Context Navigation

← Previous Period
Next Period →

Timeline

May 27, 2016:

10:51 PM Changeset in webkit [201482] by Chris Dumez

60 edits
1 copy in trunk/Source

callOnMainThread() should not copy captured lambda variables
https://bugs.webkit.org/show_bug.cgi?id=158166

Reviewed by Brady Eidson.

Source/WebCore:

callOnMainThread() should not copy captured lambda variables. This
function is usually called cross-thread with a lambda and copying
the lambda (and its captured variables) can lead to thread-safety
issues.

This patch updates callOnMainThread() to take a NoncopyableFunction&&
in parameter instead of a std::function. The call sites of
callOnMainThread() have also been updated to use C++14's lambda
capture with initializer.

Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::putOrAddOnServer):

Modules/mediastream/MediaDevicesRequest.cpp:

(WebCore::MediaDevicesRequest::didCompletePermissionCheck):
(WebCore::MediaDevicesRequest::didCompleteTrackSourceInfoRequest):

Modules/mediastream/MediaEndpointPeerConnection.cpp:

(WebCore::MediaEndpointPeerConnection::runTask):

Modules/mediastream/MediaEndpointPeerConnection.h:
Modules/mediastream/UserMediaRequest.cpp:

(WebCore::UserMediaRequest::constraintsValidated):
(WebCore::UserMediaRequest::userMediaAccessGranted):

Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::scheduleNodeDeletion):
(WebCore::AudioContext::isPlayingAudioDidChange):

dom/Document.cpp:

(WebCore::Document::postTask):
(WebCore::Document::pendingTasksTimerFired): Deleted.

dom/ScriptElement.cpp:

(WebCore::ScriptElement::requestScript):

fileapi/AsyncFileStream.cpp:

(WebCore::callOnFileThread):
(WebCore::AsyncFileStream::~AsyncFileStream):
(WebCore::AsyncFileStream::perform):

fileapi/AsyncFileStream.h:
fileapi/ThreadableBlobRegistry.cpp:

(WebCore::ThreadableBlobRegistry::registerFileBlobURL):
(WebCore::ThreadableBlobRegistry::registerBlobURL):
(WebCore::ThreadableBlobRegistry::registerBlobURLForSlice):
(WebCore::ThreadableBlobRegistry::blobSize):
(WebCore::ThreadableBlobRegistry::unregisterBlobURL):
(WebCore::ThreadableBlobRegistry::registerBlobURLOptionallyFileBacked): Deleted.

loader/icon/IconDatabase.cpp:

(WebCore::IconDatabase::dispatchDidImportIconURLForPageURLOnMainThread):
(WebCore::IconDatabase::dispatchDidImportIconDataForPageURLOnMainThread):

page/ResourceUsageThread.cpp:

(WebCore::ResourceUsageThread::notifyObservers):
(WebCore::ResourceUsageThread::threadBody):

page/ResourceUsageThread.h:
page/scrolling/ScrollingThread.cpp:

(WebCore::ScrollingThread::dispatch):
(WebCore::ScrollingThread::dispatchBarrier):
(WebCore::ScrollingThread::dispatchFunctionsFromScrollingThread):

page/scrolling/ScrollingThread.h:
page/scrolling/ios/ScrollingTreeIOS.cpp:

(WebCore::ScrollingTreeIOS::invalidate):
(WebCore::ScrollingTreeIOS::scrollingTreeNodeDidScroll):
(WebCore::ScrollingTreeIOS::currentSnapPointIndicesDidChange):
(WebCore::ScrollingTreeIOS::createScrollingTreeNode): Deleted.

page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:

(WebCore::ScrollingTreeFrameScrollingNodeMac::releaseReferencesToScrollerImpsOnTheMainThread):

platform/MemoryPressureHandler.cpp:

(WebCore::MemoryPressureHandler::releaseMemory):

platform/audio/ios/MediaSessionManagerIOS.mm:

(-[WebMediaSessionHelper dealloc]):
(-[WebMediaSessionHelper startMonitoringAirPlayRoutes]):
(-[WebMediaSessionHelper stopMonitoringAirPlayRoutes]):

platform/graphics/avfoundation/AudioSourceProviderAVFObjC.mm:

(WebCore::AudioSourceProviderAVFObjC::prepare):

platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:

(WebCore::MediaPlayerPrivateAVFoundation::scheduleMainThreadNotification):
(WebCore::MediaPlayerPrivateAVFoundation::dispatchNotification):

platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:

(-[WebCDMSessionAVFoundationObjCListener observeValueForKeyPath:ofObject:change:context:]):

platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:

(-[WebAVOutputDeviceMenuControllerHelper observeValueForKeyPath:ofObject:change:context:]):

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createVideoLayer):
(-[WebCoreAVFMovieObserver legibleOutput:didOutputAttributedStrings:nativeSampleBuffers:forItemTime:]):
(-[WebCoreAVFMovieObserver outputSequenceWasFlushed:]):
(-[WebCoreAVFLoaderDelegate resourceLoader:shouldWaitForLoadingOfRequestedResource:]):
(-[WebCoreAVFLoaderDelegate resourceLoader:shouldWaitForResponseToAuthenticationChallenge:]):
(-[WebCoreAVFLoaderDelegate resourceLoader:didCancelLoadingRequest:]):

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:

(WebCore::CMTimebaseEffectiveRateChangedCallback):
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::play):
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::pause):

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::scheduleDeferredTask):

platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:

(-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]):
(-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]):
(-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]):
(-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]):
(-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]):
(-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]):
(-[WebAVSampleBufferErrorListener observeValueForKeyPath:ofObject:change:context:]):
(-[WebAVSampleBufferErrorListener layerFailedToDecode:]):

platform/graphics/cg/GraphicsContextCG.cpp:

(WebCore::patternReleaseCallback):

platform/graphics/cg/PatternCG.cpp:

(WebCore::patternReleaseCallback):

platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:

(WebCore::MediaPlayerPrivateMediaFoundation::endCreatedMediaSource):
(WebCore::MediaPlayerPrivateMediaFoundation::endGetEvent):
(WebCore::MediaPlayerPrivateMediaFoundation::CustomVideoPresenter::processInputNotify):

platform/mediastream/MediaStreamPrivate.cpp:

(WebCore::MediaStreamPrivate::scheduleDeferredTask):

platform/mediastream/MediaStreamPrivate.h:
platform/mediastream/mac/AVMediaCaptureSource.h:
platform/mediastream/mac/AVMediaCaptureSource.mm:

(WebCore::AVMediaCaptureSource::scheduleDeferredTask):

platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:

(WebCore::RealtimeMediaSourceCenterMac::getMediaStreamTrackSources):

platform/mediastream/mac/WebAudioSourceProviderAVFObjC.mm:

(WebCore::WebAudioSourceProviderAVFObjC::prepare):

platform/mock/MockRealtimeMediaSourceCenter.cpp:

(WebCore::MockRealtimeMediaSourceCenter::getMediaStreamTrackSources):

platform/network/BlobResourceHandle.cpp:

(WebCore::BlobResourceHandle::start):
(WebCore::BlobResourceHandle::notifyFinish):

platform/network/DataURLDecoder.cpp:

(WebCore::DataURLDecoder::decode):

platform/network/DataURLDecoder.h:
platform/network/cocoa/WebCoreNSURLSession.mm:

(-[WebCoreNSURLSession dealloc]):
(-[WebCoreNSURLSessionDataTask cancel]):
(-[WebCoreNSURLSessionDataTask suspend]):
(-[WebCoreNSURLSessionDataTask resume]):

platform/network/curl/CurlDownload.cpp:

(WebCore::CurlDownload::didReceiveHeader):
(WebCore::CurlDownload::didReceiveData): Deleted.

Source/WebKit:

Storage/StorageAreaSync.cpp:

(WebCore::StorageAreaSync::deleteEmptyDatabase):

Storage/StorageSyncManager.cpp:

(WebCore::StorageSyncManager::dispatch):

Storage/StorageSyncManager.h:
Storage/StorageThread.cpp:

(WebCore::StorageThread::dispatch):
(WebCore::StorageThread::terminate):
(WebCore::StorageThread::releaseFastMallocFreeMemoryInAllThreads):

Storage/StorageThread.h:
Storage/StorageTracker.cpp:

(WebCore::StorageTracker::syncFileSystemAndTrackerDatabase):
(WebCore::StorageTracker::setOriginDetails):

Source/WebKit/mac:

Storage/WebDatabaseManagerClient.mm:

(DidModifyOriginData::dispatchToMainThread):
(DidModifyOriginData::DidModifyOriginData): Deleted.

Storage/WebStorageTrackerClient.mm:

(WebStorageTrackerClient::dispatchDidModifyOrigin):

Source/WTF:

WTF.xcodeproj/project.pbxproj:

wtf/FunctionDispatcher.h:
wtf/NoncopyableFunction.h:
Moved NoncopyableFunction from FunctionDispatcher.h to NoncopyableFunction.h.
Add a new operator=(nullptr_t) operator to NoncopyableFunction to match std::function, as one of the call sites needed it.

wtf/MainThread.cpp:

(WTF::functionQueue):
(WTF::dispatchFunctionsFromMainThread):
(WTF::callOnMainThread):

wtf/MainThread.h:

10:44 PM Changeset in webkit [201481] by caitp@igalia.com

54 edits
15 adds in trunk/Source

[JSC] implement async functions proposal
https://bugs.webkit.org/show_bug.cgi?id=156147

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

Adds support for async functions, proposed in https://tc39.github.io/ecmascript-asyncawait/.

On the front-end side, "await" becomes a contextual keyword when used within an async function,
which triggers parsing an AwaitExpression. "await" becomes an illegal identifier name within
these contexts. The bytecode generated from an "await" expression is identical to that generated
in a "yield" expression in a Generator, as AsyncFunction reuses generator's state machine mechanism.

There are numerous syntactic forms for language features, including a variation on ArrowFunctions,
requiring the keyword async to precede ArrowFormalParameters, and similarly, MethodDefinitions,
which are ordinary MethodDefinitions preceded by the keyword async.

An async function desugars to the following:

`
async function asyncFn() {
}

becomes:

function asyncFn() {

let generator = {

@generatorNext: function(@generator, @generatorState, @generatorValue, @generatorResumeMode) {

generator state machine stuff here

},
@generatorState: 0,
@generatorThis: this,
@generatorFrame: null

};
return @asyncFunctionResume(generator, undefined, GeneratorResumeMode::NormalMode);

}
`

@asyncFunctionResume() is similar to @generatorResume, with the exception that it will wrap the
result of invoking @generatorNext() in a Promise, and will avoid allocating an iterator result
object.

If the generator has yielded (an AwaitExpression has occurred), resumption will occur automatically
once the await-expression operand is finished, via Promise chaining.

API/JSScriptRef.cpp:

(parseScript):

CMakeLists.txt:
DerivedSources.make:
JavaScriptCore.xcodeproj/project.pbxproj:
builtins/AsyncFunctionPrototype.js: Added.

(asyncFunctionResume):

builtins/BuiltinExecutables.cpp:

(JSC::BuiltinExecutables::createExecutable):

bytecode/BytecodeList.json:
bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::finishCreation):

bytecode/UnlinkedCodeBlock.h:

(JSC::UnlinkedCodeBlock::isArrowFunction):
(JSC::UnlinkedCodeBlock::isOrdinaryArrowFunction):
(JSC::UnlinkedCodeBlock::isAsyncArrowFunction):

bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::generateUnlinkedFunctionCodeBlock):
(JSC::UnlinkedFunctionExecutable::fromGlobalCode):
(JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor):

bytecode/UnlinkedFunctionExecutable.h:
bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitNewFunctionExpressionCommon):
(JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
(JSC::BytecodeGenerator::emitNewMethodDefinition):
(JSC::BytecodeGenerator::emitNewFunction):
(JSC::BytecodeGenerator::emitLoadArrowFunctionLexicalEnvironment):

bytecompiler/BytecodeGenerator.h:

(JSC::BytecodeGenerator::makeFunction):

bytecompiler/NodesCodegen.cpp:

(JSC::FunctionNode::emitBytecode):

inspector/agents/InspectorRuntimeAgent.cpp:

(Inspector::InspectorRuntimeAgent::parse):

jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):

jit/JIT.h:
jit/JITOpcodes.cpp:

(JSC::JIT::emitNewFuncCommon):
(JSC::JIT::emit_op_new_async_func):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_async_func_exp):

jit/JITOperations.cpp:
jit/JITOperations.h:
jsc.cpp:

(runInteractive):
(printUsageStatement):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::LLINT_SLOW_PATH_DECL):

llint/LLIntSlowPaths.h:
llint/LowLevelInterpreter.asm:
parser/ASTBuilder.h:

(JSC::ASTBuilder::createAsyncFunctionBody):

parser/Keywords.table:
parser/Parser.cpp:

(JSC::Parser<LexerType>::Parser):
(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::isArrowFunctionParameters):
(JSC::Parser<LexerType>::parseAsyncFunctionSourceElements):
(JSC::Parser<LexerType>::parseStatementListItem):
(JSC::Parser<LexerType>::parseVariableDeclarationList):
(JSC::Parser<LexerType>::parseDestructuringPattern):
(JSC::Parser<LexerType>::parseStatement):
(JSC::Parser<LexerType>::parseFunctionDeclarationStatement):
(JSC::Parser<LexerType>::parseFormalParameters):
(JSC::stringForFunctionMode):
(JSC::Parser<LexerType>::parseFunctionParameters):
(JSC::Parser<LexerType>::parseFunctionInfo):
(JSC::Parser<LexerType>::parseAsyncFunctionDeclaration):
(JSC::Parser<LexerType>::parseClass):
(JSC::Parser<LexerType>::parseExpressionOrLabelStatement):
(JSC::Parser<LexerType>::parseImportClauseItem):
(JSC::Parser<LexerType>::parseImportDeclaration):
(JSC::Parser<LexerType>::parseExportDeclaration):
(JSC::Parser<LexerType>::parseAssignmentExpression):
(JSC::Parser<LexerType>::parseAwaitExpression):
(JSC::Parser<LexerType>::parseProperty):
(JSC::Parser<LexerType>::parsePropertyMethod):
(JSC::Parser<LexerType>::parseAsyncFunctionExpression):
(JSC::Parser<LexerType>::parsePrimaryExpression):
(JSC::Parser<LexerType>::parseMemberExpression):
(JSC::Parser<LexerType>::parseArrowFunctionExpression):
(JSC::Parser<LexerType>::parseUnaryExpression):
(JSC::Parser<LexerType>::printUnexpectedTokenText):

parser/Parser.h:

(JSC::isIdentifierOrKeyword):
(JSC::Scope::Scope):
(JSC::Scope::setSourceParseMode):
(JSC::Scope::isAsyncFunction):
(JSC::Scope::isAsyncFunctionBoundary):
(JSC::Scope::isModule):
(JSC::Scope::setIsFunction):
(JSC::Scope::setIsAsyncArrowFunction):
(JSC::Scope::setIsAsyncFunction):
(JSC::Scope::setIsAsyncFunctionBody):
(JSC::Scope::setIsAsyncArrowFunctionBody):
(JSC::Parser::ExpressionErrorClassifier::forceClassifyExpressionError):
(JSC::Parser::ExpressionErrorClassifier::propagateExpressionErrorClass):
(JSC::Parser::ExpressionErrorClassifier::indicatesPossibleAsyncArrowFunction):
(JSC::Parser::forceClassifyExpressionError):
(JSC::Parser::declarationTypeToVariableKind):
(JSC::Parser::closestParentOrdinaryFunctionNonLexicalScope):
(JSC::Parser::pushScope):
(JSC::Parser::popScopeInternal):
(JSC::Parser::matchSpecIdentifier):
(JSC::Parser::isDisallowedIdentifierAwait):
(JSC::Parser::disallowedIdentifierAwaitReason):
(JSC::parse):

parser/ParserModes.h:

(JSC::isFunctionParseMode):
(JSC::isAsyncFunctionParseMode):
(JSC::isAsyncArrowFunctionParseMode):
(JSC::isAsyncFunctionWrapperParseMode):
(JSC::isAsyncFunctionBodyParseMode):
(JSC::isModuleParseMode):
(JSC::isProgramParseMode):
(JSC::constructAbilityForParseMode):

parser/ParserTokens.h:
parser/SourceCodeKey.h:

(JSC::SourceCodeKey::SourceCodeKey):
(JSC::SourceCodeKey::runtimeFlags):
(JSC::SourceCodeKey::operator==):

parser/SyntaxChecker.h:

(JSC::SyntaxChecker::createAsyncFunctionBody):

runtime/AsyncFunctionConstructor.cpp: Added.

(JSC::AsyncFunctionConstructor::AsyncFunctionConstructor):
(JSC::AsyncFunctionConstructor::finishCreation):
(JSC::callAsyncFunctionConstructor):
(JSC::constructAsyncFunctionConstructor):
(JSC::AsyncFunctionConstructor::getCallData):
(JSC::AsyncFunctionConstructor::getConstructData):

runtime/AsyncFunctionConstructor.h: Added.

(JSC::AsyncFunctionConstructor::create):
(JSC::AsyncFunctionConstructor::createStructure):

runtime/AsyncFunctionPrototype.cpp: Added.

(JSC::AsyncFunctionPrototype::AsyncFunctionPrototype):
(JSC::AsyncFunctionPrototype::finishCreation):

runtime/AsyncFunctionPrototype.h: Added.

(JSC::AsyncFunctionPrototype::create):
(JSC::AsyncFunctionPrototype::createStructure):

runtime/CodeCache.cpp:

(JSC::CodeCache::getGlobalCodeBlock):
(JSC::CodeCache::getProgramCodeBlock):
(JSC::CodeCache::getEvalCodeBlock):
(JSC::CodeCache::getModuleProgramCodeBlock):
(JSC::CodeCache::getFunctionExecutableFromGlobalCode):

runtime/CodeCache.h:
runtime/CommonIdentifiers.h:
runtime/Completion.cpp:

(JSC::checkSyntax):
(JSC::checkModuleSyntax):

runtime/Completion.h:
runtime/Executable.cpp:

(JSC::ScriptExecutable::newCodeBlockFor):
(JSC::ProgramExecutable::checkSyntax):

runtime/Executable.h:
runtime/FunctionConstructor.cpp:

(JSC::constructFunctionSkippingEvalEnabledCheck):

runtime/FunctionConstructor.h:
runtime/JSAsyncFunction.cpp: Added.

(JSC::JSAsyncFunction::JSAsyncFunction):
(JSC::JSAsyncFunction::createImpl):
(JSC::JSAsyncFunction::create):
(JSC::JSAsyncFunction::createWithInvalidatedReallocationWatchpoint):

runtime/JSAsyncFunction.h: Added.

(JSC::JSAsyncFunction::allocationSize):
(JSC::JSAsyncFunction::createStructure):

runtime/JSFunction.cpp:

(JSC::JSFunction::getOwnPropertySlot):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::createProgramCodeBlock):
(JSC::JSGlobalObject::createEvalCodeBlock):
(JSC::JSGlobalObject::createModuleProgramCodeBlock):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::asyncFunctionPrototype):
(JSC::JSGlobalObject::asyncFunctionStructure):

runtime/ModuleLoaderObject.cpp:

(JSC::moduleLoaderObjectParseModule):

runtime/RuntimeFlags.h:

(JSC::RuntimeFlags::operator==):
(JSC::RuntimeFlags::operator!=):

tests/stress/async-await-basic.js: Added.

(shouldBe):
(shouldBeAsync):
(shouldThrow):
(shouldThrowAsync):
(let.AsyncFunction.async):
(async.asyncFunctionForProto):
(Object.getPrototypeOf.async):
(Object.getPrototypeOf.async.method):
(async):
(async.method):
(async.asyncNonConstructorDecl):
(shouldThrow.new.async):
(shouldThrow.new.async.nonConstructor):
(async.asyncDecl):
(async.f):
(MyError):
(async.asyncDeclThrower):
(shouldThrowAsync.async):
(resolveLater):
(rejectLater):
(async.resumeAfterNormal):
(O.async.resumeAfterNormal):
(resumeAfterNormalArrow.async):
(async.resumeAfterThrow):
(O.async.resumeAfterThrow):
(resumeAfterThrowArrow.async):
(catch):

tests/stress/async-await-module-reserved-word.js: Added.

(shouldThrow):
(SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
(checkModuleSyntaxError.String.raw.await):
(checkModuleSyntaxError.String.raw.async.await):
(SyntaxError.Cannot.declare.named):

tests/stress/async-await-mozilla.js: Added.

(shouldBe):
(shouldBeAsync):
(shouldThrow):
(shouldThrowAsync):
(assert):
(shouldThrowSyntaxError):
(mozSemantics.async.empty):
(mozSemantics.async.simpleReturn):
(mozSemantics.async.simpleAwait):
(mozSemantics.async.simpleAwaitAsync):
(mozSemantics.async.returnOtherAsync):
(mozSemantics.async.simpleThrower):
(mozSemantics.async.delegatedThrower):
(mozSemantics.async.tryCatch):
(mozSemantics.async.tryCatchThrow):
(mozSemantics.async.wellFinally):
(mozSemantics.async.finallyMayFail):
(mozSemantics.async.embedded.async.inner):
(mozSemantics.async.embedded):
(mozSemantics.async.fib):
(mozSemantics.async.isOdd.async.isEven):
(mozSemantics.async.isOdd):
(mozSemantics.hardcoreFib.async.fib2):
(mozSemantics.namedAsyncExpr.async.simple):
(mozSemantics.async.executionOrder.async.first):
(mozSemantics.async.executionOrder.async.second):
(mozSemantics.async.executionOrder.async.third):
(mozSemantics.async.executionOrder):
(mozSemantics.async.miscellaneous):
(mozSemantics.thrower):
(mozSemantics.async.defaultArgs):
(mozSemantics.shouldThrow):
(mozSemantics):
(mozMethods.X):
(mozMethods.X.prototype.async.getValue):
(mozMethods.X.prototype.setValue):
(mozMethods.X.prototype.async.increment):
(mozMethods.X.prototype.async.getBaseClassName):
(mozMethods.X.async.getStaticValue):
(mozMethods.Y.prototype.async.getBaseClassName):
(mozMethods.Y):
(mozFunctionNameInferrence.async.test):
(mozSyntaxErrors):

tests/stress/async-await-reserved-word.js: Added.

(assert):
(shouldThrowSyntaxError):
(AsyncFunction.async):

tests/stress/async_arrow_functions_lexical_arguments_binding.js: Added.

(shouldBe):
(shouldBeAsync):
(shouldThrowAsync):
(noArgumentsArrow2.async):

tests/stress/async_arrow_functions_lexical_new.target_binding.js: Added.

(shouldBe):
(shouldBeAsync):
(shouldThrowAsync):
(C1):
(C2):
(shouldThrowAsync.async):

tests/stress/async_arrow_functions_lexical_super_binding.js: Added.

(shouldBe):
(shouldBeAsync):
(BaseClass.prototype.baseClassValue):
(BaseClass):
(ChildClass.prototype.asyncSuperProp):
(ChildClass.prototype.asyncSuperProp2):
(ChildClass):

tests/stress/async_arrow_functions_lexical_this_binding.js: Added.

(shouldBe):
(shouldBeAsync):
(d.y):

Source/WebKit/mac:

WebView/WebPreferencesPrivate.h:

Source/WebKit/win:

Interfaces/IWebPreferencesPrivate.idl:

Source/WebKit2:

UIProcess/API/C/WKPreferencesRefPrivate.h:
UIProcess/API/Cocoa/WKPreferencesPrivate.h:

9:48 PM Changeset in webkit [201480] by Chris Dumez

2 edits in trunk/Source/WebKit2

Improve lambda capture in NetworkCache::Storage::synchronize()
https://bugs.webkit.org/show_bug.cgi?id=158176

Reviewed by Brady Eidson.

Improve lambda capture in NetworkCache::Storage::synchronize(). We can
now capture the std::unique_ptr<> variables directly thanks to:

C++14's support for initializer's in lambda captures
RunLoop::dispatch() now takes a NoncopyableFunction in instead of a std::function, allowing us to capture non-copyable variables.

NetworkProcess/cache/NetworkCacheStorage.cpp:

(WebKit::NetworkCache::Storage::synchronize):

9:18 PM Changeset in webkit [201479] by Yusuke Suzuki

2 edits in trunk/Source/WTF

Unreviewed, build fix for JSCOnly port.
https://bugs.webkit.org/show_bug.cgi?id=158111

Use NoncopyableFunction instead of std::function<>.

wtf/generic/RunLoopGeneric.cpp:

(WTF::RunLoop::TimerBase::ScheduledTask::create):
(WTF::RunLoop::TimerBase::ScheduledTask::ScheduledTask):

6:22 PM Changeset in webkit [201478] by timothy_horton@apple.com

2 edits in trunk/Source/WebCore

REGRESSION (r190574): Swipe snapshots are always black on iPhone 5
https://bugs.webkit.org/show_bug.cgi?id=158171
<rdar://problem/24639709>

Reviewed by Beth Dakin.

platform/graphics/cocoa/IOSurface.mm:

(optionsForBiplanarSurface):
(optionsFor32BitSurface):
(IOSurface::IOSurface):
(IOSurface::format):
We are supposed to be using bi-planar 422f, not yuvf. They're the same
size, but different formats, and 422f is supported in more places.

Clean up the IOSurface constructor so we don't have a switch inside an if
with random ASSERT_NOT_REACHED, making helper functions to build the
options dictionary for arbitrary-size biplanar and 32-bit single-planar
surfaces.

I don't know how to write a test because IOSurface is not supported
in the simulator.

5:44 PM Changeset in webkit [201477] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Not all transitively dominated nodes display their retained size
https://bugs.webkit.org/show_bug.cgi?id=158174

Patch by Joseph Pecoraro <Joseph Pecoraro> on 2016-05-27
Reviewed by Timothy Hatcher.

UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:

(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._isDominatedByNonBaseParent):
Use the parent reference changing in the loop instead of always using the same parent.

5:07 PM Changeset in webkit [201476] by Alan Bujtas

5 edits
2 adds in trunk

EventHandler finds incorrect scrollable container.
https://bugs.webkit.org/show_bug.cgi?id=158132
<rdar://problem/26423126>

Reviewed by Brent Fulgham.

Fix the logic that checks whether we are at the beginning or at the end of the container (horizontally).
While scrolling to the right, deltaX has negative values. So in case of deltaX < 0, we need to check if
the container is not scrolled all the way to the right.

Source/WebCore:

Test: fast/scrolling/scroll-container-horizontally.html

page/mac/EventHandlerMac.mm:

(WebCore::findEnclosingScrollableContainer):

LayoutTests:

fast/scrolling/scroll-container-horizontally-expected.txt: Added.
fast/scrolling/scroll-container-horizontally.html: Added.
platform/ios-simulator/TestExpectations:
platform/mac-wk1/TestExpectations:

5:06 PM Changeset in webkit [201475] by commit-queue@webkit.org

10 edits
2 copies
1 add in trunk/Tools

Display failing JSC stress tests in buildbot dashboard
https://bugs.webkit.org/show_bug.cgi?id=156595

Patch by Srinivasan Vijayaraghavan <svijayaraghavan@apple.com> on 2016-05-27
Reviewed by Alexey Proskuryakov.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/Buildbot.js:

(Buildbot.prototype.javaScriptCoreTestFailuresURLForIteration):
(Buildbot.prototype.javaScriptCoreTestStdioUrlForIteration):

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotCombinedQueueView.js:

(BuildbotCombinedQueueView.prototype.update):

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotIteration.js:

(BuildbotIteration):
(BuildbotIteration.prototype._parseData):
(BuildbotIteration.prototype.loadLayoutTestResults):
(BuildbotIteration.prototype.):
(BuildbotIteration.prototype.loadJavaScriptCoreTestResults):

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotQueueView.js:

(BuildbotQueueView.prototype._createLoadingIndicator):
(BuildbotQueueView.prototype.):
(BuildbotQueueView.prototype._onPopoverCopy):
(BuildbotQueueView.prototype._popoverContentForJavaScriptCoreTestRegressions):
(BuildbotQueueView.prototype._presentPopoverForJavaScriptCoreTestRegressions):
(BuildbotQueueView.prototype._addIterationHeadingToPopover):
(BuildbotQueueView.prototype._testStepFailureDescription):
(BuildbotQueueView.prototype._testStepFailureDescriptionWithCount):

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotTestResults.js:

(BuildbotTestResults.prototype.addJavaScriptCoreTestFailures):

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/BuildbotTesterQueueView.js:

(BuildbotTesterQueueView.prototype.appendBuilderQueueStatus):
(BuildbotTesterQueueView.prototype.update):
(BuildbotTesterQueueView.prototype._popoverContentForLayoutTestRegressions):
(BuildbotTesterQueueView.prototype._presentPopoverForLayoutTestRegressions):
(BuildbotTesterQueueView.prototype._testStepFailureDescription): Deleted.
(BuildbotTesterQueueView.prototype._testStepFailureDescriptionWithCount): Deleted.
(BuildbotTesterQueueView.prototype.): Deleted.
(BuildbotTesterQueueView.prototype.content.oncopy): Deleted.

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/index.html:
BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/resources/MockBuildbot.js: Copied from Tools/BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/resources/MockBuildbotQueue.js.

(MockBuildbot):
(MockBuildbot.prototype.buildPageURLForIteration):
(MockBuildbot.prototype.javaScriptCoreTestFailuresURLForIteration):
(MockBuildbot.prototype.javaScriptCoreTestStdioUrlForIteration):

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/resources/MockBuildbotQueue.js:

(MockBuildbotQueue):

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/resources/MockBuildbotTestResults.js: Copied from Tools/BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/resources/MockBuildbotQueue.js.

(MockBuildbotTestResults):
(MockBuildbotTestResults.prototype.addJavaScriptCoreTestFailures):

BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/resources/test-jsc-results.json: Added.
BuildSlaveSupport/build.webkit.org-config/public_html/dashboard/Scripts/tests/resources/tests.js:

4:58 PM Changeset in webkit [201474] by commit-queue@webkit.org

23 edits in trunk/Source

Decrease flicker when changing video presentation mode.
https://bugs.webkit.org/show_bug.cgi?id=158148
rdar://problem/24476949

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-05-27
Source/WebCore:

Reviewed by Jer Noble.

No new tests because there is no behavior change. This change is about the timing of
moving AVPlayerLayers between layers to prevent flicker.

1) Moving an AVPlayerLayer between CAContexts can flicker. So always keep two
AVPlayerLayers around and add and remove them from the inline and fullscreen contexts.
2) Wait to show the inline placeholder until the fullscreen video layer has been installed.
3) Wait to remove the fullscreen video layer until the placeholder has been removed.

Modules/mediacontrols/MediaControlsHost.cpp:

(WebCore::MediaControlsHost::isVideoLayerInline): Expose isVideoLayerInline to the shadow DOM.
(WebCore::MediaControlsHost::setPreparedForInline): Expose setPreparedForInline to the shadow DOM.

Modules/mediacontrols/MediaControlsHost.h: Add setPreparedForInline and isVideoLayerInline
Modules/mediacontrols/MediaControlsHost.idl: Add setPreparedForInline and isVideoLayerInline
Modules/mediacontrols/mediaControlsApple.js:

(Controller.prototype.showInlinePlaybackPlaceholderWhenSafe): Wait to show placeholder when entering fullscreen.
(Controller.prototype.handlePresentationModeChange): Wait to show placeholder, and notify when placeholder is removed.

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::setPreparedForInline):
(WebCore::HTMLMediaElement::waitForPreparedForInlineThen): Used to delay fullscreen cleanup until placeholder is removed.
(WebCore::HTMLMediaElement::setVideoFullscreenLayer): Add a callback so we can wait until this completes before continuing.

html/HTMLMediaElement.h:

(WebCore::HTMLMediaElement::isVideoLayerInline):
(WebCore::HTMLMediaElement::waitForPreparedForInlineThen):
(WebCore::HTMLMediaElement::setVideoFullscreenLayer): Add completionHandler.

platform/cocoa/WebVideoFullscreenModelVideoElement.h:

(WebCore::WebVideoFullscreenModelVideoElement::setVideoFullscreenLayer): Add completionHandler.
(WebCore::WebVideoFullscreenModelVideoElement::waitForPreparedForInlineThen): Added.

platform/cocoa/WebVideoFullscreenModelVideoElement.mm:

(WebVideoFullscreenModelVideoElement::setVideoFullscreenLayer): Add completionHandler.
(WebVideoFullscreenModelVideoElement::waitForPreparedForInlineThen):

platform/graphics/MediaPlayer.cpp:

(WebCore::MediaPlayer::setVideoFullscreenLayer): Add completionHandler.

platform/graphics/MediaPlayer.h:

(WebCore::MediaPlayer::setVideoFullscreenLayer): Add completionHandler.

platform/graphics/MediaPlayerPrivate.h:

(WebCore::MediaPlayerPrivateInterface::setVideoFullscreenLayer): Add completionHandler.

platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer): Create two video layers.
(WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer): Allow two video layers.
(WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer): Add completionHandler.
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoLayerGravity): Allow two video layers.

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::addDisplayLayer): Allow two video layers.
(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setVideoFullscreenLayer): Add completionHandler.

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::createPreviewLayers): Allow two video layers.
(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVideoFullscreenLayer): Add completionHandler.

platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.h:
platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.mm:

(WebCore::VideoFullscreenLayerManager::setVideoLayers): Allow two video layers.
(WebCore::VideoFullscreenLayerManager::setVideoFullscreenLayer): Add completionHandler.
(WebCore::VideoFullscreenLayerManager::setVideoFullscreenFrame): Allow two video layers.
(WebCore::VideoFullscreenLayerManager::didDestroyVideoLayer): Allow two video layers.
(WebCore::VideoFullscreenLayerManager::setVideoLayer): Deleted.

platform/ios/WebVideoFullscreenControllerAVKit.mm:

(WebVideoFullscreenControllerContext::didSetupFullscreen): Use completionHandler.
(WebVideoFullscreenControllerContext::didExitFullscreen): Use completionHandler.

Source/WebKit2:

Reviewed by Tim Horton.

Prevent flicker by using setVideoFullscreenLayer with a completion handler to delay
enter fullscreen and cleanup fullscreen until the video layer has completely been
installed or removed.

WebProcess/cocoa/WebVideoFullscreenManager.mm:

(WebKit::WebVideoFullscreenManager::didSetupFullscreen):
(WebKit::WebVideoFullscreenManager::didExitFullscreen):

4:42 PM Changeset in webkit [201473] by sbarati@apple.com

3 edits
3 adds in trunk

DebuggerCallFrame crashes when updated with the globalExec because neither ShadowChicken's algorithm nor StackVisitor's algorithm reasons about the globalExec
https://bugs.webkit.org/show_bug.cgi?id=158104

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

I think globalExec is a special enough case that it should be handled
at the layers above ShadowChicken and StackVisitor. Those APIs should
deal with real stack frames on the machine stack, not a heap constructed frame.

This patch makes DebuggerCallFrame::create aware that it may be
created with the globalObject->globalExec() by having it construct
a single DebuggerCallFrame that wraps the globalExec.

This fixes a crasher because we will construct a DebuggerCallFrame
with the globalExec when the Inspector is set to pause on all uncaught
exceptions and the JS program has a syntax error. Because the program
hasn't begun execution, there is no machine JS stack frame yet. So
DebuggerCallFrame is created with globalExec, which will cause it
to hit an assertion that dictates that the stack have size greater
than zero.

debugger/DebuggerCallFrame.cpp:

(JSC::DebuggerCallFrame::create):

LayoutTests:

inspector/debugger/breakpoint-syntax-error-top-level-expected.txt: Added.
inspector/debugger/breakpoint-syntax-error-top-level.html: Added.
inspector/debugger/resources/file-with-syntax-error.js: Added.

4:34 PM Changeset in webkit [201472] by Brent Fulgham

2 edits in trunk/LayoutTests

Unreviewed test fix after r201468.

Correct output handling to reduce flakiness on test bots.

http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html:

3:31 PM Changeset in webkit [201471] by rniwa@webkit.org

15 edits
2 adds in trunk

Crash in TreeScope::focusedElement
https://bugs.webkit.org/show_bug.cgi?id=158108

Reviewed by Enrica Casucci.

Source/WebCore:

The bug was caused by a flawed sequence of steps we took to remove an element. When an element is removed,
willRemoveChild and willRemoveChildren fire blur events on removed focused element and its ancestors and
unload event on any removed iframes. However, it was possible to focus an element on which we had fired blur
during an unload event, leaving m_focusedElement point to an element that's not in the document anymore.

Changing the order doesn't help because that would make it possible to insert the removed iframes back into
the document inside a event listener of the blur event, which was specifically fixed by r127534 four years ago.

Instead, fix the bug by not firing blur and change events on removed nodes. New behavior matches Firefox and HTML5
specification: https://html.spec.whatwg.org/multipage/interaction.html#focus-fixup-rule-one

Test: fast/shadow-dom/shadow-root-active-element-crash.html

dom/ContainerNode.cpp:

(WebCore::willRemoveChild): Made this function static local since it didn't need to have access to any private
member variables. Call Document::nodeWillBeRemoved after disconnecting iframes since unload event handler could
allocate new Ranges just like mutation events.
(WebCore::willRemoveChildren): Ditto.
(WebCore::ContainerNode::removeChild): Removed the calls to removeFullScreenElementOfSubtree and
removeFocusedNodeOfSubtree as they're now called in Document::nodeWillBeRemoved.
(WebCore::ContainerNode::removeChildren): Ditto.

dom/ContainerNode.h:
dom/Document.cpp:

(WebCore::Document::removeFocusedNodeOfSubtree): Don't dispatch blur and change events when a node is removed.
(WebCore::Document::setFocusedElement): Added FocusRemovalEventsMode as the third argument. Avoid dispatching blur
and change events when FocusRemovalEventsMode::Dispatch is set.
(WebCore::Document::nodeChildrenWillBeRemoved): Added calls to removeFullScreenElementOfSubtree and
removeFocusedNodeOfSubtree. Also assert that no events are fired within this function. If we ever fire an event here,
"unloaded" iframes can be inserted back into a document before ContainerNode::removeChild actually removes them.
(WebCore::Document::nodeWillBeRemoved): Ditto.

dom/Document.h:
dom/TreeScope.cpp:

(WebCore::TreeScope::focusedElement): Added a release assertion to make sure the focused element is in the document
of the tree scope, and added an explicit type check just in case.

LayoutTests:

Added a regression test for accessing shadowRoot.activeElement after re-focusing an element
inside DOMNodeRemovedFromDocument event and unload events.

This patch also restores the expected result of fast/events/onblur-remove.html to that of when
the test was in r15720 and updated in r19014. The expected result was changed in r85495 as it was
converted to a eventSender test.

fast/dom/Range/range-created-during-remove-children-expected.txt:
fast/dom/Range/range-created-during-remove-children.html: Update the test to use unload event

of an iframe since we no longer fire blur event when removing a focused element.

fast/dom/adopt-node-prevented-expected.txt:
fast/dom/adopt-node-prevented.html: Ditto.
fast/dom/remove-body-during-body-replacement2.html: Ditto. Use DOMNodeRemoved instead.
fast/events/nested-event-remove-node-crash.html: Ditto. Use DOMNodeRemovedFromDocument instead.
fast/events/onblur-remove-expected.txt:
fast/events/onblur-remove.html: See above.
fast/shadow-dom/shadow-root-active-element-crash-expected.txt: Added.
fast/shadow-dom/shadow-root-active-element-crash.html: Added.

3:29 PM Changeset in webkit [201470] by fpizlo@apple.com

3 edits
1 add in trunk/Source/JavaScriptCore

DFG::LazyJSValue::tryGetStringImpl() crashes for empty values
https://bugs.webkit.org/show_bug.cgi?id=158170

Reviewed by Michael Saboff.

The problem here is that jsDynamicCast<>() is evil! It avoids checking for the empty
value, presumably because this makes it soooper fast. In DFG IR, empty values can appear
anywhere because of TDZ.

This patch doesn't change jsDynamicCast<>(), but it hardens our wrappers for it in the DFG
and it has the affected code use one of those wrappers.

dfg/DFGFrozenValue.h:

(JSC::DFG::FrozenValue::dynamicCast): Harden this.
(JSC::DFG::FrozenValue::cast):

dfg/DFGLazyJSValue.cpp:

(JSC::DFG::LazyJSValue::tryGetStringImpl): Use the hardened wrapper.

tests/stress/strcat-emtpy.js: Added. This used to crash every time.

(foo):
(i.catch):

2:42 PM Changeset in webkit [201469] by matthew_hanson@apple.com

5 edits in tags/Safari-602.1.34.1/Source

Versioning

1:50 PM Changeset in webkit [201468] by Brent Fulgham

6 edits in trunk

CSP: Fire 'load' events even when blocking loads via 'frame-src'.
https://bugs.webkit.org/show_bug.cgi?id=153150
<rdar://problem/24383162>

Reviewed by Daniel Bates.

Source/WebCore:

Always fire a load event, even when the load is blocked by CSP rules, so that
attackers cannot gain knowledge about the URL in the frame by blocking the
load and waiting long enough to be sure that a 'load' event would have
fired if the load wasn't blocked.

Inspired by Blink patch:
<https://src.chromium.org/viewvc/blink?view=rev&revision=165743>

Tests: http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load.html

loader/PolicyChecker.cpp:

(WebCore::PolicyChecker::checkNavigationPolicy):

LayoutTests:

TestExpectations: Unskip the cross-origin load test.
http/tests/security/contentSecurityPolicy/frame-src-cross-origin-load-expected.txt: Update to match

our message format.

1:45 PM Changeset in webkit [201467] by fpizlo@apple.com

3 edits
2 adds in trunk/Source/JavaScriptCore

regExpProtoFuncSplitFast should OOM before it swaps
https://bugs.webkit.org/show_bug.cgi?id=158157

Reviewed by Mark Lam.

This is a huge speed-up on some jsfunfuzz test cases because it makes us realize much
sooner that running a regexp split will result in swapping. It uses the same basic
approach as http://trac.webkit.org/changeset/201451: if the result array crosses a certain
size threshold, we proceed with a dry run to see how big the array will get before
allocating anything else. This way, bogus uses of split that would have OOMed only after
killing the user's machine will now OOM before killing the user's machine.

This is an enormous speed-up on some jsfunfuzz tests: they go from running for a long
time to running instantly.

runtime/RegExpPrototype.cpp:

(JSC::advanceStringIndex):
(JSC::genericSplit):
(JSC::regExpProtoFuncSplitFast):

runtime/StringObject.h:

(JSC::jsStringWithReuse):
(JSC::jsSubstring):

tests/stress/big-split-captures.js: Added.
tests/stress/big-split.js: Added.

1:32 PM Changeset in webkit [201466] by akling@apple.com

2 edits in trunk/Source/WebCore

Document abandons its EventTargetData.
<https://webkit.org/b/158158>

Reviewed by Darin Adler.

Node::willBeDeletedFrom() is called when destroying all Node types *except* Document.
If a Document had an associated EventTargetData, it would not get cleaned up.

This patch moves the EventTargetData cleanup to ~Node() where it's guaranteed to run.

dom/Node.cpp:

(WebCore::Node::~Node):
(WebCore::Node::willBeDeletedFrom):

1:26 PM Changeset in webkit [201465] by sbarati@apple.com

4 edits
3 adds in trunk

ShadowChicken/DebuggerCallFrame don't properly handle when the entry stack frame is a tail deleted frame
https://bugs.webkit.org/show_bug.cgi?id=158131

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

There were bugs both in DebuggerCallFrame and ShadowChicken when the entry stack
frame(s) are tail deleted.

DebuggerCallFrame had an assertion saying that the entry frame shouldn't be
tail deleted. This is clearly wrong. The following program proves that this assertion
was misguided:
`
"use strict";
setTimeout(function foo() { return bar(); }, 0);
`

ShadowChicken had a very subtle bug when creating the shadow stack when
the entry frames of the stack were tail deleted. Because it places frames into its shadow
stack by walking the machine frame and looking up entries in the log,
the machine frame doesn't have any notion of those tail deleted frames
at the entry of execution. ShadowChicken would never find those frames
because it would look for tail deleted frames *before* consulting the
current machine frame. This is wrong because if the entry frames
are tail deleted, then there is no machine frame for them because there
is no machine frame before them! Therefore, we must search for tail deleted
frames *after* consulting a machine frame. This is sound because we will always
have at least one machine frame on the stack (when we are using StackVisitor on a valid ExecState).
So when we consult the machine frame that is the entry frame on the machine stack,
we will search for tail deleted frames that come before it in the shadow stack.
This will allow us to find those tail deleted frames that are the entry frames
for the shadow stack.

debugger/DebuggerCallFrame.cpp:

(JSC::DebuggerCallFrame::create):

interpreter/ShadowChicken.cpp:

(JSC::ShadowChicken::Packet::dump):
(JSC::ShadowChicken::update):
(JSC::ShadowChicken::dump):

LayoutTests:

inspector/debugger/resources/tail-deleted-frames-from-vm-entry.js: Added.

(timeout):
(bar):

inspector/debugger/tail-deleted-frames-from-vm-entry-expected.txt: Added.
inspector/debugger/tail-deleted-frames-from-vm-entry.html: Added.

1:22 PM Changeset in webkit [201464] by Chris Dumez

26 edits in trunk

WorkQueue::dispatch() / RunLoop::dispatch() should not copy captured lambda variables
https://bugs.webkit.org/show_bug.cgi?id=158111

Reviewed by Darin Adler.

WorkQueue::dispatch() / RunLoop::dispatch() should not copy captured lambda variables.
These are often used cross-thread and copying the captured lambda variables can be
dangerous (e.g. we do not want to copy a String after calling isolatedCopy() upon
capture).

Source/JavaScriptCore:

runtime/Watchdog.cpp:

(JSC::Watchdog::startTimer):
(JSC::Watchdog::Watchdog): Deleted.
(JSC::Watchdog::setTimeLimit): Deleted.

runtime/Watchdog.h:

Source/WebKit2:

NetworkProcess/NetworkProcess.cpp:

(WebKit::clearDiskCacheEntries):

NetworkProcess/cache/NetworkCache.cpp:

(WebKit::NetworkCache::Cache::clear):

NetworkProcess/cache/NetworkCacheIOChannelSoup.cpp:

(WebKit::NetworkCache::runTaskInQueue):

Platform/IPC/Connection.cpp:

(IPC::Connection::processIncomingMessage):

UIProcess/Storage/StorageManager.cpp:

(WebKit::StorageManager::getSessionStorageOrigins):
(WebKit::StorageManager::deleteSessionStorageOrigins):
(WebKit::StorageManager::deleteSessionStorageEntriesForOrigins):
(WebKit::StorageManager::getLocalStorageOrigins):
(WebKit::StorageManager::getLocalStorageOriginDetails):
(WebKit::StorageManager::deleteLocalStorageOriginsModifiedSince):
(WebKit::StorageManager::deleteLocalStorageEntriesForOrigins):

UIProcess/Storage/StorageManager.h:

Source/WTF:

This patch introduces a new NoncopyableFunction type that behaves similarly to
std::function but guarantees that the passed-in lambda (and its captured variables)
cannot be copied. This new NoncopyableFunction type is now used for
WorkQueue / RunLoop's dispatch() / dispatchAfter() which are commonly used
cross-thread. This should now allow us to call WorkQueue::dispatch() with a lambda
that captures a String like so:
[str = str.isolatedCopy()]() { }

Also note that even though this is not leveraged in this patch, NoncopyableFunction
would allow us to capture move-only types such as std::unique_ptr as so:
[p = WTFMove(p)]() { }
This does not work if we convert the lambda into an std::function because
std::function requires the lambda to be copyable, NoncopyableFunction does not.

wtf/FunctionDispatcher.h:

(WTF::CallableWrapperBase::~CallableWrapperBase):
(WTF::NoncopyableFunction::NoncopyableFunction):
(WTF::NoncopyableFunction::operator()):
(WTF::NoncopyableFunction::operator bool):
(WTF::NoncopyableFunction::operator=):

wtf/RunLoop.cpp:

(WTF::RunLoop::performWork):
(WTF::RunLoop::dispatch):

wtf/RunLoop.h:
wtf/WorkQueue.h:
wtf/cocoa/WorkQueueCocoa.cpp:

(WTF::WorkQueue::dispatch):
(WTF::WorkQueue::dispatchAfter):

wtf/efl/DispatchQueueWorkItemEfl.h:

(WorkItem::WorkItem):
(TimerWorkItem::create):
(TimerWorkItem::TimerWorkItem):

wtf/efl/WorkQueueEfl.cpp:

(WTF::WorkQueue::dispatch):
(WTF::WorkQueue::dispatchAfter):

wtf/generic/RunLoopGeneric.cpp:

(WTF::RunLoop::dispatchAfter):

wtf/generic/WorkQueueGeneric.cpp:

(WorkQueue::dispatch):
(WorkQueue::dispatchAfter):

wtf/glib/RunLoopGLib.cpp:

(WTF::DispatchAfterContext::DispatchAfterContext):
(WTF::RunLoop::dispatchAfter):

wtf/win/WorkItemWin.cpp:

(WTF::WorkItemWin::WorkItemWin):
(WTF::WorkItemWin::create):
(WTF::HandleWorkItem::HandleWorkItem):
(WTF::HandleWorkItem::createByAdoptingHandle):

wtf/win/WorkItemWin.h:

(WTF::WorkItemWin::function):

wtf/win/WorkQueueWin.cpp:

(WTF::WorkQueue::dispatch):
(WTF::WorkQueue::timerCallback):
(WTF::WorkQueue::dispatchAfter):

Tools:

WebKitTestRunner/TestController.cpp:

(WTR::TestController::decidePolicyForNavigationAction):

1:14 PM Changeset in webkit [201463] by Ryan Haddad

3 edits in trunk/Source/WebCore

Attempt to fix the iOS build.

Unreviewed build fix.

platform/graphics/cocoa/TextTrackRepresentationCocoa.mm:
platform/ios/WebVideoFullscreenInterfaceAVKit.mm:

(-[WebAVPlayerLayer layoutSublayers]):

12:50 PM Changeset in webkit [201462] by Konstantin Tokarev

2 edits in trunk/Source/JavaScriptCore

Removed unused headers from ExecutableAllocatorFixedVMPool.cpp.
https://bugs.webkit.org/show_bug.cgi?id=158159

Reviewed by Darin Adler.

jit/ExecutableAllocatorFixedVMPool.cpp:

12:45 PM Changeset in webkit [201461] by beidson@apple.com

5 edits
3 adds in trunk

Modern IDB: After closing a Netflix video, trying to watch it again fails.
<rdar://problem/25092473> and https://bugs.webkit.org/show_bug.cgi?id=158160

Reviewed by Alex Christensen.

Source/WebCore:

New APITest: IndexedDB.WebProcessKillIDBCleanup

Modules/indexeddb/IDBTransaction.cpp:

(WebCore::IDBTransaction::stop):

Modules/indexeddb/server/UniqueIDBDatabase.cpp:

(WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient): All active transactions need to be aborted

(without callback, since there's no connection to callback to).

(WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction):

Tools:

TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
TestWebKitAPI/Tests/WebKit2Cocoa/WebProcessKillIDBCleanup-1.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/WebProcessKillIDBCleanup-2.html: Added.
TestWebKitAPI/Tests/WebKit2Cocoa/WebProcessKillIDBCleanup.mm: Added.

12:22 PM Changeset in webkit [201460] by matthew_hanson@apple.com

2 edits in tags/Safari-602.1.34.1/Source/WebKit2

Merge r201453. rdar://problem/26502712

12:08 PM Changeset in webkit [201459] by matthew_hanson@apple.com

1 copy in tags/Safari-602.1.34.1

New Tag.

12:08 PM Changeset in webkit [201458] by jdiggs@igalia.com

5 edits in trunk

AX: [ATK] accessibility/gtk/no-notification-for-unrendered-iframe-children.html began failing after r201416
https://bugs.webkit.org/show_bug.cgi?id=158152

Reviewed by Chris Fleizach.

The failure is actually a bug fix because only one child is being added, but two
notifications were being emitted. Now there is only one notification. To verify
this was the case, we really should examine the child reportedly being added. That
child is the ATK event's any_data, so pass along that child to the listener.

Tools:

WebKitTestRunner/InjectedBundle/atk/AccessibilityNotificationHandlerAtk.cpp:

LayoutTests:

The failing test and associated expectations were modified to remove the duplicate
notification and include the title of the added child for the notification we get.

accessibility/gtk/no-notification-for-unrendered-iframe-children.html: Updated.
accessibility/gtk/no-notification-for-unrendered-iframe-children-expected.txt: Updated.

11:50 AM Changeset in webkit [201457] by achristensen@apple.com

8 edits in trunk

Expose content extension failure error codes in SPI
https://bugs.webkit.org/show_bug.cgi?id=158095
rdar://problem/26475651

Reviewed by Anders Carlsson.

Source/WebKit2:

UIProcess/API/APIUserContentExtensionStore.cpp:

(API::UserContentExtensionStore::synchronousRemoveAllContentExtensions):
(API::UserContentExtensionStore::invalidateContentExtensionVersion):
Added for testing.
(API::userContentExtensionStoreErrorCategory):

UIProcess/API/APIUserContentExtensionStore.h:
UIProcess/API/Cocoa/_WKUserContentExtensionStore.h:

Added the new enum, _WKUserContentExtensionStoreErrorCode.

UIProcess/API/Cocoa/_WKUserContentExtensionStore.mm:

(-[_WKUserContentExtensionStore compileContentExtensionForIdentifier:encodedContentExtension:completionHandler:]):
Sometimes the error code returned by UserContentExtensionStore::compileContentExtension has the error code from compileRuleList.
When this happens, we want to get the message from the internal compiler error, but we want the NSError's code to always be CompileFailed.
(-[_WKUserContentExtensionStore lookupContentExtensionForIdentifier:completionHandler:]):
(-[_WKUserContentExtensionStore removeContentExtensionForIdentifier:completionHandler:]):
(-[_WKUserContentExtensionStore _removeAllContentExtensions]):
(-[_WKUserContentExtensionStore _invalidateContentExtensionVersionForIdentifier:]):

UIProcess/API/Cocoa/_WKUserContentExtensionStorePrivate.h:

Added new invalidator for testing.

Tools:

TestWebKitAPI/Tests/WebKit2Cocoa/_WKUserContentExtensionStore.mm:

(checkDomain):
(TEST_F):
Add tests that use the new enum.

11:36 AM Changeset in webkit [201456] by keith_miller@apple.com

12 edits in trunk/Source/JavaScriptCore

get_by_id should support caching unset properties in the LLInt
https://bugs.webkit.org/show_bug.cgi?id=158136

Reviewed by Benjamin Poulain.

Recently, we started supporting prototype load caching for get_by_id
in the LLInt. This patch extends that to caching unset properties.
While it is uncommon in general for a program to see a single structure
without a given property, the Array.prototype.concat function needs to
lookup the Symbol.isConcatSpreadable property. For any existing code
That property will never be set as it did not exist prior to ES6.

Similarly to the get_by_id_proto_load bytecode, this patch adds a new
bytecode, get_by_id_unset that checks the structureID of the base and
assigns undefined to the result.

There are no new tests here since we already have many tests that
incidentally cover this change.

bytecode/BytecodeList.json:
bytecode/BytecodeUseDef.h:

(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::printGetByIdOp):
(JSC::CodeBlock::dumpBytecode):
(JSC::CodeBlock::finalizeLLIntInlineCaches):

bytecode/GetByIdStatus.cpp:

(JSC::GetByIdStatus::computeFromLLInt):

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGCapabilities.cpp:

(JSC::DFG::capabilityLevel):

jit/JIT.cpp:

(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::setupGetByIdPrototypeCache):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):

llint/LLIntSlowPaths.h:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:

11:35 AM Changeset in webkit [201455] by adam.bergkvist@ericsson.com

9 edits
1 add in trunk

WebRTC: Update RTCPeerConnection overloaded legacy operations to return a Promise
https://bugs.webkit.org/show_bug.cgi?id=158114

Reviewed by Eric Carlson.

Source/WebCore:

Update overloaded operations so that the legacy callback versions also return a promise
and never throw [1].

[1] https://w3c.github.io/webrtc-pc/archives/20160513/webrtc.html#legacy-interface-extensions

Updated existing tests.

fast/mediastream/RTCPeerConnection-overloaded-operations-params.html
fast/mediastream/RTCPeerConnection-overloaded-operations.html

Modules/mediastream/RTCPeerConnection.idl:

Updated legacy signatures (just for documentation purposes)

Modules/mediastream/RTCPeerConnection.js:

Implements the promise overload and the legacy callbacks overload (using the promise version)
as specified in [1] (above).
(createOffer):
(createAnswer):
(setLocalDescription):
(setRemoteDescription):
(addIceCandidate):
(getStats):

Modules/mediastream/RTCPeerConnectionInternals.js:

Added helper functions objectAndCallbacksOverload and callbacksAndDictionaryOverload that
process an argument list and determine which overloaded version to use.
(callbacksAndDictionaryOverload):
(setLocalOrRemoteDescription): Deleted.
(extractCallbackArg): Deleted.

LayoutTests:

Updated existing tests (see below).

fast/mediastream/RTCPeerConnection-overloaded-operations-expected.txt:
fast/mediastream/RTCPeerConnection-overloaded-operations-params-expected.txt:
fast/mediastream/RTCPeerConnection-overloaded-operations-params.html:

Test various combinations of good and bad arguments and verify that no errors are thrown.

fast/mediastream/RTCPeerConnection-overloaded-operations.html:

Test that all overloaded versions return a promise.

fast/mediastream/resources/promise-utils.js: Added.

Shared utils to make it easier to test async promise APIs.
(ensurePromise):
(promiseShouldReject):
(promiseShouldNotRejectWithTypeError.):

11:33 AM Changeset in webkit [201454] by commit-queue@webkit.org

2 edits in trunk/Source/WebInspectorUI

Web Inspector: Add indicators to show nesting levels inside DOM Tree
https://bugs.webkit.org/show_bug.cgi?id=157468
<rdar://problem/26162640>

Patch by Devin Rousso <Devin Rousso> on 2016-05-27
Reviewed by Timothy Hatcher.

Add CSS rules to give all expanded node children lists a small line on the
left border indicating that all items under the line are descendants.

UserInterface/Views/DOMTreeOutline.css:

(.tree-outline.dom li .selection):
(.tree-outline.dom li > span):
(.tree-outline.dom ol):
(.tree-outline.dom .tree-outline.dom li:matches(.hovered, .selected) + ol.children.expanded):
(.tree-outline.dom li.selected + ol.children.expanded):
(.tree-outline.dom li.parent::before):

10:09 AM Changeset in webkit [201453] by Alan Bujtas

2 edits in trunk/Source/WebKit2

Regression(r200972): Webcore::Range::collectSelectionsRects() asserts in startContainer() while selecting text.
https://bugs.webkit.org/show_bug.cgi?id=158155
<rdar://problem/26502712>

Reviewed by Chris Dumez.

This patch ensures that we still have a valid paragraphRange after returning from enclosingTextUnitOfGranularity().

WebProcess/WebPage/ios/WebPageIOS.mm:

(WebKit::WebPage::selectTextWithGranularityAtPoint):

9:05 AM Changeset in webkit [201452] by Konstantin Tokarev

2 edits
2 deletes in trunk/Source/bmalloc

[cmake] Deduplicated bmalloc/Zone.cpp handling.
https://bugs.webkit.org/show_bug.cgi?id=158154

Reviewed by Alex Christensen.

File bmalloc/Zone.cpp is required on Darwin irrespectively from what
port is being built.

Also I removed WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS() because it's
unlikely that bmalloc will ever need port-specific customizations (as
opposed to OS-specific customizations which should be done in
CMakeLists.txt).

CMakeLists.txt: Added bmalloc/Zone.cpp for Darwin.
PlatformGTK.cmake: Removed.
PlatformMac.cmake: Removed.

7:59 AM Changeset in webkit [201451] by fpizlo@apple.com

7 edits
2 adds in trunk/Source/JavaScriptCore

Bogus uses of regexp matching should realize that they will OOM before they start swapping
https://bugs.webkit.org/show_bug.cgi?id=158142

Reviewed by Michael Saboff.

Refactored the RegExpObject::matchGlobal() code so that there is less duplication. Took
advantage of this to make the code more resilient in case of absurd situations: if the
result array gets large, it proceeds with a dry run to detect how many matches there will
be. This allows it to OOM before it starts swapping.

This also improves the overall performance of the code by using lightweight substrings and
skipping the whole intermediate argument array.

This makes some jsfunfuzz tests run a lot faster and use a lot less memory.

builtins/RegExpPrototype.js:
CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
runtime/MatchResult.cpp: Added.

(JSC::MatchResult::dump):

runtime/MatchResult.h:

(JSC::MatchResult::empty):
(MatchResult::empty): Deleted.

runtime/RegExpObject.cpp:

(JSC::RegExpObject::match):
(JSC::collectMatches):
(JSC::RegExpObject::matchGlobal):

runtime/StringObject.h:

(JSC::jsStringWithReuse):
(JSC::jsSubstring):

tests/stress/big-match.js: Added. Make sure that this optimization doesn't break big matches.

6:51 AM Changeset in webkit [201450] by commit-queue@webkit.org

3 edits
3 adds in trunk

Video play glyph not visible if initially invisible when contained in a "-webkit-overflow-scrolling: touch" container
https://bugs.webkit.org/show_bug.cgi?id=158146
<rdar://problem/25816307>

Patch by Antoine Quint <Antoine Quint> on 2016-05-27
Reviewed by Dean Jackson.

Source/WebCore:

We now force the <video> controls play glyph into being composited due to webkit.org/b/158147. In most scenarios,
this element gets composited anyway, this is just to ensure that this happens in all cases until we get the
general fix for webkit.org/b/158147.

Test: platform/ios-simulator/media/video-play-glyph-composited-outside-overflow-scrolling-touch-container.html

Modules/mediacontrols/mediaControlsiOS.css:

(video::-webkit-media-controls-start-playback-button .webkit-media-controls-start-playback-glyph):

LayoutTests:

Testing that on iOS the play glyph for <video> controls when play button would be initially invisible when contained
in a scrollable container is indeed composited.

platform/ios-simulator/media/video-play-glyph-composited-outside-overflow-scrolling-touch-container-expected.txt: Added.
platform/ios-simulator/media/video-play-glyph-composited-outside-overflow-scrolling-touch-container.html: Added.

12:18 AM Changeset in webkit [201449] by Carlos Garcia Campos

2 edits in trunk/Tools

New intl-numberformat.js test fails on many Linux platforms
https://bugs.webkit.org/show_bug.cgi?id=154530

Reviewed by Darin Adler.

The test is actually failing because of a bug in the icu version installed in the bots, using a newer version of
icu makes the tests pass and explains why it worked for some people. So, let's add icu 55.1 to the internal
jhbuild to ensure JSC tests pass in the bots no matter what the icu version installed is.

gtk/jhbuild.modules:

12:09 AM Changeset in webkit [201448] by barraclough@apple.com

68 edits in trunk/Source/JavaScriptCore

Static table property lookup should not require getOwnPropertySlot override.
https://bugs.webkit.org/show_bug.cgi?id=158059

Reviewed by Darin Adler.

Currently JSObject does not handle property lookup of entries in the static
table. Each subclass with static properties mut override getOwnPropertySlot,
and explicitly call the lookup functions. This has the following drawbacks:

Performance: for any class with static properties, property acces becomes virtual (via method table).
Poor encapsulation: implementation detail of static property access is spread throughout & cross projects, rather than being contained in JSObject.
Code size: this results in a great many additional functions.
Inconsistency: static table presence has to be be taken into account in many other operations, e.g. presence of read-only properties for put.
Memory: in order to avoid the virtual lookup, DOM prototypes eagerly reify all properties. This is likely suboptimal.

Instead, JSObject::getPropertySlot / JSObject::getOwnPropertySlot should be
able to handle static properties.

This is actually a fairly small & simple change.

The common pattern is for subclasses of JObject to override getOwnPropertySlot
to first defer to JSObject for property storage lookup, and only if this fails
consult the static table. They just want the static tables to be consulted after
regular property storgae lookup. So just add a fast flag in TypeInfo for JSObject
to check, and where it is set, do so. Then it's just a question of switching
classes over to start setting this flag, and drop the override.

The new mechanism does change static table lookup order from oldest-ancestor
first to most-derived first. The new ordering makes more sense (means derived
class static tables can now override entries from parents), and shoudn't affect
any existing code (since overriding didn't previously work, there likely aren't
shadowing properties in more derived types).

This patch changes all classes in JavaScriptCore over to using the new mechanism,
except JSGlobalObject. I'll move classes in WebCore over as a separate patch
(this is also why I've not moved JSGlobalObject in this patch - doing so would
move JSDOMWindow, and I'd rather handle that separately).

runtime/JSTypeInfo.h:

(JSC::TypeInfo::hasStaticPropertyTable):

Add HasStaticPropertyTable flag.

runtime/Lookup.cpp:

(JSC::setUpStaticFunctionSlot):

Change setUpStaticFunctionSlot to take a VM&.

runtime/Lookup.h:

(JSC::getStaticPropertySlotFromTable):

Added helper function to perform static lookup alone.

(JSC::getStaticPropertySlot):
(JSC::getStaticFunctionSlot):

setUpStaticFunctionSlot changed to take a VM&.

runtime/JSObject.cpp:

(JSC::JSObject::getOwnStaticPropertySlot):

Added, walks ClassInfo chain looking for static properties.

runtime/JSObject.h:

(JSC::JSObject::getOwnNonIndexPropertySlot):

getOwnNonIndexPropertySlot is used internally by getPropertySlot & getOwnPropertySlot. If property is not present in storage array then check the static table.

runtime/ArrayConstructor.cpp:

(JSC::ArrayConstructor::finishCreation):
(JSC::constructArrayWithSizeQuirk):
(JSC::ArrayConstructor::getOwnPropertySlot): Deleted.

runtime/ArrayConstructor.h:

(JSC::ArrayConstructor::create):

runtime/ArrayIteratorPrototype.cpp:

(JSC::ArrayIteratorPrototype::finishCreation):
(JSC::ArrayIteratorPrototype::getOwnPropertySlot): Deleted.

runtime/ArrayIteratorPrototype.h:

(JSC::ArrayIteratorPrototype::create):
(JSC::ArrayIteratorPrototype::ArrayIteratorPrototype):

runtime/BooleanPrototype.cpp:

(JSC::BooleanPrototype::finishCreation):
(JSC::booleanProtoFuncToString):
(JSC::BooleanPrototype::getOwnPropertySlot): Deleted.

runtime/BooleanPrototype.h:

(JSC::BooleanPrototype::create):

runtime/DateConstructor.cpp:

(JSC::DateConstructor::finishCreation):
(JSC::millisecondsFromComponents):
(JSC::DateConstructor::getOwnPropertySlot): Deleted.

runtime/DateConstructor.h:

(JSC::DateConstructor::create):

runtime/DatePrototype.cpp:

(JSC::DatePrototype::finishCreation):
(JSC::dateProtoFuncToString):
(JSC::DatePrototype::getOwnPropertySlot): Deleted.

runtime/DatePrototype.h:

(JSC::DatePrototype::create):

runtime/ErrorPrototype.cpp:

(JSC::ErrorPrototype::finishCreation):
(JSC::ErrorPrototype::getOwnPropertySlot): Deleted.

runtime/ErrorPrototype.h:

(JSC::ErrorPrototype::create):

runtime/GeneratorPrototype.cpp:

(JSC::GeneratorPrototype::finishCreation):
(JSC::GeneratorPrototype::getOwnPropertySlot): Deleted.

runtime/GeneratorPrototype.h:

(JSC::GeneratorPrototype::create):
(JSC::GeneratorPrototype::createStructure):
(JSC::GeneratorPrototype::GeneratorPrototype):

runtime/InspectorInstrumentationObject.cpp:

(JSC::InspectorInstrumentationObject::finishCreation):
(JSC::InspectorInstrumentationObject::isEnabled):
(JSC::InspectorInstrumentationObject::getOwnPropertySlot): Deleted.

runtime/InspectorInstrumentationObject.h:

(JSC::InspectorInstrumentationObject::create):
(JSC::InspectorInstrumentationObject::createStructure):

runtime/IntlCollatorConstructor.cpp:

(JSC::IntlCollatorConstructor::getCallData):
(JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
(JSC::IntlCollatorConstructor::getOwnPropertySlot): Deleted.

runtime/IntlCollatorConstructor.h:
runtime/IntlCollatorPrototype.cpp:

(JSC::IntlCollatorPrototype::finishCreation):
(JSC::IntlCollatorFuncCompare):
(JSC::IntlCollatorPrototype::getOwnPropertySlot): Deleted.

runtime/IntlCollatorPrototype.h:
runtime/IntlDateTimeFormatConstructor.cpp:

(JSC::IntlDateTimeFormatConstructor::getCallData):
(JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
(JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot): Deleted.

runtime/IntlDateTimeFormatConstructor.h:
runtime/IntlDateTimeFormatPrototype.cpp:

(JSC::IntlDateTimeFormatPrototype::finishCreation):
(JSC::IntlDateTimeFormatFuncFormatDateTime):
(JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot): Deleted.

runtime/IntlDateTimeFormatPrototype.h:
runtime/IntlNumberFormatConstructor.cpp:

(JSC::IntlNumberFormatConstructor::getCallData):
(JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
(JSC::IntlNumberFormatConstructor::getOwnPropertySlot): Deleted.

runtime/IntlNumberFormatConstructor.h:
runtime/IntlNumberFormatPrototype.cpp:

(JSC::IntlNumberFormatPrototype::finishCreation):
(JSC::IntlNumberFormatFuncFormatNumber):
(JSC::IntlNumberFormatPrototype::getOwnPropertySlot): Deleted.

runtime/IntlNumberFormatPrototype.h:
runtime/JSDataViewPrototype.cpp:

(JSC::JSDataViewPrototype::createStructure):
(JSC::getData):
(JSC::JSDataViewPrototype::getOwnPropertySlot): Deleted.

runtime/JSDataViewPrototype.h:
runtime/JSInternalPromiseConstructor.cpp:

(JSC::JSInternalPromiseConstructor::getCallData):
(JSC::JSInternalPromiseConstructor::getOwnPropertySlot): Deleted.

runtime/JSInternalPromiseConstructor.h:
runtime/JSONObject.cpp:

(JSC::Walker::Walker):
(JSC::JSONObject::getOwnPropertySlot): Deleted.

runtime/JSONObject.h:

(JSC::JSONObject::create):

runtime/JSPromiseConstructor.cpp:

(JSC::JSPromiseConstructor::getCallData):
(JSC::JSPromiseConstructor::getOwnPropertySlot): Deleted.

runtime/JSPromiseConstructor.h:
runtime/JSPromisePrototype.cpp:

(JSC::JSPromisePrototype::addOwnInternalSlots):
(JSC::JSPromisePrototype::getOwnPropertySlot): Deleted.

runtime/JSPromisePrototype.h:
runtime/MapPrototype.cpp:

(JSC::MapPrototype::finishCreation):
(JSC::getMap):
(JSC::MapPrototype::getOwnPropertySlot): Deleted.

runtime/MapPrototype.h:

(JSC::MapPrototype::create):
(JSC::MapPrototype::MapPrototype):

runtime/ModuleLoaderObject.cpp:

(JSC::ModuleLoaderObject::finishCreation):
(JSC::printableModuleKey):
(JSC::ModuleLoaderObject::getOwnPropertySlot): Deleted.

runtime/ModuleLoaderObject.h:
runtime/NumberPrototype.cpp:

(JSC::NumberPrototype::finishCreation):
(JSC::toThisNumber):
(JSC::NumberPrototype::getOwnPropertySlot): Deleted.

runtime/NumberPrototype.h:

(JSC::NumberPrototype::create):

runtime/ObjectConstructor.cpp:

(JSC::ObjectConstructor::addDefineProperty):
(JSC::constructObject):
(JSC::ObjectConstructor::getOwnPropertySlot): Deleted.

runtime/ObjectConstructor.h:

(JSC::ObjectConstructor::create):
(JSC::ObjectConstructor::createStructure):

runtime/ReflectObject.cpp:

(JSC::ReflectObject::finishCreation):
(JSC::ReflectObject::getOwnPropertySlot): Deleted.

runtime/ReflectObject.h:

(JSC::ReflectObject::create):
(JSC::ReflectObject::createStructure):

runtime/RegExpConstructor.cpp:

(JSC::RegExpConstructor::getRightContext):
(JSC::regExpConstructorDollar):
(JSC::RegExpConstructor::getOwnPropertySlot): Deleted.

runtime/RegExpConstructor.h:

(JSC::RegExpConstructor::create):
(JSC::RegExpConstructor::createStructure):

runtime/SetPrototype.cpp:

(JSC::SetPrototype::finishCreation):
(JSC::getSet):
(JSC::SetPrototype::getOwnPropertySlot): Deleted.

runtime/SetPrototype.h:

(JSC::SetPrototype::create):
(JSC::SetPrototype::SetPrototype):

runtime/StringConstructor.cpp:

(JSC::StringConstructor::finishCreation):
(JSC::stringFromCharCodeSlowCase):
(JSC::StringConstructor::getOwnPropertySlot): Deleted.

runtime/StringConstructor.h:

(JSC::StringConstructor::create):

runtime/StringIteratorPrototype.cpp:

(JSC::StringIteratorPrototype::finishCreation):
(JSC::StringIteratorPrototype::getOwnPropertySlot): Deleted.

runtime/StringIteratorPrototype.h:

(JSC::StringIteratorPrototype::create):
(JSC::StringIteratorPrototype::StringIteratorPrototype):

runtime/StringPrototype.cpp:

(JSC::StringPrototype::create):
(JSC::substituteBackreferencesSlow):
(JSC::StringPrototype::getOwnPropertySlot): Deleted.

runtime/StringPrototype.h:
runtime/SymbolConstructor.cpp:

(JSC::SymbolConstructor::finishCreation):
(JSC::callSymbol):
(JSC::SymbolConstructor::getOwnPropertySlot): Deleted.

runtime/SymbolConstructor.h:

(JSC::SymbolConstructor::create):

runtime/SymbolPrototype.cpp:

(JSC::SymbolPrototype::finishCreation):
(JSC::SymbolPrototype::getOwnPropertySlot): Deleted.

runtime/SymbolPrototype.h:

(JSC::SymbolPrototype::create):

remove getOwnPropertySlot, replace OverridesGetOwnPropertySlot flag with HasStaticPropertyTable.

May 26, 2016:

10:43 PM Changeset in webkit [201447] by yoav@yoav.ws

3 edits
4 adds in trunk

Preload single download tests.
https://bugs.webkit.org/show_bug.cgi?id=157988

Reviewed by Alex Christensen.

Source/WebCore:

ResourceTiming entries for some subresource weren't registered as resource->response().isHTTP() was false, since
resource->response().url() was empty. I switched the check to use resource->resourceRequest().url() directly instead.

Test: http/tests/preload/single_download_preload_runner.html

loader/ResourceTimingInformation.cpp:

(WebCore::ResourceTimingInformation::addResourceTiming):

LayoutTests:

Make sure preload is only downloading a single resource, which is properly reused.

http/tests/preload/resources/single_download_preload.html: Added.
http/tests/preload/single_download_preload_runner-expected.txt: Added.
http/tests/preload/single_download_preload_runner.html: Added.

10:40 PM Changeset in webkit [201446] by Gyuyoung Kim

2 edits in trunk/LayoutTests

Unreviewed EFL gardening.
Release some passing tests which have been marked to Crash, Failure.

platform/efl/TestExpectations:

8:31 PM Changeset in webkit [201445] by commit-queue@webkit.org

7 edits in trunk/Source/JavaScriptCore

Unreviewed, rolling out r201436.
https://bugs.webkit.org/show_bug.cgi?id=158143

Caused 30% regression on Dromaeo DOM core tests (Requested by
rniwa on #webkit).

Reverted changeset:

"REGRESSION: JSBench spends a lot of time transitioning
to/from dictionary"
https://bugs.webkit.org/show_bug.cgi?id=158045
http://trac.webkit.org/changeset/201436

8:19 PM Changeset in webkit [201444] by beidson@apple.com

2 edits in trunk/Source/WebKit2

Certain NetworkResourceLoader callbacks can deref a null m_networkLoad.
https://bugs.webkit.org/show_bug.cgi?id=158134

Reviewed by Alex Christensen.

It's legit for m_networkLoad to be null in these callbacks.

We need null checks, just like we have in many other callbacks in this class.

NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::continueWillSendRequest):
(WebKit::NetworkResourceLoader::continueCanAuthenticateAgainstProtectionSpace):

6:41 PM Changeset in webkit [201443] by n_wang@apple.com

3 edits
2 adds in trunk

AX: Wrong CharacterOffset from VisiblePosition with composed characters
https://bugs.webkit.org/show_bug.cgi?id=158138

Reviewed by Chris Fleizach.

Source/WebCore:

The conversion logic is not correct when the text node contains composed characters.
We should use VisiblePosition's offset directly for text nodes so we won't mess things up.

Test: accessibility/mac/character-offset-visible-position-conversion-with-emoji.html

accessibility/AXObjectCache.cpp:

(WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
(WebCore::AXObjectCache::characterOffsetFromVisiblePosition):

LayoutTests:

accessibility/mac/character-offset-visible-position-conversion-with-emoji-expected.txt: Added.
accessibility/mac/character-offset-visible-position-conversion-with-emoji.html: Added.

5:40 PM Changeset in webkit [201442] by Yusuke Suzuki

29 edits in trunk

[JSC] Allow JSBench to use precise time
https://bugs.webkit.org/show_bug.cgi?id=158050

Reviewed by Geoffrey Garen.

PerformanceTests:

JSBench/amazon-chrome-win/urem.js: