp:

(WTF::printInternal):

bytecode/ValueProfile.h:

(JSC::ResultProfile::didObserveNonInt32): Deleted.
(JSC::ResultProfile::didObserveDouble): Deleted.
(JSC::ResultProfile::didObserveNonNegZeroDouble): Deleted.
(JSC::ResultProfile::setObservedNonNegZeroDouble): Deleted.

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::makeSafe): Deleted.

dfg/DFGNode.h:

(JSC::DFG::Node::mayHaveNonIntResult): Deleted.

dfg/DFGNodeFlags.cpp:

(JSC::DFG::dumpNodeFlags): Deleted.

dfg/DFGNodeFlags.h:
dfg/DFGPredictionPropagationPhase.cpp:
jit/JITMulGenerator.cpp:

(JSC::JITMulGenerator::generateFastPath): Deleted.

runtime/CommonSlowPaths.cpp:

(JSC::updateResultProfileForBinaryArithOp): Deleted.

6:26 PM Changeset in webkit [200501] by dino@apple.com

5 edits in trunk

4 and 8 digit color attributes should use the crazypants algorithm, not the CSS one.
https://bugs.webkit.org/show_bug.cgi?id=157402
<rdar://problem/26131142>

Reviewed by Simon Fraser.

Source/WebCore:

Noel and Tab from Google alerted me to the fact I broke some legacy
HTML color attributes when I added support for 4 and 8 digit hex colors
in CSS. The fix is to favor the "crazy" parsing unless we know it is a 3 or 6
digit hex value (in which case we try the CSS algorithm first).

Covered by reverting an existing test.

html/HTMLElement.cpp:

(WebCore::HTMLElement::addHTMLColorToStyle):

LayoutTests:

Restore the version that was there before I added support for
4 and 8 digit hex colors in CSS.

fast/dom/attribute-legacy-colors-expected.txt:
fast/dom/script-tests/attribute-legacy-colors.js:

6:23 PM Changeset in webkit [200500] by Manuel Rego Casasnovas

3 edits in trunk/Source/WebKit2

[GTK] Remove "region based columns" runtime feature remainings
https://bugs.webkit.org/show_bug.cgi?id=157393

The runtime feature was removed in r168978,
and the usage in WebKitSettings.cpp in r168988.
However it was still around in ExperimentalFeatures class.

Reviewed by Michael Catanzaro.

UIProcess/gtk/ExperimentalFeatures.cpp: Remove runtime feature.
UIProcess/gtk/ExperimentalFeatures.h: Ditto.

6:15 PM Changeset in webkit [200499] by commit-queue@webkit.org

9 edits in trunk

REGRESSION(r200422): Web Inspector: Make new Array Iterator objects play nice with Web Inspector
https://bugs.webkit.org/show_bug.cgi?id=157361
<rdar://problem/26099793>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-05
Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

builtins/ArrayPrototype.js:

(createArrayIterator):
(values):
(keys):
(entries):

builtins/TypedArrayPrototype.js:

(values):
(keys):
(entries):

runtime/CommonIdentifiers.h:

Set the kind on the iterator object, that can be shown
to the inspector if the object is shown in the console.

inspector/InjectedScriptSource.js:

(InjectedScript.prototype._describe):
Get a better name for the new Array Iterator which is just an Object.

inspector/JSInjectedScriptHost.cpp:

(Inspector::JSInjectedScriptHost::subtype):
(Inspector::JSInjectedScriptHost::getInternalProperties):
Detect and handle ArrayIterator object instances. Porting the code
from the JSArrayIterator code path.

LayoutTests:

platform/mac/inspector/model/remote-object-expected.txt:

5:05 PM Changeset in webkit [200498] by commit-queue@webkit.org

2 edits
1 add in trunk/Source/JavaScriptCore

[JSC] In DFG, an OSR Exit on SetLocal can trash its child node
https://bugs.webkit.org/show_bug.cgi?id=157358
rdar://problem/25339647

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-05-05
Reviewed by Filip Pizlo.

When we OSR Exit on SetLocal, the child is never restored if its representation
was changed since the MovHint.

For example, say we have:

@1 = SomethingProducingDouble()
@2 = MovHint(@1)
@3 = ValueRep(@1)
@4 = SetLocal(@3, FlushedInt32)

When we lower SetLocal(), we start by speculating that @3 is an Int32.
Now this can fail if @1 was really a double.
When that happens, we go over the VariableEventStream to find where values
are, and @1 died at @3. Since the speculation failure happens before
the SetLocal event, we don't do anything with @3.

In this patch, I extend the PhantomInsertion phase to keep the MovHint
alive past the SetLocal.

dfg/DFGPhantomInsertionPhase.cpp:
tests/stress/multiply-typed-double-and-object.js: Added.

(otherObject.valueOf):
(targetDFG.multiply):
(targetFTL.multiply):

4:59 PM Changeset in webkit [200497] by Manuel Rego Casasnovas

4 edits in trunk/Source/WebKit2

[GTK] Add CSS Grid Layout as experimental feature
https://bugs.webkit.org/show_bug.cgi?id=157391

Reviewed by Michael Catanzaro.

Now that we've a runtime feature again for CSS Grid Layout (r200215),
we can recover the old patch (r162215) that allows to enable/disable
CSS Grid Layout through the environment variable
WEBKITGTK_EXPERIMENTAL_FEATURES.

Example: WEBKITGTK_EXPERIMENTAL_FEATURES="CSS_GRID_LAYOUT=1"

UIProcess/API/gtk/WebKitSettings.cpp:

(webKitSettingsConstructed): Use new experimental feature to enable
or disable CSS Grid Layout.

UIProcess/gtk/ExperimentalFeatures.cpp: Add new experimental feature.
UIProcess/gtk/ExperimentalFeatures.h: Ditto.

4:59 PM Changeset in webkit [200496] by oliver@apple.com

2 edits in trunk/Source/JavaScriptCore

Enable separated heap by default on ios
https://bugs.webkit.org/show_bug.cgi?id=156720

Reviewed by Geoffrey Garen.

We've fixed the xnu side of things, so we can reland this.

runtime/Options.cpp:

(JSC::recomputeDependentOptions):

4:54 PM Changeset in webkit [200495] by beidson@apple.com

17 edits in trunk/Source/WebCore

Modern IDB (Workers): Remove the need for IDBConnectionProxy to expose its IDBConnectionToServer.
https://bugs.webkit.org/show_bug.cgi?id=157394

Reviewed by Alex Christensen.

No new tests (No current change in behavior, will be tested as bug 149953 makes progress).

Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::transaction):
(WebCore::IDBDatabase::fireVersionChangeEvent):
(WebCore::IDBDatabase::dispatchEvent):

Modules/indexeddb/IDBDatabase.h:

(WebCore::IDBDatabase::serverConnection): Deleted.

Modules/indexeddb/IDBOpenDBRequest.cpp:

(WebCore::IDBOpenDBRequest::requestCompleted):

Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::IDBRequest):

Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::connectionProxy):
(WebCore::IDBTransaction::serverConnection): Deleted.

Modules/indexeddb/IDBTransaction.h:

Modules/indexeddb/client/IDBConnectionProxy.cpp:

(WebCore::IDBClient::IDBConnectionProxy::abortOpenAndUpgradeNeeded):
(WebCore::IDBClient::IDBConnectionProxy::connectionToServer): Deleted.

Modules/indexeddb/client/IDBConnectionProxy.h:

Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::abortOpenAndUpgradeNeeded):

Modules/indexeddb/client/TransactionOperation.h:

(WebCore::IDBClient::TransactionOperation::TransactionOperation):

Modules/indexeddb/shared/IDBCursorInfo.cpp:

(WebCore::IDBCursorInfo::IDBCursorInfo):

Modules/indexeddb/shared/IDBRequestData.cpp:

(WebCore::IDBRequestData::IDBRequestData):

Modules/indexeddb/shared/IDBResourceIdentifier.cpp:

(WebCore::IDBResourceIdentifier::IDBResourceIdentifier):

Modules/indexeddb/shared/IDBResourceIdentifier.h:

Modules/indexeddb/shared/IDBTransactionInfo.cpp:

(WebCore::IDBTransactionInfo::clientTransaction):

Modules/indexeddb/shared/IDBTransactionInfo.h:

4:30 PM Changeset in webkit [200494] by commit-queue@webkit.org

10 edits
2 deletes in trunk

Unreviewed, rolling out r200479.
https://bugs.webkit.org/show_bug.cgi?id=157397

A LayoutTest added with this change is crashing on Mac WK1
test runs. (Requested by ryanhaddad on #webkit).

Reverted changeset:

"For keyboard users, activating a fragment URL should transfer
focus and caret to the destination"
https://bugs.webkit.org/show_bug.cgi?id=116046
http://trac.webkit.org/changeset/200479

4:27 PM Changeset in webkit [200493] by Chris Dumez

4 edits
4 adds in trunk

CORS check is sometimes incorrectly failing for media loads
https://bugs.webkit.org/show_bug.cgi?id=157370
<rdar://problem/26071607>

Reviewed by Alex Christensen.

Source/WebCore:

When the media library is issuing a conditional request for a media
element that had the 'crossorigin' attribute, we would fail the CORS
check and log an error if the server were to respond with a "304 Not
Modified" response because the 304 response usually does not have
the necessary "Access-Control-Allow-Origin: *" header (At least for
Apache) and we cannot use the cached headers either since WebKit
does not have them.

To work around the problem in the short term, we now drop the
conditional headers from the request that the media library is
giving us when the media element has the 'crossorigin' attribute
set. As a result, the server will never respond with a 304 and we
will be able to do a CORS check on the full (e.g. 206) response.

In the long term, we need to deal with this better as this means
we may sometimes fail to reuse cached data. For now, this is only
potentially inefficient in the cases that were broken (i.e. no
video would play and we would log an error in the console).

Test: http/tests/security/video-cross-origin-caching.html

loader/MediaResourceLoader.cpp:

(WebCore::MediaResourceLoader::requestResource):
Make the request unconditional if the media element has the
'crossorigin' attribute set.

platform/network/ResourceRequestBase.cpp:

(WebCore::ResourceRequestBase::isConditional):
(WebCore::ResourceRequestBase::makeUnconditional):
When fixing the bug above, I noticed that those method do not do
the right thing if the m_httpHeaderFields data member has not
been populated yet. m_httpHeaderFields is lazily initialized so
we need to call updateResourceRequest() before using it.

LayoutTests:

Add a regression test for <rdar://problem/26071607>.

http/tests/media/resources/reference.mov: Added.
http/tests/security/resources/reference-movie-cross-origin-allow.php: Added.
http/tests/security/video-cross-origin-caching-expected.txt: Added.
http/tests/security/video-cross-origin-caching.html: Added.

4:25 PM Changeset in webkit [200492] by Alan Bujtas

3 edits
2 adds in trunk

Stop traversing at the container block when computing RTL inline static distance.
https://bugs.webkit.org/show_bug.cgi?id=157349
<rdar://problem/25994087>

Reviewed by David Hyatt.

When computing the inline static distance for a child renderer, we start at its enclosing box
and traverse up all the way to the container block.
However when the enclosing box is the ancestor of the container block, we
should just bail out right away since there's no container to use to adjust the position.

Source/WebCore:

Test: fast/multicol/positioned-rtl-column-crash.html

rendering/RenderBox.cpp:

(WebCore::computeInlineStaticDistance):

LayoutTests:

fast/multicol/positioned-rtl-column-crash-expected.txt: Added.
fast/multicol/positioned-rtl-column-crash.html: Added.

4:22 PM Changeset in webkit [200491] by adachan@apple.com

2 edits in trunk/Source/WebCore

Add WebKitAdditions extension points in media controls related code in RenderThemeMac
https://bugs.webkit.org/show_bug.cgi?id=157390

Reviewed by Anders Carlsson.

rendering/RenderThemeMac.mm:

(WebCore::RenderThemeMac::mediaControlsStyleSheet):
(WebCore::RenderThemeMac::mediaControlsScript):

4:18 PM Changeset in webkit [200490] by jer.noble@apple.com

25 edits in trunk/Source

[WK2] Media controls don't update if controller is created after the interface is created
https://bugs.webkit.org/show_bug.cgi?id=157376

Reviewed by Beth Dakin.

Source/WebCore:

Add getter methods to WebPlaybackSessionModel so that the model's values can be retrieved
if those values were missed before the equivalent WebPlaybackSessionInterface methods were
called. This necessatates a bunch of changes in HTMLMediaElement and related classes to
change PassRefPtr<TimeRanges> types to Ref<TimeRanges> (and one change in TimeRanges itself).
WebPlaybackSessionModelMediaElement can implement these new getter methods by querying the
values from the HTMLMediaElement, something it was doing already, so most of those changes
are simple refactoring.

There's no reason any longer for WebVideoFullscreenModel to inherit from WebPlaybackSessionModel,
so remove that superclass.

In WebPlaybackSessionInterfaceMac, when a new WebPlaybackControlsManager is set, use the new
getter methods on WebPlaybackSessionModel to update the values in the manager.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::mediaPlayerCharacteristicChanged):
(WebCore::HTMLMediaElement::maxBufferedTime):
(WebCore::HTMLMediaElement::played):
(WebCore::HTMLMediaElement::buffered): Deleted.
(WebCore::HTMLMediaElement::seekable): Deleted.

html/HTMLMediaElement.h:
html/MediaController.cpp:

(MediaController::buffered):
(MediaController::seekable):
(MediaController::played):

html/MediaController.h:
html/MediaControllerInterface.h:
html/TimeRanges.cpp:

(WebCore::TimeRanges::copy):

html/TimeRanges.h:
platform/cocoa/WebPlaybackSessionModel.h:
platform/cocoa/WebPlaybackSessionModelMediaElement.h:
platform/cocoa/WebPlaybackSessionModelMediaElement.mm:

(WebPlaybackSessionModelMediaElement::setWebPlaybackSessionInterface):
(WebPlaybackSessionModelMediaElement::updateForEventName):
(WebPlaybackSessionModelMediaElement::updateLegibleOptions):
(WebPlaybackSessionModelMediaElement::observedEventNames):
(WebPlaybackSessionModelMediaElement::eventNameAll):
(WebPlaybackSessionModelMediaElement::duration):
(WebPlaybackSessionModelMediaElement::currentTime):
(WebPlaybackSessionModelMediaElement::bufferedTime):
(WebPlaybackSessionModelMediaElement::isPlaying):
(WebPlaybackSessionModelMediaElement::playbackRate):
(WebPlaybackSessionModelMediaElement::seekableRanges):
(WebPlaybackSessionModelMediaElement::canPlayFastReverse):
(WebPlaybackSessionModelMediaElement::audioMediaSelectionOptions):
(WebPlaybackSessionModelMediaElement::audioMediaSelectedIndex):
(WebPlaybackSessionModelMediaElement::legibleMediaSelectionOptions):
(WebPlaybackSessionModelMediaElement::legibleMediaSelectedIndex):
(WebPlaybackSessionModelMediaElement::externalPlaybackEnabled):
(WebPlaybackSessionModelMediaElement::wirelessVideoPlaybackDisabled):

platform/cocoa/WebVideoFullscreenModel.h:
platform/cocoa/WebVideoFullscreenModelVideoElement.h:
platform/cocoa/WebVideoFullscreenModelVideoElement.mm:

(WebVideoFullscreenModelVideoElement::requestFullscreenMode): Deleted.
(WebVideoFullscreenModelVideoElement::setVideoLayerFrame): Deleted.
(WebVideoFullscreenModelVideoElement::setVideoLayerGravity): Deleted.
(WebVideoFullscreenModelVideoElement::observedEventNames): Deleted.
(WebVideoFullscreenModelVideoElement::eventNameAll): Deleted.
(WebVideoFullscreenModelVideoElement::fullscreenModeChanged): Deleted.

platform/ios/WebPlaybackSessionInterfaceAVKit.h:
platform/ios/WebVideoFullscreenControllerAVKit.mm:

(WebVideoFullscreenControllerContext::play): Deleted.
(WebVideoFullscreenControllerContext::pause): Deleted.
(WebVideoFullscreenControllerContext::togglePlayState): Deleted.
(WebVideoFullscreenControllerContext::beginScrubbing): Deleted.
(WebVideoFullscreenControllerContext::endScrubbing): Deleted.
(WebVideoFullscreenControllerContext::seekToTime): Deleted.
(WebVideoFullscreenControllerContext::fastSeek): Deleted.
(WebVideoFullscreenControllerContext::beginScanningForward): Deleted.
(WebVideoFullscreenControllerContext::beginScanningBackward): Deleted.
(WebVideoFullscreenControllerContext::endScanning): Deleted.
(WebVideoFullscreenControllerContext::selectAudioMediaOption): Deleted.
(WebVideoFullscreenControllerContext::selectLegibleMediaOption): Deleted.

platform/ios/WebVideoFullscreenInterfaceAVKit.h:
platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(WebVideoFullscreenInterfaceAVKit::requestHideAndExitFullscreen):
(WebVideoFullscreenInterfaceAVKit::shouldExitFullscreenWithReason):

platform/mac/WebPlaybackSessionInterfaceMac.mm:

(WebCore::timeRangesToArray):
(WebCore::WebPlaybackSessionInterfaceMac::setSeekableRanges):
(WebCore::WebPlaybackSessionInterfaceMac::setPlayBackControlsManager):

platform/mac/WebVideoFullscreenInterfaceMac.h:

Source/WebKit2:

Implement the new getter methods on WebPlaybackSessionModelContext by caching the values
passed through WebPlaybackSessionManagerProxy.

UIProcess/Cocoa/WebPlaybackSessionManagerProxy.h:
UIProcess/Cocoa/WebPlaybackSessionManagerProxy.mm:

(WebKit::WebPlaybackSessionManagerProxy::setCurrentTime):
(WebKit::WebPlaybackSessionManagerProxy::setBufferedTime):
(WebKit::WebPlaybackSessionManagerProxy::setSeekableRangesVector):
(WebKit::WebPlaybackSessionManagerProxy::setCanPlayFastReverse):
(WebKit::WebPlaybackSessionManagerProxy::setAudioMediaSelectionOptions):
(WebKit::WebPlaybackSessionManagerProxy::setLegibleMediaSelectionOptions):
(WebKit::WebPlaybackSessionManagerProxy::setExternalPlaybackProperties):
(WebKit::WebPlaybackSessionManagerProxy::setWirelessVideoPlaybackDisabled):
(WebKit::WebPlaybackSessionManagerProxy::setDuration):
(WebKit::WebPlaybackSessionManagerProxy::setRate):

UIProcess/Cocoa/WebVideoFullscreenManagerProxy.h:
UIProcess/Cocoa/WebVideoFullscreenManagerProxy.mm:

(WebKit::WebVideoFullscreenModelContext::requestFullscreenMode): Deleted.
(WebKit::WebVideoFullscreenModelContext::setVideoLayerFrame): Deleted.
(WebKit::WebVideoFullscreenModelContext::setVideoLayerGravity): Deleted.
(WebKit::WebVideoFullscreenModelContext::fullscreenModeChanged): Deleted.
(WebKit::WebVideoFullscreenModelContext::isVisible): Deleted.
(WebKit::WebVideoFullscreenModelContext::didSetupFullscreen): Deleted.
(WebKit::WebVideoFullscreenModelContext::didEnterFullscreen): Deleted.
(WebKit::WebVideoFullscreenModelContext::didExitFullscreen): Deleted.
(WebKit::WebVideoFullscreenModelContext::didCleanupFullscreen): Deleted.
(WebKit::WebVideoFullscreenManagerProxy::WebVideoFullscreenManagerProxy): Deleted.
(WebKit::WebVideoFullscreenManagerProxy::~WebVideoFullscreenManagerProxy): Deleted.

4:11 PM Changeset in webkit [200489] by beidson@apple.com

7 edits in trunk/Source/WebCore

Modern IDB (Workers): Move TransactionOperation management from IDBConnectionToServer to IDBConnectionProxy.
https://bugs.webkit.org/show_bug.cgi?id=157392

Reviewed by Alex Christensen.

No new tests (No current change in behavior, will be tested as bug 149953 makes progress).

Set up TransactionOperations on the IDBConnectionProxy instead of the IDBConnectionToServer:

Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::createObjectStoreOnServer):
(WebCore::IDBTransaction::createIndexOnServer):
(WebCore::IDBTransaction::openCursorOnServer):
(WebCore::IDBTransaction::iterateCursorOnServer):
(WebCore::IDBTransaction::getRecordOnServer):
(WebCore::IDBTransaction::getCountOnServer):
(WebCore::IDBTransaction::deleteRecordOnServer):
(WebCore::IDBTransaction::clearObjectStoreOnServer):
(WebCore::IDBTransaction::putOrAddOnServer):
(WebCore::IDBTransaction::deleteObjectStoreOnServer):
(WebCore::IDBTransaction::deleteIndexOnServer):

IDBConnectionProxy is now the owner of dispatched TransactionOperations:

Modules/indexeddb/client/IDBConnectionProxy.cpp:

(WebCore::IDBClient::IDBConnectionProxy::createObjectStore):
(WebCore::IDBClient::IDBConnectionProxy::deleteObjectStore):
(WebCore::IDBClient::IDBConnectionProxy::clearObjectStore):
(WebCore::IDBClient::IDBConnectionProxy::createIndex):
(WebCore::IDBClient::IDBConnectionProxy::deleteIndex):
(WebCore::IDBClient::IDBConnectionProxy::putOrAdd):
(WebCore::IDBClient::IDBConnectionProxy::getRecord):
(WebCore::IDBClient::IDBConnectionProxy::getCount):
(WebCore::IDBClient::IDBConnectionProxy::deleteRecord):
(WebCore::IDBClient::IDBConnectionProxy::openCursor):
(WebCore::IDBClient::IDBConnectionProxy::iterateCursor):
(WebCore::IDBClient::IDBConnectionProxy::saveOperation):
(WebCore::IDBClient::IDBConnectionProxy::completeOperation):

Modules/indexeddb/client/IDBConnectionProxy.h:

Proxy this in-and-out calls to the ConnectionProxy:

Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::createObjectStore):
(WebCore::IDBClient::IDBConnectionToServer::didCreateObjectStore):
(WebCore::IDBClient::IDBConnectionToServer::deleteObjectStore):
(WebCore::IDBClient::IDBConnectionToServer::didDeleteObjectStore):
(WebCore::IDBClient::IDBConnectionToServer::clearObjectStore):
(WebCore::IDBClient::IDBConnectionToServer::didClearObjectStore):
(WebCore::IDBClient::IDBConnectionToServer::createIndex):
(WebCore::IDBClient::IDBConnectionToServer::didCreateIndex):
(WebCore::IDBClient::IDBConnectionToServer::deleteIndex):
(WebCore::IDBClient::IDBConnectionToServer::didDeleteIndex):
(WebCore::IDBClient::IDBConnectionToServer::putOrAdd):
(WebCore::IDBClient::IDBConnectionToServer::didPutOrAdd):
(WebCore::IDBClient::IDBConnectionToServer::getRecord):
(WebCore::IDBClient::IDBConnectionToServer::didGetRecord):
(WebCore::IDBClient::IDBConnectionToServer::getCount):
(WebCore::IDBClient::IDBConnectionToServer::didGetCount):
(WebCore::IDBClient::IDBConnectionToServer::deleteRecord):
(WebCore::IDBClient::IDBConnectionToServer::didDeleteRecord):
(WebCore::IDBClient::IDBConnectionToServer::openCursor):
(WebCore::IDBClient::IDBConnectionToServer::didOpenCursor):
(WebCore::IDBClient::IDBConnectionToServer::iterateCursor):
(WebCore::IDBClient::IDBConnectionToServer::didIterateCursor):
(WebCore::IDBClient::IDBConnectionToServer::saveOperation): Deleted.
(WebCore::IDBClient::IDBConnectionToServer::completeOperation): Deleted.

Modules/indexeddb/client/IDBConnectionToServer.h:

Give TransactionOperation a ThreadIdentifier member
Privatize most public methods from TransactionOperation
Make IDBRequestData a friend so it can get at the private methods
Modules/indexeddb/client/TransactionOperation.h:

(WebCore::IDBClient::TransactionOperation::~TransactionOperation):
(WebCore::IDBClient::TransactionOperation::perform):
(WebCore::IDBClient::TransactionOperation::completed):
(WebCore::IDBClient::TransactionOperation::originThreadID):
(WebCore::IDBClient::TransactionOperation::transactionIdentifier):
(WebCore::IDBClient::TransactionOperation::objectStoreIdentifier):
(WebCore::IDBClient::TransactionOperation::indexIdentifier):
(WebCore::IDBClient::TransactionOperation::cursorIdentifier):
(WebCore::IDBClient::TransactionOperation::transaction):
(WebCore::IDBClient::TransactionOperation::indexRecordType):

4:05 PM Changeset in webkit [200488] by Ryan Haddad

3 edits in trunk/LayoutTests

Unskip 9 compositing tests on ios-simulator, mark 2 as failures on ios-simulator-wk1

Unreviewed test gardening.

platform/ios-simulator-wk1/TestExpectations:
platform/ios-simulator/TestExpectations:

3:27 PM Changeset in webkit [200487] by Ryan Haddad

4 edits in trunk/LayoutTests

TestExpectations gardening for ios-simulator

Unreviewed test gardening.

Remove failure expectation for passing tests, move some to more specific ports, and remove expectations
for tests that are no longer in the tree.

platform/ios-simulator-wk1/TestExpectations:
platform/ios-simulator-wk2/TestExpectations:
platform/ios-simulator/TestExpectations:

3:16 PM Changeset in webkit [200486] by Alan Bujtas

6 edits
2 adds in trunk

Do not attempt to compute min/max width.
https://bugs.webkit.org/show_bug.cgi?id=157320

Reviewed by David Hyatt.

Replaced elements with no intrinsic size (only with ratio) should not call the containing
block to compute the min/max width when the containing block's min/max width
depends on the children's intrinsic size. It could lead to infinite recursion.

Source/WebCore:

Test: fast/replaced/before-content-intrinsic-crash.html

rendering/RenderBox.cpp:

(WebCore::RenderBox::computeReplacedLogicalWidthRespectingMinMaxWidth): Unrelated code change.

rendering/RenderImage.cpp: Unrelated code change.

(WebCore::RenderImage::RenderImage): Deleted.

rendering/RenderImage.h:
rendering/RenderReplaced.cpp:

(WebCore::RenderReplaced::computeReplacedLogicalWidth):

LayoutTests:

fast/replaced/before-content-intrinsic-crash-expected.txt: Added.
fast/replaced/before-content-intrinsic-crash.html: Added.

3:14 PM Changeset in webkit [200485] by beidson@apple.com

14 edits in trunk/Source/WebCore

Modern IDB: Move all IDB DOM object management from IDBConnectionToServer to IDBConnectionProxy.
https://bugs.webkit.org/show_bug.cgi?id=157348

Reviewed by Alex Christensen.

No new tests (Refactor, no change in behavior yet).

This is in-progress IDB-in-Workers code that is isolated enough to land right now.

The goal is to have IDBConnectionToServer be a main-thread-only object, leaving IDBConnectionProxy
as the threading bridge between the worker thread and the main thread.

As such, IDBConnectionToServer no longer maintains maps of IDB DOM objects, but instead the proxy
does and guards that access with locks.

No threading changes takes place in this patch but it does scatter some isMainThread() checks and FIXMEs
accurately representing where threading changes will take place once I can return to this.

Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::IDBDatabase):
(WebCore::IDBDatabase::~IDBDatabase):
(WebCore::IDBDatabase::maybeCloseInServer):

Modules/indexeddb/IDBOpenDBRequest.cpp:

(WebCore::IDBOpenDBRequest::dispatchEvent):

Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::abortOnServerAndCancelRequests):
(WebCore::IDBTransaction::commitOnServer):
(WebCore::IDBTransaction::establishOnServer):

Modules/indexeddb/client/IDBConnectionProxy.cpp:

Modules/indexeddb/client/IDBConnectionProxy.h:

Modules/indexeddb/client/IDBConnectionToServer.cpp:

(WebCore::IDBClient::IDBConnectionToServer::deleteDatabase):
(WebCore::IDBClient::IDBConnectionToServer::didDeleteDatabase):
(WebCore::IDBClient::IDBConnectionToServer::openDatabase):
(WebCore::IDBClient::IDBConnectionToServer::didOpenDatabase):
(WebCore::IDBClient::IDBConnectionToServer::establishTransaction):
(WebCore::IDBClient::IDBConnectionToServer::commitTransaction):
(WebCore::IDBClient::IDBConnectionToServer::didCommitTransaction):
(WebCore::IDBClient::IDBConnectionToServer::didFinishHandlingVersionChangeTransaction):
(WebCore::IDBClient::IDBConnectionToServer::abortTransaction):
(WebCore::IDBClient::IDBConnectionToServer::didAbortTransaction):
(WebCore::IDBClient::IDBConnectionToServer::fireVersionChangeEvent):
(WebCore::IDBClient::IDBConnectionToServer::didFireVersionChangeEvent):
(WebCore::IDBClient::IDBConnectionToServer::didStartTransaction):
(WebCore::IDBClient::IDBConnectionToServer::notifyOpenDBRequestBlocked):
(WebCore::IDBClient::IDBConnectionToServer::databaseConnectionClosed):
(WebCore::IDBClient::IDBConnectionToServer::registerDatabaseConnection): Deleted.
(WebCore::IDBClient::IDBConnectionToServer::unregisterDatabaseConnection): Deleted.
(WebCore::IDBClient::IDBConnectionToServer::hasRecordOfTransaction): Deleted.

Modules/indexeddb/client/IDBConnectionToServer.h:

Modules/indexeddb/shared/IDBRequestData.cpp:

(WebCore::IDBRequestData::IDBRequestData):

Modules/indexeddb/shared/IDBRequestData.h:

Modules/indexeddb/shared/IDBResourceIdentifier.cpp:

(WebCore::IDBResourceIdentifier::IDBResourceIdentifier):

Modules/indexeddb/shared/IDBResourceIdentifier.h:

3:14 PM Changeset in webkit [200484] by beidson@apple.com

5 edits in trunk/Source/WebCore

Modern IDB: Add isolatedCopy to a few more objects.
https://bugs.webkit.org/show_bug.cgi?id=157330

Reviewed by Alex Christensen.

No new tests (No current change in behavior, will be tested as bug 149953 makes progress).

Modules/indexeddb/shared/IDBRequestData.cpp:

(WebCore::IDBRequestData::IDBRequestData):
(WebCore::IDBRequestData::isolatedCopy):

Modules/indexeddb/shared/IDBRequestData.h:

Modules/indexeddb/shared/IDBResultData.cpp:

(WebCore::IDBResultData::IDBResultData):
(WebCore::IDBResultData::isolatedCopy):

Modules/indexeddb/shared/IDBResultData.h:

3:13 PM Changeset in webkit [200483] by beidson@apple.com

10 edits in trunk/Source/WebCore

Modern IDB: Add thread identifiers and assertions to IDB DOM objects.
https://bugs.webkit.org/show_bug.cgi?id=157329

Reviewed by Alex Christensen.

No new tests (No current change in behavior, will be tested as bug 149953 makes progress).

Modules/indexeddb/IDBCursor.cpp:

(WebCore::IDBCursor::IDBCursor):
(WebCore::IDBCursor::~IDBCursor):
(WebCore::IDBCursor::sourcesDeleted):
(WebCore::IDBCursor::transaction):
(WebCore::IDBCursor::direction):
(WebCore::IDBCursor::update):
(WebCore::IDBCursor::advance):
(WebCore::IDBCursor::continueFunction):
(WebCore::IDBCursor::uncheckedIterateCursor):
(WebCore::IDBCursor::deleteFunction):
(WebCore::IDBCursor::setGetResult):

Modules/indexeddb/IDBDatabase.cpp:

(WebCore::IDBDatabase::~IDBDatabase):
(WebCore::IDBDatabase::hasPendingActivity):
(WebCore::IDBDatabase::name):
(WebCore::IDBDatabase::version):
(WebCore::IDBDatabase::objectStoreNames):
(WebCore::IDBDatabase::createObjectStore):
(WebCore::IDBDatabase::transaction):
(WebCore::IDBDatabase::deleteObjectStore):
(WebCore::IDBDatabase::close):
(WebCore::IDBDatabase::maybeCloseInServer):
(WebCore::IDBDatabase::activeDOMObjectName):
(WebCore::IDBDatabase::canSuspendForDocumentSuspension):
(WebCore::IDBDatabase::stop):
(WebCore::IDBDatabase::startVersionChangeTransaction):
(WebCore::IDBDatabase::didStartTransaction):
(WebCore::IDBDatabase::willCommitTransaction):
(WebCore::IDBDatabase::didCommitTransaction):
(WebCore::IDBDatabase::willAbortTransaction):
(WebCore::IDBDatabase::didAbortTransaction):
(WebCore::IDBDatabase::didCommitOrAbortTransaction):
(WebCore::IDBDatabase::fireVersionChangeEvent):
(WebCore::IDBDatabase::dispatchEvent):
(WebCore::IDBDatabase::didCreateIndexInfo):
(WebCore::IDBDatabase::didDeleteIndexInfo):

Modules/indexeddb/IDBDatabase.h:

(WebCore::IDBDatabase::originThreadID):

Modules/indexeddb/IDBIndex.cpp:

(WebCore::IDBIndex::IDBIndex):
(WebCore::IDBIndex::~IDBIndex):
(WebCore::IDBIndex::name):
(WebCore::IDBIndex::objectStore):
(WebCore::IDBIndex::keyPath):
(WebCore::IDBIndex::unique):
(WebCore::IDBIndex::multiEntry):
(WebCore::IDBIndex::openCursor):
(WebCore::IDBIndex::doCount):
(WebCore::IDBIndex::openKeyCursor):
(WebCore::IDBIndex::doGet):
(WebCore::IDBIndex::doGetKey):
(WebCore::IDBIndex::markAsDeleted):

Modules/indexeddb/IDBObjectStore.cpp:

(WebCore::IDBObjectStore::IDBObjectStore):
(WebCore::IDBObjectStore::~IDBObjectStore):
(WebCore::IDBObjectStore::name):
(WebCore::IDBObjectStore::keyPath):
(WebCore::IDBObjectStore::indexNames):
(WebCore::IDBObjectStore::transaction):
(WebCore::IDBObjectStore::autoIncrement):
(WebCore::IDBObjectStore::openCursor):
(WebCore::IDBObjectStore::get):
(WebCore::IDBObjectStore::putOrAdd):
(WebCore::IDBObjectStore::doDelete):
(WebCore::IDBObjectStore::clear):
(WebCore::IDBObjectStore::createIndex):
(WebCore::IDBObjectStore::index):
(WebCore::IDBObjectStore::deleteIndex):
(WebCore::IDBObjectStore::doCount):
(WebCore::IDBObjectStore::markAsDeleted):
(WebCore::IDBObjectStore::rollbackInfoForVersionChangeAbort):

Modules/indexeddb/IDBOpenDBRequest.cpp:

(WebCore::IDBOpenDBRequest::~IDBOpenDBRequest):
(WebCore::IDBOpenDBRequest::onError):
(WebCore::IDBOpenDBRequest::versionChangeTransactionDidFinish):
(WebCore::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit):
(WebCore::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion):
(WebCore::IDBOpenDBRequest::dispatchEvent):
(WebCore::IDBOpenDBRequest::onSuccess):
(WebCore::IDBOpenDBRequest::onUpgradeNeeded):
(WebCore::IDBOpenDBRequest::onDeleteDatabaseSuccess):
(WebCore::IDBOpenDBRequest::requestCompleted):
(WebCore::IDBOpenDBRequest::requestBlocked):

Modules/indexeddb/IDBRequest.cpp:

(WebCore::IDBRequest::~IDBRequest):
(WebCore::IDBRequest::errorCode):
(WebCore::IDBRequest::error):
(WebCore::IDBRequest::setSource):
(WebCore::IDBRequest::setVersionChangeTransaction):
(WebCore::IDBRequest::transaction):
(WebCore::IDBRequest::readyState):
(WebCore::IDBRequest::sourceObjectStoreIdentifier):
(WebCore::IDBRequest::sourceIndexIdentifier):
(WebCore::IDBRequest::requestedIndexRecordType):
(WebCore::IDBRequest::eventTargetInterface):
(WebCore::IDBRequest::activeDOMObjectName):
(WebCore::IDBRequest::canSuspendForDocumentSuspension):
(WebCore::IDBRequest::hasPendingActivity):
(WebCore::IDBRequest::stop):
(WebCore::IDBRequest::enqueueEvent):
(WebCore::IDBRequest::dispatchEvent):
(WebCore::IDBRequest::uncaughtExceptionInEventHandler):
(WebCore::IDBRequest::setResult):
(WebCore::IDBRequest::setResultToStructuredClone):
(WebCore::IDBRequest::clearResult):
(WebCore::IDBRequest::setResultToUndefined):
(WebCore::IDBRequest::resultCursor):
(WebCore::IDBRequest::willIterateCursor):
(WebCore::IDBRequest::didOpenOrIterateCursor):
(WebCore::IDBRequest::requestCompleted):
(WebCore::IDBRequest::onError):
(WebCore::IDBRequest::onSuccess):

Modules/indexeddb/IDBRequest.h:

(WebCore::IDBRequest::originThreadID):

Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::IDBTransaction):
(WebCore::IDBTransaction::~IDBTransaction):
(WebCore::IDBTransaction::mode):
(WebCore::IDBTransaction::db):
(WebCore::IDBTransaction::serverConnection):
(WebCore::IDBTransaction::error):
(WebCore::IDBTransaction::objectStore):
(WebCore::IDBTransaction::abortDueToFailedRequest):
(WebCore::IDBTransaction::transitionedToFinishing):
(WebCore::IDBTransaction::abort):
(WebCore::IDBTransaction::abortOnServerAndCancelRequests):
(WebCore::IDBTransaction::activeDOMObjectName):
(WebCore::IDBTransaction::canSuspendForDocumentSuspension):
(WebCore::IDBTransaction::hasPendingActivity):
(WebCore::IDBTransaction::stop):
(WebCore::IDBTransaction::isActive):
(WebCore::IDBTransaction::isFinishedOrFinishing):
(WebCore::IDBTransaction::addRequest):
(WebCore::IDBTransaction::removeRequest):
(WebCore::IDBTransaction::scheduleOperation):
(WebCore::IDBTransaction::scheduleOperationTimer):
(WebCore::IDBTransaction::operationTimerFired):
(WebCore::IDBTransaction::commit):
(WebCore::IDBTransaction::commitOnServer):
(WebCore::IDBTransaction::finishAbortOrCommit):
(WebCore::IDBTransaction::didStart):
(WebCore::IDBTransaction::notifyDidAbort):
(WebCore::IDBTransaction::didAbort):
(WebCore::IDBTransaction::didCommit):
(WebCore::IDBTransaction::fireOnComplete):
(WebCore::IDBTransaction::fireOnAbort):
(WebCore::IDBTransaction::enqueueEvent):
(WebCore::IDBTransaction::dispatchEvent):
(WebCore::IDBTransaction::createObjectStore):
(WebCore::IDBTransaction::createObjectStoreOnServer):
(WebCore::IDBTransaction::didCreateObjectStoreOnServer):
(WebCore::IDBTransaction::createIndex):
(WebCore::IDBTransaction::createIndexOnServer):
(WebCore::IDBTransaction::didCreateIndexOnServer):
(WebCore::IDBTransaction::requestOpenCursor):
(WebCore::IDBTransaction::doRequestOpenCursor):
(WebCore::IDBTransaction::openCursorOnServer):
(WebCore::IDBTransaction::didOpenCursorOnServer):
(WebCore::IDBTransaction::iterateCursor):
(WebCore::IDBTransaction::iterateCursorOnServer):
(WebCore::IDBTransaction::didIterateCursorOnServer):
(WebCore::IDBTransaction::requestGetRecord):
(WebCore::IDBTransaction::requestGetValue):
(WebCore::IDBTransaction::requestGetKey):
(WebCore::IDBTransaction::requestIndexRecord):
(WebCore::IDBTransaction::getRecordOnServer):
(WebCore::IDBTransaction::didGetRecordOnServer):
(WebCore::IDBTransaction::requestCount):
(WebCore::IDBTransaction::getCountOnServer):
(WebCore::IDBTransaction::didGetCountOnServer):
(WebCore::IDBTransaction::requestDeleteRecord):
(WebCore::IDBTransaction::deleteRecordOnServer):
(WebCore::IDBTransaction::didDeleteRecordOnServer):
(WebCore::IDBTransaction::requestClearObjectStore):
(WebCore::IDBTransaction::clearObjectStoreOnServer):
(WebCore::IDBTransaction::didClearObjectStoreOnServer):
(WebCore::IDBTransaction::requestPutOrAdd):
(WebCore::IDBTransaction::putOrAddOnServer):
(WebCore::IDBTransaction::didPutOrAddOnServer):
(WebCore::IDBTransaction::deleteObjectStore):
(WebCore::IDBTransaction::deleteObjectStoreOnServer):
(WebCore::IDBTransaction::didDeleteObjectStoreOnServer):
(WebCore::IDBTransaction::deleteIndex):
(WebCore::IDBTransaction::deleteIndexOnServer):
(WebCore::IDBTransaction::didDeleteIndexOnServer):
(WebCore::IDBTransaction::operationDidComplete):
(WebCore::IDBTransaction::establishOnServer):
(WebCore::IDBTransaction::activate):
(WebCore::IDBTransaction::deactivate):

3:11 PM Changeset in webkit [200482] by commit-queue@webkit.org

2 edits in trunk/Source/JavaScriptCore

JSContext Inspector: Better CommandLineAPI in JSContext inspection
https://bugs.webkit.org/show_bug.cgi?id=157387
<rdar://problem/22630583>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-05
Reviewed by Timothy Hatcher.

inspector/InjectedScriptSource.js:

(InjectedScript.prototype._evaluateOn):
(BasicCommandLineAPI.inScopeVariables):
(BasicCommandLineAPI):
When creating a BasicCommandLineAPI, pass the call frame so
that we don't shadow variables in the callstack.

(BasicCommandLineAPI.methods):
(clear):
(table):
(profile):
(profileEnd):
(keys):
(values):
Some just pass through to console, others are tiny methods.
Implement them, and give them the expected toString string.

2:58 PM Changeset in webkit [200481] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Reduce maximum JIT pool size on X86_64.

Rubber stamped by Geoffrey Garen.

This changes our maximum pool size to 100MB. The problem with letting a page allocate much
more than this is that we will sometimes call deleteAllCode() or one of its friends. Deleting
a huge amount of memory is expensive in our allocator.

So long as we allow for such large-scale code death to happen, and so long as it's expensive,
we should bound the amount of code we end up with in the first place.

In the long run, we should fix our executable allocator so that it's not so expensive to kill
all code.

jit/ExecutableAllocator.h:

2:53 PM Changeset in webkit [200480] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Reduce thresholds that control the maximum IC stub size.

Rubber stamped by Chris Dumez and Benjamin Poulain.

This reduces the thresholds to before the megamorphic load optimizations to see if that
recovers a PLT regression.

runtime/Options.h:

2:38 PM Changeset in webkit [200479] by n_wang@apple.com

10 edits
2 adds in trunk

For keyboard users, activating a fragment URL should transfer focus and caret to the destination
https://bugs.webkit.org/show_bug.cgi?id=116046

Reviewed by Ryosuke Niwa.

Source/WebCore:

Added a sequential focus navigation starting node to document. When TAB or SHIFT-TAB is pressed
and there is no focused element, we start searching for next focus candidates at the sequential
focus navigation node.

Test: fast/events/sequential-focus-navigation-starting-point.html

dom/Document.cpp:

(WebCore::Document::removedLastRef):
(WebCore::Document::destroyRenderTree):
(WebCore::Document::removeFocusedNodeOfSubtree):
(WebCore::Document::hoveredElementDidDetach):
(WebCore::Document::setFocusedElement):
(WebCore::isNodeFrameOrDocument):
(WebCore::Document::setFocusNavigationStartingNode):
(WebCore::Document::focusNavigationStartingNode):
(WebCore::Document::setCSSTarget):
(WebCore::Document::nodeChildrenWillBeRemoved):
(WebCore::Document::nodeWillBeRemoved):
(WebCore::fallbackFocusNavigationStartingNodeAfterRemoval):
(WebCore::Document::updateFocusNavigationStartingNodeWithNodeRemoval):
(WebCore::Document::textInserted):

dom/Document.h:

(WebCore::Document::userActionElements):

page/EventHandler.cpp:

(WebCore::EventHandler::handleMousePressEvent):

page/FocusController.cpp:

(WebCore::FocusController::advanceFocusInDocumentOrder):

page/FrameView.cpp:

(WebCore::FrameView::scrollToAnchor):

LayoutTests:

Updated fast/dom/fragment-activation-focuses-target.html, now that navigating to a unfocusable
fragment will unset the focused element.

fast/dom/fragment-activation-focuses-target-expected.txt:
fast/dom/fragment-activation-focuses-target.html:
fast/events/sequential-focus-navigation-starting-point-expected.txt: Added.
fast/events/sequential-focus-navigation-starting-point.html: Added.
platform/ios-simulator/TestExpectations:

2:31 PM Changeset in webkit [200478] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

Another iOS debug build fix after r200464.

dom/EventContext.h:

(WebCore::EventContext::isUnreachableNode):

2:16 PM Changeset in webkit [200477] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

iOS debug build fix after r200464.

dom/EventContext.cpp:

(WebCore::TouchEventContext::checkReachability):

2:00 PM Changeset in webkit [200476] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Provide go-to links next to Functions in GC Root Path popover
https://bugs.webkit.org/show_bug.cgi?id=157381
<rdar://problem/26122531>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-05
Reviewed by Timothy Hatcher.

UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:

(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._mouseoverHandler.appendPathRow):
For functions, create a go-to-link. Insert a placeholder to replace
so that the popover sizes itself with a potential go-to arrow, as
it won't resize when the go-to arrows get inserted.

UserInterface/Views/HeapSnapshotInstancesContentView.css:

(.heap-snapshot-instance-popover-content .node .go-to-link):
Move down 1px to align better with the text.

1:40 PM Changeset in webkit [200475] by bshafiei@apple.com

16 edits in tags/Safari-602.1.31/Source

Merged r200470. rdar://problem/26116763

1:34 PM Changeset in webkit [200474] by commit-queue@webkit.org

9 edits
2 moves
2 adds in trunk/Source/WebInspectorUI

Web Inspector: HeapSnapshot should exploratory Object Graph view
https://bugs.webkit.org/show_bug.cgi?id=157371
<rdar://problem/26107304>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-05
Reviewed by Timothy Hatcher.

HeapSnapshots now have two ContentViews for viewing the graph.

HeapSnapshotInstancesContentView:

top level are Class Categories nodes
categories expand to Instances
instances expand to show what they retain
retained sizes only shown for dominated nodes of the instance

HeapSnapshotObjectGraphContentView:

top level are GlobalObject or Window nodes
expand to show what they retain
retained sizes are shown for all nodes, everything is shown

This also provides a custom preview for Window instances. Instead of
showing an ObjectPreview, it just shows the window.location.href
for that instance, which is useful when there are multiple Window
instances for different frames.

Localizations/en.lproj/localizedStrings.js:
UserInterface/Main.html:

New "Object Graph" string and new files.

UserInterface/Images/HeapSnapshotObjectGraph.svg: Added.
UserInterface/Images/gtk/HeapSnapshotObjectGraph.svg: Added.
UserInterface/Views/PathComponentIcons.css:

(.heap-snapshot-object-graph-icon .icon):
Copy the red [{}] icon from Style Rules.

UserInterface/Views/HeapSnapshotClusterContentView.js:

(WebInspector.HeapSnapshotClusterContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype.get objectGraphContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype.showObjectGraph):
(WebInspector.HeapSnapshotClusterContentView.prototype._supportsObjectGraph):
(WebInspector.HeapSnapshotClusterContentView.prototype._pathComponentForContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype._identifierForContentView):
(WebInspector.HeapSnapshotClusterContentView.prototype._showContentViewForIdentifier):
Include an "Object Graph" content view. This is unavailable in Diff views
but is available for individual HeapSnapshots.

UserInterface/Views/HeapSnapshotContentView.js: Renamed from Source/WebInspectorUI/UserInterface/Views/HeapSnapshotInstancesContentView.js.

(WebInspector.HeapSnapshotContentView):
(WebInspector.HeapSnapshotContentView.prototype.shown):
(WebInspector.HeapSnapshotContentView.prototype.hidden):
(WebInspector.HeapSnapshotContentView.prototype._sortDataGrid):
(WebInspector.HeapSnapshotContentView.prototype._heapSnapshotDataGridTreeDidPopulate):
(WebInspector.HeapSnapshotInstancesContentView):
(WebInspector.HeapSnapshotObjectGraphContentView):
Share and generalize a HeapSnapshot ContentView. The only differences are
the DataGrid columns, DataGridTree class, and identifier prefix for settings.

UserInterface/Views/HeapSnapshotDataGridTree.js: Renamed from Source/WebInspectorUI/UserInterface/Views/HeapSnapshotInstancesDataGridTree.js.

(WebInspector.HeapSnapshotDataGridTree):
(WebInspector.HeapSnapshotDataGridTree.buildSortComparator):
(WebInspector.HeapSnapshotDataGridTree.prototype.get heapSnapshot):
(WebInspector.HeapSnapshotDataGridTree.prototype.get visible):
(WebInspector.HeapSnapshotDataGridTree.prototype.get popover):
(WebInspector.HeapSnapshotDataGridTree.prototype.get popoverNode):
(WebInspector.HeapSnapshotDataGridTree.prototype.set popoverNode):
(WebInspector.HeapSnapshotDataGridTree.prototype.get children):
(WebInspector.HeapSnapshotDataGridTree.prototype.appendChild):
(WebInspector.HeapSnapshotDataGridTree.prototype.insertChild):
(WebInspector.HeapSnapshotDataGridTree.prototype.removeChildren):
(WebInspector.HeapSnapshotDataGridTree.prototype.set sortComparator):
(WebInspector.HeapSnapshotDataGridTree.prototype.sort):
(WebInspector.HeapSnapshotDataGridTree.prototype.shown):
(WebInspector.HeapSnapshotDataGridTree.prototype.hidden):
(WebInspector.HeapSnapshotDataGridTree.prototype.willDismissPopover):
(WebInspector.HeapSnapshotDataGridTree.prototype.get alwaysShowRetainedSize):
(WebInspector.HeapSnapshotDataGridTree.prototype.populateTopLevel):
(WebInspector.HeapSnapshotDataGridTree.prototype.didPopulate):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.get alwaysShowRetainedSize):
(WebInspector.HeapSnapshotInstancesDataGridTree.prototype.populateTopLevel):
(WebInspector.HeapSnapshotInstancesDataGridTree):
(WebInspector.HeapSnapshotObjectGraphDataGridTree.prototype.get alwaysShowRetainedSize):
(WebInspector.HeapSnapshotObjectGraphDataGridTree.prototype.populateTopLevel):
(WebInspector.HeapSnapshotObjectGraphDataGridTree):

UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:

(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.createCellContent):
Start using different previews based on instance type.

(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._populateError):
Common preview error logic. Also, don't output "Internal object" next to things
like Structure, InferredType, etc. Just don't output anything. Eventually, if
we provide preview data, something will show, but for now nothing is fine.

(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._populateWindowPreview.inspectedPage_window_getLocationHref):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._populateWindowPreview):
Custom preview logic for Window's gets window.location.href on the instance if it is alive.

(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._populatePreview):
Normal preview logic.

UserInterface/Views/HeapSnapshotInstancesContentView.css:

(.heap-snapshot > .data-grid tr:not(.selected) td .preview-error): Deleted.
The red text for errors was standing out too much. Make it the default black.

UserInterface/Views/HeapAllocationsTimelineView.js:

(WebInspector.HeapAllocationsTimelineView.prototype.showHeapSnapshotTimelineRecord):
Better variable name.

UserInterface/Controllers/JavaScriptRuntimeCompletionProvider.js:

(WebInspector.JavaScriptRuntimeCompletionProvider.prototype.completionControllerCompletionsNeeded.inspectedPage_evalResult_getArrayCompletions):
(WebInspector.JavaScriptRuntimeCompletionProvider.prototype.completionControllerCompletionsNeeded.inspectedPage_evalResult_getCompletions):
(WebInspector.JavaScriptRuntimeCompletionProvider.prototype.completionControllerCompletionsNeeded.getArrayCompletions): Deleted.
(WebInspector.JavaScriptRuntimeCompletionProvider.prototype.completionControllerCompletionsNeeded.getCompletions): Deleted.
(WebInspector.JavaScriptRuntimeCompletionProvider.prototype.completionControllerCompletionsNeeded.evaluated):
Try to be clearer about functions that run on the inspected page
by using the pattern with inspectedPage_<thisObject>_functionName.

1:27 PM Changeset in webkit [200473] by dino@apple.com

4 edits in trunk/Source/WebKit2

Shadow DOM should not be experimental
https://bugs.webkit.org/show_bug.cgi?id=157384
<rdar://problem/26123254>

Reviewed by Anders Carlsson.

Shadow DOM is not an experimental feature. We want
it enabled by default.

This fixes the timeout in:
WebKit2.InjectedBundleMakeAllShadowRootOpenTest

Shared/WebPreferencesDefinitions.h: Move the Shadow

DOM preference out of Experimental.

WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

1:20 PM WebKitGTK/Gardening/Calendar edited by clopez@igalia.com

(diff)

1:14 PM Changeset in webkit [200472] by clopez@igalia.com

2 edits in trunk/LayoutTests

[GTK] Unreviewed gardening.

platform/gtk/TestExpectations: Add more HiDPI tests failing.

1:12 PM Changeset in webkit [200471] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Console is unresponsive for >10 seconds when it tries to render 10,000 messages
https://bugs.webkit.org/show_bug.cgi?id=157368
<rdar://problem/26103657>

Reviewed by Timothy Hatcher.

Render only up to 100 messages per animation frame to keep the Inspector's UI responsive.

UserInterface/Controllers/JavaScriptLogViewController.js:

(WebInspector.JavaScriptLogViewController.prototype.renderPendingMessages):

1:01 PM Changeset in webkit [200470] by Simon Fraser

16 edits in trunk/Source

Revert r200390, thus putting r199259 and r200161 and back.

Source/WebCore:

loader/HistoryController.cpp:

(WebCore::HistoryController::saveScrollPositionAndViewStateToItem):

page/FrameView.cpp:

(WebCore::FrameView::adjustTiledBackingScrollability):

page/Page.h:

(WebCore::Page::obscuredInset):
(WebCore::Page::setObscuredInset):
(WebCore::Page::enclosedInScrollableAncestorView):
(WebCore::Page::setEnclosedInScrollableAncestorView):

platform/ScrollView.h:

(WebCore::ScrollView::platformObscuredInset): Deleted.
(WebCore::ScrollView::platformSetObscuredInset): Deleted.

Source/WebKit2:

Shared/VisibleContentRectUpdateInfo.cpp:

(WebKit::VisibleContentRectUpdateInfo::encode):
(WebKit::VisibleContentRectUpdateInfo::decode):

Shared/VisibleContentRectUpdateInfo.h:

(WebKit::VisibleContentRectUpdateInfo::VisibleContentRectUpdateInfo):
(WebKit::VisibleContentRectUpdateInfo::enclosedInScrollableAncestorView):
(WebKit::operator==):

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _didInvokeUIScrollViewDelegateCallback]):
(-[WKWebView _didFinishScrolling]):
(-[WKWebView scrollViewDidScroll:]):
(-[WKWebView scrollViewDidZoom:]):
(-[WKWebView scrollViewDidEndZooming:withView:atScale:]):
(-[WKWebView _scrollViewDidInterruptDecelerating:]):
(-[WKWebView _visibleRectInEnclosingScrollView:]):
(-[WKWebView _visibleContentRect]):
(-[WKWebView _didScroll]):
(-[WKWebView _enclosingScrollerScrollingEnded:]):
(-[WKWebView _frameOrBoundsChanged]):
(-[WKWebView _updateVisibleContentRects]):
(-[WKWebView _updateVisibleContentRectAfterScrollInView:]):
(scrollViewCanScroll):
(-[WKWebView _updateContentRectsWithState:]):

UIProcess/API/Cocoa/WKWebViewInternal.h:
UIProcess/WebPageProxy.h:
UIProcess/ios/WKContentView.h:
UIProcess/ios/WKContentView.mm:

(-[WKContentView didUpdateVisibleRect:unobscuredRect:unobscuredRectInScrollViewCoordinates:obscuredInset:scale:minimumScale:inStableState:isChangingObscuredInsetsInteractively:enclosedInScrollableAncestorView:]):
(-[WKContentView didUpdateVisibleRect:unobscuredRect:unobscuredRectInScrollViewCoordinates:obscuredInset:scale:minimumScale:inStableState:isChangingObscuredInsetsInteractively:]): Deleted.

UIProcess/ios/WebPageProxyIOS.mm:

(WebKit::WebPageProxy::updateVisibleContentRects):

UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:

(WebKit::RemoteLayerTreeDrawingAreaProxy::indicatorLocation):

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::updateVisibleContentRects):

12:46 PM Changeset in webkit [200469] by weinig@apple.com

2 edits in trunk/Source/WebCore

Fix the build.

platform/network/cf/CertificateInfo.h:

12:20 PM Changeset in webkit [200468] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

We shouldn't crash if DFG AI proved that something was unreachable on one run but then decided not to prove it on another run
https://bugs.webkit.org/show_bug.cgi?id=157379

Reviewed by Mark Lam.

Any run of DFG AI is a fixpoint that loosens the proof until it can't find any more
counterexamples to the proof. It errs on the side of loosening proofs, i.e., on the side of
proving fewer things.

We run this fixpoint multiple times since there are multiple points in the DFG optimization
pipeline when we run DFG AI. Each of those runs completes a fixpoint and produces the
tightest proof it can that did not result in counterexamples being found.

It's possible that on run K of DFG AI, we prove some property, but on run K+1, we don't prove
that property. The code could have changed between the two runs due to other phases. Other
phases may modify the code in such a way that it's less amenable to AI's analysis. Our design
allows this because DFG AI is not 100% precise. It defends itself from making unsound choices
or running forever by sometimes punting on proving some property. It must be able to do this,
and so therefore, it might sometimes prove fewer things on a later run.

Currently in trunk if the property that AI proves on run K but fails to prove on run K+1 is
the reachability of a piece of code, then run K+1 will crash on an assertion at the
Unreachable node. It will complain that it reached an Unreachable. But it might be reaching
that Unreachable because it failed to prove that something earlier was always exiting. That's
OK, see above.

So, we should remove the assertion that AI doesn't see Unreachable.

No new tests because I don't know how to make this happen. I believe that this happens in the
wild based on crash logs.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

12:01 PM Changeset in webkit [200467] by commit-queue@webkit.org

7 edits
2 adds in trunk

Crash if you type "debugger" in the console and continue
https://bugs.webkit.org/show_bug.cgi?id=156924
<rdar://problem/25884189>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-05
Reviewed by Mark Lam.

Source/JavaScriptCore:

inspector/agents/InspectorDebuggerAgent.cpp:

(Inspector::InspectorDebuggerAgent::evaluateOnCallFrame):
Bail with an error when we are not paused.

inspector/agents/InspectorRuntimeAgent.cpp:

(Inspector::InspectorRuntimeAgent::callFunctionOn):
(Inspector::InspectorRuntimeAgent::getProperties):
(Inspector::InspectorRuntimeAgent::getDisplayableProperties):
(Inspector::InspectorRuntimeAgent::getCollectionEntries):
(Inspector::InspectorRuntimeAgent::saveResult):
Update poor error message.

Source/WebInspectorUI:

UserInterface/Test/InspectorProtocol.js:

(InspectorProtocol.sendCommand):
Simplify sending a command with no parameters.

LayoutTests:

inspector/debugger/evaluateOnCallFrame-errors-expected.txt: Added.
inspector/debugger/evaluateOnCallFrame-errors.html: Added.
inspector/protocol/backend-dispatcher-argument-errors-expected.txt:

11:51 AM Changeset in webkit [200466] by eric.carlson@apple.com

3 edits in trunk/Source/WebCore

[iOS] Media information is sometimes not shown in Control Center
https://bugs.webkit.org/show_bug.cgi?id=157377

Reviewed by Jer Noble.

platform/audio/ios/MediaSessionManagerIOS.h:
platform/audio/ios/MediaSessionManagerIOS.mm:

(WebCore::MediaSessionManageriOS::updateNowPlayingInfo): Store values passed to MPNowPlayingInfoCenter

individually instead of in a dictionary.

11:36 AM Changeset in webkit [200465] by Simon Fraser

5 edits
2 adds in trunk

Comments on wired.com are blurry
https://bugs.webkit.org/show_bug.cgi?id=148630
Source/WebCore:

rdar://problem/22499655

Reviewed by Tim Horton.

Make sure to set -rasterizationScale on TileGrid container layers to avoid blurry layers
with some configurations of transforms, perspective and clipping.

Test: compositing/contents-scale/rasterization-scale.html

platform/graphics/ca/TileController.cpp:

(WebCore::TileController::TileController): Initialize m_deviceScaleFactor before m_tileGrid,
because TileGrid's constructor needs to read the device scale.

platform/graphics/ca/TileController.h:
platform/graphics/ca/TileGrid.cpp:

(WebCore::TileGrid::TileGrid): Push a contentsScale (which also sets rasterizationScale) onto
the tile grid container layer on constructions, and in setScale().
(WebCore::TileGrid::setScale):

LayoutTests:

Reviewed by Tim Horton.

This testcase does not fail without the patch because of how WTR does snapshotting,
but some future improvement may fix that.

compositing/contents-scale/rasterization-scale-expected.html: Added.
compositing/contents-scale/rasterization-scale.html: Added.

11:33 AM Changeset in webkit [200464] by rniwa@webkit.org

9 edits in trunk

event.target shouldn't be retargeted as the event bubbles into a slot
https://bugs.webkit.org/show_bug.cgi?id=157369

Reviewed by Antti Koivisto.

Source/WebCore:

When an event bubbles up from an assigned node to its assigned slot, we shouldn't be adjusting
event.target to point to the slot. Since a shadow tree should have access to nodes outside
the shadow tree, event.target is accessible inside the shadow tree of such a slot.

New behavior matches the behavior of Google Chrome Canary as well as the shadow DOM specification:
http://w3c.github.io/webcomponents/spec/shadow/#dfn-retargeting-algorithm

Test: fast/shadow-dom/event-inside-slotted-node.html

dom/Event.cpp:

(WebCore::Event::deepPath):

dom/EventContext.h:

(WebCore::EventContext::isUnreachableNode): Use Node::isUnclosedNode instead of isReachable.
(WebCore::EventContext::isReachable): Deleted.

dom/EventPath.cpp:

(WebCore::EventPath::EventPath): Don't set the target to the slot when entering a slot. Also moved
the code to adjust the target as we exit a shadow tree to the end of the outer loop for clarity.
(WebCore::isUnclosedNodeOf): Deleted. Renamed to Node::isUnclosedNode.
(WebCore::EventPath::setRelatedTarget):
(WebCore::EventPath::computePathUnclosedToTarget): Renamed from computePathDisclosedToTarget.
(WebCore::moveOutOfAllShadowRoots): Extracted from RelatedNodeRetargeter::RelatedNodeRetargeter.
(WebCore::RelatedNodeRetargeter::RelatedNodeRetargeter): Fixed a bug that we were exiting early
without setting m_hasDifferentTreeRoot true when target and relatedNode are disconnected from
a document.
(WebCore::RelatedNodeRetargeter::currentNode):
(WebCore::RelatedNodeRetargeter::checkConsistency): Updated to match the spec with one exception.
We don't use null as the adjusted related target when the (original) related target and the target
are in two distinct disconnected trees since such a behavior is not Web compatible. This spec bug is
tracked by https://github.com/w3c/webcomponents/issues/494

dom/EventPath.h:

(WebCore::EventPath::eventTargetRespectingTargetRules): Returns Node* instead of EventTarget* since
we need a Node in RelatedNodeRetargeter::checkConsistency.

dom/Node.cpp:

(WebCore::Node::isUnclosedNode): Moved from RelatedNodeRetargeter.cpp

dom/Node.h:

LayoutTests:

Updated test cases to expect the target to be not adjusted to a slot element when the event path
enters one as this didn't match the spec or the behavior of Google Chrome Canary. Both WebKit and
Chrome passes the test with this change.

fast/shadow-dom/event-inside-slotted-node.html:

11:23 AM Changeset in webkit [200463] by weinig@apple.com

19 edits in trunk/Source

On platforms that support it, use a SecTrustRef as the basis of CertificateInfo instead of a chain of SecCertificateRefs.
https://bugs.webkit.org/show_bug.cgi?id=157220

Reviewed by Darin Adler.

Source/WebCore:

platform/network/cf/CertificateInfo.h:

(WebCore::CertificateInfo::CertificateInfo):
(WebCore::CertificateInfo::trust):
(WebCore::CertificateInfo::isEmpty):
(WebCore::CertificateInfo::setCertificateChain): Deleted.
(WebCore::CertificateInfo::certificateChain): Deleted.

platform/network/mac/CertificateInfoMac.mm:

(WebCore::CertificateInfo::type):
(WebCore::CertificateInfo::certificateChain):
(WebCore::CertificateInfo::containsNonRootSHA1SignedCertificate):
(WebCore::CertificateInfo::dump):
When supported, allow CertificateInfo to contain a SecTrustRef instead of a certificate chain. We keep
support for holding on to a certificate chain as well, since there is API that depends on this.

platform/network/cocoa/ResourceResponseCocoa.mm:

(WebCore::ResourceResponse::platformCertificateInfo):
When supported, use the SecTrustRef from the error instead of extracting it's certificate chain.

Source/WebKit2:

Shared/Authentication/mac/AuthenticationManager.mac.mm:

(WebKit::leafCertificate):
(WebKit::chain):
(WebKit::AuthenticationManager::tryUseCertificateInfoForChallenge):
When supported, get the SecCertificateRef from the SecTrustRef rather than the
stored certificate chain.

Shared/cf/ArgumentCodersCF.cpp:

(IPC::typeFromCFTypeRef):
(IPC::encode):
(IPC::decode):

Shared/cf/ArgumentCodersCF.h:

Add support for encoding/decoding SecTrustRef objects.

Shared/mac/WebCoreArgumentCodersMac.mm:

(IPC::ArgumentCoder<CertificateInfo>::encode):
(IPC::ArgumentCoder<CertificateInfo>::decode):
Add support for encoding/decoding CertificateInfo's that contain SecTrustRef objects.

(IPC::encodeNSError):
(IPC::decodeNSError):
Simplify error encoding/decoding by not using an addition CertificateInfo object for encoding
the peerCertificateChain. Also, add the peerTrust to the userInfo that get's encoded/decoded.

UIProcess/API/Cocoa/WKWebView.h:
UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView serverTrust]):
(-[WKWebView certificateChain]):
Add new serverTrust API and deprecate certificateChain.

UIProcess/Cocoa/NavigationState.mm:

(WebKit::NavigationState::willChangeCertificateInfo):
(WebKit::NavigationState::didChangeCertificateInfo):
Add support for KVO of -[WKWebView serverTrust].

Source/WTF:

wtf/Platform.h:

Add support for HAVE(SEC_TRUST_SERIALIZATION).

wtf/spi/cocoa/SecuritySPI.h:

Add SPI access to SecTrustSerialize and SecTrustDeserialize.

11:14 AM Changeset in webkit [200462] by adachan@apple.com

3 edits in trunk/Source/WebCore

When exiting fullscreen, call a JS method immediately to implement the style changes for the presentation mode change right away
https://bugs.webkit.org/show_bug.cgi?id=157359

Reviewed by Eric Carlson.

No new tests as this is done to just mitigate a visual glitch.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::exitFullscreen):
(WebCore::HTMLMediaElement::updateMediaControlsAfterPresentationModeChange):

html/HTMLMediaElement.h:

10:43 AM Changeset in webkit [200461] by achristensen@apple.com

12 edits
3 adds in trunk

Blocked redirected main resource requests need descriptive errors
https://bugs.webkit.org/show_bug.cgi?id=156828
rdar://problem/25711316

Reviewed by Daniel Bates.

Source/WebCore:

Test: http/tests/contentextensions/main-resource-redirect-error.html

loader/DocumentLoader.cpp:

(WebCore::DocumentLoader::startLoadingMainResource):
Call cancelMainResourceLoad() so that InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame()
is called to be consistent with blocked redirected main resource requests.

loader/ResourceLoader.cpp:

(WebCore::ResourceLoader::willSendRequestInternal):
(WebCore::ResourceLoader::blockedError):
(WebCore::ResourceLoader::blockedByContentBlockerError):
(WebCore::ResourceLoader::cannotShowURLError):

loader/ResourceLoader.h:

Use a blockedByContentBlockerError() instead of a cannotShowURLError() when we blocked the load.

Tools:

WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:

(WTR::InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame):
Print out the error type to make sure we have the most descriptive error type.

LayoutTests:

http/tests/contentextensions/block-everything-if-domain-expected.txt:

Updated because the page no longer loads because the main resource was blocked.

http/tests/contentextensions/block-everything-unless-domain-expected.txt:
http/tests/contentextensions/block-everything-unless-domain.html:

Updated test because about:blank is no longer loaded when the main resource fails to load.

http/tests/contentextensions/main-resource-expected.txt:

Update to reflect new behavior of calling didFailProvisionalLoadWithError instead of just didFailLoadingWithError.

http/tests/contentextensions/main-resource-redirect-error-expected.txt: Added.
http/tests/contentextensions/main-resource-redirect-error.html: Added.
http/tests/contentextensions/main-resource-redirect-error.html.json: Added.
http/tests/contentextensions/main-resource.html:

10:41 AM Changeset in webkit [200460] by dbates@webkit.org

2 edits in trunk/Source/WebKit2

Remove workaround added in r200391 (rdar://problem/25992976)
https://bugs.webkit.org/show_bug.cgi?id=157378
<rdar://problem/26118503>

Reviewed by Anders Carlsson.

Following the fix for <rdar://problem/26075714> we can remove the workaround added in r200391 (rdar://problem/25992976).

Shared/mac/CodeSigning.mm:

(WebKit::secCodeSigningIdentifier):

10:30 AM Changeset in webkit [200459] by keith_miller@apple.com

20 edits
2 adds in trunk/Source/JavaScriptCore

Add support for delete by value to the DFG
https://bugs.webkit.org/show_bug.cgi?id=157372

Reviewed by Filip Pizlo.

This patch adds basic support for delete by value to the DFG. delete by value
just calls out to a C++ operation on each execution. Additionally, this patch
fixes an issue with delete by id where we would crash if the base was null
or undefined.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileDeleteById):
(JSC::DFG::SpeculativeJIT::compileDeleteByVal):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::callOperation):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

jit/JIT.h:
jit/JITOperations.cpp:
jit/JITOperations.h:
jit/JITPropertyAccess.cpp:

(JSC::JIT::emit_op_del_by_val):

jit/JITPropertyAccess32_64.cpp:

(JSC::JIT::emit_op_del_by_val):

tests/stress/delete-by-val.js: Added.

(assert):
(test):

tests/stress/delete-to-object-exception.js: Added.

(assert):
(test):

10:14 AM Changeset in webkit [200458] by msaboff@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed build fix after change set r200447.

Made the detection of clang version XCode build specific.
Now shouldEnableDebugAnnotations() should return false for all other build types.

offlineasm/config.rb:

9:49 AM Changeset in webkit [200457] by ddkilzer@apple.com

3 edits
1 add in trunk/Websites/bugs.webkit.org

bugs.webkit.org: "See Also" field should support Chromium bugs

Merge Bugzilla upstream master 3af55bfe0bd10a85b7cd69e26a19034a6d2e78f5.
<https://bugzilla.mozilla.org/show_bug.cgi?id=1252782>

Bugzilla/BugUrl.pm: Add Bugzilla::BugUrl::Chromium class to

list of classes that parse supported URLs.

Bugzilla/BugUrl/Chromium.pm: Added.

(should_handle):
(_check_value):

template/en/default/global/user-error.html.tmpl: Update error

message.

8:31 AM Changeset in webkit [200456] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

Fix assertions in debug builds for the GTK+ port.

Rubber-stamped by Carlos Garcia Campos.

platform/graphics/texmap/TextureMapperGL.cpp:

(WebCore::TextureMapperGLData::SharedGLData::currentSharedGLData):
Switch back to the find() + add() combo for retrieving the pointer
to the SharedGLData object stored for the specific GraphicsContext3D.
add() + isNewEntry is causing assertions in debug builds when adding
the first entry.

6:03 AM Changeset in webkit [200455] by Carlos Garcia Campos

4 edits in trunk/Source/WebCore

[GStreamer] Adaptive streaming issues
https://bugs.webkit.org/show_bug.cgi?id=144040

Reviewed by Philippe Normand.

In the case of adaptive streaming, the GST URI downloader object is creating the source object, in our case
WebKitWebSrc, without taking its ownership. This is breaking the lifetime of the WebKitWebSrc element. We are
using GRefPtr in WebKitWebSrc to ref/unref the object when sending notifications to the main thread, ensuring
that the object is not destroyed before the main thread dispatches the message. But our smart pointers are so
smart that in case of receiving a floating reference, it's converted to a full reference, so that the first time
we try to take a ref of a WebKitWebSrc having a floating reference we are actually taking the ownership
instead. When we try to release the reference, we are actuallty destroying the object, something that the actual
owner is not expecting and causing runtime critical warnings and very often web process crashes.

(WebKitWebProcess:6863): GStreamer-CRITICAL :
Trying to dispose element appsrc1, but it is in READY instead of the NULL state.
You need to explicitly set elements to the NULL state before
dropping the final reference, to allow them to clean up.
This problem may also be caused by a refcounting bug in the
application or some element.

(WebKitWebProcess:6863): GStreamer-CRITICAL : gst_uri_handler_get_uri: assertion 'GST_IS_URI_HANDLER(handler)' failed

(WebKitWebProcess:6863): GStreamer-CRITICAL : gst_uri_get_protocol: assertion 'uri != NULL' failed

This should be fixed in GST, but we can workaround it in WebKit while it's fixed in GST or to prevent this from
happening if other users make the same mistake. The idea is to add a ensureGRef() only available for GRefPtr
when using WebKitWebSrc objects that consumes the floating reference if needed before taking the actual reference.

platform/graphics/gstreamer/GRefPtrGStreamer.cpp:

(WTF::ensureGRef): Consume the floating ref if needed.

platform/graphics/gstreamer/GRefPtrGStreamer.h:
platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:

(webKitWebSrcChangeState): Use ensureGRef().

2:19 AM MathML/Early_2016_Refactoring edited by fred.wang@free.fr

(diff)

1:40 AM Changeset in webkit [200454] by commit-queue@webkit.org

2 edits
2 adds in trunk/Tools

[GStreamer] Bump internal jhbuild versions to 1.8.0 and patches to support MSE
https://bugs.webkit.org/show_bug.cgi?id=157341

Patch by Enrique Ocaña González <eocanha@igalia.com> on 2016-05-05
Reviewed by Xabier Rodriguez-Calvar.

gtk/jhbuild.modules:
gtk/patches/gst-plugins-good-Revert-qtdemux-expose-streams-with-first-moof-for-fr.patch: Added.
gtk/patches/gst-plugins-good-use-the-tfdt-decode-time.patch: Added.

1:25 AM Changeset in webkit [200453] by Csaba Osztrogonác

2 edits in trunk/Source/WebCore

[Mac][cmake] Unreviewed speculative buildfix after r200433, just for fun.

PlatformMac.cmake:

12:54 AM Changeset in webkit [200452] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

Create console object lazily
https://bugs.webkit.org/show_bug.cgi?id=157328

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-05
Reviewed by Geoffrey Garen.

runtime/CommonIdentifiers.h:
runtime/JSGlobalObject.cpp:

(JSC::createConsoleProperty):
(JSC::JSGlobalObject::init): Deleted.

May 4, 2016:

11:42 PM Changeset in webkit [200451] by zandobersek@gmail.com

5 edits in trunk/Source/WebCore

[TexMap] Clean up TextureMapperShaderProgram
https://bugs.webkit.org/show_bug.cgi?id=157302

Reviewed by Carlos Garcia Campos.

Clean up the header and the implementation file of the
TextureMapperShaderProgram class. Reference the GraphicsContext3D
object through a Ref<>, and have the context() return a reference,
not a pointer.

Sort the parts of the implementation file into something more
sensible. StringBuilder usage in create() is improved. getLocation()
only needs to do one lookup in the m_variables map by using ensure().

No new tests -- no change in behavior.

platform/graphics/surfaces/GLTransportSurface.cpp:

(WebCore::GLTransportSurface::initializeShaderProgram):

platform/graphics/texmap/TextureMapperGL.cpp:

(WebCore::TextureMapperGLData::SharedGLData::getShaderProgram):
(WebCore::prepareFilterProgram):

platform/graphics/texmap/TextureMapperShaderProgram.cpp:

(WebCore::TextureMapperShaderProgram::create):
(WebCore::TextureMapperShaderProgram::TextureMapperShaderProgram):
(WebCore::TextureMapperShaderProgram::~TextureMapperShaderProgram):
(WebCore::TextureMapperShaderProgram::setMatrix):
(WebCore::TextureMapperShaderProgram::getLocation):

platform/graphics/texmap/TextureMapperShaderProgram.h:

(WebCore::TextureMapperShaderProgram::context):

11:13 PM Changeset in webkit [200450] by commit-queue@webkit.org

2 edits in trunk/Tools

Add JSC test results in JSON format to a Buildbot log
https://bugs.webkit.org/show_bug.cgi?id=156920

Patch by Srinivasan Vijayaraghavan <svijayaraghavan@apple.com> on 2016-05-04
Reviewed by Daniel Bates.

BuildSlaveSupport/build.webkit.org-config/master.cfg:

(RunJavaScriptCoreTests): Move command-line option for output file out
of WithProperties.

10:27 PM Changeset in webkit [200449] by Dewei Zhu

7 edits
1 add in trunk/Websites/perf.webkit.org

Summary page should show warnings when current or baseline data is missing.
https://bugs.webkit.org/show_bug.cgi?id=157339

Reviewed by Ryosuke Niwa.

Set summary page to be the default page of v3 UI.
Show warning icon when either baseline or current data is missing.
Make fetchBetween returns a promise.
Update unit tests for MeasurementSet.fetchBetween since it returns a promise now.
Add a workaround to skip some platform and metric configurations.

public/v3/components/ratio-bar-graph.js:

(RatioBarGraph):
(RatioBarGraph.prototype.update): Add showWarningIcon flag to indicate whether we should show warning icon.
(RatioBarGraph.prototype.render): Show warning icon when showWarningIcon is true.
(RatioBarGraph.cssTemplate): Add style for warning icon.

public/v3/components/warning-icon.js: Add warning icon.

(WarningIcon):
(WarningIcon.cssTemplate):

public/v3/index.html:
public/v3/main.js:

(main): Set summary page to be the default page of v3 UI.

public/v3/models/measurement-set.js:

(MeasurementSet):
(MeasurementSet.prototype.fetchBetween): Returns a promise. Fix the bug in previous implementation that we miss
some callbacks sometimes. Basically, we will fetch primary cluster first, then secondary clusters. For each
secondary cluster fetch, we will always invoke callback even when it fails.
(MeasurementSet.prototype._fetchSecondaryClusters): Deleted.
(MeasurementSet.prototype._fetch.else.url.api.measurement.set platform): Deleted.

public/v3/pages/summary-page.js:

(SummaryPage): Add a variable for excluded configurations.
(SummaryPage.prototype._createConfigurationGroup): Pass excluded configurations while building config groups.
(SummaryPage.prototype._constructTable): Remove the logic for unified header since it breaks consistency of the table appearance.
(SummaryPage.prototype.this._renderQueue.push): Show warning message when baseline/current data is missing.
(SummaryPageConfigurationGroup): Add a variable to keep track of the warnings while computing summary.
(SummaryPageConfigurationGroup.prototype.warnings): A getter for warnings.
(SummaryPageConfigurationGroup._computeSummary): Fix a bug in calculating ratios. We should always use
current/baseline for ratio and present the difference between ratio and 1 in the summary page.
(SummaryPageConfigurationGroup.set then): Deleted.
(SummaryPageConfigurationGroup.set var): Deleted.

unit-tests/measurement-set-tests.js: Add a helper function to wait for fetchBetween. Update unit tests since fetchBetween returns a promise now.

(promise.set fetchBetween):
(set MeasurementSet):
(set fetchBetween): Deleted.

8:09 PM Changeset in webkit [200448] by Darin Adler

27 edits
1 add in trunk/Source/WebCore

Start on dictionary support for IDL, getting enough to work for one dictionary
https://bugs.webkit.org/show_bug.cgi?id=157336

Reviewed by Alex Christensen.

bindings/js/JSDOMBinding.h: Return RefPtr instead of PassRefPtr for the return

value of toArrayBufferView. Not only is this the correct modern idiom, it also
works properly with auto, and PassRefPtr does not.

bindings/js/JSDOMBuild.h: Added. This has the build function template in it.

It's used to build values like dictionaries. We specialize and call the tempate
in generated code. This is only the initial simplistic version; will be refining
for exception handling, optional handling, default value handling, and lots of
other things not yet needed for this first dictionary.

bindings/scripts/CodeGenerator.pm:

(ProcessDocument): Handle dictionaries much like how we handle enumerations.
(SkipIncludeHeader): Moved small list of special types here from CodeGeneratorJS.
(IsDictionaryType): Added.
(IsRefPtrType): Make this return 0 for dictionary types.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateInterface): Added handling for dictionaries.
(SkipIncludeHeader): Deleted.
(AddIncludesForType): Call the the SkipIncludeHeader from CodeGenerator.pm directly.
(GetNestedClassName): Factored out the work that was previously in
GetEnumerationClassName so we could reuse it for dictionaries too.
(GetEnumerationClassName): Changed to call GetNestedClassName.
(GetEnumerationClassIdentifier): Deleted. Instead of using this, we now use templates
so we can use the actual class name.
(GenerateEnumerationImplementationContent): Changed parse and expectedEnumerationValues
to use function template specialization instead of functions. This cleans up the code
a bit and makes it eaiser to use from other templates. Later we may want to merge the
parse function template build function template from JSDOMBuild.h. Added specialization
of the build function template.
(GetDictionaryClassName): Added. Calls GetNestedClassName.
(GenerateDictionaryImplementationContent): Added. Generates the build function for each
dictionary type. Initial simplistic version to be refined.
(GenerateImplementation): Added dictionaries argument and called the
GenerateDictionaryImplementationContent function. Also changed many functions to take
interface arguments and also removed redundant interfaceName arguments from functions
that formerly took both.
(GenerateParametersCheck): Updated for changes above. That includes calling the new
parse function template. Also changed to use auto and WTFMove, which makes the code
both more generic and potentially more efficient and obviates the need for a special
case for dictionary types.
(GenerateCallbackHeader): Updated for changes above.
(GenerateCallbackImplementation): Ditto.
(GenerateImplementationFunctionCall): Ditto.
(GetNativeTypeFromSignature): Ditto.
(GetNativeType): Changed this function to take the interface because that's needed to
get the type name right for enumeration types rather than returning "auto". Made that
change as well. Moved one type, DOMStringList, into the nativeType hash instead of
having explicit code here for it. Didn't add a dictionary type case here yet, but
probably will need to do that in the next patch.
(ShouldPassWrapperByReference): Pass interface in to GetNativeType.
(GetNativeVectorInnerType): Removed unneeded special case for DOMString.
(GetNativeTypeForCallbacks): Changed to take the interface.
(GetNativeTypeForMemoization): Ditto.
(JSValueToNative): Changed expression for Dictionary (the thing I am working to make
obsolete) to name the type so it will work with auto. Added a case for dictionary
types and updated the case for enumeration types.
(NativeToJSValue): Updated to take an interface rather than an interface name, and to
pass that along as needed.

bindings/scripts/IDLParser.pm:

(Parse): Add dictionaries to a list.
(parseDictionary): Put name, extended attributes, and members into the dictionary.
(parseDictionaryMembers): Build up a members array.
(parseDictionaryMember): Put isOptional, type, name, and default value into the
dictionary member.

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
bindings/scripts/test/GObject/WebKitDOMTestObj.h:
bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
bindings/scripts/test/JS/JSTestEventTarget.cpp:
bindings/scripts/test/JS/JSTestGlobalObject.cpp:
bindings/scripts/test/JS/JSTestInterface.cpp:
bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
bindings/scripts/test/JS/JSTestNode.cpp:
bindings/scripts/test/JS/JSTestNondeterministic.cpp:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
bindings/scripts/test/JS/JSTestTypedefs.cpp:
bindings/scripts/test/ObjC/DOMTestObj.h:
bindings/scripts/test/ObjC/DOMTestObj.mm:

Regenerated.

bindings/scripts/test/TestObj.idl: Added some test cases that I was using to

get the bindings script to work. Right now this is basically identical to the
actual use of this in Element.idl, but over time I will modify it to cover more
features of dictionaries. Also fixed some incorrect test cases trying to use
the type "bool", which doesn't exist in IDL.

dom/Element.cpp:

(WebCore::Element::canHaveUserAgentShadowRoot): Added. The existing code used a
combination of a virtual function on HTMLElement and type checking. It's better
to just use a virtual function on Element.
(WebCore::Element::attachShadow): Updated to take a ShadowRootInit struct instead
of a Dictionary. Also tweaked the code in a couple other minor ways.

dom/Element.h: Added the ShadowRootMode enum class and the ShadowRootInit struct,

and changed attachShadow to take ShadowRootInit instead of Dictionary. Also added
the private canHaveUserAgentShadowRoot virtual function.

dom/Element.idl: Added ShadowRootMode, ShadowRootInit, and used them in as the

arguemnt type for attachShadow.

html/HTMLElement.h: Made canHaveUserAgentShadowRoot a private override instead

of a public virtual function.

6:06 PM Changeset in webkit [200447] by msaboff@apple.com

2 edits in trunk/Source/JavaScriptCore

Enable Dwarf2 debug information in offline assembler for clang compiler
https://bugs.webkit.org/show_bug.cgi?id=157364.

Reviewed by Mark Lam.

Added a new function shouldEnableDebugAnnotations() that determines if
we are using clang and a new enough version to support the debug annotations.

offlineasm/config.rb:

(shouldEnableDebugAnnotations): Added.

5:55 PM Changeset in webkit [200446] by eric.carlson@apple.com

2 edits in trunk/Source/WebCore

[iOS] Playback does not pause when locking screen after playing to AirPlay.
https://bugs.webkit.org/show_bug.cgi?id=157366
<rdar://problem/22100651>

Reviewed by Dean Jackson.

platform/audio/PlatformMediaSession.cpp:

(WebCore::PlatformMediaSession::isPlayingToWirelessPlaybackTargetChanged): Save and restore

m_interruptionCount around calling sessionIsPlayingToWirelessPlaybackTargetChanged because
it will call beginInterruption if we are already in the background and the counter will
get out of sync.

5:32 PM Changeset in webkit [200445] by dbates@webkit.org

5 edits in trunk

CSP: Perform case sensitive match against path portion of source expression URL that ends in '/'
https://bugs.webkit.org/show_bug.cgi?id=157275

Reviewed by Darin Adler.

Source/WebCore:

Merged from Blink:
<https://chromium.googlesource.com/chromium/src/+/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb>

Perform a case-sensitive prefix match of the path portion a source expression that ends in '/'
against the path portion of a request URL as per step 8.5.4 of section Does url match expression
in origin with redirect count of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp>
(Editor's Draft, 27 April 2016).

page/csp/ContentSecurityPolicySource.cpp:

(WebCore::ContentSecurityPolicySource::pathMatches):

LayoutTests:

Add test to ensure that the path portion of a request URL is case-sensitively
matched against the path portion of a source expression that ends in '/'.

http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01-expected.txt:
http/tests/security/contentSecurityPolicy/source-list-parsing-paths-01.html:

5:18 PM Changeset in webkit [200444] by fpizlo@apple.com

2 edits in trunk/Source/WTF

Add HLE locks and synchronic TTAS locks to the ToyLocks benchmark suite
https://bugs.webkit.org/show_bug.cgi?id=157367

Rubber stamped by Benjamin Poulain.

Turns out they are both a lot slower than WTF::Lock. The HLE lock is written according to Intel's
documentation. The synchronic lock follows the algorithm of the "ttas_lock" in the synchronic
test.hpp.

benchmarks/ToyLocks.h:

5:14 PM Changeset in webkit [200443] by bshafiei@apple.com

5 edits in trunk/Source

Versioning.

5:13 PM Changeset in webkit [200442] by bshafiei@apple.com

1 copy in tags/Safari-602.1.31

New tag.

5:05 PM Changeset in webkit [200441] by commit-queue@webkit.org

6 edits in trunk

AX: Nonfunctional controls appear before every HTML5 video when using VoiceOver
https://bugs.webkit.org/show_bug.cgi?id=153089
<rdar://problem/24050668>

Patch by Aaron Chu <aaron_chu@apple.com> on 2016-05-04
Reviewed by Dean Jackson.

Source/WebCore:

Test: media/video-controls-show-on-kb-or-ax-event.html

Modules/mediacontrols/mediaControlsApple.js:

(Controller):
(Controller.prototype.createControls):
(Controller.prototype.updateControls):
(Controller.prototype.handlePlayButtonClicked):
(Controller.prototype.setPlaying):
(Controller.prototype.showShowControlsButton):
(Controller.prototype.showControls):
(Controller.prototype.hideControls):

Modules/mediacontrols/mediaControlsiOS.js:

(ControllerIOS.prototype.addStartPlaybackControls):
(ControllerIOS.prototype.handleStartPlaybackButtonTouchEnd):
(ControllerIOS.prototype.showControls):

Fix to make sure the showControls button in a media player behaves correctly.

LayoutTests:

media/video-controls-show-on-kb-or-ax-event-expected.txt:
media/video-controls-show-on-kb-or-ax-event.html:

A Layout Test to make sure showControls Button in media player is hidden by default.

4:41 PM Changeset in webkit [200440] by dino@apple.com

4 edits in trunk/Source/WebKit2

Experimental Features don't need an "Experimental" prefix
https://bugs.webkit.org/show_bug.cgi?id=157363
<rdar://problem/26100630>

Reviewed by Anders Carlsson.

Since we're not persisting the value of the experimental
features, it's unlikely there will ever be the case
where we move a Preference from experimental to normal
and use a stored value.

Shared/WebPreferencesDefinitions.h:
WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

4:36 PM Changeset in webkit [200439] by Nikita Vasilyev

2 edits in trunk/Source/WebInspectorUI

REGRESSION (r200401): Web Inspector: TypeError: undefined is not an object (evaluating 'messageElement.classList')
https://bugs.webkit.org/show_bug.cgi?id=157356
<rdar://problem/26097424>

Reviewed by Timothy Hatcher.

UserInterface/Views/LogContentView.js:

(WebInspector.LogContentView.prototype._reappendProvisionalMessages):
Don't filter messages since we already do that in didAppendConsoleMessageView.

4:01 PM Changeset in webkit [200438] by fpizlo@apple.com

2 edits
2 adds in trunk/Source/WTF

Add a few more WTF locking benchmarks
https://bugs.webkit.org/show_bug.cgi?id=157365

Rubber stamped by Benjamin Poulain.

Factors out our toy locks into ToyLocks.h and adds a new test (LockFairnessTest) that measures
the fairness of locks.

The result: WTF::Lock is pretty fair enough.

benchmarks/LockFairnessTest.cpp: Added.

(main):

benchmarks/LockSpeedTest.cpp:

(main):

benchmarks/ToyLocks.h: Added.

3:29 PM Changeset in webkit [200437] by dino@apple.com

9 edits in trunk/Source/WebKit2

Experimental features should toggle runtime flags
https://bugs.webkit.org/show_bug.cgi?id=157353
<rdar://problem/23621603>

Reviewed by Anders Carlsson.

Hook up the experimental WebPreferences to RuntimeEnabledFeatures.
In the process I removed the general preference for WebGL 2 (we
already had an experimental feature for it) and moved Custom
Elements and Shadow DOM to experimental.

I also removed the C versions of the preferences, since experimental
features only need the ObjC API (which is generated automatically).

Shared/WebPreferencesDefinitions.h: Move/remove some features and

make the experimental section more clear.

UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetWebGL2Enabled): Deleted.
(WKPreferencesGetWebGL2Enabled): Deleted.
(WKPreferencesSetShadowDOMEnabled): Deleted.
(WKPreferencesGetShadowDOMEnabled): Deleted.
(WKPreferencesSetCustomElementsEnabled): Deleted.
(WKPreferencesGetCustomElementsEnabled): Deleted.

UIProcess/API/C/WKPreferencesRefPrivate.h:
UIProcess/WebPreferences.cpp:

(WebKit::WebPreferences::updateBoolValueForExperimentalFeatureKey): A
version of updateBoolValueForKey that doesn't call the platform
function (e.g. doesn't save to NSUserDefaults).

UIProcess/WebPreferences.h:
UIProcess/mac/WebPreferencesMac.mm:

(WebKit::WebPreferences::platformInitializeStore): Deleted.

WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

3:28 PM Changeset in webkit [200436] by dino@apple.com

7 edits in trunk

TestRunner should always enable all the experimental features
https://bugs.webkit.org/show_bug.cgi?id=157360
<rdar://problem/26099748>

Reviewed by Anders Carlsson.

Source/WebKit2:

Experimental features are disabled by default, but it is
a pain to enable them in every test. Instead, have the
test runner turn them all on.

UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesEnableAllExperimentalFeatures):

UIProcess/API/C/WKPreferencesRefPrivate.h:
UIProcess/WebPreferences.cpp:

(WebKit::WebPreferences::enableAllExperimentalFeatures):

UIProcess/WebPreferences.h:

Tools:

Call the new SPI that enables all the experimental features.

WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues):

3:27 PM Changeset in webkit [200435] by dino@apple.com

6 edits
2 adds in trunk

Disabling WebGL2 should mean no context is created
https://bugs.webkit.org/show_bug.cgi?id=157352
<rdar://problem/26096346>

Reviewed by Eric Carlson.

Source/WebCore:

If WebGL2 is disabled by the runtime flag, we should
not create a context.

Test: fast/canvas/webgl/webgl2-runtime-flag.html

html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::WebGLRenderingContextBase::create):

testing/Internals.cpp: Added some helpers to toggle the runtime setting.

(WebCore::Internals::webGL2Enabled):
(WebCore::Internals::setWebGL2Enabled):

testing/Internals.h:
testing/Internals.idl:

LayoutTests:

Check that toggling the runtime flag enables/disables WebGL 2.0.

fast/canvas/webgl/webgl2-runtime-flag-expected.txt: Added.
fast/canvas/webgl/webgl2-runtime-flag.html: Added.

3:22 PM Changeset in webkit [200434] by keith_miller@apple.com

2 edits in trunk/Source/JavaScriptCore

Unreviewed, fix test for new ArrayIteratorPrototype.next() error message.

tests/stress/array-iterators-next-with-call.js:

3:14 PM Changeset in webkit [200433] by andersca@apple.com

2 edits
1 move in trunk/Source/WebCore

Add an override point for drawing named images in ThemeCocoa
https://bugs.webkit.org/show_bug.cgi?id=157357
rdar://problem/25878445

Reviewed by Dean Jackson.

Rename ThemeCocoa.cpp to ThemeCocoa.mm and rearrange the code that draws the wireless-playback image
so we can import ThemeCocoaDrawNamedImage.mm below.

WebCore.xcodeproj/project.pbxproj:
platform/cocoa/ThemeCocoa.cpp:

(WebCore::fitContextToBox): Deleted.
(WebCore::ThemeCocoa::drawNamedImage): Deleted.

platform/cocoa/ThemeCocoa.mm: Renamed from Source/WebCore/platform/cocoa/ThemeCocoa.cpp.

(WebCore::fitContextToBox):
(WebCore::ThemeCocoa::drawNamedImage):

3:03 PM Changeset in webkit [200432] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

Don't disconnect WebAVPlayerController from its delegate since there is no way to reconnect it.
https://bugs.webkit.org/show_bug.cgi?id=157337

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-05-04
Reviewed by Jer Noble.

WebAVPlayerController used to be deleted and recreated each time we begin fullscreen video mode.
Since it is now preserved, we shouldn't paritally tear it down in cleanupFullscreen by disconnecting it
from its delegate, especially since we have no way to reconnect it.

The side effect of leaving it connected is that it can continue to make callbacks during cleanup.
Of importance is that it sets the audio and legible media selctions to nil. We don't want to change
the selection as a result of teardown. Nil selection is unsupported by WebVideoFullscreenModelVideoElement
and causes an assert. This transition to nil selection is now ignored.

platform/ios/WebAVPlayerController.mm:

(-[WebAVPlayerController setCurrentAudioMediaSelectionOption:]):
(-[WebAVPlayerController setCurrentLegibleMediaSelectionOption:]):

platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(WebVideoFullscreenInterfaceAVKit::cleanupFullscreen):

2:33 PM Changeset in webkit [200431] by Chris Dumez

13 edits
2 adds in trunk

Media elements should not be paused right away when removed from the document
https://bugs.webkit.org/show_bug.cgi?id=157347
<rdar://problem/25888758>

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline now that more W3C tests are passing.

web-platform-tests/html/semantics/embedded-content/media-elements/playing-the-media-resource/pause-move-to-other-document-expected.txt:
web-platform-tests/html/semantics/embedded-content/media-elements/playing-the-media-resource/pause-move-within-document-expected.txt:
web-platform-tests/html/semantics/embedded-content/media-elements/playing-the-media-resource/pause-remove-from-document-expected.txt:

Source/WebCore:

Media elements should not be paused right away when removed from the document.
Instead we should allow the task that removed the media element from the
document to finish because considering pausing.

This avoid inadvertently pausing media elements when the JS merely moves them
on the page (e.g. using Node.replaceChild()).

Text from the HTML specification:
"""
When a media element is removed from a Document, the user agent must run the
following steps:

Await a stable state, allowing the task that removed the media element

from the Document to continue. The synchronous section consists of all the
remaining steps of this algorithm. (Steps in the synchronous section are
marked with ⌛.)

⌛ If the media element is in a Document, abort these steps.
⌛ Run the internal pause steps for the media element.

"""

c.f. https://html.spec.whatwg.org/multipage/embedded-content.html#htmlmediaelement

Test: media/replaceChild-should-not-pause-video.html

dom/GenericEventQueue.cpp:

(WebCore::GenericEventQueue::sharedTimerFired):
Copy the queue of events before processing it so that we don't fire events that
get scheduled by the event handlers as a result of us firing the pending events.
Otherwise, we end up firing events synchronously right after they've been queued,
which is wrong. This was causing several W3C tests to fail.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::HTMLMediaElement):
(WebCore::HTMLMediaElement::pauseAfterDetachedTimerFired):
(WebCore::HTMLMediaElement::removedFrom):

html/HTMLMediaElement.h:

After the media element gets removed from the document, schedule a 0 timer before
pausing the media element, to give the task that removed us a chance to finish.
When the timer fires, we check if we were added back into an active document and
avoid pausing in such case.

LayoutTests:

media/remove-from-document-expected.txt:
media/remove-from-document.html:

Check asynchronously if the video has been paused after removing it from
the document instead of synchronously as we no longer pause the video
synchronously in this case.

media/replaceChild-should-not-pause-video-expected.txt: Added.
media/replaceChild-should-not-pause-video.html: Added.

Add test case to make sure that calling replaceChild() on with a video
element as newChild does not pause the video if it is already playing.
This is a regression test for <rdar://problem/25888758>.

webaudio/audiocontext-state-interrupted-expected.txt:
webaudio/audiocontext-state-interrupted.html:

Add a missing call to
internals.setMediaSessionRestrictions("WebAudio", "InterruptedPlaybackNotPermitted")
before the fourth test. The fourth test was previously passing by
chance, due to a bug in GenericEventQueue sometimes firing events
synchronously after they are scheduled.

2:21 PM Changeset in webkit [200430] by fpizlo@apple.com

41 edits
7 adds in trunk

Speed up JSGlobalObject initialization by making some properties lazy
https://bugs.webkit.org/show_bug.cgi?id=157045

Source/JavaScriptCore:

Reviewed by Keith Miller.

This makes about half of JSGlobalObject's state lazy. There are three categories of
state in JSGlobalObject:

1) C++ fields in JSGlobalObject.
2) JS object properties in JSGlobalObject's JSObject superclass.
3) JS variables in JSGlobalObject's JSSegmentedVariableObject superclass.

State held in JS variables cannot yet be made lazy. That's why this patch only goes
half-way.

State in JS object properties can be made lazy if we move it to the static property
hashtable. JSGlobalObject already had one of those. This patch makes static property
hashtables a lot more powerful, by adding three new kinds of static properties. These
new kinds allow us to make almost all of JSGlobalObject's object properties lazy.

State in C++ fields can now be made lazy thanks in part to WTF's support for stateless
lambdas. You can of course make anything lazy by hand, but there are many C++ fields in
JSGlobalObject and we are adding more all the time. We don't want to require that each
of these has a getter with an initialization check and a corresponding out-of-line slow
path that does the initialization. We want this kind of boilerplate to be handled by
some abstractions.

The primary abstraction introduced in this patch is LazyProperty<Type>. Currently, this
only works where Type is a subclass of JSCell. Such a property holds a pointer to Type.
You can use it like you would a WriteBarrier<Type>. It even has set() and get() methods,
so it's almost a drop-in replacement.

The key to LazyProperty<Type>'s power is that you can do this:

class Bar {

...
LazyProperty<Foo> m_foo;

};
...
m_foo.initLater(

[] (const LazyProperty<Foo>::Initializer<Bar>& init) {

init.set(Foo::create(init.vm, init.owner));

});

This initLater() call requires that you pass a stateless lambda (see WTF changelog for
the definition). Miraculously, this initLater() call is guaranteed to compile to a store
of a pointer constant to m_foo, as in:

movabsq 0xBLAH, %rax
movq %rax, &m_foo

This magical pointer constant points to a callback that was generated by the template
instantiation of initLater(). That callback knows to call your stateless lambda, but
also does some other bookkeeping: it makes sure that you indeed initialized the property
inside the callback and it manages recursive initializations. It's totally legal to call
m_foo.get() inside the initLater() callback. If you do that before you call init.set(),
m_foo.get() will return null. This is an excellent escape hatch if we ever find
ourselves in a dependency cycle. I added this feature because I already had to create a
dependency cycle.

Note that using LazyProperties from DFG threads is super awkward. It's going to be hard
to get this right. The DFG thread cannot initialize those fields, so it has to make sure
that it does conservative things. But for some nodes this could mean adding a lot of new
logic, like NewTypedArray, which currently is written in such a way that it assumes that
we always have the typed array structure. Currently we take a two-fold approach: for
typed arrays we don't handle the NewTypedArray intrinsic if the structure isn't
initialized, and for everything else we don't make the properties lazy if the DFG needs
them. As we optimize this further we might need to teach the DFG to handle more lazy
properties. I tried to do this for RegExp but found it to be very confusing. With typed
arrays I got lucky.

There is also a somewhat more powerful construct called LazyClassStructure. We often
need to keep around the structure of some standard JS class, like Date. We also need to
make sure that the constructor ends up in the global object's property table. And we
often need to keep the original value of the constructor for ourselves. In this case, we
want to make sure that the creation of the structure-prototype-constructor constellation
is atomic. We don't want code to start looking at the structure if it points to a
prototype that doesn't have its "constructor" property set yet, for example.
LazyClassStructure solves this by abstracting that whole initialization. You provide the
callback that allocates everything, since we are super inconsistent about the way we
initialize things, but LazyClassStructure establishes the workflow and helps you not
mess up.

Finally, the new static hashtable attributes allow for all of this to work with the JS
property table:

PropertyCallback: if you use this attribute, the second column in the table should be
the name of a function to call to initialize this property. This is useful for things
like the Math property. The Math object turns out to be very expensive to allocate.
Delaying its allocation is super easy with the PropertyCallback attribute.

CellProperty: with this attribute the second column should be a C++ field name like
JSGlobalObject::m_evalErrorConstructor. The static hashtable will grab the offset of
this property, and when it needs to be initialized, Lookup will assume you have a
LazyProperty<JSCell> and call its get() method. It will initialize the property to
whatever get() returned. Note that it's legal to cast a LazyProperty<Anything> to
LazyProperty<JSCell> for the purpose of calling get() because the get() method will just
call whatever callback function pointer is encoded in the property and it does not need
to know anything about what type that callback will instantiate.

ClassStructure: with this attribute the second column should be a C++ field name. The
static hashtable will initialize the property by treating the field as a
LazyClassStructure and it will call get(). LazyClassStructure completely owns the whole
initialization workflow, so Lookup assumes that when LazyClassStructure::get() returns,
the property in question will already be set. By convention, we have LazyClassStructure
initialize the property with a pointer to the constructor, since that's how all of our
classes work: "globalObject.Date" points to the DateConstructor.

This is a 2x speed-up in JSGlobalObject initialization time in a microbenchmark that
calls our C API. This is a 1% speed-up on SunSpider and JSRegress.

Rolling this back in after fixing the function pointer alignment issue. The last version
relied on function pointers being aligned to a 4-byte boundary. We cannot rely on this,
especially since ARMv7 uses the low bit of function pointers as a tag to indicate the
instruction set. This version adds an extra indirection, so that
LazyProperty<>::m_pointer points to a pointer that points to the function. A pointer to
a pointer is guaranteed to be at least 4-byte aligned.

API/JSCallbackFunction.cpp:

(JSC::JSCallbackFunction::create):

API/ObjCCallbackFunction.h:

(JSC::ObjCCallbackFunction::impl):

API/ObjCCallbackFunction.mm:

(JSC::ObjCCallbackFunction::ObjCCallbackFunction):
(JSC::ObjCCallbackFunction::create):

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
create_hash_table:
debugger/DebuggerScope.cpp:

(JSC::DebuggerScope::create):
(JSC::DebuggerScope::DebuggerScope):

debugger/DebuggerScope.h:

(JSC::DebuggerScope::jsScope):
(JSC::DebuggerScope::create): Deleted.

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::set):

dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::originalArrayStructure):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewTypedArray):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStructureRegistrationPhase.cpp:

(JSC::DFG::StructureRegistrationPhase::run):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):

runtime/ClonedArguments.cpp:

(JSC::ClonedArguments::getOwnPropertySlot):
(JSC::ClonedArguments::materializeSpecials):

runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncToString):

runtime/InternalFunction.cpp:

(JSC::InternalFunction::visitChildren):
(JSC::InternalFunction::name):
(JSC::InternalFunction::calculatedDisplayName):
(JSC::InternalFunction::createSubclassStructure):

runtime/InternalFunction.h:
runtime/JSBoundFunction.cpp:

(JSC::JSBoundFunction::finishCreation):
(JSC::JSBoundFunction::visitChildren):

runtime/JSBoundSlotBaseFunction.cpp:

(JSC::JSBoundSlotBaseFunction::create):

runtime/JSFunction.cpp:

(JSC::retrieveCallerFunction):
(JSC::getThrowTypeErrorGetterSetter):
(JSC::JSFunction::callerGetter):
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::defineOwnProperty):

runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayView):

runtime/JSGlobalObject.cpp:

(JSC::createProxyProperty):
(JSC::createJSONProperty):
(JSC::createMathProperty):
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::stringPrototypeChainIsSane):
(JSC::JSGlobalObject::resetPrototype):
(JSC::JSGlobalObject::visitChildren):
(JSC::JSGlobalObject::toThis):
(JSC::JSGlobalObject::getOwnPropertySlot):
(JSC::JSGlobalObject::createThrowTypeError): Deleted.
(JSC::JSGlobalObject::createThrowTypeErrorArgumentsAndCaller): Deleted.

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::objectConstructor):
(JSC::JSGlobalObject::promiseConstructor):
(JSC::JSGlobalObject::internalPromiseConstructor):
(JSC::JSGlobalObject::evalErrorConstructor):
(JSC::JSGlobalObject::rangeErrorConstructor):
(JSC::JSGlobalObject::referenceErrorConstructor):
(JSC::JSGlobalObject::syntaxErrorConstructor):
(JSC::JSGlobalObject::typeErrorConstructor):
(JSC::JSGlobalObject::URIErrorConstructor):
(JSC::JSGlobalObject::nullGetterFunction):
(JSC::JSGlobalObject::nullSetterFunction):
(JSC::JSGlobalObject::callFunction):
(JSC::JSGlobalObject::applyFunction):
(JSC::JSGlobalObject::definePropertyFunction):
(JSC::JSGlobalObject::arrayProtoValuesFunction):
(JSC::JSGlobalObject::initializePromiseFunction):
(JSC::JSGlobalObject::newPromiseCapabilityFunction):
(JSC::JSGlobalObject::functionProtoHasInstanceSymbolFunction):
(JSC::JSGlobalObject::regExpProtoExecFunction):
(JSC::JSGlobalObject::regExpProtoSymbolReplaceFunction):
(JSC::JSGlobalObject::regExpProtoGlobalGetter):
(JSC::JSGlobalObject::regExpProtoUnicodeGetter):
(JSC::JSGlobalObject::throwTypeErrorGetterSetter):
(JSC::JSGlobalObject::throwTypeErrorArgumentsAndCallerGetterSetter):
(JSC::JSGlobalObject::moduleLoader):
(JSC::JSGlobalObject::objectPrototype):
(JSC::JSGlobalObject::functionPrototype):
(JSC::JSGlobalObject::arrayPrototype):
(JSC::JSGlobalObject::booleanPrototype):
(JSC::JSGlobalObject::stringPrototype):
(JSC::JSGlobalObject::symbolPrototype):
(JSC::JSGlobalObject::numberPrototype):
(JSC::JSGlobalObject::datePrototype):
(JSC::JSGlobalObject::regExpPrototype):
(JSC::JSGlobalObject::errorPrototype):
(JSC::JSGlobalObject::iteratorPrototype):
(JSC::JSGlobalObject::generatorFunctionPrototype):
(JSC::JSGlobalObject::generatorPrototype):
(JSC::JSGlobalObject::debuggerScopeStructure):
(JSC::JSGlobalObject::withScopeStructure):
(JSC::JSGlobalObject::strictEvalActivationStructure):
(JSC::JSGlobalObject::activationStructure):
(JSC::JSGlobalObject::moduleEnvironmentStructure):
(JSC::JSGlobalObject::directArgumentsStructure):
(JSC::JSGlobalObject::scopedArgumentsStructure):
(JSC::JSGlobalObject::clonedArgumentsStructure):
(JSC::JSGlobalObject::isOriginalArrayStructure):
(JSC::JSGlobalObject::booleanObjectStructure):
(JSC::JSGlobalObject::callbackConstructorStructure):
(JSC::JSGlobalObject::callbackFunctionStructure):
(JSC::JSGlobalObject::callbackObjectStructure):
(JSC::JSGlobalObject::propertyNameIteratorStructure):
(JSC::JSGlobalObject::objcCallbackFunctionStructure):
(JSC::JSGlobalObject::objcWrapperObjectStructure):
(JSC::JSGlobalObject::dateStructure):
(JSC::JSGlobalObject::nullPrototypeObjectStructure):
(JSC::JSGlobalObject::errorStructure):
(JSC::JSGlobalObject::calleeStructure):
(JSC::JSGlobalObject::functionStructure):
(JSC::JSGlobalObject::boundFunctionStructure):
(JSC::JSGlobalObject::boundSlotBaseFunctionStructure):
(JSC::JSGlobalObject::getterSetterStructure):
(JSC::JSGlobalObject::nativeStdFunctionStructure):
(JSC::JSGlobalObject::namedFunctionStructure):
(JSC::JSGlobalObject::functionNameOffset):
(JSC::JSGlobalObject::numberObjectStructure):
(JSC::JSGlobalObject::privateNameStructure):
(JSC::JSGlobalObject::mapStructure):
(JSC::JSGlobalObject::regExpStructure):
(JSC::JSGlobalObject::generatorFunctionStructure):
(JSC::JSGlobalObject::setStructure):
(JSC::JSGlobalObject::stringObjectStructure):
(JSC::JSGlobalObject::symbolObjectStructure):
(JSC::JSGlobalObject::iteratorResultObjectStructure):
(JSC::JSGlobalObject::lazyTypedArrayStructure):
(JSC::JSGlobalObject::typedArrayStructure):
(JSC::JSGlobalObject::typedArrayStructureConcurrently):
(JSC::JSGlobalObject::isOriginalTypedArrayStructure):
(JSC::JSGlobalObject::typedArrayConstructor):
(JSC::JSGlobalObject::actualPointerFor):
(JSC::JSGlobalObject::internalFunctionStructure): Deleted.

runtime/JSNativeStdFunction.cpp:

(JSC::JSNativeStdFunction::create):

runtime/JSWithScope.cpp:

(JSC::JSWithScope::create):
(JSC::JSWithScope::visitChildren):
(JSC::JSWithScope::createStructure):
(JSC::JSWithScope::JSWithScope):

runtime/JSWithScope.h:

(JSC::JSWithScope::object):
(JSC::JSWithScope::create): Deleted.
(JSC::JSWithScope::createStructure): Deleted.
(JSC::JSWithScope::JSWithScope): Deleted.

runtime/LazyClassStructure.cpp: Added.

(JSC::LazyClassStructure::Initializer::Initializer):
(JSC::LazyClassStructure::Initializer::setPrototype):
(JSC::LazyClassStructure::Initializer::setStructure):
(JSC::LazyClassStructure::Initializer::setConstructor):
(JSC::LazyClassStructure::visit):
(JSC::LazyClassStructure::dump):

runtime/LazyClassStructure.h: Added.

(JSC::LazyClassStructure::LazyClassStructure):
(JSC::LazyClassStructure::get):
(JSC::LazyClassStructure::prototype):
(JSC::LazyClassStructure::constructor):
(JSC::LazyClassStructure::getConcurrently):
(JSC::LazyClassStructure::prototypeConcurrently):
(JSC::LazyClassStructure::constructorConcurrently):

runtime/LazyClassStructureInlines.h: Added.

(JSC::LazyClassStructure::initLater):

runtime/LazyProperty.h: Added.

(JSC::LazyProperty::Initializer::Initializer):
(JSC::LazyProperty::LazyProperty):
(JSC::LazyProperty::get):
(JSC::LazyProperty::getConcurrently):

runtime/LazyPropertyInlines.h: Added.

(JSC::ElementType>::Initializer::set):
(JSC::ElementType>::initLater):
(JSC::ElementType>::setMayBeNull):
(JSC::ElementType>::set):
(JSC::ElementType>::visit):
(JSC::ElementType>::dump):
(JSC::ElementType>::callFunc):

runtime/Lookup.cpp:

(JSC::setUpStaticFunctionSlot):

runtime/Lookup.h:

(JSC::HashTableValue::function):
(JSC::HashTableValue::functionLength):
(JSC::HashTableValue::propertyGetter):
(JSC::HashTableValue::propertyPutter):
(JSC::HashTableValue::accessorGetter):
(JSC::HashTableValue::accessorSetter):
(JSC::HashTableValue::constantInteger):
(JSC::HashTableValue::lexerValue):
(JSC::HashTableValue::lazyCellPropertyOffset):
(JSC::HashTableValue::lazyClassStructureOffset):
(JSC::HashTableValue::lazyPropertyCallback):
(JSC::getStaticPropertySlot):
(JSC::getStaticValueSlot):
(JSC::putEntry):
(JSC::reifyStaticProperty):

runtime/PropertySlot.h:
runtime/TypedArrayType.h:

Source/WebCore:

Reviewed by Keith Miller.

No new tests because no change in behavior.

This adapts JSHTMLElementCustom.cpp to the new JSWithScope API. Note that this revealed
that this was using a curious choice of global object, which may not be right. I decided
to do a very literal refactoring that exactly preserves what this code got before, but I
added a FIXME to reconsider this later.

bindings/js/JSHTMLElementCustom.cpp:

(WebCore::JSHTMLElement::pushEventHandlerScope):

Source/WTF:

Reviewed by Keith Miller.

This WTF change is at the heart of a large JSC change. In JSC I found myself wanting to
do this a lot:

static void callback(Foo& foo) { ... }

foo.setCallback(callback);

But that's not very nice to write if many different setCallback() calls are inside of the
same very large function: you'll have to have a lot of static function definitions in
one part of the file, and then a bunch of setCallback() calls in another part. It's hard
to reason about what's going on with such code.

So what if you wrote this instead:

foo.setCallback([] (Foo& foo) { ... });

Much nicer! There is a standard way to do this: lambdas that are stateless are
convertible to function pointers. This change also offers another approach that is a bit
more general.

These additions to WTF help you do it:

isStatelessLambda<Func>(): tells you if Func is a stateless lambda. This uses is_empty to
test if the lambda is stateless. This turns out to be a stronger property than
convertibility to function pointers. For example, a function pointer is convertible to a
function pointer, but it is definitely stateful: you cannot successfully call it if you
only has its type. On the other hand, a stateless lambda is really stateless in the sense
that you only need its type to call it.

callStatelessLambda<ResultType, Func>(Arguments&&...): calls the given stateless lambda.

JSC uses these to build up some sophisticated lazy-initialization APIs. The use of
statelessness allows JSC to combine a lambda with other logic into a single function
pointer.

wtf/StdLibExtras.h:

(WTF::isStatelessLambda):
(WTF::callStatelessLambda):

LayoutTests:

Reviewed by Mark Lam.

js/dom/cross-window-put-math-expected.txt: Added.
js/dom/cross-window-put-math.html: Added.

2:05 PM Changeset in webkit [200429] by commit-queue@webkit.org

12 edits in trunk

Improve the grammar of some error messages 'a argument list' => 'an argument list'
https://bugs.webkit.org/show_bug.cgi?id=157350
<rdar://problem/26082108>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-04
Reviewed by Mark Lam.

LayoutTests/imported/w3c:

web-platform-tests/html/dom/interfaces-expected.txt:

Source/JavaScriptCore:

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseIfStatement):
(JSC::Parser<LexerType>::parseImportDeclaration):
(JSC::Parser<LexerType>::parseExportDeclaration):
(JSC::Parser<LexerType>::parseObjectLiteral):
(JSC::Parser<LexerType>::parseStrictObjectLiteral):
(JSC::Parser<LexerType>::parseArguments):
Use the alternate error message formatter macro which outputs 'an'
instead of 'a' preceding the last argument.

LayoutTests:

fast/css/css-selector-text-expected.txt:
inspector/runtime/parse-expected.txt:
js/object-literal-computed-methods-expected.txt:
js/object-literal-methods-expected.txt:
sputnik/Conformance/07_Lexical_Conventions/7.5_Tokens/7.5.2_Keywords/S7.5.2_A1.12-expected.txt:
sputnik/Conformance/12_Statement/12.5_The_if_Statement/S12.5_A6_T1-expected.txt:
sputnik/Conformance/12_Statement/12.5_The_if_Statement/S12.5_A6_T2-expected.txt:

1:49 PM Changeset in webkit [200428] by keith_miller@apple.com

8 edits
1 add in trunk

Corrections to r200422
https://bugs.webkit.org/show_bug.cgi?id=157351

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

Fix some typos in various files. Also, make separate error messages
for the this value being undefined vs null in the ArrayIteratorprototype
next function and add test.

Scripts/builtins/builtins_model.py:
builtins/ArrayIteratorPrototype.js:

(next):
(arrayIteratorValueNext):
(arrayIteratorKeyNext):
(arrayIteratorKeyValueNext):

builtins/ArrayPrototype.js:

(keys):
(entries):

builtins/TypedArrayPrototype.js:
runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init): Deleted.

tests/stress/array-iterators-next-error-messages.js: Added.

(assert):
(catch):

LayoutTests:

Test case had some code changed that was not intended.

js/regress/script-tests/deltablue-for-of.js:

(deltaBlue):

1:32 PM Changeset in webkit [200427] by Manuel Rego Casasnovas

2 edits in trunk/Source/WebCore

[css-grid] Refactor information stored related to column positions
https://bugs.webkit.org/show_bug.cgi?id=157342

Reviewed by Darin Adler.

In m_columnPositions we were storing position of each column
including the alignment offset, always from the logical left,
and the border and padding, depending on the direction.

This was really confusing as in the case of RTL direction
we were adding the offset from the left and
the right border and padding.

This patches changes it to store always the info from the left,
so even in RTL direction we use the left border and padding.

This allows us to simplify translateRTLCoordinate() as
it doesn't need to care about border and padding anymore.
And also to refactor offsetAndBreadthForPositionedChild()
which became really complex after adding RTL support.

No new tests, no change of behavior.

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
(WebCore::RenderGrid::populateGridPositions):
(WebCore::RenderGrid::translateRTLCoordinate):

1:15 PM Changeset in webkit [200426] by keith_miller@apple.com

40 edits
5 adds in trunk

Unreviewed, reland r200149 since the rollout had inconclusive PLT AB testing results.

1:00 PM Changeset in webkit [200425] by commit-queue@webkit.org

6 edits in trunk

Web Inspector: GC Root Path sometimes does not go up to Window
https://bugs.webkit.org/show_bug.cgi?id=156768
<rdar://problem/25816131>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-04
Reviewed by Geoffrey Garen.

Source/WebInspectorUI:

UserInterface/Proxies/HeapSnapshotNodeProxy.js:

(WebInspector.HeapSnapshotNodeProxy.prototype.retainers):
Include paths for debugging.

UserInterface/Workers/HeapSnapshot/HeapSnapshot.js:

(HeapSnapshot.prototype.shortestGCRootPath):
(HeapSnapshot.prototype._isNodeGlobalObject):
Prefer the shortest GC Root Path that contains a known
global object, otherwise fallback to the shortest.

(HeapSnapshot.prototype.retainers):
Include paths for debugging.

LayoutTests:

inspector/unit-tests/heap-snapshot-expected.txt:
inspector/unit-tests/heap-snapshot.html:

12:51 PM Changeset in webkit [200424] by Ryan Haddad

2 edits in trunk/LayoutTests

Rebaseline inspector/model/remote-object.html after r200422

Unreviewed test gardening.

platform/mac/inspector/model/remote-object-expected.txt:

12:23 PM Changeset in webkit [200423] by mark.lam@apple.com

13 edits
3 adds in trunk

ES6 Function.name inferred from property names of literal objects can break some websites.
https://bugs.webkit.org/show_bug.cgi?id=157246

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Specifically, the library mathjs (see http://mathjs.org and https://github.com/josdejong/mathjs)
uses an idiom where it created literal objects with property names that look like
this: 'number | BigNumber | Unit'. Later, this name is used in a string to create
function source code that gets eval'ed. Since 'number | BigNumber | Unit' is not
a valid function name, we get a syntax error.

Here are the details:

mathjs uses object literals with the funky property names for its function members. For example,

helper function to type check the middle value of the array
var middle = typed({

'number | BigNumber | Unit': function (value) {

return value;

}

});

mathjs' getName() uses Function.name to get the name of functions (hence, picks up the property name as inferred value of Function.name as specified by ES6):

/

Retrieve the function name from a set of functions, and check
whether the name of all functions match (if given) ... */

function getName (fns) {

var name = ;

for (var i = 0; i < fns.length; i++) {

var fn = fns[i];
...

name = fn.name;

...

return name;

}

mathjs uses that name to assembler new function source code that gets eval'ed:

/

Compose a function from sub-functions each handling a single type signature. ... */

function _typed(name, signatures) {

...
generate code for the typed function
var code = [];

var _name = name

;

...
code.push('function ' + _name + '(' + _args.join(', ') + ') {');
code.push(' "use strict";');
code.push(' var name = \ + _name + '\';');
code.push(node.toCode(refs, ' '));
code.push('}');

generate body for the factory function
var body = [

refs.toCode(),
'return ' + code.join('\n')

].join('\n');

evaluate the JavaScript code and attach function references
var factory = (new Function(refs.name, 'createError', body)); <== Syntax Error here!
var fn = factory(refs, createError);
...
return fn;

}

Until mathjs (and any other frameworks that does similar things) and sites that
uses mathjs has been updated to work with ES6, we'll need a compatibility hack to
work around it.

Here's what we'll do:

Introduce a needsSiteSpecificQuirks flag in JSGlobalObject.
Have WebCore's JSDOMWindowBase set that flag if the browser's needsSiteSpecificQuirks is enabled in its settings.
If needsSiteSpecificQuirks is enabled, have JSFunction::reifyName() check for ' ' or '|' in the name string it will use to reify the Function.name property. If those characters exists in the name, we'll replace the name string with a null string.

runtime/JSFunction.cpp:

(JSC::JSFunction::reifyName):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::needsSiteSpecificQuirks):
(JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
(JSC::JSGlobalObject::setNeedsSiteSpecificQuirks):

Source/WebCore:

Test: js/dom/regress-157246.html

bindings/js/JSDOMWindowBase.cpp:

(WebCore::JSDOMWindowBase::finishCreation):

Set the needsSiteSpecificQuirks flag in the JSGlobalObject if needed.

Tools:

WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues):
(WTR::updateTestOptionsFromTestHeader):

WebKitTestRunner/TestOptions.h:

WebKitTestRunner/ios/PlatformWebViewIOS.mm:

(WTR::PlatformWebView::viewSupportsOptions):

WebKitTestRunner/mac/PlatformWebViewMac.mm:

(WTR::PlatformWebView::viewSupportsOptions):

Add needsSiteSpecificQuirks to WKTR options that can be set.

LayoutTests:

js/dom/regress-157246-expected.txt: Added.
js/dom/regress-157246.html: Added.
js/dom/script-tests/regress-157246.js: Added.

platform/ios-simulator-wk1/TestExpectations:
platform/mac-wk1/TestExpectations:
Skip js/dom/regress-157246.html for wk1 because it relies on a WKTR feature to enable the needsSiteSpecificQuirks settings before running the test.

10:59 AM Changeset in webkit [200422] by keith_miller@apple.com

19 edits
3 adds in trunk

Speedup array iterators
https://bugs.webkit.org/show_bug.cgi?id=157315

Reviewed by Michael Saboff.

Source/JavaScriptCore:

This patch improves the performance of Array iterators in ES6. There are two main changes
that make things faster. The first is that the value, keys and entries functions have been
moved to JS. This enables us to inline the construction of the iterator. Thus, when we get
to the FTL we are able to sink the allocation of the iterator object. This significantly
improves the performance of any for-of loop since we are now able to have both the iteration
counter and the iterated object in local variables rather than in the heap.

Secondly, instead of using a number to store the iteratation kind we now use a virtual
method on the iteration object to indicate which next function to use. This ends up being
helpful because it means we can eliminate the branches in the old next function that decide
what value to return. With those branches gone the various next functions are now small
enough to inline. Once the next functions are inlined then the FTL is able to sink the
allocation of next() result object. There is still room for optimization in the loop since
we currently don't recognize that the array access in the next function is in bounds or that
the increment to the loop counter cannot overflow.

The overall performance changes appear to be a ~4-6x speedup in a simple microbenchmark that
computes the sum of an array with some extra arithmetic. The variance depends on the exact
body of the loop. Additionally, on a new regress test that changes all the loops in
deltablue into for-of loops this patch is a 1.8x progression. Overall, it still looks like
for-of loops are significantly slower than an indexed for loop. In the first test it's ~2-4x
slower with the difference depending on the body of the loop. If the loop is just the sum
then we see a much larger regression than if the loop does even simple arithmetic. It looks
like the indexed for loop without extra arithmetic is small enough to fit into the x86
replay buffer on my machine, which would explain why there is such a big difference between
the for of loop in that case. On the deltablue benchmark it's 1.4x slower. It's clear from
these numbers that there is still a lot of work we can do to make for of loops faster.

This patch also makes some changes to the way that we decorate our builtin js
functions. Instead of the old syntax (putting the decorated values in [] before the function
declaration i.e. [intrinsic=foo]) this patch changes the syntax to be closer to the way that
decorators are proposed in a future ECMAScript proposal (using @ followed by the entry on a
new line before the function declaration i.e. @intrinsic=foo).

Finally, in the builtin scripts regular expressions re.S has been changed to re.DOTALL since
DOTALL is easier to understand without going to the reference page for python regular
expressions.

Scripts/builtins/builtins_model.py:
builtins/ArrayIteratorPrototype.js:

(next):
(arrayIteratorValueNext):
(arrayIteratorKeyNext):
(arrayIteratorKeyValueNext):

builtins/ArrayPrototype.js:

(createArrayIterator):
(values):
(keys):
(entries):

builtins/RegExpPrototype.js:

(intrinsic.RegExpTestIntrinsic.test):

builtins/StringPrototype.js:

(intrinsic.StringPrototypeReplaceIntrinsic.replace):

builtins/TypedArrayPrototype.js:

(values):
(keys):
(entries):

inspector/JSInjectedScriptHost.cpp:

(Inspector::cloneArrayIteratorObject):
(Inspector::JSInjectedScriptHost::iteratorEntries):

jit/ThunkGenerators.cpp:
runtime/ArrayPrototype.cpp:

(JSC::ArrayPrototype::finishCreation):
(JSC::arrayProtoFuncValues): Deleted.
(JSC::arrayProtoFuncEntries): Deleted.
(JSC::arrayProtoFuncKeys): Deleted.

runtime/CommonIdentifiers.h:
runtime/JSArrayIterator.cpp:

(JSC::JSArrayIterator::clone): Deleted.

runtime/JSGenericTypedArrayViewPrototypeFunctions.h:

(JSC::genericTypedArrayViewProtoFuncEntries): Deleted.
(JSC::genericTypedArrayViewProtoFuncKeys): Deleted.
(JSC::typedArrayViewProtoFuncValues): Deleted.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

runtime/JSGlobalObject.h:
runtime/JSTypedArrayViewPrototype.cpp:

(JSC::JSTypedArrayViewPrototype::finishCreation):
(JSC::typedArrayViewProtoFuncEntries): Deleted.
(JSC::typedArrayViewProtoFuncKeys): Deleted.
(JSC::typedArrayViewProtoFuncValues): Deleted.

runtime/MapPrototype.cpp:

(JSC::MapPrototype::finishCreation):

runtime/SetPrototype.cpp:

(JSC::SetPrototype::finishCreation):

LayoutTests:

Add a new regression test for for-of iterators in ES6. The test is a
modification of the deltablue benchmark that converts all the
loops on Arrays into for-of loops.

js/regress/deltablue-for-of-expected.txt: Added.
js/regress/deltablue-for-of.html: Added.
js/regress/script-tests/deltablue-for-of.js: Added.

(Object.prototype.inheritsFrom):
(OrderedCollection):
(OrderedCollection.prototype.add):
(OrderedCollection.prototype.at):
(OrderedCollection.prototype.size):
(OrderedCollection.prototype.removeFirst):
(OrderedCollection.prototype.remove):
(Strength):
(Strength.stronger):
(Strength.weaker):
(Strength.weakestOf):
(Strength.strongest):
(Strength.prototype.nextWeaker):
(Constraint):
(Constraint.prototype.addConstraint):
(Constraint.prototype.satisfy):
(Constraint.prototype.destroyConstraint):
(Constraint.prototype.isInput):
(UnaryConstraint):
(UnaryConstraint.prototype.addToGraph):
(UnaryConstraint.prototype.chooseMethod):
(UnaryConstraint.prototype.isSatisfied):
(UnaryConstraint.prototype.markInputs):
(UnaryConstraint.prototype.output):
(UnaryConstraint.prototype.recalculate):
(UnaryConstraint.prototype.markUnsatisfied):
(UnaryConstraint.prototype.inputsKnown):
(UnaryConstraint.prototype.removeFromGraph):
(StayConstraint):
(StayConstraint.prototype.execute):
(EditConstraint.prototype.isInput):
(EditConstraint.prototype.execute):
(BinaryConstraint):
(BinaryConstraint.prototype.chooseMethod):
(BinaryConstraint.prototype.addToGraph):
(BinaryConstraint.prototype.isSatisfied):
(BinaryConstraint.prototype.markInputs):
(BinaryConstraint.prototype.input):
(BinaryConstraint.prototype.output):
(BinaryConstraint.prototype.recalculate):
(BinaryConstraint.prototype.markUnsatisfied):
(BinaryConstraint.prototype.inputsKnown):
(BinaryConstraint.prototype.removeFromGraph):
(ScaleConstraint):
(ScaleConstraint.prototype.addToGraph):
(ScaleConstraint.prototype.removeFromGraph):
(ScaleConstraint.prototype.markInputs):
(ScaleConstraint.prototype.execute):
(ScaleConstraint.prototype.recalculate):
(EqualityConstraint):
(EqualityConstraint.prototype.execute):
(Variable):
(Variable.prototype.addConstraint):
(Variable.prototype.removeConstraint):
(Planner):
(Planner.prototype.incrementalAdd):
(Planner.prototype.incrementalRemove):
(Planner.prototype.newMark):
(Planner.prototype.makePlan):
(Planner.prototype.extractPlanFromConstraints):
(Planner.prototype.addPropagate):
(Planner.prototype.removePropagateFrom):
(Planner.prototype.addConstraintsConsumingTo):
(Plan):
(Plan.prototype.addConstraint):
(Plan.prototype.size):
(Plan.prototype.constraintAt):
(Plan.prototype.execute):
(chainTest):
(projectionTest):
(change):
(deltaBlue):

10:40 AM Changeset in webkit [200421] by Yusuke Suzuki

5 edits
1 add in trunk/Source/JavaScriptCore

[JSC] Object constructor need to be aware of new.target
https://bugs.webkit.org/show_bug.cgi?id=157196

Reviewed by Darin Adler.

Object constructor should be aware of new.target.
When the new.target is specified, we should store it.prototype to the newly created
object's Prototype.

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):
Take the design that caches the structure used for empty object.
This structure is also used in constructEmptyObject frequently.

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::objectStructureForObjectConstructor):

runtime/ObjectConstructor.cpp:

(JSC::constructObject):
(JSC::constructWithObjectConstructor):
(JSC::callObjectConstructor):

runtime/ObjectConstructor.h:

(JSC::constructEmptyObject):
Construct the object by using the plain structure that is also used in the ObjectConstructor.

tests/stress/object-constructor-should-be-new-target-aware.js: Added.

(shouldBe):
(Hello):

10:20 AM Changeset in webkit [200420] by peavo@outlook.com

2 edits in trunk/Source/WTF

[Win] Use NeverDestroyed template.
https://bugs.webkit.org/show_bug.cgi?id=157345

Reviewed by Darin Adler.

wtf/ThreadingWin.cpp:

(WTF::threadMapMutex):
(WTF::threadMap):

9:35 AM Changeset in webkit [200419] by Ryan Haddad

2 edits in trunk/LayoutTests

Marking imported/w3c/web-platform-tests/html/dom/interfaces.html as failing on ios-simulator release builds
https://bugs.webkit.org/show_bug.cgi?id=157344

Unreviewed test gardening.

platform/ios-simulator/TestExpectations:

9:21 AM Changeset in webkit [200418] by Ryan Haddad

2 edits in trunk/LayoutTests

Remove failure expectation for imported/w3c/web-platform-tests/html/dom/interfaces.html on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=157344

Unreviewed test gardening.

This failure expectation was overriding the global skip on debug builds.

platform/ios-simulator/TestExpectations:

9:20 AM Changeset in webkit [200417] by Konstantin Tokarev

5 edits in trunk/Source/WebCore

Deduplicated initializer lists of BitmapImage constructors.
https://bugs.webkit.org/show_bug.cgi?id=157249

Reviewed by Darin Adler.

No new tests needed.

platform/graphics/BitmapImage.cpp:

(WebCore::BitmapImage::BitmapImage): Added new private constructor of
BitmapImage for delegation purpose only.

platform/graphics/BitmapImage.h: Use inline initialization for some

BitmapImage fields.

platform/graphics/cairo/BitmapImageCairo.cpp:

(WebCore::BitmapImage::BitmapImage): Delegate field initialization to
new private constructor.

platform/graphics/cg/BitmapImageCG.cpp:

(WebCore::BitmapImage::BitmapImage): Ditto.

8:48 AM Changeset in webkit [200416] by Chris Dumez

41 edits
7 deletes in trunk

Unreviewed, rolling out r200383 and r200406.

Seems to have caused crashes on iOS / ARMv7s

Reverted changesets:

"Speed up JSGlobalObject initialization by making some
properties lazy"
https://bugs.webkit.org/show_bug.cgi?id=157045
http://trac.webkit.org/changeset/200383

"REGRESSION(r200383): Setting lazily initialized properties
across frame boundaries crashes"
https://bugs.webkit.org/show_bug.cgi?id=157333
http://trac.webkit.org/changeset/200406

5:54 AM Changeset in webkit [200415] by jdiggs@igalia.com

30 edits in trunk

AX: ARIA 'region' role is now a landmark; HTML 'section' element should be a landmark only if named
https://bugs.webkit.org/show_bug.cgi?id=157331

Reviewed by Chris Fleizach.

Source/WebCore:

The 'region' role is now mapped as a landmark: The WebCore DocumentRegionRole
AccessibilityRole has been renamed to LandmarkRegionRole. The AXDocumentRegion
subrole has been renamed to AXLandmarkRegion. A 'section' element is mapped to
the LandmarkRegionRole if it has an author-provided accessible name via either
the aria-label or aria-labelledby attribute. Otherwise, it is mapped as GroupRole
with no subrole.

Our existing test coverage for exposure of the 'region' role and the 'section'
element is sufficient. These tests were updated to reflect the new behavior.
Several new test cases were added to cover both sections with accessible names
and those without.

accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::accessibleNameDerivesFromContent):
(WebCore::AccessibilityObject::isLandmark):
(WebCore::initializeRoleMap):

accessibility/AccessibilityObject.h:
accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored):
(WebCore::AccessibilityRenderObject::determineAccessibilityRole):

accessibility/atk/WebKitAccessibleWrapperAtk.cpp:

(atkRole):

accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:

(-[WebAccessibilityObjectWrapper _accessibilityIsLandmarkRole:]):
(-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):

accessibility/mac/WebAccessibilityObjectWrapperBase.mm:

(-[WebAccessibilityObjectWrapperBase ariaLandmarkRoleDescription]):

accessibility/mac/WebAccessibilityObjectWrapperMac.mm:

(createAccessibilityRoleMap):
(-[WebAccessibilityObjectWrapper subrole]):

platform/LocalizedStrings.cpp:

(WebCore::AXARIAContentGroupText):

Source/WebKit/win:

As part of this change, the WebCore DocumentRegionRole AccessibilityRole has
been renamed to LandmarkRegionRole. Update MSAARole() to use the new name.

AccessibleBase.cpp:

(MSAARole):

Tools:

Add AXLandmarkRegion to the landmark strings handled by roleToString
for objects with ATK_ROLE_LANDMARK.

WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:

LayoutTests:

accessibility/gtk/xml-roles-exposed-expected.txt: Updated.
accessibility/mac/aria-grouping-roles-expected.txt: Updated.
accessibility/mac/aria-grouping-roles.html: Updated.
accessibility/mac/html-section-elements-expected.txt: Updated.
accessibility/mac/html-section-elements.html: Updated.
accessibility/mac/landmark-not-ignored-expected.txt: Updated.
accessibility/mac/landmark-not-ignored.html: Updated.
accessibility/roles-computedRoleString-expected.txt: Updated.
accessibility/roles-computedRoleString.html: New test cases added.
accessibility/roles-exposed.html: New test cases added.
platform/efl/accessibility/roles-exposed-expected.txt: Updated.
platform/gtk/accessibility/roles-computedRoleString-expected.txt: Updated.
platform/gtk/accessibility/roles-exposed-expected.txt: Updated.
platform/mac-mavericks/accessibility/roles-exposed-expected.txt: Updated.
platform/mac/accessibility/roles-exposed-expected.txt: Updated.
platform/win/accessibility/roles-exposed-expected.txt: Updated.

5:51 AM Changeset in webkit [200414] by youenn.fablet@crf.canon.fr

6 edits
2 adds in trunk

Clicks inside button elements are sometimes discarded when the mouse moves
https://bugs.webkit.org/show_bug.cgi?id=39620

Reviewed by Darin Adler.

Source/WebCore:

Test: fast/events/click-over-descendant-elements.html

dom/Node.cpp:

(WebCore::ancestor):
(WebCore::commonAncestor): Method inspired from
http://src.chromium.org/viewvc/blink?view=revision&revision=162081.
(WebCore::commonAncestorCrossingShadowBoundary): Helper routine
that handles the case of nodes into a shadow node.

dom/Node.h:
page/EventHandler.cpp:

(WebCore::EventHandler::handleMouseReleaseEvent): Selecting click event
target node according commonAncestorOverShadowBoundary method.
(WebCore::EventHandler::targetNodeForClickEvent): Deleted.

LayoutTests:

Test coming from http://src.chromium.org/viewvc/blink?view=revision&revision=162081.
Modified to ensure click events do not end up being considered as double click events.

fast/events/click-over-descendant-elements-expected.txt: Added.
fast/events/click-over-descendant-elements.html: Added.
platform/ios-simulator/TestExpectations: Marked new test as failing.

3:26 AM Changeset in webkit [200413] by zandobersek@gmail.com

2 edits in trunk/Source/WebCore

Unreviewed, fixing crashing GTK+ tests after r200407.

platform/graphics/texmap/TextureMapperGL.cpp:

(WebCore::TextureMapperGLData::SharedGLData::~SharedGLData):
Don't use RELEASE_ASSERT. Also fix the actual assertion,
checking that any of the values in the map matches the object
that's being destroyed, instead of checking the keys.

1:39 AM Changeset in webkit [200412] by Gyuyoung Kim

8 edits in trunk/Source

Add WKPreference for SelectionPaintingWithoutSelectionGaps
https://bugs.webkit.org/show_bug.cgi?id=156900

Reviewed by Michael Catanzaro.

Unlike other browsers WebKit has been drawing selection gaps
between render blocks during the text selection. This often
cause text selection screen looks messy.

This patch adds a setting method to disable the functionality,
and EFL port disables it by default.

Source/WebCore:

page/Settings.in:
rendering/RenderBlock.cpp:

(WebCore::RenderBlock::shouldPaintSelectionGaps):

Source/WebKit2:

Shared/WebPreferencesDefinitions.h:
UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetSelectionPaintingWithoutSelectionGapsEnabled):
(WKPreferencesGetSelectionPaintingWithoutSelectionGapsEnabled):

UIProcess/API/C/WKPreferencesRefPrivate.h:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

1:22 AM Changeset in webkit [200411] by youenn.fablet@crf.canon.fr

4 edits
1 move in trunk/Source/WebCore

Rename JSKeyValueIterator as JSDOMIterator
https://bugs.webkit.org/show_bug.cgi?id=157308

Reviewed by Darin Adler.

No change of behavior.

bindings/js/JSDOMIterator.h: Renamed from Source/WebCore/bindings/js/JSKeyValueIterator.h.

(WebCore::JSDOMIteratorPrototype::create):
(WebCore::JSDOMIteratorPrototype::createStructure):
(WebCore::JSDOMIteratorPrototype::JSDOMIteratorPrototype):
(WebCore::createKeyValueIterator):
(WebCore::keyValueIteratorForEach):
(WebCore::JSDOMIterator<JSWrapper>::destroy):
(WebCore::JSDOMIterator<JSWrapper>::next):
(WebCore::JSDOMIteratorPrototype<JSWrapper>::next):
(WebCore::JSDOMIteratorPrototype<JSWrapper>::finishCreation):

bindings/js/JSFontFaceSetCustom.cpp:
bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementationIterableFunctions):

bindings/scripts/test/JS/JSTestObj.cpp:

12:44 AM Changeset in webkit [200410] by jiewen_tan@apple.com

2 edits in trunk/Source/WebCore

CrashTracer: [USER] com.apple.WebKit.WebContent at …ple.WebCore: WebCore::EditCommandComposition::unapply + 105
https://bugs.webkit.org/show_bug.cgi?id=157282
<rdar://problem/25391441>

Reviewed by Darin Adler.

A frame could be destroyed in the middle of executing undo/redo command.
Therefore, add an early return.

editing/CompositeEditCommand.cpp:

(WebCore::EditCommandComposition::unapply):
(WebCore::EditCommandComposition::reapply):

12:43 AM Changeset in webkit [200409] by Yusuke Suzuki

3 edits
2 adds in trunk/Source/JavaScriptCore

Assertion failure for super() call in direct eval in method function
https://bugs.webkit.org/show_bug.cgi?id=157091

Reviewed by Darin Adler.

While we ensure that direct super is under the correct context,
we don't check it for the eval code. This patch moves the check from the end of parsing the function
to the places where we found the direct super or the super bindings. This covers the direct eval that
contains the direct super calls.

parser/Parser.cpp:

(JSC::Parser<LexerType>::parseGeneratorFunctionSourceElements):
(JSC::Parser<LexerType>::parseFunctionInfo):
(JSC::Parser<LexerType>::parseMemberExpression):

parser/Parser.h:

(JSC::Scope::hasDirectSuper):
(JSC::Scope::setHasDirectSuper):
(JSC::Scope::needsSuperBinding):
(JSC::Scope::setNeedsSuperBinding):
(JSC::Parser::closestParentOrdinaryFunctionNonLexicalScope):

tests/stress/eval-and-super.js: Added.

(shouldBe):
(shouldThrow):
(prototype.m):
(prototype.n):

tests/stress/generator-and-super.js: Added.

(testSyntaxError):
(testSyntaxError.Base.prototype.hello):
(testSyntaxError.Base.prototype.ok):
(testSyntaxError.Base):
(Hello.prototype.gen):
(Hello):
(testSyntaxError.hello):

12:39 AM Changeset in webkit [200408] by zandobersek@gmail.com

8 edits in trunk/Source

[CoordGraphics] CompositingCoordinator should hande root compositing and view overlay layers separately
https://bugs.webkit.org/show_bug.cgi?id=157305

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Split out handling of the root compositing and the view overlay layers
into two separate methods. Both do nothing if the passed-in layer is
the same as the current one. Otherwise, the current one is removed
from the tree and the new one added to it.

No change in behavior is expected.

platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:

(WebCore::CompositingCoordinator::setRootCompositingLayer):
(WebCore::CompositingCoordinator::setViewOverlayRootLayer):

platform/graphics/texmap/coordinated/CompositingCoordinator.h:

Source/WebKit2:

Update CoordinatedLayerTreeHost and ThreadCoordinatedLayerTreeHost to
correctly use setRootCompositingLayer() and setViewOverlayRootLayer()
methods on the CompositingCoordinator object.

CoordinatedLayerTreeHost doesn't have to keep a pointer to the root
compositing layer anymore. updateRootLayers() can be removed.

ThreadCoordinatedLayerTreeHost doen't have to keep a pointer to both
the root compositing and the view overlay layers anymore. Similarly,
updateRootLayers() can be removed.

WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:

(WebKit::CoordinatedLayerTreeHost::setViewOverlayRootLayer):
(WebKit::CoordinatedLayerTreeHost::setRootCompositingLayer):
(WebKit::CoordinatedLayerTreeHost::CoordinatedLayerTreeHost): Deleted.
(WebKit::CoordinatedLayerTreeHost::updateRootLayers): Deleted.

WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.h:
WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp:

(WebKit::ThreadedCoordinatedLayerTreeHost::setRootCompositingLayer):
(WebKit::ThreadedCoordinatedLayerTreeHost::setViewOverlayRootLayer):
(WebKit::ThreadedCoordinatedLayerTreeHost::ThreadedCoordinatedLayerTreeHost): Deleted.
(WebKit::ThreadedCoordinatedLayerTreeHost::updateRootLayers): Deleted.

WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.h:

12:36 AM Changeset in webkit [200407] by zandobersek@gmail.com

3 edits in trunk/Source/WebCore

[TexMap] Clean up TextureMapperGLData, TextureMapperGLData::SharedGLData
https://bugs.webkit.org/show_bug.cgi?id=157303

Reviewed by Carlos Garcia Campos.

Torch the TextureMapperGLData and TextureMapperGLData::SharedGLData
classes into a better form.

SharedGLData is now private to the TextureMapperGLData class, but
lists that class as a friend. This enables moving the getShaderProgram()
method to TextureMapperGLData and removes the need to expose the
SharedGLData publicly. SharedGLData also doesn't have to keep a
reference to the GraphicsContext3D object.

TextureMapperGLData now default-initializes the publicly accessible
member variables while making some other members private, not exposing
anything that isn't necessary.

Usual whitespace cleanup included. More elegant HashMap::ensure()
insertions are used where they don't obfuscate object creation.

No new tests -- no change in behavior.

platform/graphics/texmap/TextureMapperGL.cpp:

(WebCore::TextureMapperGLData::SharedGLData::currentSharedGLData):
(WebCore::TextureMapperGLData::SharedGLData::~SharedGLData):
(WebCore::TextureMapperGLData::SharedGLData::contextDataMap):
(WebCore::TextureMapperGLData::SharedGLData::SharedGLData):
(WebCore::TextureMapperGLData::TextureMapperGLData):
(WebCore::TextureMapperGLData::~TextureMapperGLData):
(WebCore::TextureMapperGLData::initializeStencil):
(WebCore::TextureMapperGLData::getStaticVBO):
(WebCore::TextureMapperGLData::getShaderProgram):
(WebCore::TextureMapperGL::TextureMapperGL):
(WebCore::TextureMapperGL::drawBorder):
(WebCore::TextureMapperGL::drawTexture):
(WebCore::TextureMapperGL::drawSolidColor):
(WebCore::TextureMapperGL::drawFiltered):
(WebCore::TextureMapperGL::beginClip):
(WebCore::TextureMapperGLData::SharedGLData::glContextDataMap): Deleted.
(WebCore::TextureMapperGLData::SharedGLData::getShaderProgram): Deleted.
(WebCore::TextureMapperGLData::sharedGLData): Deleted.

platform/graphics/texmap/TextureMapperGL.h:

May 3, 2016:

10:01 PM Changeset in webkit [200406] by fpizlo@apple.com

4 edits
2 adds in trunk

REGRESSION(r200383): Setting lazily initialized properties across frame boundaries crashes
https://bugs.webkit.org/show_bug.cgi?id=157333

Reviewed by Benjamin Poulain.

Source/JavaScriptCore:

I forgot to add logic for lazy properties in putEntry(). It turns out that it's easy to
add.

runtime/Lookup.h:

(JSC::putEntry):

runtime/PropertySlot.h:

LayoutTests:

This is JoePeck's original test case. It used to crash and now it doesn't crash anymore.

js/dom/cross-window-put-math-expected.txt: Added.
js/dom/cross-window-put-math.html: Added.

7:23 PM Changeset in webkit [200405] by fpizlo@apple.com

8 edits in trunk/Source/JavaScriptCore

References from code to Structures should be stronger than weak
https://bugs.webkit.org/show_bug.cgi?id=157324

Reviewed by Mark Lam.

If code refers to a Structure and the Structure dies, then previously we'd kill the code.
This makes sense because the Structure could be the only thing left referring to some global
object or prototype.

But this also causes unnecessary churn. Sometimes there will be a structure that we just
haven't really done anything with recently and so it appears dead. The approach we use
elsewhere in our type inference is that the type that the code uses is general enough to
handle every past execution. Having the GC clear code when some Structure it uses dies means
that we forget that the code used that Structure. We'll either assume that the code is more
monomorphic than it really is (because after GC we patch in some other structure but not the
deleted one, so it looks like we only ever saw the new structure), or we'll assume that it's
crazier than it really is (because we'll remember that there had been some structure that
caused deletion, so we'll assume that deletions might happen in the future, so we'll use a
fully dynamic IC).

This change introduces a more nuanced policy: if it's cheap to mark a dead Structure then we
should mark it just so that all of the code that refers to it remembers that there had been
this exact Structure in the past. If the code often goes through different Structures then
we already have great mechanisms to realize that the code is nutty (namely, the
PolymorphicAccess size limit). But if the code just does this a handful of times then
remembering this old Structure is probably net good:

It obeys the "handle all past executions" law.
It preserves the history of the property access, allowing a precise measure of its past polymorphism.
It makes the code ready to run fast if the user decides to use that Structure again. Marking the Structure means it will stay in whatever property transition tables it was in, so if the program does the same thing it did in the past, it will get this old Structure.

It looks like this is a progression in gbemu and it makes gbemu perform more
deterministically. Also, it seems that this makes JetStream run faster.

Over five in-browser runs of JetStream, here's what we see before and after:

Geometric Mean:

Before After
229.23 +- 8.2523 230.70 +- 12.888
232.91 +- 15.638 239.04 +- 13.766
234.79 +- 12.760 236.32 +- 15.562
236.20 +- 23.125 242.02 +- 3.3865
237.22 +- 2.1929 237.23 +- 17.664

Just gbemu:

Before After
541.0 +- 135.8 481.7 +- 143.4
518.9 +- 15.65 508.1 +- 136.3
362.5 +- 0.8884 489.7 +- 101.4
470.7 +- 313.3 530.7 +- 11.49
418.7 +- 180.6 537.2 +- 6.514

Notice that there is plenty of noise before and after, but the noise is now far less severe.
After this change I did not see any runs like "470.7 +- 313.3" where the size of the
confidence interval (313.3 * 2) is greater than the score (470.7). Also, notice that the
least noisy run before the change also got a lower score than we ever observed after the
change (36.5 +- 0.8884). The noise, and these occasional very low scores, are due to a
pathology where the GC would reset some stubs at an unfortunate time during profiling,
causing the optimizing compiler to make many poor decisions. That pathology doesn't exist
anymore.

On the other hand, prior to this change it was possible for gbemu to sometimes run sooooper
fast because the GC would cause the profiler to forget gbemu's behavior on the first tick
and focus only on its behavior in subsequent ticks. So, in steady state, we'd optimize gbemu
for its later behavior rather than a combination of its early behavior and later behavior.
We rarely got lucky this way, so it's not fair to view this quirk as a feature.

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::propagateTransitions):

bytecode/PolymorphicAccess.cpp:

(JSC::AccessCase::visitWeak):
(JSC::AccessCase::propagateTransitions):
(JSC::AccessCase::generateWithGuard):
(JSC::PolymorphicAccess::visitWeak):
(JSC::PolymorphicAccess::propagateTransitions):
(JSC::PolymorphicAccess::dump):

bytecode/PolymorphicAccess.h:
bytecode/StructureStubInfo.cpp:

(JSC::StructureStubInfo::visitWeakReferences):
(JSC::StructureStubInfo::propagateTransitions):
(JSC::StructureStubInfo::containsPC):

bytecode/StructureStubInfo.h:

(JSC::StructureStubInfo::considerCaching):

runtime/Structure.cpp:

(JSC::Structure::visitChildren):
(JSC::Structure::isCheapDuringGC):
(JSC::Structure::markIfCheap):
(JSC::Structure::prototypeChainMayInterceptStoreTo):

runtime/Structure.h:

6:54 PM Changeset in webkit [200404] by commit-queue@webkit.org

6 edits in trunk/Source/JavaScriptCore

Web Inspector: Simplify console.clear
https://bugs.webkit.org/show_bug.cgi?id=157316

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-03
Reviewed by Timothy Hatcher.

inspector/ScriptArguments.cpp:

(Inspector::ScriptArguments::createEmpty):
(Inspector::ScriptArguments::ScriptArguments):

inspector/ScriptArguments.h:

Provide a way to create an empty list.

runtime/ConsoleClient.cpp:

(JSC::ConsoleClient::clear):

runtime/ConsoleClient.h:

Drop unnecessary parameter.

runtime/ConsoleObject.cpp:

(JSC::consoleProtoFuncClear):
No need to parse arguments.

6:46 PM Changeset in webkit [200403] by Beth Dakin

5 edits
4 adds in trunk

Add VideoControlsManager tests
https://bugs.webkit.org/show_bug.cgi?id=157332
-and corresponding-
rdar://problem/24358431

Reviewed by Sam Weinig.

Source/WebKit2:

Expose _hasActiveVideoForControlsManager on WKWebViewPrivate for the sake of
testing.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _hasActiveVideoForControlsManager]):
(-[WKWebView _doAfterNextPresentationUpdate:]):

UIProcess/API/Cocoa/WKWebViewPrivate.h:

Tools:

This patch adds three VideoControlsManager tests.

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit/ios/video-with-audio.html:
TestWebKitAPI/Tests/WebKit2Cocoa/VideoControlsManager.mm: Added.

(-[DidPlayMessageHandler initWithWKWebView:]):
(-[DidPlayMessageHandler userContentController:didReceiveScriptMessage:]):
(TestWebKitAPI::TEST):

TestWebKitAPI/Tests/WebKit2Cocoa/large-video-with-audio.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/large-video-with-audio.mp4: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/large-video-without-audio.html: Added.

6:21 PM Changeset in webkit [200402] by Yusuke Suzuki

20 edits
1 add in trunk

Improve Symbol() to string coercion error message
https://bugs.webkit.org/show_bug.cgi?id=157317

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Improve error messages related to Symbols.

runtime/JSCJSValue.cpp:

(JSC::JSValue::toStringSlowCase):

runtime/Symbol.cpp:

(JSC::Symbol::toNumber):

runtime/SymbolConstructor.cpp:

(JSC::symbolConstructorKeyFor):

runtime/SymbolPrototype.cpp:

(JSC::symbolProtoFuncToString):
(JSC::symbolProtoFuncValueOf):

tests/stress/dfg-to-primitive-pass-symbol.js:
tests/stress/floating-point-div-to-mul.js:

(i.catch):

tests/stress/string-from-code-point.js:

(shouldThrow):
(string_appeared_here.shouldThrow):

tests/stress/symbol-error-messages.js: Added.

(shouldThrow):

tests/stress/symbol-registry.js:

LayoutTests:

js/math-clz32-expected.txt:
js/script-tests/symbol-abstract-relational-comparison.js:

(relationalOperators.forEach):

js/script-tests/symbol-object.js:
js/script-tests/symbol-prototype-is-ordinary-object.js:
js/script-tests/symbol-tostring.js:
js/string-code-point-at-expected.txt:
js/symbol-abstract-relational-comparison-expected.txt:
js/symbol-object-expected.txt:
js/symbol-prototype-is-ordinary-object-expected.txt:
js/symbol-tostring-expected.txt:

6:19 PM Changeset in webkit [200401] by Nikita Vasilyev

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Adding a new console message shouldn't modify DOM when the console log is hidden
https://bugs.webkit.org/show_bug.cgi?id=155629
<rdar://problem/25235470>

Reviewed by Timothy Hatcher.

Instead of rendering console messages right away, store them (in _pendingMessages)
and render only when the console tab or the split console is visible.
Also, batch rendering operations using requestAnimationFrame.

UserInterface/Controllers/JavaScriptLogViewController.js:

(WebInspector.JavaScriptLogViewController):
Store console message views in _pendingMessages.

(WebInspector.JavaScriptLogViewController.prototype._appendConsoleMessageView):
(WebInspector.JavaScriptLogViewController.prototype.renderPendingMessages):
Use requestAnimationFrame batching. Run isScrolledToBottom() at most only once
per batch.

(WebInspector.JavaScriptLogViewController.prototype.renderPendingMessagesSoon):
(WebInspector.JavaScriptLogViewController.prototype._didRenderConsoleMessageView):
There is no need to run scrollToBottom again.

UserInterface/Views/ConsoleCommandView.js:

(WebInspector.ConsoleCommandView):
Move all DOM operations to a new render method.

(WebInspector.ConsoleCommandView.prototype.render):

UserInterface/Views/ConsoleMessageView.js:

(WebInspector.ConsoleMessageView):
(WebInspector.ConsoleMessageView.prototype.render):
(WebInspector.ConsoleMessageView.prototype.set repeatCount):
(WebInspector.ConsoleMessageView.prototype._renderRepeatCount):

UserInterface/Views/LogContentView.js:

(WebInspector.LogContentView.prototype.shown):
When the console tab or the split console is opened render all pending messages.

(WebInspector.LogContentView.prototype.didAppendConsoleMessageView):
Don't call needsLayout on every added console message. Call it only once per
requestAnimationFrame. Also, no need to scrollToBottom once again.

(WebInspector.LogContentView.prototype._messageAdded):
(WebInspector.LogContentView.prototype._previousMessageRepeatCountUpdated):
(WebInspector.LogContentView.prototype._scopeFromMessageLevel): Deleted.
(WebInspector.LogContentView.prototype._markScopeBarItemUnread): Added.
Rename _pulseScopeBarItemBorder. In the very first version the border was pulsing,
but now we use small colored circles instead.

6:08 PM Changeset in webkit [200400] by commit-queue@webkit.org

6 edits
2 adds in trunk

Web Inspector: Give console.time/timeEnd a default label and warnings
https://bugs.webkit.org/show_bug.cgi?id=157325
<rdar://problem/26073290>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-03
Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

Provide more user friendly console.time/timeEnd. The timer name
is now optional, and is "default" if not provided. Also provide
warnings when attempting to start an already started timer,
or stop a timer that does not exist.

inspector/agents/InspectorConsoleAgent.cpp:

(Inspector::InspectorConsoleAgent::startTiming):
(Inspector::InspectorConsoleAgent::stopTiming):
Warnings for bad cases.

runtime/ConsoleObject.cpp:

(JSC::defaultLabelString):
(JSC::consoleProtoFuncTime):
(JSC::consoleProtoFuncTimeEnd):
Optional label becomes "default".

Source/WebInspectorUI:

UserInterface/Models/NativeFunctionParameters.js:

Update the convenience signature.

LayoutTests:

inspector/console/console-time-expected.txt: Added.
inspector/console/console-time.html: Added.

6:06 PM Changeset in webkit [200399] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

Fix the ENABLE(WEBASSEMBLY) build
https://bugs.webkit.org/show_bug.cgi?id=157312

Patch by Xan Lopez <xlopez@igalia.com> on 2016-05-03
Reviewed by Darin Adler.

runtime/Executable.cpp:

(JSC::WebAssemblyExecutable::WebAssemblyExecutable):

wasm/WASMFunctionCompiler.h:

(JSC::WASMFunctionCompiler::convertValueToDouble):

6:06 PM Changeset in webkit [200398] by commit-queue@webkit.org

4 edits in trunk/Source/JavaScriptCore

Web Inspector: Remove unused parameter of ScriptArguments::getFirstArgumentAsString
https://bugs.webkit.org/show_bug.cgi?id=157301

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-03
Reviewed by Timothy Hatcher.

inspector/ScriptArguments.cpp:

(Inspector::ScriptArguments::getFirstArgumentAsString):

inspector/ScriptArguments.h:

Remove unused argument and related code.

runtime/ConsoleClient.cpp:

(JSC::ConsoleClient::printConsoleMessageWithArguments):
Drive by remove unnecessary cast.

6:05 PM Changeset in webkit [200397] by jdiggs@igalia.com

5 edits in trunk

[ATK] accessibility/document-attributes.html is failing
https://bugs.webkit.org/show_bug.cgi?id=125348

Reviewed by Chris Fleizach.

Tools:

The test was failing because the WebArea is now being exposed with the role of
ATK_ROLE_DOCUMENT_WEB; not ATK_ROLE_DOCUMENT_FRAME. Unfortunately, when that
change was made, documentEncoding() and documentURI() were not updated accordingly.

WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:

(WTR::AccessibilityUIElement::documentEncoding):
(WTR::AccessibilityUIElement::documentURI):

LayoutTests:

platform/efl/TestExpectations: Unskipped failing test.
platform/gtk/TestExpectations: Unskipped failing test.

6:04 PM Changeset in webkit [200396] by jer.noble@apple.com

2 edits in trunk/Source/WebKit2

[iOS][WK2] Allow WKWebView to play local filesystem media when created with -loadFileURL:allowingReadAccessToURL:
https://bugs.webkit.org/show_bug.cgi?id=156875
<rdar://problem/24281444>

Reviewed by Alexey Proskuryakov.

Grant AVFoundation the right to issue file read sandbox extensions from the WebContent process to the mediaserverd
process, so that it can play back local media files.

Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:

6:03 PM Changeset in webkit [200395] by jiewen_tan@apple.com

3 edits
1 add in trunk/Source/WebKit2

File Upload: Photo upload name is always generic (image.jpg)
https://bugs.webkit.org/show_bug.cgi?id=157291
<rdar://problem/12353008>

Reviewed by Darin Adler.

Use the original filename as the name of an uploaded image instead of
a generic name, i.e. image.jpg.

Platform/spi/ios/PhotosSPI.h: Added.
UIProcess/ios/forms/WKFileUploadPanel.mm:

(-[WKFileUploadPanel _uploadItemForImage:withAssetURL:successBlock:failureBlock:]):

WebKit2.xcodeproj/project.pbxproj:

4:26 PM Changeset in webkit [200394] by Chris Dumez

5 edits in trunk/Source

[WK2][DiskCache] Store common HTTP header names as strings
https://bugs.webkit.org/show_bug.cgi?id=157326
<rdar://problem/26073498>

Reviewed by Antti Koivisto.

Store common HTTP header names as strings in the disk cache instead of
using their value in the HTTPHeaderName enumeration. Having the disk
cache rely in the HTTPHeaderName enumeration is risky becomes it means
the cached data would become invalid every time someone updates
HTTPHeaderNames.in in WebCore. If someone were to update
HTTPHeaderNames.in without bumping the disk cache version, we would end
up with wrongly recognized HTTP header names after loading responses
from the cache.

NetworkProcess/cache/NetworkCacheCoders.cpp:

(WebKit::NetworkCache::Coder<WebCore::HTTPHeaderMap>::encode):
(WebKit::NetworkCache::Coder<WebCore::HTTPHeaderMap>::decode):

NetworkProcess/cache/NetworkCacheCoders.h:
NetworkProcess/cache/NetworkCacheStorage.h:

4:25 PM Changeset in webkit [200393] by Chris Dumez

6 edits in trunk/Source/WebCore

Optimize [StrictTypeChecking] on IDL attributes
https://bugs.webkit.org/show_bug.cgi?id=157321

Reviewed by Geoffrey Garen.

Optimize [StrictTypeChecking] on IDL attributes:

Only generate extra code for nullable attributes because for non-nullable attributes, JSXXX::toWrapped() will return null in case of a bad input type. We will then throw a TypeError when null-checking it already.
After the JSValue::isNullOrUndefined() check, avoid calling JSXXX::toWrapped() and set nativeValue to nullptr directly.
Drop the check for JSValue::inherits(JSXXX::info()) and just do a null check on the value returned by JSXXX::toWrapped(). toWrapped() already does a JSValue::inherits(JSXXX::info() check. Since we only call toWrapped() if the JSValue is not null/undefined, a null return value always indicates a bad input type.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:

(webkit_dom_test_obj_set_strict_type_checking_attribute):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::setJSTestObjStrictTypeCheckingAttribute):

bindings/scripts/test/ObjC/DOMTestObj.mm:

(-[DOMTestObj setStrictTypeCheckingAttribute:]):

bindings/scripts/test/TestObj.idl:

4:01 PM Changeset in webkit [200392] by Ryan Haddad

2 edits in trunk/LayoutTests

Un-skipping storage/indexeddb/intversion-open-in-upgradeneeded.html, but leaving it as flaky
https://bugs.webkit.org/show_bug.cgi?id=155050

Unreviewed test gardening.

platform/mac-wk2/TestExpectations:

3:31 PM Changeset in webkit [200391] by dbates@webkit.org

2 edits in trunk/Source/WebKit2

Temporary workaround for Apple Internal builds
<rdar://problem/25992976>

For Apple Internal builds treat error code errSecCSGuestInvalid as if it were error code errSecCSUnsigned.
We will look to remove this workaround in the fix for <rdar://problem/26075714>.

Shared/mac/CodeSigning.mm:

(WebKit::secCodeSigningIdentifier):

3:20 PM Changeset in webkit [200390] by Chris Dumez

16 edits in trunk/Source

Unreviewed, rolling out r199259 and r200161.

Seems to have caused a ~1.2% PLT regression on iOS

Reverted changesets:

"[iOS WK2] WKWebViews should consult ancestor UIScrollViews to
determine tiling area"
https://bugs.webkit.org/show_bug.cgi?id=156429
http://trac.webkit.org/changeset/199259

"[iOS WK2] When determining tile size, check whether ancestor
UIScrollViews are actually scrollable"
https://bugs.webkit.org/show_bug.cgi?id=157107
http://trac.webkit.org/changeset/200161

3:12 PM Changeset in webkit [200389] by dino@apple.com

6 edits in trunk/Source/WebKit2

CSS Grid should be an experimental feature flag
https://bugs.webkit.org/show_bug.cgi?id=157327
<rdar://problem/26075147>

Reviewed by Anders Carlsson.

The CSS Grid Layout runtime flag was exposed by
a WebKit preference. It was in the experimental
section but was missing the "Experimental" prefix.

It was also missing the human readable description.

Lastly, there is no need for the C API for experimental
features.

Shared/WebPreferencesDefinitions.h:
UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetCSSGridLayoutEnabled): Deleted.
(WKPreferencesGetCSSGridLayoutEnabled): Deleted.

UIProcess/API/C/WKPreferencesRefPrivate.h:
WebProcess/InjectedBundle/InjectedBundle.cpp:

(WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner):

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::updatePreferences):

2:46 PM Changeset in webkit [200388] by achristensen@apple.com

2 edits in trunk/Source/WebKit2

Remove firing assertion when redirecting
https://bugs.webkit.org/show_bug.cgi?id=155800
rdar://25299194

Reviewed by Sam Weinig.

NetworkProcess/cocoa/NetworkSessionCocoa.mm:

(-[WKNetworkSessionDelegate URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:willCacheResponse:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
(-[WKNetworkSessionDelegate URLSession:task:didCompleteWithError:]):
With NSURLConnection, we stopped getting delegate callbacks once the delegate is destroyed, and everything was cancelled.
With NSURLSession we continue getting delegate callbacks because the session's delegate is not destroyed after each load.
As documented in NSURLSession.h: "In some cases, the task may signal other work before it acknowledges the cancelation."
In the cases where we cancel a load, delete the NetworkLoad and corresponding NetworkDataTask, we want to call all
completion handlers indicating that we really want to cancel instead of asserting.

2:42 PM Changeset in webkit [200387] by msaboff@apple.com

2 edits
1 add in trunk/Source/JavaScriptCore

Crash: Array.prototype.slice() and .splice() can call fastSlice() after an array is truncated
https://bugs.webkit.org/show_bug.cgi?id=157322

Reviewed by Filip Pizlo.

Check to see if the source array has changed length before calling fastSlice().
If it has, take the slow path.

runtime/ArrayPrototype.cpp:

(JSC::arrayProtoFuncSlice):
(JSC::arrayProtoFuncSplice):

tests/stress/regress-157322.js: New test.

1:54 PM Changeset in webkit [200386] by ggaren@apple.com

3 edits in trunk/Source/bmalloc

2016-05-03 Geoffrey Garen <ggaren@apple.com>

Assertion failure in bmalloc::vmRevokePermissions(void*, unsigned long).
https://bugs.webkit.org/show_bug.cgi?id=157047

Reviewed by Filip Pizlo.

Renamed roundUpToMultipleOfSloppy => roundUpToMultipleOfNonPowerOfTwo.

bmalloc/Algorithm.h: (bmalloc::roundUpToMultipleOfNonPowerOfTwo): (bmalloc::roundUpToMultipleOfSloppy): Deleted.
bmalloc/VMHeap.cpp: (bmalloc::VMHeap::allocateSmallChunk):

12:43 PM Changeset in webkit [200385] by ggaren@apple.com

3 edits in trunk/Source/bmalloc

Assertion failure in bmalloc::vmRevokePermissions(void*, unsigned long).
https://bugs.webkit.org/show_bug.cgi?id=157047

Reviewed by Filip Pizlo.

The previous fix aligned the guard page sizes correctly but forgot to
align the guard page start address correctly.

bmalloc/Algorithm.h:

(bmalloc::roundUpToMultipleOfSloppy): Use a new helper method to round
up when not working with a power of two, instead of writing out the
math by hand.

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::allocateSmallChunk): Make sure to round up the guard
page start address in addition to its size. Assert at the very end to
try to catch more bugs.

11:38 AM Changeset in webkit [200384] by Joseph Pecoraro

2 edits in trunk/Source/JavaScriptCore

Eliminate PassRefPtr conversion from ConsoleObject
https://bugs.webkit.org/show_bug.cgi?id=157300

Reviewed by Timothy Hatcher.

runtime/ConsoleObject.cpp:

(JSC::consoleLogWithLevel):
(JSC::consoleProtoFuncClear):
(JSC::consoleProtoFuncDir):
(JSC::consoleProtoFuncDirXML):
(JSC::consoleProtoFuncTable):
(JSC::consoleProtoFuncTrace):
(JSC::consoleProtoFuncAssert):
(JSC::consoleProtoFuncCount):
(JSC::consoleProtoFuncTimeStamp):
(JSC::consoleProtoFuncGroup):
(JSC::consoleProtoFuncGroupCollapsed):
(JSC::consoleProtoFuncGroupEnd):
No need to release to a PassRefPtr, we can just move into the RefPtr<>&&.

11:36 AM Changeset in webkit [200383] by fpizlo@apple.com

40 edits
5 adds in trunk/Source

Speed up JSGlobalObject initialization by making some properties lazy
https://bugs.webkit.org/show_bug.cgi?id=157045

Reviewed by Keith Miller.
Source/JavaScriptCore:

This makes about half of JSGlobalObject's state lazy. There are three categories of
state in JSGlobalObject:

1) C++ fields in JSGlobalObject.
2) JS object properties in JSGlobalObject's JSObject superclass.
3) JS variables in JSGlobalObject's JSSegmentedVariableObject superclass.

State held in JS variables cannot yet be made lazy. That's why this patch only goes
half-way.

State in JS object properties can be made lazy if we move it to the static property
hashtable. JSGlobalObject already had one of those. This patch makes static property
hashtables a lot more powerful, by adding three new kinds of static properties. These
new kinds allow us to make almost all of JSGlobalObject's object properties lazy.

State in C++ fields can now be made lazy thanks in part to WTF's support for stateless
lambdas. You can of course make anything lazy by hand, but there are many C++ fields in
JSGlobalObject and we are adding more all the time. We don't want to require that each
of these has a getter with an initialization check and a corresponding out-of-line slow
path that does the initialization. We want this kind of boilerplate to be handled by
some abstractions.

The primary abstraction introduced in this patch is LazyProperty<Type>. Currently, this
only works where Type is a subclass of JSCell. Such a property holds a pointer to Type.
You can use it like you would a WriteBarrier<Type>. It even has set() and get() methods,
so it's almost a drop-in replacement.

The key to LazyProperty<Type>'s power is that you can do this:

class Bar {

...
LazyProperty<Foo> m_foo;

};
...
m_foo.initLater(

[] (const LazyProperty<Foo>::Initializer<Bar>& init) {

init.set(Foo::create(init.vm, init.owner));

});

movabsq 0xBLAH, %rax
movq %rax, &m_foo

API/JSCallbackFunction.cpp:

(JSC::JSCallbackFunction::create):

API/ObjCCallbackFunction.h:

(JSC::ObjCCallbackFunction::impl):

API/ObjCCallbackFunction.mm:

(JSC::ObjCCallbackFunction::ObjCCallbackFunction):
(JSC::ObjCCallbackFunction::create):

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
create_hash_table:
dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGAbstractValue.cpp:

(JSC::DFG::AbstractValue::set):

dfg/DFGArrayMode.cpp:

(JSC::DFG::ArrayMode::originalArrayStructure):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::handleTypedArrayConstructor):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileNewTypedArray):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGStructureRegistrationPhase.cpp:

(JSC::DFG::StructureRegistrationPhase::run):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):

runtime/ClonedArguments.cpp:

(JSC::ClonedArguments::getOwnPropertySlot):
(JSC::ClonedArguments::materializeSpecials):

runtime/CommonSlowPaths.cpp:

(JSC::SLOW_PATH_DECL):

runtime/FunctionPrototype.cpp:

(JSC::functionProtoFuncToString):

runtime/InternalFunction.cpp:

(JSC::InternalFunction::visitChildren):
(JSC::InternalFunction::name):
(JSC::InternalFunction::calculatedDisplayName):
(JSC::InternalFunction::createSubclassStructure):

runtime/InternalFunction.h:
runtime/JSBoundFunction.cpp:

(JSC::JSBoundFunction::finishCreation):
(JSC::JSBoundFunction::visitChildren):

runtime/JSFunction.cpp:

(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::defineOwnProperty):

runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::constructGenericTypedArrayView):

runtime/JSGlobalObject.cpp:

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::objectConstructor):
(JSC::JSGlobalObject::promiseConstructor):
(JSC::JSGlobalObject::internalPromiseConstructor):
(JSC::JSGlobalObject::evalErrorConstructor):
(JSC::JSGlobalObject::rangeErrorConstructor):
(JSC::JSGlobalObject::referenceErrorConstructor):
(JSC::JSGlobalObject::syntaxErrorConstructor):
(JSC::JSGlobalObject::typeErrorConstructor):
(JSC::JSGlobalObject::URIErrorConstructor):
(JSC::JSGlobalObject::nullGetterFunction):
(JSC::JSGlobalObject::nullSetterFunction):
(JSC::JSGlobalObject::callFunction):
(JSC::JSGlobalObject::applyFunction):
(JSC::JSGlobalObject::definePropertyFunction):
(JSC::JSGlobalObject::arrayProtoValuesFunction):
(JSC::JSGlobalObject::initializePromiseFunction):
(JSC::JSGlobalObject::newPromiseCapabilityFunction):
(JSC::JSGlobalObject::functionProtoHasInstanceSymbolFunction):
(JSC::JSGlobalObject::regExpProtoExecFunction):
(JSC::JSGlobalObject::regExpProtoSymbolReplaceFunction):
(JSC::JSGlobalObject::regExpProtoGlobalGetter):
(JSC::JSGlobalObject::regExpProtoUnicodeGetter):
(JSC::JSGlobalObject::throwTypeErrorGetterSetter):
(JSC::JSGlobalObject::moduleLoader):
(JSC::JSGlobalObject::objectPrototype):
(JSC::JSGlobalObject::functionPrototype):
(JSC::JSGlobalObject::arrayPrototype):
(JSC::JSGlobalObject::booleanPrototype):
(JSC::JSGlobalObject::stringPrototype):
(JSC::JSGlobalObject::symbolPrototype):
(JSC::JSGlobalObject::numberPrototype):
(JSC::JSGlobalObject::datePrototype):
(JSC::JSGlobalObject::regExpPrototype):
(JSC::JSGlobalObject::errorPrototype):
(JSC::JSGlobalObject::iteratorPrototype):
(JSC::JSGlobalObject::generatorFunctionPrototype):
(JSC::JSGlobalObject::generatorPrototype):
(JSC::JSGlobalObject::debuggerScopeStructure):
(JSC::JSGlobalObject::withScopeStructure):
(JSC::JSGlobalObject::strictEvalActivationStructure):
(JSC::JSGlobalObject::activationStructure):
(JSC::JSGlobalObject::moduleEnvironmentStructure):
(JSC::JSGlobalObject::directArgumentsStructure):
(JSC::JSGlobalObject::scopedArgumentsStructure):
(JSC::JSGlobalObject::clonedArgumentsStructure):
(JSC::JSGlobalObject::isOriginalArrayStructure):
(JSC::JSGlobalObject::booleanObjectStructure):
(JSC::JSGlobalObject::callbackConstructorStructure):
(JSC::JSGlobalObject::callbackFunctionStructure):
(JSC::JSGlobalObject::callbackObjectStructure):
(JSC::JSGlobalObject::propertyNameIteratorStructure):
(JSC::JSGlobalObject::objcCallbackFunctionStructure):
(JSC::JSGlobalObject::objcWrapperObjectStructure):
(JSC::JSGlobalObject::dateStructure):
(JSC::JSGlobalObject::nullPrototypeObjectStructure):
(JSC::JSGlobalObject::errorStructure):
(JSC::JSGlobalObject::calleeStructure):
(JSC::JSGlobalObject::functionStructure):
(JSC::JSGlobalObject::boundFunctionStructure):
(JSC::JSGlobalObject::boundSlotBaseFunctionStructure):
(JSC::JSGlobalObject::getterSetterStructure):
(JSC::JSGlobalObject::nativeStdFunctionStructure):
(JSC::JSGlobalObject::namedFunctionStructure):
(JSC::JSGlobalObject::functionNameOffset):
(JSC::JSGlobalObject::numberObjectStructure):
(JSC::JSGlobalObject::privateNameStructure):
(JSC::JSGlobalObject::mapStructure):
(JSC::JSGlobalObject::regExpStructure):
(JSC::JSGlobalObject::generatorFunctionStructure):
(JSC::JSGlobalObject::setStructure):
(JSC::JSGlobalObject::stringObjectStructure):
(JSC::JSGlobalObject::symbolObjectStructure):
(JSC::JSGlobalObject::iteratorResultObjectStructure):
(JSC::JSGlobalObject::lazyTypedArrayStructure):
(JSC::JSGlobalObject::typedArrayStructure):
(JSC::JSGlobalObject::typedArrayStructureConcurrently):
(JSC::JSGlobalObject::isOriginalTypedArrayStructure):
(JSC::JSGlobalObject::typedArrayConstructor):
(JSC::JSGlobalObject::actualPointerFor):
(JSC::JSGlobalObject::internalFunctionStructure): Deleted.

runtime/JSNativeStdFunction.cpp:

(JSC::JSNativeStdFunction::create):

runtime/JSWithScope.cpp:

(JSC::JSWithScope::create):
(JSC::JSWithScope::visitChildren):
(JSC::JSWithScope::createStructure):
(JSC::JSWithScope::JSWithScope):

runtime/JSWithScope.h:

(JSC::JSWithScope::object):
(JSC::JSWithScope::create): Deleted.
(JSC::JSWithScope::createStructure): Deleted.
(JSC::JSWithScope::JSWithScope): Deleted.

runtime/LazyClassStructure.cpp: Added.

runtime/LazyClassStructure.h: Added.

runtime/LazyClassStructureInlines.h: Added.

(JSC::LazyClassStructure::initLater):

runtime/LazyProperty.h: Added.

(JSC::LazyProperty::Initializer::Initializer):
(JSC::LazyProperty::LazyProperty):
(JSC::LazyProperty::get):
(JSC::LazyProperty::getConcurrently):

runtime/LazyPropertyInlines.h: Added.

(JSC::LazyProperty<ElementType>::Initializer<OwnerType>::set):
(JSC::LazyProperty<ElementType>::initLater):
(JSC::LazyProperty<ElementType>::setMayBeNull):
(JSC::LazyProperty<ElementType>::set):
(JSC::LazyProperty<ElementType>::visit):
(JSC::LazyProperty<ElementType>::dump):
(JSC::LazyProperty<ElementType>::callFunc):

runtime/Lookup.cpp:

(JSC::setUpStaticFunctionSlot):

runtime/Lookup.h:

runtime/PropertySlot.h:
runtime/TypedArrayType.h:

Source/WebCore:

bindings/js/JSHTMLElementCustom.cpp:

(WebCore::JSHTMLElement::pushEventHandlerScope):

Source/WTF:

This WTF change is at the heart of a large JSC change. In JSC I found myself wanting to
do this a lot:

static void callback(Foo& foo) { ... }

foo.setCallback(callback);

foo.setCallback([] (Foo& foo) { ... });

wtf/StdLibExtras.h:

(WTF::isStatelessLambda):
(WTF::callStatelessLambda):

11:22 AM Changeset in webkit [200382] by peavo@outlook.com

6 edits in trunk/Source

[Win] Remove Windows XP Compatibility Requirements
https://bugs.webkit.org/show_bug.cgi?id=152899

Reviewed by Brent Fulgham.

Source/JavaScriptCore:

Windows XP is not supported anymore, we can remove workarounds.

JavaScriptCore.vcxproj/jsc/DLLLauncherMain.cpp:

(enableTerminationOnHeapCorruption):

Source/WebCore:

Windows XP is not supported anymore, we can remove compatibility workarounds.

platform/text/win/LocaleWin.cpp:

(WebCore::extractLanguageCode):
(WebCore::LCIDFromLocaleInternal):
(WebCore::LCIDFromLocale):
(WebCore::removeLastComponent): Deleted.
(WebCore::ensureNameToLCIDMap): Deleted.
(WebCore::convertLocaleNameToLCID): Deleted.

Source/WTF:

Windows XP is not supported anymore, we can remove workarounds.

wtf/Assertions.cpp:

11:00 AM Changeset in webkit [200381] by Antti Koivisto

5 edits
2 adds in trunk

REGRESSION (r198943): Transitions don't work if they animate display property
https://bugs.webkit.org/show_bug.cgi?id=157244
<rdar://problem/26042189>

Reviewed by Simon Fraser.

Source/WebCore:

Test: transitions/transition-display-property.html

style/RenderTreeUpdater.cpp:

(WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement):

Call the common function for ::before/::after updates.

style/StyleTreeResolver.cpp:

(WebCore::Style::TreeResolver::resolveElement):
(WebCore::Style::TreeResolver::createAnimatedElementUpdate):

If animation forces render tree reconstruction use the original rather than animated style for update.
Because animations are tied to renderers we start them during renderer construction in this case.

Factor to a function.

(WebCore::Style::elementImplicitVisibility):

style/StyleTreeResolver.h:

LayoutTests:

transitions/transition-display-property-expected.html: Added.
transitions/transition-display-property.html: Added.

10:58 AM Changeset in webkit [200380] by peavo@outlook.com

2 edits in trunk/Source/WTF

[Win] Warning fix.
https://bugs.webkit.org/show_bug.cgi?id=157309

Reviewed by Darin Adler.

MSVC gives a warning when converting from signed to unsigned.

wtf/SmallPtrSet.h:

(WTF::SmallPtrSet::begin):

10:31 AM Changeset in webkit [200379] by bshafiei@apple.com

10 edits in tags/Safari-602.1.30.4/Source

Merged r200157. rdar://problem/25841037

10:24 AM Changeset in webkit [200378] by Chris Dumez

1 edit
3 deletes in trunk/LayoutTests

Unreviewed, drop outdated layout test after r200375.

fast/workers/resources/worker-replace-self.js: Removed.
fast/workers/worker-replace-self-expected.txt: Removed.
fast/workers/worker-replace-self.html: Removed.

10:10 AM Changeset in webkit [200377] by Brent Fulgham

2 edits in trunk/Tools

[Win] Unreviewed build fix.

EWSTools/start-queue-win.sh: Establish proper VS2015 build

environment at start of queue run.

9:39 AM Changeset in webkit [200376] by jdiggs@igalia.com

1 edit
1 add in trunk/LayoutTests

Unreviewed GTK+ gardening.
Adding a platform-specific expectations file for aria-text-role.html.

platform/gtk/accessibility/aria-text-role-expected.txt: Added.

8:50 AM Changeset in webkit [200375] by Chris Dumez

3 edits
9 adds in trunk

WorkerGlobalScope's self, location and navigator attributes should not be replaceable
https://bugs.webkit.org/show_bug.cgi?id=157296
<rdar://problem/25962738>

Patch by Pranjal Jumde <pjumde@apple.com> on 2016-05-03
Reviewed by Chris Dumez.

Source/WebCore:

Tests: http/tests/workers/location-readonly.html

http/tests/workers/navigator-readonly.html
http/tests/workers/self-readonly.html

workers/WorkerGlobalScope.idl:

The 'self', 'location', and 'navigator' properties of the WorkerGlobalScope must be immutable.
See: https://html.spec.whatwg.org/multipage/workers.html#the-workerglobalscope-common-interface

LayoutTests:

http/tests/workers/location-readonly-expected.txt: Added.
http/tests/workers/location-readonly.html: Added.
http/tests/workers/navigator-readonly-expected.txt: Added.
http/tests/workers/navigator-readonly.html: Added.
http/tests/workers/self-readonly-expected.txt: Added.
http/tests/workers/self-readonly.html: Added.
http/tests/workers/worker-location.js: Added.
http/tests/workers/worker-navigator.js: Added.
http/tests/workers/worker-self.js: Added.

8:44 AM Changeset in webkit [200374] by Chris Dumez

6 edits in trunk/Source/WebCore

Drop some unnecessary exception checking in the generated bindings
https://bugs.webkit.org/show_bug.cgi?id=157299

Reviewed by Darin Adler.

Drop some unnecessary exception checking in the generated bindings.
Only do a check for state->hadException() after converting a JSValue
to a native value when necessary. Update JSValueToNative() to
indicate the caller if converting to the native value may throw an
exception.

This gets rid of a lot of unnecessary branching in the bindings.

No new tests, no intended web-exposed behavior change.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):
(GenerateParametersCheck):
(JSValueToNative):

bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
bindings/scripts/test/JS/JSTestInterface.cpp:
bindings/scripts/test/JS/JSTestObj.cpp:
bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

8:39 AM Changeset in webkit [200373] by commit-queue@webkit.org

3 edits in trunk/Source/WebInspectorUI

Web Inspector: Update window.console function API description strings in Console
https://bugs.webkit.org/show_bug.cgi?id=157298

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-03
Reviewed by Timothy Hatcher.

UserInterface/Models/NativeFunctionParameters.js:
UserInterface/Views/ObjectTreePropertyTreeElement.js:

(WebInspector.ObjectTreePropertyTreeElement.prototype._functionParameterString):
The Console object changed how it works. Work with the new
structure, and the older structure for legacy backends.

8:30 AM Changeset in webkit [200372] by beidson@apple.com

7 edits in trunk/Source/WebCore

Add/refactor isolatedCopy methods for 3 IDB classes.
https://bugs.webkit.org/show_bug.cgi?id=157289

Reviewed by Alex Christensen.

No new tests (Refactor, no behavior change).

In an upcoming, much larger patch, I'll need the ability to directly construct these three objects
as isolated copies.

This is a nice standalone refactor that enables that ability.

Modules/indexeddb/IDBGetResult.cpp:

(WebCore::IDBGetResult::IDBGetResult):
(WebCore::IDBGetResult::isolatedCopy):

Modules/indexeddb/IDBGetResult.h:

Modules/indexeddb/IDBKeyData.cpp:

(WebCore::IDBKeyData::IDBKeyData):
(WebCore::IDBKeyData::isolatedCopy):

Modules/indexeddb/IDBKeyData.h:

Modules/indexeddb/shared/IDBTransactionInfo.cpp:

(WebCore::IDBTransactionInfo::IDBTransactionInfo):
(WebCore::IDBTransactionInfo::isolatedCopy):

Modules/indexeddb/shared/IDBTransactionInfo.h:

8:24 AM Changeset in webkit [200371] by commit-queue@webkit.org

4 edits in trunk/Source/JavaScriptCore

Web Inspector: console.assert should do far less work when the assertion is true
https://bugs.webkit.org/show_bug.cgi?id=157297
<rdar://problem/26056556>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-03
Reviewed by Timothy Hatcher.

runtime/ConsoleClient.h:
runtime/ConsoleClient.cpp:

(JSC::ConsoleClient::assertion):
(JSC::ConsoleClient::assertCondition): Deleted.
Rename, now that this will only get called when the assertion failed.

runtime/ConsoleObject.cpp:

(JSC::consoleProtoFuncAssert):
Avoid doing any work if the assertion succeeded.

8:23 AM Changeset in webkit [200370] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Allow format specifiers in console.assert and console.trace
https://bugs.webkit.org/show_bug.cgi?id=157295
<rdar://problem/26056039>

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-03
Reviewed by Timothy Hatcher.

UserInterface/Views/ConsoleMessageView.js:

(WebInspector.ConsoleMessageView.prototype._appendMessageTextAndArguments):
Treat the first argument as a format specifier.

8:23 AM Changeset in webkit [200369] by jdiggs@igalia.com

13 edits
2 adds in trunk

[ATK] accessibility/content-editable-as-textarea.html fails
https://bugs.webkit.org/show_bug.cgi?id=155353

Reviewed by Darin Adler.

Source/WebCore:

The test was timing out because it expected an AXValueChanged notification.
In ATK, AXValueChanged notifications are made for widgets which implement
the AtkValue interface (sliders, progress bars, etc.). We should be listening
for AXTextChanged instead.

In addition, for contenteditable elements, we should emit the notification on
the element itself. Because we were handling the notification in the same way
as native text controls (where the notification we receive from WebCore is for
StaticTextRole children), we were attempting to emit the notification from
the parent of the contenteditable.

Lastly, ATK's AccessibilityUIElement support had a number of unimplemented
methods that are being used as part of the previously-failing test. Those
methods are now implemented so that the ATK results are much more similar
to those on the Mac.

No new tests needed. The previously-failing test now passes.

accessibility/AccessibilityNodeObject.cpp:

(WebCore::AccessibilityNodeObject::childrenChanged):

accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::isNonNativeTextControl):

accessibility/AccessibilityObject.h:
accessibility/AccessibilityRenderObject.cpp:

(WebCore::AccessibilityRenderObject::textChanged):

accessibility/atk/AXObjectCacheAtk.cpp:

(WebCore::AXObjectCache::nodeTextChangePlatformNotification):

Tools:

Also, ATK's AccessibilityUIElement support had a number of unimplemented
methods that are being used as part of the previously-failing test. Those
methods are now implemented so that the ATK results are much more similar
to those on the Mac.

WebKitTestRunner/InjectedBundle/atk/AccessibilityNotificationHandlerAtk.cpp:

(WTR::AccessibilityNotificationHandler::connectAccessibilityCallbacks):

WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:

(WTR::AccessibilityUIElement::stringAttributeValue):
(WTR::AccessibilityUIElement::rangeForLine):
(WTR::AccessibilityUIElement::boundsForRange):
(WTR::AccessibilityUIElement::attributedStringForRange):

LayoutTests:

Updated the test identified in the bug to listen for the appropriate
notification for ATK and created platform-specific expectations.

In addition, set-selected-text-range-contenteditable.html was timing out
due to the use of shouldBecomeEqual() with an assertion that is wrong for
ATK. Modifying the test so that it verifies the result appropriate for
each platform eliminates the timeout.

accessibility/content-editable-as-textarea.html: Updated.
accessibility/set-selected-text-range-contenteditable.html: Updated.
platform/gtk/TestExpectations: Unskipped the failing tests.
platform/gtk/accessibility/content-editable-as-textarea-expected.txt: Added.
platform/gtk/accessibility/set-selected-text-range-contenteditable-expected.txt: Added.

4:30 AM Changeset in webkit [200368] by svillar@igalia.com

5 edits in trunk/Source/WebCore

[css-grid] Add support for position resolution with auto-repeat tracks
https://bugs.webkit.org/show_bug.cgi?id=157260

Reviewed by Darin Adler.

This is a generalization of our position resolution code so it now supports every possible
type of resolution (definite position, position spans, automatic resolution, named lines
resolution, grid areas...) under the presence of auto-repeat tracks, i.e., tracks that are
dynamically created by the LayoutGrid depending on the available space and that cannot be
directly inferred from the CSS declarations.

This means that we need two extra things to resolve positions:

the LayoutGrid needs to provide the number of auto-repeat tracks per axis
a wrapper is needed to hide the eventual presence of auto-repeat tracks (with their line

names) from the rest of the resolution code which should remain mostly unchanged.

The former is trivial (requires passing a new argument to some functions at the most) but
the latter requires a new class called NamedLineCollection. This class allow us to locate
and resolve named lines without having to insert the auto-repeat named lines in the already
existing data structures. It does it in a very compact representation as it does not
duplicate the names for every single repetition.

No new tests required as there is no change in behavior because the auto-repeat tracks
computation is not implemented yet. Current tests already test this code extensively, and
the auto-repeat code paths will be tested later once
RenderGrid::computeAutoRepeatTracksCount() is implemented.

rendering/RenderGrid.cpp:

(WebCore::RenderGrid::computeAutoRepeatTracksCount): New method with empty implementation.
(WebCore::RenderGrid::placeItemsOnGrid): Initialize the auto repeat tracks count.
(WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
(WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

rendering/RenderGrid.h:
rendering/style/GridPositionsResolver.cpp:

(WebCore::directionFromSide):
(WebCore::NamedLineCollection::NamedLineCollection): New class which is able to resolve the
positions of a given named line in the presence of auto-repeat and "normal" tracks.
(WebCore::NamedLineCollection::isValidNamedLineOrArea): Checks whether the given named line
is a valid line name or area.
(WebCore::NamedLineCollection::hasNamedLines): Checks whether the named line exists in the
given axis (either specified by auto-repeat or "normal" tracks).
(WebCore::NamedLineCollection::find): Looks for a line number whithin the line numbers where
the given named line was found.
(WebCore::NamedLineCollection::contains):
(WebCore::NamedLineCollection::firstPosition): Returns the first line where the given named
line is located.
(WebCore::adjustGridPositionsFromStyle): Use NamedLineCollection.
(WebCore::GridPositionsResolver::explicitGridColumnCount): Include auto repeat tracks.
(WebCore::GridPositionsResolver::explicitGridRowCount): Ditto.
(WebCore::explicitGridSizeForSide): Ditto.
(WebCore::lookAheadForNamedGridLine): Use NamedLineCollection.
(WebCore::lookBackForNamedGridLine): Ditto.
(WebCore::resolveNamedGridLinePositionFromStyle):
(WebCore::definiteGridSpanWithNamedLineSpanAgainstOpposite):
(WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
(WebCore::resolveGridPositionAgainstOppositePosition):
(WebCore::resolveGridPositionFromStyle):
(WebCore::GridPositionsResolver::resolveGridPositionsFromStyle):
(WebCore::gridLinesForSide): Deleted.
(WebCore::GridPositionsResolver::isNonExistentNamedLineOrArea): Deleted.

rendering/style/GridPositionsResolver.h:

2:18 AM Changeset in webkit [200367] by Joseph Pecoraro

5 edits in trunk

Unreviewed follow-up testapi fix after r200355.

Source/JavaScriptCore:

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
Revert back to non-enumerable. This matches our older behavior,
we can decide to make this Enumerable later if needed.

LayoutTests:

js/console-expected.txt:
js/console.html:

Make window.console non-enumerable.

2:09 AM Changeset in webkit [200366] by Carlos Garcia Campos

2 edits in trunk/LayoutTests

Unreviewed GTK+ gardening. Update drag and drop tests bug reference.

We were using a fixed bug, because drag and drop was already implemented in WebKit2. However, some tests still
fail because some drag and drop events are not emitted when using synthetic events like even sender does. So,
update the bug reference to https://bugs.webkit.org/show_bug.cgi?id=157179 and add two more tests that are
timing out in the bots for the same reason.

platform/gtk/TestExpectations:

1:50 AM Changeset in webkit [200365] by Carlos Garcia Campos

2 edits in trunk/Source/WebCore

Unreviewed. Fix GObject DOM bindings API break after r200316.

webkit_dom_tree_walker_set_current_node no longer raises exceptions after r200316, so mark it accordingly.

bindings/scripts/CodeGeneratorGObject.pm:

(FunctionUsedToRaiseException):

1:18 AM Changeset in webkit [200364] by Carlos Garcia Campos

4 edits in trunk/Source/WebCore

[OpenType] OpenTypeVerticalData object should not be created if the font is not OpenType
https://bugs.webkit.org/show_bug.cgi?id=157172

Reviewed by Michael Catanzaro.

It's a bit weird that the object is always created and has an isOpenType() method to check whether it's an
OpenType or not. The caller is always deleting the object when it's not an OpenType, so it would be better if
the create method returned nullptr instead of creating the object when the font is not OpenType.

platform/graphics/FontCache.cpp:

(WebCore::FontCache::verticalData): Do not use isOpenType(), we can now simply use the return value of OpenTypeVerticalData::create().

platform/graphics/opentype/OpenTypeVerticalData.cpp:

(WebCore::loadHmtxTable): Moved to a helper funtion that returns false if the font is not OpenType.
(WebCore::OpenTypeVerticalData::create): Try to load the Hmtx table, and create the object if succeeded or
return nullptr otherwise.
(WebCore::OpenTypeVerticalData::OpenTypeVerticalData): Receive the advanceWidths as constructor parameter.
(WebCore::OpenTypeVerticalData::loadMetrics): Load all other tables.

platform/graphics/opentype/OpenTypeVerticalData.h:

(WebCore::OpenTypeVerticalData::isOpenType): Deleted.

12:19 AM Changeset in webkit [200363] by bshafiei@apple.com

5 edits in tags/Safari-602.1.30.4/Source

Versioning.

12:12 AM Changeset in webkit [200362] by bshafiei@apple.com

1 copy in tags/Safari-602.1.30.4

New tag.

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed