Context Navigation

← Previous Period
Next Period →

Timeline

Apr 3, 2018:

11:55 PM Changeset in webkit [230251] by commit-queue@webkit.org

4 edits in trunk/Source/WebCore

Remove unused libsoup ResourceHandle implementation
https://bugs.webkit.org/show_bug.cgi?id=184048

Patch by Alex Christensen <achristensen@webkit.org> on 2018-04-03
Reviewed by Michael Catanzaro.

This code is unused since r228901 so let's remove it!

platform/network/ResourceHandle.h:
platform/network/ResourceHandleInternal.h:

(WebCore::ResourceHandleInternal::ResourceHandleInternal):

platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::ResourceHandle::~ResourceHandle):
(WebCore::ResourceHandleInternal::soupSession):
(WebCore::ResourceHandle::cancelledOrClientless):
(WebCore::ResourceHandle::ensureReadBuffer):
(WebCore::ResourceHandle::currentStreamPosition const):
(WebCore::ResourceHandle::platformContinueSynchronousDidReceiveResponse):
(WebCore::ResourceHandle::didStartRequest):
(WebCore::ResourceHandle::start):
(WebCore::ResourceHandle::releaseForDownload):
(WebCore::ResourceHandle::sendPendingRequest):
(WebCore::ResourceHandle::cancel):
(WebCore::ResourceHandle::shouldUseCredentialStorage):
(WebCore::ResourceHandle::continueDidReceiveAuthenticationChallenge):
(WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
(WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
(WebCore::ResourceHandle::receivedCredential):
(WebCore::ResourceHandle::receivedCancellation):
(WebCore::ResourceHandle::receivedChallengeRejection):
(WebCore::ResourceHandle::platformSetDefersLoading):
(WebCore::sessionFromContext): Deleted.
(WebCore::ResourceHandle::create): Deleted.
(WebCore::ResourceHandle::ResourceHandle): Deleted.
(WebCore::isAuthenticationFailureStatusCode): Deleted.
(WebCore::tlsErrorsChangedCallback): Deleted.
(WebCore::gotHeadersCallback): Deleted.
(WebCore::applyAuthenticationToRequest): Deleted.
(WebCore::restartedCallback): Deleted.
(WebCore::shouldRedirect): Deleted.
(WebCore::shouldRedirectAsGET): Deleted.
(WebCore::continueAfterWillSendRequest): Deleted.
(WebCore::doRedirect): Deleted.
(WebCore::redirectSkipCallback): Deleted.
(WebCore::wroteBodyDataCallback): Deleted.
(WebCore::cleanupSoupRequestOperation): Deleted.
(WebCore::nextMultipartResponsePartCallback): Deleted.
(WebCore::sendRequestCallback): Deleted.
(WebCore::continueAfterDidReceiveResponse): Deleted.
(WebCore::startingCallback): Deleted.
(WebCore::networkEventCallback): Deleted.
(WebCore::createSoupMessageForHandleAndRequest): Deleted.
(WebCore::createSoupRequestAndMessageForHandle): Deleted.
(WebCore::ResourceHandle::timeoutFired): Deleted.
(WebCore::waitingToSendRequest): Deleted.
(WebCore::readCallback): Deleted.

11:32 PM Changeset in webkit [230250] by jmarcell@apple.com

1 edit
2 adds in branches/safari-605-branch/LayoutTests

Cherry-pick r230172. rdar://problem/39155049

Followup(r230063): Add test a layout test for https://bugs.webkit.org/show_bug.cgi?id=183972
https://bugs.webkit.org/show_bug.cgi?id=184162

Reviewed by Daniel Bates.

Without r230063, running run-webkit-tests -g for this test will crash.

svg/dom/animated-tearoff-list-remove-target-expected.txt: Added.
svg/dom/animated-tearoff-list-remove-target.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230172 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:32 PM Changeset in webkit [230249] by jmarcell@apple.com

2 edits in branches/safari-605-branch/Source/WebCore

Cherry-pick r230063. rdar://problem/39155049

The SVGAnimatedProperty wrappers have to be detached from the referenced values before the SVGAnimatedType is deleted
https://bugs.webkit.org/show_bug.cgi?id=183972

Reviewed by Daniel Bates.

If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers
of the animated properties have to be detached from the items in the list
before it's deleted.

svg/SVGAnimateElementBase.cpp: (WebCore::SVGAnimateElementBase::clearAnimatedType):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230063 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:11 PM Changeset in webkit [230248] by jmarcell@apple.com

2 edits in branches/safari-605-branch/Source/WebKitLegacy/mac

Cherry-pick r229414. rdar://problem/38651634

Possible null dereference of the page under WebFrameNetworkingContext::storageSession()
https://bugs.webkit.org/show_bug.cgi?id=183455
<rdar://problem/38191749>

Reviewed by Youenn Fablet.

Add a null check for the page as we have evidence from crashes that it can be null.
Other functions in WebFrameNetworkingContext already null check the page as well,
not just the frame so this is consistent.

WebCoreSupport/WebFrameNetworkingContext.mm: (WebFrameNetworkingContext::storageSession const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229414 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:11 PM Changeset in webkit [230247] by jmarcell@apple.com

5 edits
4 adds in branches/safari-605-branch

Cherry-pick r230006. rdar://problem/38154623

CSS mask images should be retrieved using potentially CORS-enabled fetch
https://bugs.webkit.org/show_bug.cgi?id=179983
<rdar://problem/35678149>

Reviewed by Brent Fulgham.

Source/WebCore:

As per <https://drafts.fxtf.org/css-masking-1/#priv-sec> (Editor’s Draft, 23 December 2017)
we should fetch CSS mask images using a potentially CORS-enabled fetch.

Both cross-origin CSS shape-outside images and CSS mask images may be sensitive to timing
attacks that can be used to reveal their pixel data when retrieved without regard to CORS.
For the same reason that we fetch CSS shape-outside images using a potentially CORS-enabled
fetch we should fetch CSS mask the same way. This also makes the behavior of WebKit more
closely align with the behavior in the spec.

Test: http/tests/security/css-mask-image.html

page/Settings.yaml: Add a setting for toggle "Anonymous" mode fetching of mask images (defaults: true). We need this setting to avoid breaking the developer convenience feature that some modern media controls layout tests employ to load assets from the filesystem as opposed to using the hardcoded data URLs baked into the WebKit binary.
style/StylePendingResources.cpp: Substitute LoadPolicy::NoCORS and LoadPolicy::Anonymous for LoadPolicy::Normal and LoadPolicy::ShapeOutside, respectively, to match the terminology used in the HTML, CSS Shapes Module Level 1, and CSS Masking Module Level 1 specs. (WebCore::Style::loadPendingImage): Ditto. (WebCore::Style::loadPendingResources): Use load policy LoadPolicy::Anonymous when fetching a mask image or shape-outside image.

LayoutTests:

Add a test to ensure we do not fetch a cross-origin CSS mask image that does
not allow CORS access.

http/tests/security/css-mask-image-expected.html: Added.
http/tests/security/css-mask-image.html: Added.
http/tests/security/resources/black-square.png: Added.
http/tests/security/resources/fail-mask.png: Added.
media/modern-media-controls/resources/media-controls-loader.js: Disable "Anonymous" mode fetching of mask images to allow modern media controls to load mask assets from the filesystem.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230006 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:11 PM Changeset in webkit [230246] by jmarcell@apple.com

4 edits
3 adds in branches/safari-605-branch

Cherry-pick r229987. rdar://problem/39155464

DFG should know that CreateThis can be effectful
https://bugs.webkit.org/show_bug.cgi?id=184013

Reviewed by Saam Barati.

JSTests:

stress/create-this-property-change.js: Added. (Foo): (RealBar): (get if):
stress/create-this-structure-change-without-cse.js: Added. (Foo): (RealBar): (get if):
stress/create-this-structure-change.js: Added. (Foo): (RealBar): (get if):

Source/JavaScriptCore:

As shown in the tests added in JSTests, CreateThis can be effectful if the constructor this
is a proxy.

dfg/DFGAbstractInterpreterInlines.h: (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
dfg/DFGClobberize.h: (JSC::DFG::clobberize):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229987 268f45cc-cd09-0410-ab3c-d52691b4dbfc

11:02 PM Changeset in webkit [230245] by Carlos Garcia Campos

5 edits in trunk

ASSERTION FAILED: !m_mainFrame->coreFrame()->loader().frameHasLoaded()

!m_pendingNavigationID when reloading page while a page is loading

https://bugs.webkit.org/show_bug.cgi?id=153210

Reviewed by Alex Christensen.

Source/WebKit:

The assert happens when WebPage::reload() is called twice and the first time the reload is ignored by
FrameLoader because the document URL is empty. In that case the pending navigation is not reset, because
FrameLoader::reload() returns before creating the document loader.

WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::reload): Check if the pending navigation has been reset after calling FrameLoader::reload()
and reset it otherwise.

Tools:

Add unit tests to WebKit C API and WebKitGLib.

TestWebKitAPI/Tests/WebKit/PageLoadBasic.cpp:

(TestWebKitAPI::TEST):

TestWebKitAPI/Tests/WebKitGLib/TestLoaderClient.cpp:

(LoadTwiceAndReloadTest::reloadOnFinishLoad):
(LoadTwiceAndReloadTest::LoadTwiceAndReloadTest):
(LoadTwiceAndReloadTest::~LoadTwiceAndReloadTest):
(LoadTwiceAndReloadTest::waitUntilFinished):
(testWebViewLoadTwiceAndReload):
(beforeAll):

11:00 PM Changeset in webkit [230244] by Carlos Garcia Campos

2 edits in trunk/Tools

[GTK] Test /webkit/WebKitWebPage/context-menu is failing since r229831
https://bugs.webkit.org/show_bug.cgi?id=184260

Reviewed by Michael Catanzaro.

This is not a regression introduced in r229831, though, it's a bug in the test itself revealed by r229831. We
should wait for the load to complete before trying to show the context menu.

TestWebKitAPI/Tests/WebKitGtk/TestContextMenu.cpp:

(testContextMenuWebExtensionMenu):

9:36 PM Changeset in webkit [230243] by Alan Bujtas

6 edits
1 add in trunk/Tools

[LayoutReloaded] Introduce floating to InlineFormattingContext
https://bugs.webkit.org/show_bug.cgi?id=184288

Reviewed by Antti Koivisto.

LayoutReloaded/FormattingContext/BlockFormatting/BlockFormattingContext.js:

(BlockFormattingContext.prototype._computeFloatingWidth): Deleted.
(BlockFormattingContext.prototype._computeFloatingHeight): Deleted.

LayoutReloaded/FormattingContext/FormattingContext.js:

(FormattingContext.prototype._computeFloatingWidth):
(FormattingContext.prototype._computeFloatingHeight):

LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js:

(InlineFormattingContext.prototype.layout):
(InlineFormattingContext.prototype._handleFloatingBox):

LayoutReloaded/FormattingContext/InlineFormatting/Line.js:

(Line.prototype.addFloatingBox):
(Line):

LayoutReloaded/test/float-is-inside-inline-formatting-context-simple.html: Added.
LayoutReloaded/test/index.html:

8:27 PM Changeset in webkit [230242] by jmarcell@apple.com

5 edits in branches/safari-605-branch

Cherry-pick r230146. rdar://problem/39155245

Show punycode if URL contains hyphen character
https://bugs.webkit.org/show_bug.cgi?id=184221
<rdar://problem/38044633>

Reviewed by Darin Adler.

Source/WebCore:

Revise our "lookalike character" logic to include the hyphen,
non-breaking hyphen, and minus sign.

Test: fast/url/host.html

platform/mac/WebCoreNSURLExtras.mm: (WebCore::isLookalikeCharacter):

LayoutTests:

fast/url/host-expected.txt:
fast/url/host.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230146 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230241] by jmarcell@apple.com

3 edits
2 adds in branches/safari-605-branch

Cherry-pick r230143. rdar://problem/39155381

JSC crash in JIT code with for-of loop and Array/Set iterators
https://bugs.webkit.org/show_bug.cgi?id=183174

Reviewed by Saam Barati.

JSTests:

microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x. (foo):
stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed. (f):

Source/JavaScriptCore:

dfg/DFGSafeToExecute.h: (JSC::DFG::safeToExecute): Fix the bug by making GetByOffset and friends verify that they are getting the type proof they want at the desired hoisting site.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230143 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230240] by jmarcell@apple.com

5 edits
1 add in branches/safari-605-branch

Cherry-pick r230119. rdar://problem/39155070

WebAssembly compilation from DataView

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230119 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230239] by jmarcell@apple.com

28 edits
1 copy
1 add
2 deletes in branches/safari-605-branch

Cherry-pick r230102. rdar://problem/38154594

A stack overflow in the parsing of a builtin (called by createExecutable) cause a crash instead of a catchable js exception
https://bugs.webkit.org/show_bug.cgi?id=184074
<rdar://problem/37165897>

Reviewed by Keith Miller.

JSTests:

stress/stack-overflow-while-parsing-builtin.js: Added. (f):

Source/JavaScriptCore:

Fixing this requires getting the ParserError (with information about the failure) and an ExecState* (to throw an exception) in the same place.
It is surprisingly painful, with quite a long call stack between the last function with an access to an ExecState* and the first function with the ParserError.
Even worse, many of these functions are generated by macros, themselves generated by a maze of python scripts.
As a result, this patch is grotesquely large, while all it does is adding enough plumbing to throw a proper exception in this specific case.

There are now bare calls to '.value()' on several paths that may crash. It is not a problem in my opinion, since we previously crashed in every case regardless of the path that took us to createExecutable when encountering a stack overflow.
If we ever find an example that can cause these calls to fail, it should be doable to throw a proper exception there too.

Two other minor changes:

I removed BuiltinExecutableCreator.{cpp, h} as it was nearly empty, and only used in one place. That place now includes BuiltinExecutables.h directly instead.
I moved code from ParserError.h into a newly created ParserError.cpp, as I see no need to inline functions that are only used when encountering a parser error, and ParserError.h is now included in quite a few places.

JavaScriptCore.xcodeproj/project.pbxproj:
Scripts/builtins/builtins_generate_combined_header.py: (BuiltinsCombinedHeaderGenerator.generate_forward_declarations): (ParserError): (generate_section_for_object): Deleted. (generate_externs_for_object): Deleted. (generate_macros_for_object): Deleted. (generate_section_for_code_table_macro): Deleted. (generate_section_for_code_name_macro): Deleted. (generate_section_for_global_private_code_name_macro): Deleted.
Scripts/builtins/builtins_generate_separate_header.py: (generate_secondary_header_includes):
Scripts/builtins/builtins_templates.py:
Sources.txt:
builtins/BuiltinExecutableCreator.cpp: Removed.
builtins/BuiltinExecutableCreator.h: Removed.
builtins/BuiltinExecutables.cpp: (JSC::BuiltinExecutables::createDefaultConstructor): (JSC::BuiltinExecutables::createBuiltinExecutable): (JSC::createBuiltinExecutable): (JSC::BuiltinExecutables::createExecutableOrCrash): (JSC::BuiltinExecutables::createExecutable):
builtins/BuiltinExecutables.h:
bytecompiler/BytecodeGenerator.h:
parser/ParserError.cpp: Added. (JSC::ParserError::toErrorObject): (JSC::ParserError::throwStackOverflowOrOutOfMemory): (WTF::printInternal):
parser/ParserError.h: (JSC::ParserError::toErrorObject): Deleted. (WTF::printInternal): Deleted.
runtime/AsyncIteratorPrototype.cpp: (JSC::AsyncIteratorPrototype::finishCreation):
runtime/FunctionPrototype.cpp: (JSC::FunctionPrototype::addFunctionProperties):
runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::init):
runtime/JSObject.cpp: (JSC::JSObject::getOwnStaticPropertySlot): (JSC::JSObject::reifyAllStaticProperties):
runtime/JSObject.h: (JSC::JSObject::getOwnNonIndexPropertySlot): (JSC::JSObject::getOwnPropertySlot): (JSC::JSObject::getPropertySlot):
runtime/JSObjectInlines.h: (JSC::JSObject::getNonIndexPropertySlot):
runtime/JSTypedArrayViewPrototype.cpp: (JSC::JSTypedArrayViewPrototype::finishCreation):
runtime/Lookup.cpp: (JSC::reifyStaticAccessor): (JSC::setUpStaticFunctionSlot):
runtime/Lookup.h: (JSC::getStaticPropertySlotFromTable): (JSC::reifyStaticProperty):
runtime/MapPrototype.cpp: (JSC::MapPrototype::finishCreation):
runtime/SetPrototype.cpp: (JSC::SetPrototype::finishCreation):
tools/JSDollarVM.cpp: (JSC::functionCreateBuiltin):

Source/WebCore:

I had to slightly change the type of some bindings between JSC and WebCore. No functional change intended on the WebCore side.

bindings/js/JSReadableStreamPrivateConstructors.cpp: (WebCore::JSBuiltinReadableStreamDefaultReaderPrivateConstructor::initializeExecutable): (WebCore::JSBuiltinReadableStreamDefaultControllerPrivateConstructor::initializeExecutable): (WebCore::JSBuiltinReadableByteStreamControllerPrivateConstructor::initializeExecutable): (WebCore::JSBuiltinReadableStreamBYOBReaderPrivateConstructor::initializeExecutable): (WebCore::JSBuiltinReadableStreamBYOBRequestPrivateConstructor::initializeExecutable):
bindings/scripts/CodeGeneratorJS.pm: (GenerateConstructorHelperMethods):
bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp: (WebCore::JSTestClassWithJSBuiltinConstructorConstructor::initializeExecutable):
bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp: (WebCore::JSTestJSBuiltinConstructorConstructor::initializeExecutable):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230102 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230238] by jmarcell@apple.com

5 edits
1 add in branches/safari-605-branch

Cherry-pick r230101. rdar://problem/39155394

Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
https://bugs.webkit.org/show_bug.cgi?id=183657
JSTests:

Reviewed by Keith Miller.

stress/large-unshift-splice.js: Added. (make_contig_arr):

Source/JavaScriptCore:

<rdar://problem/38464399>

Reviewed by Keith Miller.

There was just a missing check in unshiftCountForIndexingType.
I've also replaced 'return false' by 'return true' in the case of an 'out-of-memory' exception, because 'return false' means 'please continue to the slow path',
and the slow path has an assert that there is no unhandled exception (line 360 of ArrayPrototype.cpp).
Finally, I made the assert in ensureLength a release assert as it would have caught this bug and prevented it from being a security risk.

runtime/ArrayPrototype.cpp: (JSC::unshift):
runtime/JSArray.cpp: (JSC::JSArray::unshiftCountWithAnyIndexingType):
runtime/JSObject.h: (JSC::JSObject::ensureLength):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230101 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230237] by jmarcell@apple.com

4 edits
3 adds in branches/safari-605-branch

Cherry-pick r230052. rdar://problem/39155251

WebSocket cookie incorrectly stored
https://bugs.webkit.org/show_bug.cgi?id=184100
<rdar://problem/37928715>

Reviewed by Brent Fulgham.

Source/WebCore:

A cookie received in a WebSocket response should be stored with respect to the
origin of the WebSocket server in order for it to be sent in a subsequent request.

Also removed a FIXME about implementing support for the long since
deprecated Set-Cookie2 header.

Test: http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html

Modules/websockets/WebSocketChannel.cpp: (WebCore::WebSocketChannel::processBuffer):
Modules/websockets/WebSocketHandshake.h:

LayoutTests:

http/tests/websocket/tests/hybi/cookie_wsh.py: Added. Downloaded from <https://github.com/w3c/pywebsocket/blob/b2e1d11086fdf00b33a0d30c504f227e7d4fa86b/src/example/cookie_wsh.py>. (_add_set_cookie): (web_socket_do_extra_handshake): (web_socket_transfer_data):
http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior-expected.txt: Added.
http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230052 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230236] by jmarcell@apple.com

6 edits
1 add in branches/safari-605-branch

Cherry-pick r230026. rdar://problem/39155085

appendQuotedJSONString stops on arithmetic overflow instead of propagating it upwards
https://bugs.webkit.org/show_bug.cgi?id=183894

Reviewed by Saam Barati.

JSTests:

stress/json-stringified-overflow.js: Added. (catch):

Source/JavaScriptCore:

Use the return value of appendQuotedJSONString to fail more gracefully when given a string that is too large to handle.

runtime/JSONObject.cpp: (JSC::Stringifier::appendStringifiedValue):

Source/WTF:

appendQuotedJSONString now returns a bool indicating whether it succeeded, instead of silently failing when given a string too large
to fit in 4GB.

wtf/text/StringBuilder.h:
wtf/text/StringBuilderJSON.cpp: (WTF::StringBuilder::appendQuotedJSONString):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230026 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230235] by jmarcell@apple.com

2 edits in branches/safari-605-branch/Source/JavaScriptCore

Cherry-pick r229962. rdar://problem/39122091

r228149 accidentally removed code that resets m_emptyCursor at the end of a GC
https://bugs.webkit.org/show_bug.cgi?id=183995

Reviewed by Filip Pizlo.

The removal of this line of code was unintended and happened during some
refactoring Fil was doing. The consequence of removing this line of code
is that the m_emptyCursor became a monotonically increasing integer, leading
the cursor to usually being out of bounds of the block range (depending on
what the program is doing). This made the functionality of finding an empty
block to steal almost always fail.

heap/BlockDirectory.cpp: (JSC::BlockDirectory::prepareForAllocation):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229962 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230234] by jmarcell@apple.com

3 edits
1 add in branches/safari-605-branch

Cherry-pick r229850. rdar://problem/39155286

Race Condition in arrayProtoFuncReverse() causes wrong results or crash
https://bugs.webkit.org/show_bug.cgi?id=183901

Reviewed by Keith Miller.

JSTests:

New test.

stress/array-reverse-doesnt-clobber.js: Added. (testArrayReverse): (createArrayOfArrays): (createArrayStorage):

Source/JavaScriptCore:

Added write barriers to ensure the reversed contents are properly marked.

runtime/ArrayPrototype.cpp: (JSC::arrayProtoFuncReverse):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229850 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:27 PM Changeset in webkit [230233] by jmarcell@apple.com

7 edits
2 adds in branches/safari-605-branch

Cherry-pick r229830. rdar://problem/39155360

Disconnect the SVGPathSegList items from their SVGPathElement before rebuilding a new list
https://bugs.webkit.org/show_bug.cgi?id=183723
<rdar://problem/38517871>

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2018-03-21
Reviewed by Daniel Bates.

Source/WebCore:

When setting the "d" attribute directly on a path, we rebuild the list
of path segments held for creating the property tear off. The old path
segments need to get disconnected from the path element. We already do
that when a path segment is replaced or removed.

Test: svg/dom/reuse-pathseg-after-changing-d.html

svg/SVGPathElement.cpp: (WebCore::SVGPathElement::svgAttributeChanged):
svg/SVGPathSegList.cpp: (WebCore::SVGPathSegList::clear): SVGPathSegListValues::clearContextAndRoles() will now be called from SVGPathSegListValues::clear() via SVGListProperty::clearValues(). (WebCore::SVGPathSegList::replaceItem): (WebCore::SVGPathSegList::removeItem): (WebCore::SVGPathSegList::clearContextAndRoles): Deleted.
svg/SVGPathSegList.h: SVGPathSegListValues::clearContextAndRoles() will now be called from SVGPathSegListValues::clear() via SVGListProperty::initializeValues().
svg/SVGPathSegListValues.cpp: (WebCore::SVGPathSegListValues::clearItemContextAndRole): (WebCore::SVGPathSegListValues::clearContextAndRoles):
svg/SVGPathSegListValues.h: (WebCore::SVGPathSegListValues::operator=): (WebCore::SVGPathSegListValues::clear):

LayoutTests:

svg/dom/reuse-pathseg-after-changing-d-expected.txt: Added.
svg/dom/reuse-pathseg-after-changing-d.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229830 268f45cc-cd09-0410-ab3c-d52691b4dbfc

8:03 PM Changeset in webkit [230232] by youenn@apple.com

3 edits in trunk/Source/WebKit

Make NetworkProcess get ContentBlocker information from UIProcess
https://bugs.webkit.org/show_bug.cgi?id=184205
<rdar://problem/39146551>

Unreviewed.
Updated decode/encode methods to not hit null identifier assertion.

Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::encode const):
(WebKit::WebPageCreationParameters::decode):

Shared/WebPageGroupData.cpp:

(WebKit::WebPageGroupData::encode const):
(WebKit::WebPageGroupData::decode):

7:41 PM Changeset in webkit [230231] by aestes@apple.com

5 edits in trunk/Source/WebKit

[iOS] WKWebView shouldn't know about WKPDFView
https://bugs.webkit.org/show_bug.cgi?id=184283

Reviewed by Timothy Hatcher.

WKWebView shouldn't be checking if _customContentView is a particular kind of
class (e.g., WKPDFView). Instead, it should interact with the _customContentView
using the WKWebViewContentProvider protocol.

Reimplement -_isBackground, -_isDisplayingPDF, -_dataForDisplayedPDF, and
-_suggestedFilenameForDisplayedPDF using new WKWebViewContentProvider protocol
methods that WKPDFView implements.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _isBackground]):
(-[WKWebView _isDisplayingPDF]):
(-[WKWebView _dataForDisplayedPDF]):
(-[WKWebView _suggestedFilenameForDisplayedPDF]):

UIProcess/Cocoa/WKWebViewContentProvider.h:
UIProcess/ios/WKPDFView.h:
UIProcess/ios/WKPDFView.mm:

(-[WKPDFView web_dataRepresentation]):
(-[WKPDFView web_suggestedFilename]):
(-[WKPDFView web_isBackground]):
(-[WKPDFView suggestedFilename]): Deleted.
(-[WKPDFView pdfDocument]): Deleted.
(-[WKPDFView isBackground]): Deleted.

6:19 PM Changeset in webkit [230230] by mark.lam@apple.com

2 edits in trunk/JSTests

Test js-fixed-array-out-of-memory.js should be excluded for memory limited devices.
https://bugs.webkit.org/show_bug.cgi?id=184284

Reviewed by Saam Barati.

stress/js-fixed-array-out-of-memory.js:

5:56 PM Changeset in webkit [230229] by Ross Kirsling

21 edits in trunk/Source/WebCore

Add missing WEBCORE_EXPORTs (for Windows shared library build)
https://bugs.webkit.org/show_bug.cgi?id=184279

Reviewed by Alex Christensen.

dom/Element.h:
dom/Node.h:
editing/FrameSelection.h:
html/DOMURL.h:
html/HTMLFormElement.h:
html/canvas/CanvasRenderingContext.h:
platform/graphics/GraphicsContext.h:
platform/graphics/PlatformDisplay.h:
platform/graphics/cairo/CairoOperations.h:
platform/graphics/cairo/GraphicsContextImplCairo.h:
platform/graphics/texmap/TextureMapperLayer.h:
platform/network/HTTPHeaderMap.h:
platform/network/ResourceRequestBase.h:
platform/network/ResourceResponseBase.h:
platform/network/curl/AuthenticationChallenge.h:
platform/network/curl/CurlFormDataStream.h:
platform/network/curl/CurlRequest.h:
platform/network/curl/CurlSSLHandle.h:
platform/network/curl/ResourceError.h:
platform/network/curl/ResourceResponse.h:

5:46 PM Changeset in webkit [230228] by commit-queue@webkit.org

4 edits in trunk/Source/WebInspectorUI

AX: Add Experimental setting for Accessibility Audit
https://bugs.webkit.org/show_bug.cgi?id=183646
<rdar://problem/38478583>

Patch by Aaron Chu <aaron_chu@apple.com> on 2018-04-03
Reviewed by Brian Burg.

Added experimental feature flag for Accessibility Audit work.

Localizations/en.lproj/localizedStrings.js:
UserInterface/Base/Setting.js:
UserInterface/Views/SettingsTabContentView.js:

(WI.SettingsTabContentView.prototype._createExperimentalSettingsView):

5:44 PM Changeset in webkit [230227] by youenn@apple.com

9 edits in trunk/Source

RealtimeOutgoingVideoSourceMac should pass a ObjCFrameBuffer buffer
https://bugs.webkit.org/show_bug.cgi?id=184281
rdar://problem/39153262

Reviewed by Jer Noble.

Source/ThirdParty/libwebrtc:

Introduce a routine to create the wrapper around native pixel buffers as expected by the new libwebrtc H264 encoder.

Configurations/libwebrtc.iOS.exp:
Configurations/libwebrtc.iOSsim.exp:
Configurations/libwebrtc.mac.exp:
Source/webrtc/sdk/WebKit/WebKitUtilities.h:
Source/webrtc/sdk/WebKit/WebKitUtilities.mm:

(webrtc::pixelBufferToFrame):

Source/WebCore:

Covered by manual testing by going to WebRTC web sites.

platform/mediastream/mac/RealtimeOutgoingVideoSourceCocoa.cpp:

(WebCore::RealtimeOutgoingVideoSourceCocoa::sampleBufferUpdated):

4:52 PM Changeset in webkit [230226] by fpizlo@apple.com

30 edits
6 deletes in trunk/Source

GC shouldn't do object distancing
https://bugs.webkit.org/show_bug.cgi?id=184195

Reviewed by Saam Barati.
Source/JavaScriptCore:

This rolls out SecurityKind/SecurityOriginToken, but keeps the TLC infrastructure. It seems
to be a small speed-up.

CMakeLists.txt:
JavaScriptCore.xcodeproj/project.pbxproj:
Sources.txt:
heap/BlockDirectory.cpp:

(JSC::BlockDirectory::findBlockForAllocation):
(JSC::BlockDirectory::addBlock):

heap/BlockDirectory.h:
heap/CellAttributes.cpp:

(JSC::CellAttributes::dump const):

heap/CellAttributes.h:

(JSC::CellAttributes::CellAttributes):

heap/LocalAllocator.cpp:

(JSC::LocalAllocator::allocateSlowCase):
(JSC::LocalAllocator::tryAllocateWithoutCollecting):

heap/MarkedBlock.cpp:

(JSC::MarkedBlock::Handle::didAddToDirectory):

heap/MarkedBlock.h:

(JSC::MarkedBlock::Handle::securityOriginToken const): Deleted.

heap/SecurityKind.cpp: Removed.
heap/SecurityKind.h: Removed.
heap/SecurityOriginToken.cpp: Removed.
heap/SecurityOriginToken.h: Removed.
heap/ThreadLocalCache.cpp:

(JSC::ThreadLocalCache::create):
(JSC::ThreadLocalCache::ThreadLocalCache):

heap/ThreadLocalCache.h:

(JSC::ThreadLocalCache::securityOriginToken const): Deleted.

runtime/JSDestructibleObjectHeapCellType.cpp:

(JSC::JSDestructibleObjectHeapCellType::JSDestructibleObjectHeapCellType):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::JSGlobalObject):

runtime/JSGlobalObject.h:

(JSC::JSGlobalObject::threadLocalCache const): Deleted.

runtime/JSSegmentedVariableObjectHeapCellType.cpp:

(JSC::JSSegmentedVariableObjectHeapCellType::JSSegmentedVariableObjectHeapCellType):

runtime/JSStringHeapCellType.cpp:

(JSC::JSStringHeapCellType::JSStringHeapCellType):

runtime/VM.cpp:

(JSC::VM::VM):

runtime/VM.h:
runtime/VMEntryScope.cpp:

(JSC::VMEntryScope::VMEntryScope):

wasm/js/JSWebAssemblyCodeBlockHeapCellType.cpp:

(JSC::JSWebAssemblyCodeBlockHeapCellType::JSWebAssemblyCodeBlockHeapCellType):

Source/WebCore:

No new tests because no change in behavior.

Sources.txt:
WebCore.xcodeproj/project.pbxproj:
bindings/js/JSDOMGlobalObject.cpp:

(WebCore::JSDOMGlobalObject::JSDOMGlobalObject):

bindings/js/JSDOMGlobalObject.h:
bindings/js/JSDOMWindowBase.cpp:

(WebCore::JSDOMWindowBase::JSDOMWindowBase):

dom/Document.cpp:

(WebCore::Document::threadLocalCache): Deleted.

dom/Document.h:
page/OriginThreadLocalCache.cpp: Removed.
page/OriginThreadLocalCache.h: Removed.

4:50 PM Changeset in webkit [230225] by Brent Fulgham

10 edits in trunk/Source

Guard against keychain/certificate access outside the network process
https://bugs.webkit.org/show_bug.cgi?id=184214
<rdar://problem/38734795>

Reviewed by Youenn Fablet.

Use the ProcessPrivilege assertions to guard against accessing the Keychain from
a non-Networking process.

Source/WebCore:

Modules/webauthn/cocoa/LocalAuthenticator.mm:

(WebCore::LocalAuthenticator::makeCredential): Assert if we access the keychain from
a proces other than the Network or UI process.
(WebCore::LocalAuthenticator::getAssertion): Ditto.
(WebCore::LocalAuthenticator::issueClientCertificate const): Ditto.

crypto/mac/SerializedCryptoKeyWrapMac.mm:

(WebCore::createAndStoreMasterKey): Ditto.
(WebCore::findMasterKey): Ditto.
(WebCore::deleteDefaultWebCryptoMasterKey): Ditto.

platform/mac/SSLKeyGeneratorMac.mm:

(WebCore::signedPublicKeyAndChallengeString): Ditto.

platform/network/cocoa/NetworkStorageSessionCocoa.mm:

(WebCore::createPrivateStorageSession): Ditto.

platform/network/mac/ResourceHandleMac.mm:

(WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Ditto.

Source/WebKit:

Shared/cf/ArgumentCodersCF.cpp:

(IPC::encode): Assert if we access the keychain from a proces other than the Network or UI process.
(IPC::decode): Ditto.

3:20 PM Changeset in webkit [230224] by youenn@apple.com

23 edits
3 adds in trunk

NetworkResourceLoader does not need to expose all redirect response headers
https://bugs.webkit.org/show_bug.cgi?id=184114
<rdar://problem/39010557>

Reviewed by Ryosuke Niwa.

Source/WebCore:

No JS observable change of behavior.
Behavior change is observable for injected bundles since they will no longer get access to the full response.
List of response headers correspond to the one currently being used/exposed for redirections.

Test: http/wpt/loading/redirect-headers.html

page/RuntimeEnabledFeatures.h:

(WebCore::RuntimeEnabledFeatures::setRestrictedHTTPResponseAccess):
(WebCore::RuntimeEnabledFeatures::restrictedHTTPResponseAccess const):

platform/network/ResourceResponseBase.cpp:

(WebCore::isSafeToKeepRedirectionHeader):
(WebCore::ResourceResponseBase::sanitizeRedirectionHTTPHeaderFields):

platform/network/ResourceResponseBase.h:

Source/WebKit:

WebProcess instructs NetworkProcess whether to sanitize response headers based on a runtime flag.
We sanitize redirection response headers in case this is not related to a navigation load.
Navigation loads may currently require the full response for content blockers.

NetworkProcess/NetworkResourceLoadParameters.cpp:

(WebKit::NetworkResourceLoadParameters::encode const):
(WebKit::NetworkResourceLoadParameters::decode):

NetworkProcess/NetworkResourceLoadParameters.h:
NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::willSendRedirectedRequest):
(WebKit::NetworkResourceLoader::sanitizeRedirectResponseIfPossible):
(WebKit::NetworkResourceLoader::dispatchWillSendRequestForCacheEntry):

NetworkProcess/NetworkResourceLoader.h:
Shared/WebPreferences.yaml:
UIProcess/API/C/WKPreferences.cpp:

(WKPreferencesSetRestrictedHTTPResponseAccess):
(WKPreferencesGetRestrictedHTTPResponseAccess):

UIProcess/API/C/WKPreferencesRef.h:
WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::scheduleLoadFromNetworkProcess):
(WebKit::WebLoaderStrategy::loadResourceSynchronously):
(WebKit::WebLoaderStrategy::startPingLoad):
(WebKit::WebLoaderStrategy::preconnectTo):

Tools:

Add an option to dump the number of headers in a response.
This allows validating that filtering does happen or not.

WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:

(WTR::dumpResponseDescriptionSuitableForTestResult):
(WTR::InjectedBundlePage::responseHeaderCount):
(WTR::InjectedBundlePage::willSendRequestForFrame):

WebKitTestRunner/InjectedBundle/InjectedBundlePage.h:
WebKitTestRunner/InjectedBundle/TestRunner.h:

(WTR::TestRunner::dumpAllHTTPRedirectedResponseHeaders):
(WTR::TestRunner::shouldDumpAllHTTPRedirectedResponseHeaders const):

WebKitTestRunner/InjectedBundle/cocoa/InjectedBundlePageCocoa.mm:

(WTR::InjectedBundlePage::responseHeaderCount):

WebKitTestRunner/TestController.cpp:

(WTR::TestController::resetPreferencesToConsistentValues):

LayoutTests:

New test verifies that headers are filtered. Witout filtering, 9 headers would be visible to the injected bundle, while 6 headers reamin after filtering.

http/wpt/loading/redirect-headers-expected.txt: Added.
http/wpt/loading/redirect-headers.html: Added.
platform/mac-wk1/TestExpectations: Skipped new test for WK1.

2:33 PM Changeset in webkit [230223] by youenn@apple.com

26 edits
2 copies
2 adds in trunk/Source/WebKit

Make NetworkProcess get ContentBlocker information from UIProcess
https://bugs.webkit.org/show_bug.cgi?id=184205

Reviewed by Alex Christensen.

Make NetworkProcess get content blockers from UIProcess directly.
Before that patch, WebProcess sent content blockers to NetworkProcess for each PingLoad.
Instead, WebProcess sends the content blocker identifier for each PingLoad and NetworkProcess fetches the content blocker once.

This is both more efficient than passing them for each PingLoad and safer in the sense
that a compromised WebProcess will not be able to bypass any of these.
In the future, NetworkProcess should get the content blocker identifier directly from the WebPageID attached to the request.

Covered by existing beacon+content blocker tests.

Did some refactoring to add a typed content blocker identifier.
Once NetworkProcess fetches a given content blocker, the content blocker will send any modification to NetworkProcess.
Introduced NetworkContentRuleListManager to handle the content blockers in NetworkProcess.

CMakeLists.txt:
DerivedSources.make:
NetworkProcess/NetworkLoadChecker.cpp:

(WebKit::NetworkLoadChecker::checkRequest):
(WebKit::NetworkLoadChecker::continueCheckingRequest):
(WebKit::NetworkLoadChecker::processContentExtensionRulesForLoad):

NetworkProcess/NetworkLoadChecker.h:

(WebKit::NetworkLoadChecker::setContentExtensionController):

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::didReceiveMessage):

NetworkProcess/NetworkProcess.h:

(WebKit::NetworkProcess::networkUserContentController):

NetworkProcess/NetworkResourceLoadParameters.cpp:

(WebKit::NetworkResourceLoadParameters::encode const):
(WebKit::NetworkResourceLoadParameters::decode):

NetworkProcess/NetworkResourceLoadParameters.h:
NetworkProcess/NetworkContentRuleListManager.cpp: Added.

(WebKit::NetworkContentRuleListManager::contentExtensionsBackend):
(WebKit::NetworkContentRuleListManager::addContentRuleLists):
(WebKit::NetworkContentRuleListManager::removeContentRuleList):
(WebKit::NetworkContentRuleListManager::removeAllContentRuleLists):
(WebKit::NetworkContentRuleListManager::remove):

NetworkProcess/NetworkContentRuleListManager.h: Added.
NetworkProcess/NetworkContentRuleListManager.messages.in: Added.
NetworkProcess/PingLoad.cpp:
Scripts/webkit/messages.py:
Shared/UserContentControllerIdentifier.h: Added.
Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::decode):

Shared/WebPageCreationParameters.h:
Shared/WebPageGroupData.cpp:

(WebKit::WebPageGroupData::decode):

Shared/WebPageGroupData.h:
UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::~NetworkProcessProxy):
(WebKit::NetworkProcessProxy::contentExtensionRules):
(WebKit::NetworkProcessProxy::didDestroyWebUserContentControllerProxy):

UIProcess/Network/NetworkProcessProxy.h:
UIProcess/Network/NetworkProcessProxy.messages.in:
UIProcess/UserContent/WebUserContentControllerProxy.cpp:

(WebKit::WebUserContentControllerProxy::get):
(WebKit::WebUserContentControllerProxy::WebUserContentControllerProxy):
(WebKit::WebUserContentControllerProxy::~WebUserContentControllerProxy):
(WebKit::WebUserContentControllerProxy::addProcess):
(WebKit::WebUserContentControllerProxy::removeProcess):
(WebKit::WebUserContentControllerProxy::addUserContentWorldUse):
(WebKit::WebUserContentControllerProxy::removeUserContentWorldUses):
(WebKit::WebUserContentControllerProxy::addUserScript):
(WebKit::WebUserContentControllerProxy::removeUserScript):
(WebKit::WebUserContentControllerProxy::removeAllUserScripts):
(WebKit::WebUserContentControllerProxy::addUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeUserStyleSheet):
(WebKit::WebUserContentControllerProxy::removeAllUserStyleSheets):
(WebKit::WebUserContentControllerProxy::addUserScriptMessageHandler):
(WebKit::WebUserContentControllerProxy::removeUserMessageHandlerForName):
(WebKit::WebUserContentControllerProxy::removeAllUserMessageHandlers):
(WebKit::WebUserContentControllerProxy::addContentRuleList):
(WebKit::WebUserContentControllerProxy::removeContentRuleList):
(WebKit::WebUserContentControllerProxy::removeAllContentRuleLists):

UIProcess/UserContent/WebUserContentControllerProxy.h:

(WebKit::WebUserContentControllerProxy::create):
(WebKit::WebUserContentControllerProxy::addNetworkProcess):
(WebKit::WebUserContentControllerProxy::removeNetworkProcess):
(WebKit::WebUserContentControllerProxy::contentExtensionRules):
(WebKit::WebUserContentControllerProxy::identifier const):

WebKit.xcodeproj/project.pbxproj:
WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::startPingLoad):

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::getOrCreate):
(WebKit::WebUserContentController::WebUserContentController):
(WebKit::WebUserContentController::~WebUserContentController):

WebProcess/UserContent/WebUserContentController.h:
WebProcess/WebPage/WebPage.h:

(WebKit::WebPage::userContentControllerIdentifier const):

1:41 PM Changeset in webkit [230222] by sbarati@apple.com

2 edits in trunk/Source/bmalloc

totalPhysicalSize calculation when splitting a range must account for double rounding effects
https://bugs.webkit.org/show_bug.cgi?id=184275

Reviewed by Mark Lam.

The rounding error could happen when we split a range where the
range's total physical size equals the range's total size. The
rounding may cause the left size to lose a byte, and the right
size to gain a byte. This caused the right side to be a byte
large than its size.

bmalloc/LargeRange.h:

(bmalloc::LargeRange::LargeRange):
(bmalloc::LargeRange::split const):

1:40 PM Changeset in webkit [230221] by aestes@apple.com

10 edits in trunk

[Mac] Prioritize file promises over filenames during drag and drop
https://bugs.webkit.org/show_bug.cgi?id=184237
<rdar://problem/38278076>

Reviewed by Wenson Hsieh.

Source/WebCore:

When performing a drag operation where the pasteboard contains both a file path and a file
promise, we have historically preferred to accept the file path. Some versions of Photos.app
will provide both a low-resolution thumbnail as a file path and its high-resolution
counterpart as a file promise when dragging a photo, and our current logic leads us to
choose the low-quality thumbnail.

This patch changes our logic to prefer file promises over file paths. This matches the
behavior of Finder and ensures we accept high-resolution assets from Photos.app.

Covered by existing file promise drag tests. beginDragWithFilePromises() was updated to
write a bogus file path to the pasteboard along with the legitimate file promise.

platform/mac/DragDataMac.mm:

(WebCore::DragData::asFilenames const):

platform/mac/PasteboardMac.mm:

(WebCore::Pasteboard::read):
(WebCore::Pasteboard::readFilePaths):

platform/mac/PlatformPasteboardMac.mm:

(WebCore::PlatformPasteboard::numberOfFiles const):

Source/WebKit:

UIProcess/Cocoa/WebViewImpl.mm:

(WebKit::WebViewImpl::performDragOperation):

Source/WebKitLegacy/mac:

WebView/WebView.mm:

(-[WebView performDragOperation:]):

Tools:

DumpRenderTree/mac/EventSendingController.mm:

(-[EventSendingController beginDragWithFilePromises:]):

1:22 PM Changeset in webkit [230220] by mark.lam@apple.com

58 edits in trunk/Source/WebCore

Fix mis-application of WTF_PREPARE_VTBL_POINTER_FOR_INSPECTION macro.
https://bugs.webkit.org/show_bug.cgi?id=184276
<rdar://problem/39109543>

Rubber-stamped by Michael Saboff.

bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

bindings/scripts/test/JS/JSInterfaceName.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSMapLike.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSReadOnlyMapLike.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestCEReactions.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestCallTracer.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestEnabledBySetting.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestEventConstructor.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestEventTarget.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestException.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestGlobalObject.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestIterable.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedConstructor.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedGetterCallWith.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedSetterThrowingException.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestNode.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestPluginInterface.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestPromiseRejectionEvent.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestSerialization.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestStringifier.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestStringifierNamedOperation.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.cpp:

(WebCore::toJSNewlyCreated):

bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::toJSNewlyCreated):

1:01 PM Changeset in webkit [230219] by beidson@apple.com

9 edits in trunk

Make SessionStorage work with process swapping.
https://bugs.webkit.org/show_bug.cgi?id=184270

Reviewed by Andy Estes.

Source/WebKit:

Due to a minor process accounting error, WebPageProxys weren't always being reconnected with their
WebsiteDataStore's StorageManager when doing process swaps.

Fix that error, and SessionStorage "just works."

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::webProcessWillShutDown):
(WebKit::WebPageProxy::processDidTerminate): For NavigationSwap termination, make sure to tell the

process lifetime tracker that this page was removed.

UIProcess/WebProcessLifetimeObserver.h:

(WebKit::WebProcessLifetimeObserver::webPageWasInvalidated): Renamed from "webPageWasRemoved"
(WebKit::WebProcessLifetimeObserver::webPageWasRemoved): Deleted.

UIProcess/WebProcessLifetimeTracker.cpp:

(WebKit::WebProcessLifetimeTracker::webPageLeavingWebProcess): Renamed from "webProcessWillShutDown"
(WebKit::WebProcessLifetimeTracker::pageWasInvalidated):
(WebKit::WebProcessLifetimeTracker::webProcessWillShutDown): Deleted.

UIProcess/WebProcessLifetimeTracker.h:

UIProcess/WebsiteData/WebsiteDataStore.cpp:

(WebKit::WebsiteDataStore::webPageWasInvalidated):
(WebKit::WebsiteDataStore::webPageWasRemoved): Deleted.

UIProcess/WebsiteData/WebsiteDataStore.h:

Tools:

TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

(-[PSONMessageHandler userContentController:didReceiveScriptMessage:]):

12:58 PM Changeset in webkit [230218] by commit-queue@webkit.org

26 edits
4 deletes in trunk/Source/WebKit

Unreviewed, rolling out r230210.
https://bugs.webkit.org/show_bug.cgi?id=184277

it is breaking internal bots (Requested by youenn on #webkit).

Reverted changeset:

"Make NetworkProcess get ContentBlocker information from
UIProcess"
https://bugs.webkit.org/show_bug.cgi?id=184205
https://trac.webkit.org/changeset/230210

12:22 PM Changeset in webkit [230217] by Wenson Hsieh

3 edits
4 deletes in trunk/Source/WebKit

[Extra zoom mode] Update time picker to use platform view controller
https://bugs.webkit.org/show_bug.cgi?id=184252
<rdar://problem/38804795>

Reviewed by Andy Estes.

Adjust for some small WKTimePickerViewController changes, and remove some files that we no longer need.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView presentViewControllerForCurrentAssistedNode]):
(-[WKContentView textInputController:didCommitText:]): Deleted.
(-[WKContentView textInputController:didCommitText:withSuggestion:]): Deleted.
(-[WKContentView textInputControllerDidRequestDismissal:]): Deleted.

UIProcess/ios/forms/WKTextFormControlViewController.h: Removed.
UIProcess/ios/forms/WKTextFormControlViewController.mm: Removed.
UIProcess/ios/forms/WKTextSuggestionButton.h: Removed.
UIProcess/ios/forms/WKTextSuggestionButton.mm: Removed.
WebKit.xcodeproj/project.pbxproj:

12:02 PM Changeset in webkit [230216] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark http/tests/appcache/interrupted-update.html as flaky.
https://bugs.webkit.org/show_bug.cgi?id=184061

Unreviewed test gardening.

TestExpectations:

12:02 PM Changeset in webkit [230215] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark storage/indexeddb/dont-wedge-private.html as flaky.
https://bugs.webkit.org/show_bug.cgi?id=184058

Unreviewed test gardening.

TestExpectations:

12:02 PM Changeset in webkit [230214] by Ryan Haddad

3 edits in trunk/LayoutTests

Mark http/tests/workers/service/service-worker-cache-api.https.html as flaky.
https://bugs.webkit.org/show_bug.cgi?id=184245

Unreviewed test gardening.

platform/ios-wk2/TestExpectations:
platform/mac-wk2/TestExpectations:

11:14 AM Changeset in webkit [230213] by Ross Kirsling

2 edits in trunk/Source/WebKit

Xcode prepends line comments from WTF/Compiler.h to *.sb files
https://bugs.webkit.org/show_bug.cgi?id=184166

Reviewed by Brent Fulgham.

DerivedSources.make:

Strip ;-comments from *.sb.in files before preprocessing so we can stop treating Platform.h/Compiler.h as C89.

11:14 AM Changeset in webkit [230212] by commit-queue@webkit.org

3 edits in trunk/Source/WebCore

[CMake] gperf path should be given when WebCore/css/makevalues.pl is executed
https://bugs.webkit.org/show_bug.cgi?id=184224

Patch by Yousuke Kimoto <yousuke.kimoto@sony.com> on 2018-04-03
Reviewed by Konstantin Tokarev.

When a building evironment doens't include a path to gperf,
WebCore/css/makevalue.pl failes due to failing to execute gperf,
so the full path to gperf should be given like WebCore/css/makeprop.pl.

No new tests, no Web-facing behavior change.

CMakeLists.txt: gperf path is given to css/makevalues.pl.
css/makevalues.pl: Add an argument to handle a given gperf path.

11:01 AM Changeset in webkit [230211] by Chris Dumez

189 edits
2 deletes in trunk

Drop MainFrame class
https://bugs.webkit.org/show_bug.cgi?id=184191

Reviewed by Darin Adler.

Source/WebCore:

Drop MainFrame class and move contents into Page / Frame since there is a 1:1
relationship between the Page and the MainFrame.

This is ground work for introducing LocalFrame / RemoteFrame concepts.

Modules/applepay/ApplePaySession.cpp:

(WebCore::ApplePaySession::create):
(WebCore::ApplePaySession::supportsVersion):
(WebCore::ApplePaySession::canMakePayments):
(WebCore::ApplePaySession::canMakePaymentsWithActiveCard):
(WebCore::ApplePaySession::openPaymentSetup):
(WebCore::ApplePaySession::paymentCoordinator const):

Modules/applepay/paymentrequest/ApplePayPaymentHandler.cpp:

(WebCore::paymentCoordinator):

Modules/mediastream/MediaDevicesEnumerationRequest.cpp:
Modules/mediastream/UserMediaRequest.cpp:
Modules/plugins/QuickTimePluginReplacement.mm:
Sources.txt:
WebCore.xcodeproj/project.pbxproj:
accessibility/AccessibilityObject.cpp:

(WebCore::AccessibilityObject::mainFrame const):
(WebCore::AccessibilityObject::visiblePositionForBounds const):

accessibility/AccessibilityObject.h:
accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
bindings/js/ScriptController.cpp:
bindings/js/ScriptState.cpp:
contentextensions/ContentExtensionsBackend.cpp:
css/MediaQueryEvaluator.cpp:

(WebCore::displayModeEvaluate):

dom/DOMImplementation.cpp:
dom/Document.cpp:
dom/DocumentMarkerController.cpp:
dom/Element.cpp:

(WebCore::Element::removedFromAncestor):

dom/EventDispatcher.cpp:
dom/ScriptedAnimationController.cpp:
editing/Editor.cpp:

(WebCore::Editor::scanSelectionForTelephoneNumbers):

editing/EditorCommand.cpp:
editing/SelectionRectGatherer.cpp:

(WebCore::SelectionRectGatherer::Notifier::~Notifier):

editing/cocoa/WebContentReaderCocoa.mm:
editing/markup.cpp:
history/CachedFrame.cpp:
history/CachedPage.cpp:
history/PageCache.cpp:

(WebCore::destroyRenderTree):

html/HTMLMediaElement.cpp:
html/HTMLPlugInImageElement.cpp:
html/ImageDocument.cpp:
html/MediaElementSession.cpp:

(WebCore::isMainContentForPurposesOfAutoplay):

html/canvas/WebGLRenderingContextBase.cpp:
inspector/InspectorClient.cpp:
inspector/InspectorController.cpp:
inspector/InspectorFrontendClientLocal.cpp:
inspector/InspectorFrontendHost.cpp:
inspector/InspectorInstrumentation.cpp:
inspector/InspectorOverlay.cpp:
inspector/PageScriptDebugServer.cpp:
inspector/agents/InspectorApplicationCacheAgent.cpp:
inspector/agents/InspectorCanvasAgent.cpp:
inspector/agents/InspectorDOMAgent.cpp:
inspector/agents/InspectorPageAgent.cpp:

(WebCore::InspectorPageAgent::mainFrame):

inspector/agents/InspectorPageAgent.h:
inspector/agents/page/PageDebuggerAgent.cpp:
inspector/agents/page/PageRuntimeAgent.cpp:
loader/DocumentLoader.cpp:
loader/DocumentWriter.cpp:
loader/FrameLoader.cpp:

(WebCore::FrameLoader::loadWithDocumentLoader):
(WebCore::FrameLoader::setState):

loader/HistoryController.cpp:
loader/NavigationDisabler.h:
loader/ProgressTracker.cpp:
loader/ResourceLoadObserver.cpp:
loader/ResourceLoader.cpp:
loader/SubframeLoader.cpp:
loader/SubresourceLoader.cpp:
loader/appcache/ApplicationCacheHost.cpp:
loader/archive/mhtml/MHTMLArchive.cpp:
loader/cache/CachedResource.cpp:
loader/cache/CachedResourceLoader.cpp:
page/AutoscrollController.cpp:
page/Chrome.cpp:
page/ContextMenuController.cpp:
page/DOMWindow.cpp:
page/DebugPageOverlays.cpp:

(WebCore::MouseWheelRegionOverlay::updateRegion):
(WebCore::NonFastScrollableRegionOverlay::updateRegion):
(WebCore::RegionOverlay::create):
(WebCore::RegionOverlay::RegionOverlay):
(WebCore::RegionOverlay::~RegionOverlay):
(WebCore::DebugPageOverlays::ensureRegionOverlayForPage):
(WebCore::DebugPageOverlays::showRegionOverlay):
(WebCore::DebugPageOverlays::hideRegionOverlay):
(WebCore::DebugPageOverlays::regionChanged):
(WebCore::DebugPageOverlays::regionOverlayForPage const):
(WebCore::DebugPageOverlays::updateOverlayRegionVisibility):
(WebCore::DebugPageOverlays::settingsChanged):

page/DebugPageOverlays.h:

(WebCore::DebugPageOverlays::hasOverlaysForPage const):
(WebCore::DebugPageOverlays::hasOverlays):
(WebCore::DebugPageOverlays::didLayout):
(WebCore::DebugPageOverlays::didChangeEventHandlers):

page/DragController.cpp:

(WebCore::DragController::performDragOperation):
(WebCore::DragController::tryDHTMLDrag):
(WebCore::DragController::beginDrag):
(WebCore::DragController::doSystemDrag):

page/EventHandler.cpp:

(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::mouseMoved):
(WebCore::EventHandler::handleMouseReleaseEvent):
(WebCore::EventHandler::handleWheelEvent):
(WebCore::EventHandler::clearLatchedState):
(WebCore::EventHandler::defaultWheelEventHandler):

page/FocusController.cpp:
page/Frame.cpp:

(WebCore::Frame::Frame):
(WebCore::Frame::dropChildren):
(WebCore::Frame::selfOnlyRef):
(WebCore::Frame::selfOnlyDeref):

page/Frame.h:

(WebCore::Frame::mainFrame const):

page/FrameTree.cpp:
page/FrameView.cpp:

(WebCore::FrameView::setFrameRect):
(WebCore::FrameView::setContentsSize):
(WebCore::FrameView::didChangeScrollOffset):
(WebCore::FrameView::setViewExposedRect):

page/History.cpp:
page/MainFrame.cpp: Removed.
page/MainFrame.h: Removed.
page/MemoryRelease.cpp:
page/Page.cpp:

(WebCore::Page::Page):
(WebCore::m_applicationManifest):
(WebCore::Page::setDeviceScaleFactor):
(WebCore::Page::latchingState):
(WebCore::Page::pushNewLatchingState):
(WebCore::Page::resetLatchingState):
(WebCore::Page::popLatchingState):
(WebCore::Page::removeLatchingStateForTarget):
(WebCore::Page::setPaymentCoordinator):

page/Page.h:

(WebCore::Page::mainFrame):
(WebCore::Page::mainFrame const):
(WebCore::Page::wheelEventDeltaFilter):
(WebCore::Page::pageOverlayController):
(WebCore::Page::servicesOverlayController):
(WebCore::Page::paymentCoordinator const):
(WebCore::Page::applicationManifest const):
(WebCore::Page::performanceLogging const):

page/PageConsoleClient.cpp:
page/PageDebuggable.cpp:
page/PageGroup.cpp:
page/PageGroupLoadDeferrer.cpp:
page/PageOverlay.cpp:

(WebCore::PageOverlay::controller const):

page/PageOverlayController.cpp:

(WebCore::PageOverlayController::PageOverlayController):
(WebCore::PageOverlayController::createRootLayersIfNeeded):
(WebCore::PageOverlayController::layerWithDocumentOverlays):
(WebCore::PageOverlayController::layerWithViewOverlays):
(WebCore::PageOverlayController::installPageOverlay):
(WebCore::PageOverlayController::updateForceSynchronousScrollLayerPositionUpdates):
(WebCore::PageOverlayController::didChangeViewExposedRect):
(WebCore::PageOverlayController::updateSettingsForLayer):
(WebCore::PageOverlayController::deviceScaleFactor const):
(WebCore::PageOverlayController::notifyFlushRequired):
(WebCore::PageOverlayController::tiledBackingUsageChanged):

page/PageOverlayController.h:
page/PageSerializer.cpp:
page/PerformanceLogging.cpp:

(WebCore::PerformanceLogging::PerformanceLogging):
(WebCore::PerformanceLogging::didReachPointOfInterest):

page/PerformanceLogging.h:
page/PerformanceMonitor.cpp:
page/ResourceUsageOverlay.cpp:

(WebCore::ResourceUsageOverlay::~ResourceUsageOverlay):
(WebCore::ResourceUsageOverlay::initialize):

page/SettingsBase.cpp:
page/SpatialNavigation.cpp:
page/UserContentProvider.cpp:
page/ios/FrameIOS.mm:
page/mac/DragControllerMac.mm:
page/mac/EventHandlerMac.mm:

(WebCore::latchingIsLockedToPlatformFrame):
(WebCore::latchingIsLockedToAncestorOfThisFrame):
(WebCore::EventHandler::clearOrScheduleClearingLatchedStateIfNeeded):
(WebCore::EventHandler::platformPrepareForWheelEvents):
(WebCore::EventHandler::platformRecordWheelEvent):
(WebCore::EventHandler::platformCompleteWheelEvent):
(WebCore::EventHandler::platformCompletePlatformWidgetWheelEvent):

page/mac/PageMac.mm:
page/mac/ServicesOverlayController.h:

(WebCore::ServicesOverlayController::page const):

page/mac/ServicesOverlayController.mm:

(WebCore::ServicesOverlayController::Highlight::Highlight):
(WebCore::ServicesOverlayController::Highlight::notifyFlushRequired):
(WebCore::ServicesOverlayController::Highlight::deviceScaleFactor const):
(WebCore::ServicesOverlayController::ServicesOverlayController):
(WebCore::ServicesOverlayController::invalidateHighlightsOfType):
(WebCore::ServicesOverlayController::buildPotentialHighlightsIfNeeded):
(WebCore::ServicesOverlayController::remainingTimeUntilHighlightShouldBeShown const):
(WebCore::ServicesOverlayController::buildPhoneNumberHighlights):
(WebCore::ServicesOverlayController::buildSelectionHighlight):
(WebCore::ServicesOverlayController::hasRelevantSelectionServices):
(WebCore::ServicesOverlayController::createOverlayIfNeeded):
(WebCore::ServicesOverlayController::telephoneNumberRangesForFocusedFrame):
(WebCore::ServicesOverlayController::findTelephoneNumberHighlightContainingSelectionHighlight):
(WebCore::ServicesOverlayController::mouseEvent):
(WebCore::ServicesOverlayController::handleClick):
(WebCore::ServicesOverlayController::mainFrame const):

page/scrolling/AsyncScrollingCoordinator.cpp:
page/scrolling/ScrollingCoordinator.cpp:
page/scrolling/ios/ScrollingCoordinatorIOS.mm:
page/scrolling/mac/ScrollingCoordinatorMac.mm:
platform/graphics/ca/win/CACFLayerTreeHost.cpp:
plugins/DOMMimeType.cpp:
plugins/PluginInfoProvider.cpp:

(WebCore::PluginInfoProvider::refresh):

rendering/RenderBox.cpp:
rendering/RenderLayer.cpp:
rendering/RenderLayerBacking.cpp:
rendering/RenderLayerCompositor.cpp:

(WebCore::RenderLayerCompositor::hasAnyAdditionalCompositedLayers const):
(WebCore::RenderLayerCompositor::updateCompositingLayers):
(WebCore::RenderLayerCompositor::appendDocumentOverlayLayers):
(WebCore::RenderLayerCompositor::attachRootLayer):
(WebCore::RenderLayerCompositor::detachRootLayer):
(WebCore::RenderLayerCompositor::rootLayerAttachmentChanged):

rendering/RenderObject.cpp:
replay/UserInputBridge.cpp:
storage/StorageEventDispatcher.cpp:
style/StyleTreeResolver.cpp:

(WebCore::Style::suspendMemoryCacheClientCalls):

svg/SVGSVGElement.cpp:
svg/graphics/SVGImage.cpp:
testing/InternalSettings.cpp:
testing/Internals.cpp:

(WebCore::Internals::Internals):
(WebCore::Internals::installMockPageOverlay):
(WebCore::Internals::pageOverlayLayerTreeAsText const):

testing/MockPageOverlay.cpp:
testing/MockPageOverlay.h:
testing/MockPageOverlayClient.cpp:

(WebCore::MockPageOverlayClient::installOverlay):
(WebCore::MockPageOverlayClient::layerTreeAsText):

testing/MockPageOverlayClient.h:
testing/MockPaymentCoordinator.cpp:

(WebCore::MockPaymentCoordinator::MockPaymentCoordinator):
(WebCore::MockPaymentCoordinator::showPaymentUI):
(WebCore::MockPaymentCoordinator::completeMerchantValidation):
(WebCore::MockPaymentCoordinator::changeShippingOption):
(WebCore::MockPaymentCoordinator::changePaymentMethod):
(WebCore::MockPaymentCoordinator::acceptPayment):
(WebCore::MockPaymentCoordinator::cancelPayment):

testing/MockPaymentCoordinator.h:
workers/service/context/ServiceWorkerThreadProxy.cpp:

Source/WebKit:

Drop MainFrame class and move contents into Page / Frame since there is a 1:1
relationship between the Page and the MainFrame.

This is ground work for introducing LocalFrame / RemoteFrame concepts.

Shared/WebRenderLayer.cpp:
Shared/WebRenderObject.cpp:
WebProcess/ApplePay/WebPaymentCoordinator.cpp:

(WebKit::WebPaymentCoordinator::paymentCoordinator):

WebProcess/Automation/WebAutomationSessionProxy.cpp:
WebProcess/FullScreen/WebFullScreenManager.cpp:
WebProcess/InjectedBundle/API/c/WKBundlePage.cpp:

(WKBundlePageInstallPageOverlay):
(WKBundlePageUninstallPageOverlay):
(WKBundlePageInstallPageOverlayWithAnimation):
(WKBundlePageUninstallPageOverlayWithAnimation):

WebProcess/InjectedBundle/API/glib/WebKitWebPage.cpp:
WebProcess/InjectedBundle/API/mac/WKWebProcessPlugInBrowserContextController.mm:
WebProcess/InjectedBundle/InjectedBundle.cpp:
WebProcess/Plugins/PDF/PDFPlugin.mm:
WebProcess/Plugins/PluginView.cpp:
WebProcess/Plugins/WebPluginInfoProvider.cpp:
WebProcess/WebCoreSupport/WebChromeClient.cpp:
WebProcess/WebCoreSupport/WebContextMenuClient.cpp:
WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
WebProcess/WebCoreSupport/WebInspectorClient.cpp:

(WebKit::WebInspectorClient::~WebInspectorClient):
(WebKit::WebInspectorClient::highlight):
(WebKit::WebInspectorClient::hideHighlight):
(WebKit::WebInspectorClient::showPaintRect):

WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
WebProcess/WebCoreSupport/WebProgressTrackerClient.cpp:
WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm:
WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
WebProcess/WebPage/AcceleratedDrawingArea.cpp:
WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp:
WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:
WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp:
WebProcess/WebPage/FindController.cpp:

(WebKit::FindController::updateFindUIAfterPageScroll):
(WebKit::FindController::hideFindUI):

WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeContext.mm:
WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm:

(WebKit::RemoteLayerTreeDrawingArea::updatePreferences):

WebProcess/WebPage/WKAccessibilityWebPageObjectIOS.mm:
WebProcess/WebPage/WebBackForwardListProxy.cpp:
WebProcess/WebPage/WebFrame.cpp:
WebProcess/WebPage/WebInspector.cpp:
WebProcess/WebPage/WebInspectorFrontendAPIDispatcher.cpp:
WebProcess/WebPage/WebPage.cpp:

(WebKit::WebPage::mainFrame const):
(WebKit::WebPage::determinePrimarySnapshottedPlugIn):
(WebKit::WebPage::plugInIntersectsSearchRect):

WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/atk/WebPageAccessibilityObjectAtk.cpp:
WebProcess/WebPage/ios/FindControllerIOS.mm:
WebProcess/WebPage/ios/WebPageIOS.mm:
WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:

(WebKit::TiledCoreAnimationDrawingArea::updatePreferences):

WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm:
WebProcess/WebPage/mac/WKAccessibilityWebPageObjectMac.mm:

(-[WKAccessibilityWebPageObject accessibilityParameterizedAttributeNames]):
(-[WKAccessibilityWebPageObject accessibilityAttributeValue:forParameter:]):

WebProcess/WebPage/mac/WebPageMac.mm:

(WebKit::WebPage::performImmediateActionHitTestAtLocation):
(WebKit::WebPage::dataDetectorsDidPresentUI):
(WebKit::WebPage::dataDetectorsDidChangeUI):
(WebKit::WebPage::dataDetectorsDidHideUI):

WebProcess/WebProcess.cpp:
WebProcess/WebStorage/StorageAreaMap.cpp:

Source/WebKitLegacy/mac:

Drop MainFrame class and move contents into Page / Frame since there is a 1:1
relationship between the Page and the MainFrame.

This is ground work for introducing LocalFrame / RemoteFrame concepts.

WebCoreSupport/WebDragClient.mm:
WebCoreSupport/WebFrameLoaderClient.mm:
WebCoreSupport/WebInspectorClient.mm:
WebCoreSupport/WebPlatformStrategies.mm:
WebCoreSupport/WebPluginInfoProvider.mm:
WebView/WebFrame.mm:
WebView/WebFrameView.mm:
WebView/WebHTMLView.mm:
WebView/WebView.mm:

Source/WebKitLegacy/win:

Drop MainFrame class and move contents into Page / Frame since there is a 1:1
relationship between the Page and the MainFrame.

This is ground work for introducing LocalFrame / RemoteFrame concepts.

WebCoreSupport/AcceleratedCompositingContext.cpp:
WebCoreSupport/WebContextMenuClient.cpp:
WebCoreSupport/WebDragClient.cpp:
WebDropSource.cpp:
WebFrame.cpp:
WebView.cpp:

Tools:

TestWebKitAPI/Tests/WebCore/cocoa/WebCoreNSURLSession.mm:

10:58 AM Changeset in webkit [230210] by youenn@apple.com

26 edits
2 copies
2 adds in trunk/Source/WebKit

Make NetworkProcess get ContentBlocker information from UIProcess
https://bugs.webkit.org/show_bug.cgi?id=184205

Reviewed by Alex Christensen.

Covered by existing beacon+content blocker tests.

CMakeLists.txt:
DerivedSources.make:
NetworkProcess/NetworkLoadChecker.cpp:

(WebKit::NetworkLoadChecker::checkRequest):
(WebKit::NetworkLoadChecker::continueCheckingRequest):
(WebKit::NetworkLoadChecker::processContentExtensionRulesForLoad):

NetworkProcess/NetworkLoadChecker.h:

(WebKit::NetworkLoadChecker::setContentExtensionController):

NetworkProcess/NetworkProcess.cpp:

(WebKit::NetworkProcess::didReceiveMessage):

NetworkProcess/NetworkProcess.h:

(WebKit::NetworkProcess::networkUserContentController):

NetworkProcess/NetworkResourceLoadParameters.cpp:

(WebKit::NetworkResourceLoadParameters::encode const):
(WebKit::NetworkResourceLoadParameters::decode):

NetworkProcess/NetworkResourceLoadParameters.h:
NetworkProcess/NetworkContentRuleListManager.cpp: Added.

NetworkProcess/NetworkContentRuleListManager.h: Added.
NetworkProcess/NetworkContentRuleListManager.messages.in: Added.
NetworkProcess/PingLoad.cpp:
Scripts/webkit/messages.py:
Shared/UserContentControllerIdentifier.h: Added.
Shared/WebPageCreationParameters.cpp:

(WebKit::WebPageCreationParameters::decode):

Shared/WebPageCreationParameters.h:
Shared/WebPageGroupData.cpp:

(WebKit::WebPageGroupData::decode):

Shared/WebPageGroupData.h:
UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::~NetworkProcessProxy):
(WebKit::NetworkProcessProxy::contentExtensionRules):
(WebKit::NetworkProcessProxy::didDestroyWebUserContentControllerProxy):

UIProcess/Network/NetworkProcessProxy.h:
UIProcess/Network/NetworkProcessProxy.messages.in:
UIProcess/UserContent/WebUserContentControllerProxy.cpp:

UIProcess/UserContent/WebUserContentControllerProxy.h:

WebKit.xcodeproj/project.pbxproj:
WebProcess/Network/WebLoaderStrategy.cpp:

(WebKit::WebLoaderStrategy::startPingLoad):

WebProcess/UserContent/WebUserContentController.cpp:

(WebKit::WebUserContentController::getOrCreate):
(WebKit::WebUserContentController::WebUserContentController):
(WebKit::WebUserContentController::~WebUserContentController):

WebProcess/UserContent/WebUserContentController.h:
WebProcess/WebPage/WebPage.h:

(WebKit::WebPage::userContentControllerIdentifier const):

10:38 AM Changeset in webkit [230209] by jmarcell@apple.com

2 edits in tags/Safari-606.1.11.3/Source/WebKit

Cherry-pick r230204. rdar://problem/39078586

Fix the managed configurations build
https://bugs.webkit.org/show_bug.cgi?id=184253
-and corresponding-
rdar://problem/39078586

Reviewed by Dan Bernstein.

UIProcess/ios/WKContentViewInteraction.mm: (-[WKContentView canPerformActionForWebView:withSender:]): (-[WKContentView _defineForWebView:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230204 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:15 AM Changeset in webkit [230208] by commit-queue@webkit.org

17 edits
1 add in trunk

The referer header is not set after redirect
https://bugs.webkit.org/show_bug.cgi?id=182644
<rdar://problem/37479048>

Patch by Sihui Liu <sihui_liu@apple.com> on 2018-04-03
Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Rebaseline some tests for fetch api as they are passing now.

web-platform-tests/fetch/api/basic/referrer.any-expected.txt:
web-platform-tests/fetch/api/basic/referrer.any.worker-expected.txt:
web-platform-tests/fetch/api/redirect/redirect-referrer-expected.txt:
web-platform-tests/fetch/api/redirect/redirect-referrer-worker-expected.txt:

Source/WebCore:

Update referrer policy and recompute referrer in redirection check, so Referer header would be set after it's removed from cross-origin request.

Add support for Referrer-Policy header, so referrer policy would be changed based on redirect response.

Sources.txt:
WebCore.xcodeproj/project.pbxproj:
dom/Document.cpp:

(WebCore::Document::processReferrerPolicy):

loader/CrossOriginAccessControl.cpp:

(WebCore::updateRequestReferrer):

loader/CrossOriginAccessControl.h:
loader/ResourceLoader.h:

(WebCore::ResourceLoader::setReferrerPolicy):
(WebCore::ResourceLoader::referrerPolicy const):

loader/SubresourceLoader.cpp:

(WebCore::SubresourceLoader::checkRedirectionCrossOriginAccessControl):
(WebCore::SubresourceLoader::updateReferrerPolicy):

loader/SubresourceLoader.h:
loader/cache/CachedResourceRequest.cpp:

(WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin):
(WebCore::CachedResourceRequest::updateForAccessControl):
(WebCore::CachedResourceRequest::updateReferrerOriginAndUserAgentHeaders):

platform/ReferrerPolicy.cpp: Added.

(WebCore::parseReferrerPolicy):

platform/ReferrerPolicy.h:
platform/network/HTTPHeaderNames.in:

10:12 AM Changeset in webkit [230207] by jmarcell@apple.com

7 edits in tags/Safari-606.1.11.3/Source

Versioning.

10:07 AM Changeset in webkit [230206] by jmarcell@apple.com

1 copy in tags/Safari-606.1.11.3

New tag.

9:26 AM Changeset in webkit [230205] by Chris Dumez

6 edits in trunk/Source/WebCore

Make SecurityOrigin safe to create and use from any thread
https://bugs.webkit.org/show_bug.cgi?id=184216

Reviewed by Youenn Fablet.

We found that we have a decent amount of code constructing and using SecurityOrigin
objects from non-main threads. Unfortunately, this was not safe, mostly due to
SecurityOrigin's reliance on the SchemeRegistry.

This patch makes it safe to construct a SecurityOrigin on any thread A and use
it later on the same thread A. However, developers still need to call isolatedCopy()
if they want to pass such object to another thread B.

page/SecurityOrigin.cpp:

(WebCore::SecurityOrigin::canDisplay const):

page/SecurityOrigin.h:
page/SecurityPolicy.cpp:

(WebCore::originAccessMapLock):
(WebCore::originAccessMap):
(WebCore::SecurityPolicy::isAccessWhiteListed):
(WebCore::SecurityPolicy::addOriginAccessWhitelistEntry):
(WebCore::SecurityPolicy::removeOriginAccessWhitelistEntry):
(WebCore::SecurityPolicy::resetOriginAccessWhitelists):

platform/SchemeRegistry.cpp:

(WebCore::schemeRegistryLock):
(WebCore::allBuiltinSchemes):
(WebCore::builtinLocalURLSchemes):
(WebCore::localURLSchemes):
(WebCore::displayIsolatedURLSchemes):
(WebCore::builtinSecureSchemes):
(WebCore::secureSchemes):
(WebCore::builtinSchemesWithUniqueOrigins):
(WebCore::schemesWithUniqueOrigins):
(WebCore::builtinEmptyDocumentSchemes):
(WebCore::emptyDocumentSchemes):
(WebCore::schemesForbiddenFromDomainRelaxation):
(WebCore::builtinCanDisplayOnlyIfCanRequestSchemes):
(WebCore::canDisplayOnlyIfCanRequestSchemes):
(WebCore::notAllowingJavascriptURLsSchemes):
(WebCore::SchemeRegistry::registerURLSchemeAsLocal):
(WebCore::SchemeRegistry::removeURLSchemeRegisteredAsLocal):
(WebCore::schemesAllowingLocalStorageAccessInPrivateBrowsing):
(WebCore::schemesAllowingDatabaseAccessInPrivateBrowsing):
(WebCore::builtinCORSEnabledSchemes):
(WebCore::CORSEnabledSchemes):
(WebCore::ContentSecurityPolicyBypassingSchemes):
(WebCore::cachePartitioningSchemes):
(WebCore::serviceWorkerSchemes):
(WebCore::alwaysRevalidatedSchemes):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsLocal):
(WebCore::SchemeRegistry::registerURLSchemeAsNoAccess):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsNoAccess):
(WebCore::SchemeRegistry::registerURLSchemeAsDisplayIsolated):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated):
(WebCore::SchemeRegistry::registerURLSchemeAsSecure):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsSecure):
(WebCore::SchemeRegistry::canDisplayOnlyIfCanRequest):
(WebCore::SchemeRegistry::registerAsCanDisplayOnlyIfCanRequest):
(WebCore::SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy):
(WebCore::SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy):
(WebCore::SchemeRegistry::schemeShouldBypassContentSecurityPolicy):
(WebCore::SchemeRegistry::registerURLSchemeAsCachePartitioned):
(WebCore::SchemeRegistry::shouldPartitionCacheForURLScheme):
(WebCore::SchemeRegistry::registerURLSchemeServiceWorkersCanHandle):
(WebCore::SchemeRegistry::canServiceWorkersHandleURLScheme):
(WebCore::SchemeRegistry::isServiceWorkerContainerCustomScheme):

platform/SchemeRegistry.h:

8:51 AM Changeset in webkit [230204] by Beth Dakin

2 edits in trunk/Source/WebKit

Fix the managed configurations build
https://bugs.webkit.org/show_bug.cgi?id=184253
-and corresponding-
rdar://problem/39078586

Reviewed by Dan Bernstein.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView canPerformActionForWebView:withSender:]):
(-[WKContentView _defineForWebView:]):

8:09 AM Changeset in webkit [230203] by Carlos Garcia Campos

8 edits
1 add in trunk/Source/WebCore

[SOUP] Stop using ResourceHandle to load GResources
https://bugs.webkit.org/show_bug.cgi?id=184259

Reviewed by Sergio Villar Senin.

GResources are loaded in the WebProcess using ResourceHandle because soup handles them transparently. But now
that we no longer use ResourceHandle, we can add a simple loader for GResources, similar to the one used for
data URLS, since loading a GResource is a matter of calling g_resources_lookup_data() in the end.

SourcesGTK.txt:
SourcesWPE.txt:
loader/ResourceLoader.cpp:

(WebCore::ResourceLoader::start): Check if resource to load is a GResource and call loadGResource().

loader/ResourceLoader.h:
loader/soup/ResourceLoaderSoup.cpp: Added.

(WebCore::ResourceLoader::loadGResource): Load the GResource in a GTask thread.

platform/SharedBuffer.cpp:

(WebCore::SharedBuffer::DataSegment::data const):
(WebCore::SharedBuffer::DataSegment::size const):

platform/SharedBuffer.h:
platform/glib/SharedBufferGlib.cpp:

(WebCore::SharedBuffer::SharedBuffer):
(WebCore::SharedBuffer::create):

6:34 AM Changeset in webkit [230202] by cturner@igalia.com

3 edits in trunk

[WPE] Add WPE port to garden-o-matic
https://bugs.webkit.org/show_bug.cgi?id=182998

Reviewed by Michael Catanzaro.

BuildSlaveSupport/build.webkit.org-config/public_html/TestFailures/scripts/config.js:

Add WPE as a port to check.
(config.kPlatforms.string_appeared_here._builderApplies): Use less
surprising equality operator.
(config.kPlatforms.string_appeared_here.resultsDirectoryNameFromBuilderName):
Ditto.
(config.kPlatforms.string_appeared_here.resultsDirectoryForBuildNumber):
Ditto.

5:51 AM Changeset in webkit [230201] by tpopela@redhat.com

2 edits in trunk/Source/WTF

Unreviewed, mute the unused parameter compilation warning

Triggered on the PPC64 machine.

wtf/ThreadingPthreads.cpp:

(WTF::Thread::signalHandlerSuspendResume):

5:42 AM Changeset in webkit [230200] by tpopela@redhat.com

2 edits in trunk/Source/WTF

Unreviewed, fix the unused variable compilation warning

Move the ucontext_t code under the HAVE(MACHINE_CONTEXT). Triggered
on the PPC64 machine.

wtf/ThreadingPthreads.cpp:

(WTF::Thread::signalHandlerSuspendResume):

4:14 AM Changeset in webkit [230199] by Adrian Perez de Castro

2 edits in trunk/Tools

[GTK][JHBuild] Tools/gtk/install-dependencies: Replace libxfont with libxfont2 in Arch Linux
https://bugs.webkit.org/show_bug.cgi?id=184258

Reviewed by Carlos Alberto Lopez Perez.

gtk/install-dependencies: Use libxfont2 on Arch Linux as well.

12:16 AM Changeset in webkit [230198] by Carlos Garcia Campos

5 edits in trunk/Source

[Enchant] Clean up TextCheckerEnchant
https://bugs.webkit.org/show_bug.cgi?id=184233

Reviewed by Michael Catanzaro.

Source/WebCore:

Several cleanups and improvements:

platform/text/enchant/TextCheckerEnchant.cpp:

(WebCore::TextCheckerEnchant::singleton): Make TextCheckerEnchant a singleton since it's always used as a
singleton.
(WebCore::TextCheckerEnchant::EnchantDictDeleter::operator() const):
(WebCore::TextCheckerEnchant::TextCheckerEnchant):
(WebCore::TextCheckerEnchant::ignoreWord): Convert to utf8 once instead of on every loop iteration.
(WebCore::TextCheckerEnchant::learnWord): Ditton.
(WebCore::TextCheckerEnchant::checkSpellingOfWord): m_enchantDictionaries is now a Vector of std::unique_ptr.
(WebCore::TextCheckerEnchant::getGuessesForWord): Convert to utf8 once instead of on every loop iteration.
(WebCore::TextCheckerEnchant::updateSpellCheckingLanguages): Get only the first language instead of building a
vector to get its first item. Use WTFMove to replace m_enchantDictionaries with the new Vector.
(WebCore::TextCheckerEnchant::loadedSpellCheckingLanguages const): Use a lambda to get the list of languages
already converted to String and iterate only once.
(WebCore::TextCheckerEnchant::availableSpellCheckingLanguages const): Ditto.
(WebCore::enchantDictDescribeCallback): Deleted.
(WebCore::TextCheckerEnchant::~TextCheckerEnchant): Deleted.
(WebCore::TextCheckerEnchant::freeEnchantBrokerDictionaries): Deleted.

platform/text/enchant/TextCheckerEnchant.h:

Source/WebKit:

Use TextCheckerEnchant as a singleton now, instead of implementing the singleton here.

UIProcess/gtk/TextCheckerGtk.cpp:

(WebKit::TextChecker::checkSpellingOfString):
(WebKit::TextChecker::getGuessesForWord):
(WebKit::TextChecker::learnWord):
(WebKit::TextChecker::ignoreWord):
(WebKit::TextChecker::setSpellCheckingLanguages):
(WebKit::TextChecker::loadedSpellCheckingLanguages):
(WebKit::enchantTextChecker): Deleted.

12:11 AM Changeset in webkit [230197] by Carlos Garcia Campos

2 edits in trunk/Source/WebCore

[GTK] Segfaults in enchant_broker_free_dict()
https://bugs.webkit.org/show_bug.cgi?id=183738

Reviewed by Michael Catanzaro.

Check enchant_broker_request_dict() didn't return nullptr before adding it to the m_enchantDictionaries vector.

platform/text/enchant/TextCheckerEnchant.cpp:

(WebCore::TextCheckerEnchant::updateSpellCheckingLanguages):

12:09 AM Changeset in webkit [230196] by Carlos Garcia Campos

6 edits in trunk/Source

[GTK] NetworkProcess from WebKitGtk+ 2.19.9x SIGSEVs in NetworkStorageSession (secret search callback)
https://bugs.webkit.org/show_bug.cgi?id=183346

Reviewed by Michael Catanzaro.

Source/WebCore:

This might happen if a request is cancelled right after the password request starts and before it finishes. We
should cancel the password search when the network request is cancelled, not only when the NetworkStorageSession
is destroyed.

platform/network/NetworkStorageSession.h:
platform/network/soup/NetworkStorageSessionSoup.cpp:

(WebCore::NetworkStorageSession::~NetworkStorageSession):
(WebCore::SecretServiceSearchData::SecretServiceSearchData): Helper struct to keep the request cancellable and
completion handler.
(WebCore::NetworkStorageSession::getCredentialFromPersistentStorage): Create a SecretServiceSearchData for the
request.

platform/network/soup/ResourceHandleSoup.cpp:

(WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Pass the request cancellable to
NetworkStorageSession::getCredentialFromPersistentStorage().

Source/WebKit:

Pass the request cancellable to NetworkStorageSession::getCredentialFromPersistentStorage().

NetworkProcess/soup/NetworkDataTaskSoup.cpp:

(WebKit::NetworkDataTaskSoup::authenticate):

Apr 2, 2018:

6:03 PM Changeset in webkit [230195] by beidson@apple.com

13 edits in trunk

Process swapping on navigation needs to handle server redirects.
<rdar://problem/38690465> and https://bugs.webkit.org/show_bug.cgi?id=184142

Reviewed by Alex Christensen.

Source/WebKit:

The same rules we apply to process swapping for basic navigations need to apply
to server redirects as well.

There's three interesting cases we need to support that are covered by new API tests:
1 - The initial load in a WKWebView redirects cross-origin.
2 - A WKWebView is showing content from a.com, we start a load to b.com, and that redirects to c.com
3 - A WKWebView is showing content from a.com, we start a load to a.com, that that redirects to b.com.

Supporting all 3 of these brought their own little challenges.

By teaching Navigation objects more about redirects I was able to support all 3 cases.

UIProcess/API/APINavigation.cpp:

(API::Navigation::Navigation):
(API::Navigation::setCurrentRequest):
(API::Navigation::appendRedirectionURL):
(API::Navigation::loggingString const):
(API::Navigation::loggingURL const): Deleted.

UIProcess/API/APINavigation.h:

(API::Navigation::originalRequest const):
(API::Navigation::currentRequest const):
(API::Navigation::currentRequestProcessIdentifier const):
(API::Navigation::setCurrentRequestIsRedirect):
(API::Navigation::currentRequestIsRedirect const):
(API::Navigation::request const): Deleted.

UIProcess/API/Cocoa/WKNavigation.mm:

(-[WKNavigation _request]):

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::receivedPolicyDecision):
(WebKit::WebPageProxy::continueNavigationInNewProcess): If this continued navigation is currently in a server

redirect, save off a lambda to synthesize a "did receive server redirect" callback once the new WebProcess is running.

(WebKit::WebPageProxy::didCreateMainFrame):
(WebKit::WebPageProxy::didStartProvisionalLoadForFrame): Possibly ignore this notification if it is really a

cross-origin redirect that is just starting back up in a new WebProcess.

(WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::resetStateAfterProcessExited): Do not clear pageLoadState if the process is exitting for

a navigation swap, as we will need to pick up where we left off when the load continues in a new WebProcess.

UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::processForNavigation): If a process has never committed any provisional load, it can always

be used to continue a navigation.

UIProcess/WebProcessPool.h:

UIProcess/WebProcessProxy.h:

(WebKit::WebProcessProxy::didCommitProvisionalLoad):
(WebKit::WebProcessProxy::hasCommittedAnyProvisionalLoads const):

WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDidReceiveServerRedirectForProvisionalLoad):
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction):

Tools:

TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

(-[PSONNavigationDelegate webView:didFinishNavigation:]):
(-[PSONNavigationDelegate webView:decidePolicyForNavigationAction:decisionHandler:]):
(-[PSONNavigationDelegate webView:didReceiveServerRedirectForProvisionalNavigation:]):
(-[PSONScheme addRedirectFromURLString:toURLString:]):
(-[PSONScheme webView:startURLSchemeTask:]):

5:50 PM Changeset in webkit [230194] by eric.carlson@apple.com

27 edits in trunk/Source

[Extra zoom mode] Replace video with a placeholder image during fullscreen transition
https://bugs.webkit.org/show_bug.cgi?id=184188
<rdar://problem/38940307>

Reviewed by Youenn Fablet.

Source/WebCore:

html/HTMLMediaElement.cpp:

(WebCore::HTMLMediaElement::willExitFullscreen):

html/HTMLMediaElement.h:
platform/cocoa/VideoFullscreenChangeObserver.h:
platform/cocoa/VideoFullscreenModelVideoElement.h:
platform/cocoa/VideoFullscreenModelVideoElement.mm:

(VideoFullscreenModelVideoElement::willExitFullscreen):

platform/graphics/MediaPlayer.cpp:

(WebCore::MediaPlayer::updateVideoFullscreenInlineImage):

platform/graphics/MediaPlayer.h:
platform/graphics/MediaPlayerPrivate.h:

(WebCore::MediaPlayerPrivateInterface::updateVideoFullscreenInlineImage):

platform/graphics/VideoFullscreenLayerManager.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:

(WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerItem):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoFullscreenInlineImage):
(WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastPixelBuffer):
(WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastImage):
(WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithVideoOutput):

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setVideoFullscreenLayer):

platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:

(WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVideoFullscreenLayer):

platform/graphics/avfoundation/objc/VideoFullscreenLayerManagerObjC.h:
platform/graphics/avfoundation/objc/VideoFullscreenLayerManagerObjC.mm:

(WebCore::VideoFullscreenLayerManagerObjC::setVideoLayer):
(WebCore::VideoFullscreenLayerManagerObjC::updateVideoFullscreenInlineImage):
(WebCore::VideoFullscreenLayerManagerObjC::setVideoFullscreenLayer):

platform/ios/VideoFullscreenInterfaceAVKit.h:
platform/ios/VideoFullscreenInterfaceAVKit.mm:

(VideoFullscreenInterfaceAVKit::exitFullscreen):
(VideoFullscreenInterfaceAVKit::preparedToExitFullscreen):
(VideoFullscreenInterfaceAVKit::shouldExitFullscreenWithReason):

platform/ios/WebVideoFullscreenControllerAVKit.mm:

(VideoFullscreenControllerContext::willExitFullscreen):

Source/WebKit:

UIProcess/Cocoa/VideoFullscreenManagerProxy.h:
UIProcess/Cocoa/VideoFullscreenManagerProxy.messages.in:
UIProcess/Cocoa/VideoFullscreenManagerProxy.mm:

(WebKit::VideoFullscreenModelContext::willExitFullscreen):
(WebKit::VideoFullscreenManagerProxy::preparedToExitFullscreen):
(WebKit::VideoFullscreenManagerProxy::willExitFullscreen):

WebProcess/cocoa/VideoFullscreenManager.h:
WebProcess/cocoa/VideoFullscreenManager.messages.in:
WebProcess/cocoa/VideoFullscreenManager.mm:

(WebKit::VideoFullscreenManager::willExitFullscreen):

5:11 PM Changeset in webkit [230193] by BJ Burg

2 edits in trunk/Source/WebKit

[Cocoa] Fix some internal builds that consume WebDriver atoms
https://bugs.webkit.org/show_bug.cgi?id=184197

Reviewed by Dan Bernstein.

WebKit.xcodeproj/project.pbxproj:

Use a Run Script phase to copy WebDriver atoms to WebKit.framework
private headers during the installhdrs phase.

4:12 PM Changeset in webkit [230192] by dbates@webkit.org

7 edits in trunk/Tools

Add infrastructure to relax SSL for allowed hosts in DumpRenderTree and WebKitTestRunner
https://bugs.webkit.org/show_bug.cgi?id=184239

Reviewed by Alexey Proskuryakov.

Adds a new optional command line option --allow-any-certificate-for-allowed-hosts (defaults to disabled)
to allow the allowed hosts to accept any HTTPS certificate. You can specify an allowed host
by using the existing command line option --allowed-host.

Currently both DumpRenderTree and WebKitTestRunner relax SSL certificate validation
for 127.0.0.1 and localhost so that we can run HTTPS tests from these hosts using
a self-signed certificate. They do not relax these restrictions for any allowed host,
specified using the optional command line option --allowed-host. For testing purposes
it is useful to be able to run a local HTTPS server with a self-signed certificate and
mimic a non-localhost hostname (by adding an alias(es) for 127.0.0.1 to /etc/hosts).
We should support relaxing SSL restrictions for such testing purposes.

For example, to allow host example.test to present any HTTPS certificate when running
tests you would invoke:

run-webkit-tests --allowed-host example.test --additional-drt-flag '--allow-any-certificate-for-allowed-hosts'

DumpRenderTree/mac/DumpRenderTree.mm:

(initializeGlobalsFromCommandLineOptions): Parse the command line option --allow-any-certificate-for-allowed-hosts.
(dumpRenderTree): Allow any HTTPS certificate from each allowed host.

WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:

(WTR::InjectedBundle::didReceiveMessageToPage): Clear out the existing list of allowed hosts
before appending entries to it to avoid growing the list of allowed hosts without bound. Call
platformAllowAnyHTTPSCertificateForAllowedHosts() to apply SSL relaxation for each allowed host.

WebKitTestRunner/Options.cpp:

(WTR::handleOptionAllowAnyHTTPSCertificateForAllowedHosts): Added.
(WTR::handleOptionAllowedHost): Update code as needed now that Options::allowedHosts is a std::set.
(WTR::OptionsHandler::OptionsHandler):

WebKitTestRunner/Options.h: Change the data type of allowedHosts from a std::vector to a std::set

so that we can make use of the convenience functon std::set::find() in TestController::canAuthenticateAgainstProtectionSpace().

WebKitTestRunner/TestController.cpp:

(WTR::TestController::initialize):
(WTR::TestController::canAuthenticateAgainstProtectionSpace): Allow any HTTPS certificate from each allowed host.

WebKitTestRunner/TestController.h:

4:09 PM Changeset in webkit [230191] by Ryan Haddad

13 edits in trunk

Unreviewed, rolling out r230174.

Caused LayoutTests to exit early with assertion failures.

Reverted changeset:

"Process swapping on navigation needs to handle server
redirects."
https://bugs.webkit.org/show_bug.cgi?id=184142
https://trac.webkit.org/changeset/230174

4:05 PM Changeset in webkit [230190] by dbates@webkit.org

3 edits in trunk/Tools

Remove pre-Network Session code path for allowing any HTTPS certificate on Mac and iOS
https://bugs.webkit.org/show_bug.cgi?id=184242

Reviewed by Alexey Proskuryakov.

Following r227364 we use the Network Session (NSURLSession) code path by default in
modern WebKit on Mac and iOS. That is, we no longer use {CF, NS}URLConnection in modern
WebKit on these platforms. So, we can remove code that used NSURLRequest SPI to allow
any HTTPS certificate from localhost and 127.0.0.1 when using {CF, NS}URLConnection.
The equivalent functionality is implemented in TestController::canAuthenticateAgainstProtectionSpace().

WebKitTestRunner/InjectedBundle/ios/InjectedBundleIOS.mm:

(WTR::InjectedBundle::platformInitialize):

WebKitTestRunner/InjectedBundle/mac/InjectedBundleMac.mm:

(WTR::InjectedBundle::platformInitialize):

2:59 PM Changeset in webkit [230189] by jmarcell@apple.com

2 edits in tags/Safari-606.1.11.2/Source/WebKit

Cherry-pick r230160. rdar://problem/39094484

Fixed the build when BOOL is not bool.
<rdar://problem/39094484>

Reviewed by Jer Noble.

UIProcess/ios/fullscreen/WKFullScreenViewController.mm: (-[WKFullScreenViewController videoControlsManagerDidChange]): Removed the write-only ivar _hasControlsManager, the assignment to which was causing the compiler error.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230160 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:14 PM Changeset in webkit [230188] by pvollan@apple.com

2 edits in trunk

Remove references to internal version of WebKitQuartzCoreAdditions in CMake files.
https://bugs.webkit.org/show_bug.cgi?id=184246
<rdar://problem/39116563>

Unreviewed build fix.

Source/PlatformWin.cmake:

2:09 PM Changeset in webkit [230187] by sbarati@apple.com

22 edits
1 copy in trunk/Source

bmalloc should compute its own estimate of its footprint
https://bugs.webkit.org/show_bug.cgi?id=184121

Reviewed by Filip Pizlo.

Source/bmalloc:

This patch makes it so that bmalloc keeps track of its own physical
footprint.

Doing this for IsoHeaps is trivial. It allocates/deallocates fixed
page sizes at a time. IsoHeapImpl just updates a count every time
a page is committed/decommitted.

Making Heap keep its footprint was a bit trickier because of how
LargeRange is constructed. Before this patch, LargeRange kept track
of the amount of physical memory at the start of its range. This
patch extends large range to also keep track of the total physical memory
in the range just for footprint bookkeeping. This was needed to make
Heap's footprint come close to resembling reality, because as we merge and split
large ranges, the start physical size often becomes wildly inaccurate.
The total physical size number stored in LargeRange is still just an
estimate. It's possible that as ranges are split, that the total physical
size split amongst the two ranges doesn't resemble reality. This can
happen when the total physical size is really all in one end of the split,
but we mark it as being proportionally split amongst the resulting two
ranges. In practice, I did not notice this being a problem. The footprint
estimate tracks reality very closely (in my testing, within less than 1MB for
heaps with sizes upwards of 1GB). The other nice thing about total physical
size is that even if it diverges from reality in terms of how memory is
using up physical RAM, it stays internally consistent inside bmalloc's
own data structures.

The main oversight of this patch is how it deals with Wasm memory. All Wasm
memory will be viewed by bmalloc as taking up physical space even when it
may not be. Wasm memory starts off as taking up purely virtual pages. When a
page is first accessed, only then will the OS page it in and cause it to use
physical RAM. I opened a bug to come up with a solution to this problem:
https://bugs.webkit.org/show_bug.cgi?id=184207

bmalloc.xcodeproj/project.pbxproj:
bmalloc/AvailableMemory.cpp:

(bmalloc::memoryStatus):

bmalloc/BPlatform.h:
bmalloc/Heap.cpp:

(bmalloc::Heap::Heap):
(bmalloc::Heap::freeableMemory):
(bmalloc::Heap::footprint):
(bmalloc::Heap::scavenge):
(bmalloc::Heap::deallocateSmallChunk):
(bmalloc::Heap::allocateSmallPage):
(bmalloc::Heap::splitAndAllocate):
(bmalloc::Heap::tryAllocateLarge):
(bmalloc::Heap::shrinkLarge):
(bmalloc::Heap::deallocateLarge):
(bmalloc::Heap::externalCommit):
(bmalloc::Heap::externalDecommit):

bmalloc/Heap.h:
bmalloc/IsoDirectory.h:
bmalloc/IsoDirectoryInlines.h:

(bmalloc::passedNumPages>::takeFirstEligible):
(bmalloc::passedNumPages>::didDecommit):
(bmalloc::passedNumPages>::freeableMemory):

bmalloc/IsoHeapImpl.h:
bmalloc/IsoHeapImplInlines.h:

(bmalloc::IsoHeapImpl<Config>::freeableMemory):
(bmalloc::IsoHeapImpl<Config>::footprint):
(bmalloc::IsoHeapImpl<Config>::didCommit):
(bmalloc::IsoHeapImpl<Config>::didDecommit):

bmalloc/LargeRange.h:

(bmalloc::LargeRange::LargeRange):
(bmalloc::LargeRange::startPhysicalSize const):
(bmalloc::LargeRange::setStartPhysicalSize):
(bmalloc::LargeRange::totalPhysicalSize const):
(bmalloc::LargeRange::setTotalPhysicalSize):
(bmalloc::merge):
(bmalloc::LargeRange::split const):
(bmalloc::LargeRange::physicalSize const): Deleted.
(bmalloc::LargeRange::setPhysicalSize): Deleted.

bmalloc/PhysicalPageMap.h: Added.

This class is added for debugging purposes. It's useful when hacking
on the code that calculates the footprint to use this map as a sanity
check. It's just a simple implementation that has a set of all the committed pages.

(bmalloc::PhysicalPageMap::commit):
(bmalloc::PhysicalPageMap::decommit):
(bmalloc::PhysicalPageMap::footprint):
(bmalloc::PhysicalPageMap::forEachPhysicalPage):

bmalloc/Scavenger.cpp:

(bmalloc::dumpStats):
(bmalloc::Scavenger::scavenge):
(bmalloc::Scavenger::freeableMemory):
This is here just for debugging for now. But we should implement an
efficient version of this to use when driving when to run the
scavenger.

(bmalloc::Scavenger::footprint):
(bmalloc::Scavenger::threadRunLoop):

bmalloc/Scavenger.h:
bmalloc/VMAllocate.h:

(bmalloc::physicalPageSizeSloppy):

bmalloc/VMHeap.cpp:

(bmalloc::VMHeap::tryAllocateLargeChunk):

bmalloc/bmalloc.cpp:

(bmalloc::api::commitAlignedPhysical):
(bmalloc::api::decommitAlignedPhysical):

bmalloc/bmalloc.h:

Source/JavaScriptCore:

heap/IsoAlignedMemoryAllocator.cpp:

(JSC::IsoAlignedMemoryAllocator::~IsoAlignedMemoryAllocator):
(JSC::IsoAlignedMemoryAllocator::tryAllocateAlignedMemory):
(JSC::IsoAlignedMemoryAllocator::freeAlignedMemory):

Source/WTF:

wtf/FastMalloc.cpp:

(WTF::fastCommitAlignedMemory):
(WTF::fastDecommitAlignedMemory):

wtf/FastMalloc.h:

2:06 PM Changeset in webkit [230186] by jmarcell@apple.com

6 edits in tags/Safari-606.1.7.4/Source/WebKit

Cherry-pick r229684. rdar://problem/38516584

Add _useSystemAppearance to WKView
https://bugs.webkit.org/show_bug.cgi?id=183706
<rdar://problem/38516584>

Reviewed by Tim Horton.

Plumb useSystemAppearance and other supporting functions to WKView

UIProcess/API/Cocoa/WKViewPrivate.h:
UIProcess/API/Cocoa/WKWebView.mm: (-[WKWebView _initializeWithConfiguration:]): (-[WKWebView _useSystemAppearance]): (-[WKWebView _setUseSystemAppearance:]): (-[WKWebView effectiveAppearanceDidChange]):
UIProcess/API/mac/WKView.mm: (-[WKView effectiveAppearanceDidChange]): (-[WKView _setUseSystemAppearance:]): (-[WKView _useSystemAppearance]): (-[WKView _setDefaultAppearance:]):
UIProcess/Cocoa/WebViewImpl.h:
UIProcess/Cocoa/WebViewImpl.mm: (WebKit::WebViewImpl::setUseSystemAppearance): (WebKit::WebViewImpl::useSystemAppearance): (WebKit::WebViewImpl::setDefaultAppearance):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229684 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:06 PM Changeset in webkit [230185] by jmarcell@apple.com

7 edits in tags/Safari-606.1.7.4/Source

Cherry-pick r229679. rdar://problem/38385900

Ensure that style is updated when the effective appearance changes
https://bugs.webkit.org/show_bug.cgi?id=183690
<rdar://problem/38385900>

Reviewed by Tim Horton and Wenson Hsieh.

Source/WebCore:

Only exposing a function to outside WebCore, no tests needed.

page/Page.h:

Source/WebKit:

Respond to and respect the effective appearance changing.

UIProcess/API/Cocoa/WKWebView.mm: (-[WKWebView effectiveAppearanceDidChange]):
WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::setDefaultAppearance):

Source/WebKitLegacy/mac:

Respond to and respect the effective appearance changing.

WebView/WebView.mm: (-[WebView _setUseSystemAppearance:]): (-[WebView effectiveAppearanceDidChange]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229679 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:06 PM Changeset in webkit [230184] by jmarcell@apple.com

28 edits
2 copies in tags/Safari-606.1.7.4/Source

Cherry-pick r229654. rdar://problem/38382934

Create MediaQueryParserContext to provide additional context for the evaluation of media queries
https://bugs.webkit.org/show_bug.cgi?id=183677

Reviewed by Tim Horton.

We need additional context for parsing media queries to make sure they are parsed correctly and valid.

Source/WebCore:

Not currently testable, will add tests in a later patch.

WebCore.xcodeproj/project.pbxproj:
css/MediaList.cpp: (WebCore::MediaQuerySet::create): (WebCore::MediaQuerySet::set): (WebCore::MediaQuerySet::add): (WebCore::MediaQuerySet::remove):
css/MediaList.h:
css/MediaQueryEvaluator.cpp: (WebCore::MediaQueryEvaluator::mediaAttributeMatches):
css/MediaQueryExpression.cpp: (WebCore::featureWithValidIdent): (WebCore::featureWithValidDensity): (WebCore::featureWithValidPositiveLength): (WebCore::featureWithPositiveInteger): (WebCore::featureWithPositiveNumber): (WebCore::featureWithZeroOrOne): (WebCore::isFeatureValidWithoutValue): (WebCore::MediaQueryExpression::MediaQueryExpression):
css/MediaQueryExpression.h:
css/MediaQueryMatcher.cpp: (WebCore::MediaQueryMatcher::matchMedia):
css/MediaQueryParserContext.cpp: Added. (WebCore::MediaQueryParserContext::MediaQueryParserContext):
css/MediaQueryParserContext.h: Added. (WebCore::MediaQueryParserContext::MediaQueryParserContext):
css/StyleMedia.cpp: (WebCore::StyleMedia::matchMedium const):
css/StyleRuleImport.cpp: (WebCore::StyleRuleImport::StyleRuleImport): (WebCore::StyleRuleImport::setCSSStyleSheet):
css/parser/CSSParser.cpp: (WebCore::CSSParserContext::CSSParserContext): (WebCore::operator==):
css/parser/CSSParserImpl.cpp: (WebCore::CSSParserImpl::consumeImportRule): (WebCore::CSSParserImpl::consumeMediaRule):
css/parser/MediaQueryParser.cpp: (WebCore::MediaQueryParser::parseMediaQuerySet): (WebCore::MediaQueryParser::parseMediaCondition): (WebCore::MediaQueryParser::MediaQueryParser): (WebCore::MediaQueryData::addExpression):
css/parser/MediaQueryParser.h: (WebCore::MediaQueryData::setMediaQueryParserContext):
css/parser/SizesAttributeParser.cpp: (WebCore::SizesAttributeParser::parse):
dom/DOMImplementation.cpp: (WebCore::DOMImplementation::createCSSStyleSheet):
dom/InlineStyleSheetOwner.cpp: (WebCore::InlineStyleSheetOwner::createSheet):
dom/ProcessingInstruction.cpp: (WebCore::ProcessingInstruction::setCSSStyleSheet):
html/HTMLImageElement.cpp: (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
html/HTMLLinkElement.cpp: (WebCore::HTMLLinkElement::process): (WebCore::HTMLLinkElement::initializeStyleSheet): (WebCore::HTMLLinkElement::setCSSStyleSheet):
html/HTMLLinkElement.h:
html/HTMLMediaElement.cpp: (WebCore::HTMLMediaElement::selectNextSourceChild):
html/HTMLSourceElement.cpp: (WebCore::HTMLSourceElement::parsedMediaAttribute const):
html/HTMLSourceElement.h:
html/HTMLStyleElement.cpp: (WebCore::HTMLStyleElement::parseAttribute):
html/parser/HTMLPreloadScanner.cpp: (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):

Source/WebKitLegacy/mac:

DOM/DOM.mm: (-[DOMHTMLLinkElement _mediaQueryMatches]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229654 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:06 PM Changeset in webkit [230183] by jmarcell@apple.com

17 edits in tags/Safari-606.1.7.4/Source

Cherry-pick r229511. rdar://problem/38326388

Media query for default appearance
https://bugs.webkit.org/show_bug.cgi?id=183539
<rdar://problem/38326388>

Reviewed by Tim Horton.

Source/WebCore:

Not currently testable, will add tests in a later patch.

Write a media query to evaluate appearance.

css/CSSValueKeywords.in:
css/MediaFeatureNames.h:
css/MediaQueryEvaluator.cpp: (WebCore::defaultAppearanceEvaluate):
css/MediaQueryExpression.cpp: (WebCore::featureWithValidIdent): (WebCore::isFeatureValidWithoutValue):
page/Page.h: (WebCore::Page::defaultAppearance const): (WebCore::Page::setDefaultAppearance):

Source/WebKit:

Write a media query to evaluate appearance.

Shared/WebPageCreationParameters.cpp: (WebKit::WebPageCreationParameters::encode const): (WebKit::WebPageCreationParameters::decode):
Shared/WebPageCreationParameters.h:
UIProcess/API/Cocoa/WKWebView.mm: (-[WKWebView _initializeWithConfiguration:]): (-[WKWebView _setUseSystemAppearance:]):
UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::creationParameters): (WebKit::WebPageProxy::setDefaultAppearance):
UIProcess/WebPageProxy.h: (WebKit::WebPageProxy::defaultAppearance const):
WebProcess/WebPage/WebPage.cpp: (WebKit::m_credentialsMessenger): (WebKit::WebPage::setDefaultAppearance):
WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:

Source/WebKitLegacy/mac:

Write a media query to evaluate appearance.

WebView/WebView.mm: (-[WebView _commonInitializationWithFrameName:groupName:]): (-[WebView _setUseSystemAppearance:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229511 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:06 PM Changeset in webkit [230182] by jmarcell@apple.com

45 edits in tags/Safari-606.1.7.4/Source

Cherry-pick r229448. rdar://problem/36975642

Allow WebViews to disable system appearance
https://bugs.webkit.org/show_bug.cgi?id=183418
<rdar://problem/36975642>

Reviewed by Tim Horton.
Source/WebCore:

Not currently testable, tests will be added in a later patch.

Allow webviews to choose whether or not to follow the default system appearance.

css/StyleColor.cpp: (WebCore::StyleColor::colorFromKeyword):
css/StyleColor.h:
css/StyleResolver.cpp: (WebCore::StyleResolver::colorFromPrimitiveValue const):
css/parser/CSSParser.cpp: (WebCore::CSSParser::parseSystemColor):
css/parser/CSSParser.h:
css/parser/CSSParserMode.h:
html/canvas/CanvasRenderingContext2D.cpp: (WebCore::CanvasRenderingContext2D::drawFocusIfNeededInternal):
html/canvas/CanvasRenderingContext2DBase.cpp: (WebCore::CanvasRenderingContext2DBase::setStrokeColor): (WebCore::CanvasRenderingContext2DBase::setFillColor):
html/canvas/CanvasStyle.cpp: (WebCore::parseColor): (WebCore::parseColorOrCurrentColor): (WebCore::CanvasStyle::createFromString): (WebCore::CanvasStyle::createFromStringWithOverrideAlpha):
html/canvas/CanvasStyle.h:
page/Page.h: (WebCore::Page::useSystemAppearance const): (WebCore::Page::setUseSystemAppearance):
platform/Theme.cpp: (WebCore::Theme::paint):
platform/Theme.h:
platform/mac/LocalDefaultSystemAppearance.h:
platform/mac/LocalDefaultSystemAppearance.mm: (WebCore::LocalDefaultSystemAppearance::LocalDefaultSystemAppearance): (WebCore::LocalDefaultSystemAppearance::~LocalDefaultSystemAppearance):
platform/mac/ThemeMac.h:
platform/mac/ThemeMac.mm: (-[WebCoreThemeView initWithUseSystemAppearance:]): (WebCore::paintToggleButton): (WebCore::paintButton): (WebCore::ThemeMac::ensuredView): (WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext): (WebCore::ThemeMac::paint): (-[WebCoreThemeView init]): Deleted.
rendering/RenderTheme.cpp: (WebCore::RenderTheme::paint): (WebCore::RenderTheme::systemColor const): (WebCore::RenderTheme::focusRingColor):
rendering/RenderTheme.h: (WebCore::RenderTheme::platformFocusRingColor const):
rendering/RenderThemeIOS.mm: (WebCore::RenderThemeIOS::systemColor const):
rendering/RenderThemeMac.h:
rendering/RenderThemeMac.mm: (WebCore::RenderThemeMac::documentViewFor const): (WebCore::RenderThemeMac::platformFocusRingColor const): (WebCore::RenderThemeMac::systemColor const): (WebCore::RenderThemeMac::paintCellAndSetFocusedElementNeedsRepaintIfNecessary): (WebCore::RenderThemeMac::paintSliderThumb):
rendering/TextPaintStyle.cpp: (WebCore::computeTextPaintStyle):

Source/WebKit:

Allow webviews to choose whether or not to follow the default system appearance.

Shared/WebPageCreationParameters.cpp: (WebKit::WebPageCreationParameters::encode const): (WebKit::WebPageCreationParameters::decode):
Shared/WebPageCreationParameters.h:
UIProcess/API/Cocoa/WKWebView.mm: (-[WKWebView _useSystemAppearance]): (-[WKWebView _setUseSystemAppearance:]):
UIProcess/API/Cocoa/WKWebViewPrivate.h:
UIProcess/WebPageProxy.cpp: (WebKit::WebPageProxy::creationParameters): (WebKit::WebPageProxy::setUseSystemAppearance):
UIProcess/WebPageProxy.h: (WebKit::WebPageProxy::useSystemAppearance const):
WebProcess/WebPage/WebPage.cpp: (WebKit::WebPage::setUseSystemAppearance):
WebProcess/WebPage/WebPage.h:
WebProcess/WebPage/WebPage.messages.in:

Source/WebKitLegacy/mac:

Allow webviews to choose whether or not to follow the default system appearance.

WebView/WebView.mm: (-[WebView _setUseSystemAppearance:]): (-[WebView _useSystemAppearance]):
WebView/WebViewPrivate.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229448 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:05 PM Changeset in webkit [230181] by jmarcell@apple.com

2 edits in tags/Safari-606.1.7.4/Source/WebCore

Cherry-pick r229438. rdar://problem/38274894

Ensure default appearance for selection form control
https://bugs.webkit.org/show_bug.cgi?id=183482
<rdar://problem/38274894>

Reviewed by Tim Horton.

The appearance for selection form controls was not set to default.

Not currently testable, will add tests in a later patch.

rendering/RenderThemeMac.mm: (WebCore::RenderThemeMac::platformInactiveListBoxSelectionBackgroundColor const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229438 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:05 PM Changeset in webkit [230180] by jmarcell@apple.com

2 edits in tags/Safari-606.1.7.4/Source/WebCore

Cherry-pick r229430. rdar://problem/38210306

Ensure system appearance is default for legacy webkit
https://bugs.webkit.org/show_bug.cgi?id=183473
<rdar://problem/38210306>

Reviewed by Tim Horton.

Need to set the appearance on the window for legacy webkit due to differences in drawing.

Not currently testable, will add tests in a later patch.

platform/mac/ThemeMac.mm: (WebCore::paintButton):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229430 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:05 PM Changeset in webkit [230179] by jmarcell@apple.com

4 edits
2 adds in tags/Safari-606.1.7.4/Source/WebCore

Cherry-pick r229336. rdar://problem/36975571

Ensure system appearance is default for web content
https://bugs.webkit.org/show_bug.cgi?id=183354
<rdar://problem/36975571>
<rdar://problem/38162381>

Make sure the the system appearance for web content is default, and
consolidate that code to a single class.

Reviewed by Tim Horton.

Not currently testable, will add tests in a future patch.

WebCore.xcodeproj/project.pbxproj:
platform/mac/LocalDefaultSystemAppearance.h: Added.
platform/mac/LocalDefaultSystemAppearance.mm: Added. (WebCore::LocalDefaultSystemAppearance::LocalDefaultSystemAppearance): (WebCore::LocalDefaultSystemAppearance::~LocalDefaultSystemAppearance):
platform/mac/ThemeMac.mm: (-[WebCoreThemeView init]): (WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):
rendering/RenderThemeMac.mm: (WebCore::RenderThemeMac::systemColor const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229336 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2:05 PM Changeset in webkit [230178] by jmarcell@apple.com

7 edits in tags/Safari-606.1.7.4/Source

Versioning.

1:34 PM Changeset in webkit [230177] by eric.carlson@apple.com

9 edits in trunk/Source/WebCore

Define AVKit softlink macro
https://bugs.webkit.org/show_bug.cgi?id=184241

Reviewed by Jer Noble.

Source/WebCore:

No new tests, no functional change.

platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
platform/ios/PlaybackSessionInterfaceAVKit.mm:
platform/ios/VideoFullscreenInterfaceAVKit.mm:
platform/ios/WebAVPlayerController.mm:
platform/mac/PlaybackSessionInterfaceMac.mm:
platform/mac/VideoFullscreenInterfaceMac.mm:

Source/WebCore/PAL:

pal/cf/CoreMediaSoftLink.h:

1:27 PM Changeset in webkit [230176] by Wenson Hsieh

6 edits in trunk/Source

[Extra zoom mode] Update date picker UI to latest specifications
https://bugs.webkit.org/show_bug.cgi?id=184234
<rdar://problem/38804760>

Reviewed by Timothy Hatcher.

Source/WebCore:

Tweak localizable strings. Day, month and year labels should be fully capitalized, and there needs to be a
string for the "Set" button title.

English.lproj/Localizable.strings:
platform/LocalizedStrings.cpp:

(WebCore::datePickerSetButtonTitle):
(WebCore::datePickerDayLabelTitle):
(WebCore::datePickerMonthLabelTitle):
(WebCore::datePickerYearLabelTitle):

platform/LocalizedStrings.h:

Source/WebKit:

Rename WKTextFormControlListViewControllerDelegate to WKTextInputListViewControllerDelegate and adjust for the
new initializer of WKDatePickerViewController.

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView presentViewControllerForCurrentAssistedNode]):

1:07 PM Changeset in webkit [230175] by mark.lam@apple.com

3 edits in trunk/Source/JavaScriptCore

We should not trash the stack pointer on OSR entry.
https://bugs.webkit.org/show_bug.cgi?id=184243
<rdar://problem/39114319>

Reviewed by Filip Pizlo.

In the DFG OSR entry path, we momentarily over-write the stack pointer with
returnValueGPR2. returnValueGPR2 contains a pointer to a side buffer we malloc'ed.
Hence, this assignment is wrong, and it turns out to be unnecessary as well.
The stack pointer does get corrected later in the thunk (generated by
osrEntryThunkGenerator()) that we jump to. This is why we don't see ill-effects
so far.

This bug only poses an issue if interrupts use the user stack for their stack
frame (e.g. linux), and when we do stack alignment tests during debugging.

The fix is simply to remove the assignment.

dfg/DFGThunks.cpp:

(JSC::DFG::osrEntryThunkGenerator):

jit/JIT.cpp:

(JSC::JIT::emitEnterOptimizationCheck):

1:05 PM Changeset in webkit [230174] by beidson@apple.com

13 edits in trunk

Process swapping on navigation needs to handle server redirects.
<rdar://problem/38690465> and https://bugs.webkit.org/show_bug.cgi?id=184142

Reviewed by Alex Christensen.

Source/WebKit:

The same rules we apply to process swapping for basic navigations need to apply
to server redirects as well.

Supporting all 3 of these brought their own little challenges.

By teaching Navigation objects more about redirects I was able to support all 3 cases.

UIProcess/API/APINavigation.cpp:

(API::Navigation::Navigation):
(API::Navigation::setCurrentRequest):
(API::Navigation::appendRedirectionURL):
(API::Navigation::loggingString const):
(API::Navigation::loggingURL const): Deleted.

UIProcess/API/APINavigation.h:

UIProcess/API/Cocoa/WKNavigation.mm:

(-[WKNavigation _request]):

UIProcess/WebPageProxy.cpp:

(WebKit::WebPageProxy::receivedPolicyDecision):
(WebKit::WebPageProxy::continueNavigationInNewProcess): If this continued navigation is currently in a server

redirect, save off a lambda to synthesize a "did receive server redirect" callback once the new WebProcess is running.

(WebKit::WebPageProxy::didCreateMainFrame):
(WebKit::WebPageProxy::didStartProvisionalLoadForFrame): Possibly ignore this notification if it is really a

cross-origin redirect that is just starting back up in a new WebProcess.

a navigation swap, as we will need to pick up where we left off when the load continues in a new WebProcess.

UIProcess/WebPageProxy.h:
UIProcess/WebPageProxy.messages.in:

UIProcess/WebProcessPool.cpp:

(WebKit::WebProcessPool::processForNavigation): If a process has never committed any provisional load, it can always

be used to continue a navigation.

UIProcess/WebProcessPool.h:

UIProcess/WebProcessProxy.h:

(WebKit::WebProcessProxy::didCommitProvisionalLoad):
(WebKit::WebProcessProxy::hasCommittedAnyProvisionalLoads const):

WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDidReceiveServerRedirectForProvisionalLoad):
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction):

Tools:

TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:

12:59 PM Changeset in webkit [230173] by rniwa@webkit.org

2 edits in trunk/Source/WebCore

REGRESSION(r228260):WebHTMLView beeps at every keydown for Chinese/Japanese/Korean Input Method
https://bugs.webkit.org/show_bug.cgi?id=184231

Reviewed by Alexey Proskuryakov.

The bug was caused by EventHandler::internalKeyEvent calling setDefaultHandled and expecting it to stay true
after dispatching the event even though m_defaultHandled is always cleared after r228260. This results in
EventHandler::internalKeyEvent returning false, and resulting in a beep.

Unfortunately, no new tests since there is no facility to detect this case in layout tests, and we can't
easily emulate or trigger a real input method in API tests.

page/EventHandler.cpp:

(WebCore::EventHandler::internalKeyEvent):

12:42 PM Changeset in webkit [230172] by Said Abou-Hallawa

1 edit
2 adds in trunk/LayoutTests

Followup(r230063): Add test a layout test for https://bugs.webkit.org/show_bug.cgi?id=183972
https://bugs.webkit.org/show_bug.cgi?id=184162

Reviewed by Daniel Bates.

Without r230063, running run-webkit-tests -g for this test will crash.

svg/dom/animated-tearoff-list-remove-target-expected.txt: Added.
svg/dom/animated-tearoff-list-remove-target.html: Added.

12:06 PM Changeset in webkit [230171] by Wenson Hsieh

2 edits in trunk/Source/WebKit

[Extra zoom mode] Zoom level is sometimes excessive when zooming to focused form controls
https://bugs.webkit.org/show_bug.cgi?id=184222
<rdar://problem/39063886>

Reviewed by Timothy Hatcher.

Upon interactively focusing an element, we zoom and scroll to reveal that element. The heuristics introduced in
<https://trac.webkit.org/r168744> work by computing a target scale, and then a point to zoom to given that
scale. Currently, this scale is dependent on the computed font size of the form control, such that the form
control would be scaled to have an effective font size of 16.

However, in extra zoom mode, applying these same heuristics (ironically) results in excessive zoom levels, since
scaling the font up to 16 would cause most form controls to zoom so far in that we lose context of surrounding
elements such as labels and other form controls; the fact that the element is highlighted by the focused form
control overlay makes this even more confusing, since part of the focus overlay highlight rect often ends up
outside the viewport.

To fix this, we make a couple of tweaks to focus rect zooming in extra zoom mode. (1) Instead of computing
target zoom level based on font size, try to zoom such that the focused element rect fills up most of the
viewport (similar to double-tap zooming). This ensures that the focused form control overlay's highlight rect
makes sense in most cases, with few exceptions (e.g. the element frame is larger than the viewport). (2)
Introduce a minimum legible font size of 11, and compute the minimium scale needed such that the form control
font would appear to be at least this legible font size. Then, clamp the target scale chosen by (1) to this
minimum scale.

One additional consideration for (1) is that naively scaling to fit the element rect to the viewport (with some
fixed margins) would cause the viewport scale to always change when moving focus between form controls of
different dimensions, even if the current scale is more or less appropriate for all the focusable elements. To
address this, instead of computing a single target zoom scale for an element rect, compute a range of possible
target zoom scales (where the minimum and maximum values depend on the margin we add around the element rect).
If the current scale already falls within this target scale range, then we won't bother adjusting the scale at
all (unless the font size is too small — see (2)). If the current scale falls outside the target scale range, we
then make the minimal adjustment needed to ensure that the element rect fits well within the viewport without
being too small.

UIProcess/API/Cocoa/WKWebView.mm:

(-[WKWebView _zoomToFocusRect:selectionRect:insideFixed:fontSize:minimumScale:maximumScale:allowScaling:forceScroll:]):

Move some logic around so that the target scale is computed after computing the visible size. Also renames some
constants local to this function (WKWebViewStandardFontSize, kMinimumHeightToShowContentAboveKeyboard,
UIWebFormAnimationDuration, CaretOffsetFromWindowEdge) such that they now share a consistent naming style.

12:01 PM Changeset in webkit [230170] by jmarcell@apple.com

1 copy in tags/Safari-606.1.7.4

New tag.

11:59 AM Changeset in webkit [230169] by jer.noble@apple.com

5 edits in trunk/Source

Enable Legacy EME for all WebKit & WebKitLegacy clients
https://bugs.webkit.org/show_bug.cgi?id=184018
<rdar://problem/34887387>

Reviewed by Eric Carlson.

Source/WebKit:

Shared/WebPreferences.yaml:
Shared/WebPreferencesDefaultValues.h:

Source/WebKitLegacy/mac:

WebView/WebPreferences.mm:

(+[WebPreferences initialize]):

11:57 AM Changeset in webkit [230168] by jmarcell@apple.com

1 delete in tags/Safari-606.1.11.3

Delete tag.

11:34 AM Changeset in webkit [230167] by commit-queue@webkit.org

2 edits in trunk/Tools

webkitpy: Use current environment value for GST_DEBUG(_FILE) and DOT_DIR env vars
https://bugs.webkit.org/show_bug.cgi?id=184036

Patch by Thibault Saunier <tsaunier@igalia.com> on 2018-04-02
Reviewed by Philippe Normand.

Those variables are for debug purpose and should not change the behaviour
itself, and developers expect them to have effect.

Scripts/webkitpy/port/gtk.py:

(GtkPort.setup_environ_for_server):

11:09 AM Changeset in webkit [230166] by dbates@webkit.org

3 edits in trunk/Tools

Remove Options constructor and use internal linkage for option handlers
https://bugs.webkit.org/show_bug.cgi?id=184229

Reviewed by Andy Estes.

Use C++11 default initializer syntax to remove the need to explicitly have a constructor
for the struct Options. Use internal linkage for option handler functions as these
are never invoked outside the translation unit they are defined in.

WebKitTestRunner/Options.cpp:

(WTR::handleOptionNoTimeout):
(WTR::handleOptionVerbose):
(WTR::handleOptionGcBetweenTests):
(WTR::handleOptionPixelTests):
(WTR::handleOptionPrintSupportedFeatures):
(WTR::handleOptionComplexText):
(WTR::handleOptionAcceleratedDrawing):
(WTR::handleOptionRemoteLayerTree):
(WTR::handleOptionShowWebView):
(WTR::handleOptionShowTouches):
(WTR::handleOptionAllowedHost):
(WTR::handleOptionUnmatched):
(WTR::Options::Options): Deleted.

WebKitTestRunner/Options.h:

10:51 AM Changeset in webkit [230165] by jmarcell@apple.com

1 copy in tags/Safari-606.1.11.3

New tag.

10:49 AM Changeset in webkit [230164] by commit-queue@webkit.org

3 edits in trunk/Source/JavaScriptCore

[MIPS] Optimize JIT code generated by methods with TrustedImm32 operand
https://bugs.webkit.org/show_bug.cgi?id=183740

Patch by Stanislav Ocovaj <stanislav.ocovaj@rt-rk.com> on 2018-04-02
Reviewed by Yusuke Suzuki.

In many macro assembler methods with TrustedImm32 operand a move imm, immTemp (pseudo)instruction is
first generated and a register operand variant of the same method is called to generate the rest
of the code. If the immediate value can fit in 16 bits then we can skip the move instruction and
generate more efficient code using MIPS instructions with immediate operand.

assembler/MIPSAssembler.h:

(JSC::MIPSAssembler::slti):

assembler/MacroAssemblerMIPS.h:

(JSC::MacroAssemblerMIPS::lshift32):
(JSC::MacroAssemblerMIPS::xor32):
(JSC::MacroAssemblerMIPS::branch8):
(JSC::MacroAssemblerMIPS::compare8):
(JSC::MacroAssemblerMIPS::branch32):
(JSC::MacroAssemblerMIPS::branch32WithUnalignedHalfWords):
(JSC::MacroAssemblerMIPS::branchTest32):
(JSC::MacroAssemblerMIPS::mask8OnTest):
(JSC::MacroAssemblerMIPS::branchTest8):
(JSC::MacroAssemblerMIPS::branchAdd32):
(JSC::MacroAssemblerMIPS::branchNeg32):
(JSC::MacroAssemblerMIPS::compare32):
(JSC::MacroAssemblerMIPS::test8):

10:45 AM Changeset in webkit [230163] by jer.noble@apple.com

3 edits in trunk/Source/WebKit

REGRESSION (229680): Fullscreen video does not work (youtube, netflix)
https://bugs.webkit.org/show_bug.cgi?id=184235

Reviewed by Eric Carlson.

Enable the Fullscreen API by default.

Shared/WebPreferences.yaml:
Shared/WebPreferencesDefaultValues.h:

10:44 AM Changeset in webkit [230162] by Fujii Hironori

2 edits in trunk/Source/WebKit

[Win] MSVC can't compile WebResourceLoadStatisticsStore::scheduleClearInMemoryAndPersistent
https://bugs.webkit.org/show_bug.cgi?id=184120

Reviewed by Alex Christensen.

It seems that MSVC can't compile the code using this in a
generalized lambda capture in another lambda.

In this case, there is no need to copy protectedThis for the
inner lambda. Move protectedThis of the outer lambda to the
inner as well as callback.

UIProcess/WebResourceLoadStatisticsStore.cpp:

(WebKit::WebResourceLoadStatisticsStore::scheduleClearInMemoryAndPersistent):
Moved protectedThis from the outer lambda to the inner.

10:16 AM Changeset in webkit [230161] by mitz@apple.com

3 edits in trunk/Source/WebKit

Build fix after r230121

Configurations/WebKit.xcconfig: Disabled framework header postprocessing when building for iOS 11.*
UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h: Reverted r230159.

9:45 AM Changeset in webkit [230160] by mitz@apple.com

2 edits in trunk/Source/WebKit

Fixed the build when BOOL is not bool.
<rdar://problem/39094484>

Reviewed by Jer Noble.

UIProcess/ios/fullscreen/WKFullScreenViewController.mm:

(-[WKFullScreenViewController videoControlsManagerDidChange]): Removed the write-only ivar

_hasControlsManager, the assignment to which was causing the compiler error.

9:41 AM Changeset in webkit [230159] by Ryan Haddad

2 edits in trunk/Source/WebKit

Unreviewed build fix.

UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h: Update availability annotation.

8:40 AM Changeset in webkit [230158] by jer.noble@apple.com

4 edits
2 adds in trunk

AudioBufferSourceNode start method causes OfflineAudioContext to start running
https://bugs.webkit.org/show_bug.cgi?id=181939
<rdar://problem/36755393>

Reviewed by Eric Carlson.

Source/WebCore:

Test: webaudio/offlineaudiocontext-restriction.html

Don't respect playback restrictions for offline AudioContexts.

Modules/webaudio/AudioContext.cpp:

(WebCore::AudioContext::constructCommon):

Modules/webaudio/AudioContext.h:

(WebCore::AudioContext::isOfflineContext const):
(WebCore::AudioContext::userGestureRequiredForAudioStart const):
(WebCore::AudioContext::pageConsentRequiredForAudioStart const):
(WebCore::AudioContext::isOfflineContext): Deleted.

LayoutTests:

webaudio/offlineaudiocontext-restriction-expected.txt: Added.
webaudio/offlineaudiocontext-restriction.html: Added.

7:55 AM Changeset in webkit [230157] by alex

2 edits in trunk/Source/ThirdParty/libwebrtc

Unreviewed fixing GTK port X86 32bits compilation after r230152.

CMakeLists.txt:

7:42 AM Changeset in webkit [230156] by Michael Catanzaro

2 edits in trunk/Source/WebKit

[GTK] DragAndDropHandler.cpp should include GUniquePtrGtk.h
https://bugs.webkit.org/show_bug.cgi?id=184119

Reviewed by Daniel Bates.

UIProcess/gtk/DragAndDropHandler.cpp:

7:33 AM Changeset in webkit [230155] by alex

2 edits in trunk/Source/ThirdParty/libwebrtc

Unreviewed fixing GTK port ARM compilation after r230152.

CMakeLists.txt: Properly avoid SSE implementations for ARM.

6:57 AM Changeset in webkit [230154] by alex

2 edits in trunk/Tools

Unreviewed GTK port dependencies fix after r230152.

Add alsa library dependency for gtk.

gtk/install-dependencies:

5:45 AM Changeset in webkit [230153] by fred.wang@free.fr

5 edits in trunk/Source/WebKit

Fix warnings for unused lambda captures in Source/WebKit
https://bugs.webkit.org/show_bug.cgi?id=173555

Patch by Frederic Wang <fwang@igalia.com> on 2018-04-02
Reviewed by Konstantin Tokarev.

When release logs are disabled, several lambda captures are unused, causing compilation
failures with -Wunused-lambda-capture. This patch marks the corresponding variables as unused
in order to fix these warnings.

Based on initial patch by: Konstantin Tokarev <Konstantin Tokarev>

NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::retrieveCacheEntry):

UIProcess/Network/NetworkProcessProxy.cpp:

(WebKit::NetworkProcessProxy::fetchWebsiteData):
(WebKit::NetworkProcessProxy::deleteWebsiteData):
(WebKit::NetworkProcessProxy::deleteWebsiteDataForOrigins):

UIProcess/WebProcessProxy.cpp:

(WebKit::WebProcessProxy::fetchWebsiteData):
(WebKit::WebProcessProxy::deleteWebsiteData):
(WebKit::WebProcessProxy::deleteWebsiteDataForOrigins):

UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView dragInteraction:willAnimateLiftWithAnimator:session:]):

4:29 AM Changeset in webkit [230152] by commit-queue@webkit.org

20 edits
1 copy
9 adds in trunk

[GTK] Make libwebrtc backend buildable for GTK port
https://bugs.webkit.org/show_bug.cgi?id=178860

Patch by Alejandro G. Castro <alex@igalia.com> on 2018-04-02
Reviewed by Youenn Fablet.

Source/CMakeLists.txt: Add the libwebrtc directory to the compilation.
Source/cmake/OptionsGTK.cmake: Add the USE_LIBWEBRTC option to

allow compilation of the specific code.

Source/ThirdParty/libwebrtc:

Modified the cmake file and added some assembly code to the
boringssl compilation required for the linux compilation generated
by libwebrtc.

CMakeLists.txt: This cmake file was unused so we have modified

it completely to make it work for our port. It was originally
generated from the libwebrtc json file but not anymore. We could
change its structure at some point but current one seems a good
option for the moment.

Source/webrtc/base/task_queue_libevent.cc: We use system

libevent for the moment so we needed to adapt the includes in this file.

Source/webrtc/modules/video_coding/codecs/vp8/vp8_impl.cc:

Readded lines removed by mistake in a previous commit.

Source/WebCore:

This is the first step to add webrtc support to the GTK port using
the libwebrtc backend.

No new tests, no new feature added, it should be tested by current
tests.

CMakeLists.txt: Add the new files to the compilation and set the

new includes in the libwebrtc library.

Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.cpp:

Reorder the includes alphabetically and add some that are missing.

Modules/mediastream/libwebrtc/LibWebRTCPeerConnectionBackend.cpp:

Ditto.

Sources.txt: Add new file to the compilation.
platform/mediastream/gstreamer/RealtimeIncomingAudioSourceLibWebRTC.cpp:

Added. Initial implementation for GTK and WPE.

platform/mediastream/gstreamer/RealtimeIncomingAudioSourceLibWebRTC.h:

Added. Ditto.

platform/mediastream/gstreamer/RealtimeIncomingVideoSourceLibWebRTC.cpp:

Added. Ditto.

platform/mediastream/gstreamer/RealtimeIncomingVideoSourceLibWebRTC.h:

Added. Ditto.

platform/mediastream/gstreamer/RealtimeOutgoingAudioSourceLibWebRTC.cpp:

Added. Ditto.

platform/mediastream/gstreamer/RealtimeOutgoingAudioSourceLibWebRTC.h:

Added. Ditto.

platform/mediastream/gstreamer/RealtimeOutgoingVideoSourceLibWebRTC.cpp:

Added. Ditto.

platform/mediastream/gstreamer/RealtimeOutgoingVideoSourceLibWebRTC.h:

Added. Ditto.

platform/mediastream/libwebrtc/LibWebRTCProviderGlib.cpp: Added includes

for the compilation.

platform/mediastream/libwebrtc/LibWebRTCProviderGlib.h: Added, inherit from

the LibWebRTCProvider to adapt for glib.

Source/WebKit:

CMakeLists.txt: Add RTC network classes to the compilation and

the libwebrtc includes.

PlatformGTK.cmake: Add the libwebrtc directory.
SourcesGTK.txt: Add RTC files to the compilation.

Tools:

gstreamer/jhbuild.modules: Modified the libvpx module for the

libwebrtc compilation.

gtk/install-dependencies: Add libevent as a system requirement.
Scripts/webkitpy/style/checker.py: Added libwebrtc to the list of third

party libraries with reduced style checks.

2:09 AM Changeset in webkit [230151] by aakash_jain@apple.com

5 edits in trunk/Websites/perf.webkit.org

Remove deprecated Buildbot 0.8 code from Perf syncing scripts
https://bugs.webkit.org/show_bug.cgi?id=183915

Reviewed by Ryosuke Niwa.

server-tests/resources/mock-data.js:

(MockData.buildbotBuildersURLDeprecated): Deleted.
(MockData.mockBuildbotBuildersDeprecated): Deleted.
(MockData.pendingBuildDeprecated): Deleted.
(MockData.runningBuildDeprecated): Deleted.
(MockData.finishedBuildDeprecated): Deleted.

tools/js/buildbot-syncer.js:

(BuildbotBuildEntryDeprecated): Deleted.
(BuildbotBuildEntryDeprecated.prototype.initialize): Deleted.
(BuildbotBuildEntryDeprecated.prototype.url): Deleted.
(BuildbotSyncer.prototype.scheduleBuildOnBuildbotDeprecated): Deleted.
(BuildbotSyncer.prototype._pullRecentBuildsDeprecated): Deleted.
(BuildbotSyncer.prototype.pathForPendingBuildsJSONDeprecated): Deleted.
(BuildbotSyncer.prototype.pathForBuildJSONDeprecated): Deleted.
(BuildbotSyncer.prototype.pathForForceBuildDeprecated): Deleted.
(BuildbotSyncer.prototype.url): Deleted.
(BuildbotSyncer.prototype.urlForBuildNumberDeprecated): Deleted.

tools/js/buildbot-triggerable.js:

(BuildbotTriggerable.prototype.getBuilderNameToIDMapDeprecated): Deleted.

unit-tests/buildbot-syncer-tests.js:

(smallPendingBuildDeprecated): Deleted.
(smallInProgressBuildDeprecated): Deleted.
(smallFinishedBuildDeprecated): Deleted.
(samplePendingBuildRequestDeprecated): Deleted.
(sampleInProgressBuildDeprecated): Deleted.
(sampleFinishedBuildDeprecated): Deleted.

12:51 AM Changeset in webkit [230150] by Yusuke Suzuki

5 edits in trunk/Source/JavaScriptCore

[DFG] More aggressive removal of duplicate 32bit DFG code
https://bugs.webkit.org/show_bug.cgi?id=184089

Reviewed by Saam Barati.

This patch more aggressively removes duplicate 32bit DFG code
by leveraging JSValueRegs and meta-programmed callOperation.

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetByValWithThis):
(JSC::DFG::SpeculativeJIT::compileArithMinMax):
(JSC::DFG::SpeculativeJIT::compileNewArray):
(JSC::DFG::SpeculativeJIT::compileCheckCell):
(JSC::DFG::SpeculativeJIT::compileGetGlobalVariable):
(JSC::DFG::SpeculativeJIT::compilePutGlobalVariable):
(JSC::DFG::SpeculativeJIT::compileGetClosureVar):
(JSC::DFG::SpeculativeJIT::compilePutClosureVar):
(JSC::DFG::SpeculativeJIT::compileGetByOffset):
(JSC::DFG::SpeculativeJIT::compilePutByOffset):
(JSC::DFG::SpeculativeJIT::compileGetExecutable):
(JSC::DFG::SpeculativeJIT::compileNewArrayBuffer):
(JSC::DFG::SpeculativeJIT::compileToThis):
(JSC::DFG::SpeculativeJIT::compileIdentity):

dfg/DFGSpeculativeJIT.h:
dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):

Apr 1, 2018:

10:59 PM Changeset in webkit [230149] by Matt Baker

5 edits in trunk/Source/WebInspectorUI

Web Inspector: Remove dead TabBrowser/TabContentView code
https://bugs.webkit.org/show_bug.cgi?id=184104

Reviewed by Devin Rousso.

UserInterface/Base/Main.js:

(WI._tryToRestorePendingTabs):

UserInterface/Views/NewTabContentView.js:

(WI.NewTabContentView.prototype.shown):
(WI.NewTabContentView.prototype.hidden):

UserInterface/Views/TabBrowser.js:

(WI.TabBrowser.prototype.addTabForContentView):
(WI.TabBrowser.prototype.showTabForContentView):
(WI.TabBrowser._tabBarItemRemoved):

UserInterface/Views/TabContentView.js:

(WI.TabContentView.prototype.get parentTabBrowser): Deleted.
(WI.TabContentView.prototype.set parentTabBrowser): Deleted.

10:03 PM Changeset in webkit [230148] by Alan Bujtas

3 edits
1 add in trunk/Tools

[LayoutReloaded] Use containing block's contentBox left edge when the float is to the right.
https://bugs.webkit.org/show_bug.cgi?id=184230

Reviewed by Antti Koivisto.

LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js:

(InlineFormattingContext.prototype._mapFloatingPosition):
(InlineFormattingContext):

LayoutReloaded/test/index.html:
LayoutReloaded/test/inline-formatting-context-with-floats2.html: Added.

8:18 PM Changeset in webkit [230147] by Yusuke Suzuki

7 edits in trunk/Source/WebCore

Use WTF::Lock instead of GMutex
https://bugs.webkit.org/show_bug.cgi?id=184227

Reviewed by Saam Barati.

Prefer WTF::Lock over GMutex since these locks are just protecting WebKit C++ fields.

No behavior change.

platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp:

(WebCore::AudioSourceProviderGStreamer::AudioSourceProviderGStreamer):
(WebCore::AudioSourceProviderGStreamer::~AudioSourceProviderGStreamer):
(WebCore::AudioSourceProviderGStreamer::provideInput):
(WebCore::AudioSourceProviderGStreamer::handleAudioBuffer):
(WebCore::AudioSourceProviderGStreamer::clearAdapters):

platform/audio/gstreamer/AudioSourceProviderGStreamer.h:
platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:

(WebCore::MediaPlayerPrivateGStreamerBase::MediaPlayerPrivateGStreamerBase):
(WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
(WebCore::MediaPlayerPrivateGStreamerBase::naturalSize const):
(WebCore::MediaPlayerPrivateGStreamerBase::pushTextureToCompositor):
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
(WebCore::MediaPlayerPrivateGStreamerBase::flushCurrentBuffer):
(WebCore::MediaPlayerPrivateGStreamerBase::paint):
(WebCore::MediaPlayerPrivateGStreamerBase::copyVideoTextureToPlatformTexture):
(WebCore::MediaPlayerPrivateGStreamerBase::nativeImageForCurrentTime):

platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
platform/graphics/gstreamer/mse/PlaybackPipeline.cpp:
platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp:

7:04 PM Changeset in webkit [230146] by Brent Fulgham

5 edits in trunk

Show punycode if URL contains hyphen character
https://bugs.webkit.org/show_bug.cgi?id=184221
<rdar://problem/38044633>

Reviewed by Darin Adler.

Source/WebCore:

Revise our "lookalike character" logic to include the hyphen,
non-breaking hyphen, and minus sign.

Test: fast/url/host.html

platform/mac/WebCoreNSURLExtras.mm:

(WebCore::isLookalikeCharacter):

LayoutTests:

fast/url/host-expected.txt:
fast/url/host.html:

12:46 PM Changeset in webkit [230145] by fpizlo@apple.com

2 edits in trunk/Source/JavaScriptCore

Raise the for-call inlining threshold to 190 to fix JetStream/richards regression
https://bugs.webkit.org/show_bug.cgi?id=184228

Reviewed by Yusuke Suzuki.

runtime/Options.h:

10:57 AM Changeset in webkit [230144] by fpizlo@apple.com

54 edits in trunk/Source

JSObject shouldn't do index masking
https://bugs.webkit.org/show_bug.cgi?id=184194

Reviewed by Yusuke Suzuki.
Source/JavaScriptCore:

Remove index masking, because it's not the way we'll mitigate Spectre.

API/tests/JSObjectGetProxyTargetTest.cpp:

(testJSObjectGetProxyTarget):

b3/B3LowerToAir.cpp:
b3/B3Validate.cpp:
b3/B3WasmBoundsCheckValue.cpp:

(JSC::B3::WasmBoundsCheckValue::WasmBoundsCheckValue):
(JSC::B3::WasmBoundsCheckValue::dumpMeta const):

b3/B3WasmBoundsCheckValue.h:

(JSC::B3::WasmBoundsCheckValue::bounds const):
(JSC::B3::WasmBoundsCheckValue::pinnedIndexingMask const): Deleted.

b3/testb3.cpp:

(JSC::B3::testWasmBoundsCheck):
(JSC::B3::run):

dfg/DFGAbstractInterpreterInlines.h:

(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):

dfg/DFGArgumentsEliminationPhase.cpp:
dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::parseBlock):

dfg/DFGClobberize.h:

(JSC::DFG::clobberize):

dfg/DFGDoesGC.cpp:

(JSC::DFG::doesGC):

dfg/DFGFixupPhase.cpp:

(JSC::DFG::FixupPhase::fixupNode):

dfg/DFGNodeType.h:
dfg/DFGPredictionPropagationPhase.cpp:
dfg/DFGSSALoweringPhase.cpp:

(JSC::DFG::SSALoweringPhase::handleNode):

dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
(JSC::DFG::SpeculativeJIT::loadFromIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
(JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
(JSC::DFG::SpeculativeJIT::compileCreateActivation):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
(JSC::DFG::SpeculativeJIT::compileArraySlice):
(JSC::DFG::SpeculativeJIT::compileNewStringObject):
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
(JSC::DFG::SpeculativeJIT::compileNewRegexp):
(JSC::DFG::SpeculativeJIT::compileCreateThis):
(JSC::DFG::SpeculativeJIT::compileNewObject):

dfg/DFGSpeculativeJIT.h:

(JSC::DFG::SpeculativeJIT::emitAllocateJSObject):
(JSC::DFG::SpeculativeJIT::emitAllocateJSObjectWithKnownSize):

dfg/DFGSpeculativeJIT32_64.cpp:

(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):

dfg/DFGSpeculativeJIT64.cpp:

(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):

ftl/FTLAbstractHeapRepository.h:
ftl/FTLCapabilities.cpp:

(JSC::FTL::canCompile):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileAtomicsReadModifyWrite):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
(JSC::FTL::DFG::LowerDFGToB3::compileCreateDirectArguments):
(JSC::FTL::DFG::LowerDFGToB3::compileNewStringObject):
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeNewObject):
(JSC::FTL::DFG::LowerDFGToB3::compileMaterializeCreateActivation):
(JSC::FTL::DFG::LowerDFGToB3::compileNewRegexp):
(JSC::FTL::DFG::LowerDFGToB3::allocateObject):
(JSC::FTL::DFG::LowerDFGToB3::allocateVariableSizedObject):
(JSC::FTL::DFG::LowerDFGToB3::allocateJSArray):
(JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayMask): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::maskedIndex): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::computeButterflyIndexingMask): Deleted.

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitAllocateJSObject):
(JSC::AssemblyHelpers::emitAllocateJSObjectWithKnownSize):
(JSC::AssemblyHelpers::emitAllocateVariableSizedJSObject):
(JSC::AssemblyHelpers::emitAllocateDestructibleObject):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_new_object):
(JSC::JIT::emit_op_create_this):

jit/JITOperations.cpp:
jit/JITPropertyAccess.cpp:

(JSC::JIT::emitDoubleLoad):
(JSC::JIT::emitContiguousLoad):
(JSC::JIT::emitArrayStorageLoad):

llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/Butterfly.h:

(JSC::ContiguousData::at const):
(JSC::ContiguousData::at):
(JSC::Butterfly::computeIndexingMask const): Deleted.

runtime/ButterflyInlines.h:

(JSC::ContiguousData<T>::at const): Deleted.
(JSC::ContiguousData<T>::at): Deleted.

runtime/ClonedArguments.cpp:

(JSC::ClonedArguments::createEmpty):

runtime/JSArray.cpp:

(JSC::JSArray::tryCreateUninitializedRestricted):
(JSC::JSArray::appendMemcpy):
(JSC::JSArray::setLength):
(JSC::JSArray::pop):
(JSC::JSArray::shiftCountWithAnyIndexingType):
(JSC::JSArray::unshiftCountWithAnyIndexingType):
(JSC::JSArray::fillArgList):
(JSC::JSArray::copyToArguments):

runtime/JSArrayBufferView.cpp:

(JSC::JSArrayBufferView::JSArrayBufferView):

runtime/JSArrayInlines.h:

(JSC::JSArray::pushInline):

runtime/JSFixedArray.h:
runtime/JSGenericTypedArrayViewInlines.h:

(JSC::JSGenericTypedArrayView<Adaptor>::slowDownAndWasteMemory):

runtime/JSObject.cpp:

(JSC::JSObject::getOwnPropertySlotByIndex):
(JSC::JSObject::putByIndex):
(JSC::JSObject::createInitialUndecided):
(JSC::JSObject::createInitialInt32):
(JSC::JSObject::createInitialDouble):
(JSC::JSObject::createInitialContiguous):
(JSC::JSObject::createArrayStorage):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::convertUndecidedToArrayStorage):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToArrayStorage):
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::convertDoubleToArrayStorage):
(JSC::JSObject::convertContiguousToArrayStorage):
(JSC::JSObject::createInitialForValueAndSet):
(JSC::JSObject::deletePropertyByIndex):
(JSC::JSObject::getOwnPropertyNames):
(JSC::JSObject::putByIndexBeyondVectorLengthWithoutAttributes):
(JSC::JSObject::countElements):
(JSC::JSObject::increaseVectorLength):
(JSC::JSObject::ensureLengthSlow):
(JSC::JSObject::reallocateAndShrinkButterfly):
(JSC::JSObject::getEnumerableLength):

runtime/JSObject.h:

(JSC::JSObject::canGetIndexQuickly):
(JSC::JSObject::getIndexQuickly):
(JSC::JSObject::tryGetIndexQuickly const):
(JSC::JSObject::setIndexQuickly):
(JSC::JSObject::initializeIndex):
(JSC::JSObject::initializeIndexWithoutBarrier):
(JSC::JSObject::butterflyOffset):
(JSC::JSObject::setButterfly):
(JSC::JSObject::nukeStructureAndSetButterfly):
(JSC::JSObject::JSObject):
(JSC::JSObject::butterflyIndexingMaskOffset): Deleted.
(JSC::JSObject::butterflyIndexingMask const): Deleted.
(JSC::JSObject::setButterflyWithIndexingMask): Deleted.

runtime/JSObjectInlines.h:

(JSC::JSObject::prepareToPutDirectWithoutTransition):
(JSC::JSObject::putDirectInternal):

runtime/RegExpMatchesArray.h:

(JSC::tryCreateUninitializedRegExpMatchesArray):

runtime/Structure.cpp:

(JSC::Structure::flattenDictionaryStructure):

wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::B3IRGenerator):
(JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
(JSC::Wasm::B3IRGenerator::emitCheckAndPreparePointer):
(JSC::Wasm::B3IRGenerator::load):
(JSC::Wasm::B3IRGenerator::store):
(JSC::Wasm::B3IRGenerator::addCallIndirect):

wasm/WasmBinding.cpp:

(JSC::Wasm::wasmToWasm):

wasm/WasmInstance.h:

(JSC::Wasm::Instance::updateCachedMemory):
(JSC::Wasm::Instance::offsetOfCachedMemorySize):
(JSC::Wasm::Instance::offsetOfCachedIndexingMask): Deleted.

wasm/WasmMemory.cpp:

(JSC::Wasm::Memory::Memory):
(JSC::Wasm::Memory::grow):

wasm/WasmMemory.h:

(JSC::Wasm::Memory::size const):
(JSC::Wasm::Memory::offsetOfSize):
(JSC::Wasm::Memory::indexingMask): Deleted.
(JSC::Wasm::Memory::offsetOfIndexingMask): Deleted.

wasm/WasmMemoryInformation.cpp:

(JSC::Wasm::PinnedRegisterInfo::get):
(JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):

wasm/WasmMemoryInformation.h:

(JSC::Wasm::PinnedRegisterInfo::toSave const):

wasm/js/JSToWasm.cpp:

(JSC::Wasm::createJSToWasmWrapper):

Source/WebCore:

No new tests because no new behavior.

bindings/js/JSDOMConvertSequences.h:

(WebCore::Detail::NumericSequenceConverter::convertArray):
(WebCore::Detail::SequenceConverter::convertArray):

10:08 AM Changeset in webkit [230143] by fpizlo@apple.com

3 edits
2 adds in trunk

JSC crash in JIT code with for-of loop and Array/Set iterators
https://bugs.webkit.org/show_bug.cgi?id=183174

Reviewed by Saam Barati.

JSTests:

microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x.

(foo):

stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed.

(f):

Source/JavaScriptCore:

dfg/DFGSafeToExecute.h:

(JSC::DFG::safeToExecute): Fix the bug by making GetByOffset and friends verify that they are getting the type proof they want at the desired hoisting site.

9:47 AM Changeset in webkit [230142] by Alan Bujtas

3 edits
1 add in trunk/Tools

[LayoutReloaded] Right floating box reduces available line width.
https://bugs.webkit.org/show_bug.cgi?id=184226

Reviewed by Antti Koivisto.

LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js:

(InlineFormattingContext.prototype._createNewLine):

LayoutReloaded/test/index.html:
LayoutReloaded/test/inline-with-floats-right-left-simple.html: Added.

Mar 31, 2018:

10:37 PM Changeset in webkit [230141] by Alan Bujtas

5 edits
1 add in trunk/Tools

[LayoutReloaded] Floating box reduces line with in inline formatting context
https://bugs.webkit.org/show_bug.cgi?id=184223

Reviewed by Antti Koivisto.

LayoutReloaded/FormattingContext/FloatingContext.js:

(FloatingContext.prototype.left):
(FloatingContext.prototype.right):
(FloatingContext.prototype._mapDisplayMarginBoxToFormattingRoot):
(FloatingContext.prototype._mapBorderBoxToFormattingRoot):
(FloatingContext.prototype._mapContentBoxToFormattingRoot):
(FloatingContext.prototype.formattingRoot):
(FloatingContext.prototype._floatingState):
(FloatingContext.prototype._formattingRoot): Deleted.

LayoutReloaded/FormattingContext/InlineFormatting/InlineFormattingContext.js:

(InlineFormattingContext.prototype._createNewLine):
(InlineFormattingContext.prototype._mapFloatingPosition):
(InlineFormattingContext):

LayoutReloaded/FormattingState/FormattingState.js:

(FormattingState.prototype.displayBox):
(FormattingState):

LayoutReloaded/test/index.html:
LayoutReloaded/test/inline-formatting-context-with-floats.html: Added.

8:07 PM Changeset in webkit [230140] by Alan Bujtas

5 edits in trunk/Tools

[LayoutReloaded] InlineFormattingState should inherit the floating state from its parent formatting state
https://bugs.webkit.org/show_bug.cgi?id=184220

Reviewed by Antti Koivisto.

If the block container box that initiates an inline formatting context also establishes a block context,
create a new float state, otherwise use the existing one.

LayoutReloaded/FormattingContext/BlockFormatting/BlockFormattingContext.js:

(BlockFormattingContext.prototype._contentHeight):

LayoutReloaded/FormattingState/InlineFormattingState.js:

(InlineFormattingState):

LayoutReloaded/LayoutState.js:

(LayoutState.prototype.establishedFormattingState):
(LayoutState.prototype.formattingStateForBox):
(LayoutState.prototype.formattingState): Deleted.

LayoutReloaded/Utils.js:

7:44 PM Changeset in webkit [230139] by Alan Bujtas

3 edits in trunk/Tools

[LayoutReloaded] FloatingContext does not need a parent formatting context.
https://bugs.webkit.org/show_bug.cgi?id=184219

Reviewed by Antti Koivisto.

We don't need the formatting context in the FloatingContext now that margins are moved over to Display.Box.
This is in preparation for being able to create a FloatingContext for an inline formatting context,
when the inline context actually inherits the floating state from its formatting root.

LayoutReloaded/FormattingContext/FloatingContext.js:

(FloatingContext):
(FloatingContext.prototype._availableSpace):
(FloatingContext.prototype._adjustedFloatingPosition):
(FloatingContext.prototype._addFloatingBox):
(FloatingContext.prototype._formattingContext): Deleted.

LayoutReloaded/FormattingContext/FormattingContext.js:

(FormattingContext):

7:24 PM Changeset in webkit [230138] by Alan Bujtas

4 edits in trunk/Tools

[LayoutReloaded] Do not clone Display.Box for FloatingState stacks.
https://bugs.webkit.org/show_bug.cgi?id=184218

Reviewed by Antti Koivisto.

Now that Display.Box is in a tree context, we can't just clone it for the purpose of caching its absolute position.

LayoutReloaded/DisplayTree/Box.js:

(Display.Box.prototype.clone): Deleted.

LayoutReloaded/FormattingContext/FloatingContext.js:

(FloatingContext.prototype._positionForFloating):
(FloatingContext.prototype._moveToNextVerticalPosition):
(FloatingContext.prototype._availableSpace):
(FloatingContext.prototype._findFloatingAtVerticalPosition):
(FloatingContext.prototype._adjustedFloatingPosition):
(FloatingContext.prototype._bottom):
(FloatingContext.prototype._addFloatingBox):
(FloatingContext.prototype._mapMarginBoxToFormattingRoot):
(FloatingContext.prototype._mapDisplayMarginBoxToFormattingRoot):

LayoutReloaded/FormattingState/FloatingState.js:

(FloatingState.prototype.addFloating):

7:07 PM Changeset in webkit [230137] by Alan Bujtas

5 edits in trunk/Tools

[LayoutReloaded] Remove all FormattingContext::absolute*Box functions.
https://bugs.webkit.org/show_bug.cgi?id=184215

Reviewed by Antti Koivisto.

Use Display.Box instead.

LayoutReloaded/FormattingContext/BlockFormatting/BlockFormattingContext.js:

(BlockFormattingContext.prototype._computeOutOfFlowPosition):

LayoutReloaded/FormattingContext/FloatingContext.js:

(FloatingContext.prototype._availableSpace):
(FloatingContext.prototype._adjustedFloatingPosition):
(FloatingContext.prototype._mapBorderBoxToFormattingRoot):
(FloatingContext.prototype._mapContentBoxToFormattingRoot):

LayoutReloaded/FormattingContext/FormattingContext.js:

(FormattingContext.prototype.absoluteBorderBox): Deleted.
(FormattingContext.prototype.absolutePaddingBox): Deleted.
(FormattingContext.prototype.absoluteContentBox): Deleted.
(FormattingContext.prototype._toAbsolutePosition): Deleted.
(FormattingContext.prototype._toRootAbsolutePosition): Deleted.

LayoutReloaded/Utils.js:

(Utils.mapPosition):
(Utils.marginBox):
(Utils.borderBox):
(Utils.contentBox):

6:12 PM Changeset in webkit [230136] by Alan Bujtas

4 edits in trunk/Tools

[LayoutReloaded] Remove FormattingContext::absoluteMarginBox
https://bugs.webkit.org/show_bug.cgi?id=184213

Reviewed by Antti Koivisto.

Display.Box already has the margin values.

LayoutReloaded/FormattingContext/FloatingContext.js:

(FloatingContext.prototype._positionForFloating):
(FloatingContext.prototype._addFloatingBox):
(FloatingContext.prototype._mapMarginBoxToFormattingRoot):
(FloatingContext.prototype._formattingRoot):

LayoutReloaded/FormattingContext/FormattingContext.js:

(FormattingContext.prototype.absoluteMarginBox): Deleted.

LayoutReloaded/Utils.js:

(Utils.marginBox):

5:50 PM Changeset in webkit [230135] by Alan Bujtas

4 edits in trunk/Tools

[layoutReloaded] Introduce margin to Display.Box
https://bugs.webkit.org/show_bug.cgi?id=184212

Reviewed by Antti Koivisto.

This is in preparation for moving margin box out of formatting context to Display.Box.

LayoutReloaded/DisplayTree/Box.js:

(Display.Box):
(Display.Box.prototype.setRect):
(Display.Box.prototype.setTopLeft):
(Display.Box.prototype.setTop):
(Display.Box.prototype.setLeft):
(Display.Box.prototype.setSize):
(Display.Box.prototype.setWidth):
(Display.Box.prototype.setHeight):
(Display.Box.prototype.width):
(Display.Box.prototype.setMarginTop):
(Display.Box.prototype.setMarginLeft):
(Display.Box.prototype.setMarginBottom):
(Display.Box.prototype.setMarginRight):
(Display.Box.prototype.marginTop):
(Display.Box.prototype.marginLeft):
(Display.Box.prototype.marginBottom):
(Display.Box.prototype.marginRight):
(Display.Box.prototype.marginBox):

LayoutReloaded/FormattingContext/FormattingContext.js:

(FormattingContext.prototype.absoluteMarginBox):
(FormattingContext.prototype._addToLayoutQueue):

LayoutReloaded/FormattingState/FormattingState.js:

(FormattingState.prototype.createDisplayBox):

4:39 PM Changeset in webkit [230134] by Alan Bujtas

3 edits in trunk/Tools

[LayoutReloaded] Add tree context to Display.Box
https://bugs.webkit.org/show_bug.cgi?id=184211

Reviewed by Antti Koivisto.

This is preparation for using the Display.Box tree to resolve absolute coordinates.

LayoutReloaded/DisplayTree/Box.js:

(Display.Box):
(Display.Box.prototype.setParent):
(Display.Box.prototype.setNextSibling):
(Display.Box.prototype.setPreviousSibling):
(Display.Box.prototype.setFirstChild):
(Display.Box.prototype.setLastChild):
(Display.Box.prototype.parent):
(Display.Box.prototype.nextSibling):
(Display.Box.prototype.previousSibling):
(Display.Box.prototype.firstChild):
(Display.Box.prototype.lastChild):

LayoutReloaded/FormattingState/FormattingState.js:

(FormattingState.prototype.createDisplayBox):

10:32 AM Changeset in webkit [230133] by jmarcell@apple.com

5 edits in tags/Safari-606.1.11.2/Source

Cherry-pick r230128. rdar://problem/39057006

REGRESSION (r229828): Facebook login popup is blank
https://bugs.webkit.org/show_bug.cgi?id=184206
<rdar://problem/39057006>

Reviewed by Wenson Hsieh.

Source/WebCore:

Since r229828, we freeze the layer tree during the navigation policy check.
We freeze in WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction()
and unfreeze in WebFrameLoaderClient::didDecidePolicyForNavigationAction().

WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction() gets called
from PolicyChecker::checkNavigationPolicy() which has 3 call sites in
FrameLoader and one in DocumentLoader for redirects. The call sites in
FrameLoader were taking care of calling didDecidePolicyForNavigationAction()
on the FrameLoaderClient in their completion handler, but the DocumentLoader
call site was failing to do so. As a result, the layer tree would stay frozen.

To make this a lot less error prone, I moved the call to
WebFrameLoaderClient::didDecidePolicyForNavigationAction() to
PolicyChecker::checkNavigationPolicy(), inside the completion handler passed
to WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(). This way,
even if new code starts calling PolicyChecker::checkNavigationPolicy(), we
do not need to worry about letting the client know when the policy decision
is made.

No new tests, covered by existing redirection tests with the
new assertion I added.

loader/FrameLoader.cpp: (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy): (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
loader/PolicyChecker.cpp: (WebCore::PolicyChecker::checkNavigationPolicy):

Source/WebKit:

Add assertion to make sure we never try to do a policy check to
a resource response while a policy check for a navigation is
pending. This assertion was being hit by several of our redirection
tests without my fix.

WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp: (WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230128 268f45cc-cd09-0410-ab3c-d52691b4dbfc

10:26 AM Changeset in webkit [230132] by jmarcell@apple.com

7 edits in tags/Safari-606.1.11.2/Source

Versioning.

10:22 AM Changeset in webkit [230131] by jmarcell@apple.com

1 copy in tags/Safari-606.1.11.2

New tag.

8:55 AM Changeset in webkit [230130] by fpizlo@apple.com

12 edits in trunk/Source

Strings and Vectors shouldn't do index masking
https://bugs.webkit.org/show_bug.cgi?id=184193

Reviewed by Mark Lam.

Source/JavaScriptCore:

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileGetCharCodeAt):
(JSC::DFG::SpeculativeJIT::compileGetByValOnString):

ftl/FTLAbstractHeapRepository.h:
ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharCodeAt):

jit/ThunkGenerators.cpp:

(JSC::stringCharLoad):

Source/WTF:

wtf/SizeLimits.cpp:
wtf/Vector.h:

(WTF::VectorBufferBase::allocateBuffer):
(WTF::VectorBufferBase::tryAllocateBuffer):
(WTF::VectorBufferBase::reallocateBuffer):
(WTF::VectorBufferBase::deallocateBuffer):
(WTF::VectorBufferBase::releaseBuffer):
(WTF::VectorBufferBase::VectorBufferBase):
(WTF::VectorBuffer::allocateBuffer):
(WTF::VectorBuffer::tryAllocateBuffer):
(WTF::VectorBuffer::swap):
(WTF::VectorBuffer::restoreInlineBufferIfNeeded):
(WTF::Vector::at):
(WTF::Vector::at const):
(WTF::VectorBufferBase::updateMask): Deleted.

wtf/text/StringImpl.h:

(WTF::StringImpl::flagIsSymbol):
(WTF::StringImpl::length const):
(WTF::StringImplShape::StringImplShape):
(WTF::StringImpl::at const):
(WTF::StringImpl::tailOffset):
(WTF::StringImpl::maskOffset): Deleted.
(WTF::StringImpl::mask const): Deleted.

wtf/text/StringView.h:

(WTF::StringView::StringView):
(WTF::StringView::operator=):
(WTF::StringView::initialize):
(WTF::StringView::clear):
(WTF::StringView::operator[] const):

wtf/text/WTFString.h:

(WTF::String::length const):
(WTF::String::mask const): Deleted.

12:04 AM Changeset in webkit [230129] by mark.lam@apple.com

58 edits in trunk/Source

Add pointer profiling support in baseline JIT and supporting files.
https://bugs.webkit.org/show_bug.cgi?id=184200
<rdar://problem/39057300>

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

To simplify pointer profiling support, vmEntryToJavaScript() now always enters the code via the arity check entry.
To accommodate (1), all JITCode must now populate their arity check entry code pointers as well. For native code, programs, evals, and modules that don't do arity check, we set the normal entry as the arity check entry (though with the CodeEntryWithArityCheckPtrTag profile instead).

assembler/AbstractMacroAssembler.h:
assembler/LinkBuffer.h:

(JSC::LinkBuffer::locationOfNearCall):

assembler/MacroAssemblerARM64.h:

(JSC::MacroAssemblerARM64::readCallTarget):
(JSC::MacroAssemblerARM64::linkCall):

bytecode/AccessCase.cpp:

(JSC::AccessCase::generateImpl):

bytecode/AccessCaseSnippetParams.cpp:

(JSC::SlowPathCallGeneratorWithArguments::generateImpl):

bytecode/CodeBlock.cpp:

(JSC::CodeBlock::addJITAddIC):
(JSC::CodeBlock::addJITMulIC):
(JSC::CodeBlock::addJITSubIC):
(JSC::CodeBlock::addJITNegIC):

bytecode/CodeBlock.h:

(JSC::CodeBlock::addMathIC):

bytecode/InlineAccess.cpp:

(JSC::InlineAccess::rewireStubAsJump):

bytecode/LLIntCallLinkInfo.h:

(JSC::LLIntCallLinkInfo::unlink):
(): Deleted.

bytecode/PolymorphicAccess.cpp:

(JSC::AccessGenerationState::emitExplicitExceptionHandler):
(JSC::PolymorphicAccess::regenerate):

dfg/DFGJITFinalizer.cpp:

(JSC::DFG::JITFinalizer::finalize):
(JSC::DFG::JITFinalizer::finalizeFunction):

dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::compileValueAdd):
(JSC::DFG::SpeculativeJIT::compileArithSub):
(JSC::DFG::SpeculativeJIT::compileArithNegate):
(JSC::DFG::SpeculativeJIT::compileArithMul):
(JSC::DFG::SpeculativeJIT::emitSwitchIntJump):
(JSC::DFG::SpeculativeJIT::emitSwitchImm):
(JSC::DFG::SpeculativeJIT::emitSwitchStringOnString):

disassembler/ARM64Disassembler.cpp:

(JSC::tryToDisassemble):

ftl/FTLJITFinalizer.cpp:

(JSC::FTL::JITFinalizer::finalizeCommon):

ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileValueAdd):
(JSC::FTL::DFG::LowerDFGToB3::compileUnaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileBinaryMathIC):
(JSC::FTL::DFG::LowerDFGToB3::compileArithAddOrSub):
(JSC::FTL::DFG::LowerDFGToB3::compileArithMul):
(JSC::FTL::DFG::LowerDFGToB3::compileArithNegate):

heap/JITStubRoutineSet.h:

(JSC::JITStubRoutineSet::mark):

jit/AssemblyHelpers.cpp:

(JSC::AssemblyHelpers::callExceptionFuzz):
(JSC::AssemblyHelpers::debugCall):

jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::emitFunctionPrologue):

jit/CCallHelpers.cpp:

(JSC::CCallHelpers::ensureShadowChickenPacket):

jit/CCallHelpers.h:

(JSC::CCallHelpers::prepareForTailCallSlow):

jit/CallFrameShuffler.cpp:

(JSC::CallFrameShuffler::prepareForTailCall):

jit/ExecutableAllocator.cpp:

(JSC::FixedVMPoolExecutableAllocator::jitWriteThunkGenerator):

jit/ExecutableAllocator.h:

(JSC::performJITMemcpy):

jit/JIT.cpp:

(JSC::JIT::compileWithoutLinking):
(JSC::JIT::link):

jit/JITArithmetic.cpp:

(JSC::JIT::emit_op_negate):
(JSC::JIT::emit_op_add):
(JSC::JIT::emitMathICFast):
(JSC::JIT::emitMathICSlow):
(JSC::JIT::emit_op_mul):
(JSC::JIT::emit_op_sub):

jit/JITCode.cpp:

(JSC::JITCode::execute):
(JSC::JITCodeWithCodeRef::executableAddressAtOffset):
(JSC::DirectJITCode::DirectJITCode):
(JSC::DirectJITCode::initializeCodeRef):
(JSC::NativeJITCode::addressForCall):

jit/JITExceptions.cpp:

(JSC::genericUnwind):

jit/JITMathIC.h:

(JSC::isProfileEmpty):
(JSC::JITBinaryMathIC::JITBinaryMathIC):
(JSC::JITUnaryMathIC::JITUnaryMathIC):

jit/JITOpcodes.cpp:

(JSC::JIT::emit_op_switch_imm):
(JSC::JIT::emit_op_switch_char):
(JSC::JIT::emit_op_switch_string):
(JSC::JIT::privateCompileHasIndexedProperty):
(JSC::JIT::emitSlow_op_has_indexed_property):

jit/JITOpcodes32_64.cpp:

(JSC::JIT::privateCompileHasIndexedProperty):

jit/JITOperations.cpp:

(JSC::getByVal):
(JSC::tryGetByValOptimize):

jit/JITPropertyAccess.cpp:

(JSC::JIT::stringGetByValStubGenerator):
(JSC::JIT::emitGetByValWithCachedId):
(JSC::JIT::emitSlow_op_get_by_val):
(JSC::JIT::emitPutByValWithCachedId):
(JSC::JIT::emitSlow_op_put_by_val):
(JSC::JIT::emitSlow_op_try_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id):
(JSC::JIT::emitSlow_op_get_by_id_with_this):
(JSC::JIT::emitSlow_op_put_by_id):
(JSC::JIT::privateCompileGetByVal):
(JSC::JIT::privateCompileGetByValWithCachedId):
(JSC::JIT::privateCompilePutByVal):
(JSC::JIT::privateCompilePutByValWithCachedId):

jit/JITThunks.cpp:

(JSC::JITThunks::hostFunctionStub):

jit/Repatch.cpp:

(JSC::tryCacheGetByID):
(JSC::repatchGetByID):
(JSC::appropriateOptimizingPutByIdFunction):
(JSC::tryCachePutByID):
(JSC::repatchPutByID):
(JSC::linkFor):
(JSC::revertCall):
(JSC::linkPolymorphicCall):
(JSC::resetGetByID):
(JSC::resetPutByID):

jit/Repatch.h:
jit/SpecializedThunkJIT.h:

(JSC::SpecializedThunkJIT::finalize):
(JSC::SpecializedThunkJIT::callDoubleToDouble):

jit/ThunkGenerators.cpp:

(JSC::emitPointerValidation):
(JSC::throwExceptionFromCallSlowPathGenerator):
(JSC::slowPathFor):
(JSC::linkCallThunkGenerator): Deleted.
(JSC::linkPolymorphicCallThunkGenerator): Deleted.
(JSC::virtualThunkFor): Deleted.
(JSC::nativeForGenerator): Deleted.
(JSC::nativeCallGenerator): Deleted.
(JSC::nativeTailCallGenerator): Deleted.
(JSC::nativeTailCallWithoutSavedTagsGenerator): Deleted.
(JSC::nativeConstructGenerator): Deleted.
(JSC::internalFunctionCallGenerator): Deleted.
(JSC::internalFunctionConstructGenerator): Deleted.
(JSC::arityFixupGenerator): Deleted.
(JSC::unreachableGenerator): Deleted.
(JSC::stringCharLoad): Deleted.
(JSC::charToString): Deleted.
(JSC::charCodeAtThunkGenerator): Deleted.
(JSC::charAtThunkGenerator): Deleted.
(JSC::fromCharCodeThunkGenerator): Deleted.
(JSC::clz32ThunkGenerator): Deleted.
(JSC::sqrtThunkGenerator): Deleted.
(JSC::floorThunkGenerator): Deleted.
(JSC::ceilThunkGenerator): Deleted.
(JSC::truncThunkGenerator): Deleted.
(JSC::roundThunkGenerator): Deleted.
(JSC::expThunkGenerator): Deleted.
(JSC::logThunkGenerator): Deleted.
(JSC::absThunkGenerator): Deleted.
(JSC::imulThunkGenerator): Deleted.
(JSC::randomThunkGenerator): Deleted.
(JSC::boundThisNoArgsFunctionCallGenerator): Deleted.

llint/LLIntData.cpp:

(JSC::LLInt::initialize):

llint/LLIntData.h:

(JSC::LLInt::getCodePtr):

llint/LLIntEntrypoint.cpp:

(JSC::LLInt::setEvalEntrypoint):
(JSC::LLInt::setProgramEntrypoint):
(JSC::LLInt::setModuleProgramEntrypoint):

llint/LLIntSlowPaths.cpp:

(JSC::LLInt::setUpCall):

llint/LLIntThunks.cpp:

(JSC::LLInt::generateThunkWithJumpTo):

llint/LowLevelInterpreter.asm:
llint/LowLevelInterpreter32_64.asm:
llint/LowLevelInterpreter64.asm:
runtime/ExecutableBase.h:
runtime/NativeExecutable.cpp:

(JSC::NativeExecutable::finishCreation):

runtime/NativeFunction.h:

(JSC::TaggedNativeFunction::TaggedNativeFunction):
(JSC::TaggedNativeFunction::operator NativeFunction):

runtime/PropertySlot.h:

(JSC::PropertySlot::setCustom):
(JSC::PropertySlot::setCacheableCustom):

runtime/PtrTag.h:
runtime/PutPropertySlot.h:

(JSC::PutPropertySlot::setCustomValue):
(JSC::PutPropertySlot::setCustomAccessor):

runtime/SamplingProfiler.cpp:

(JSC::SamplingProfiler::takeSample):

runtime/VMTraps.cpp:

(JSC::SignalContext::SignalContext):
(JSC::VMTraps::tryInstallTrapBreakpoints):

tools/SigillCrashAnalyzer.cpp:

(JSC::installCrashHandler):

yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generateTryReadUnicodeCharacterHelper):
(JSC::Yarr::YarrGenerator::generateEnter):

Source/WTF:

wtf/PointerPreparations.h:
Remove WTF_PREPARE_FUNCTION_POINTER_FOR_EXECUTION. It is no longer needed.

Mar 30, 2018:

11:44 PM Changeset in webkit [230128] by Chris Dumez

5 edits in trunk/Source

REGRESSION (r229828): Facebook login popup is blank
https://bugs.webkit.org/show_bug.cgi?id=184206
<rdar://problem/39057006>

Reviewed by Wenson Hsieh.

Source/WebCore:

Since r229828, we freeze the layer tree during the navigation policy check.
We freeze in WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction()
and unfreeze in WebFrameLoaderClient::didDecidePolicyForNavigationAction().

WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction() gets called
from PolicyChecker::checkNavigationPolicy() which has 3 call sites in
FrameLoader and one in DocumentLoader for redirects. The call sites in
FrameLoader were taking care of calling didDecidePolicyForNavigationAction()
on the FrameLoaderClient in their completion handler, but the DocumentLoader
call site was failing to do so. As a result, the layer tree would stay frozen.

To make this a lot less error prone, I moved the call to
WebFrameLoaderClient::didDecidePolicyForNavigationAction() to
PolicyChecker::checkNavigationPolicy(), inside the completion handler passed
to WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(). This way,
even if new code starts calling PolicyChecker::checkNavigationPolicy(), we
do not need to worry about letting the client know when the policy decision
is made.

No new tests, covered by existing redirection tests with the
new assertion I added.

loader/FrameLoader.cpp:

(WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
(WebCore::FrameLoader::continueLoadAfterNavigationPolicy):

loader/PolicyChecker.cpp:

(WebCore::PolicyChecker::checkNavigationPolicy):

Source/WebKit:

Add assertion to make sure we never try to do a policy check to
a resource response while a policy check for a navigation is
pending. This assertion was being hit by several of our redirection
tests without my fix.

WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:

(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse):

10:14 PM Changeset in webkit [230127] by webkit@devinrousso.com

13 edits
2 adds in trunk

Web Inspector: tint all pixels drawn by shader program when hovering ShaderProgramTreeElement
https://bugs.webkit.org/show_bug.cgi?id=175223

Reviewed by Matt Baker.

Source/JavaScriptCore:

inspector/protocol/Canvas.json:

Add setShaderProgramHighlighted command that will cause a blend to be applied to the
canvas if the given shader program is active immediately before drawArrays or drawElements
is called. The blend is removed and the previous value is applied once the draw is complete.

Source/WebCore:

Test: inspector/canvas/setShaderProgramHighlighted.html

html/canvas/InspectorShaderProgram.h:

(WebCore::InspectorShaderProgram::highlighted):
(WebCore::InspectorShaderProgram::setHighlighted):

html/canvas/WebGLRenderingContextBase.cpp:

(WebCore::InspectorScopedShaderProgramHighlight::InspectorScopedShaderProgramHighlight):
(WebCore::InspectorScopedShaderProgramHighlight::~InspectorScopedShaderProgramHighlight):
(WebCore::InspectorScopedShaderProgramHighlight::showHighlight):
(WebCore::InspectorScopedShaderProgramHighlight::hideHighlight):
(WebCore::InspectorScopedShaderProgramHighlight::saveBlendValue):
(WebCore::InspectorScopedShaderProgramHighlight::hasBufferBinding):
(WebCore::InspectorScopedShaderProgramHighlight::hasFramebufferParameterAttachment):
(WebCore::WebGLRenderingContextBase::drawArrays):
(WebCore::WebGLRenderingContextBase::drawElements):
If the current shader program has been marked as highlighted, apply a blend right before
drawArrays and drawElements is called, tinting the resulting pixels so that they are
visually distinguished from pixels drawn by other shader programs.

inspector/InspectorCanvasAgent.h:
inspector/InspectorCanvasAgent.cpp:

(WebCore::InspectorCanvasAgent::setShaderProgramHighlighted):
(WebCore::InspectorCanvasAgent::isShaderProgramHighlighted):

inspector/InspectorInstrumentation.h:
inspector/InspectorInstrumentation.cpp:

(WebCore::InspectorInstrumentation::isShaderProgramHighlighted):
(WebCore::InspectorInstrumentation::isShaderProgramHighlightedImpl):

Source/WebInspectorUI:

UserInterface/Models/ShaderProgram.js:

(WI.ShaderProgram):
(WI.ShaderProgram.prototype.showHighlight):
(WI.ShaderProgram.prototype.hideHighlight):

UserInterface/Views/ShaderProgramTreeElement.js:

(WI.ShaderProgramTreeElement.prototype.onattach):
(WI.ShaderProgramTreeElement.prototype._handleMouseOver):
(WI.ShaderProgramTreeElement.prototype._handleMouseOut):
Whenever a ShaderProgramTreeElement is hovered, highlight the corresponding shader program
by tinting the pixels it draws via a blend.

LayoutTests:

inspector/canvas/setShaderProgramHighlighted-expected.txt: Added.
inspector/canvas/setShaderProgramHighlighted.html: Added.

8:09 PM Changeset in webkit [230126] by Ryan Haddad

2 edits in trunk/Source/WebKit

Unreviewed, rolling out r230125.

Build fix broke more builds.

Reverted changeset:

"Unreviewed build fix, remove unused lambda capture."
https://trac.webkit.org/changeset/230125

7:54 PM Changeset in webkit [230125] by Ryan Haddad

2 edits in trunk/Source/WebKit

Unreviewed build fix, remove unused lambda capture.

NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::retrieveCacheEntry):

5:13 PM Changeset in webkit [230124] by Ryan Haddad

2 edits in trunk/LayoutTests

Skip http/tests/resourceLoadStatistics/prevalent-resource-with-user-interaction-timeout.html
https://bugs.webkit.org/show_bug.cgi?id=178472

Unreviewed test gardening.

platform/mac-wk2/TestExpectations:

5:13 PM Changeset in webkit [230123] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark imported/w3c/web-platform-tests/html/browsers/offline/appcache/workers/appcache-worker.html as flaky.
https://bugs.webkit.org/show_bug.cgi?id=184198

Unreviewed test gardening.

TestExpectations:

5:12 PM Changeset in webkit [230122] by Wenson Hsieh

7 edits in trunk/Source

[Extra zoom mode] Adopt list view controller UI for numeric input types
https://bugs.webkit.org/show_bug.cgi?id=184184
<rdar://problem/37238916>

Reviewed by Timothy Hatcher.

Source/WebCore:

Add a localized string for the OK button shown on number pads in extra zoomed form controls.

English.lproj/Localizable.strings:
platform/LocalizedStrings.cpp:

(WebCore::numberPadOKButtonTitle):

platform/LocalizedStrings.h:

Source/WebKit:

Remove existing logic for presenting a number pad view controller, since number pads will now be handled as a
special case of general text form controls in extra zoom mode.

UIProcess/ios/WKContentViewInteraction.h:
UIProcess/ios/WKContentViewInteraction.mm:

(-[WKContentView presentViewControllerForCurrentAssistedNode]):
(-[WKContentView dismissAllInputViewControllers]):
(-[WKContentView _wheelChangedWithEvent:]):

5:09 PM Changeset in webkit [230121] by mitz@apple.com

28 edits in trunk/Source/WebKit

Update availability annotations to match the macOS 10.13.4 and iOS 11.3 GM SDKs
https://bugs.webkit.org/show_bug.cgi?id=184173

Reviewed by Alex Christensen.

Changed WK_MAC_TBA and WK_IOS_TBA to 10.13.4 and 11.3, respectively, in all declarations that
appear in the GM SDKs.

Shared/API/Cocoa/_WKNSWindowExtras.h:
UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h:
UIProcess/API/Cocoa/WKOpenPanelParameters.h:
UIProcess/API/Cocoa/WKOpenPanelParametersPrivate.h:
UIProcess/API/Cocoa/WKPreferencesPrivate.h:
UIProcess/API/Cocoa/WKProcessPoolPrivate.h:
UIProcess/API/Cocoa/WKUIDelegatePrivate.h:
UIProcess/API/Cocoa/WKViewPrivate.h:
UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
UIProcess/API/Cocoa/WKWebViewPrivate.h:
UIProcess/API/Cocoa/WKWebsiteDataRecord.h:
UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
UIProcess/API/Cocoa/_WKApplicationManifest.h:
UIProcess/API/Cocoa/_WKAttachment.h:
UIProcess/API/Cocoa/_WKAutomationSession.h:
UIProcess/API/Cocoa/_WKAutomationSessionConfiguration.h:
UIProcess/API/Cocoa/_WKDownload.h:
UIProcess/API/Cocoa/_WKDownloadDelegate.h:
UIProcess/API/Cocoa/_WKFocusedElementInfo.h:
UIProcess/API/Cocoa/_WKFullscreenDelegate.h:
UIProcess/API/Cocoa/_WKProcessPoolConfiguration.h:
UIProcess/API/Cocoa/_WKRemoteWebInspectorViewController.h:
UIProcess/API/Cocoa/_WKVisitedLinkStore.h:
UIProcess/API/Cocoa/_WKWebsiteDataStoreConfiguration.h:
UIProcess/API/Cocoa/_WKWebsitePolicies.h:
WebProcess/InjectedBundle/API/Cocoa/WKWebProcessPlugInNodeHandlePrivate.h:
WebProcess/InjectedBundle/API/mac/WKDOMDocument.h:

4:57 PM Changeset in webkit [230120] by rniwa@webkit.org

5 edits in trunk

Copying a list from Microsoft Word to TinyMCE fails when mso-list is the first property
https://bugs.webkit.org/show_bug.cgi?id=182938
<rdar://problem/37683007>

Reviewed by Wenson Hsieh.

Source/WebCore:

Made the logic to detect Microsoft Word's mso-list CSS property more generic by detecting
inline styles which start with "mso-list:" and one which line-break right before it: "\nmso-list:"

Tests: PasteHTML.PreservesMSOList

editing/markup.cpp:

(WebCore::StyledMarkupAccumulator::shouldPreserveMSOListStyleForElement):

Tools:

Added more assertions to PasteHTML.PreservesMSOList for preserving an inline style which starts with mso-list
or the one which line-breaks right before it.

TestWebKitAPI/Tests/WebKitCocoa/PasteHTML.mm:
TestWebKitAPI/Tests/WebKitCocoa/mso-list.html:

4:12 PM Changeset in webkit [230119] by jfbastien@apple.com

5 edits
1 add in trunk

WebAssembly compilation from DataView

2:50 PM Changeset in webkit [230118] by youenn@apple.com

5 edits
5 adds in trunk

NetworkLoadChecker should upgrade redirects if needed
https://bugs.webkit.org/show_bug.cgi?id=184098

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

web-platform-tests/beacon/resources/beacon-preflight.py: Added.
web-platform-tests/beacon/resources/redirect.py: Added.
web-platform-tests/beacon/resources/upgrade-iframe.html: Added.
web-platform-tests/beacon/resources/upgrade-redirect-iframe.html: Added.
web-platform-tests/beacon/upgrade-beacon.https-expected.txt: Added.
web-platform-tests/beacon/upgrade-beacon.https.html: Added.

Source/WebCore:

Test: imported/w3c/web-platform-tests/beacon/upgrade-beacon.https.html

page/csp/ContentSecurityPolicy.h:

Source/WebKit:

In case of redirections, upgrade URL according CSP.

NetworkProcess/NetworkLoadChecker.cpp:

(WebKit::NetworkLoadChecker::checkRequest):
(WebKit::NetworkLoadChecker::contentSecurityPolicy const):

2:01 PM Changeset in webkit [230117] by dbates@webkit.org

5 edits
2 adds in trunk

ASSERTION FAILED: ASSERT(!containsImage

MIMETypeRegistry::isSupportedImageResourceMIMEType([resource MIMEType])) in -[NSPasteboard(WebExtras) _web_writePromisedRTFDFromArchive:containsImage:]

https://bugs.webkit.org/show_bug.cgi?id=184161

Reviewed by Per Arne Vollan.

ManualTests/DragInlinePDFImageDocument.html: Added.
ManualTests/resources/simple.pdf: Added.

Source/WebCore:

Fixes an assertion failure when quiting an app that uses a Legacy WebKit web view
after dragging-and-dropping a PDF embedded using an HTML image element into the
same web view.

When performing a drag-and-drop of a PDF document image (WebCore::PDFDocumentImage) we create a WebArchive
from the main frame's WebHTMLView and promise AppKit that will provide a Rich Text Format (RTF) document
from this archive if needed. For some reason, on app termination AppKit requests that the WebHTMLView
fullfill its RTF document promise for the WebArchive created at the start of the drag operation. WebKit
expects that the created WebArchive is either for an inline image (e.g. <img>) or an image document that
has a supported image resource MIME type (by querying MIMETypeRegistry::isSupportedImageResourceMIMEType())
and checks for these cases in this order. PDF/PostScript are not listed in the set of supported image
resource MIME types. So, the first check fails and WebKit assumes that the WebArchive was created from
an image document of a supported image resource MIME type. However, the WebArchive was created from a
WebHTMLView and has MIME type text/html. Therefore the assertion fails. We need to add PDF and PostScript
to the set of supported image resource MIME types so that WebKit does not fall back to the WebHTMLView
code path. Historically, PDF and PostScript were in the set supported image resource MIME types. Over time
the set of MIME types for image resouces (images loaded as a document) became identical to the set of MIME
types for images loaded inline (e.g. <img>) and this set omitted the MIME types for PDF and PostScript.

Additionally it is sufficient to implement MIMETypeRegistry::isSupportedImageResourceMIMEType() in terms
of MIMETypeRegistry::isSupportedImageMIMEType() and MIMETypeRegistry::isPDFOrPostScriptMIMEType() instead
of allocating a dedicated HashSet for the supported image resource MIME types (as we currently do).

dom/DOMImplementation.cpp:

(WebCore::DOMImplementation::createDocument): Assert that PDF is a supported image MIME type before
instantiating an ImageDocument.

platform/MIMETypeRegistry.cpp:

(WebCore::initializeSupportedImageMIMETypes): Remove unnecessary allocation of a HashSet for the support
image resource MIME types.
(WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType): Write in terms of MIMETypeRegistry::isSupportedImageMIMEType()
and MIMETypeRegistry::isPDFOrPostScriptMIMEType().
(WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes): Deleted.

platform/MIMETypeRegistry.h:

1:46 PM Changeset in webkit [230116] by jfbastien@apple.com

2 edits in trunk/Source/WTF

WorkQueueWin: don't move rvalues
https://bugs.webkit.org/show_bug.cgi?id=184190
<rdar://problem/39049850>

Reviewed by Mark Lam.

As part of #184167 optional is now more frequently an rvalue
reference, and moving its .value() is not a thing that should be
done anymore.

wtf/win/WorkQueueWin.cpp:

(WTF::WorkQueue::unregisterAndCloseHandle):

1:31 PM Changeset in webkit [230115] by fpizlo@apple.com

3 edits
1 add in trunk

Bytecode generator should not get_from_scope something that may be a hole into a variable that is already live
https://bugs.webkit.org/show_bug.cgi?id=184189

Reviewed by JF Bastien.

JSTests:

stress/load-hole-from-scope-into-live-var.js: Added.

(result.eval.try.switch):
(catch):

Source/JavaScriptCore:

bytecompiler/NodesCodegen.cpp:

(JSC::ResolveNode::emitBytecode):

1:25 PM Changeset in webkit [230114] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark inspector/unit-tests/debounce.html as flaky.
https://bugs.webkit.org/show_bug.cgi?id=184057

Unreviewed test gardening.

platform/mac/TestExpectations:

12:16 PM Changeset in webkit [230113] by jfbastien@apple.com

8 edits in trunk/Source

Remove CXX_REFERENCE_QUALIFIED_FUNCTIONS and optional's equivalent
https://bugs.webkit.org/show_bug.cgi?id=184167
<rdar://problem/39023130>

Reviewed by Yusuke Suzuki.

Remove COMPILER_SUPPORTS(CXX_REFERENCE_QUALIFIED_FUNCTIONS), it's
supported by all compilers WebKit supports (it's a C++11 feature,
*detection* of it with has_extension was added to clang on May
13th 2011, and VS2015 / GCC support it).

Optional.h had a similar thing, ditch it too.

wtf/Compiler.h:
wtf/Optional.h:

(std::optional::contained_val const):
(std::optional::contained_val):

wtf/Ref.h:
wtf/RefPtr.h:
wtf/text/WTFString.cpp:
wtf/text/WTFString.h:

11:45 AM Changeset in webkit [230112] by graouts@webkit.org

7 edits in trunk

[Web Animations] CSSTransition objects should have fill: backwards to allow seeking prior to start time
https://bugs.webkit.org/show_bug.cgi?id=184129

Reviewed by Dean Jackson.

Source/WebCore:

In order to allow a CSS Transition to be seeked prior to its start time, it needs to have its fill mode set
to backwards. Adding code to set the fill mode in CSSTransition::initialize() yields early timing model
invalidation and we could get in a situation where stylesWouldYieldNewCSSTransitionsBlendingKeyframes()
was called before we had a chance to create blending keyframes for a CSS transitions, since the call
to create blending keyframes is made after the call to initialize(), so we now cater for this case.

animation/CSSTransition.cpp:

(WebCore::CSSTransition::initialize):

animation/CSSTransition.h:
animation/KeyframeEffectReadOnly.cpp:

(WebCore::KeyframeEffectReadOnly::stylesWouldYieldNewCSSTransitionsBlendingKeyframes const):

LayoutTests:

Make one test opt into CSS Animations and CSS Transitions as Web Animations and fix expectations for a CSSTransition
test which mistakenly assumes the fill to be "none".

transitions/transition-in-delay-phase.html:
webanimations/css-transitions.html:

10:46 AM Changeset in webkit [230111] by jmarcell@apple.com

7 edits in tags/Safari-606.1.11.1/Source

Versioning.

10:41 AM Changeset in webkit [230110] by jmarcell@apple.com

1 copy in tags/Safari-606.1.11.1

New tag.

10:36 AM Changeset in webkit [230109] by jfbastien@apple.com

2 edits in trunk/Source/WTF

Introduce WTF_LAZY_INSTANTIATE
https://bugs.webkit.org/show_bug.cgi?id=184169
<rdar://problem/39023385>

Reviewed by Mark Lam.

As part of #184164 I'm adding some forwarding methods to
WTF::String. These need to forward RetainPtr and CString, and
usually that would require #include'ing RetainPtr.h and CString.h
to WTFString.h which isn't really something we should do.

Introduce WTF_LAZY_INSTANTIATE to forward-declare functions which
just pass parameters to another function, and return whatever that
other function returned, without having to include the return's /
parameters' type header.

Try it out here: godbolt.org/g/oV8G5Q

wtf/Forward.h:

10:30 AM Changeset in webkit [230108] by jfbastien@apple.com

7 edits in trunk/Source/WebKit

Update messages.py codegen for String, fix tests
https://bugs.webkit.org/show_bug.cgi?id=184179
<rdar://problem/39041352>

Reviewed by Mark Lam.

I updated some of the code in
https://trac.webkit.org/changeset/230097 and auto-magically used a
script to update copyright headers... and that broke the tests
which checked for a particular date. Update all of the headers.

Part of this change updates the code generated by messages.py

Scripts/webkit/LegacyMessageReceiver-expected.cpp:
Scripts/webkit/MessageReceiver-expected.cpp:
Scripts/webkit/MessageReceiverSuperclass-expected.cpp:
Scripts/webkit/MessagesSuperclass-expected.h:
Scripts/webkit/messages.py:
Scripts/webkit/messages_unittest.py:

(GeneratedFileContentsTest.assertGeneratedFileContentsEqual):
generate a better error message

9:55 AM Changeset in webkit [230107] by dbates@webkit.org

3 edits in trunk/Source/WebCore

Remove unused MIMETypeRegistry::getSupportedImageMIMETypesForEncoding()
https://bugs.webkit.org/show_bug.cgi?id=184154

Reviewed by Per Arne Vollan.

platform/MIMETypeRegistry.cpp:

(WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding): Deleted.

platform/MIMETypeRegistry.h:

9:31 AM Changeset in webkit [230106] by mark.lam@apple.com

12 edits in trunk/Source/JavaScriptCore

Add pointer profiling support to Wasm.
https://bugs.webkit.org/show_bug.cgi?id=184175
<rdar://problem/39027923>

Reviewed by JF Bastien.

runtime/PtrTag.h:
wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::addGrowMemory):
(JSC::Wasm::B3IRGenerator::addCall):
(JSC::Wasm::B3IRGenerator::addCallIndirect):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I32Popcnt>):
(JSC::Wasm::B3IRGenerator::addOp<OpType::I64Popcnt>):

wasm/WasmBBQPlan.cpp:

(JSC::Wasm::BBQPlan::prepare):
(JSC::Wasm::BBQPlan::complete):

wasm/WasmBinding.cpp:

(JSC::Wasm::wasmToWasm):

wasm/WasmBinding.h:
wasm/WasmFaultSignalHandler.cpp:

(JSC::Wasm::trapHandler):

wasm/WasmOMGPlan.cpp:

(JSC::Wasm::OMGPlan::work):

wasm/WasmThunks.cpp:

(JSC::Wasm::throwExceptionFromWasmThunkGenerator):
(JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
(JSC::Wasm::triggerOMGTierUpThunkGenerator):

wasm/js/WasmToJS.cpp:

(JSC::Wasm::handleBadI64Use):
(JSC::Wasm::wasmToJS):

wasm/js/WebAssemblyFunction.cpp:

(JSC::callWebAssemblyFunction):

wasm/js/WebAssemblyFunction.h:

9:05 AM Changeset in webkit [230105] by Ryan Haddad

28 edits
2 copies
2 deletes in trunk

Unreviewed, rolling out r230102.

Caused assertion failures on JSC bots.

Reverted changeset:

"A stack overflow in the parsing of a builtin (called by
createExecutable) cause a crash instead of a catchable js
exception"
https://bugs.webkit.org/show_bug.cgi?id=184074
https://trac.webkit.org/changeset/230102

9:00 AM Changeset in webkit [230104] by Ryan Haddad

2 edits in trunk/LayoutTests

Mark imported/w3c/web-platform-tests/IndexedDB/idbobjectstore_createIndex7-event_order.htm as flaky.
https://bugs.webkit.org/show_bug.cgi?id=184116

Unreviewed test gardening.

platform/mac/TestExpectations:

7:03 AM Changeset in webkit [230103] by rmorisset@apple.com

3 edits
1 add in trunk

Inlining of a function that ends in op_unreachable in a non-tail position triggers an ASSERT
https://bugs.webkit.org/show_bug.cgi?id=183812

Reviewed by Keith Miller.

JSTests:

stress/inlining-unreachable-non-tail.js: Added.

(foo.):
(foo):

Source/JavaScriptCore:

The fix I landed for https://bugs.webkit.org/show_bug.cgi?id=181027 was flawed: I tried setting the bytecodeIndex for the new block on line 1679 (at the end of inlineCall), but it is going to be reset on line 6612 (in parseCodeBlock).
The fix is simply to make the block untargetable by default, and let parseCodeBlock make it targetable afterwards if it is a jump target.

dfg/DFGByteCodeParser.cpp:

(JSC::DFG::ByteCodeParser::allocateTargetableBlock):
(JSC::DFG::ByteCodeParser::inlineCall):

5:39 AM Changeset in webkit [230102] by rmorisset@apple.com

28 edits
1 copy
1 add
2 deletes in trunk

A stack overflow in the parsing of a builtin (called by createExecutable) cause a crash instead of a catchable js exception
https://bugs.webkit.org/show_bug.cgi?id=184074
<rdar://problem/37165897>

Reviewed by Keith Miller.

JSTests:

stress/stack-overflow-while-parsing-builtin.js: Added.

(f):

Source/JavaScriptCore:

Fixing this requires getting the ParserError (with information about the failure) and an ExecState* (to throw an exception) in the same place.
It is surprisingly painful, with quite a long call stack between the last function with an access to an ExecState* and the first function with the ParserError.
Even worse, many of these functions are generated by macros, themselves generated by a maze of python scripts.
As a result, this patch is grotesquely large, while all it does is adding enough plumbing to throw a proper exception in this specific case.

There are now bare calls to '.value()' on several paths that may crash. It is not a problem in my opinion, since we previously crashed in every case regardless of the path that took us to createExecutable when encountering a stack overflow.
If we ever find an example that can cause these calls to fail, it should be doable to throw a proper exception there too.

Two other minor changes:

I removed BuiltinExecutableCreator.{cpp, h} as it was nearly empty, and only used in one place. That place now includes BuiltinExecutables.h directly instead.
I moved code from ParserError.h into a newly created ParserError.cpp, as I see no need to inline functions that are only used when encountering a parser error, and ParserError.h is now included in quite a few places.

JavaScriptCore.xcodeproj/project.pbxproj:
Scripts/builtins/builtins_generate_combined_header.py:

(BuiltinsCombinedHeaderGenerator.generate_forward_declarations):
(ParserError):
(generate_section_for_object): Deleted.
(generate_externs_for_object): Deleted.
(generate_macros_for_object): Deleted.
(generate_section_for_code_table_macro): Deleted.
(generate_section_for_code_name_macro): Deleted.
(generate_section_for_global_private_code_name_macro): Deleted.

Scripts/builtins/builtins_generate_separate_header.py:

(generate_secondary_header_includes):

Scripts/builtins/builtins_templates.py:
Sources.txt:
builtins/BuiltinExecutableCreator.cpp: Removed.
builtins/BuiltinExecutableCreator.h: Removed.
builtins/BuiltinExecutables.cpp:

(JSC::BuiltinExecutables::createDefaultConstructor):
(JSC::BuiltinExecutables::createBuiltinExecutable):
(JSC::createBuiltinExecutable):
(JSC::BuiltinExecutables::createExecutableOrCrash):
(JSC::BuiltinExecutables::createExecutable):

builtins/BuiltinExecutables.h:
bytecompiler/BytecodeGenerator.h:
parser/ParserError.cpp: Added.

(JSC::ParserError::toErrorObject):
(JSC::ParserError::throwStackOverflowOrOutOfMemory):
(WTF::printInternal):

parser/ParserError.h:

(JSC::ParserError::toErrorObject): Deleted.
(WTF::printInternal): Deleted.

runtime/AsyncIteratorPrototype.cpp:

(JSC::AsyncIteratorPrototype::finishCreation):

runtime/FunctionPrototype.cpp:

(JSC::FunctionPrototype::addFunctionProperties):

runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::init):

runtime/JSObject.cpp:

(JSC::JSObject::getOwnStaticPropertySlot):
(JSC::JSObject::reifyAllStaticProperties):

runtime/JSObject.h:

(JSC::JSObject::getOwnNonIndexPropertySlot):
(JSC::JSObject::getOwnPropertySlot):
(JSC::JSObject::getPropertySlot):

runtime/JSObjectInlines.h:

(JSC::JSObject::getNonIndexPropertySlot):

runtime/JSTypedArrayViewPrototype.cpp:

(JSC::JSTypedArrayViewPrototype::finishCreation):

runtime/Lookup.cpp:

(JSC::reifyStaticAccessor):
(JSC::setUpStaticFunctionSlot):

runtime/Lookup.h:

(JSC::getStaticPropertySlotFromTable):
(JSC::reifyStaticProperty):

runtime/MapPrototype.cpp:

(JSC::MapPrototype::finishCreation):

runtime/SetPrototype.cpp:

(JSC::SetPrototype::finishCreation):

tools/JSDollarVM.cpp:

(JSC::functionCreateBuiltin):

Source/WebCore:

I had to slightly change the type of some bindings between JSC and WebCore. No functional change intended on the WebCore side.

bindings/js/JSReadableStreamPrivateConstructors.cpp:

(WebCore::JSBuiltinReadableStreamDefaultReaderPrivateConstructor::initializeExecutable):
(WebCore::JSBuiltinReadableStreamDefaultControllerPrivateConstructor::initializeExecutable):
(WebCore::JSBuiltinReadableByteStreamControllerPrivateConstructor::initializeExecutable):
(WebCore::JSBuiltinReadableStreamBYOBReaderPrivateConstructor::initializeExecutable):
(WebCore::JSBuiltinReadableStreamBYOBRequestPrivateConstructor::initializeExecutable):

bindings/scripts/CodeGeneratorJS.pm:

(GenerateConstructorHelperMethods):

bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:

(WebCore::JSTestClassWithJSBuiltinConstructorConstructor::initializeExecutable):

bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:

(WebCore::JSTestJSBuiltinConstructorConstructor::initializeExecutable):

5:05 AM Changeset in webkit [230101] by rmorisset@apple.com

5 edits
1 add in trunk

Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
https://bugs.webkit.org/show_bug.cgi?id=183657
JSTests:

Reviewed by Keith Miller.

stress/large-unshift-splice.js: Added.

(make_contig_arr):

Source/JavaScriptCore:

<rdar://problem/38464399>

Reviewed by Keith Miller.

There was just a missing check in unshiftCountForIndexingType.
I've also replaced 'return false' by 'return true' in the case of an 'out-of-memory' exception, because 'return false' means 'please continue to the slow path',
and the slow path has an assert that there is no unhandled exception (line 360 of ArrayPrototype.cpp).
Finally, I made the assert in ensureLength a release assert as it would have caught this bug and prevented it from being a security risk.

runtime/ArrayPrototype.cpp:

(JSC::unshift):

runtime/JSArray.cpp:

(JSC::JSArray::unshiftCountWithAnyIndexingType):

runtime/JSObject.h:

(JSC::JSObject::ensureLength):

Note: See TracTimeline for information about the timeline view.

Download in other formats:

RSS Feed