2016-03-09  Chris Dumez  <cdumez@apple.com>

        focus() / blur() should be on HTMLElement / SVGElement, not Element
        https://bugs.webkit.org/show_bug.cgi?id=155216

        Reviewed by Darin Adler.

        focus() / blur() should be on HTMLElement / SVGElement, not Element:
        - https://html.spec.whatwg.org/multipage/dom.html#htmlelement
        - https://www.w3.org/TR/SVG2/types.html#InterfaceSVGElement

        Chrome and Firefox match the specification.

        Note that after this change, focus() / blur() is no longer exposed
        on MathMLElement. This matches the MathML specification and is
        consistent with Firefox and Chrome.

        * dom/Element.idl:
        * html/HTMLElement.idl:
        * svg/SVGElement.idl:

2016-03-09  Chris Dumez  <cdumez@apple.com>

        Move attributes to the instance for most interfaces that have "Error" in their name
        https://bugs.webkit.org/show_bug.cgi?id=155231

        Reviewed by Darin Adler.

        Our bindings generator was keeping attributes on the instances for
        interfaces having "Error" or "Exception" in their name. The reason is
        that interfaces that have "Error" in their prototype would not behave
        correctly otherwise because "Error" incorrectly has its attributes on
        the instance at the moment. However, in our bindings generator, the
        condition to decide if an interface's prototype should be "Error" is
        if $interface->isException. Therefore, we should use the same condition
        to decide if we should keep attributes on the instance until "Error"
        is updated to have its attributes on the prototype. Doing this for any
        interface having "Error" or "Exception" in their name is overkill.

        No new tests, already covered by existing test.

        * bindings/scripts/CodeGeneratorJS.pm:
        (InterfaceRequiresAttributesOnInstance):

2016-03-09  Daniel Bates  <dabates@apple.com>

        Rename WebCore/platform/crypto/mac/CryptoDigestMac.cpp to WebCore/platform/crypto/commoncrypto/CryptoDigestCommonCrypto.cpp
        https://bugs.webkit.org/show_bug.cgi?id=155244

        Reviewed by Alexey Proskuryakov.

        The file WebCore/platform/crypto/mac/CryptoDigestMac.cpp is applicable to both iOS and OS X.
        We should move and rename this file to reflect that is applicable to both of these platforms.

        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/crypto/commoncrypto/CryptoDigestCommonCrypto.cpp: Renamed from Source/WebCore/platform/crypto/mac/CryptoDigestMac.cpp.

2016-03-09  Tim Horton  <timothy_horton@apple.com>

        Removing and re-adding a script message handler with the same name results in an unusable message handler
        https://bugs.webkit.org/show_bug.cgi?id=155223

        Reviewed by Sam Weinig.
        Patch by Geoff Garen and myself.

        New API test: WKUserContentController.ScriptMessageHandlerReplaceWithSameName.

        * page/UserMessageHandler.h:
        (WebCore::UserMessageHandler::descriptor):
        * page/UserMessageHandlersNamespace.cpp:
        (WebCore::UserMessageHandlersNamespace::handler):
        This lazy removal mechanism combined with the fact that we only compare
        handler name and world makes it such that m_messageHandlers could have
        a stale UserMessageHandler with a UserMessageHandlerDescriptor that differed
        only in client.

        It is safe to compare the descriptors by pointer instead because m_messageHandler
        holds a strong reference to its UserMessageHandlerDescriptors, and this will ensure
        that the add-remove-add path (with identical name and world) causes a new
        UserContentController to be created.

        We also now clean up any stale UserMessageHandlers whenever we're about to
        add a new one, by removing any which the UserContentController no longer knows about.

2016-03-09  Chris Dumez  <cdumez@apple.com>

        Align HTMLKeygenElement.keytype with the specification
        https://bugs.webkit.org/show_bug.cgi?id=155214

        Reviewed by Darin Adler.

        Align HTMLKeygenElement.keytype with the specification:
        - https://html.spec.whatwg.org/#dom-keygen-keytype
        - https://html.spec.whatwg.org/#attr-keygen-keytype

        In particular, the following changes were made:
        1. Return "rsa" by default (i.e. when the corresponding content attribute is missing)
        2. Only return known values

        Test: fast/dom/HTMLKeygenElement/keygen-keytype.html

        * html/HTMLKeygenElement.cpp:
        (WebCore::HTMLKeygenElement::setKeytype):
        (WebCore::HTMLKeygenElement::keytype):
        (WebCore::HTMLKeygenElement::appendFormData):
        * html/HTMLKeygenElement.h:
        * html/HTMLKeygenElement.idl:

2016-03-09  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] Fix MediaPlayerPrivate conflicts
        https://bugs.webkit.org/show_bug.cgi?id=155236

        Reviewed by Martin Robinson.

        In some cases the mediastream player would be used to play
        non-mediastream videos or MSE streams. The OWR player should be
        used only for mediastreams and the MediaPlayerPrivateGStreamer
        player should be used only for normal <video> elements and
        MediaSource support.

        This patch intends to fix the massive tests timeouts currently
        happening on the GTK bots after r197752.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::supportsType): Bail out if
        the type checked represents a mediastream.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        Prevent signal disconnection on possible NULL GObjects.
        (WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:
        (WebCore::MediaPlayerPrivateGStreamerOwr::MediaPlayerPrivateGStreamerOwr):
        Simplify constructor to the bare minimum.
        (WebCore::MediaPlayerPrivateGStreamerOwr::load): Create sinks only
        if needed from the load method.
        (WebCore::MediaPlayerPrivateGStreamerOwr::getSupportedTypes):
        Initialize the type cache to an empty static hashset.
        (WebCore::MediaPlayerPrivateGStreamerOwr::supportsType): This
        player does support mediastreams and nothing else.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h:

2016-03-08  Brent Fulgham  <bfulgham@apple.com>

        Local HTML should be blocked from localStorage access unless "Disable Local File Restrictions" is checked..
        https://bugs.webkit.org/show_bug.cgi?id=155185
        <rdar://problem/11101440>

        Reviewed by Zalan Bujtas.

        Tested by storage/domstorage/localstorage/blocked-file-access.html.

        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canAccessStorage): If the origin is a local file, and we have not been granted
        universal file access, prevent access to DOM localStorage.

2016-03-09  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Allow to place positioned grid items on the padding
        https://bugs.webkit.org/show_bug.cgi?id=155199

        Reviewed by Sergio Villar Senin.

        According to the following discussion on the CSS WG mailing list,
        we should be able to place positioned grid items on the padding directly:
        https://lists.w3.org/Archives/Public/www-style/2015Nov/0070.html

        This means that a positioned grid item can be placed on the padding itself.
        The "auto" value resolves to the padding edges (0th and -0th lines).
        So if a positioned item is placed with: grid-column: auto / 1;
        it'd be placed on the padding, from line 0th to 1st line.

        On top of that, we've to detect properly the first and last explicit
        grid lines during the layout of positioned grid items.
        We have to consider that the grid can have implicit tracks created
        previously by regular grid items.

        Tests: fast/css-grid-layout/grid-positioned-items-padding.html
               fast/css-grid-layout/grid-positioned-items-within-grid-implicit-track.html

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):

2016-03-09  Andreas Kling  <akling@apple.com>

        ImageDocuments leak their world.
        <https://webkit.org/b/155167>
        <rdar://problem/24987363>

        Reviewed by Antti Koivisto.

        ImageDocument uses a special code path in ImageLoader in order to manually
        control how the image is loaded. It has to do this because the ImageDocument
        is really just a synthetic wrapper around a main resource that's an image.

        This custom loading code had a bug where it would create a new CachedImage
        and neglect to set its CachedResource::m_state flag to Pending (which is
        normally set by CachedResource::load(), but we don't call that for these.)

        This meant that when ImageDocument called CachedImage::finishLoading() to
        trigger the notifyFinished() callback path, the image would look at its
        loading state and see that it was Unknown (not Pending), and conclude that
        it hadn't loaded yet. So we never got the notifyFinished() signal.

        The world leaks here because ImageLoader slaps a ref on its <img> element
        while it waits for the loading operation to complete. Once finished, whether
        successfully or with an error, it derefs the <img>.

        Since we never fired notifyFinished(), we ended up with an extra ref on
        these <img> forever, and then the element kept its document alive too.

        Test: fast/dom/ImageDocument-world-leak.html

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):

2016-03-08  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Fix auto-track sizing with min-size:auto and specific sizes
        https://bugs.webkit.org/show_bug.cgi?id=155165

        Reviewed by Darin Adler.

        Specs recently changed the way auto tracks are sized. In the
        previous versions, when sizing auto minimums, only the
        min-width|height of the items spanning through the auto tracks
        were used to size them. The new text specifies that for items
        with a specified minimum size of auto, the behavior is
        equivalent to a min-content minimum.

        This means that from now on, auto tracks with min-size:auto
        will no longer be smaller than min-content tracks (which was
        pretty weird from the user POV).

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::minSizeForChild): use grid items
        min-content contributions whenever the specified size is not
        auto or when min-size is auto.

2016-03-09  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Initial support for implicit grid before explicit grid
        https://bugs.webkit.org/show_bug.cgi?id=155014

        Reviewed by Darin Adler.

        Change GridSpan to store int instead of unsigned. This allows us to
        resolve positions before the explicit grid with negative values.

        This patch adds a new type of GridSpan called "Untranslated".
        This type is only used in populateExplicitGridAndOrderIterator().
        Where we store the smallest negative position in both axis.

        Then the GridSpans are translated into positive values, using the offset
        calculated before. This is done in placeItemsOnGrid() and from that
        moment the rest of the code uses "Definite" GridSpans, which returns
        only positive positions (unsigned instead of int).
        This allows us to don't have to modify the rest of the code, as it keeps
        using GridSpans as before.

        Let's use an example to explain how it works. Imagine that we've a 2
        columns grid and 2 items placed like:
        * Item A: grid-column: -5;
        * Item B: grid-column: 1;

        Initially we'll use "Unstranslated" GridSpans with the following values:
        * Item A: GridSpan(-2, -1)
        * Item B: GridSpan(0, 1)

        Then we'll translate them using the smallest position as offset (-2)
        so we've "Definite" GridSpans:
        * Item A: GridSpan(0, 1)
        * Item B: GridSpan(2, 3)

        Test: fast/css-grid-layout/implicit-tracks-before-explicit.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::gridTrackSize):
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::placeAutoMajorAxisItemsOnGrid): Deleted.
        (WebCore::RenderGrid::layoutPositionedObject): Deleted.
        * rendering/RenderGrid.h:
        * rendering/style/GridCoordinate.h:
        (WebCore::GridSpan::untranslatedDefiniteGridSpan):
        (WebCore::GridSpan::translatedDefiniteGridSpan):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::untranslatedResolvedInitialPosition):
        (WebCore::GridSpan::untranslatedResolvedFinalPosition):
        (WebCore::GridSpan::resolvedInitialPosition):
        (WebCore::GridSpan::resolvedFinalPosition):
        (WebCore::GridSpan::begin):
        (WebCore::GridSpan::end):
        (WebCore::GridSpan::isTranslatedDefinite):
        (WebCore::GridSpan::isIndefinite):
        (WebCore::GridSpan::translate):
        (WebCore::GridSpan::GridSpan):
        (WebCore::GridSpan::operator==): Deleted.
        (WebCore::GridSpan::GridSpanIterator::GridSpanIterator): Deleted.
        (WebCore::GridSpan::GridSpanIterator::operator unsigned&): Deleted.
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::resolveGridPositionFromStyle):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
        (WebCore::GridResolvedPosition::spanSizeForAutoPlacedItem): Deleted.

2016-03-09  Myles C. Maxfield  <mmaxfield@apple.com>

        [iOS] Arabic text on Wikipedia is shown as boxes
        https://bugs.webkit.org/show_bug.cgi?id=155129
        <rdar://problem/24919902>

        Reviewed by Darin Adler.

        GeezaPro is the PostScript name, not the family name.

        Test: fast/text/arabic-blacklisted.html

        * platform/graphics/ios/FontCacheIOS.mm:
        (WebCore::platformLookupFallbackFont):

2016-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197825.
        https://bugs.webkit.org/show_bug.cgi?id=155222

        It broke the EFL build. It is not dead code. (Requested by
        gyuyoung on #webkit).

        Reverted changeset:

        "Delete dead scrolling code"
        https://bugs.webkit.org/show_bug.cgi?id=155210
        http://trac.webkit.org/changeset/197825

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Element with maximum tabIndex cannot be returned by nextElementWithGreaterTabIndex()
        https://bugs.webkit.org/show_bug.cgi?id=155215

        Reviewed by Ryosuke Niwa.

        Element with maximum tabIndex cannot be returned by nextElementWithGreaterTabIndex()
        due to a bug in r197726. This patch fixes the issue by only comparing
        candidate.tabIndex to winningTabIndex if winner is non-null.

        Test: fast/events/max-tabindex-focus.html

        * page/FocusController.cpp:
        (WebCore::nextElementWithGreaterTabIndex):

2016-03-08  Sam Weinig  <sam@webkit.org>

        Stop using the UserContentController for injecting the override style sheet from CaptionUserPreferences
        https://bugs.webkit.org/show_bug.cgi?id=155211

        Reviewed by Dan Bernstein.

        The UserContentController is going to become read only from WebCore's perspective. The CaptionUserPreferences
        was relying on being able to set a UserStyleSheet on it, but this was really unnecessary complexity. Simplify
        things by storing the style sheet's source directly on the Page and teaching ExtensionStyleSheets about it
        explicitly.

        * dom/ExtensionStyleSheets.cpp:
        (WebCore::ExtensionStyleSheets::updateInjectedStyleSheetCache):
        If there is a captionUserPreferencesStyleSheet on the page, inject it.

        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::updateCaptionStyleSheetOveride):
        Greatly simplify the code. Now, all this does is set the style sheet on each page.

        * page/Page.cpp:
        (WebCore::Page::invalidateInjectedStyleSheetCacheInAllFrames):
        Extract this out from UserContentController.

        (WebCore::Page::setUserContentController):
        Call the newly extracted invalidateInjectedStyleSheetCacheInAllFrames().

        (WebCore::Page::captionUserPreferencesStyleSheet):
        (WebCore::Page::setCaptionUserPreferencesStyleSheet):
        Add getter/setter. When setting, invalidate the style sheet cache.

        * page/Page.h:
        Add new members and functions.

        * page/UserContentController.cpp:
        (WebCore::UserContentController::addUserStyleSheet):
        (WebCore::UserContentController::removeUserStyleSheet):
        (WebCore::UserContentController::removeUserStyleSheets):
        (WebCore::UserContentController::removeAllUserContent):
        Switch to calling invalidateInjectedStyleSheetCacheInAllFramesInAllPages().

        (WebCore::UserContentController::invalidateInjectedStyleSheetCacheInAllFramesInAllPages):
        Rename and implement in terms of Page::invalidateInjectedStyleSheetCacheInAllFrames().

        * page/UserContentController.h:
        Rename function.

2016-03-08  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Memory Timeline should show MemoryPressure events
        https://bugs.webkit.org/show_bug.cgi?id=155158
        <rdar://problem/25026610>

        Reviewed by Brian Burg.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseMemory):
        When responding to memory pressure, notify page inspectors.

        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        Remove unused includes.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::didHandleMemoryPressureImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::playbackStarted):
        (WebCore::InspectorInstrumentation::playbackPaused):
        (WebCore::InspectorInstrumentation::playbackFinished):
        (WebCore::InspectorInstrumentation::playbackHitPosition):
        (WebCore::InspectorInstrumentation::didHandleMemoryPressure):
        * inspector/InspectorMemoryAgent.cpp:
        (WebCore::InspectorMemoryAgent::didCreateFrontendAndBackend):
        (WebCore::InspectorMemoryAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorMemoryAgent::enable):
        (WebCore::InspectorMemoryAgent::disable):
        (WebCore::InspectorMemoryAgent::didHandleMemoryPressure):
        * inspector/InspectorMemoryAgent.h:
        * inspector/InstrumentingAgents.cpp:
        (WebCore::InstrumentingAgents::reset):
        * inspector/InstrumentingAgents.h:
        (WebCore::InstrumentingAgents::inspectorMemoryAgent):
        (WebCore::InstrumentingAgents::setInspectorMemoryAgent):
        Plumbing to notify the right active inspector.

2016-03-08  Myles C. Maxfield  <mmaxfield@apple.com>

        Delete dead scrolling code
        https://bugs.webkit.org/show_bug.cgi?id=155210

        Reviewed by Simon Fraser.

        No new tests because there is no behavior change.

        * page/FrameView.cpp:
        (WebCore::FrameView::layerForScrolling): Deleted.
        * page/FrameView.h:
        * page/scrolling/ScrollingCoordinator.cpp:
        (WebCore::ScrollingCoordinator::scrollLayerForScrollableArea): Deleted.
        * page/scrolling/ScrollingCoordinator.h:
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::horizontalScrollbar):
        (WebCore::ScrollableArea::verticalScrollbar):
        (WebCore::ScrollableArea::tiledBacking):
        (WebCore::ScrollableArea::layerForHorizontalScrollbar):
        (WebCore::ScrollableArea::layerForVerticalScrollbar):
        (WebCore::ScrollableArea::layerForScrollCorner):
        (WebCore::ScrollableArea::layerForOverhangAreas):
        (WebCore::ScrollableArea::layerForScrolling): Deleted.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects): Deleted.
        * rendering/RenderLayer.h:

2016-03-08  Oliver Hunt  <oliver@apple.com>

        Start moving to separated writable and executable mappings in the JIT
        https://bugs.webkit.org/show_bug.cgi?id=155178

        Reviewed by Fil Pizlo.

        Update feature defines.

        * Configurations/FeatureDefines.xcconfig:

2016-03-08  Myles C. Maxfield  <mmaxfield@apple.com>

        Font size computed style is innaccurate
        https://bugs.webkit.org/show_bug.cgi?id=154705
        <rdar://problem/23474068>

        Reviewed by Timothy Hatcher.

        Safari rounds the font size value reported to getComputedStyle(). Neither Firefox
        nor Chrome do this.

        Covered by existing tests.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
        (WebCore::fontSizeFromStyle):

2016-03-08  Ada Chan  <adachan@apple.com>

        Enable API related to the video fullscreen layer in MediaPlayerPrivateMediaStreamAVFObjC for Mac.
        https://bugs.webkit.org/show_bug.cgi?id=153239

        Reviewed by Eric Carlson.

        Reuse VideoFullscreenLayerManager to manage moving the video layer between the fullscreen
        layer and the inline layer depending on the current presentation mode.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::MediaPlayerPrivateMediaStreamAVFObjC):
        Create m_videoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::platformLayer):
        Return the video inline layer from the VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::createPreviewLayers):
        Call VideoFullscreenLayerManager::setVideoLayer() with the m_videoBackgroundLayer. To make sure
        the preview layer (a sublayer of m_videoBackgroundLayer) resize according to aspect ratio, set
        its contents gravity to kCAGravityResizeAspect. Also, set its autoresizing mask so it'll resize
        with its superlayer.
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVideoFullscreenLayer):
        Call VideoFullscreenLayerManager::setVideoFullscreenLayer().
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::setVideoFullscreenFrame):
        Call VideoFullscreenLayerManager::setVideoFullscreenFrame().

2016-03-08  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Crash when a single load request causes multiple fonts to fail loading
        https://bugs.webkit.org/show_bug.cgi?id=155009

        Reviewed by Simon Fraser.

        In JavaScript, the first promise fulfillment/failure wins. However, in C++, any
        subsequent fulfillments/failures cause a crash.

        Test: fast/text/font-face-set-document-multiple-failure.html

        * css/CSSFontFace.cpp:
        (WebCore::iterateClients): Notifying a client may cause some other client
        to be destroyed, thereby modifying the clients set. This function allows
        for notifying clients in a resilient manner.
        (WebCore::CSSFontFace::setStyle): Update to use iterateClients().
        (WebCore::CSSFontFace::setWeight): Ditto.
        (WebCore::CSSFontFace::setUnicodeRange): Ditto.
        (WebCore::CSSFontFace::setVariantLigatures): Ditto.
        (WebCore::CSSFontFace::setVariantPosition): Ditto.
        (WebCore::CSSFontFace::setVariantCaps): Ditto.
        (WebCore::CSSFontFace::setVariantNumeric): Ditto.
        (WebCore::CSSFontFace::setVariantAlternates): Ditto.
        (WebCore::CSSFontFace::setVariantEastAsian): Ditto.
        (WebCore::CSSFontFace::setFeatureSettings): Ditto.
        (WebCore::CSSFontFace::setStatus): Ditto.
        (WebCore::CSSFontFace::notifyClientsOfFontPropertyChange): Deleted.
        * css/CSSFontFace.h: Adding a way for clients to make sure they don't register
        or deregister another client.
        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::guardAgainstClientRegistrationChanges): Simple
        ref()/deref() pair.
        (WebCore::CSSFontFaceSet::stopGuardingAgainstClientRegistrationChanges):
        * css/CSSFontFaceSet.h:
        * css/FontFace.cpp: Ditto.
        (WebCore::FontFace::guardAgainstClientRegistrationChanges):
        (WebCore::FontFace::stopGuardingAgainstClientRegistrationChanges):
        * css/FontFace.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::faceFinished): Make sure that we only fulfil or reject
        a promise once.
        * css/FontFaceSet.h:
        * dom/Document.cpp:
        (WebCore::Document::fonts): The CSSFontFaces inside the CSSFontSelector get
        created during style recalc. We may be in a state where there is a style
        recalc pending. In order to make sure the Javascript API sees the current
        state of the world, force a style recalc here (but only if one is pending).

2016-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197793 and r197799.
        https://bugs.webkit.org/show_bug.cgi?id=155195

        something weird happened while landing this and everything
        broke (Requested by olliej on #webkit).

        Reverted changesets:

        "Start moving to separated writable and executable mappings in
        the JIT"
        https://bugs.webkit.org/show_bug.cgi?id=155178
        http://trac.webkit.org/changeset/197793

        "arm64 build fix after r197793."
        http://trac.webkit.org/changeset/197799

2016-03-08  Mark Lam  <mark.lam@apple.com>

        synthesizePrototype() and friends need to be followed by exception checks (or equivalent).
        https://bugs.webkit.org/show_bug.cgi?id=155169

        Reviewed by Geoffrey Garen.

        No new tests because this issue is covered by existing tests when the fix for
        https://bugs.webkit.org/show_bug.cgi?id=154865 lands.  That patch is waiting for
        this patch to land first so as to not introduce test failures.

        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::installReplacement):
        * bindings/js/JSDeviceMotionEventCustom.cpp:
        (WebCore::readAccelerationArgument):
        (WebCore::readRotationRateArgument):
        * bindings/js/JSGeolocationCustom.cpp:
        (WebCore::createPositionOptions):
        * bindings/js/JSHTMLCanvasElementCustom.cpp:
        (WebCore::get3DContextAttributes):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::construct):
        * contentextensions/ContentExtensionParser.cpp:
        (WebCore::ContentExtensions::getTypeFlags):
        * html/HTMLMediaElement.cpp:
        (WebCore::setPageScaleFactorProperty):
        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):

2016-03-08  Oliver Hunt  <oliver@apple.com>

        Start moving to separated writable and executable mappings in the JIT
        https://bugs.webkit.org/show_bug.cgi?id=155178

        Reviewed by Filip Pizlo.

        Update feature defines.

        * Configurations/FeatureDefines.xcconfig:

2016-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197766.
        https://bugs.webkit.org/show_bug.cgi?id=155183

        Has platform-specific code in non-platform files (Requested by
        smfr on #webkit).

        Reverted changeset:

        "AX: Force allow user zoom"
        https://bugs.webkit.org/show_bug.cgi?id=155056
        http://trac.webkit.org/changeset/197766

2016-03-08  Beth Dakin  <bdakin@apple.com>

        Add an event for when touch force changes
        https://bugs.webkit.org/show_bug.cgi?id=155143
        -and corresponding-
        rdar://problem/24068726

        Reviewed by Darin Adler.

        We will be able to test this once we fix the iOS touch tests. 

        This patch adds touchforcechange which is a lot like the iOS equivalent of 
        webkitmouseforcechanged. We had originally hoped to use touchmove to dispatch 
        force changes, but that turned out to be a compatibility nightmare.

        * dom/EventNames.h:
        (WebCore::EventNames::isTouchEventType):
        (WebCore::EventNames::isWheelEventType):
        (WebCore::EventNames::touchEventNames):
        * dom/GlobalEventHandlers.idl:
        * html/HTMLAttributeNames.in:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::createEventHandlerNameMap):
        * platform/PlatformEvent.h:

2016-03-08  Anders Carlsson  <andersca@apple.com>

        Ignore deprecation warnings.

        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::computedAttributesForElement):
        (HTMLConverter::_addMarkersToList):
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::keyEvent):
        (WebCore::lastEventIsMouseUp):
        (WebCore::EventHandler::passSubframeEventToSubframe):
        (WebCore::EventHandler::passWheelEventToWidget):
        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):
        * page/mac/TextIndicatorWindow.mm:
        (WebCore::TextIndicatorWindow::setTextIndicator):
        * platform/graphics/mac/IconMac.mm:
        (WebCore::Icon::paint):
        * platform/mac/CursorMac.mm:
        (WebCore::createCustomCursor):
        * platform/mac/DragImageMac.mm:
        (WebCore::dissolveDragImageToFraction):
        (WebCore::createDragImageFromImage):
        * platform/mac/EventLoopMac.mm:
        (WebCore::EventLoop::cycle):
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::setDragImage):
        * platform/mac/PlatformEventFactoryMac.mm:
        (WebCore::globalPointForEvent):
        (WebCore::pointForEvent):
        (WebCore::mouseButtonForEvent):
        (WebCore::mouseEventTypeForEvent):
        (WebCore::clickCountForEvent):
        (WebCore::textFromEvent):
        (WebCore::unmodifiedTextFromEvent):
        (WebCore::keyIdentifierForKeyEvent):
        (WebCore::isKeypadEvent):
        (WebCore::windowsKeyCodeForKeyEvent):
        (WebCore::isKeyUpEvent):
        (WebCore::modifiersForEvent):
        (WebCore::PlatformKeyboardEventBuilder::PlatformKeyboardEventBuilder):
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::scrollbarControlSizeToNSControlSize):
        * platform/mac/ThemeMac.mm:
        (-[WebCoreThemeView window]):
        (WebCore::controlSizeForFont):
        (WebCore::controlSizeFromPixelSize):
        (WebCore::setUpButtonCell):
        (WebCore::stepperControlSizeForFont):
        (WebCore::paintStepper):
        (WebCore::ThemeMac::minimumControlSize):
        * platform/mac/WebVideoFullscreenHUDWindowController.mm:
        (-[WebVideoFullscreenHUDWindow initWithContentRect:styleMask:backing:defer:]):
        (-[WebVideoFullscreenHUDWindow performKeyEquivalent:]):
        (-[WebVideoFullscreenHUDWindowController init]):
        (-[WebVideoFullscreenHUDWindowController keyDown:]):
        (-[WebVideoFullscreenHUDWindowController windowDidLoad]):
        * platform/mac/WebWindowAnimation.mm:
        (WebWindowAnimationDurationFromDuration):
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::updateCachedSystemFontDescription):
        (WebCore::RenderThemeMac::controlSizeForFont):
        (WebCore::RenderThemeMac::controlSizeForCell):
        (WebCore::RenderThemeMac::controlSizeForSystemFont):
        (WebCore::RenderThemeMac::paintProgressBar):
        (WebCore::RenderThemeMac::popupMenuSize):
        (WebCore::RenderThemeMac::sliderThumbHorizontal):
        (WebCore::RenderThemeMac::sliderThumbVertical):

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix the 32bit build after r197782.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::logMemoryUsageChange):

2016-03-08  Antonio Gomes  <tonikitoo@webkit.org>

        Scrolling does not work when the mouse down is handled by a node
        https://bugs.webkit.org/show_bug.cgi?id=19033

        Reviewed by Simon Fraser.

        Test: fast/events/prevent-default-prevents-interaction-with-scrollbars-.html

        When a mouse press/down event happens on a scrollbar area, but event
        is default prevented in the document level**, for example, event does not get
        properly passed to scrollbars, although it should.

        Problem started long ago with r17770, and was improved with r19596.
        However, years later, the way Scrollbar* is obtained is still currently different
        weither event is default prevented or not.

        Patch uniforms the logic for both cases, and fixes the bug.

        Note: code before used to look like

        if (swallowEvent) {
            <code>
        } else {
            <bleh>
            <foo>
        }

        .. and now looks like

        if (!swallowEvent)
            <bleh>

        <code>

        if (!swallowEvent)
            <foo>

        ** e.g. document.addEventListener('mousedown', function (e) { e.preventDefault(); });

        * page/EventHandler.cpp:
        (WebCore::scrollbarForMouseEvent):
        (WebCore::EventHandler::handleMousePressEvent):

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed Windows build fix after r197728.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::logMemoryUsageChange):

2016-03-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197765.
        https://bugs.webkit.org/show_bug.cgi?id=155172

        The test added with this change is failing on all platforms.
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "ImageDocuments leak their world."
        https://bugs.webkit.org/show_bug.cgi?id=155167
        http://trac.webkit.org/changeset/197765

2016-03-08  Antti Koivisto  <antti@apple.com>

        Make Element const in ElementRuleCollector
        https://bugs.webkit.org/show_bug.cgi?id=155170

        Reviewed by Andreas Kling.

        More const.

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ElementRuleCollector):
        (WebCore::ElementRuleCollector::matchAllRules):
        * css/ElementRuleCollector.h:
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        (WebCore::SelectorChecker::matchesFocusPseudoClass):
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelationIfResolvingStyle):
        (WebCore::SelectorCompiler::addStyleRelationFunction):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateContextFunctionCallTest):
        (WebCore::SelectorCompiler::elementIsActive):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsFirstChild):
        (WebCore::SelectorCompiler::elementIsHovered):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsOnlyChild):
        (WebCore::SelectorCompiler::makeContextStyleUniqueIfNecessaryAndTestIsPlaceholderShown):
        (WebCore::SelectorCompiler::isPlaceholderShown):
        * cssjit/SelectorCompiler.h:
        * dom/StyledElement.h:
        (WebCore::StyledElement::additionalPresentationAttributeStyle):
        (WebCore::StyledElement::inlineStyle):
        (WebCore::StyledElement::collectStyleForPresentationAttribute):
        (WebCore::StyledElement::invalidateStyleAttribute):
        (WebCore::StyledElement::presentationAttributeStyle):
        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::parseAttribute):
        (WebCore::HTMLTableCellElement::additionalPresentationAttributeStyle):
        * html/HTMLTableCellElement.h:
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):
        (WebCore::HTMLTableColElement::additionalPresentationAttributeStyle):
        * html/HTMLTableColElement.h:
        * html/HTMLTableElement.cpp:
        (WebCore::leakBorderStyle):
        (WebCore::HTMLTableElement::additionalPresentationAttributeStyle):
        * html/HTMLTableElement.h:
        * html/HTMLTableSectionElement.cpp:
        (WebCore::HTMLTableSectionElement::create):
        (WebCore::HTMLTableSectionElement::additionalPresentationAttributeStyle):
        * html/HTMLTableSectionElement.h:
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::didUnregisterNamedFlowContentElement):
        (WebCore::InspectorCSSAgent::forcePseudoState):
        * inspector/InspectorCSSAgent.h:
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::pushNodePathToFrontend):
        (WebCore::InspectorDOMAgent::boundNodeId):
        (WebCore::InspectorDOMAgent::backendNodeIdForNode):
        * inspector/InspectorDOMAgent.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::handleMousePressImpl):
        (WebCore::InspectorInstrumentation::forcePseudoStateImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::handleMousePress):
        (WebCore::InspectorInstrumentation::forcePseudoState):

2016-03-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Commonalize handling of FetchBody by FetchRequest and FetchResponse
        https://bugs.webkit.org/show_bug.cgi?id=154959

        Reviewed by Darin Adler.

        Introducing FetchBodyOwner class as base class of FetchRequest and FetchResponse.
        This class is an ActiveDOMObject and is responsible of handling the Body API implemented by Request and Response.

        Covered by existing tests.

        * Modules/fetch/FetchBodyOwner.h: Added.
        (WebCore::FetchBodyOwner::isDisturbed):
        (WebCore::FetchBodyOwner::arrayBuffer):
        (WebCore::FetchBodyOwner::formData):
        (WebCore::FetchBodyOwner::blob):
        (WebCore::FetchBodyOwner::json):
        (WebCore::FetchBodyOwner::text):
        (WebCore::FetchBodyOwner::body):
        (WebCore::FetchBodyOwner::FetchBodyOwner):
        * Modules/fetch/FetchRequest.h:
        (WebCore::FetchRequest::FetchRequest):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::FetchResponse):
        * Modules/fetch/FetchResponse.h:
        * WebCore.xcodeproj/project.pbxproj:

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed, fix 32-bit build after r197726.

        Also, re-enable static_assert to check the ElementRareData size.

        * dom/ElementRareData.cpp:

2016-03-08  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed test fix after r197721.
        https://bugs.webkit.org/show_bug.cgi?id=155120
        <rdar://problem/25010167>

        If a WK1 client turns on the "Resource Load Statistics" debug flag, but
        does not supply a data modification handler, we dereference a null function.

        * loader/ResourceLoadStatisticsStore.cpp:
        (WebCore::ResourceLoadStatisticsStore::fireDataModificationHandler): Check
        for nullptr function before invoking it.

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed, temporarily comment out static_assert while I investigate.

        It still did not build on some platforms.

        * dom/ElementRareData.cpp:

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed, another build fix after r197726.

        * dom/ElementRareData.cpp:

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed Windows build fix after r197728.

        * platform/MemoryPressureHandler.cpp:

2016-03-08  Chris Dumez  <cdumez@apple.com>

        Unreviewed build fix after r197726.

        * dom/ElementRareData.cpp:

2016-03-08  Nan Wang  <n_wang@apple.com>

        AX: Force allow user zoom
        https://bugs.webkit.org/show_bug.cgi?id=155056

        Reviewed by Chris Fleizach.

        Override the maximum scale factor when forceAlwaysUserScalable is true.

        Test: accessibility/ios-simulator/force-user-scalable.html

        * page/ViewportConfiguration.h:
        (WebCore::ViewportConfiguration::maximumScale):
        * testing/Internals.cpp:
        (WebCore::Internals::composedTreeAsText):
        (WebCore::Internals::setViewportForceAlwaysUserScalable):
        (WebCore::Internals::viewportConfigurationMaximumScale):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-03-08  Andreas Kling  <akling@apple.com>

        ImageDocuments leak their world.
        <https://webkit.org/b/155167>
        <rdar://problem/24987363>

        Reviewed by Antti Koivisto.

        ImageDocument uses a special code path in ImageLoader in order to manually
        control how the image is loaded. It has to do this because the ImageDocument
        is really just a synthetic wrapper around a main resource that's an image.

        This custom loading code had a bug where it would create a new CachedImage
        and neglect to set its CachedResource::m_state flag to Pending (which is
        normally set by CachedResource::load(), but we don't call that for these.)

        This meant that when ImageDocument called CachedImage::finishLoading() to
        trigger the notifyFinished() callback path, the image would look at its
        loading state and see that it was Unknown (not Pending), and conclude that
        it hadn't loaded yet. So we never got the notifyFinished() signal.

        The world leaks here because ImageLoader slaps a ref on its <img> element
        while it waits for the loading operation to complete. Once finished, whether
        successfully or with an error, it derefs the <img>.

        Since we never fired notifyFinished(), we ended up with an extra ref on
        these <img> forever, and then the element kept its document alive too.

        Test: fast/dom/ImageDocument-world-leak.html

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):

2016-03-07  Antti Koivisto  <antti@apple.com>

        ElementRuleCollector should not mutate document and style
        https://bugs.webkit.org/show_bug.cgi?id=155113

        Reviewed by Andreas Kling.

        Move applying of style relations out of ElementRuleCollector and StyleResolver.
        This gets us closer to making StyleResolver const for Element.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ElementRuleCollector):

            No need for style parameter anymore.

        (WebCore::ElementRuleCollector::collectMatchingRules):
        (WebCore::ElementRuleCollector::sortAndTransferMatchedRules):
        (WebCore::ElementRuleCollector::ruleMatches):

            Client will now do the style and element mutations. Just collect the data here.

        (WebCore::ElementRuleCollector::collectMatchingRulesForList):
        (WebCore::ElementRuleCollector::commitStyleRelations): Deleted.

            Moves to StyleRelations.cpp

        * css/ElementRuleCollector.h:
        (WebCore::ElementRuleCollector::hasMatchedRules):
        (WebCore::ElementRuleCollector::matchedPseudoElementIds):
        (WebCore::ElementRuleCollector::styleRelations):
        (WebCore::ElementRuleCollector::didMatchUncommonAttributeSelector):
        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::prepareEvaluator):
        (WebCore::MediaQueryMatcher::evaluate):
        * css/SelectorChecker.cpp:
        (WebCore::addStyleRelation):
        (WebCore::isFirstChildElement):
        (WebCore::isFirstOfType):
        (WebCore::countElementsBefore):
        (WebCore::countElementsOfTypeBefore):
        (WebCore::SelectorChecker::matchRecursively):
        (WebCore::SelectorChecker::checkOne):
        * css/SelectorChecker.h:
        (WebCore::SelectorChecker::CheckingContext::CheckingContext):
        * css/StyleMedia.cpp:
        (WebCore::StyleMedia::matchMedium):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):

            Apply the style relations affecting current style immediately.
            Pass the rest to the client.

        (WebCore::StyleResolver::styleForKeyframe):
        (WebCore::StyleResolver::pseudoStyleForElement):
        (WebCore::StyleResolver::pseudoStyleRulesForElement):
        * css/StyleResolver.h:
        (WebCore::ElementStyle::ElementStyle):
        * cssjit/SelectorCompiler.cpp:
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelationIfResolvingStyle):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelation):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateSelectorCheckerExcludingPseudoElements):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateDirectAdjacentTreeWalker):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateIndirectAdjacentTreeWalker):
        (WebCore::SelectorCompiler::addStyleRelationFunction):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsActive):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsEmpty):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsFirstChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsHovered):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsLastChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsOnlyChild):
        (WebCore::SelectorCompiler::makeContextStyleUniqueIfNecessaryAndTestIsPlaceholderShown):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthChildOf):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthLastChild):
        (WebCore::SelectorCompiler::SelectorCodeGenerator::generateElementIsNthLastChildOf):
        * dom/Document.cpp:
        (WebCore::Document::styleForElementIgnoringPendingStylesheets):

            Apply style relations.

        (WebCore::Document::updateLayoutIfDimensionsOutOfDate):
        * dom/Element.cpp:
        (WebCore::Element::styleResolver):
        (WebCore::Element::resolveStyle):
        (WebCore::Element::didDetachRenderers):
        (WebCore::Element::resolveCustomStyle):

            Return ElementStyle (which contains style relations along with the render style).
            Rename for consistency.

        (WebCore::Element::cloneAttributesFromElement):
        (WebCore::Element::customStyleForRenderer): Deleted.
        * dom/Element.h:
        (WebCore::Element::isVisibleInViewportChanged):
        * dom/PseudoElement.cpp:
        (WebCore::PseudoElement::clearHostElement):
        (WebCore::PseudoElement::resolveCustomStyle):
        (WebCore::PseudoElement::didAttachRenderers):
        (WebCore::PseudoElement::customStyleForRenderer): Deleted.
        * dom/PseudoElement.h:
        * html/HTMLTitleElement.cpp:
        (WebCore::HTMLTitleElement::computedTextWithDirection):
        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::hostInput):
        (WebCore::SliderThumbElement::resolveCustomStyle):
        (WebCore::SliderThumbElement::shadowPseudoId):
        (WebCore::SliderContainerElement::createElementRenderer):
        (WebCore::SliderContainerElement::resolveCustomStyle):
        (WebCore::SliderContainerElement::shadowPseudoId):
        (WebCore::SliderThumbElement::customStyleForRenderer): Deleted.
        (WebCore::SliderContainerElement::customStyleForRenderer): Deleted.
        * html/shadow/SliderThumbElement.h:
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerElement::create):
        (WebCore::TextControlInnerElement::resolveCustomStyle):
        (WebCore::TextControlInnerTextElement::renderer):
        (WebCore::TextControlInnerTextElement::resolveCustomStyle):
        (WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):
        (WebCore::TextControlPlaceholderElement::resolveCustomStyle):
        (WebCore::TextControlInnerElement::customStyleForRenderer): Deleted.
        (WebCore::TextControlInnerTextElement::customStyleForRenderer): Deleted.
        (WebCore::TextControlPlaceholderElement::customStyleForRenderer): Deleted.
        * html/shadow/TextControlInnerElements.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::getUncachedPseudoStyle):
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::computeStyleInRegion):
        (WebCore::RenderNamedFlowFragment::computeChildrenStyleInRegion):
        * style/StyleRelations.cpp: Added.
        (WebCore::Style::commitRelationsToRenderStyle):

            Commit relations affecting style that is being computed.

        (WebCore::Style::commitRelationsToDocument):

            Commit relations that mutate document.

        * style/StyleRelations.h: Added.

            Factor style relation data structures and functions to a file of their own.

        (WebCore::Style::Relation::Relation):
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::styleSharingCandidateMatchesRuleSet):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::styleForElement):

            Apply style relations.

        * style/StyleTreeResolver.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::synchronizeSystemLanguage):
        (WebCore::SVGElement::resolveCustomStyle):
        (WebCore::SVGElement::customStyleForRenderer): Deleted.
        * svg/SVGElement.h:
        * svg/SVGElementRareData.h:
        (WebCore::SVGElementRareData::overrideComputedStyle):

2016-03-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement fetch skeleton
        https://bugs.webkit.org/show_bug.cgi?id=155111

        Reviewed by Darin Adler.

        Adding skeleton code to call fetch API from normal and worker scopes.
        Fetch API implementation is limited to reject the promise.

        Updating the binding generator to fix the case of overloaded promise-returning functions.
        Made overloaded utility functions "static inline".

        Tests: imported/w3c/web-platform-tests/fetch/api/basic/accept-header-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/accept-header.html
               imported/w3c/web-platform-tests/fetch/api/basic/integrity-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/integrity.html
               imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/mode-no-cors.html
               imported/w3c/web-platform-tests/fetch/api/basic/mode-same-origin-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/mode-same-origin.html
               imported/w3c/web-platform-tests/fetch/api/basic/request-forbidden-headers-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/request-forbidden-headers.html
               imported/w3c/web-platform-tests/fetch/api/basic/request-headers-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/request-headers.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-about-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-about.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-blob-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-blob.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-data-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-data.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-others-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/scheme-others.html
               imported/w3c/web-platform-tests/fetch/api/basic/stream-response-worker.html
               imported/w3c/web-platform-tests/fetch/api/basic/stream-response.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * Modules/fetch/DOMWindowFetch.cpp: Added.
        (WebCore::DOMWindowFetch::fetch):
        * Modules/fetch/DOMWindowFetch.h: Added.
        * Modules/fetch/DOMWindowFetch.idl: Added.
        * Modules/fetch/WorkerGlobalScopeFetch.cpp: Added.
        (WebCore::WorkerGlobalScopeFetch::fetch):
        * Modules/fetch/WorkerGlobalScopeFetch.h: Added.
        * Modules/fetch/WorkerGlobalScopeFetch.idl: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Fixing the case of overloaded promise-returning functions.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod1):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod3):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod4):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod5):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod6):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod7):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod8):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod9):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod10):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod11):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod12):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter1):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
        (WebCore::jsTestObjConstructorFunctionOverloadedMethod11):
        (WebCore::jsTestObjConstructorFunctionOverloadedMethod12):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction1Promise):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise):
        (WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction):
        (WebCore::jsTestObjPrototypeFunctionOverloadedMethod): Deleted.
        (WebCore::jsTestObjConstructorFunctionClassMethod2): Deleted.
        (WebCore::jsTestObjPrototypeFunctionAny): Deleted.
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionPromise): Deleted.
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithFloatArgumentPromise): Deleted.
        (WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithExceptionPromise): Deleted.
        * bindings/scripts/test/TestObj.idl:

2016-03-08  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Make FetchRequest and FetchResponse ActiveDOMObject
        https://bugs.webkit.org/show_bug.cgi?id=154729

        Reviewed by Darin Adler.

        Covered by existing tests.

        Making FetchRequest and FetchResponse ActiveDOMObject.
        Both objects can always be suspended now.
        This might be updated when blob conversion is added or when fetching data to fill in FetchResponse.

        * Modules/fetch/FetchRequest.cpp:
        (WebCore::FetchRequest::create):
        (WebCore::FetchRequest::clone):
        (WebCore::FetchRequest::activeDOMObjectName):
        (WebCore::FetchRequest::canSuspendForDocumentSuspension):
        * Modules/fetch/FetchRequest.h:
        (WebCore::FetchRequest::FetchRequest):
        * Modules/fetch/FetchRequest.idl:
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::FetchResponse):
        (WebCore::FetchResponse::clone):
        (WebCore::FetchResponse::activeDOMObjectName):
        (WebCore::FetchResponse::canSuspendForDocumentSuspension):
        * Modules/fetch/FetchResponse.h:
        (WebCore::FetchResponse::create):
        * Modules/fetch/FetchResponse.idl:

2016-03-08  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        [SVG2] Implement marker orient='auto-start-reverse'
        https://bugs.webkit.org/show_bug.cgi?id=138456

        Reviewed by Darin Adler.

        https://www.w3.org/TR/SVG2/painting.html#OrientAttribute
        marker-start markers must be oriented at 180 degrees to the direction of the path when
        the orient attribute of the marker is set to 'auto-start-reverse'.

        To acheive this the SVGMarkerData class which calculates the angles for each marker on
        a path must know whether the orient type is set to reverse the start marker. 

        Tests: svg/animations/animate-marker-orient-from-angle-to-autostartreverse.html
               svg/animations/animate-marker-orienttype-4.html
               svg/custom/marker-auto-start-reverse.html

        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::processMarkerPositions):
          Create marker data, using animated value of orient to determine
          if first marker should be reversed.
        * rendering/svg/SVGMarkerData.h:
        (WebCore::SVGMarkerData::SVGMarkerData):
          Constructor now requires boolean indicating if start marker is 
          reversed.
        (WebCore::SVGMarkerData::currentAngle):
          Take into account whether start marker should be reversed.
        * rendering/svg/SVGResources.cpp:
        (WebCore::SVGResources::markerReverseStart):
          New function to query whether start marker should be reversed.
        * rendering/svg/SVGResources.h:
          Add declaration for new function.
        * svg/SVGAnimatedAngle.cpp:
        (WebCore::SVGAnimatedAngleAnimator::calculateAnimatedValue):
          Support animation including the value auto-start-reverse.
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::setOrient):
          Combine duplicated functionality into one private method
        (WebCore::SVGMarkerElement::setOrientToAuto):
          Set orient type and angle correctly for orient=auto. Uses setOrient.
        (WebCore::SVGMarkerElement::setOrientToAngle):
          Set orient type and angle correctly for orient=<angle>. Uses setOrient.
        (WebCore::SVGMarkerElement::synchronizeOrientType):
          Support auto-start-reverse as a possible case.
        * svg/SVGMarkerElement.h:
        (WebCore::SVGIDLEnumLimits<SVGMarkerOrientType>::highestExposedEnumValue):
          Limit the orient DOM property so that the new enum value
          required for auto-start-reverse is not exposed.
        (WebCore::SVGPropertyTraits<SVGMarkerOrientType>::highestEnumValue):
          Support auto-start-reverse.
        (WebCore::SVGPropertyTraits<SVGMarkerOrientType>::fromString):
          Support auto-start-reverse.

2016-03-07  Keith Rollin  <krollin@apple.com>

        Enhance logging: Use "always on" macros
        https://bugs.webkit.org/show_bug.cgi?id=154499
        <rdar://problem/24757730>

        Reviewed by Chris Dumez.

        Make use of new logging macros by reporting on frame and resource
        load activity.

        Add new logging to memory pressure handler to show when it's called
        and its effectiveness. As part of this change, the various
        platform-specific implementations have been unified.

        No new tests. No new basic functionality has been added. Only new
        logging has been added in release mode or has been enabled to execute
        in release mode as well as debug mode.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::prepareForLoadStart):
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        (WebCore::FrameLoader::isAlwaysOnLoggingAllowed):
        * loader/FrameLoader.h:
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::isAlwaysOnLoggingAllowed):
        * loader/ResourceLoader.h:
        * page/Frame.cpp:
        (WebCore::Frame::isAlwaysOnLoggingAllowed):
        * page/Frame.h:
        * page/Page.cpp:
        (WebCore::Page::isAlwaysOnLoggingAllowed):
        * page/Page.h:
        * page/SessionID.h:
        (WebCore::SessionID::isAlwaysOnLoggingAllowed):
        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::logMemoryUsageChange):
        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog): Deleted.
        * platform/MemoryPressureHandler.h:
        (WebCore::MemoryPressureHandler::ReliefLogger::ReliefLogger):
        (WebCore::MemoryPressureHandler::ReliefLogger::~ReliefLogger):
        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog): Deleted.
        * platform/linux/MemoryPressureHandlerLinux.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog): Deleted.
        * platform/win/MemoryPressureHandlerWin.cpp:
        (WebCore::MemoryPressureHandler::ReliefLogger::platformLog): Deleted.

2016-03-07  Chris Dumez  <cdumez@apple.com>

        Align HTMLCanvasElement.width / height with the specification
        https://bugs.webkit.org/show_bug.cgi?id=155156

        Reviewed by Ryosuke Niwa.

        Align HTMLCanvasElement.width / height with the specification:
        - https://html.spec.whatwg.org/multipage/scripting.html#dom-canvas-width
        - https://html.spec.whatwg.org/multipage/scripting.html#attr-canvas-width

        In particular, the following changes were made:
        1. The attributes are now 'unsigned long' instead of 'long'
        2. The corresponding content attributes are parsed as per the HTML rules
           for passing non-negative integers.
        3. Upon setting, if the value is out-of-range, the content attributes is
           set to its default value.

        No new tests, already covered by existing test.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::setHeight):
        (WebCore::HTMLCanvasElement::setWidth):
        (WebCore::HTMLCanvasElement::reset):
        * html/HTMLCanvasElement.h:
        * html/HTMLCanvasElement.idl:

2016-03-07  Chris Dumez  <cdumez@apple.com>

        Stop clamping HTMLElement.tabIndex to the range of a short
        https://bugs.webkit.org/show_bug.cgi?id=155159

        Reviewed by Ryosuke Niwa.

        Stop clamping HTMLElement.tabIndex to the range of a short. We
        apparently did this to match Firefox. However, this no longer matches
        Firefox's behavior nor the HTML specification:
        - https://html.spec.whatwg.org/multipage/interaction.html#dom-tabindex

        No new tests, already covered by existing test.

        * dom/Element.cpp:
        (WebCore::Element::setTabIndexExplicitly):
        (WebCore::Element::tabIndex):
        * dom/Element.h:
        * dom/ElementRareData.h:
        (WebCore::ElementRareData::tabIndex):
        (WebCore::ElementRareData::setTabIndexExplicitly):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::tabIndex):
        * html/HTMLAnchorElement.h:
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseAttribute):
        (WebCore::HTMLElement::tabIndex):
        * html/HTMLElement.h:
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::tabIndex):
        * html/HTMLFormControlElement.h:
        * page/FocusController.cpp:
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::FocusController::previousFocusableElement):
        * svg/SVGAElement.cpp:
        (WebCore::SVGAElement::tabIndex):
        * svg/SVGAElement.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::tabIndex):
        (WebCore::SVGElement::parseAttribute):
        * svg/SVGElement.h:

2016-03-07  Daniel Bates  <dabates@apple.com>

        CSP: Source '*' should not match URLs with schemes blob, data, or filesystem
        https://bugs.webkit.org/show_bug.cgi?id=154122
        <rdar://problem/24613336>

        Reviewed by Brent Fulgham.

        Restrict matching of source expression * to HTTP or HTTPS URLs for all directives except
        img-src and media-src. This policy is more restrictive than the policy described in section
        Matching Source Expressions of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721>,
        which restricts matching * to schemes that are not blob, data, or filesystem.

        For directive img-src we restrict matching of * to HTTP, HTTPS, and data URLs. For directive
        media-src we restrict matching of * to HTTP, HTTPS, data URLs and blob URLs. We use a
        more lenient interpretation of * for directives img-src and media-src than required by
        the spec. to mitigate web compatibility issues.

        Tests: fast/dom/HTMLImageElement/image-with-blob-url-blocked-by-csp-img-src-star.html
               fast/dom/HTMLImageElement/image-with-data-url-allowed-by-csp-img-src-star.html
               fast/dom/HTMLImageElement/image-with-file-url-blocked-by-csp-img-src-star.html
               fast/dom/HTMLLinkElement/link-with-blob-url-blocked-by-csp-style-src-star.html
               fast/dom/HTMLLinkElement/link-with-data-url-blocked-by-csp-style-src-star.html
               fast/dom/HTMLLinkElement/link-with-file-url-blocked-by-csp-style-src-star.html
               http/tests/security/contentSecurityPolicy/image-with-http-url-allowed-by-csp-img-src-star.html
               http/tests/security/contentSecurityPolicy/image-with-https-url-allowed-by-csp-img-src-star.html
               http/tests/security/contentSecurityPolicy/javascript-url-blocked-by-default-src-star.html
               http/tests/security/contentSecurityPolicy/link-with-http-url-allowed-by-csp-style-src-star.html
               http/tests/security/contentSecurityPolicy/link-with-https-url-allowed-by-csp-style-src-star.html
               http/tests/security/contentSecurityPolicy/video-with-http-url-allowed-by-csp-media-src-star.html
               http/tests/security/contentSecurityPolicy/video-with-https-url-allowed-by-csp-media-src-star.html
               media/video-with-blob-url-allowed-by-csp-media-src-star.html
               media/video-with-data-url-allowed-by-csp-media-src-star.html
               media/video-with-file-url-blocked-by-csp-media-src-star.html

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar): Added.
        (WebCore::ContentSecurityPolicySourceList::matches): Modified to only match * if ContentSecurityPolicySourceList::isProtocolAllowedByStar().
        evaluates to true.
        * page/csp/ContentSecurityPolicySourceList.h:

2016-03-07  Brent Fulgham  <bfulgham@apple.com>

        Reduce startup and shutdown cost of resource load statistics
        https://bugs.webkit.org/show_bug.cgi?id=155120
        <rdar://problem/25010167>

        Reviewed by Andy Estes.

        Move all file-related code out of WebCore.

        * loader/ResourceLoadStatisticsStore.cpp:
        (WebCore::ResourceLoadStatisticsStore::create): Deleted path overload.
        (WebCore::ResourceLoadStatisticsStore::createEncoderFromData): Added.
        (WebCore::ResourceLoadStatisticsStore::readDataFromDecoder): Added.
        (WebCore::ResourceLoadStatisticsStore::ResourceLoadStatisticsStore): Deleted.
        (WebCore::ResourceLoadStatisticsStore::writeDataToDisk): Deleted.
        (WebCore::ResourceLoadStatisticsStore::setStatisticsStorageDirectory): Deleted.
        (WebCore::ResourceLoadStatisticsStore::persistentStoragePath): Deleted.
        (WebCore::ResourceLoadStatisticsStore::readDataFromDiskIfNeeded): Deleted.
        (WebCore::ResourceLoadStatisticsStore::createDecoderFromDisk): Deleted.
        (WebCore::ResourceLoadStatisticsStore::writeEncoderToDisk): Deleted.
        * loader/ResourceLoadStatisticsStore.h:
        (WebCore::ResourceLoadStatisticsStore::clear): Added.

2016-03-07  Zalan Bujtas  <zalan@apple.com>

        Crash in WebCore::RenderElement::containingBlockForObjectInFlow
        https://bugs.webkit.org/show_bug.cgi?id=155109

        Reviewed by Simon Fraser.

        It's unsafe to call containingBlock() on RenderView.

        Unable to reproduce.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::styleWillChange):
        (WebCore::RenderBlock::isSelfCollapsingBlock):
        (WebCore::RenderBlock::selectionGaps):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::borderBoxRectInRegion):
        (WebCore::RenderBox::computePercentageLogicalHeight):
        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
        (WebCore::logicalWidthIsResolvable):
        (WebCore::RenderBox::percentageLogicalHeightIsResolvableFromBlock):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::hasAutoHeightOrContainingBlockWithAutoHeight):
        * rendering/RenderFlowThread.cpp:
        (WebCore::RenderFlowThread::adjustedPositionRelativeToOffsetParent):
        (WebCore::RenderFlowThread::offsetFromLogicalTopOfFirstRegion):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::hasCompositedLayerInEnclosingPaginationChain):
        (WebCore::RenderLayer::updatePagination):
        (WebCore::inContainingBlockChain):
        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::isValidColumnSpanner):
        * rendering/RenderNamedFlowThread.cpp:
        (WebCore::RenderNamedFlowThread::decorationsClipRectForBoxInNamedFlowFragment):
        * rendering/RenderObject.cpp:
        (WebCore::hasFixedPosInNamedFlowContainingBlock):
        * rendering/RenderReplaced.cpp:
        (WebCore::firstContainingBlockWithLogicalWidth):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::subtreeSelectionBounds):
        (WebCore::RenderView::repaintSubtreeSelection):
        (WebCore::RenderView::clearSubtreeSelection):
        (WebCore::RenderView::applySubtreeSelection):

2016-03-07  Daniel Bates  <dabates@apple.com>

        Cleanup: Add convenience function URL::procotolIsBlob()
        https://bugs.webkit.org/show_bug.cgi?id=155127
        <rdar://problem/25016829>

        Reviewed by Brent Fulgham.

        Similar to the class member function URL::protocolIsData(), add a class member function to
        class URL to determine if a URL is a blob URL.

        No functionality was changed. So, no new tests.

        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::shouldUseInnerURL): Modified to use URL::protocolIsBlob().
        (WebCore::getCachedOrigin): Ditto.
        * platform/URL.h:
        (WebCore::URL::protocolIsBlob): Added.
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (webKitWebSrcStart): Modified to use URL::protocolIsBlob().
        (urlHasSupportedProtocol): Ditto.
        * workers/Worker.cpp:
        (WebCore::Worker::didReceiveResponse): Ditto.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Ditto.

2016-03-07  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Implement MediaEndpointPeerConnection::createOffer()
        https://bugs.webkit.org/show_bug.cgi?id=154867

        Reviewed by Eric Carlson and Jer Noble.

        - MediaEndpointPeerConnection: Initial implementation of createOffer()
        added. createOffer() is split up into a synchronous part, and a
        scheduled task. The task will be deferred until information, requiring
        some amount of work, such as the DTLS fingerprint is available. Other
        async API functions will also follow this pattern.

        - SDPProcessor (added): The SDPProcessors parses SDP to a
        MediaEndpointSessionConfiguration object and generates SDP in the
        reverse direction. Any SDP string handling is confined to the
        SDPProcessor and all configuration of the media session is done via the
        MediaEndpointSessionConfiguration object.

        The SDP parser and generator logic is implemented in JavaScript and
        works with JSON (SDP->JSON, JSON->SDP). The SDPProcessor runs JS in an
        isolated scope and converts JSON to a MediaEndpointSessionConfiguration
        object and the reverse. Using JSON signaling (nonstandard) can be
        helpful during debugging.

        - MockMediaEndpoint (added): Mock MediaEndpoint implementation with
        support for generating offers. DTLS information, such as fingerprint,
        is hard coded to facilitate testing with expected values.

        Test: fast/mediastream/RTCPeerConnection-inspect-offer.html

        The test is currently skipped on the mac port until support to read the
        SDPProcessor JavaScript resource is added.

        * CMakeLists.txt:
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::WrappedSessionDescriptionPromise::create):
        (WebCore::WrappedSessionDescriptionPromise::promise):
        (WebCore::WrappedSessionDescriptionPromise::WrappedSessionDescriptionPromise):
        (WebCore::randomString):
        (WebCore::MediaEndpointPeerConnection::MediaEndpointPeerConnection):
        (WebCore::MediaEndpointPeerConnection::runTask):
        (WebCore::MediaEndpointPeerConnection::startRunningTasks):
        (WebCore::MediaEndpointPeerConnection::createOffer):
        (WebCore::MediaEndpointPeerConnection::createOfferTask):
        (WebCore::MediaEndpointPeerConnection::gotDtlsFingerprint):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * Modules/mediastream/SDPProcessor.cpp: Added.
        (WebCore::SDPProcessor::SDPProcessor):
        (WebCore::createCandidateObject):
        (WebCore::createCandidate):
        (WebCore::configurationFromJSON):
        (WebCore::iceCandidateFromJSON):
        (WebCore::configurationToJSON):
        (WebCore::iceCandidateToJSON):
        (WebCore::SDPProcessor::generate):
        (WebCore::SDPProcessor::parse):
        (WebCore::SDPProcessor::generateCandidateLine):
        (WebCore::SDPProcessor::parseCandidateLine):
        (WebCore::SDPProcessor::callScript):
        * Modules/mediastream/SDPProcessor.h: Added.
        * Modules/mediastream/sdp.js: Added.
        (match):
        (addDefaults):
        (fillTemplate):
        (SDP.parse):
        (SDP.generate):
        (SDP.generateCandidateLine):
        (hasAllProperties):
        (SDP.verifyObject):
        (generate):
        (parse):
        (generateCandidateLine):
        (parseCandidateLine):
        * PlatformGTK.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/mediastream/MediaEndpoint.cpp:
        (WebCore::createMediaEndpoint):
        * platform/mediastream/MediaEndpoint.h:
        * platform/mediastream/PeerMediaDescription.h:
        * platform/mediastream/SDPProcessorScriptResource.cpp: Added.
        (WebCore::SDPProcessorScriptResource::scriptString):
        * platform/mediastream/SDPProcessorScriptResource.h: Added.
        * platform/mediastream/gtk/SDPProcessorScriptResourceGtk.cpp: Added.
        (WebCore::SDPProcessorScriptResource::scriptString):
        * platform/mock/MockMediaEndpoint.cpp: Added.
        (WebCore::MockMediaEndpoint::create):
        (WebCore::MockMediaEndpoint::MockMediaEndpoint):
        (WebCore::MockMediaEndpoint::~MockMediaEndpoint):
        (WebCore::MockMediaEndpoint::setConfiguration):
        (WebCore::MockMediaEndpoint::generateDtlsInfo):
        (WebCore::MockMediaEndpoint::getDefaultAudioPayloads):
        (WebCore::MockMediaEndpoint::getDefaultVideoPayloads):
        (WebCore::MockMediaEndpoint::updateReceiveConfiguration):
        (WebCore::MockMediaEndpoint::updateSendConfiguration):
        (WebCore::MockMediaEndpoint::addRemoteCandidate):
        (WebCore::MockMediaEndpoint::replaceSendSource):
        (WebCore::MockMediaEndpoint::stop):
        * platform/mock/MockMediaEndpoint.h: Added.
        * testing/Internals.cpp:
        (WebCore::Internals::Internals):
        (WebCore::Internals::enableMockMediaEndpoint):
        * testing/Internals.h:

2016-03-07  Daniel Bates  <dabates@apple.com>

        CSP: object-src directive should prohibit creation of nested browsing context
        https://bugs.webkit.org/show_bug.cgi?id=153153
        <rdar://problem/24383209>

        Reviewed by Brent Fulgham.

        Enforce the Content Security Policy object-src directive when fetching a URL for content
        that will cause an HTML object or HTML embed element to act as a nested browsing context
        (i.e. behave as if the content was loaded in an HTML iframe element). This makes our
        enforcement of the object-src directive match the behavior of the object-src directive
        in the Content Security Policy 2.0 spec., <http://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Tests: http/tests/security/contentSecurityPolicy/embed-src-url-blocked.html
               http/tests/security/contentSecurityPolicy/embed-src-url-blocked2.html
               http/tests/security/contentSecurityPolicy/object-src-param-src-blocked2.html
               http/tests/security/contentSecurityPolicy/object-src-url-blocked2.html

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::isPluginContentAllowedByContentSecurityPolicy): Extracted from SubframeLoader::pluginIsLoadable().
        Checks if the plugin element is allowed by the Content Security Policy to load the URL and MIME type.
        (WebCore::SubframeLoader::pluginIsLoadable): Extract out the logic for determining if
        the plugin content is allowed to load by the Content Security Policy into SubframeLoader::isPluginContentAllowedByContentSecurityPolicy()
        and make use of this function.
        (WebCore::SubframeLoader::requestObject): Modified to call SubframeLoader::isPluginContentAllowedByContentSecurityPolicy()
        before loading plugin content into a sub frame. If the plugin content is not allowed to load then we
        mark the plugin as unavailable with the reason being that it was blocked by the Content Security Policy.
        * loader/SubframeLoader.h:

2016-03-06  Gavin Barraclough  <barraclough@apple.com>

        Convert DOMTimer to std::chrono::milliseconds
        https://bugs.webkit.org/show_bug.cgi?id=155085

        Reviewed by Andreas Kling.

        DOMTimer currently uses a mix of millisecond (was int, now std::chrono) and second (as double)
        time values. Constant conversion back and forth is a complete mess. Stop that.

        * dom/Document.cpp:
        (WebCore::Document::minimumTimerInterval):
        (WebCore::Document::timerAlignmentInterval):
        * dom/Document.h:
            - double -> std::chrono::milliseconds
        * dom/ScriptExecutionContext.cpp:
        (WebCore::ScriptExecutionContext::adjustMinimumTimerInterval):
        (WebCore::ScriptExecutionContext::minimumTimerInterval):
        (WebCore::ScriptExecutionContext::timerAlignmentInterval):
        * dom/ScriptExecutionContext.h:
            - double -> std::chrono::milliseconds
        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::updateTimerIntervalIfNecessary):
        (WebCore::DOMTimer::intervalClampedToMinimum):
        (WebCore::DOMTimer::alignedFireTime):
        * page/DOMTimer.h:
            - double -> std::chrono::milliseconds
        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingState):
        (WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
        (WebCore::Page::updateDOMTimerAlignmentInterval):
        * page/Page.h:
            - double -> std::chrono::milliseconds
        * page/Settings.cpp:
        (WebCore::Settings::setNeedsAdobeFrameReloadingQuirk):
        (WebCore::Settings::setMinimumDOMTimerInterval):
        * page/Settings.h:
            - double -> std::chrono::milliseconds
        * page/SuspendableTimer.h:
        (WebCore::SuspendableTimer::startRepeating):
        (WebCore::SuspendableTimer::startOneShot):
        (WebCore::SuspendableTimer::repeatIntervalMS):
        (WebCore::SuspendableTimer::augmentFireInterval):
        (WebCore::SuspendableTimer::augmentRepeatInterval):
            - added std::chrono::milliseconds interface.
        * platform/Timer.cpp:
        (WebCore::TimerBase::setNextFireTime):
            - restructured for new alignedFireTime signatured, moved zero-delay handling to here.
              This change made because inside alignedFireTime fireTime will have already been truncated.
        * platform/Timer.h:
        (WebCore::TimerBase::msToSeconds):
        (WebCore::TimerBase::secondsToMS):
            - internal helper functions to bridge std::chrono::milliseconds to internal double.
        (WebCore::TimerBase::startRepeating):
        (WebCore::TimerBase::startOneShot):
        (WebCore::TimerBase::repeatIntervalMS):
        (WebCore::TimerBase::augmentFireInterval):
        (WebCore::TimerBase::augmentRepeatInterval):
            - expanded std::chrono::milliseconds interface.
        (WebCore::TimerBase::alignedFireTime):
            - changed to std::chrono::milliseconds, made return value Optional (null means no alignment).
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setMinimumTimerInterval):
        * testing/InternalSettings.h:
            - double -> std::chrono::milliseconds

2016-03-07  Andreas Kling  <akling@apple.com>

        Make RenderStyle copy-on-write a bit less.
        <https://webkit.org/b/155106>

        Reviewed by Antti Koivisto.

        Add a cheesy SET_NESTED_VAR macro complement to SET_VAR so we can avoid copy-on-write
        detachment of nested RenderStyle substructures when the leaf value doesn't change.

        I spotted about 300kB of these mistakes being made during PLT on iOS, most of them
        in the transformX setter.

        * rendering/style/RenderStyle.h:

2016-03-07  Miguel Gomez  <magomez@igalia.com>

        [TextureMapper] [BitmapTexturePool] Use appropriate list size when freeing textures
        https://bugs.webkit.org/show_bug.cgi?id=155105

        Reviewed by Žan Doberšek.

        Use appropriate list size when releasing the textures used as attachment.
        This is a fix for the patch to https://bugs.webkit.org/show_bug.cgi?id=154965.

        No new tests because no new functionality was added.

        * platform/graphics/texmap/BitmapTexturePool.cpp:
        (WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired):

2016-03-06  Benjamin Poulain  <bpoulain@apple.com>

        [JSC] Improve codegen of Compare and Test
        https://bugs.webkit.org/show_bug.cgi?id=155055

        Reviewed by Filip Pizlo.

        * cssjit/FunctionCall.h:
        (WebCore::FunctionCall::callAndBranchOnCondition):

2016-03-06  Saam Barati  <sbarati@apple.com>

        [[GetPrototypeOf]] should be a fully virtual method in the method table
        https://bugs.webkit.org/show_bug.cgi?id=155002

        Reviewed by Filip Pizlo.

        Change ::getPrototype(.) to ::prototype(.) in various places to prevent
        a naming conflict with JSC.

        No new tests because no new functionality was added.

        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::setWindow):
        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::initializeProperties):
        (WebCore::JSImageConstructor::prototypeForStructure):
        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::initScript):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        (GenerateConstructorHelperMethods):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::JSTestActiveDOMObjectConstructor::initializeProperties):
        (WebCore::JSTestActiveDOMObject::createPrototype):
        (WebCore::JSTestActiveDOMObject::prototype):
        (WebCore::JSTestActiveDOMObject::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::JSTestClassWithJSBuiltinConstructorConstructor::initializeProperties):
        (WebCore::JSTestClassWithJSBuiltinConstructor::createPrototype):
        (WebCore::JSTestClassWithJSBuiltinConstructor::prototype):
        (WebCore::JSTestClassWithJSBuiltinConstructor::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::initializeProperties):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::createPrototype):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::prototype):
        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetterConstructor::initializeProperties):
        (WebCore::JSTestCustomNamedGetter::createPrototype):
        (WebCore::JSTestCustomNamedGetter::prototype):
        (WebCore::JSTestCustomNamedGetter::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::initializeProperties):
        (WebCore::JSTestEventConstructor::createPrototype):
        (WebCore::JSTestEventConstructor::prototype):
        (WebCore::JSTestEventConstructor::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTargetConstructor::initializeProperties):
        (WebCore::JSTestEventTarget::createPrototype):
        (WebCore::JSTestEventTarget::prototype):
        (WebCore::JSTestEventTarget::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::JSTestExceptionConstructor::initializeProperties):
        (WebCore::JSTestException::createPrototype):
        (WebCore::JSTestException::prototype):
        (WebCore::JSTestException::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::JSTestGenerateIsReachableConstructor::initializeProperties):
        (WebCore::JSTestGenerateIsReachable::createPrototype):
        (WebCore::JSTestGenerateIsReachable::prototype):
        (WebCore::JSTestGenerateIsReachable::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceConstructor::initializeProperties):
        (WebCore::JSTestInterface::createPrototype):
        (WebCore::JSTestInterface::prototype):
        (WebCore::JSTestInterface::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::JSTestJSBuiltinConstructorConstructor::initializeProperties):
        (WebCore::JSTestJSBuiltinConstructor::createPrototype):
        (WebCore::JSTestJSBuiltinConstructor::prototype):
        (WebCore::JSTestJSBuiltinConstructor::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::JSTestMediaQueryListListenerConstructor::initializeProperties):
        (WebCore::JSTestMediaQueryListListener::createPrototype):
        (WebCore::JSTestMediaQueryListListener::prototype):
        (WebCore::JSTestMediaQueryListListener::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::JSTestNamedConstructorConstructor::initializeProperties):
        (WebCore::JSTestNamedConstructorNamedConstructor::initializeProperties):
        (WebCore::JSTestNamedConstructor::createPrototype):
        (WebCore::JSTestNamedConstructor::prototype):
        (WebCore::JSTestNamedConstructor::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::JSTestNodeConstructor::initializeProperties):
        (WebCore::JSTestNode::createPrototype):
        (WebCore::JSTestNode::prototype):
        (WebCore::JSTestNode::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestNode.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::JSTestNondeterministicConstructor::initializeProperties):
        (WebCore::JSTestNondeterministic::createPrototype):
        (WebCore::JSTestNondeterministic::prototype):
        (WebCore::JSTestNondeterministic::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjConstructor::initializeProperties):
        (WebCore::JSTestObj::createPrototype):
        (WebCore::JSTestObj::prototype):
        (WebCore::JSTestObj::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::JSTestOverloadedConstructorsConstructor::initializeProperties):
        (WebCore::JSTestOverloadedConstructors::createPrototype):
        (WebCore::JSTestOverloadedConstructors::prototype):
        (WebCore::JSTestOverloadedConstructors::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::JSTestOverrideBuiltinsConstructor::initializeProperties):
        (WebCore::JSTestOverrideBuiltins::createPrototype):
        (WebCore::JSTestOverrideBuiltins::prototype):
        (WebCore::JSTestOverrideBuiltins::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::initializeProperties):
        (WebCore::JSTestSerializedScriptValueInterface::createPrototype):
        (WebCore::JSTestSerializedScriptValueInterface::prototype):
        (WebCore::JSTestSerializedScriptValueInterface::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::JSTestTypedefsConstructor::initializeProperties):
        (WebCore::JSTestTypedefs::createPrototype):
        (WebCore::JSTestTypedefs::prototype):
        (WebCore::JSTestTypedefs::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::JSattributeConstructor::initializeProperties):
        (WebCore::JSattribute::createPrototype):
        (WebCore::JSattribute::prototype):
        (WebCore::JSattribute::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSattribute.h:
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::JSreadonlyConstructor::initializeProperties):
        (WebCore::JSreadonly::createPrototype):
        (WebCore::JSreadonly::prototype):
        (WebCore::JSreadonly::getPrototype): Deleted.
        * bindings/scripts/test/JS/JSreadonly.h:

2016-03-06  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Enable DOM class create functions to take parameters in case of JSBuiltinConstructor
        https://bugs.webkit.org/show_bug.cgi?id=155022

        Reviewed by Darin Adler.

        Introducing JSDOMObjectInspector to check whether a given JS class is built-in (no DOM class).
        If that is not the case, the JS class wraps a DOM class.
        The inspector detects whether the DOM class create static method takes no parameter or some parameters.
        This is used in JSDOMConstructor.h to generate correctly the createJSObject functions needed by JSBuiltinConstructor.

        Updated binding generator to not generate anymore createJSObject as it is handled directly in JSDOMConstructor.h.

        Covered by existing tests.

        * bindings/js/JSDOMConstructor.h:
        (WebCore::JSBuiltinConstructor<JSClass>::callConstructor):
        (WebCore::createJSObject):
        (WebCore::JSBuiltinConstructor<JSClass>::construct):
        * bindings/js/JSDOMWrapper.h:
        * bindings/js/JSKeyValueIterator.h: Taking benefit of JSClass::DOMWrapper type declaration.
        * bindings/js/JSReadableStreamPrivateConstructors.cpp:
        (WebCore::JSBuiltinReadableStreamReaderPrivateConstructor::initializeExecutable): Deleted.
        (WebCore::JSBuiltinReadableStreamControllerPrivateConstructor::initializeExecutable): Deleted.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition): Deleted.
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::JSTestClassWithJSBuiltinConstructorConstructor::prototypeForStructure): Deleted.

2016-03-06  Antti Koivisto  <antti@apple.com>

        RenderTextControlSingleLine shouldn't mutate placeholder element inline style
        https://bugs.webkit.org/show_bug.cgi?id=155086

        Reviewed by Andreas Kling.

        Text field placeholder element is currently managed by changing its inline style
        from the host renderer based on the host style and state. Rendering poking
        into DOM is wrong.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setRangeText):
        (WebCore::HTMLInputElement::shouldTruncateText):

            Add a helper.

        (WebCore::HTMLInputElement::createInnerTextStyle):
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
        (WebCore::HTMLTextAreaElement::placeholderElement):
        (WebCore::HTMLTextAreaElement::matchesReadWritePseudoClass):
        (WebCore::HTMLTextAreaElement::updatePlaceholderText):

            Use the new shadow element.

        * html/HTMLTextAreaElement.h:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::updatePlaceholderVisibility):

            No more poking to inline style.

        (WebCore::HTMLTextFormControlElement::setSelectionStart):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::updatePlaceholderText):

            Use the new shadow element.

        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):

            Add a subclass for the placeholder element instead of just using div.

        (WebCore::TextControlPlaceholderElement::customStyleForRenderer):

            Compute style base on the host state and style.

        (WebCore::SearchFieldResultsButtonElement::SearchFieldResultsButtonElement):
        * html/shadow/TextControlInnerElements.h:
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::styleDidChange):

            No more setInlineStyleProperty.
            This now needs to trigger layout like it does with other inner elements.

        (WebCore::RenderTextControlSingleLine::computeControlLogicalHeight):
        (WebCore::RenderTextControlSingleLine::autoscroll):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated): Deleted.
        * rendering/RenderTextControlSingleLine.h:

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Add the support for upgrading custom elements in cloneNode
        https://bugs.webkit.org/show_bug.cgi?id=155062

        Reviewed by Antti Koivisto.

        Implement https://w3c.github.io/webcomponents/spec/custom/#upgrading and steps 6 through 11 in
        https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor to support upgrading elements
        created by Node.prototype.cloneNode.

        Tests: fast/custom-elements/lifecycle-callback-timing.html
               fast/custom-elements/upgrading/Node-cloneNode.html

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::upgradeElement): Added. Implements
         https://w3c.github.io/webcomponents/spec/custom/#dfn-upgrade-a-custom-element
        (WebCore::JSCustomElementInterface::didUpgradeLastElementInConstructionStack): Added. Implements step 10
         "Replace the last entry in definition's construction stacka with an already constructed marker."
         in https://w3c.github.io/webcomponents/spec/custom/#dom-htmlelement-constructor
        * bindings/js/JSCustomElementInterface.h:
        (WebCore::JSCustomElementInterface::isUpgradingElement):
        (WebCore::JSCustomElementInterface::lastElementInConstructionStack):
        (WebCore::JSCustomElementInterface): Added m_constructionStack. This is the construction stack:
         https://w3c.github.io/webcomponents/spec/custom/#dfn-element-definition-construction-stack
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::throwInvalidStateError): Added.
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement): Implement the upgrading case in:
         https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor
        * dom/Document.cpp:
        (WebCore::createFallbackHTMLElement): Added. Enqueues upgrades of custom elements (enqueueElementUpgrade
         currently does nothing if there is no InvokesCustomElementLifecycleCallbacks; e.g. in other DOM APIs).
         This function implements https://w3c.github.io/webcomponents/spec/custom/#dfn-element-upgrade-algorithm
        (WebCore::Document::createElement):
        * dom/LifecycleCallbackQueue.cpp:
        (WebCore::LifecycleQueueItem::LifecycleQueueItem): Added a generic constructor.
        (WebCore::LifecycleQueueItem::invoke): Call upgradeElement when m_type is Type::ElementUpgrade.
        (WebCore::LifecycleCallbackQueue::enqueueElementUpgrade): Added.
        * dom/LifecycleCallbackQueue.h:
        * dom/Node.idl: Added InvokesCustomElementLifecycleCallbacks on cloneNode.
        * dom/make_names.pl:
        (printFactoryCppFile): Added a variant of createKnownElement which takes QualifiedName. Also directly call
         find(HTML|SVG|MathML)ElementConstructorFunction in createElement that takes AtomicString to avoid an extra
         function call.
        (printFactoryHeaderFile): Added a function declaration for createKnownElement that takes QualifiedName and
         outdented class and function declarations to match the modern code style guideline.

2016-03-05  Tim Horton  <timothy_horton@apple.com>

        Create a DOMHTMLVideoElement when wrapping <video> elements
        https://bugs.webkit.org/show_bug.cgi?id=155084
        <rdar://problem/24997193>

        Reviewed by Dan Bernstein.

        * bindings/objc/DOM.mm:
        (WebCore::createElementClassMap):
        Add <video> to the mapping.

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Minor cleans up in custom elements' code per Darin's comments
        https://bugs.webkit.org/show_bug.cgi?id=155081

        Reviewed by Darin Adler.

        Cleanup per Darin's comments.

        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::findInterface): Use get instead of explicitly checking against end().
        * dom/LifecycleCallbackQueue.h: Remove unecessary header includes.

2016-03-05  Sam Weinig  <sam@webkit.org>

        Fix two minor typos from http://trac.webkit.org/changeset/197626 that were causing some test failures.

        * html/Autofill.cpp:
        (WebCore::fieldNameMap):
        (WebCore::AutofillData::createFromHTMLFormControlElement):

2016-03-05  Chris Dumez  <cdumez@apple.com>

        Consolidate RuntimeApplicationChecks and RuntimeApplicationChecksIOS
        https://bugs.webkit.org/show_bug.cgi?id=155035

        Reviewed by Darin Adler.

        Consolidate RuntimeApplicationChecks and RuntimeApplicationChecksIOS into
        one file. The following changes were made:
        - The checks now all rely on applicationBundleIdentifier(), which has the
          benefit of working in WK1 and WK2 UI/WebContent/Networking processes.
        - Use namespaces to distinguish Mac and iOS applications instead of relying
          on the method name. So, applicationIsIBooksForIOS() becomes
          IOSApplication::isIBooks().
        - Use NSBundle API on both iOS and Mac instead of using the CF API on Mac
          and the NS API on iOS.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper _accessibilityWebDocumentView]):
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::commonVM):
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        * html/HTMLMediaElement.cpp:
        * html/HTMLObjectElement.cpp:
        (WebCore::shouldNotPerformURLAdjustment):
        * html/MediaElementSession.cpp:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::currentRunLoop):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::willLoadMediaElementURL):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::create):
        (WebCore::SubresourceLoader::startLoading):
        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::shouldIgnoreHTTPStatusCodeErrors):
        * platform/RuntimeApplicationChecks.cpp: Removed.
        * platform/RuntimeApplicationChecks.h:
        * platform/RuntimeApplicationChecks.mm: Added.
        (WebCore::applicationBundleIdentifier):
        (WebCore::applicationBundleIsEqualTo):
        (WebCore::MacApplication::isSafari):
        (WebCore::MacApplication::isAppleMail):
        (WebCore::MacApplication::isIBooks):
        (WebCore::MacApplication::isITunes):
        (WebCore::MacApplication::isMicrosoftMessenger):
        (WebCore::MacApplication::isAdobeInstaller):
        (WebCore::MacApplication::isAOLInstantMessenger):
        (WebCore::MacApplication::isMicrosoftMyDay):
        (WebCore::MacApplication::isMicrosoftOutlook):
        (WebCore::MacApplication::isQuickenEssentials):
        (WebCore::MacApplication::isAperture):
        (WebCore::MacApplication::isVersions):
        (WebCore::MacApplication::isHRBlock):
        (WebCore::MacApplication::isSolidStateNetworksDownloader):
        (WebCore::MacApplication::isHipChat):
        (WebCore::IOSApplication::isMobileMail):
        (WebCore::IOSApplication::isMobileSafari):
        (WebCore::IOSApplication::isDumpRenderTree):
        (WebCore::IOSApplication::isMobileStore):
        (WebCore::IOSApplication::isWebApp):
        (WebCore::IOSApplication::isOkCupid):
        (WebCore::IOSApplication::isFacebook):
        (WebCore::IOSApplication::isDaijisenDictionary):
        (WebCore::IOSApplication::isNASAHD):
        (WebCore::IOSApplication::isTheEconomistOnIphone):
        (WebCore::IOSApplication::isWebProcess):
        (WebCore::IOSApplication::isIBooks):
        (WebCore::setApplicationBundleIdentifier):
        * platform/RuntimeApplicationChecksIOS.h: Removed.
        * platform/RuntimeApplicationChecksIOS.mm: Removed.
        * platform/audio/ios/AudioDestinationIOS.cpp:
        * platform/cf/URLCF.cpp:
        * platform/graphics/ca/cocoa/LayerFlushSchedulerMac.cpp:
        (WebCore::currentRunLoop):
        * platform/ios/PasteboardIOS.mm:
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        * platform/ios/wak/WebCoreThread.mm:
        (WebThreadEnable):
        * platform/mac/WidgetMac.mm:
        (WebCore::Widget::paint):
        * platform/network/ios/QuickLook.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::needsIOSDumpRenderTreeMainFrameRenderViewLayerIsAlwaysOpaqueHack):

2016-03-05  Zalan Bujtas  <zalan@apple.com>

        Make table collapsed borders subpixel aware.
        https://bugs.webkit.org/show_bug.cgi?id=150383

        Reviewed by Simon Fraser.

        This patch enables authors to 
        - set subpixel width on collapsed borders
        - and push those borders to subpixel positions.

        Test: fast/table/collapsed-border-with-odd-pixel-width.html

        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::calcBorderStart):
        (WebCore::RenderTable::calcBorderEnd):
        (WebCore::RenderTable::outerBorderBefore):
        (WebCore::RenderTable::outerBorderAfter):
        (WebCore::RenderTable::outerBorderStart):
        (WebCore::RenderTable::outerBorderEnd):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::borderHalfStart):
        (WebCore::RenderTableCell::borderHalfEnd):
        (WebCore::RenderTableCell::borderHalfBefore):
        (WebCore::RenderTableCell::borderHalfAfter):
        (WebCore::RenderTableCell::paintCollapsedBorders):
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::calcOuterBorderBefore):
        (WebCore::RenderTableSection::calcOuterBorderAfter):
        (WebCore::RenderTableSection::calcOuterBorderStart):
        (WebCore::RenderTableSection::calcOuterBorderEnd):
        * rendering/style/CollapsedBorderValue.h:
        (WebCore::CollapsedBorderValue::adjustedCollapsedBorderWidth):

2016-03-05  Sam Weinig  <sam@webkit.org>

        Add support for processing the autofill field name out of form control elements ultimately to aid input methods
        <rdar://problem/23041180>
        https://bugs.webkit.org/show_bug.cgi?id=155079

        Reviewed by Enrica Casucci.

        Added additional cases to fast/forms/autocomplete-tokens.html.

        * WebCore.xcodeproj/project.pbxproj:
        Add Autofill.h/cpp

        * html/Autofill.cpp: Added.
        (WebCore::fieldNameMap):
        (WebCore::toAutofillFieldName):
        (WebCore::isContactToken):
        (WebCore::maxTokensForAutofillFieldCategory):
        (WebCore::AutofillData::createFromHTMLFormControlElement):
        * html/Autofill.h: Added.
        (WebCore::AutofillData::AutofillData):
        Refactored the autofill data processing algorithm into it's own file and added support
        returning not just the IDL-exposed autofill value but also the autofill field name. The
        code is structured simply enough that if we find a need for the hint set or scope information
        we could return it as well.

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::autocomplete):
        (WebCore::HTMLFormControlElement::setAutocomplete):
        (WebCore::HTMLFormControlElement::autofillMantle):
        (WebCore::HTMLFormControlElement::autofillData):
        Use AutofillData to implement these.

        * html/HTMLFormControlElement.h:
        Expose accessor for mantle and AutofillData.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::autocomplete):
        * html/HTMLFormElement.h:
        Switch to return an AtomicString as it will always
        return one of two known values.

        * testing/Internals.cpp:
        (WebCore::Internals::autofillFieldName):
        * testing/Internals.h:
        * testing/Internals.idl:
        Add accessor of the field name for testing purposes.

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Build fix after r197612 (under ASAN/GuardMalloc).

        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::findInterface):

2016-03-05  Michael Catanzaro  <mcatanzaro@igalia.com>

        Unreviewed, fix GTK/EFL build after r197575 and add mandatory GnuTLS dependency

        * PlatformEfl.cmake:
        * PlatformGTK.cmake:

2016-03-05  Simon Fraser  <simon.fraser@apple.com>

        Add support for the object-position CSS property
        https://bugs.webkit.org/show_bug.cgi?id=122811
        rdar://problem/15836338

        Reviewed by Sam Weinig.

        Take object-position into account when rendering replaced elements.
        RenderReplaced::replacedContentRect() is the one place where we compute
        the content rect for replaced elements.

        Also return false from foregroundIsKnownToBeOpaqueInRect() if we have
        any non-default object-position, as the foreground may no longer fill the box.

        Tests: compositing/video/video-object-position.html
               fast/css/object-position/object-position-canvas.html
               fast/css/object-position/object-position-embed.html
               fast/css/object-position/object-position-img-svg.html
               fast/css/object-position/object-position-img.html
               fast/css/object-position/object-position-input-image.html
               fast/css/object-position/object-position-object.html
               fast/css/object-position/object-position-video-poster.html

        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::foregroundIsKnownToBeOpaqueInRect):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::replacedContentRect):

2016-03-05  Simon Fraser  <simon.fraser@apple.com>

        Add parsing support for object-position
        https://bugs.webkit.org/show_bug.cgi?id=155065

        Reviewed by Sam Weinig.
        
        Add parsing support for object-position. This is the first property with
        CSS <position> values which does not have equivalent -x and -y shorthands,
        so we can store it as a new LengthPoint type.
        
        Per the CSS Values spec, bottom- and right-relative values are translated
        into calc() expressions, which are exposed via computed style. For example,
        "right 10px bottom" becomes "calc(100% - 10px) 100%". This also allows transitions
        between, say, "left 10px bottom" and "right 10px bottom".

        Test: fast/css/object-position/parsing-object-position.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        * css/CSSPrimitiveValue.h:
        (WebCore::CSSPrimitiveValue::isPair):
        * css/CSSPropertyNames.in:
        * css/CSSValue.h:
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertLength):
        (WebCore::StyleBuilderConverter::convertTo100PercentMinusLength):
        (WebCore::StyleBuilderConverter::convertPositionComponent):
        (WebCore::StyleBuilderConverter::convertObjectPosition):
        * platform/LengthPoint.cpp: Added.
        (WebCore::operator<<):
        * platform/LengthPoint.h: Added.
        (WebCore::LengthPoint::LengthPoint):
        (WebCore::LengthPoint::operator==):
        (WebCore::LengthPoint::setX):
        (WebCore::LengthPoint::x):
        (WebCore::LengthPoint::setY):
        (WebCore::LengthPoint::y):
        (WebCore::LengthPoint::blend):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresRepaint):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:

2016-03-05  Joanmarie Diggs  <jdiggs@igalia.com>

        AX: Implement missing/different accessibility API mappings for SVG
        https://bugs.webkit.org/show_bug.cgi?id=155034

        Reviewed by Chris Fleizach.

        Create an AccessibilitySVGElement class for the SVG-specific mappings;
        fix name and description mappings for ATK; add new AccessibilityRole
        types (SVGTextRole, SVGTSpanRole, SVGTextPathRole) and map them for
        ATK and AX API.

        Tests: accessibility/w3c-svg-description-calculation.html
               accessibility/w3c-svg-elements-not-exposed.html
               accessibility/w3c-svg-name-calculation.html
               accessibility/w3c-svg-presentational-role.html
               accessibility/w3c-svg-roles.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * accessibility/AXObjectCache.cpp:
        (WebCore::createFromRenderer):
        * accessibility/AccessibilityAllInOne.cpp:
        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::AccessibilityNodeObject::alternativeText): Deleted.
        (WebCore::AccessibilityNodeObject::accessibilityDescription): Deleted.
        * accessibility/AccessibilityObject.h:
        (WebCore::AccessibilityObject::isAccessibilitySVGElement):
        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::determineAccessibilityRole): Deleted.
        * accessibility/AccessibilitySVGElement.cpp: Added.
        (WebCore::AccessibilitySVGElement::AccessibilitySVGElement):
        (WebCore::AccessibilitySVGElement::~AccessibilitySVGElement):
        (WebCore::AccessibilitySVGElement::create):
        (WebCore::AccessibilitySVGElement::targetForUseElement):
        (WebCore::AccessibilitySVGElement::accessibilityText):
        (WebCore::AccessibilitySVGElement::accessibilityDescription):
        (WebCore::AccessibilitySVGElement::helpText):
        (WebCore::AccessibilitySVGElement::computeAccessibilityIsIgnored):
        (WebCore::AccessibilitySVGElement::inheritsPresentationalRole):
        (WebCore::AccessibilitySVGElement::determineAriaRoleAttribute):
        (WebCore::AccessibilitySVGElement::determineAccessibilityRole):
        * accessibility/AccessibilitySVGElement.h: Added.
        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetName):
        (webkitAccessibleGetDescription):
        (atkRole):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityObjectWrapper determineIsAccessibilityElement]):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (createAccessibilityRoleMap):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::isSVGTSpan):
        * rendering/svg/RenderSVGTSpan.h:

2016-03-05  Yusuke Suzuki  <utatane.tea@gmail.com>

        [ES6] Support Reflect.construct
        https://bugs.webkit.org/show_bug.cgi?id=147330

        Reviewed by Saam Barati.

        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::installReplacement):
        * bindings/js/CallbackFunction.cpp:
        (WebCore::checkFunctionOnlyCallback):
        * bindings/js/JSCallbackData.cpp:
        (WebCore::JSCallbackData::invokeCallback):
        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::constructElement):
        (WebCore::JSCustomElementInterface::attributeChanged):
        * bindings/js/JSCustomXPathNSResolver.cpp:
        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::callFunctionWithCurrentArguments):
        (WebCore::DOMConstructorObject::getCallData):
        * bindings/js/JSDOMConstructor.h:
        (WebCore::JSDOMConstructorNotConstructable::getCallData):
        (WebCore::JSDOMConstructor<JSClass>::getConstructData):
        (WebCore::JSDOMNamedConstructor<JSClass>::getConstructData):
        (WebCore::JSBuiltinConstructor<JSClass>::getConstructData):
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::DeferredWrapper::callFunction):
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement):
        * bindings/js/JSErrorHandler.cpp:
        (WebCore::JSErrorHandler::handleEvent):
        * bindings/js/JSEventListener.cpp:
        (WebCore::JSEventListener::handleEvent):
        * bindings/js/JSHTMLAllCollectionCustom.cpp:
        (WebCore::JSHTMLAllCollection::getCallData):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::open):
        * bindings/js/JSKeyValueIterator.h:
        (WebCore::keyValueIteratorForEach):
        * bindings/js/JSMainThreadExecStateInstrumentation.h:
        (WebCore::JSMainThreadExecState::instrumentFunctionCall):
        (WebCore::JSMainThreadExecState::instrumentFunctionConstruct):
        * bindings/js/JSMutationCallback.cpp:
        (WebCore::JSMutationCallback::call):
        * bindings/js/JSMutationObserverCustom.cpp:
        (WebCore::constructJSMutationObserver):
        * bindings/js/JSPluginElementFunctions.cpp:
        (WebCore::callPlugin):
        (WebCore::pluginElementGetCallData):
        * bindings/js/ScheduledAction.cpp:
        (WebCore::ScheduledAction::create):
        (WebCore::ScheduledAction::executeFunctionInContext):
        * bindings/objc/WebScriptObject.mm:
        (-[WebScriptObject callWebScriptMethod:withArguments:]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorHelperMethods):
        * bindings/scripts/test/JS/JSFloat64Array.cpp:
        (WebCore::JSFloat64ArrayConstructor::getConstructData):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::JSTestInterfaceConstructor::getConstructData):
        * bridge/NP_jsobject.cpp:
        (_NPN_InvokeDefault):
        (_NPN_Invoke):
        (_NPN_Construct):
        * bridge/objc/objc_runtime.mm:
        (JSC::Bindings::ObjcFallbackObjectImp::getCallData):
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::getCallData):
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::getCallData):
        (JSC::Bindings::RuntimeObject::getConstructData):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::updateCaptionContainer):
        (WebCore::HTMLMediaElement::didAddUserAgentShadowRoot):
        (WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot):
        * testing/Internals.cpp:
        (WebCore::Internals::isReadableStreamDisturbed):

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Fix the bindings test after r197611.

        * bindings/scripts/test/TestObj.idl:

2016-03-05  Ryosuke Niwa  <rniwa@webkit.org>

        Move QualifiedName from CustomElementInfo to JSCustomElementInterface
        https://bugs.webkit.org/show_bug.cgi?id=155061

        Reviewed by Antti Koivisto.

        Store QualifiedName of custom elements in JSCustomElementInterface instead of CustomElementInfo
        now that each interface is associated with exactly one custom element as of r197602.

        No new tests since this is a refactoring.

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::JSCustomElementInterface): Now takes QualifiedName as the
        first argument.
        * bindings/js/JSCustomElementInterface.h:
        (WebCore::JSCustomElementInterface::create):
        (WebCore::JSCustomElementInterface::name): Added.
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement):
        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement): Use findInterface instead of the deleted findName.
        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::checkName):
        (WebCore::CustomElementDefinitions::addElementDefinition): Renamed from defineElement.
        (WebCore::CustomElementDefinitions::findInterface): Add a variant that finds the interface object
        by a JS constructor.
        (WebCore::CustomElementDefinitions::containsConstructor):
        (WebCore::CustomElementDefinitions::findName): Deleted.
        * dom/CustomElementDefinitions.h:
        (WebCore::CustomElementDefinitions::CustomElementInfo::CustomElementInfo): Deleted.

2016-03-04  Ryosuke Niwa  <rniwa@webkit.org>

        Add basic support for attributeChanged lifecycle callback
        https://bugs.webkit.org/show_bug.cgi?id=155011

        Reviewed by Antti Koivisto.

        Add basic support for attributeChangedCallback in setAttribute, removeAttribute, setAttributeNS,
        remoteAttributeNS, setAttributeNode, and removeAttributeNS. There are many other DOM APIs that
        could modify attributes but we would annotate those APIs in a separate patch to limit the scope
        of this change.

        In order to invoke the lifecycle callback right before returning to the author script, allocate
        an instance of CustomElementLifecycleProcessingStack in each of these functions' binding code.
        The stack object's destructor invokes all callbacks enqueued by the DOM API if there are any.

        Spec: https://w3c.github.io/webcomponents/spec/custom/#dfn-attribute-changed-callback

        Tests: fast/custom-elements/attribute-changed-callback.html
               fast/custom-elements/lifecycle-callback-timing.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::attributeChanged): Added. Invokes attributeChangedCallback.
        * bindings/js/JSCustomElementInterface.h:
        * bindings/js/JSMainThreadExecState.h:
        (JSMainThreadNullState): Allocate an instance of CustomElementLifecycleProcessingStack in GObject
        and Objective-C binding code for consistency with JavaScript. We can't do this in JavaScript
        because there is no RAII object all functions, getters, and setters allocate (for a good reason).

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation): Generate an instance of CustomElementLifecycleProcessingStack when
        NeedsLifecycleProcessingStack is specified as an extended IDL attribute.
        * bindings/scripts/IDLAttributes.txt: Added NeedsLifecycleProcessingStack.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithNeedsLifecycleProcessingStack):
        * bindings/scripts/test/TestObj.idl: Added a test for NeedsLifecycleProcessingStack.

        * dom/DOMAllInOne.cpp:
        * dom/Element.cpp:
        (WebCore::Element::attributeChanged): Enqueue attributeChanged callback if the context object
        is a custom element and there is a CustomElementLifecycleProcessingStack allocated in the stack.
        * dom/Element.idl:

        * dom/LifecycleCallbackQueue.cpp: Added.
        (WebCore::LifecycleQueueItem): Added.
        (WebCore::LifecycleQueueItem::LifecycleQueueItem): Added.
        (WebCore::LifecycleQueueItem::invoke): Added.
        (WebCore::LifecycleCallbackQueue::LifecycleCallbackQueue): Added.
        (WebCore::LifecycleCallbackQueue::~LifecycleCallbackQueue): Added.
        (WebCore::LifecycleCallbackQueue::enqueueAttributeChangedCallback): Added.
        (WebCore::LifecycleCallbackQueue::invokeAll): Added.
        (WebCore::CustomElementLifecycleProcessingStack::ensureCurrentQueue): Added. As noted in FIXME,
        the early exit in the code is necessary only because we haven't added NeedsLifecycleProcessingStack
        in all places. It should go away in a follow up patch.
        (WebCore::CustomElementLifecycleProcessingStack::processQueue): Added.
        * dom/LifecycleCallbackQueue.h: Added.
        (WebCore::CustomElementLifecycleProcessingStack): This is a light weight RAII object the binding
        code will allocate in order to queue up lifecycle callbacks. We don't use Ref or std::unique_ptr
        in m_queue to avoid generating the code to destruct LifecycleCallbackQueue everywhere.
        (WebCore::CustomElementLifecycleProcessingStack::CustomElementLifecycleProcessingStack): Added.
        (WebCore::CustomElementLifecycleProcessingStack::~CustomElementLifecycleProcessingStack): Added.
        (WebCore::CustomElementLifecycleProcessingStack::hasCurrentProcessingStack): Added.

2016-03-04  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Scrollbars are broken again with GTK+ >= 3.19.11
        https://bugs.webkit.org/show_bug.cgi?id=154890

        Reviewed by Michael Catanzaro.

        Scrollbar style properties have been deprecated in GTK+, and it
        seems that now deprecating means keeping the properties but
        ignoring them. So, this reworks the whole scrollbars theme code
        again to not cache style properties anymore, but retrieve them
        from the GtkStyleContext. Previous GTK+ versions still need to
        query the style properties, so I've added helper functions to get
        all the style properties with the ifdefs, trying to keep the
        common render code free of GTK+ versions ifdefs.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::backButtonRect):
        (WebCore::ScrollbarThemeGtk::forwardButtonRect):
        (WebCore::ScrollbarThemeGtk::trackRect):
        (WebCore::ScrollbarThemeGtk::thumbRect):
        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
        (WebCore::ScrollbarThemeGtk::paintThumb):
        (WebCore::ScrollbarThemeGtk::paint):
        (WebCore::ScrollbarThemeGtk::scrollbarThickness):
        (WebCore::ScrollbarThemeGtk::buttonSize):
        (WebCore::ScrollbarThemeGtk::stepperSize):
        (WebCore::ScrollbarThemeGtk::getStepperSpacing):
        (WebCore::ScrollbarThemeGtk::troughUnderSteppers):
        (WebCore::ScrollbarThemeGtk::minimumThumbLength):
        (WebCore::ScrollbarThemeGtk::thumbFatness):
        (WebCore::ScrollbarThemeGtk::getTroughBorder):
        (WebCore::ScrollbarThemeGtk::getOrCreateStyleContext):
        (WebCore::ScrollbarThemeGtk::updateThemeProperties):
        (WebCore::ScrollbarThemeGtk::handleMousePressEvent):
        * platform/gtk/ScrollbarThemeGtk.h:

2016-03-04  Brent Fulgham  <bfulgham@apple.com>

        Resource load statistics are not honoring private browsing
        https://bugs.webkit.org/show_bug.cgi?id=155054
        <rdar://problem/24987873>

        Reviewed by Andy Estes.

        Modify the points where we capture resource load statistics to ignore
        loads made during private browsing. Do this by moving more of the logic
        about whether to gather statistics into the logging functions, passing
        the raw input types (frame, ResourceRequest, ResourceResponse) internally
        so that we don't pay any cost until we decide we want to gather data.s

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::willSendRequest): Revise for the new API on
        ResourceLoadObserver.
        * loader/ResourceLoadObserver.cpp:
        (WebCore::ResourceLoadObserver::logFrameNavigation): Revise signature and
        check for private browsing.
        (WebCore::ResourceLoadObserver::logSubresourceLoading): Ditto.
        (WebCore::ResourceLoadObserver::logUserInteraction): Ditto.
        * loader/ResourceLoadObserver.h:
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal): Ditto.

2016-03-04  Alex Christensen  <achristensen@webkit.org>

        Fix file mime-types when using NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=155058

        Reviewed by Andy Estes.

        This fixes platform/mac/fast/loader/file-url-mimetypes-3.html
        and platform/mac/fast/loader/file-url-mimetypes.html.

        * platform/network/mac/WebCoreURLResponse.h:

2016-03-04  Sam Weinig  <sam@webkit.org>

        [WebKit2] Add WebKit2 equivalent of -[WebView _insertNewlineInQuotedContent]
        <rdar://problem/24943591>
        https://bugs.webkit.org/show_bug.cgi?id=155057

        Reviewed by Tim Horton.

        Move Editor::insertParagraphSeparatorInQuotedContent() into Editor.cpp
        and remove the duplicated code in EditorIOS.mm and EditorMac.mm.

        * editing/Editor.cpp:
        (WebCore::Editor::insertParagraphSeparatorInQuotedContent):
        * editing/Editor.h:
        * editing/ios/EditorIOS.mm:
        (WebCore::Editor::insertParagraphSeparatorInQuotedContent): Deleted.
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::insertParagraphSeparatorInQuotedContent): Deleted.

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Convert DOMTimer interval from int to std::chromo::milliseconds
        https://bugs.webkit.org/show_bug.cgi?id=155051

        Speculative build fix.

        * inspector/TimelineRecordFactory.cpp:
        (WebCore::TimelineRecordFactory::createTimerInstallData):

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Convert DOMTimer interval from int to std::chromo::milliseconds
        https://bugs.webkit.org/show_bug.cgi?id=155051

        iOS build fix

        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::install):

2016-03-04  Ryosuke Niwa  <rniwa@webkit.org>

        Update defineCustomElement according to the spec rewrite
        https://bugs.webkit.org/show_bug.cgi?id=155010
        <rdar://problem/24970878>

        Reviewed by Chris Dumez.

        Updated the implementation of defineCustomElement and HTMLConstructor per recent rewrite of the spec:
        https://w3c.github.io/webcomponents/spec/custom/#dom-document-defineelement
        https://w3c.github.io/webcomponents/spec/custom/#htmlelement-constructor

        defineCustomElement is now called defineElement and we disallow defining multiple custom elements with
        a single class and throw an exception in defineElement.

        Test: fast/custom-elements/Document-defineElement.html

        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineElement): Renamed from defineCustomElement. Throw an exception when the interface
        already defines another custom element. Also added FIXME's for missing steps.

        * bindings/js/JSHTMLElementCustom.cpp:
        (WebCore::constructJSHTMLElement): Removed the support for specifying a tag name in the first argument when
        a single class defines multiple custom elements since that now results in an exception (in defineElement).

        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::containsConstructor): Added.
        * dom/CustomElementDefinitions.h:
        * dom/Document.idl: Renamed defineCustomElement to defineElement.
        * html/HTMLElement.idl: Removed the optional tag name from the constructor.

2016-03-04  Tim Horton  <timothy_horton@apple.com>

        Begin implementing <attachment> painting on iOS
        https://bugs.webkit.org/show_bug.cgi?id=155046
        <rdar://problem/24805991>

        Reviewed by Enrica Casucci.

        No new tests; there are existing tests that I will unskip and rebaseline
        in the near future.

        * rendering/RenderThemeIOS.h:
        * rendering/RenderThemeIOS.mm:
        (WebCore::AttachmentInfo::addLine):
        (WebCore::AttachmentInfo::buildTitleLines):
        (WebCore::AttachmentInfo::buildSingleLine):
        (WebCore::getAttachmentProgress):
        (WebCore::iconForAttachment):
        (WebCore::AttachmentInfo::AttachmentInfo):
        (WebCore::RenderThemeIOS::attachmentIntrinsicSize):
        (WebCore::RenderThemeIOS::attachmentBaseline):
        (WebCore::paintAttachmentIcon):
        (WebCore::paintAttachmentText):
        (WebCore::paintAttachmentProgress):
        (WebCore::paintAttachmentBorder):
        (WebCore::RenderThemeIOS::paintAttachment):
        There are still a few missing pieces, but get <attachment> painting a bit on iOS.
        We will paint an icon, action, title, and subtitle - in that order - depending on what we have.
        The content is vertically and horizontally centered.

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Convert DOMTimer interval from int to std::chromo::milliseconds
        https://bugs.webkit.org/show_bug.cgi?id=155051

        Reviewed by Ryosuke Niwa.

        This change is pretty much mechanical, replacing int with std::chrono::milliseconds.

        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::willSendXMLHttpRequestImpl):
        (WebCore::InspectorInstrumentation::didInstallTimerImpl):
        * inspector/InspectorInstrumentation.h:
        (WebCore::InspectorInstrumentation::willSendXMLHttpRequest):
        (WebCore::InspectorInstrumentation::didInstallTimer):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::didPaint):
        (WebCore::InspectorTimelineAgent::didInstallTimer):
        * inspector/InspectorTimelineAgent.h:
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::TimelineRecordFactory::createGenericTimerData):
        (WebCore::TimelineRecordFactory::createTimerInstallData):
        * inspector/TimelineRecordFactory.h:
        * page/DOMTimer.cpp:
        (WebCore::shouldForwardUserGesture):
        (WebCore::DOMTimer::DOMTimer):
        (WebCore::DOMTimer::~DOMTimer):
        (WebCore::DOMTimer::install):
        (WebCore::DOMTimer::intervalClampedToMinimum):
        * page/DOMTimer.h:
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::setTimeout):
        (WebCore::DOMWindow::clearTimeout):
        (WebCore::DOMWindow::setInterval):
        (WebCore::DOMWindow::clearInterval):
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::setTimeout):
        (WebCore::WorkerGlobalScope::clearTimeout):
        (WebCore::WorkerGlobalScope::setInterval):
        (WebCore::WorkerGlobalScope::clearInterval):

2016-03-03  Enrica Casucci  <enrica@apple.com>

        Add a mechanism to customize the long press action.
        https://bugs.webkit.org/show_bug.cgi?id=154995
        rdar://problem/24823732

        Reviewed by Tim Horton.

        We want to allow long press on attachment elements as well.

        * WebCore.xcodeproj/project.pbxproj: Making HTMLAttachmentElement.h private.
        * html/HTMLAttachmentElement.h: Adding exported functions.

2016-03-04  Andreas Kling  <akling@apple.com>

        [iOS] Throw away compiled RegExp code when navigating to a new page.
        <https://webkit.org/b/155015>

        Reviewed by Anders Carlsson.

        Discard RegExp code when doing a top-level navigation.
        This frees up a couple hundred kilobytes on many pages.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::deleteAllRegExpCode):
        * bindings/js/GCController.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-03-04  Simon Fraser  <simon.fraser@apple.com>

        Use larger tiles when possible to reduce per-tile painting overhead
        https://bugs.webkit.org/show_bug.cgi?id=154985

        Reviewed by Zalan Bujtas.

        r197541 inadvertently missed FrameView changes that push scrollability data
        onto the TiledBacking, so didn't actually change behavior (hence the 512x512 tiles
        in the failing tests).

        Also remove m_tileSizeAtLastRevalidate from TileGrid; it's replaced by a simpler test.

        * page/FrameView.cpp:
        (WebCore::FrameView::addedOrRemovedScrollbar):
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::revalidateTiles):
        (WebCore::TileGrid::TileGrid): Deleted.
        * platform/graphics/ca/TileGrid.h:

2016-03-04  Simon Fraser  <simon.fraser@apple.com>

        Use BoxExtent instead of EdgeSet in TileController
        https://bugs.webkit.org/show_bug.cgi?id=155040

        Reviewed by Zalan Bujtas.

        Remove EdgeSet, which was very similar to the existing BoxExtent, and use BoxExtent
        in TileController.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/EdgeSet.h: Removed.
        (WebCore::EdgeSet::EdgeSet): Deleted.
        (WebCore::EdgeSet::top): Deleted.
        (WebCore::EdgeSet::setTop): Deleted.
        (WebCore::EdgeSet::right): Deleted.
        (WebCore::EdgeSet::setRight): Deleted.
        (WebCore::EdgeSet::bottom): Deleted.
        (WebCore::EdgeSet::setBottom): Deleted.
        (WebCore::EdgeSet::left): Deleted.
        (WebCore::EdgeSet::setLeft): Deleted.
        (WebCore::EdgeSet::operator==): Deleted.
        (WebCore::EdgeSet::operator!=): Deleted.
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::setHasMargins):
        * platform/graphics/ca/TileController.h:

2016-03-04  Brent Fulgham  <bfulgham@apple.com>

        [WK2] Gather resource load statistics
        https://bugs.webkit.org/show_bug.cgi?id=154278
        <rdar://problem/24702892>

        Reviewed by Andy Estes.

        Tested (now under WK2) by http/tests/navigation/statistics.html

        Split part of the ResourceLoadObserver into a new class (ResourceLoadStatisticsStore)
        that manages the collection of ResourceLoadStatistic objects, and that can be used
        in the UIProcess without touching various WebProcess-specific WebCore classes.

        Have the WebProcess only fire a message to the UIProcess if data has been modified. Otherwise,
        no messages should be sent. When new data is encountered, start a 5 second timer. If more
        data is found during this delay, just accumulate it. When the timer fires, all data is sent
        and the timer stops until a new batch of data arrives.

        * CMakeLists.txt: Add the new ResourceLoadStatisticsStore class.
        * WebCore.xcodeproj/project.pbxproj: Adjust visibility of ResourceLoadStatistics header,
        and add new ResourceLoadStatisticsStore class.
        * loader/ResourceLoadObserver.cpp:
        (WebCore::ResourceLoadObserver::setResourceLoadStatisticsEnabled): Deleted.
        (WebCore::ResourceLoadObserver::resourceLoadStatisticsEnabled): Deleted.
        (WebCore::ResourceLoadObserver::setStatisticsStore): Added.
        (WebCore::ResourceLoadObserver::logFrameNavigation): Tell the ResourceLoadStatisticsStore to fire its 'data changed'
        handler if necessary.
        (WebCore::ResourceLoadObserver::logSubresourceLoading): Ditto.
        (WebCore::ResourceLoadObserver::logUserInteraction): Ditto.
        (WebCore::ResourceLoadObserver::statisticsForOrigin): Use new ResourceLoadStatisticsStore.
        (WebCore::ResourceLoadObserver::isPrevalentResource): Deleted.
        (WebCore::ResourceLoadObserver::resourceStatisticsForPrimaryDomain): Deleted.
        (WebCore::ResourceLoadObserver::writeDataToDisk): Deleted.
        (WebCore::ResourceLoadObserver::setStatisticsStorageDirectory): Deleted.
        (WebCore::ResourceLoadObserver::persistentStoragePath): Deleted.
        (WebCore::ResourceLoadObserver::readDataFromDiskIfNeeded): Deleted.
        (WebCore::ResourceLoadObserver::createDecoderFromDisk): Deleted.
        (WebCore::ResourceLoadObserver::writeEncoderToDisk): Deleted.
        * loader/ResourceLoadObserver.h:
        * loader/ResourceLoadStatistics.cpp:
        (WebCore::ResourceLoadStatistics::encode): Get rid of unneeded argument.
        (WebCore::ResourceLoadStatistics::decode): Ditto.
        (WebCore::mergeHashCountedSet): Added helper function.
        (WebCore::ResourceLoadStatistics::merge): Added.
        * loader/ResourceLoadStatistics.h:
        (WebCore::ResourceLoadStatistics::ResourceLoadStatistics):
        * loader/ResourceLoadStatisticsStore.cpp: Added.
        (WebCore::ResourceLoadStatisticsStore::create):
        (WebCore::ResourceLoadStatisticsStore::ResourceLoadStatisticsStore):
        (WebCore::ResourceLoadStatisticsStore::isPrevalentResource):
        (WebCore::ResourceLoadStatisticsStore::resourceStatisticsForPrimaryDomain):
        (WebCore::ResourceLoadStatisticsStore::writeDataToDisk):
        (WebCore::ResourceLoadStatisticsStore::setStatisticsStorageDirectory):
        (WebCore::ResourceLoadStatisticsStore::persistentStoragePath):
        (WebCore::ResourceLoadStatisticsStore::readDataFromDiskIfNeeded):
        (WebCore::ResourceLoadStatisticsStore::createDecoderFromDisk):
        (WebCore::ResourceLoadStatisticsStore::writeEncoderToDisk):
        (WebCore::ResourceLoadStatisticsStore::statisticsForOrigin):
        (WebCore::ResourceLoadStatisticsStore::takeStatistics):
        (WebCore::ResourceLoadStatisticsStore::mergeStatistics):
        (WebCore::ResourceLoadStatisticsStore::setNotificationCallback):
        (WebCore::ResourceLoadStatisticsStore::fireDataModificationHandler):
        * loader/ResourceLoadStatisticsStore.h: Added.

2016-03-04  Konstantin Tokarev  <annulen@yandex.ru>

        Added missing override specifiers under Source/WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=155021

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * bridge/NP_jsobject.cpp:
        * css/CSSStyleSheet.cpp:
        * dom/MutationObserver.cpp:
        * editing/DictationCommand.cpp:
        * editing/EditingStyle.cpp:
        * loader/EmptyClients.cpp:
        * loader/SinkDocument.cpp:
        * page/DOMWindow.cpp:
        * page/animation/CSSPropertyAnimation.cpp:
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        Also added #if(SOUP) guard to
        ResourceHandleStreamingClient::getOrCreateReadBuffer
        because it is not an overridden method otherwise.
        * platform/text/LineEnding.cpp:
        * xml/parser/XMLDocumentParserLibxml2.cpp:

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Max out timer throttling immediately for pre-render pages
        https://bugs.webkit.org/show_bug.cgi?id=155038

        Reviewed by Chris Dumez.

        If a hidden page has never been visible, no need to gently ramp into throttling - treat it
        the same as a page that has been viewed, but has been in the background for a long time.

        Why? The throttling mechanism scales with the amount of background work by shifting the
        limit - once all background pages have maxed out the limit, they should no longer be burden
        of the system. However the mechanism doesn't currently do anything to accelerate towards
        the limit based on the number of pages in the ramp up phase, and ramp up duration is
        proportional to limit (so ramping up to a high limit takes a long time). So if you quickly
        create a large number of hidden pages the system may be under excessive load for a while,
        as we slowly ramp up to a limit that will adequately constrain resource consumption.
        In cases where a large number of hidden pages are rapidly generated, many likely remain in
        the pre-render state, so this mitigation should typically help.

        * page/Page.cpp:
        (WebCore::Page::updateDOMTimerAlignmentInterval):
            - if m_isPrerender then m_timerAlignmentInterval is set to the limit.
        (WebCore::Page::setIsPrerender):
            - When this changes updateDOMTimerAlignmentInterval().

2016-03-04  Gavin Barraclough  <barraclough@apple.com>

        Unify determination of page timer alignment
        https://bugs.webkit.org/show_bug.cgi?id=155031

        Reviewed by Chris Dumez.

        Currently this is scattered throughout Page - sites that call setDOMTimerAlignmentInterval have
        to determine the correct alignment interval. Instead, replace setDOMTimerAlignmentInterval with
        updateDOMTimerAlignmentInterval, and unify the policy decision here.

        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingState):
            - setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval
              Also, to simplify always record the timestamp when the state changes.
        (WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
            - setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval
        (WebCore::Page::updateDOMTimerAlignmentInterval):
            - Was setDOMTimerAlignmentInterval, now determines the new alignment value.
        (WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):
            - setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval
        (WebCore::Page::setDOMTimerAlignmentInterval): Deleted.
            - Removed, became updateDOMTimerAlignmentInterval.
        * page/Page.h:
            - setDOMTimerAlignmentInterval -> updateDOMTimerAlignmentInterval
              m_timerThrottlingEnabledTime -> m_timerThrottlingStateLastChangedTime

2016-03-04  Simon Fraser  <simon.fraser@apple.com>

        Fix crash seen in iOS simulator tests
        https://bugs.webkit.org/show_bug.cgi?id=155030

        Reviewed by Tim Horton.

        owningGraphicsLayer() can be null when the tileSizeChangeTimer fires, so null check
        it and return, as we do for the tileRevalidationTimer.

        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::tileSizeChangeTimerFired):

2016-03-04  Alex Christensen  <achristensen@webkit.org>

        Remove vcxproj build system
        https://bugs.webkit.org/show_bug.cgi?id=154388

        Rubber-stamped by Brent Fulgham.

        * WebCore.vcxproj/WebCore.submit.sln: Removed.
        * WebCore.vcxproj/WebCore.vcxproj: Removed.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Removed.
        * WebCore.vcxproj/WebCoreCFNetwork.props: Removed.
        * WebCore.vcxproj/WebCoreCG.props: Removed.
        * WebCore.vcxproj/WebCoreCURL.props: Removed.
        * WebCore.vcxproj/WebCoreCairo.props: Removed.
        * WebCore.vcxproj/WebCoreCommon.props: Removed.
        * WebCore.vcxproj/WebCoreDebug.props: Removed.
        * WebCore.vcxproj/WebCoreDebugWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreGenerated.make: Removed.
        * WebCore.vcxproj/WebCoreGenerated.vcxproj: Removed.
        * WebCore.vcxproj/WebCoreGenerated.vcxproj.filters: Removed.
        * WebCore.vcxproj/WebCoreGeneratedCommon.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedDebug.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedDebugWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedProduction.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedRelease.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedReleaseWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreGeneratedWinCairo.make: Removed.
        * WebCore.vcxproj/WebCoreGeneratedWinCairoCommon.props: Removed.
        * WebCore.vcxproj/WebCoreIncludeCommon.props: Removed.
        * WebCore.vcxproj/WebCoreMediaQT.props: Removed.
        * WebCore.vcxproj/WebCorePostBuild.cmd: Removed.
        * WebCore.vcxproj/WebCorePreBuild.cmd: Removed.
        * WebCore.vcxproj/WebCoreProduction.props: Removed.
        * WebCore.vcxproj/WebCoreQuartzCore.props: Removed.
        * WebCore.vcxproj/WebCoreRelease.props: Removed.
        * WebCore.vcxproj/WebCoreReleaseWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupport.vcxproj: Removed.
        * WebCore.vcxproj/WebCoreTestSupport.vcxproj.filters: Removed.
        * WebCore.vcxproj/WebCoreTestSupportCommon.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportDebug.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportDebugWinCairo.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportProduction.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportRelease.props: Removed.
        * WebCore.vcxproj/WebCoreTestSupportReleaseWinCairo.props: Removed.
        * WebCore.vcxproj/build-generated-files.pl: Removed.
        * WebCore.vcxproj/copyForwardingHeaders.cmd: Removed.
        * WebCore.vcxproj/copyWebCoreResourceFiles.cmd: Removed.
        * WebCore.vcxproj/migrate-scripts.pl: Removed.

2016-03-04  Brady Eidson  <beidson@apple.com>

        Remove use of deprecated sqlite3_expired
        https://bugs.webkit.org/show_bug.cgi?id=155025

        Reviewed by Tim Horton.

        Since we exclusively use sqlite3_prepare_v2 and don't use sqlite3_prepare,
        manually checking for expired statements is not necessary.

        * platform/sql/SQLiteStatement.cpp:
        (WebCore::SQLiteStatement::isExpired): Null check the statement, but don't bother
          with sqlite3_expired.

2016-03-04  Daniel Bates  <dabates@apple.com>

        Move CryptoDigest to WebCore/platform
        https://bugs.webkit.org/show_bug.cgi?id=155008
        <rdar://problem/24969787>

        Reviewed by Brent Fulgham.

        CryptoDigest provides a platform-independent interface for interacting with platform-
        specific cryptographic hashing services. We currently make use of this code as part
        of the implementation of Web Crypto. This code will also be beneficial as part of
        implementing support for Content Security Policy inline script and inline stylesheet
        hashes. We should move CryptoDigest to WebCore/platform to convey that it a general
        purpose platform abstraction.

        * CMakeLists.txt: Add include directory WebCore/platform/crypto.
        * PlatformEfl.cmake: Add file platform/crypto/gnutls/CryptoDigestGnuTLS.cpp and
        remove file crypto/gnutls/CryptoDigestGnuTLS.cpp.
        * PlatformGTK.cmake: Ditto.
        * PlatformMac.cmake: Add file platform/crypto/mac/CryptoDigestMac.cpp and
        remove file crypto/mac/CryptoDigestMac.cpp.
        * WebCore.xcodeproj/project.pbxproj:
        * crypto/algorithms/CryptoAlgorithmSHA1.cpp:
        (WebCore::CryptoAlgorithmSHA1::digest): Substitute "CryptoDigest::Algorithm" for "CryptoAlgorithmIdentifier".
        * crypto/algorithms/CryptoAlgorithmSHA224.cpp:
        (WebCore::CryptoAlgorithmSHA224::digest): Ditto.
        * crypto/algorithms/CryptoAlgorithmSHA256.cpp:
        (WebCore::CryptoAlgorithmSHA256::digest): Ditto.
        * crypto/algorithms/CryptoAlgorithmSHA384.cpp:
        (WebCore::CryptoAlgorithmSHA384::digest): Ditto.
        * crypto/algorithms/CryptoAlgorithmSHA512.cpp:
        (WebCore::CryptoAlgorithmSHA512::digest): Ditto.
        * crypto/mac/CryptoAlgorithmRSASSA_PKCS1_v1_5Mac.cpp:
        (WebCore::getCryptoDigestAlgorithm): Converts a CryptoAlgorithmIdentifier enumerator to a
        CryptoDigest::Algorithm enumerator, if applicable.
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformSign): Write in terms of WebCore::getCryptoDigestAlgorithm().
        (WebCore::CryptoAlgorithmRSASSA_PKCS1_v1_5::platformVerify): Ditto.
        * platform/crypto/CryptoDigest.h: Renamed from Source/WebCore/crypto/CryptoDigest.h. Also added enum CryptoDigest::Algorithm
        and changed constructor to take this enum.
        * platform/crypto/gnutls/CryptoDigestGnuTLS.cpp: Renamed from Source/WebCore/crypto/gnutls/CryptoDigestGnuTLS.cpp.
        (WebCore::CryptoDigest::CryptoDigest): Substitute "CryptoDigest::Algorithm" for "CryptoAlgorithmIdentifier".
        (WebCore::CryptoDigest::~CryptoDigest): Ditto.
        (WebCore::CryptoDigest::create): Ditto.
        (WebCore::CryptoDigest::addBytes): Ditto.
        (WebCore::CryptoDigest::computeHash): Ditto.
        * platform/crypto/mac/CryptoDigestMac.cpp: Renamed from Source/WebCore/crypto/mac/CryptoDigestMac.cpp.
        (WebCore::toSHA1Context): Ditto.
        (WebCore::toSHA224Context): Ditto.
        (WebCore::toSHA256Context): Ditto.
        (WebCore::toSHA384Context): Ditto.
        (WebCore::toSHA512Context): Ditto.
        (WebCore::CryptoDigest::CryptoDigest): Ditto.
        (WebCore::CryptoDigest::~CryptoDigest): Ditto.
        (WebCore::CryptoDigest::create): Ditto.
        (WebCore::CryptoDigest::addBytes): Ditto.
        (WebCore::CryptoDigest::computeHash): Ditto.

2016-03-04  Myles C. Maxfield  <mmaxfield@apple.com>

        Whitespace causes font-variant: all-small-caps to synthesize
        https://bugs.webkit.org/show_bug.cgi?id=155004
        <rdar://problem/24630796>

        Reviewed by Darin Adler.

        Many fonts (such as Avenir Next) don't report to support whitespace characters under
        smcp or c2sc. Previously, we were using this as a signal to synthesize small caps
        instead of true small caps. However, a better solution is for whitespace to never
        cause synthesis with all-small-caps.

        Test: fast/text/all-small-caps-whitespace.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::shouldSynthesize):
        (WebCore::ComplexTextController::collectComplexTextRuns):

2016-03-04  Myles C. Maxfield  <mmaxfield@apple.com>

        [iOS] Crash during font loading when injected bundle cancels load
        https://bugs.webkit.org/show_bug.cgi?id=155001

        Reviewed by Tim Horton.

        If a injected bundle cancels the load, the fontLoaded() callback will be
        called twice. We can simply detect this condition.

        Test: CancelLoading.CancelFontSubresource API test

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::fontLoaded):

2016-03-03  Ada Chan  <adachan@apple.com>

        The visibility of the airplay menu also depends on whether there's a custom menu item.
        https://bugs.webkit.org/show_bug.cgi?id=154987

        Reviewed by Darin Adler.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::enqueuePlaybackTargetAvailabilityChangedEvent):

2016-03-04  Timothy Hatcher  <timothy@apple.com>

        Inform WebKit and WebCore if a page is controlled by automation.

        https://bugs.webkit.org/show_bug.cgi?id=154991
        rdar://problem/24965784

        Reviewed by Joseph Pecoraro.

        * page/Page.h:
        (WebCore::Page::isControlledByAutomation): Added.
        (WebCore::Page::setControlledByAutomation): Added.

2016-03-03  Antti Koivisto  <antti@apple.com>

        ComposedTreeIterator may traverse slotted nodes multiple times
        https://bugs.webkit.org/show_bug.cgi?id=154983

        Reviewed by Ryosuke Niwa.

        Traversal of slotted nodes can escape to real siblings. Those siblings are then traversed again as slotted nodes.

        Test: fast/shadow-dom/composed-tree-slots.html

        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::initializeContextStack):
        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
        (WebCore::ComposedTreeIterator::traverseNextLeavingContext):
        (WebCore::ComposedTreeIterator::advanceInSlot):
        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::Context::Context):

            Include end iterator to the context.
            For slotted nodes set it up to point to the next sibling of the node.

        (WebCore::ComposedTreeIterator::context):
        (WebCore::ComposedTreeIterator::traverseNextSkippingChildren):

2016-03-04  Andreas Kling  <akling@apple.com>

        Drop DocumentSharedObjectPool immediately when going into PageCache.
        <https://webkit.org/b/154986>

        Reviewed by Antti Koivisto.

        The DocumentSharedObjectPool is a weirdly efficient little optimization
        that deduplicates ElementData during the first 10s of a Document's lifetime.
        While it's up, every ElementData created will persist so it can be used for
        deduplication.

        If a Document goes into the PageCache while its shared object pool is still
        alive, we can just kill it right away. This will sometimes allow us to free
        a bunch of ElementData sooner.

        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::setInPageCache):
        (WebCore::Document::clearSharedObjectPool):
        (WebCore::Document::sharedObjectPoolClearTimerFired): Deleted.
        * dom/Document.h:

2016-03-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove PassRefPtr from ThreadableLoader and relatives
        https://bugs.webkit.org/show_bug.cgi?id=154966

        Reviewed by Darin Adler.

        Covered by existing tests.

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::create):
        * loader/DocumentThreadableLoader.h:
        * loader/ThreadableLoader.cpp:
        (WebCore::ThreadableLoader::create):
        * loader/ThreadableLoader.h:
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
        * loader/WorkerThreadableLoader.h:

2016-03-03  Ryosuke Niwa  <rniwa@webkit.org>

        Let XCode have its own way and also sort the file.

        * WebCore.xcodeproj/project.pbxproj:

2016-03-03  Chris Dumez  <cdumez@apple.com>

        Regression(r196770): Unable to use HipChat Mac app
        https://bugs.webkit.org/show_bug.cgi?id=154999
        <rdar://problem/24931959>

        Reviewed by Darin Adler.

        r196770 made [Unforgeable] operations such as Location.reload()
        non-writable as per the Web IDL specification. As a result,
        trying to set such properties will be ignored in non-strict
        mode and will throw an exception is strict mode. This also matches
        Firefox and Chrome.

        However, this broke the HipChat Mac App (the Web App seems fine)
        because it sets Location.reload() and is using strict mode, therefore
        causing an exception to be thrown.

        This patch adds a quirk to JSLocation::putDelegate() which disable
        strict mode when we detect that the application is HipChat. As a
        result, we no longer throw when HipChat tries to set Location.reload
        and the application is able to connect again.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        Add a quirk which disables strict mode if the application is HipChat.

        * platform/RuntimeApplicationChecks.cpp:
        (WebCore::mainBundleIdentifier):
        Extract this from mainBundleIsEqualTo() so it can be shared with
        applicationBundleIdentifier().

        (WebCore::applicationBundleIdentifier):
        Returns the application bundle identifier, which is a static variable.
        For the WebContent / Networking processes, the application bundle
        identifier gets set to the UIProcess bundle identifier upon
        initialization. If unset, we fall back to using mainBundleIdentifier()
        which will do the right thing for the WK2 UIProcess and WK1.

        (WebCore::mainBundleIsEqualTo):
        Extract part of the code to mainBundleIdentifier() to better share
        code.

        (WebCore::applicationIsHipChat):
        Add utility function that checks if the application is HipChat. This
        will do the right thing whether it is called from the UIProcess, the
        WebProcess or the UIProcess.

        (WebCore::setApplicationBundleIdentifier):
        Add utility function to set the application bundle identifier. It gets
        called with the UIProcess bundle identifier by the NetworkProcess and
        the WebProcess upon initialization.

        * platform/RuntimeApplicationChecks.h:

2016-03-03  Keith Miller  <keith_miller@apple.com>

        JSArrayBuffers should be collected less aggressively
        https://bugs.webkit.org/show_bug.cgi?id=154982

        Reviewed by Geoffrey Garen.

        We are currently too aggressive in our collection of ArrayBuffer wrappers.
        There are three cases where we need to avoid collecting ArrayBuffer wrappers.
        1. If the wrapper has custom properties.
        2. If the wrapper is a subclass of ArrayBuffer.
        3. If the wrapper is in a WeakMap/WeakSet.

        Currently, we only pass the first case in WebCore and none in the jsc CLI.
        This patch removes some optimizations that cause us to collect when we
        should not. Namely, always skipping the object unless it has custom
        properties. Additionally, in the case of subclassing, we also need a way
        for custom JSArrayBuffer objects to register themselves as the wrapper for
        an ArrayBuffer class.

        Finally, this patch removes an unnecessary ref() and deref() of
        ArrayBuffer objects during the creation/destruction of the wrapper.
        Since an ArrayBuffer object's GC lifetime will be at least as long
        as the lifetime of the wrapper we are creating for it we don't need
        to ref() and deref() the ArrayBuffer object. This lifetime is
        guaranteed because ArrayBuffer objects are both GCed and refcounted
        and any new wrapper will visit the ArrayBuffer object as long as the
        wrapper is still alive.

        Test: js/arraybuffer-wrappers.html

        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        * bindings/js/WebCoreTypedArrayController.cpp:
        (WebCore::WebCoreTypedArrayController::registerWrapper):
        (WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::finalize):
        (WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots): Deleted.
        * bindings/js/WebCoreTypedArrayController.h:

2016-03-03  Simon Fraser  <simon.fraser@apple.com>

        Use larger tiles when possible to reduce per-tile painting overhead
        https://bugs.webkit.org/show_bug.cgi?id=154985
        rdar://problem/23635219

        Reviewed by Tim Horton.

        There's no reason to use lots of 512x512 tiles on a non-scrollable page. We can reduce
        per-tile painting overhead by using one big tile. On vertically scrolling pages, we
        can also use wide tiles to reduce tile-crossing when painting. Have FrameView tell
        the TiledBacking about scrollability, allowing TileController to make tile size decisions.

        Change the "giant tile" code path to just return whether Settings says we're in giant
        tile mode, so that tile size decisions can be made in TileController.

        TileController now stores a single margin size, and a per-edge margin flag rather than a size
        per edge. It computes tile size based on scrollability, but adjusts tile size with some 
        hysteresis to avoid size thrashing for content that frequently resizes the document (e.g.
        some performance tests).

        TileGrid stores a copy of the tile size, so that it remains unchanged from one revalidate
        to the next, and the grid can detect when the tile size changes, since it needs to throw away
        all tiles in that case.

        Tests: tiled-drawing/tile-size-both-scrollable.html
               tiled-drawing/tile-size-horizontally-scrollable.html
               tiled-drawing/tile-size-unscrollable.html
               tiled-drawing/tile-size-vertically-scrollable.html

        * WebCore.xcodeproj/project.pbxproj:
        * page/FrameView.cpp:
        (WebCore::FrameView::addedOrRemovedScrollbar):
        (WebCore::FrameView::willStartLiveResize): Tell the tile backing when live resize starts and stops.
        (WebCore::FrameView::willEndLiveResize):
        * platform/graphics/EdgeSet.h: Added. Template class that just stores some value
        per edge.
        (WebCore::EdgeSet::EdgeSet):
        (WebCore::EdgeSet::top):
        (WebCore::EdgeSet::setTop):
        (WebCore::EdgeSet::right):
        (WebCore::EdgeSet::setRight):
        (WebCore::EdgeSet::bottom):
        (WebCore::EdgeSet::setBottom):
        (WebCore::EdgeSet::left):
        (WebCore::EdgeSet::setLeft):
        (WebCore::EdgeSet::operator==):
        (WebCore::EdgeSet::operator!=):
        * platform/graphics/GraphicsLayerClient.h: Rather than have the client return the
        tile size, have it return whether we're in giant tile mode.
        (WebCore::GraphicsLayerClient::useGiantTiles):
        (WebCore::GraphicsLayerClient::tileSize): Deleted.
        * platform/graphics/TiledBacking.h:
        (WebCore::defaultTileSize): Deleted.
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::GraphicsLayerCA::platformCALayerUseGiantTiles):
        (WebCore::GraphicsLayerCA::platformCALayerTileSize): Deleted.
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/ca/PlatformCALayerClient.h:
        (WebCore::PlatformCALayerClient::platformCALayerUseGiantTiles):
        (WebCore::PlatformCALayerClient::platformCALayerTileSize): Deleted.
        * platform/graphics/ca/TileController.cpp:
        (WebCore::TileController::TileController):
        (WebCore::TileController::setScrollability):
        (WebCore::TileController::willStartLiveResize):
        (WebCore::TileController::didEndLiveResize):
        (WebCore::TileController::tileSize):
        (WebCore::TileController::setHasMargins):
        (WebCore::TileController::setMarginSize):
        (WebCore::TileController::hasMargins):
        (WebCore::TileController::hasHorizontalMargins):
        (WebCore::TileController::hasVerticalMargins):
        (WebCore::TileController::topMarginHeight):
        (WebCore::TileController::bottomMarginHeight):
        (WebCore::TileController::leftMarginWidth):
        (WebCore::TileController::rightMarginWidth):
        (WebCore::TileController::setTileMargins): Deleted.
        * platform/graphics/ca/TileController.h:
        * platform/graphics/ca/TileGrid.cpp:
        (WebCore::TileGrid::TileGrid):
        (WebCore::TileGrid::setNeedsDisplayInRect):
        (WebCore::TileGrid::rectForTileIndex):
        (WebCore::TileGrid::getTileIndexRangeForRect):
        (WebCore::TileGrid::removeAllTiles):
        (WebCore::TileGrid::revalidateTiles):
        * platform/graphics/ca/TileGrid.h:
        (WebCore::TileGrid::tileSize):
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setTiledBackingHasMargins):
        (WebCore::RenderLayerBacking::useGiantTiles):
        (WebCore::RenderLayerBacking::tileSize): Deleted.
        * rendering/RenderLayerBacking.h:

2016-03-03  Ryosuke Niwa  <rniwa@webkit.org>

        Disallow custom elements inside a window-less documents
        https://bugs.webkit.org/show_bug.cgi?id=154944
        <rdar://problem/24944875>

        Reviewed by Antti Koivisto.

        Disallow custom elements inside a window-less documents such as the shared inert document of template elements
        and the ones created by DOMImplementation.createDocument and DOMImplementation.createHTMLDocument.

        Throw NotSupportedError in defineCustomElement when it's called in such a document as discussed in:
        https://github.com/w3c/webcomponents/issues/369

        Tests: fast/custom-elements/parser/parser-constructs-custom-element-in-document-write.html
               fast/custom-elements/parser/parser-uses-registry-of-owner-document.html

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::throwNotSupportedError): Added.
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::defineCustomElement): Throw NotSupportedError when the context object's document doesn't
        have a browsing context (i.e. window-less).
        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Replaced a FIXME with an assertion now that we
        disallow instantiation of custom elements inside a template element.

2016-03-03  Alex Christensen  <achristensen@webkit.org>

        Move SPI to CFNetworkSPI.h
        https://bugs.webkit.org/show_bug.cgi?id=154992

        Reviewed by Andy Estes.

        * platform/spi/cf/CFNetworkSPI.h:

2016-03-03  Alex Christensen  <achristensen@webkit.org>

        Use CredentialStorage with NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=154939

        Reviewed by Darin Adler.

        This makes the credential-based http tests pass when using NetworkSession.

        * platform/network/CredentialBase.h:
        (WebCore::CredentialBase::encodingRequiresPlatformData):
        * platform/network/CredentialStorage.h:
        WEBCORE_EXPORT more things that are newly used in WebKit2.

2016-03-03  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Make collapsed borders painting subpixel aware.
        https://bugs.webkit.org/show_bug.cgi?id=154980

        Reviewed by David Hyatt.

        This patch enables collapsed borders with odd pixel width paint on subpixel position.
        Currently borders with odd pixels are split at integral position so that border-width: 3px;
        paints 1px on the left(top) and 2px on the right(bottom) side. With this patch
        we paint 1.5px on both sides(on 2x display).

        Test: fast/table/hidpi-collapsed-border-with-odd-pixel-width.html

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::paintCollapsedBorders):

2016-03-03  Dave Hyatt  <hyatt@apple.com>

        Add support for the "last" value of hanging-punctuation
        https://bugs.webkit.org/show_bug.cgi?id=154977

        Reviewed by Darin Adler and Simon Fraser.

        New tests in fast/text.

        This patch adds support for the new "last" value and also fixes up both
        "first" and "last" to work with leading and trailing whitespace that ends
        up getting collapsed away.

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::inlineAncestorHasStartBorderPaddingOrMargin):
        (WebCore::inlineAncestorHasEndBorderPaddingOrMargin):
        (WebCore::isLastInFlowRun):
        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
        * rendering/RenderText.cpp:
        (WebCore::isHangablePunctuationAtLineEnd):
        (WebCore::RenderText::hangablePunctuationStartWidth):
        (WebCore::RenderText::hangablePunctuationEndWidth):
        (WebCore::RenderText::firstCharacterIndexStrippingSpaces):
        (WebCore::RenderText::lastCharacterIndexStrippingSpaces):
        (WebCore::RenderText::trimmedPrefWidths):
        * rendering/RenderText.h:
        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::handleText):

2016-03-03  Andy Estes  <aestes@apple.com>

        Adopt CFNetwork storage partitioning SPI
        https://bugs.webkit.org/show_bug.cgi?id=154957
        rdar://problem/23614620

        Reviewed by Darin Adler.

        Adopt CFNetwork SPI for creating storage partitions. If Settings::cookieStoragePartitioningEnabled() is true,
        create cookie storage partitions for third-party contexts. This feature is disabled by default.

        No new tests. Test support is tracked by <https://webkit.org/b/154958>.

        * page/Settings.cpp:
        (WebCore::Settings::setCookieStoragePartitioningEnabled): Controls whether storage partitioning for cookies is enabled.
        * page/Settings.h:
        (WebCore::Settings::cookieStoragePartitioningEnabled):
        * platform/network/NetworkStorageSession.h:
        * platform/network/cf/NetworkStorageSessionCFNet.cpp:
        (WebCore::cookieStoragePartition): Computes a storage partition identifier by determining the top
        privately-controlled domain of the cookie's first-party (main frame document) URL, then determining whether the
        cookie's document hostname is a subdomain of it. If is is not, the first-party top domain is the partition name.
        Otherwise, there is no partition name.
        * platform/network/mac/CookieJarMac.mm:
        (WebCore::applyPartitionToCookies): Returns a deep copy of the given cookie array after adding a storage
        partition property to each copied cookie.
        (WebCore::cookiesInPartitionForURL): Returns cookies for the partition computed by the given URLs. If no
        partition can be determined, nil is returned.
        (WebCore::cookiesForURL): Returns cookiesInPartitionForURL() if non-nil, otherwise returns wkHTTPCookiesForURL().
        (WebCore::cookiesForSession): Started calling cookiesForURL().
        (WebCore::setCookiesFromDOM): Called applyPartitionToCookies() if a partition can be computed from the given URLs.
        (WebCore::getRawCookies): Started calling cookiesForURL().
        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::createNSURLConnection): Computed the storage partition identifier for the new request.
        If non-empty, set it as a property on the NSURLRequest where CFNetwork knows to find it.
        * platform/spi/cf/CFNetworkSPI.h: Declare new SPI for building with the public SDK.

2016-03-03  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Fix order of grid shorthands in CSSPropertyNames.in
        https://bugs.webkit.org/show_bug.cgi?id=154915

        Reviewed by Darin Adler.

        The order of columns and rows in grid and grid-template shorthands
        has been swapped recently (r196906 & r196934).
        However the order was not updated in CSSPropertyNames.in file.

        * css/CSSPropertyNames.in:

2016-03-03  Alexey Proskuryakov  <ap@apple.com>

        AllInOne build fix.

        * rendering/RenderFlexibleBox.cpp:
        * rendering/RenderGrid.cpp:
        Don't have two static functions with the same name.

2016-03-03  Chris Dumez  <cdumez@apple.com>

        Drop [TreatNullAs=EmptyString] from URL interface attributes
        https://bugs.webkit.org/show_bug.cgi?id=154951

        Reviewed by Darin Adler.

        Drop [TreatNullAs=EmptyString] from URL interface attributes to match
        the specification:
        - https://url.spec.whatwg.org/#api

        Firefox and Chrome both already follow the specification and convert
        null to the "null" string.

        No new tests, already covered by existing tests.

        * html/URLUtils.idl:

2016-03-03  Miguel Gomez  <magomez@igalia.com>

        [TextureMapper] Use RGBA format for textures attached to framebuffers
        https://bugs.webkit.org/show_bug.cgi?id=154965

        Reviewed by Žan Doberšek.

        Use RGBA format when allocating textures that will be used as framebuffer
        attachments. This means adding a new flag to BitmapTexture and modifying
        BitmapTextureGL to use the appropriate format according to the flag. Also,
        BitmapTexturePool needs to use two vectors to handle both types of textures
        separately, as we want to avoid constantly switching the format of a reused
        texture.

        No new tests since the behavior change is covered by existing tests.

        * platform/graphics/texmap/BitmapTexture.h: Add new flag.
        * platform/graphics/texmap/BitmapTextureGL.cpp:
        (WebCore::BitmapTextureGL::BitmapTextureGL): Receive flags on constructor and use RGBA
        when the FBOAttachment flag is enabled.
        (WebCore::BitmapTextureGL::applyFilters): Use FBOAttachemt flag to request a texture.
        * platform/graphics/texmap/BitmapTextureGL.h: Add flags to the constructor.
        * platform/graphics/texmap/BitmapTexturePool.cpp: Add a new vector of textures to hold
        those in RGBA format.
        (WebCore::BitmapTexturePool::acquireTexture): Return a texture for the usage specified
        in the incoming flags.
        (WebCore::BitmapTexturePool::releaseUnusedTexturesTimerFired): Release textures from
        both vectors.
        (WebCore::BitmapTexturePool::createTexture): Pass the usage flag when creating a new
        texture.
        * platform/graphics/texmap/BitmapTexturePool.h: Add new texture vector and add flags to
        the needed headers.
        * platform/graphics/texmap/TextureMapper.cpp:
        (WebCore::TextureMapper::acquireTextureFromPool): Pass the received flags to the BitmapTexturePool.
        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::paintIntoSurface): Use FBOAttachemt flag to request a texture.

2016-03-03  Javier Fernandez  <jfernandez@igalia.com>

        [CSS Box Alignment] New CSS Value 'normal' for Content Alignment
        https://bugs.webkit.org/show_bug.cgi?id=154282

        Reviewed by David Hyatt.

        The Box Alignment specification defines a new value 'normal' to be used
        as default for the different layout models, which will define the
        specific behavior for each case. This patch adds a new CSS value in the
        parsing logic and adapts the Content Alignment properties to the new
        value.

        The 'auto' value is no longer valid and the Computed Value will be
        always the specified value. Hence, I removed the StyleResolver logic
        because is not required now; the specific behavior of the 'normal'
        value will be resolved at layout time.

        Computed value of both align-content and justify-content is the
        specified value, we don't have to resolve any 'auto' value now.

        Additionally, this patch updates the layout logic as well, for both
        Flexbox and Grid layout models.

        No new tests, since we only need to rebaseline those test cases
        affected by the new default computed value.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::valueForContentPositionAndDistributionWithOverflowAlignment):
        (WebCore::ComputedStyleExtractor::propertyValue):
        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Deleted.
        (WebCore::CSSComputedStyleDeclaration::copyProperties): Deleted.
        (WebCore::nodeOrItsAncestorNeedsStyleRecalc): Deleted.
        (WebCore::isFlexOrGrid): Deleted.
        (WebCore::ComputedStyleExtractor::customPropertyValue): Deleted.
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseContentDistributionOverflowPosition):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator ContentPosition):
        * rendering/RenderFlexibleBox.cpp:
        (WebCore::normalValueBehavior):
        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
        (WebCore::RenderFlexibleBox::layoutColumnReverse):
        (WebCore::RenderFlexibleBox::alignFlexLines):
        (WebCore::alignContentSpaceBetweenChildren): Deleted.
        * rendering/RenderGrid.cpp:
        (WebCore::normalValueBehavior):
        (WebCore::RenderGrid::applyStretchAlignmentToTracksIfNeeded):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        (WebCore::resolveContentDistributionFallback):
        (WebCore::contentDistributionOffset):
        (WebCore::RenderGrid::computeContentPositionAndDistributionOffset):
        * rendering/style/RenderStyle.cpp:
        (WebCore::resolvedContentAlignmentPosition):
        (WebCore::resolvedContentAlignmentDistribution):
        (WebCore::RenderStyle::resolvedJustifyContentPosition):
        (WebCore::RenderStyle::resolvedJustifyContentDistribution):
        (WebCore::RenderStyle::resolvedAlignContentPosition):
        (WebCore::RenderStyle::resolvedAlignContentDistribution):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:

2016-03-03  Antti Koivisto  <antti@apple.com>

        Slider thumb style should not depend on renderers
        https://bugs.webkit.org/show_bug.cgi?id=154961

        Reviewed by Andreas Kling.

        Currently slider thumb pseudo id is computed based on host element renderer.
        Style is the input for building a render tree and should be computable without having one.

        * html/shadow/SliderThumbElement.cpp:
        (WebCore::SliderThumbElement::hostInput):
        (WebCore::SliderThumbElement::customStyleForRenderer):

            Compute pseudo id based on the host style.
            Return nullptr so style recalc will otherwise proceed normally.

        (WebCore::SliderThumbElement::shadowPseudoId):
        (WebCore::SliderThumbElement::cloneElementWithoutAttributesAndChildren):
        (WebCore::SliderContainerElement::SliderContainerElement):
        (WebCore::SliderContainerElement::create):
        (WebCore::SliderContainerElement::createElementRenderer):
        (WebCore::SliderContainerElement::customStyleForRenderer):

            Here too.

        (WebCore::SliderContainerElement::shadowPseudoId):
        (WebCore::sliderThumbShadowPseudoId): Deleted.
        (WebCore::mediaSliderThumbShadowPseudoId): Deleted.
        * html/shadow/SliderThumbElement.h:

2016-03-03  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Simplify method to resolve auto-placed items
        https://bugs.webkit.org/show_bug.cgi?id=154911

        Reviewed by Sergio Villar Senin.

        Refactor the method to resolve auto-placed items
        as we're only interested in knowing the span size.

        Adapt the calls to use the span size instead of a GridSpan.

        No new tests, no change of behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::GridResolvedPosition::spanSizeForAutoPlacedItem):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
        Renamed to spanSizeForAutoPlacedItem().
        * rendering/style/GridResolvedPosition.h:

2016-03-02  Chris Dumez  <cdumez@apple.com>

        HTMLFormElement's named property getter does not return a RadioNodelist
        https://bugs.webkit.org/show_bug.cgi?id=154949

        Reviewed by Ryosuke Niwa.

        HTMLFormElement's named property getter should return a RadioNodeList
        when there are several matches:
        https://html.spec.whatwg.org/multipage/forms.html#the-form-element

        Previously, WebKit returned a generic NodeList. As a result, users
        cannot create a white-and-gold hat in the MAKE A HAT GREAT AGAIN
        section at:
        https://www.washingtonpost.com/news/the-fix/wp/2015/10/06/hey-lets-all-make-our-own-donald-trump-hats/

        Chrome and Firefox already match the specification. Edge will soon.

        Test: fast/dom/HTMLFormElement/named-property-getter-radionodelist.html

        * bindings/js/JSHTMLFormElementCustom.cpp:
        (WebCore::JSHTMLFormElement::nameGetter):

2016-03-02  Chris Dumez  <cdumez@apple.com>

        Drop [TreatNullAs=LegacyNullString] from HTMLBaseElement.href
        https://bugs.webkit.org/show_bug.cgi?id=154952

        Reviewed by Ryosuke Niwa.

        Drop [TreatNullAs=LegacyNullString] from HTMLBaseElement.href as this
        does not match the specification:
        - https://html.spec.whatwg.org/multipage/semantics.html#the-base-element

        Firefox and Chrome both convert null to the string "null".

        No new tests, updated the following existing test:
        fast/dom/HTMLBaseElement/href-attribute-resolves-with-respect-to-document.html

        * html/HTMLBaseElement.idl:

2016-03-02  Zalan Bujtas  <zalan@apple.com>

        Paint table borders on empty cells even in quirks mode.
        https://bugs.webkit.org/show_bug.cgi?id=154928

        Reviewed by David Hyatt.

        Enable border painting for empty cells unless 'empty-cells: hide' is set. 
        This is inline with FF and Chrome behaviour.

        Test: fast/table/border-on-empty-table-cells-quirks-mode.html

        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::paintBoxDecorations):

2016-03-02  Ryosuke Niwa  <rniwa@webkit.org>

        HTML parser instantiates a custom element inside a template element with a wrong owner document
        https://bugs.webkit.org/show_bug.cgi?id=154936

        Reviewed by Chris Dumez.

        The bug was caused by our implementation following the old spec which didn't create a appropriate template
        contents owner document [1] for a document without a browsing context. The new spec no longer has this clause,
        and we should be always creating the appropriate template contents owner document unless the document itself
        is an appropriate template contents owner document for another document (comes up in nested template elements).

        No new tests since the behavior change is covered by existing tests.

        [1] https://html.spec.whatwg.org/#appropriate-template-contents-owner-document

        * dom/Document.h:
        (WebCore::Document::templateDocument):

2016-03-02  Gavin Barraclough  <barraclough@apple.com>

        PageThrottler should apply hysteresis to media activity
        https://bugs.webkit.org/show_bug.cgi?id=154940

        Reviewed by Ryosuke Niwa.

        Currently PageThrottler keeps a track of audible plugin activity and HTML media element
        activity separately. Audible plugin activity also gets an extra 5s hysteresis applied,
        so that after audio playback has completed there is a chance to queue up more audio
        before timer throttling kicks in. HTML audio does not get this grace. Funnel both
        together into a single activity flag, such that the hysteresis is applied to both.

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::PageThrottler):
        (WebCore::m_mediaActivityHysteresis):
            - PageActivityState::AudiblePlugin -> PageActivityState::MediaActivity.
        (WebCore::m_mediaActivityCounter):
            - when m_mediaActivityCounter value changes call mediaActivityCounterChanged().
        (WebCore::PageThrottler::mediaActivityCounterChanged):
            - Drive PageActivityState::MediaActivity indirectly via m_mediaActivityHysteresis,
              such that a 5s hysteresis is applied.
        * page/PageThrottler.h:
            - Removed AudiblePlugin (merged in with MediaActivity).
        (WebCore::PageThrottler::pluginDidEvaluateWhileAudioIsPlaying):
            - m_audiblePluginHysteresis.impulse -> m_mediaActivityHysteresis.impulse.

2016-03-01  Ada Chan  <adachan@apple.com>

        Update the media element's presentation mode properly after going in and out of full screen via the Full Screen API
        https://bugs.webkit.org/show_bug.cgi?id=154834

        Reviewed by Simon Fraser.

        * dom/Document.cpp:
        (WebCore::Document::webkitWillEnterFullScreenForElement):
        * dom/Element.cpp:
        (WebCore::Element::willBecomeFullscreenElement):
        * dom/Element.h:
        (WebCore::Element::ancestorWillEnterFullscreen):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::enterFullscreen):
        If the Full Screen API is enabled and this media element is entering a mode other than standard
        full screen, see if it's currently contained in a full screen element. If so, exit full screen.
        (WebCore::HTMLMediaElement::willBecomeFullscreenElement):
        If this media element is going to standard full screen, update its presentation mode. If
        this media element also supports presentation mode and it currently has a presentation mode
        that's not standard full screen, exit that presentation mode directly without animation.
        (WebCore::HTMLMediaElement::willStopBeingFullscreenElement):
        Set the presentation mode back to inline unless it's already changed to a different
        presentation mode.
        * html/HTMLMediaElement.h:
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::ancestorWillEnterFullscreen):
        Reset this video element's presentation state to inline if its ancestor is going to full screen.
        (WebCore::HTMLVideoElement::exitToFullscreenModeWithoutAnimationIfPossible):
        If the fullscreen mode the video element is exiting from is supported, exit that mode to the new mode.
        * html/HTMLVideoElement.h:
        * page/ChromeClient.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::exitFullscreenWithoutAnimationToMode):

2016-03-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: Close UniqueIDBDatabases once they become unused.
        https://bugs.webkit.org/show_bug.cgi?id=154922

        Reviewed by Alex Christensen.

        Tests: storage/indexeddb/modern/256-open-databases.html
               storage/indexeddb/modern/exceed-open-file-limit.html

        Without this change, attempts to open a 256th database in the DatabaseProcess will fail on Mac.
        
        Due to SQLite journal files, this limit could come up as early as 128 databases if they are all
        in active use.
        
        This is because launchd - by default - limits xpc services to having 256 open file handles by default.
        
        While we should explore raising the limit, we should also close databases we no longer need.
        
        * Modules/indexeddb/server/IDBBackingStore.h:

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::closeUniqueIDBDatabase):
        (WebCore::IDBServer::IDBServer::deleteUniqueIDBDatabase): Deleted.
        * Modules/indexeddb/server/IDBServer.h:

        * Modules/indexeddb/server/MemoryBackingStoreTransaction.cpp:
        (WebCore::IDBServer::MemoryBackingStoreTransaction::MemoryBackingStoreTransaction):

        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::getOrEstablishDatabaseInfo):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation): Handle the case where opening
          the backing store failed by firing an error event instead of pretending everything is okay.
        (WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::openBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::didOpenBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::isCurrentlyInUse):
        (WebCore::IDBServer::UniqueIDBDatabase::operationAndTransactionTimerFired): If the database is not
          currently in use, close it.
        (WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        (WebCore::IDBServer::UniqueIDBDatabase::deletePending): Deleted.

        * Modules/indexeddb/shared/IDBObjectStoreInfo.cpp:
        (WebCore::IDBObjectStoreInfo::isolatedCopy): Actually get this right.

2016-03-02  Gavin Barraclough  <barraclough@apple.com>

        Disable timer throttling increases for visually idle / active pages.
        https://bugs.webkit.org/show_bug.cgi?id=154935

        Reviewed by Chris Dumez.

        Currently any page that is visually idle can timer throttle, and all are eligible for throttling
        allow throttling to increase.

        Instead, still allow any visually idle page to timer throttle, but only allow increasing in those
        that are fully hidden & inactive (no page loading or media activity).

        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingState):
            - Updated policy per commet above.
        (WebCore::Page::setPageActivityState):
        (WebCore::Page::setIsVisible):
            - We now may need to updated timer throttling when these change.

2016-03-02  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
        https://bugs.webkit.org/show_bug.cgi?id=154651

        Reviewed by Alex Christensen.

        No new tests needed.

        * CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

2016-03-02  Dave Hyatt  <hyatt@apple.com>

        Add support for the "first" value of the hanging-punctuation property.
        https://bugs.webkit.org/show_bug.cgi?id=154919

        Reviewed by Simon Fraser.

        New tests added in fast/text.

        Implement the "first" value for hanging-punctuation as described here:
        https://drafts.csswg.org/css-text-3/#propdef-hanging-punctuation

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths):
        Update the preferred logical width computation to factor in hanging punctuation.
        This check is similar to the text-indent logic in that we only want to do it for
        the first formatted line.

        * rendering/RenderBlockFlow.h:
        (WebCore::RenderBlockFlow::simpleLineLayout):
        Make sure to turn off simple line layout when hanging punctuation is present. Eventually
        it should be feasible to support this in simple line layout, but since the full line
        layout model has to work with it anyway, we are starting there.

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::inlineAncestorHasStartBorderPaddingOrMargin):
        (WebCore::isLastInFlowRun):
        Helper functions that are needed to determine whether or not we're allowed to apply
        hanging punctuation "first" to a text run.

        (WebCore::RenderBlockFlow::computeInlineDirectionPositionsForSegment):
        This function manipulates logicalLeft and availableWidth when hanging punctuation
        is present to shift the line as needed and to expand the availableWidth of the line.

        * rendering/RenderText.cpp:
        (WebCore::isHangablePunctuationAtLineStart):
        (WebCore::isHangablePunctuationAtLineEnd):
        (WebCore::RenderText::hangablePunctuationStartWidth):
        (WebCore::RenderText::trimmedPrefWidths):
        * rendering/RenderText.h:
        RenderText has a helper function for handing back the hangable punctuation width. This
        is used everywhere line layout wants to apply that offset. There are also helper functions
        that detect whether the character is a hangable punctuation character.

        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForWithReason):
        (WebCore::SimpleLineLayout::printReason):
        Turn off simple line layout when hanging punctuation is enabled.

        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::handleText):
        Modified to expand the available width when hanging punctuation is present so that we
        know we have more room on the line.

        * rendering/line/LineWidth.h:
        (WebCore::LineWidth::isFirstLine):
        Add an accessor for whether or not we're the first line.

2016-03-01  Ryosuke Niwa  <rniwa@webkit.org>

        Make HTML parser construct custom elements
        https://bugs.webkit.org/show_bug.cgi?id=154908
        <rdar://problem/24923735>

        Reviewed by Antti Koivisto.

        Added the support for instantiating custom elements inside the parser. Based on Jan F2F discussion,
        the HTML parser is going to synchronously construct custom elements. When a custom element constructor
        throws, the HTML parser creates a HTMLUnknownElement instead.

        In our implementation, we pause the parser completely and construct custom elements using the same
        mechanism used to run author scripts. It's possible that we may want to apply some optimizations to
        to make custom element construction but it's probably a good idea to get semantics right first.

        Tests: fast/custom-elements/parser/parser-constructs-custom-elements.html
               fast/custom-elements/parser/parser-fallsback-to-unknown-element.html
               fast/custom-elements/parser/parser-sets-attributes-and-children.html
               fast/custom-elements/parser/parser-uses-constructed-element.html

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::constructElement): Added ShouldClearException as an argument
        to be used by the HTML parser since the parser can't re-throw to anywhere or fail parsing.

        * bindings/js/JSCustomElementInterface.h:
        (WebCore::JSCustomElementInterface::ShouldClearException): Added.

        * dom/Document.cpp:
        (WebCore::createHTMLElementWithNameValidation): Do not clear the exception here since createElement
        must re-throw the exception thrown by a custom element constructor.
        (WebCore::Document::createElementForBindings):

        * dom/make_names.pl:
        (printFactoryCppFile): Added ConstructorFunctionMapEntry which contains the constructor function
        as well as the qualified name.
        (printFactoryHeaderFile): Added a variant of createKnownElement and createElement that takes
        AtomicString instead of QualifiedName.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::setAttributes): Added a variant that takes Vector<Attribute>.
        (WebCore::HTMLConstructionSite::insertHTMLElementOrFindCustomElementInterface): Added. Returns a
        custom element interface when the element doesn't match any builtin element and there is a custom
        element definition that matches the specified name.
        (WebCore::HTMLConstructionSite::insertCustomElement): Added. Like insertElement but also sets the
        attributes on the newly created custom element.
        (WebCore::HTMLConstructionSite::createHTMLElementOrFindCustomElementInterface): Extracted from
        createHTMLElement. When customElementInterface is not nullptr, we optionally find the custom
        element interface and return nullptr.
        (WebCore::HTMLConstructionSite::createHTMLElement):
        * html/parser/HTMLConstructionSite.h:

        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Create a custom element when there
        is a pending custom element to create (i.e. m_customElementToConstruct is not empty).
        (WebCore::HTMLDocumentParser::isWaitingForScripts):

        * html/parser/HTMLStackItem.h:
        (WebCore::HTMLStackItem::create): Added a variant used for custom elements.
        (WebCore::HTMLStackItem::HTMLStackItem): Ditto.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::CustomElementConstructionData::CustomElementConstructionData): Added. It needs to be in
        the cpp file to avoid introducing more header dependencies in HTMLTreeBuilder.h.
        (WebCore::CustomElementConstructionData::~CustomElementConstructionData): Ditto.
        (WebCore::HTMLTreeBuilder::processStartTagForInBody): Use insertGenericHTMLElement when creating
        a generic element that could be custom elements.
        (WebCore::HTMLTreeBuilder::insertGenericHTMLElement): Added. Create and insert a new element
        or set m_customElementToConstruct so that the HTMLDocumentParser will create a custom element later.
        (WebCore::HTMLTreeBuilder::didCreateCustomOrCallbackElement): Added. Called by HTMLDocumentParser
        when it finishes creating a new custom element.

        * html/parser/HTMLTreeBuilder.h:
        (WebCore::HTMLTreeBuilder::takeCustomElementConstructionData): Added.
        (WebCore::HTMLTreeBuilder::hasParserBlockingScriptWork): Renamed from hasParserBlockingScript.
        Checks the existence of m_customElementToConstruct as well as m_scriptToProcess.

2016-03-02  Zalan Bujtas  <zalan@apple.com>

        Use IndentTextOrNot instead of passing isFirstLine/shouldIndentText as bool.
        https://bugs.webkit.org/show_bug.cgi?id=154628

        Reviewed by Simon Fraser.

        No change in behaviour.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeStartPositionDeltaForChildAvoidingFloats):
        (WebCore::RenderBlock::logicalLeftSelectionOffset):
        (WebCore::RenderBlock::logicalRightSelectionOffset):
        * rendering/RenderBlock.h:
        (WebCore::RenderBlock::availableLogicalWidthForLineInRegion):
        (WebCore::RenderBlock::logicalRightOffsetForLineInRegion):
        (WebCore::RenderBlock::logicalLeftOffsetForLineInRegion):
        (WebCore::RenderBlock::startOffsetForLineInRegion):
        (WebCore::RenderBlock::endOffsetForLineInRegion):
        (WebCore::RenderBlock::availableLogicalWidthForLine):
        (WebCore::RenderBlock::logicalRightOffsetForLine):
        (WebCore::RenderBlock::logicalLeftOffsetForLine):
        (WebCore::RenderBlock::startOffsetForLine):
        (WebCore::RenderBlock::endOffsetForLine):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::getClearDelta):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::updateLogicalInlinePositions):
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
        (WebCore::RenderBlockFlow::deleteEllipsisLineBoxes):
        (WebCore::RenderBlockFlow::checkLinesForTextOverflow):
        (WebCore::RenderBlockFlow::startAlignedOffsetForLine):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats):
        (WebCore::RenderBox::containingBlockAvailableLineWidthInRegion):
        * rendering/RenderDeprecatedFlexibleBox.cpp:
        (WebCore::RenderDeprecatedFlexibleBox::applyLineClamp):
        * rendering/RenderListItem.cpp:
        (WebCore::RenderListItem::positionListMarker):
        * rendering/RootInlineBox.cpp:
        (WebCore::RootInlineBox::selectionTop):
        (WebCore::RootInlineBox::selectionBottom):
        * rendering/SimpleLineLayout.cpp:
        (WebCore::SimpleLineLayout::canUseForWithReason):
        (WebCore::SimpleLineLayout::updateLineConstrains):
        * rendering/line/LineBreaker.cpp:
        (WebCore::LineBreaker::skipLeadingWhitespace):
        * rendering/line/LineWidth.cpp:
        (WebCore::LineWidth::shrinkAvailableWidthForNewFloatIfNeeded):
        (WebCore::availableWidthAtOffset):
        * rendering/line/LineWidth.h:
        (WebCore::LineWidth::shouldIndentText):

2016-03-02  Beth Dakin  <bdakin@apple.com>

        Add support for playbackControlsManager
        https://bugs.webkit.org/show_bug.cgi?id=154742
        -and corresponding-
        rdar://problem/23833753

        Reviewed by Jer Noble.

        Make AVKitSPI.h private so that it can be used from other projects.
        * WebCore.xcodeproj/project.pbxproj:

        Right now, set up a controls manager for a video when it starts playing. In 
        the future, this is something that should be handled by the 
        PlatformMediaSessionManager since we only want a controls for the 
        currentSession.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::playInternal):

        New function setUpVideoControlsManager.
        * page/ChromeClient.h:

        Make these CoreMedia functions available on Mac and iOS instead of just iOS.
        * platform/cf/CoreMediaSoftLink.cpp:
        * platform/cf/CoreMediaSoftLink.h:

        This patch fleshes out an implementation for a bunch of these interface 
        functions since they need to communicate to the playbackControlsManager. This 
        is also where the playbackControlsManager lives.
        * platform/mac/WebVideoFullscreenInterfaceMac.h:

        Define an interface and implementation for WebPlaybackControlsManager.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):
        (-[WebPlaybackControlsManager isSeeking]):
        (-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]):
        (-[WebPlaybackControlsManager audioMediaSelectionOptions]):
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
        (-[WebPlaybackControlsManager legibleMediaSelectionOptions]):
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):
        (-[WebPlaybackControlsManager cancelThumbnailAndAudioAmplitudeSampleGeneration]):

        Relay this information to the playbackControlsManager.
        (WebCore::WebVideoFullscreenInterfaceMac::setDuration):
        (WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        (WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges):
        (WebCore::WebVideoFullscreenInterfaceMac::ensureControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::playBackControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):

        New SPI needed.
        * platform/spi/cocoa/AVKitSPI.h:
        * platform/spi/mac/AVFoundationSPI.h:

2016-03-02  Gavin Barraclough  <barraclough@apple.com>

        Add Page::TimerThrottlingState
        https://bugs.webkit.org/show_bug.cgi?id=154926

        Reviewed by Chris Dumez.

        Hidden page timer throttling is currently a boolean state, indicated by whether the Optional
        m_timerThrottlingEnabledTime is in a set/unset state. When enabled, the increasing mechanism
        may or may not be enabled, this is controlled directly by the setting.

        Refactor to add an enum tracking timer throttling being in one of three states - disabled,
        enabled, or enabled-increasing. This cleans things up, and will enabled up to introduce a
        dynamic policy for when enabled-throttling is enabled. (Behavior is unchanged in this patch.)

        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::setIsVisuallyIdleInternal):
        (WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged):
            - setTimerThrottlingEnabled -> updateTimerThrottlingState.
        (WebCore::Page::updateTimerThrottlingState):
            - policy decision (currently enabled if visually-idle) was scattered across
              all call sites to setTimerThrottlingState. Unify in one place.
        (WebCore::Page::setTimerThrottlingState):
            - Was setTimerThrottlingEnabled.
        (WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
        (WebCore::Page::setDOMTimerAlignmentInterval):
        (WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):
            - updated to check m_timerThrottlingState.
        (WebCore::Page::setTimerThrottlingEnabled): Deleted.
            - This became updateTimerThrottlingState.
        * page/Page.h:
        (WebCore::Page::timerThrottlingEnabled): Deleted.
            - Removed, it's easy enough now to just check m_timerThrottlingState.

2016-03-02  Chris Dumez  <cdumez@apple.com>

        Align HTMLInputElement.maxLength with the specification
        https://bugs.webkit.org/show_bug.cgi?id=154906

        Reviewed by Ryosuke Niwa.

        Align HTMLInputElement.maxLength with the specification:
        - https://html.spec.whatwg.org/multipage/forms.html#dom-input-maxlength
        - https://html.spec.whatwg.org/multipage/forms.html#attr-input-maxlength

        In particular, the following Web-facing change was made:
        - HTMLInputElement.maxLength returns -1 instead of 524288 when
          the corresponding content attribute is missing, cannot be parsed
          or out of range (i.e. negative), as per:
          - https://html.spec.whatwg.org/multipage/infrastructure.html#limited-to-only-non-negative-numbers

        Note that HTMLTextAreaElement.maxLength was already returning -1 in
        this case.

        The new behavior matches Firefox. Chrome however, still seems to
        return 524288.

        Note that we keep using 524288 as a maximum maxLength internally for
        performance reasons. However, we stop exposing this arbitrary value to
        the Web as this is an internal limitation.

        No new tests, already covered by existing tests.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::HTMLInputElement):
        Initialize m_maxLength to -1 initially, instead of 524288.

        (WebCore::HTMLInputElement::tooLong):
        Call effectiveMaxLength() instead of maxLength(), which no longer
        exists. effectiveMaxLength() makes sure of returning a value in
        the range [0, 524288].

        (WebCore::HTMLInputElement::parseAttribute):

        (WebCore::HTMLInputElement::effectiveMaxLength):
        Split maxLength() into maxLengthForBindings() and effectiveMaxLength().
        effectiveMaxLength() returns a value in the range [0, 524288], while
        maxLengthForBindings() returns values in the range [-1, 2147483647].

        (WebCore::HTMLInputElement::setMaxLength): Deleted.
        The implementation was moved to the parent class so that it can be
        shared with HTMLTextAreaElement.

        (WebCore::HTMLInputElement::maxLengthAttributeChanged):
        Rename for clarity.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::parseAttribute):
        (WebCore::HTMLTextAreaElement::maxLengthAttributeChanged):
        Cache the parsed maxLength when the content attribute changes, similarly
        to what is already done in HTMLInputElement.

        (WebCore::HTMLTextAreaElement::handleBeforeTextInsertedEvent):
        (WebCore::HTMLTextAreaElement::validationMessage):
        (WebCore::HTMLTextAreaElement::tooLong):
        Call effectiveMaxLength() instead of maxLength() which no longer exists.
        effectiveMaxLength() returns a cached value and is therefore a lot more
        efficient.

        * html/HTMLTextAreaElement.h:
        * html/HTMLTextAreaElement.idl:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::setMaxLengthForBindings):
        This was moved up from HTMLInputElement / HTMLTextAreaElement to avoid code
        duplication.

        * html/HTMLTextFormControlElement.h:

        * html/InputType.cpp:
        (WebCore::InputType::validationMessage):
        * html/TextFieldInputType.cpp:
        (WebCore::TextFieldInputType::handleBeforeTextInsertedEvent):
        Call HTMLInputElement::effectiveMaxLength() instead of
        HTMLInputElement::maxLength() which no longer exists.

2016-03-02  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197434 and r197436.
        https://bugs.webkit.org/show_bug.cgi?id=154921

        This change caused a LayoutTest assertion in debug (Requested
        by ryanhaddad on #webkit).

        Reverted changesets:

        "Extend CSSFontSelector's lifetime to be longer than the
        Document's lifetime"
        https://bugs.webkit.org/show_bug.cgi?id=154101
        http://trac.webkit.org/changeset/197434

        "Unreviewed build fix after r197434."
        http://trac.webkit.org/changeset/197436

2016-03-02  Zalan Bujtas  <zalan@apple.com>

        Subpixel layout: Enable vertical/horizontal subpixel spacing for tables.
        https://bugs.webkit.org/show_bug.cgi?id=154899

        Reviewed by Simon Fraser.

        This patch enables authors to specify device pixel values for table border spacing.
        (see border-spacing)

        Test: fast/table/hidpi-vertical-and-horizontal-spacing.html

        * css/CSSPropertyNames.in:
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::offsetLeftForColumn):
        (WebCore::RenderTable::offsetWidthForColumn):
        (WebCore::RenderTable::RenderTable): Deleted.
        * rendering/RenderTable.h:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::horizontalBorderSpacing):
        (WebCore::RenderStyle::verticalBorderSpacing):
        (WebCore::RenderStyle::setHorizontalBorderSpacing):
        (WebCore::RenderStyle::setVerticalBorderSpacing):
        * rendering/style/RenderStyle.h:
        * rendering/style/StyleInheritedData.h:

2016-03-02  Chris Dumez  <cdumez@apple.com>

        Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use WTF::Optional
        https://bugs.webkit.org/show_bug.cgi?id=154845

        Reviewed by Darin Adler.

        Take into consideration review comments made after landing r197389.

        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseBorderWidthAttribute):
        (WebCore::HTMLElement::parseAttribute):
        * html/HTMLInputElement.cpp:
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::maxLength):
        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::height):
        (WebCore::ImageInputType::width):
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLNonNegativeInteger):
        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
        (WebCore::limitToOnlyHTMLNonNegative):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::parseAttribute):

2016-03-01  Ryosuke Niwa  <rniwa@webkit.org>

        Unreviewed. Remove the "Partial Support" status from web components since shadow DOM and custom elements
        are in active development.

        * features.json:

2016-03-01  Ryosuke Niwa  <rniwa@webkit.org>

        Unreviewed. Update the feature status for custom elements API.

        * features.json:

2016-02-26  Ryosuke Niwa  <rniwa@webkit.org>

        Contents inside a shadow host with a negative tabindex should not be tab focusable
        https://bugs.webkit.org/show_bug.cgi?id=154769

        Reviewed by Antti Koivisto.

        Contents inside a shadow host with a negative tabindex content attribute should not be included in
        the sequential focus navigation order as discussed on https://github.com/w3c/webcomponents/issues/399.

        Test: fast/shadow-dom/negative-tabindex-on-shadow-host.html

        * dom/Element.cpp:
        (WebCore::Element::tabIndexSetExplicitly): Added.
        * dom/Element.h:
        * page/FocusController.cpp:
        (WebCore::shadowAdjustedTabIndex): Renamed from adjustedTabIndex. Return 0 when tabindex content attribute
        is not explicitly set since element.tabIndex() would return -1 for HTML elements in such case.
        (WebCore::isFocusableOrHasShadowTreeWithoutCustomFocusLogic): Renamed from shouldVisit.
        (WebCore::FocusController::findElementWithExactTabIndex):
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::previousElementWithLowerTabIndex):
        (WebCore::FocusController::nextFocusableElement):
        (WebCore::FocusController::previousFocusableElement):

2016-03-01  Michael Saboff  <msaboff@apple.com>

        REGRESSION (r197426): Missed adding unicode parameter to call to Yarr::parse() in URLFilterParser::addPattern()
        https://bugs.webkit.org/show_bug.cgi?id=154898

        Reviewed by Saam Barati.

        This is a fix for the API tests after r197426.

        Added missing bool unicode parameter of "false".

        * contentextensions/URLFilterParser.cpp:
        (WebCore::ContentExtensions::URLFilterParser::addPattern):

2016-03-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Unreviewed build fix after r197434.

        Unreviewed

        * css/SourceSizeList.cpp:
        (WebCore::parseSizesAttribute):

2016-03-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Small-caps non-BMP characters are garbled in the complex text codepath
        https://bugs.webkit.org/show_bug.cgi?id=154875

        Reviewed by Michael Saboff.

        We were assuming that all characters able to be capitalized are in BMP. This is not true.

        Test: fast/text/complex-small-caps-non-bmp-capitalize.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::capitalized):
        (WebCore::ComplexTextController::collectComplexTextRuns):

2016-03-01  Myles C. Maxfield  <mmaxfield@apple.com>

        Extend CSSFontSelector's lifetime to be longer than the Document's lifetime
        https://bugs.webkit.org/show_bug.cgi?id=154101

        Reviewed by Darin Adler.

        Rather than destroying the Document's CSSFontSelector, instead, the object should
        live for the lifetime of the document, and it should instead be asked to clear its
        contents.

        This is important for the CSS Font Loading API, where the identity of objects the
        CSSFontSelector references needs to persist throughout the lifetime of the
        Document. This patch represents the first step to implementing this correctly.
        The second step is for the CSSFontSelector to perform a diff instead of a
        wholesale clear of its contents. Once this is done, font loading objects can
        survive through a call to Document::clearStyleResolver().

        This patch gives the CSSFontSelector two states: building underway and building not
        underway. The state is building underway in between calls to clearStyleResolver()
        and when the style resolver gets built back up. Otherwise, the state is building
        not underway. Because of this new design, creation of all FontFace objects can be
        postponed until a state transition from building underway to building not underway.
        A subsequent patch will perform the diff at this point. An ASSERT() makes sure that
        we never service a font lookup request while Building.

        No new tests because there is no behavior change.

        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::clear):
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::buildStarted):
        (WebCore::CSSFontSelector::buildCompleted):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::CSSFontSelector::fontRangesForFamily):
        (WebCore::CSSFontSelector::CSSFontSelector): Deleted.
        (WebCore::CSSFontSelector::clearDocument): Deleted.
        * css/CSSFontSelector.h:
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::appendAuthorStyleSheets):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        (WebCore::Document::~Document):
        (WebCore::Document::clearStyleResolver):
        (WebCore::Document::fontSelector): Deleted.
        * dom/Document.h:
        (WebCore::Document::fontSelector):

2016-03-01  Alexey Proskuryakov  <ap@apple.com>

        Update Xcode project for InstallAPI
        https://bugs.webkit.org/show_bug.cgi?id=154896
        rdar://problem/24825992

        Patch by Daniel Dunbar, reviewed by me.

        * Configurations/WebCore.xcconfig:
        * WebCore.xcodeproj/project.pbxproj:

2016-03-01  Ada Chan  <adachan@apple.com>

        One more attempt to fix the build.

        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):

2016-03-01  Ada Chan  <adachan@apple.com>

        Attempt to fix the internal build.

        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):

2016-02-29  Ada Chan  <adachan@apple.com>

        Adopt the new version of AVOutputDeviceMenuController's showMenuForRect method.
        https://bugs.webkit.org/show_bug.cgi?id=154823

        Reviewed by Tim Horton.

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::showPlaybackTargetPicker):
        (WebCore::WebMediaSessionManager::customPlaybackActionSelected):
        Call customPlaybackActionSelected() on the client that requested the picker.
        * Modules/mediasession/WebMediaSessionManager.h:
        * Modules/mediasession/WebMediaSessionManagerClient.h:
        * dom/Document.cpp:
        (WebCore::Document::showPlaybackTargetPicker):
        (WebCore::Document::customPlaybackActionSelected):
        * dom/Document.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::customPlaybackActionSelected):
        (WebCore::HTMLMediaElement::playbackTargetPickerCustomActionName):
        * html/HTMLMediaElement.h:
        * html/MediaElementSession.cpp:
        (WebCore::MediaElementSession::showPlaybackTargetPicker):
        (WebCore::MediaElementSession::customPlaybackActionSelected):
        * html/MediaElementSession.h:
        * page/ChromeClient.h:
        * page/Page.cpp:
        (WebCore::Page::showPlaybackTargetPicker):
        (WebCore::Page::customPlaybackActionSelected):
        * page/Page.h:
        * platform/audio/PlatformMediaSession.h:
        (WebCore::PlatformMediaSessionClient::customPlaybackActionSelected):
        * platform/graphics/MediaPlaybackTargetClient.h:
        * platform/graphics/MediaPlaybackTargetPicker.cpp:
        (WebCore::MediaPlaybackTargetPicker::pendingActionTimerFired):
        (WebCore::MediaPlaybackTargetPicker::showPlaybackTargetPicker):
        * platform/graphics/MediaPlaybackTargetPicker.h:
        (WebCore::MediaPlaybackTargetPicker::Client::customPlaybackActionSelected):
        (WebCore::MediaPlaybackTargetPicker::customPlaybackActionSelected):
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.h:
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        Update the forward declaration of AVOutputDeviceMenuController's showMenuForRect method.
        (WebCore::MediaPlaybackTargetPickerMac::showPlaybackTargetPicker):
        Call the new version of showMenuForRect if available.
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback):
        * platform/mock/MediaPlaybackTargetPickerMock.cpp:
        (WebCore::MediaPlaybackTargetPickerMock::showPlaybackTargetPicker):
        * platform/mock/MediaPlaybackTargetPickerMock.h:
        * platform/spi/cocoa/AVKitSPI.h:
        Updated with the new version of showMenuForRect.

2016-03-01  Daniel Bates  <dabates@apple.com>

        com.apple.WebKit.Networking.Development crashes in WebCore::formOpen()
        https://bugs.webkit.org/show_bug.cgi?id=154682
        <rdar://problem/23550269>

        Reviewed by Brent Fulgham.

        Speculative fix for a race condition when opening the stream for the next form data element.
        Calling CFReadStreamOpen(s) in WebCore::openNextStream() can cause stream s to be closed and
        deallocated before CFReadStreamOpen(s) returns.

        When WebCore::openNextStream() is called it closes and deallocates the current stream and
        then opens a new stream for the next form data element. Calling CFReadStreamOpen() in
        WebCore::openNextStream() can lead to WebCore::openNextStream() being re-entered via
        WebCore::formEventCallback() from another thread. One example when this can occur is when
        the stream being opened has no data (i.e. WebCore::formEventCallback() is called
        back with event type kCFStreamEventEndEncountered).

        I have been unable to reproduce this crash. We know that it occurs from crash reports.

        * platform/network/cf/FormDataStreamCFNet.cpp:
        (WebCore::closeCurrentStream): Assert that we had acquired a lock to close the stream.
        (WebCore::advanceCurrentStream): Assert that we had acquired a lock to advance the stream.
        (WebCore::openNextStream): Acquire a lock before we open the next stream to ensure that
        exactly one thread executes this critical section at a time.
        (WebCore::formFinalize): Acquire a lock before we close the current stream.
        (WebCore::formClose): Ditto.

2016-03-01  Michael Saboff  <msaboff@apple.com>

        ASSERT in platform/graphics/mac/ComplexTextController.cpp::capitalize()
        https://bugs.webkit.org/show_bug.cgi?id=154875

        Reviewed by Myles C. Maxfield.

        Change an ASSERT to verify that uper casing a character doesn't change its size.

        Test: fast/text/regress-154875.html

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::capitalized):

2016-03-01  Gavin Barraclough  <barraclough@apple.com>

        Timer alignment in separate web processes should not all sync up to the same point.
        https://bugs.webkit.org/show_bug.cgi?id=154878

        Reviewed by Chris Dumez.

        For any given WebContent process it is desirable that timers are synchronized to a single
        alignment point, but if all WebContent processes align to the same point then there may
        be a thundering herd of processes waking up.

        * page/DOMTimer.cpp:
        (WebCore::DOMTimer::alignedFireTime):
            - align to a randomized point.

2016-03-01  Alex Christensen  <achristensen@webkit.org>

        Reduce size of internal windows build output
        https://bugs.webkit.org/show_bug.cgi?id=154763

        Reviewed by Brent Fulgham.

        * WebCore.vcxproj/WebCore.proj:

2016-03-01  Andreas Kling  <akling@apple.com>

        REGRESSION (r154616): Accelerated drawing is off during the initial load
        <https://webkit.org/b/123812>

        Reviewed by Tim Horton.

        Robustify the hey-the-Settings-changed callbacks in Page to handle document-less frames.
        This is needed because now Settings are changed even before the main Frame has a Document.

        * page/Page.cpp:
        (WebCore::networkStateChanged):
        (WebCore::Page::updateStyleForAllPagesAfterGlobalChangeInEnvironment):
        (WebCore::Page::takeAnyMediaCanStartListener):
        (WebCore::Page::setMediaVolume):
        (WebCore::Page::setPageScaleFactor):
        (WebCore::Page::invalidateStylesForAllLinks):
        (WebCore::Page::invalidateStylesForLink):
        (WebCore::Page::dnsPrefetchingStateChanged):
        (WebCore::Page::storageBlockingStateChanged):
        (WebCore::Page::setMuted):
        (WebCore::Page::captionPreferencesChanged):
        (WebCore::Page::setSessionID):
        (WebCore::Page::setPlaybackTarget):
        (WebCore::Page::playbackTargetAvailabilityDidChange):
        (WebCore::Page::setShouldPlayToPlaybackTarget):
        * page/Settings.cpp:
        (WebCore::setImageLoadingSettings):

2016-03-01  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197056.
        https://bugs.webkit.org/show_bug.cgi?id=154870

        broke win ews (Requested by alexchristensen on #webkit).

        Reverted changeset:

        "[cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK."
        https://bugs.webkit.org/show_bug.cgi?id=154651
        http://trac.webkit.org/changeset/197056

2016-03-01  Brady Eidson  <beidson@apple.com>

        Modern IDB: Possible crash deallocating IDBDatabaseInfo/IDBObjectStoreInfo/IDBIndexInfo.
        https://bugs.webkit.org/show_bug.cgi?id=154860

        Reviewed by Alex Christensen.

        Covered by existing tests.

        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
        (WebCore::IDBDatabaseInfo::IDBDatabaseInfo):
        (WebCore::IDBDatabaseInfo::isolatedCopy):
        * Modules/indexeddb/shared/IDBDatabaseInfo.h:

        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::isolatedCopy): If there's an IDBDatabaseInfo to copy,  that
          copy needs to be isolated.

2016-03-01  Tim Horton  <timothy_horton@apple.com>

        Expose MediaElement and VideoElement to the Objective-C DOM bindings
        https://bugs.webkit.org/show_bug.cgi?id=154830

        Reviewed by Sam Weinig.

        * Modules/mediasession/HTMLMediaElementMediaSession.idl:
        * Modules/mediastream/HTMLMediaElementMediaStream.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLVideoElement.idl:
        Avoid Objective-C bindings for various extraneous bits, like MediaSource and MediaSession,
        to avoid exposing way more than we need to.

        * WebCore.xcodeproj/project.pbxproj:
        Add a bunch of Derived Sources.

2016-03-01  Antti Koivisto  <antti@apple.com>

        Text control shadow element style shouldn't depend on renderers
        https://bugs.webkit.org/show_bug.cgi?id=154855

        Reviewed by Andreas Kling.

        Currently the code for computing style for text control shadow elements lives in render tree.
        Style is the input for building a render tree and should be computable without having one.

        Fix by moving virtual createInnerTextStyle() from RenderTextControl hierarchy to the DOM side
        HTMLTextFormControlElement hierarchy.

        * dom/Element.cpp:
        (WebCore::Element::didDetachRenderers):
        (WebCore::Element::customStyleForRenderer):

            Also pass shadow host style as it is needed for text controls.

        * dom/Element.h:
        * dom/PseudoElement.cpp:
        (WebCore::PseudoElement::clearHostElement):
        (WebCore::PseudoElement::customStyleForRenderer):
        * dom/PseudoElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setRangeText):
        (WebCore::HTMLInputElement::createInnerTextStyle):
        (WebCore::HTMLInputElement::setupDateTimeChooserParameters):
        * html/HTMLInputElement.h:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::willRespondToMouseClickEvents):
        (WebCore::HTMLTextAreaElement::createInnerTextStyle):
        * html/HTMLTextAreaElement.h:
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::directionForFormData):
        (WebCore::HTMLTextFormControlElement::adjustInnerTextStyle):
        * html/HTMLTextFormControlElement.h:
        (WebCore::HTMLTextFormControlElement::cachedSelectionDirection):
        * html/shadow/TextControlInnerElements.cpp:
        (WebCore::TextControlInnerElement::create):
        (WebCore::TextControlInnerElement::customStyleForRenderer):
        (WebCore::TextControlInnerTextElement::renderer):
        (WebCore::TextControlInnerTextElement::customStyleForRenderer):
        * html/shadow/TextControlInnerElements.h:
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::styleDidChange):
        (WebCore::RenderTextControl::textBlockLogicalHeight):
        (WebCore::RenderTextControl::adjustInnerTextStyle): Deleted.
        * rendering/RenderTextControl.h:
        * rendering/RenderTextControlMultiLine.cpp:
        (WebCore::RenderTextControlMultiLine::baselinePosition):
        (WebCore::RenderTextControlMultiLine::layoutSpecialExcludedChild):
        (WebCore::RenderTextControlMultiLine::createInnerTextStyle): Deleted.

            createInnerTextStyle moves to HTMLTextAreaElement::createInnerTextStyle

        * rendering/RenderTextControlMultiLine.h:
        * rendering/RenderTextControlSingleLine.cpp:
        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):

            Remove m_desiredInnerTextLogicalHeight cache. It doesn't work, it is never valid when hit.

        (WebCore::RenderTextControlSingleLine::layout):
        (WebCore::RenderTextControlSingleLine::styleDidChange):
        (WebCore::RenderTextControlSingleLine::computeControlLogicalHeight):
        (WebCore::RenderTextControlSingleLine::textShouldBeTruncated):
        (WebCore::RenderTextControlSingleLine::createInnerTextStyle): Deleted.
        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle): Deleted.

            - createInnerTextStyle moves to HTMLInputElement::createInnerTextStyle
            - createInnerBlockStyle moves to TextControlInnerElement::customStyleForRenderer

        * rendering/RenderTextControlSingleLine.h:
        (WebCore::RenderTextControlSingleLine::centerContainerIfNeeded):
        (WebCore::RenderTextControlSingleLine::containerElement):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::styleForElement):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::synchronizeSystemLanguage):
        (WebCore::SVGElement::customStyleForRenderer):
        * svg/SVGElement.h:

2016-03-01  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Get rid of GridResolvedPosition
        https://bugs.webkit.org/show_bug.cgi?id=154818

        Reviewed by Darin Adler.

        GridResolvedPosition was a small class just wrapping a unsigned.
        In the future it should actually wrap an integer,
        as we want to support implicit tracks before the explicit grid.

        The class itself is not providing any benefit,
        so we can get rid of it and store directly 2 unsigned in GridSpan.

        This will make simpler future changes related to this task.

        We keep the class just as a utility for the methods
        that deal with the positions resolution.
        But it should be renamed in a follow-up patch.

        No new tests, no change of behavior.

        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::stringForPosition):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::findFlexFactorUnitSize):
        (WebCore::RenderGrid::spanningItemCrossesFlexibleSizedTracks):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForItems):
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::createEmptyGridAreaAtSpecifiedPositionsOutsideGrid):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::gridAreaBreadthForChild):
        (WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        * rendering/style/GridCoordinate.h:
        (WebCore::GridSpan::definiteGridSpan):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::resolvedInitialPosition):
        (WebCore::GridSpan::resolvedFinalPosition):
        (WebCore::GridSpan::GridSpanIterator::GridSpanIterator):
        (WebCore::GridSpan::GridSpanIterator::operator*):
        (WebCore::GridSpan::GridSpanIterator::operator++):
        (WebCore::GridSpan::GridSpanIterator::operator!=):
        (WebCore::GridSpan::begin):
        (WebCore::GridSpan::end):
        (WebCore::GridSpan::GridSpan):
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::resolveNamedGridLinePositionFromStyle):
        (WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
        (WebCore::resolveGridPositionFromStyle):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
        * rendering/style/GridResolvedPosition.h:
        (WebCore::GridResolvedPosition::GridResolvedPosition): Deleted.
        (WebCore::GridResolvedPosition::operator*): Deleted.
        (WebCore::GridResolvedPosition::operator++): Deleted.
        (WebCore::GridResolvedPosition::operator==): Deleted.
        (WebCore::GridResolvedPosition::operator!=): Deleted.
        (WebCore::GridResolvedPosition::operator<): Deleted.
        (WebCore::GridResolvedPosition::operator>): Deleted.
        (WebCore::GridResolvedPosition::operator<=): Deleted.
        (WebCore::GridResolvedPosition::operator>=): Deleted.
        (WebCore::GridResolvedPosition::toInt): Deleted.
        (WebCore::GridResolvedPosition::next): Deleted.
        (WebCore::GridResolvedPosition::prev): Deleted.

2016-03-01  Andreas Kling  <akling@apple.com>

        MemoryCache::forEachResource() should guard resources across function invocation.
        <https://webkit.org/b/154846>

        Reviewed by Antti Koivisto.

        It occurred to me that we should protect the CachedResources from being
        deleted while invoking the custom function here, lest we create a giant footgun.

        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::forEachResource):

2016-03-01  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] One more unreviewed speculative buildfix after r197375. Just for fun.

        * PlatformMac.cmake:

2016-03-01  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r197375. Just for fun.

        * PlatformMac.cmake:

2016-03-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Support Request and Response blob() when body data is a blob
        https://bugs.webkit.org/show_bug.cgi?id=154820

        Reviewed by Darin Adler.

        Adding support for returning the same Blob that is stored in Body in case JS blob() is called.
        Adding support for Blob creation when data is stored as text.
        Updated JSDOMBinding and JSDOMPromise to return a JS ArrayBuffer for Vector<char> as well as Vector<unsigned char>.

        Covered by added tests.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::arrayBuffer):
        (WebCore::FetchBody::blob):
        (WebCore::FetchBody::extractFromText):
        * Modules/fetch/FetchBody.h:
        * bindings/js/JSDOMBinding.h:
        (WebCore::toJS):
        * bindings/js/JSDOMPromise.h:
        (WebCore::DeferredWrapper::resolve): Deleted.

2016-02-29  Chris Dumez  <cdumez@apple.com>

        Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use WTF::Optional
        https://bugs.webkit.org/show_bug.cgi?id=154845

        Reviewed by Ryosuke Niwa.

        Have parseHTMLInteger() / parseHTMLNonNegativeInteger() use
        WTF::Optional.

        * dom/Element.cpp:
        (WebCore::Element::getIntegralAttribute):
        (WebCore::Element::getUnsignedIntegralAttribute):
        (WebCore::Element::setUnsignedIntegralAttribute): Deleted.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::parseBorderWidthAttribute):
        (WebCore::HTMLElement::parseAttribute):
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseMaxLengthAttribute):
        * html/HTMLInputElement.h:
        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::parseAttribute):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::maxLength):
        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::height):
        (WebCore::ImageInputType::width):
        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLIntegerInternal):
        (WebCore::parseHTMLInteger):
        (WebCore::parseHTMLNonNegativeInteger):
        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
        (WebCore::limitToOnlyHTMLNonNegative):
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::parseAttribute):

2016-02-29  Zan Dobersek  <zdobersek@igalia.com>

        TextureMapperGL: simplify TransformationMatrix copies in draw(), beginClip()
        https://bugs.webkit.org/show_bug.cgi?id=154791

        Reviewed by Carlos Garcia Campos.

        In both functions, the passed-in model-view matrix is first copied, multiplied
        against a rect-to-rect TransformationMatrix, and then assigned into a local
        TransformationMatrix variable, which causes another copy due to the multiply()
        function returning a reference to the modified object.

        To avoid the last copy, first copy the model-view matrix into a local variable,
        and multiply the rect-to-rect TransformationMatrix into the new object afterwards.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::draw):
        (WebCore::TextureMapperGL::beginClip):

2016-02-29  Zan Dobersek  <zdobersek@igalia.com>

        ImageBufferCairo should support OpenGL ES 2 configurations
        https://bugs.webkit.org/show_bug.cgi?id=154790

        Reviewed by Carlos Garcia Campos.

        When building with OpenGL ES 2 and with accelerated 2D canvas support,
        the GLES2 header should be included instead of the OpenGLShims.h header.

        The glTexParameterf() calls targeting GL_TEXTURE_WRAP_S and
        GL_TEXTURE_WRAP_T parameters should use the GL_CLAMP_TO_EDGE value.
        GL_CLAMP isn't available in OpenGL ES 2 and was dropped in OpenGL 3.

        * platform/graphics/cairo/ImageBufferCairo.cpp:
        (WebCore::ImageBufferData::createCairoGLSurface):

2016-02-29  Zan Dobersek  <zdobersek@igalia.com>

        TextureMapperGL: beginPainting() should handle the PaintingMirrored value in PaintFlags
        https://bugs.webkit.org/show_bug.cgi?id=154789

        Reviewed by Carlos Garcia Campos.

        * platform/graphics/texmap/TextureMapperGL.cpp:
        (WebCore::TextureMapperGL::beginPainting): The ClipStack should be reset with
        a Y-axis mode that corresponds to the presence of the PaintingMirrored value in
        the passed-in PaintFlags argument. If present, the default Y-axis mode should be
        used, and the inverted Y-axis otherwise.

2016-02-29  Zan Dobersek  <zdobersek@igalia.com>

        CoordinatedGraphicsLayer should override the inherited TextureMapperPlatformLayer::Client methods
        https://bugs.webkit.org/show_bug.cgi?id=154788

        Reviewed by Carlos Garcia Campos.

        * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:
        Add the override specifiers for the two methods that are inherited
        from the TextureMapperPlatformLayer::Client interface.

2016-02-29  Simon Fraser  <simon.fraser@apple.com>

        Remove the experimental feature of antialiased font dilation
        https://bugs.webkit.org/show_bug.cgi?id=154843

        Reviewed by Zalan Bujtas.
        
        Remove the "antialiased font dilation" code path, and related prefs.

        * page/Settings.cpp:
        (WebCore::Settings::Settings): Deleted.
        (WebCore::Settings::setAntialiasedFontDilationEnabled): Deleted.
        * page/Settings.h:
        (WebCore::Settings::antialiasedFontDilationEnabled): Deleted.
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::setAntialiasedFontDilationEnabled): Deleted.
        (WebCore::FontCascade::antialiasedFontDilationEnabled): Deleted.
        * platform/graphics/FontCascade.h:
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContextStateChange::changesFromState): Deleted.
        (WebCore::GraphicsContextStateChange::accumulate): Deleted.
        (WebCore::GraphicsContextStateChange::apply): Deleted.
        (WebCore::GraphicsContextStateChange::dump): Deleted.
        (WebCore::GraphicsContext::setAntialiasedFontDilationEnabled): Deleted.
        * platform/graphics/GraphicsContext.h:
        (WebCore::GraphicsContextState::GraphicsContextState): Deleted.
        (WebCore::GraphicsContext::antialiasedFontDilationEnabled): Deleted.
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayer::drawLayerContents): Deleted.
        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::dilationSizeForTextColor): Deleted.
        (WebCore::FontCascade::drawGlyphs): Deleted.
        * platform/graphics/displaylists/DisplayList.cpp:
        (WebCore::DisplayList::DisplayList::shouldDumpForFlags): Deleted.

2016-02-29  Jer Noble  <jer.noble@apple.com>

        Refactor CoreVideo API access into their own classes so code can be re-used.
        https://bugs.webkit.org/show_bug.cgi?id=154544

        Reviewed by Eric Carlson.

        In order for common CoreVideo code paths to be re-used in other classes, pull those paths
        out of MediaPlayerPrivateAVFoundationObjC and into re-usable clasess.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/cf/CoreMediaSoftLink.cpp:
        * platform/cf/CoreMediaSoftLink.h:
        * platform/cocoa/CoreVideoSoftLink.cpp: Added.
        * platform/cocoa/CoreVideoSoftLink.h: Added.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createPixelBuffer):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateLastImage):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::copyVideoTextureToPlatformTexture):
        (WebCore::CVPixelBufferGetBytePointerCallback): Deleted.
        (WebCore::CVPixelBufferReleaseBytePointerCallback): Deleted.
        (WebCore::CVPixelBufferReleaseInfoCallback): Deleted.
        (WebCore::createImageFromPixelBuffer): Deleted.
        (WebCore::enumToStringMap): Deleted.
        * platform/graphics/cv/PixelBufferConformerCV.cpp: Added.
        (WebCore::PixelBufferConformerCV::PixelBufferConformerCV):
        (WebCore::CVPixelBufferGetBytePointerCallback):
        (WebCore::CVPixelBufferReleaseBytePointerCallback):
        (WebCore::CVPixelBufferReleaseInfoCallback):
        (WebCore::PixelBufferConformerCV::createImageFromPixelBuffer):
        * platform/graphics/cv/PixelBufferConformerCV.h: Added.
        * platform/graphics/cv/TextureCacheCV.h: Added.
        (WebCore::TextureCacheCV::context):
        * platform/graphics/cv/TextureCacheCV.mm: Added.
        (WebCore::TextureCacheCV::create):
        (WebCore::TextureCacheCV::TextureCacheCV):
        (WebCore::TextureCacheCV::textureFromImage):
        * platform/graphics/cv/VideoTextureCopierCV.cpp: Added.
        (WebCore::VideoTextureCopierCV::VideoTextureCopierCV):
        (WebCore::VideoTextureCopierCV::~VideoTextureCopierCV):
        (WebCore::enumToStringMap):
        (WebCore::VideoTextureCopierCV::copyVideoTextureToPlatformTexture):
        * platform/graphics/cv/VideoTextureCopierCV.h: Added.
        (WebCore::VideoTextureCopierCV::context):
        * platform/mediastream/mac/AVVideoCaptureSource.mm: Move SOFT_LINK declarations into CoreVideoSoftLink.h/cpp.

2016-02-29  Chris Dumez  <cdumez@apple.com>

        Use WTF::Optional for HTMLOListElement::m_start
        https://bugs.webkit.org/show_bug.cgi?id=154824

        Reviewed by Andreas Kling.

        Use WTF::Optional for HTMLOListElement::m_start.

        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::parseAttribute):
        * html/HTMLOListElement.h:

2016-02-29  Gavin Barraclough  <barraclough@apple.com>

        RefCounter<T>::Event -> RefCounterEvent
        https://bugs.webkit.org/show_bug.cgi?id=154767

        Reviewed by Darin Adler.

        RefCounter<T>::Event is kinda verbose to use, and there is no need for this
        to be specific to a particular typeof RefCounter. Move the enum class up to
        the top level & rename to RefCounterEvent.

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::PageThrottler):
        (WebCore::m_audiblePluginHysteresis):
        (WebCore::m_mediaActivityCounter):
        (WebCore::m_pageLoadActivityCounter):
        * platform/VNodeTracker.cpp:
        (WebCore::VNodeTracker::singleton):
        (WebCore::VNodeTracker::VNodeTracker):
        (WebCore::m_lastWarningTime):

2016-02-29  Chris Dumez  <cdumez@apple.com>

        Use HTML parsing rules for textarea.maxLength
        https://bugs.webkit.org/show_bug.cgi?id=154805

        Reviewed by Andreas Kling.

        Use HTML parsing rules for textarea.maxLength:
        - https://html.spec.whatwg.org/multipage/forms.html#dom-textarea-maxlength
        - https://html.spec.whatwg.org/multipage/infrastructure.html#limited-to-only-non-negative-numbers

        No new tests, already covered by existing test.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::maxLength):

2016-02-29  Chris Dumez  <cdumez@apple.com>

        Align td.rowSpan / td.colSpan with the specification
        https://bugs.webkit.org/show_bug.cgi?id=154803

        Reviewed by Darin Adler.

        Align td.rowSpan / td.colSpan with the specification:
        - https://html.spec.whatwg.org/multipage/tables.html#htmltablecellelement
        - https://html.spec.whatwg.org/multipage/tables.html#dom-tdth-colspan
        - https://html.spec.whatwg.org/multipage/tables.html#dom-tdth-rowspan

        In particular, the following changes were made:
        - Change type from 'long' to 'unsigned long'.
        - Use HTML rules for parsing unsigned integers:
          - https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers
        - Use 1 as default value when the input value is out of range instead
          of 0 when setting.
        - rowspan is still clamped to [1, 8190] internally but we now expose the
          unclamped value to JS as this is an internal restriction. The same is
          done for a colSpan value of 0, we expose 0 to the Web but clamp to 1
          internally.

        No new tests, already covered by existing test.

        * html/HTMLTableCellElement.cpp:
        (WebCore::HTMLTableCellElement::colSpan):
        (WebCore::HTMLTableCellElement::rowSpan):
        (WebCore::HTMLTableCellElement::rowSpanForBindings):
        (WebCore::HTMLTableCellElement::setColSpan):
        (WebCore::HTMLTableCellElement::setRowSpanForBindings):
        (WebCore::HTMLTableCellElement::axis): Deleted.
        (WebCore::HTMLTableCellElement::headers): Deleted.
        * html/HTMLTableCellElement.h:
        * html/HTMLTableCellElement.idl:

2016-02-29  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Add support for [TreatNullAs=EmptyString] and use it
        https://bugs.webkit.org/show_bug.cgi?id=154654

        Reviewed by Darin Adler.

        Add support for [TreatNullAs=EmptyString] standard Web IDL extended
        attribute:
        - http://heycam.github.io/webidl/#TreatNullAs

        This replaces the WebKit-specific [TreatNullAs=NullString] IDL
        extended attribute. Instead of passing a null String() to the
        implementation, emptyString() is passed.

        This patch does not cause any web-exposed behavior change. For
        case where switching from NullString to EmptyString would change
        the behavior (or require changes to the implementation), the old
        IDL attribute was kept. However, it was renamed to
        [TreatNullAs=LegacyNullString] to discourage its use in new code.
        Eventually, this legacy IDL attribute should go away entirely.

        [TreatNullAs=EmptyString] should only be used when it is present
        in the corresponding specification. Note that there are a lot of
        places where we use [TreatNullAs=EmptyString] in our IDL where it
        does not match the specification. I have added FIXME comments for
        those so we can clean them up later.

        No new tests, no web-exposed behavior change.

        * Modules/mediastream/RTCPeerConnection.idl:
        No behavior change because this is not implemented.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::valueToStringTreatingNullAsEmptyString):
        * bindings/js/JSDOMBinding.h:
        Add new function to convert a JSValue into a String while treating
        null as the empty string.

        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        * bindings/scripts/IDLAttributes.txt:
        - Add support for [TreatNullAs=EmptyString].
        - Rename NullString to LegacyNullString to discourage its use.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl:
        Add bindings tests coverage for [TreatNullAs=EmptyString].

        * css/CSSStyleDeclaration.idl:
        * dom/CharacterData.idl:
        * dom/DOMImplementation.idl:
        * dom/Document.idl:
        * dom/Element.idl:
        * dom/ShadowRoot.idl:
        * html/HTMLOutputElement.idl:
        * html/HTMLScriptElement.idl:
        * html/URLUtils.idl:
        * svg/SVGAngle.idl:
        * svg/SVGLength.idl:
        Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString].
        There is not behavior change because the implementation does
        not distinguish the null string from the empty string.

        * html/HTMLBaseElement.idl:
        * html/HTMLButtonElement.idl:
        * html/HTMLFormElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLSelectElement.idl:
        * svg/SVGElement.idl:
        * svg/SVGScriptElement.idl:
        Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString],
        no behavior change.

        * html/HTMLDocument.idl:
        - dir and *Color: Rename [TreatNullAs=NullString] to
          [TreatNullAs=LegacyNullString].
        - designMode: Drop [TreatNullAs=NullString] as per the specification:
          - https://html.spec.whatwg.org/multipage/dom.html#the-document-object
          null now gets converted to "null" instead of the null String but this
          does not change behavior because the implementation only recognizes
          "on" / "off" / others. So we still end up using inherit mode when
          set to null.

        * html/HTMLElement.idl:
        - Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString] for
          innerText / outerText. Does not change behavior because the
          implementation does not distinguishes.
        - Drop [TreatNullAs=NullString] from contentEditable to match the spec:
          - https://html.spec.whatwg.org/multipage/interaction.html#elementcontenteditable
          This does not change behavior because the implementation will the a SyntaxError
          wether a null String or the string "null" is passed.

        * html/HTMLFrameElement.idl:
        Drop [TreatNullAs=NullString] from location attribute. This does not
        change behavior because the attribute is using a custom setter.

        * html/HTMLInputElement.idl:
        - formEnctype / formMethod / autocapitalize: Rename [TreatNullAs=NullString] to
          [TreatNullAs=LegacyNullString].
        - value: Rename [TreatNullAs=NullString] to Rename [TreatNullAs=EmptyString], which
          does not change behavior because the implementation does not distinguish. Also
          drop the extended attribute for non-JS bindings as it has no impact.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setMediaGroup):
        Drop redundant group.isNull() check as group.isEmpty() already checks for null.

        * html/HTMLScriptElement.cpp:
        (WebCore::HTMLScriptElement::setText):
        Drop useless .impl() call as we have a String and the method requires a String
        as input.

        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::setValueCommon):
        Use emptyString() instead of "" as it is slightly more efficient.

        * html/HTMLTextAreaElement.idl:
        - value: Use [TreatNullAs=EmptyString] instead of [TreatNullAs=NullString]. No
          behavior change because the implementation does not distinguish.
        - autocapitalize: Rename [TreatNullAs=NullString] to [TreatNullAs=LegacyNullString].

        * html/canvas/CanvasRenderingContext2D.idl:
        - globalCompositeOperation / repetitionType: Use [TreatNullAs=EmptyString] instead of
          [TreatNullAs=NullString]. No behavior change because the implementation does not
          distinguish.
        - lineCap / lineJoin: Drop the [TreatNullAs=NullString] to match the spec:
          - https://html.spec.whatwg.org/multipage/scripting.html#canvaspathdrawingstyles
          There is no behavior change because those are string enumerations and the value
          is not recognized either way (String() or String("null")).
        - shadowColor: Drop the [TreatNullAs=NullString] to match the spec:
          - https://html.spec.whatwg.org/multipage/scripting.html#canvasshadowstyles
          No behavior change because this is not a valid color either way.

2016-02-29  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Refactor FetchBody constructors
        https://bugs.webkit.org/show_bug.cgi?id=154721

        Reviewed by Sam Weinig and Darin Adler.

        Covered by existing tests.

        * Modules/fetch/FetchBody.cpp:
        (WebCore::FetchBody::extract): Renamed from "fromJSValue"
        (WebCore::FetchBody::extractFromBody): Renamed from "fromRequestBody" and making use of move constructor.
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::FetchBody): Making default constructor public and removing empty static method.
        * Modules/fetch/FetchRequest.cpp:
        (WebCore::buildBody):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::initializeWith):
        * Modules/fetch/FetchResponse.h:
        (WebCore::FetchResponse::create):

2016-02-28  Antti Koivisto  <antti@apple.com>

        ::slotted doesn't work in nested shadow trees
        https://bugs.webkit.org/show_bug.cgi?id=154765
        <rdar://problem/24870995>

        Reviewed by Ryosuke Niwa.

        See https://github.com/w3c/webcomponents/issues/331#issuecomment-189191593

        Test: fast/shadow-dom/css-scoping-shadow-slotted-nested.html

        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):

        Collect ::slotted rules from all the nested shadow trees instead of just the host's.

2016-02-28  Chris Dumez  <cdumez@apple.com>

        Parse HTMLOLElement.start as per the HTML spec
        https://bugs.webkit.org/show_bug.cgi?id=154802

        Reviewed by Andreas Kling.

        Parse HTMLOLElement.start as per the HTML spec:
        - https://html.spec.whatwg.org/multipage/semantics.html#dom-ol-start
        - https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-integers

        No new tests, already covered by existing test.

        * html/HTMLOListElement.cpp:
        (WebCore::HTMLOListElement::parseAttribute):

2016-02-28  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce uses of PassRefPtr in indexeddb
        https://bugs.webkit.org/show_bug.cgi?id=154273

        Reviewed by Darin Adler.

        No new tests, no behavior changes.

        * Modules/indexeddb/IDBDatabaseError.h:
        (WebCore::IDBDatabaseError::create):
        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::maybeCreateIDBKey):
        * Modules/indexeddb/IDBKeyData.h:
        * Modules/indexeddb/IDBKeyRange.cpp:
        (WebCore::IDBKeyRange::create):
        (WebCore::IDBKeyRange::IDBKeyRange):
        (WebCore::IDBKeyRange::only):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBKeyRange.h:
        (WebCore::IDBKeyRange::create):
        (WebCore::IDBKeyRange::lower):
        (WebCore::IDBKeyRange::upper):
        (WebCore::IDBKeyRange::lowerBound):
        (WebCore::IDBKeyRange::upperBound):
        (WebCore::IDBKeyRange::bound):
        * Modules/indexeddb/IDBKeyRangeData.cpp:
        (WebCore::IDBKeyRangeData::maybeCreateIDBKeyRange):
        * Modules/indexeddb/IDBKeyRangeData.h:
        * Modules/indexeddb/IDBServerConnection.h:
        * Modules/indexeddb/legacy/IDBCallbacks.h:
        * Modules/indexeddb/legacy/IDBCursorBackend.cpp:
        (WebCore::IDBCursorBackend::continueFunction):
        * Modules/indexeddb/legacy/IDBCursorBackend.h:
        * Modules/indexeddb/legacy/IDBCursorBackendOperations.h:
        (WebCore::CursorIterationOperation::create):
        (WebCore::CursorIterationOperation::CursorIterationOperation):
        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp:
        (WebCore::GetOperation::perform):
        (WebCore::PutOperation::perform):
        * Modules/indexeddb/legacy/LegacyCursor.cpp:
        (WebCore::LegacyCursor::continueFunction):
        * Modules/indexeddb/legacy/LegacyCursor.h:
        * Modules/indexeddb/legacy/LegacyFactory.h:
        (WebCore::LegacyFactory::create):
        * Modules/indexeddb/legacy/LegacyRequest.cpp:
        (WebCore::LegacyRequest::onSuccess):
        * Modules/indexeddb/legacy/LegacyRequest.h:
        * inspector/InspectorIndexedDBAgent.cpp:

2016-02-28  Tim Horton  <timothy_horton@apple.com>

        Switch to application/vnd.apple.folder for <attachment> folder special-case
        https://bugs.webkit.org/show_bug.cgi?id=154786
        <rdar://problem/24416632>

        Reviewed by Anders Carlsson.

        No new tests, adjusted an existing test to cover this.

        * rendering/RenderThemeMac.mm:
        (WebCore::iconForAttachment):
        Add a second folder MIME type.

2016-02-28  Tim Horton  <timothy_horton@apple.com>

        Variables can resolve to the wrong value when elements differ in nothing but inherited variable value
        https://bugs.webkit.org/show_bug.cgi?id=154785

        Reviewed by Antti Koivisto.

        Test: fast/css/variables/avoid-matched-property-cache.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::MatchResult::addMatchedProperties):
        Disable the matched property cache when a value is variable-dependent, because
        they can resolve to inherited values, and the matched property cache could
        end up copying the wrong value from another similarly-styled element.

2016-02-28  Konstantin Tokarev  <annulen@yandex.ru>

        SVGToOTFFontConversion.cpp does not compile with libstdc++ 4.8
        https://bugs.webkit.org/show_bug.cgi?id=154794

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::appendLigatureSubtable): Added const
        qualifiers.

2016-02-27  Chris Dumez  <cdumez@apple.com>

        Prevent cross-origin access to Location.assign() / Location.reload()
        https://bugs.webkit.org/show_bug.cgi?id=154779

        Reviewed by Darin Adler.

        Prevent cross-origin access to Location.assign() / Location.reload()
        to match the latest specification:
        - https://html.spec.whatwg.org/multipage/browsers.html#crossoriginproperties-(-o-)

        Firefox and Chrome already prevent this but WebKit allowed it.

        No new tests, already covered by existing tests.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::getOwnPropertySlotDelegate):
        (WebCore::JSLocation::putDelegate): Deleted.

2016-02-27  Andy VanWagoner  <thetalecrafter@gmail.com>

        Intl.Collator uses POSIX locale (detected by js/intl-collator.html on iOS Simulator)
        https://bugs.webkit.org/show_bug.cgi?id=152448

        Reviewed by Darin Adler.

        Pass defaultLanguage from Language.h to the globalObjectMethodTable to
        ensure Intl objects can be initialized with the correct default locale.

        * bindings/js/JSDOMWindowBase.cpp:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:

2016-02-27  Chris Dumez  <cdumez@apple.com>

        Align HTMLMarqueeElement.scrollAmount / scrollDelay with the specification
        https://bugs.webkit.org/show_bug.cgi?id=154781

        Reviewed by Darin Adler.

        Align HTMLMarqueeElement.scrollAmount / scrollDelay with the
        specification:
        - https://www.w3.org/TR/html5/obsolete.html#the-marquee-element-0

        In particular:
        - The attributes should have unsigned long type
        - We should not throw for negative values
        - Values should be in the range [0, 2147483647] as per:
        - https://html.spec.whatwg.org/multipage/infrastructure.html#reflect

        No new tests, already covered by existing tests.

        * html/HTMLMarqueeElement.cpp:
        (WebCore::HTMLMarqueeElement::scrollAmount):
        (WebCore::HTMLMarqueeElement::setScrollAmount):
        (WebCore::HTMLMarqueeElement::scrollDelay):
        (WebCore::HTMLMarqueeElement::setScrollDelay):
        (WebCore::HTMLMarqueeElement::loop): Deleted.
        * html/HTMLMarqueeElement.h:
        * html/HTMLMarqueeElement.idl:

2016-02-27  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197204, r197207, r197211, r197217,
        r197218, and r197219.
        https://bugs.webkit.org/show_bug.cgi?id=154780

        Caused crashes in WebVideoFullscreenManagerProxy (Requested by
        ap on #webkit).

        Reverted changesets:

        "Add support for playbackControlsManager"
        https://bugs.webkit.org/show_bug.cgi?id=154742
        http://trac.webkit.org/changeset/197204

        "Attempted build fix."
        http://trac.webkit.org/changeset/197207

        "Attempted build fix."
        http://trac.webkit.org/changeset/197211

        "Attempted 32-bit build fix."
        http://trac.webkit.org/changeset/197217

        "Another 32-bit build fix."
        http://trac.webkit.org/changeset/197218

        "32-bit!!!"
        http://trac.webkit.org/changeset/197219

2016-02-27  Chris Dumez  <cdumez@apple.com>

        Optimize parseHTMLInteger()
        https://bugs.webkit.org/show_bug.cgi?id=154772

        Reviewed by Ryosuke Niwa.

        Optimize parseHTMLInteger() a bit now that it is used a lot more and
        that it has decent API test coverage. In particular, we now:
        - Avoid using a StringBuilder for the digits.
        - Get rid of a is8Bit() branch.
        - Only traverse the input string once.

        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLIntegerInternal):
        (WebCore::parseHTMLInteger):
        (WebCore::parseHTMLNonNegativeInteger): Deleted.

2016-02-27  Andreas Kling  <akling@apple.com>

        [iOS] Discard decoded image data on top-level navigation.
        <https://webkit.org/b/154776>

        Reviewed by Anders Carlsson.

        Add a mechanism that destroys decoded data for all CachedImages and invoke it
        when performing a top-level navigation on iOS.

        This substantially reduces the ImageIO contribution to our peak memory footprint.

        It would be even better if we could mark these images volatile during the transition
        but we currently don't have framework support for such machinations.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::forEachResource):
        (WebCore::MemoryCache::destroyDecodedDataForAllImages):
        * loader/cache/MemoryCache.h:

2016-02-26  Carlos Garcia Campos  <cgarcia@igalia.com>

        Network cache: old pages returned by disk cache on history navigation after session is restored
        https://bugs.webkit.org/show_bug.cgi?id=153230

        Reviewed by Chris Dumez.

        Add a flag to HistoryItem to mark them as restored from session
        and use it from the FrameLoader to not change the policy request
        when navigating to a history item that was restored from session,
        except for iOS port.

        * history/HistoryItem.h:
        (WebCore::HistoryItem::setWasRestoredFromSession):
        (WebCore::HistoryItem::wasRestoredFromSession):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadDifferentDocumentItem):

2016-02-26  Michael Catanzaro  <mcatanzaro@igalia.com>

        Remove unused private field from WEBPImageDecoder

        Unreviewed.

        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
        (WebCore::WEBPImageDecoder::WEBPImageDecoder):
        * platform/image-decoders/webp/WEBPImageDecoder.h:

2016-02-26  Chris Dumez  <cdumez@apple.com>

        Fix the behavior of reflecting IDL attributes of type unsigned long
        https://bugs.webkit.org/show_bug.cgi?id=154771

        Reviewed by Ryosuke Niwa.

        Fix the behavior of reflecting IDL attributes of type unsigned long to
        align with the specification:
        - https://html.spec.whatwg.org/multipage/infrastructure.html#reflecting-content-attributes-in-idl-attributes
        - https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers

        Firefox and Chrome already follow the specification.

        There were several issues with our implementation, which are all
        addressed in this patch:
        - Upon getting, the value returned must be in the range 0 to 2147483647.
          Otherwise, we must return the default value (0 unless specified
          otherwise). We previously returned values in the range 0 to 4294967295
          instead.
        - Upon setting, we must set the content attribute to the default value
          (0 unless specified otherwise) if the input value is not in the range
          0 to 2147483647. We previously allowed values in the range 0 to
          4294967295 instead.
        - "-0" was not recognized as a valid unsigned integer

        Test: fast/dom/reflect-unsigned-long.html

        * dom/Element.cpp:
        (WebCore::Element::setUnsignedIntegralAttribute):
        Update setUnsignedIntegralAttribute() to limit the input value in the
        0 to 2147483647 range, as per the HTML specification. This method is
        called by the bindings implementation of reflecting attributes setters.

        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLNonNegativeInteger):
        Update parseHTMLNonNegativeInteger() to call parseHTMLInteger() instead
        of duplicating most of its code and fail if the value returned is
        negative. This matches the algorithm in the specification:
        - https://html.spec.whatwg.org/multipage/infrastructure.html#rules-for-parsing-non-negative-integers

        This has 2 behavior changes:
        1. "-0" is now correctly parsed as 0.
        2. The returned values are in the range 0 to 2147483647.

        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
        (WebCore::limitToOnlyHTMLNonNegative):
        Drop the checks for "<= 2147483647" and replace with an assertion
        now that parseHTMLNonNegativeInteger() already returned values in
        the right range.

2016-02-26  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (188611): Search field Cancel button should not overlap search text on extensions page.
        https://bugs.webkit.org/show_bug.cgi?id=154692
        <rdar://problem/22840453>

        Reviewed by Brent Fulgham.

        Adjust the cancel button position using the actual size of the cancel button.

        When the input box and the font height trigger different cancel button sizes, we need to readjust
        the rectangle returned by cancelButtonRectForBounds.
        This fixes both the mispositioned cancel button and the squared off icon when the input field is zoomed all the way in.

        Covered by existing tests.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
        (WebCore::RenderThemeMac::cancelButtonSizes): Update button size.

2016-02-26  Brady Eidson  <beidson@apple.com>

        Modern IDB: New database versions are never committed to SQLite.
        <rdar://problem/24860952> and https://bugs.webkit.org/show_bug.cgi?id=154741
        
        Modern IDB: If a database handle is not open, files are not actually deleted from disk
        https://bugs.webkit.org/show_bug.cgi?id=154756

        Reviewed by Alex Christensen.

        Tested by API test "IndexedDBPersistence"

        * Modules/indexeddb/server/IDBServer.cpp:
        (WebCore::IDBServer::IDBServer::deleteDatabase): If there's not an open handle to the database, create one.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction): If a version change transaction, actually
          set the new version on disk.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore): If there is no open backing store, create one.
          This is necessary to both read the current database version, and to actually delete the file on disk.
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore): If necessary, manufacture a "most recently
          deleted database info" from the version returned by deleteBackingStore.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-02-26  Chris Dumez  <cdumez@apple.com>

        Add API test coverage for parseHTMLInteger / parseHTMLNonNegativeInteger
        https://bugs.webkit.org/show_bug.cgi?id=154714

        Reviewed by Darin Adler.

        Export a couple more symbols for API testing.

        * html/parser/HTMLParserIdioms.h:

2016-02-26  Beth Dakin  <bdakin@apple.com>

        32-bit!!!

        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):

2016-02-26  Beth Dakin  <bdakin@apple.com>

        Another 32-bit build fix.

        * platform/spi/cocoa/AVKitSPI.h:

2016-02-26  Beth Dakin  <bdakin@apple.com>

        Attempted 32-bit build fix.

        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):

2016-02-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197160.
        https://bugs.webkit.org/show_bug.cgi?id=154757

        This change causes editing/mac/attributed-string/font-
        size.html to fail on El Capitan WK1 (Requested by ryanhaddad
        on #webkit).

        Reverted changeset:

        "Font size computed style is innaccurate"
        https://bugs.webkit.org/show_bug.cgi?id=154705
        http://trac.webkit.org/changeset/197160

2016-02-26  Gavin Barraclough  <barraclough@apple.com>

        Page TimerAlignmentIntervalIncrease mechanism should have upper limit
        https://bugs.webkit.org/show_bug.cgi?id=154744

        Reviewed by Geoff Garen.

        There would be diminishing returns from throttling timers in background pages infinitely.
        Add a heuristic to limit appropriately.

        Keep track of the current limit, and make the increase time take this into account.

        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingEnabled):
            - When timer throttling is disabled visit all timers to resume.
        (WebCore::Page::setTimerAlignmentIntervalIncreaseLimit):
            - Track the maximum alignment interval, and call setDOMTimerAlignmentInterval
              to ensure m_timerAlignmentInterval is updated in accordance with the new limit.
        (WebCore::Page::setDOMTimerAlignmentInterval):
            - When the timer alignemnt interval changes update the increase timer.
        (WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):
            - Apply limit.
        * page/Page.h:
        (WebCore::Page::timerThrottlingEnabled):
            - Accessor for readability.

2016-02-26  Beth Dakin  <bdakin@apple.com>

        Attempted build fix.

        * platform/spi/cocoa/AVKitSPI.h:

2016-02-26  Beth Dakin  <bdakin@apple.com>

        Add support for playbackControlsManager
        https://bugs.webkit.org/show_bug.cgi?id=154742
        -and corresponding-
        rdar://problem/23833753

        Reviewed by Jer Noble.

        Make AVKitSPI.h private so that it can be used from other projects.
        * WebCore.xcodeproj/project.pbxproj:

        Right now, set up a controls manager for a video when it starts playing. In 
        the future, this is something that should be handled by the 
        PlatformMediaSessionManager since we only want a controls for the 
        currentSession.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::playInternal):

        New function setUpVideoControlsManager.
        * page/ChromeClient.h:

        Make these CoreMedia functions available on Mac and iOS instead of just iOS.
        * platform/cf/CoreMediaSoftLink.cpp:
        * platform/cf/CoreMediaSoftLink.h:

        This patch fleshes out an implementation for a bunch of these interface 
        functions since they need to communicate to the playbackControlsManager. This 
        is also where the playbackControlsManager lives.
        * platform/mac/WebVideoFullscreenInterfaceMac.h:

        Define an interface and implementation for WebPlaybackControlsManager.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (-[WebPlaybackControlsManager initWithWebVideoFullscreenInterfaceMac:]):
        (-[WebPlaybackControlsManager isSeeking]):
        (-[WebPlaybackControlsManager seekToTime:toleranceBefore:toleranceAfter:]):
        (-[WebPlaybackControlsManager audioMediaSelectionOptions]):
        (-[WebPlaybackControlsManager currentAudioMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentAudioMediaSelectionOption:]):
        (-[WebPlaybackControlsManager legibleMediaSelectionOptions]):
        (-[WebPlaybackControlsManager currentLegibleMediaSelectionOption]):
        (-[WebPlaybackControlsManager setCurrentLegibleMediaSelectionOption:]):
        (-[WebPlaybackControlsManager cancelThumbnailAndAudioAmplitudeSampleGeneration]):

        Relay this information to the playbackControlsManager.
        (WebCore::WebVideoFullscreenInterfaceMac::setDuration):
        (WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        (WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges):
        (WebCore::WebVideoFullscreenInterfaceMac::ensureControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::playBackControlsManager):
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):

        New SPI needed.
        * platform/spi/cocoa/AVKitSPI.h:
        * platform/spi/mac/AVFoundationSPI.h:

2016-02-26  Said Abou-Hallawa  <sabouhallawa@apple.com>

        <g> wrapping <symbol> causes display of hidden <symbol>
        https://bugs.webkit.org/show_bug.cgi?id=154576

        Reviewed by Darin Adler.
        
        The SVGSymbolElement is allowed in the shadow tree of an SVGUseElement
        only if it subtree root element. Any descendant SVGSymbolElement should
        be removed from the subtree because it is a hidden container. If the cloned
        subtree includes an SVGUseElement which references an SVGSymbolElement,
        the same rule will be applied to the descendant SVGUseElement. The goal
        is to remove all the descendant SVGSymbolElements from the cloned target
        because these SVGSymbolElements will be expanded to SVGSVGElements and
        hence become visible.

        * svg/SVGUseElement.cpp:
        (WebCore::disassociateAndRemoveClones): A helper function which removes
        cloned SVGElements and their subtrees from their parents and disassociate
        them from their originals.
        
        (WebCore::removeDisallowedElementsFromSubtree): Use disassociateAndRemoveClones().
        
        (WebCore::removeSymbolElementsFromSubtree): Removes all the descendant
        SVGSymbolElements from the cloned subtree. It does not remove the root
        element itself if it is an SVGSymbolElement because this one will be
        expanded to an SVGSVGElement which is exactly what we need.
        
        (WebCore::SVGUseElement::cloneTarget): Call removeSymbolElementsFromSubtree()
        to remove the descendant SVGSymbolElements from the cloned subtree before
        appending it to the container shadow root.

2016-02-26  Olivier Blin  <olivier.blin@softathome.com>

        Initialize LocaleICU data members in header
        https://bugs.webkit.org/show_bug.cgi?id=154731

        Reviewed by Michael Catanzaro.

        LocaleICU data members should be initialized in the header, to
        avoid conditional initialization lines in the constructor, as
        suggested by Darin in bug 154484.

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::LocaleICU): Deleted.
        * platform/text/LocaleICU.h:

2016-02-26  Brady Eidson  <beidson@apple.com>

        Modern IDB: Using existing database info from SQLite backing store is busted.
        <rdar://problem/24848143> and https://bugs.webkit.org/show_bug.cgi?id=154735

        Reviewed by Alex Christensen.

        No new tests.
        
        Reproducing the bug requires having a known database on disk *before* launching the DatabaseProcess to
        read in the existing IDBDatabaseInfo.
        
        Our automated infrastructure currently has no way of testing this.

        * Modules/indexeddb/client/IDBConnectionToServer.cpp:
        (WebCore::IDBClient::IDBConnectionToServer::openDatabase):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo): Do the optional migrate on
          the IndexRecords table here; *every* time we open a SQLite backing store.
        (WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo): Deleted.
        * Modules/indexeddb/shared/IDBDatabaseInfo.cpp:
        (WebCore::IDBDatabaseInfo::isolatedCopy): Copy the entire object, not just name/version.

2016-02-25  Gavin Barraclough  <barraclough@apple.com>

        RefCounter value changed callback should be called on all changes (not just zero edge).
        https://bugs.webkit.org/show_bug.cgi?id=154699

        Reviewed by Anders Carlsson.

        RefCounter currently only triggers a callback when the count goes from zero
        to non-zero and vice-versa. Change that, to be useful to more clients.

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::PageThrottler):
            - Updated for change in RefCounter callback siganture.
        * platform/VNodeTracker.cpp:
        (WebCore::VNodeTracker::VNodeTracker):
            - Can now use RefCounter callback to trigger checkPressureState().
        (WebCore::VNodeTracker::pressureWarningTimerFired):
            - RefCounter count is now a size_t (%d -> %ul).
        * platform/VNodeTracker.h:
            - simplified VNodeTracker::token() [no longer needs to call checkPressureState()].

2016-02-26  Andreas Kling  <akling@apple.com>

        Remove unused CFNetwork disk cache mmap optimization in WebKit2.
        <https://webkit.org/b/154727>

        Reviewed by Darin Adler.

        Remove some now-unused SPI.

        * platform/spi/cf/CFNetworkSPI.h:

2016-02-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r197167.
        https://bugs.webkit.org/show_bug.cgi?id=154730

        This change broke the Mac build (Requested by ryanhaddad on
        #webkit).

        Reverted changeset:

        "REGRESSION (188611): Search field Cancel button should not
        overlap search text on extensions page."
        https://bugs.webkit.org/show_bug.cgi?id=154692
        http://trac.webkit.org/changeset/197167

2016-02-26  Martin Robinson  <mrobinson@igalia.com>

        Remove libqcms support
        https://bugs.webkit.org/show_bug.cgi?id=154707

        Reviewed by Žan Doberšek.

        No new tests. This change simply removes dead code.

        * platform/image-decoders/ImageDecoder.h: Remove QCMS support.
        (WebCore::ImageDecoder::qcmsOutputDeviceProfile): Deleted.
        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Remove QCMS support.
        (WebCore::JPEGImageReader::JPEGImageReader): Deleted.
        (WebCore::JPEGImageReader::close): Deleted.
        (WebCore::JPEGImageReader::decode): Deleted.
        (WebCore::JPEGImageReader::colorTransform): Deleted.
        (WebCore::JPEGImageReader::createColorTransform): Deleted.
        (WebCore::JPEGImageDecoder::outputScanlines): Deleted.
        * platform/image-decoders/png/PNGImageDecoder.cpp: Remove QCMS support.
        (WebCore::PNGImageReader::PNGImageReader): Deleted.
        (WebCore::PNGImageReader::close): Deleted.
        (WebCore::PNGImageReader::rowBuffer): Deleted.
        (WebCore::PNGImageReader::createRowBuffer): Deleted.
        (WebCore::PNGImageReader::colorTransform): Deleted.
        (WebCore::PNGImageReader::createColorTransform): Deleted.
        (WebCore::PNGImageDecoder::headerAvailable): Deleted.
        (WebCore::PNGImageDecoder::rowAvailable): Deleted.
        (WebCore::PNGImageDecoder::frameComplete): Deleted.
        * platform/image-decoders/webp/WEBPImageDecoder.cpp: Remove QCMS support.
        (WebCore::WEBPImageDecoder::decode): Remove QCMS support.
        (WebCore::WEBPImageDecoder::WEBPImageDecoder): Deleted.
        (WebCore::WEBPImageDecoder::clear): Deleted.
        (WebCore::WEBPImageDecoder::createColorTransform): Deleted.
        (WebCore::WEBPImageDecoder::readColorProfile): Deleted.
        (WebCore::WEBPImageDecoder::applyColorProfile): Deleted.
        * platform/image-decoders/webp/WEBPImageDecoder.h: Remove QCMS support.
        (WebCore::WEBPImageDecoder::colorTransform): Deleted.

2016-02-26  Zalan Bujtas  <zalan@apple.com>

        RenderTheme::controlSize* methods should take const RenderStyle&.
        https://bugs.webkit.org/show_bug.cgi?id=154708

        Reviewed by Darin Adler.

        No change in functionality.

        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::minimumMenuListSize):
        (WebCore::RenderTheme::popupInternalPaddingLeft):
        (WebCore::RenderTheme::popupInternalPaddingRight):
        (WebCore::RenderTheme::popupInternalPaddingTop):
        (WebCore::RenderTheme::popupInternalPaddingBottom):
        * rendering/RenderThemeMac.h:
        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::controlSizeForFont):
        (WebCore::RenderThemeMac::sizeForFont):
        (WebCore::RenderThemeMac::sizeForSystemFont):
        (WebCore::RenderThemeMac::controlSizeForSystemFont):
        (WebCore::RenderThemeMac::minimumProgressBarHeight):
        (WebCore::RenderThemeMac::popupInternalPaddingLeft):
        (WebCore::RenderThemeMac::popupInternalPaddingRight):
        (WebCore::RenderThemeMac::popupInternalPaddingTop):
        (WebCore::RenderThemeMac::popupInternalPaddingBottom):
        (WebCore::RenderThemeMac::minimumMenuListSize):

2016-02-26  Zalan Bujtas  <zalan@apple.com>

        REGRESSION (188611): Search field Cancel button should not overlap search text on extensions page.
        https://bugs.webkit.org/show_bug.cgi?id=154692
        <rdar://problem/22840453>

        Reviewed by Brent Fulgham.

        Adjust the cancel button position using the actual size of the cancel button.

        When the input box and the font height trigger different cancel button sizes, we need to readjust
        the rectangle returned by cancelButtonRectForBounds.
        This fixes both the mispositioned cancel button and the squared off icon when the input field is zoomed all the way in.

        Covered by existing tests.

        * rendering/RenderThemeMac.mm:
        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
        (WebCore::RenderThemeMac::cancelButtonSizes): Update button size.

2016-02-25  Antti Koivisto  <antti@apple.com>

        Implement ::slotted pseudo element
        https://bugs.webkit.org/show_bug.cgi?id=149441
        <rdar://problem/22731987>

        Reviewed by Andreas Kling.

        Based on latest in https://github.com/w3c/webcomponents/issues/331

        * css/CSSGrammar.y.in:

            Parse ::slotted.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::detectFunctionTypeToken):
        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoElementCueFunctionSelector):
        (WebCore::CSSParserSelector::parsePseudoElementSlottedFunctionSelector):

            Tokenize ::slotted.

        (WebCore::CSSParserSelector::parsePseudoClassAndCompatibilityElementSelector):
        * css/CSSParserValues.h:
        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::pseudoId):
        * css/CSSSelector.h:
        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::matchAuthorRules):
        (WebCore::ElementRuleCollector::matchHostPseudoClassRules):
        (WebCore::ElementRuleCollector::matchSlottedPseudoElementRules):

            Match ::slotted selector.

        (WebCore::ElementRuleCollector::collectSlottedPseudoElementRulesForSlot):

            Collect ::slotted rules that may apply to an element in a slot.

        (WebCore::ElementRuleCollector::matchUserRules):
        (WebCore::ElementRuleCollector::matchUARules):
        (WebCore::findSlottedPseudoElementSelector):
        (WebCore::ElementRuleCollector::ruleMatches):
        * css/ElementRuleCollector.h:
        * css/RuleSet.cpp:
        (WebCore::RuleSet::addRule):

            Collect ::slotted rules.

        (WebCore::RuleSet::shrinkToFit):
        * css/RuleSet.h:
        (WebCore::RuleSet::hostPseudoClassRules):
        (WebCore::RuleSet::slottedPseudoElementRules):
        (WebCore::RuleSet::focusPseudoClassRules):
        (WebCore::RuleSet::universalRules):
        * css/SelectorChecker.cpp:
        (WebCore::SelectorChecker::checkOne):
        * style/StyleSharingResolver.cpp:
        (WebCore::Style::SharingResolver::resolve):

            Disable style sharing for children of shadow host. They may be affected by the shadow tree style
            which is not considered in style sharing checks.

2016-02-25  Myles C. Maxfield  <mmaxfield@apple.com>

        Font size computed style is innaccurate
        https://bugs.webkit.org/show_bug.cgi?id=154705
        <rdar://problem/23474068>

        Reviewed by Timothy Hatcher.

        Safari rounds the font size value reported to getComputedStyle(). Neither Firefox
        nor Chrome do this.

        Covered by existing tests.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::ComputedStyleExtractor::getFontSizeCSSValuePreferringKeyword):
        (WebCore::fontSizeFromStyle):

2016-02-25  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Mark DOMString parameters as nullable when they should be
        https://bugs.webkit.org/show_bug.cgi?id=154666

        Reviewed by Darin Adler.

        Mark DOMString parameters as nullable when they should be. We previously
        emulated nullable DOMString attributes by using:
        [TreatNullAs=NullString, TreatUndefinedAs=NullString]
        However, this was non-standard and very verbose. Also, developers would
        sometimes forget the [TreatUndefinedAs=NullString] part and the behavior
        would end up being wrong for undefined.

        After this clean up, the non-standard [TreatUndefinedAs=NullString] is
        no longer used so this patch drops support for it. Only
        [TreatNullAs=NullString] remains and this one will be renamed to
        [TreatNullAs=EmptyString] via Bug 154654 to match Web IDL standard.

        Tests: fast/dom/Element/getElementsByTagNameNS-nullable.html
               fast/dom/Node/nullable-parameters.html
               fast/events/storageevent-initStorageEvent-nullable.html

        * Modules/mediastream/RTCPeerConnection.idl:
        Drop [TreatUndefinedAs=NullString] from createDataChannel()'s first
        parameter instead of marking it as nullable. This matches the
        specification:
        - http://w3c.github.io/webrtc-pc/#rtcpeerconnection-interface-extensions-1
        This means there is a slight behavior change when undefined is passed, it
        now becomes the string "undefined" instead of a null String.

        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        Drop handling of [TreatUndefinedAs=] as it is no longer used.

        * bindings/scripts/IDLAttributes.txt:
        Drop support for [TreatUndefinedAs=] as it is no longer used.

        * bindings/scripts/test/TestObj.idl:

        * dom/DOMImplementation.idl:
        Make a few parameters nullable and drop [TreatNullAs=NullString,
        TreatUndefinedAs=NullString]. There is no web-exposed behavior
        change.

        * dom/Document.idl:
        - Make a few parameters nullable and drop [TreatNullAs=NullString,
          TreatUndefinedAs=NullString]. There is no web-exposed behavior
          change from this.
        - Drop these attributes from ObjC-specific bindings as they only
          matter to JS bindings.
        - The namespaceURI parameter to getElementsByTagNameNS() is now marked
          as nullable even though it only treated null as a null String, not
          undefined. This was a bug and did not match the specification:
          https://dom.spec.whatwg.org/#document

        * dom/Element.idl:
        - Make a few parameters nullable and drop [TreatNullAs=NullString,
          TreatUndefinedAs=NullString]. There is no web-exposed behavior
          change from this.
        - Drop these attributes from ObjC-specific bindings as they only
          matter to JS bindings.
        - The namespaceURI parameter to getElementsByTagNameNS() is now marked
          as nullable even though it only treated null as a null String, not
          undefined. This was a bug and did not match the specification:
          https://dom.spec.whatwg.org/#interface-element

        * dom/NamedNodeMap.idl:
        Make a few parameters nullable and drop [TreatNullAs=NullString,
        TreatUndefinedAs=NullString]. There is no web-exposed behavior
        change from this.

        * dom/Node.idl:
        - Drop these attributes from isSupported() as this is not exposed
          to JS (only native bindings) and these attributes only matter to
          JS bindings.
        - Make the first parameter to lookupPrefix() / isDefaultNamespace()
          and lookupNamespaceURI() nullable. Previously, we treated null
          as a null string but not undefined. There is therefore a slight
          behavior change but this matches the specification:
          https://dom.spec.whatwg.org/#node

        * fileapi/Blob.idl:
        * html/HTMLButtonElement.idl:
        * html/HTMLCanvasElement.idl:
        * html/HTMLFieldSetElement.idl:
        * html/HTMLInputElement.idl:
        * html/HTMLKeygenElement.idl:
        * html/HTMLMediaElement.idl:
        * html/HTMLObjectElement.idl:
        * html/HTMLOutputElement.idl:
        * html/HTMLSelectElement.idl:
        * html/HTMLTextAreaElement.idl:
        * page/DOMWindow.idl:
        Make a few parameters nullable and drop [TreatNullAs=NullString,
        TreatUndefinedAs=NullString]. There is no web-exposed behavior
        change from this.

        * storage/StorageEvent.idl:
        Mark oldValueArg / newValueArg parameters to initStorageEvent()
        as nullable. Previously, we only treated null as a null string,
        not undefined. This is therefore a slight behavior change but
        it matches the specification:
        https://www.w3.org/TR/webstorage/#storageeventinit

2016-02-25  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r196744): NetworkExtension.framework and NEFilterSource class are not available on Recovery partition
        <http://webkit.org/b/154703>

        Reviewed by Andy Estes.

        * platform/cocoa/NetworkExtensionContentFilter.mm: Make
        soft-linking of NetworkExtension.framework and NEFilterSource
        class optional since they are not available on the Recovery
        partition.  Note that NetworkExtensionContentFilter::enabled()
        does not need to change since it already had the correct
        behavior when getNEFilterSourceClass() returned nullptr.

2016-02-25  Ada Chan  <adachan@apple.com>

        Update the definition of ENABLE_VIDEO_PRESENTATION_MODE for Mac platform
        https://bugs.webkit.org/show_bug.cgi?id=154702

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:

2016-02-25  David Kilzer  <ddkilzer@apple.com>

        Change ASSERT to RELEASE_ASSERT in SOFT_LINK_CLASS() macro

        Follow-up fix noted by Andy Estes for:

            [Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
            <http://webkit.org/b/154364>

        * platform/mac/SoftLinking.h:
        (SOFT_LINK_CLASS): Change ASSERT to RELEASE_ASSERT to check the
        return value of objc_getClass().  This matches what we do for
        SOFT_LINK_CLASS_FOR_SOURCE().

2016-02-25  Daniel Bates  <dabates@apple.com>

        CSP: Remove SecurityPolicy script interface
        https://bugs.webkit.org/show_bug.cgi?id=154694
        <rdar://problem/24846482>

        Reviewed by Andy Estes.

        Remove the Content Security Policy script interface, SecurityPolicy. This interface was only
        enabled when building with ENABLE(CSP_NEXT) (disabled by default).

        For completeness, the SecurityPolicy interface was removed from the Content Security Policy 1.1 spec.
        in <https://github.com/w3c/webappsec/commit/18882953ce2d8afca25f685557fef0e0471b2c9a> (12/26/2013).

        * CMakeLists.txt: Remove files to DOMSecurityPolicy.{cpp, idl}.
        * DerivedSources.cpp: Remove file JSDOMSecurityPolicy.cpp.
        * DerivedSources.make: Remove file DOMSecurityPolicy.idl.
        * PlatformGTK.cmake: Ditto.
        * PlatformMac.cmake: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Remove files DOMSecurityPolicy files.
        * bindings/scripts/CodeGeneratorGObject.pm: Remove reference to DOMSecurityPolicy.
        * dom/Document.cpp:
        (WebCore::Document::securityPolicy): Deleted.
        * dom/Document.h:
        * dom/Document.idl: Remove attribute securityPolicy.
        * page/DOMSecurityPolicy.cpp: Removed.
        * page/DOMSecurityPolicy.h: Removed.
        * page/DOMSecurityPolicy.idl: Removed.

2016-02-25  Andreas Kling  <akling@apple.com>

        Don't clear the weak JSString cache on memory pressure.
        <https://webkit.org/b/154693>

        Reviewed by Antti Koivisto.

        This was stupid. The cache is a WeakGCMap, so all the JSStrings pointed to are
        still alive anyway. This way we keep the ability to deduplicate common strings.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseNoncriticalMemory): Deleted.

2016-02-25  Chris Dumez  <cdumez@apple.com>

        Drop [TreatReturnedNullStringAs=Undefined] WebKit-specific IDL attribute
        https://bugs.webkit.org/show_bug.cgi?id=154662

        Reviewed by Darin Adler.

        Drop [TreatReturnedNullStringAs=Undefined] WebKit-specific IDL attribute.
        This has no standard equivalent and all uses in WebKit are either useless
        or wrong.

        Test: fast/frames/detached-frame-document-defaultCharset.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Deleted.
        * bindings/scripts/IDLAttributes.txt:
        Drop support for [TreatReturnedNullStringAs=X] entirely.

        * dom/Document.cpp:
        (WebCore::Document::defaultCharset):
        Fall back to return "UTF-8" instead of the null string, similarly to
        what is done in for Document.characterSet. Note that this attribute
        is non-standard and is an IE extension. Firefox never supported it
        and Chrome dropped it last year.

        * dom/Document.idl:
        - Drop extended attribute for Document.defaultCharset as the
          implementation has been updated to never return a null String.
        - Drop extended attribute for Document.readyState. It was useless
          because the implementation could never return a null String.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::getAllResponseHeaders):
        Update implementation to return emptyString() instead of "" in case
        of error.

        * xml/XMLHttpRequest.idl:
        Drop extended attribute from XMLHttpRequest.getAllResponseHeaders().
        It was useless because the implementation could never return a
        null String.

        * xml/XSLTProcessor.idl:
        Drop extended attribute from XSLTProcessor.getParameter(). The
        operation is already marked as [Custom] so the extended attribute
        had no effect.

2016-02-25  Gavin Barraclough  <barraclough@apple.com>

        Should template RefCounter instead of RefCounter::Token
        https://bugs.webkit.org/show_bug.cgi?id=154691

        Reviewed by Anders Carlsson.

        Mechanical update per RefCounter interface change.

        * page/PageThrottler.cpp:
        (WebCore::PageThrottler::mediaActivityToken):
        (WebCore::PageThrottler::pageLoadActivityToken):
        (WebCore::PageThrottler::setActivityFlag):
        * page/PageThrottler.h:
        * platform/VNodeTracker.h:

2016-02-25  Brady Eidson  <beidson@apple.com>

        Remove LegacyIDB.
        https://bugs.webkit.org/show_bug.cgi?id=150854

        Reviewed by Alex Christensen.

        No new tests (No change in behavior).

        * CMakeLists.txt:
        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
        (WebCore::DOMWindowIndexedDatabase::indexedDB):
        * Modules/indexeddb/IDBDatabaseMetadata.cpp: Removed.
        * Modules/indexeddb/IDBDatabaseMetadata.h: Removed.
        * Modules/indexeddb/IDBFactory.h:
        * Modules/indexeddb/IDBIndex.h:
        * Modules/indexeddb/IDBIndexMetadata.h: Removed.
        * Modules/indexeddb/IDBObjectStoreMetadata.h: Removed.
        * Modules/indexeddb/IDBOperation.h: Removed.
        * Modules/indexeddb/IDBServerConnection.h: Removed.
        * Modules/indexeddb/IDBTransaction.h:
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.cpp:
        (WebCore::WorkerGlobalScopeIndexedDatabase::indexedDB):
        * Modules/indexeddb/WorkerGlobalScopeIndexedDatabase.h:
        * Modules/indexeddb/legacy/IDBCallbacks.h: Removed.
        * Modules/indexeddb/legacy/IDBCursorBackend.cpp: Removed.
        * Modules/indexeddb/legacy/IDBCursorBackend.h: Removed.
        * Modules/indexeddb/legacy/IDBCursorBackendOperations.cpp: Removed.
        * Modules/indexeddb/legacy/IDBCursorBackendOperations.h: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseBackend.cpp: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseBackend.h: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacks.h: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.cpp: Removed.
        * Modules/indexeddb/legacy/IDBDatabaseCallbacksImpl.h: Removed.
        * Modules/indexeddb/legacy/IDBFactoryBackendInterface.h: Removed.
        * Modules/indexeddb/legacy/IDBPendingDeleteCall.h: Removed.
        * Modules/indexeddb/legacy/IDBPendingOpenCall.h: Removed.
        * Modules/indexeddb/legacy/IDBPendingTransactionMonitor.cpp: Removed.
        * Modules/indexeddb/legacy/IDBPendingTransactionMonitor.h: Removed.
        * Modules/indexeddb/legacy/IDBTransactionBackend.cpp: Removed.
        * Modules/indexeddb/legacy/IDBTransactionBackend.h: Removed.
        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.cpp: Removed.
        * Modules/indexeddb/legacy/IDBTransactionBackendOperations.h: Removed.
        * Modules/indexeddb/legacy/IDBTransactionCoordinator.cpp: Removed.
        * Modules/indexeddb/legacy/IDBTransactionCoordinator.h: Removed.
        * Modules/indexeddb/legacy/LegacyAny.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyAny.h: Removed.
        * Modules/indexeddb/legacy/LegacyCursor.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyCursor.h: Removed.
        * Modules/indexeddb/legacy/LegacyCursorWithValue.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyCursorWithValue.h: Removed.
        * Modules/indexeddb/legacy/LegacyDatabase.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyDatabase.h: Removed.
        * Modules/indexeddb/legacy/LegacyFactory.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyFactory.h: Removed.
        * Modules/indexeddb/legacy/LegacyIndex.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyIndex.h: Removed.
        * Modules/indexeddb/legacy/LegacyObjectStore.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyObjectStore.h: Removed.
        * Modules/indexeddb/legacy/LegacyOpenDBRequest.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyOpenDBRequest.h: Removed.
        * Modules/indexeddb/legacy/LegacyRequest.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyRequest.h: Removed.
        * Modules/indexeddb/legacy/LegacyTransaction.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyTransaction.h: Removed.
        * Modules/indexeddb/legacy/LegacyVersionChangeEvent.cpp: Removed.
        * Modules/indexeddb/legacy/LegacyVersionChangeEvent.h: Removed.
        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::establishStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::generateIndexKeysForValue): Deleted.
        * bindings/js/IDBBindingUtilities.h:
        * bindings/js/JSMainThreadExecState.cpp:
        (WebCore::JSMainThreadExecState::didLeaveScriptContext): Deleted.
        * inspector/InspectorIndexedDBAgent.cpp:
        * loader/EmptyClients.cpp:
        * page/DatabaseProvider.cpp:
        (WebCore::DatabaseProvider::idbFactoryBackend): Deleted.
        * page/DatabaseProvider.h:
        * platform/CrossThreadCopier.cpp:
        (WebCore::IDBDatabaseMetadata>::copy): Deleted.
        (WebCore::IDBIndexMetadata>::copy): Deleted.
        (WebCore::IDBObjectStoreMetadata>::copy): Deleted.
        * platform/CrossThreadCopier.h:

2016-02-25  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION (r196268): Many assertion failures and crashes on SVG path animation tests when JS garbage collection happens quickly
        https://bugs.webkit.org/show_bug.cgi?id=154331

        Reviewed by Darin Adler.

        This is not an actual regression. The bug did exist before r196268 but
        the whole document was leaking once an SVGAnimatedProperty was created
        so there was no way to produce this bug. After fixing the leak, one crash
        and one assert got uncovered. Both of them happen because of the fact:
        "if an SVGAnimatedProperty is not referenced it will be deleted."

        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::lookupOrCreateDWrapper):
        The code in this function was assuming that the wrapper will be created
        only once which happens when SVGAnimatedProperty::lookupOrCreateWrapper()
        is called. Before making this single call, lookupOrCreateDWrapper() was
        building an initial SVGPathSegList from byte stream. But now
        SVGAnimatedProperty::lookupWrapper() can return false even after creating
        the SVGAnimatedProperty because it was deleted later. Calling
        buildSVGPathSegListFromByteStream() more than once was causing
        SVGAnimatedListPropertyTearOff::animationStarted() to fire the assertion
        ASSERT(m_values.size() == m_wrappers.size()) because the path segments were
        appended twice to m_values which is in fact SVGPathElement::m_pathSegList.value.
        The fix is to build the initial SVGPathSegList only once which should happen
        when m_pathSegList.value.isEmpty().
        
        (WebCore::SVGPathElement::animatedPropertyWillBeDeleted):
        * svg/SVGPathElement.h:
        * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::~SVGAnimatedPathSegListPropertyTearOff):
        SVGPathElement is assuming the following equivalence relation:
        m_pathSegList.shouldSynchronize ~ SVGAnimatedProperty_is_created_and_not_null.
        SVGPathElement::animatedPathSegList() and animatedNormalizedPathSegList()
        set m_pathSegList.shouldSynchronize to true when SVGAnimatedProperty is
        created but nothing sets m_pathSegList.shouldSynchronize back to false.
        This was not a problem when the SVGAnimatedProperty was leaking but after
        ensuring it is deleted when it is not referenced this equivalence relation
        becomes untrue sometimes. This caused SVGPathElement::svgAttributeChanged()
        to crash when we check m_pathSegList.shouldSynchronize and if it is true we
        assume that SVGAnimatedProperty::lookupWrapper() will return a non-null pointer
        and therefore we deference this pointer and call SVGAnimatedProperty::isAnimating().
        To fix this crash we need to set m_pathSegList.shouldSynchronize back to false
        when the associated SVGAnimatedProperty is deleted.

2016-02-25  Brady Eidson  <beidson@apple.com>

        Modern IDB: WebKit 2 IPC layer.
        https://bugs.webkit.org/show_bug.cgi?id=153808

        Reviewed by Alex Christensen.

        No new tests (Covered by over 1,000 existing tests).

        * Modules/indexeddb/IDBKeyData.h:
        (WebCore::IDBKeyData::encode): It's okay to encode Min and Max.
        (WebCore::IDBKeyData::decode): It's okay to decode Min and Max.

2016-02-25  Daniel Bates  <dabates@apple.com>

        CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default
        https://bugs.webkit.org/show_bug.cgi?id=154522
        <rdar://problem/24762078>

        Reviewed by Brent Fulgham.

        Include attributes statusCode and columnNumber in a dispatched SecurityPolicyViolationEvent and
        as part of the SecurityPolicyViolationEventInit dictionary as per section Violation DOM Events
        of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp/> (24 February 2016).
        Additionally, enable dispatching of this event when a Content Security Policy violation occurs regardless
        of whether ENABLE(CSP_NEXT) is enabled.

        Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

        * WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.
        * dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.
        * dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this
        code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent
        to support attributes statusCode and columnNumebr.
        * dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent
        and send a violation report (if applicable).

2016-02-25  Eric Carlson  <eric.carlson@apple.com>

        [MediaStream] MediaDeviceInfo deviceId and groupId must be unique to the page's origin
        https://bugs.webkit.org/show_bug.cgi?id=153163
        <rdar://problem/24334526>

        Reviewed by Tim Horton.

        Tests: http/tests/media/media-stream/enumerate-devices-source-id-persistent.html
               http/tests/media/media-stream/enumerate-devices-source-id.html

        * Modules/mediastream/MediaDevicesRequest.cpp:
        (WebCore::MediaDevicesRequest::start): Don't check document.hasHadActiveMediaStreamTrack, do it
          in didCompleteTrackSourceInfoRequest where we need the information.
        (WebCore::MediaDevicesRequest::didCompletePermissionCheck): Renamed from didCompleteCheck, save
          device ID hash string.
        (WebCore::hashString): Hash a string with SHA1.
        (WebCore::MediaDevicesRequest::hashID): Hash and ID.
        (WebCore::MediaDevicesRequest::didCompleteTrackSourceInfoRequest): Hash deviceId and groupId.
        (WebCore::MediaDevicesRequest::didCompleteCheck): Deleted.
        (WebCore::MediaDevicesRequest::getTrackSources): Deleted.
        (WebCore::MediaDevicesRequest::didCompleteRequest): Deleted.
        * Modules/mediastream/MediaDevicesRequest.h:

        * Modules/mediastream/UserMediaPermissionCheck.cpp:
        (WebCore::UserMediaPermissionCheck::userMediaDocumentOrigin): Renamed from securityOrigin.
        (WebCore::UserMediaPermissionCheck::topLevelDocumentOrigin): New, return the top level document origin.
        (WebCore::UserMediaPermissionCheck::setUserMediaAccessInfo): Renamed from setHasPersistentPermission.
        (WebCore::UserMediaPermissionCheck::securityOrigin): Deleted.
        (WebCore::UserMediaPermissionCheck::setHasPersistentPermission): Deleted.
        * Modules/mediastream/UserMediaPermissionCheck.h:

        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::UserMediaRequest::userMediaDocumentOrigin): Renamed from securityOrigin.
        (WebCore::UserMediaRequest::topLevelDocumentOrigin): New, return the top level document origin.
        (WebCore::UserMediaRequest::securityOrigin): Deleted.
        * Modules/mediastream/UserMediaRequest.h:
        (WebCore::UserMediaRequest::requiresAudio): Deleted, unused.
        (WebCore::UserMediaRequest::requiresVideo): Ditto.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerMediaDeviceIdentifierStorageDirectory): Deleted, unused.
        * html/HTMLMediaElement.h:

        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerMediaDeviceIdentifierStorageDirectory): Deleted.

        * platform/mediastream/MediaStreamTrackSourcesRequestClient.h:
        (WebCore::MediaStreamTrackSourcesRequestClient::didCompleteTrackSourceInfoRequest): Renamed from didCompleteRequest.

        * platform/mediastream/mac/RealtimeMediaSourceCenterMac.cpp:
        (WebCore::RealtimeMediaSourceCenterMac::getMediaStreamTrackSources): Ditto.

        * platform/mock/MockRealtimeMediaSourceCenter.cpp:
        (WebCore::MockRealtimeMediaSourceCenter::getMediaStreamTrackSources): Ditto.

2016-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Tearing when entering AC mode
        https://bugs.webkit.org/show_bug.cgi?id=150955

        Reviewed by Michael Catanzaro.

        * platform/gtk/GtkUtilities.cpp:
        (WebCore::widgetIsOnscreenToplevelWindow): Allow passing nullptr.

2016-02-24  Chris Dumez  <cdumez@apple.com>

        Drop [TreatReturnedNullStringAs=Null] WebKit-specific IDL attribute
        https://bugs.webkit.org/show_bug.cgi?id=154659

        Reviewed by Sam Weinig.

        Drop [TreatReturnedNullStringAs=Null] WebKit-specific IDL attribute and
        use nullable DOMString types instead:
        http://heycam.github.io/webidl/#idl-nullable-type

        This is the standard way of doing things. We already had support
        in the bindings generator for nullable DOMString attributes so
        we now just leverage this support. However, our IDL parser did
        not correctly parse nullable DOMString return values for operations.
        This patch fixes this.

        This patch also drops [TreatNullAs=NullString] and
        [TreatUndefinedAs=NullString] for writable DOMString attributes that
        are now marked as nullable because they are implied.

        * Modules/fetch/FetchHeaders.idl:
        * Modules/indexeddb/IDBObjectStore.idl:
        * Modules/mediasource/DOMURLMediaSource.idl:
        * Modules/mediastream/DOMURLMediaStream.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): Deleted.
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/IDLParser.pm:
        (parseAttributeOrOperationRest):
        (parseOperationOrIterator):
        (parseSpecialOperation):
        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        (webkit_dom_test_obj_nullable_string_method):
        (webkit_dom_test_obj_nullable_string_special_method):
        (webkit_dom_test_obj_conditional_method3): Deleted.
        (webkit_dom_test_obj_convert1): Deleted.
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObj::getOwnPropertySlot):
        (WebCore::JSTestObj::getOwnPropertySlotByIndex):
        (WebCore::JSTestObj::getOwnPropertyNames):
        (WebCore::jsTestObjPrototypeFunctionNullableStringMethod):
        (WebCore::jsTestObjConstructorFunctionNullableStringStaticMethod):
        (WebCore::jsTestObjPrototypeFunctionNullableStringSpecialMethod):
        (WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence): Deleted.
        (WebCore::jsTestObjPrototypeFunctionMethodWithAndWithoutNullableSequence2): Deleted.
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        (-[DOMTestObj nullableStringMethod]):
        (-[DOMTestObj nullableStringStaticMethod]):
        (-[DOMTestObj nullableStringSpecialMethod:]):
        (-[DOMTestObj overloadedMethod1:]): Deleted.
        (-[DOMTestObj getSVGDocument]): Deleted.
        * bindings/scripts/test/TestObj.idl:
        * css/CSSCharsetRule.idl:
        * css/CSSImportRule.idl:
        * css/CSSKeyframesRule.idl:
        * css/CSSPageRule.idl:
        * css/CSSRule.idl:
        * css/CSSStyleDeclaration.idl:
        * css/CSSStyleRule.idl:
        * css/CSSValue.idl:
        * css/MediaList.idl:
        * css/StyleSheet.idl:
        * dom/Attr.idl:
        * dom/CharacterData.idl:
        * dom/DOMStringList.idl:
        * dom/Document.idl:
        * dom/DocumentType.idl:
        * dom/Element.idl:
        * dom/Entity.idl:
        * dom/MutationRecord.idl:
        * dom/Node.idl:
        * dom/ProcessingInstruction.idl:
        * html/DOMSettableTokenList.idl:
        * html/DOMTokenList.idl:
        * html/DOMURL.idl:
        * html/canvas/WebGLDebugShaders.idl:
        * html/canvas/WebGLRenderingContextBase.idl:
        * page/DOMWindow.idl:
        * storage/Storage.idl:
        * storage/StorageEvent.idl:
        * xml/XMLHttpRequest.idl:
        * xml/XPathNSResolver.idl:

2016-02-24  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        [web-animations] Add AnimationTimeline, DocumentTimeline and add extensions to Document interface
        https://bugs.webkit.org/show_bug.cgi?id=151688

        Reviewed by Dean Jackson.

        - Adds DocumentTimeline interface and class implementation
        - Implements the DocumentAnimation extension to the Document Interface that contains a default DocumentTimeline
        - Add AnimationTimeline interface stub (i.e. without getAnimations and currentTime)
        - Adds AnimationTimeline class implementation for AnimationTimeline interface stub
        - Adds Javascript bindings for the above classes and interfaces
        - Enables the WEB_ANIMATIONS compiler switch

        No tests yet.  Tests will be added as class functionality is added incrementally.

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * DerivedSources.make:
        * PlatformGTK.cmake:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.vcxproj/WebCoreIncludeCommon.props:
        * WebCore.vcxproj/copyForwardingHeaders.cmd:
        * WebCore.xcodeproj/project.pbxproj:
        * animation/AnimationTimeline.cpp: Added.
        (WebCore::AnimationTimeline::AnimationTimeline):
        (WebCore::AnimationTimeline::~AnimationTimeline):
        (WebCore::AnimationTimeline::destroy):
        * animation/AnimationTimeline.h: Added.
        (WebCore::AnimationTimeline::deref):
        (WebCore::AnimationTimeline::isDocumentTimeline):
        (WebCore::AnimationTimeline::classType):
        * animation/AnimationTimeline.idl: Added.
        * animation/DocumentAnimation.cpp: Added.
        (WebCore::DocumentAnimation::DocumentAnimation):
        (WebCore::DocumentAnimation::~DocumentAnimation):
        (WebCore::DocumentAnimation::timeline):
        (WebCore::DocumentAnimation::supplementName):
        (WebCore::DocumentAnimation::from):
        * animation/DocumentAnimation.h: Added.
        * animation/DocumentAnimation.idl: Added.
        * animation/DocumentTimeline.cpp: Added.
        (WebCore::DocumentTimeline::create):
        (WebCore::DocumentTimeline::DocumentTimeline):
        (WebCore::DocumentTimeline::~DocumentTimeline):
        * animation/DocumentTimeline.h: Added.
        * animation/DocumentTimeline.idl: Added.
        * bindings/js/JSAnimationTimelineCustom.cpp: Added.
        (WebCore::toJS):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/scripts/CodeGeneratorGObject.pm:
        * dom/Document.h:

2016-02-24  Brady Eidson  <beidson@apple.com>

        Modern IDB: Some w3c objectstore tests crash under GuardMalloc.
        https://bugs.webkit.org/show_bug.cgi?id=154460

        Reviewed by Alex Christensen.

        No new tests (Covered by existing tests).

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::~UniqueIDBDatabase):
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentDeleteOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):  Don't delete the UniqueIDBDatabase yet 
          if there are still any connections pending close.
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformCommitTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformAbortTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::inProgressTransactionCompleted): It's possible that with this
          transaction completing, and a connection finished its close process, that the UniqueIDBDatabase is
          now ready to be deleted.

        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseConnection::abortTransactionWithoutCallback):
        * Modules/indexeddb/server/UniqueIDBDatabaseConnection.h:

        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::abortWithoutCallback):

2016-02-24  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Moved PRE/POST_BUILD_COMMAND to WEBKIT_FRAMEWORK.
        https://bugs.webkit.org/show_bug.cgi?id=154651

        Reviewed by Alex Christensen.

        No new tests needed.

        * CMakeLists.txt: Moved shared code to WEBKIT_FRAMEWORK macro.

2016-02-24  Ryosuke Niwa  <rniwa@webkit.org>

        Use more references in FocusNavigationScope
        https://bugs.webkit.org/show_bug.cgi?id=154637

        Reviewed by Chris Dumez.

        Use references in various functions of FocusNavigationScope as well as m_treeScope.

        * page/FocusController.cpp:
        (WebCore::FocusNavigationScope::FocusNavigationScope): Takes TreeScope& instead of TreeScope*.
        (WebCore::FocusNavigationScope::rootNode): Returns ContainerNode& instead of ContainerNode*.
        (WebCore::FocusNavigationScope::owner):
        (WebCore::FocusNavigationScope::scopeOf): Takes Node& instead of Node*. Renamed from focusNavigationScopeOf.
        (WebCore::FocusNavigationScope::scopeOwnedByShadowHost): Ditto. Renamed from focusNavigationScopeOwnedByShadowHost.
        (WebCore::FocusNavigationScope::scopeOwnedByIFrame): Ditto. Renamed from focusNavigationScopeOwnedByIFrame.
        (WebCore::FocusController::findFocusableElementDescendingDownIntoFrameDocument):
        (WebCore::FocusController::advanceFocusInDocumentOrder):
        (WebCore::FocusController::findFocusableElementAcrossFocusScope): Define currentScope inside the loop now that
        the copy constructor of FocusNavigationScope no longer exists (since m_treeScope is a reference).
        (WebCore::FocusController::findFocusableElementRecursively):
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::FocusController::nextFocusableElement):
        (WebCore::FocusController::previousFocusableElement):

2016-02-24  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add MediaEndpoint interface (WebRTC backend abstraction)
        https://bugs.webkit.org/show_bug.cgi?id=150165

        Reviewed by Eric Carlson.

        Add the MediaEndpoint interface along with its companion objects.

        MediaEndpoint interface: A WebRTC platform abstraction that is used to
        configure how the the WebRTC backend sends and receives. It also abstracts
        ICE functionality such as generating local candidates and doing
        checking on remote candidates. The RTCPeerConnection API, and other API
        objects such as RTCRtpSender/Receiver, live above MediaEndpoint.

        MediaEndpointConfiguration: A settings object used to configure a
        MediaEndpoint with, for example, ICE helper servers and other polices.
        A MediaEndpointConfiguration is used to initialize a MediaEndpoint, but
        can also be used to update settings.

        MediaEndpointSessionConfiguration: An object that describes how the
        MediaEndpoint should send and receive. Contains PeerMediaDescription,
        MediaPayload and IceCandidate objects.

        Tests: The MediaEndpoint platform interface has no implementations yet.

        * CMakeLists.txt:
        * Modules/mediastream/MediaEndpointPeerConnection.cpp:
        (WebCore::MediaEndpointPeerConnection::gotDtlsFingerprint):
        (WebCore::MediaEndpointPeerConnection::gotIceCandidate):
        (WebCore::MediaEndpointPeerConnection::doneGatheringCandidates):
        (WebCore::MediaEndpointPeerConnection::gotRemoteSource):
        * Modules/mediastream/MediaEndpointPeerConnection.h:
        * WebCore.xcodeproj/project.pbxproj:
        * platform/mediastream/IceCandidate.h: Added.
        (WebCore::IceCandidate::create):
        (WebCore::IceCandidate::~IceCandidate):
        (WebCore::IceCandidate::type):
        (WebCore::IceCandidate::setType):
        (WebCore::IceCandidate::foundation):
        (WebCore::IceCandidate::setFoundation):
        (WebCore::IceCandidate::componentId):
        (WebCore::IceCandidate::setComponentId):
        (WebCore::IceCandidate::transport):
        (WebCore::IceCandidate::setTransport):
        (WebCore::IceCandidate::priority):
        (WebCore::IceCandidate::setPriority):
        (WebCore::IceCandidate::address):
        (WebCore::IceCandidate::setAddress):
        (WebCore::IceCandidate::port):
        (WebCore::IceCandidate::setPort):
        (WebCore::IceCandidate::tcpType):
        (WebCore::IceCandidate::setTcpType):
        (WebCore::IceCandidate::relatedAddress):
        (WebCore::IceCandidate::setRelatedAddress):
        (WebCore::IceCandidate::relatedPort):
        (WebCore::IceCandidate::setRelatedPort):
        (WebCore::IceCandidate::clone):
        (WebCore::IceCandidate::IceCandidate):
        * platform/mediastream/MediaEndpoint.cpp: Added.
        (WebCore::createMediaEndpoint):
        * platform/mediastream/MediaEndpoint.h: Added.
        (WebCore::MediaEndpointClient::~MediaEndpointClient):
        (WebCore::MediaEndpoint::~MediaEndpoint):
        * platform/mediastream/MediaEndpointConfiguration.cpp: Added.
        (WebCore::IceServerInfo::IceServerInfo):
        (WebCore::MediaEndpointConfiguration::MediaEndpointConfiguration):
        * platform/mediastream/MediaEndpointConfiguration.h: Added.
        (WebCore::IceServerInfo::create):
        (WebCore::IceServerInfo::~IceServerInfo):
        (WebCore::IceServerInfo::urls):
        (WebCore::IceServerInfo::credential):
        (WebCore::IceServerInfo::username):
        (WebCore::MediaEndpointConfiguration::create):
        (WebCore::MediaEndpointConfiguration::iceServers):
        (WebCore::MediaEndpointConfiguration::iceTransportPolicy):
        (WebCore::MediaEndpointConfiguration::bundlePolicy):
        * platform/mediastream/MediaEndpointSessionConfiguration.h: Added.
        (WebCore::MediaEndpointSessionConfiguration::create):
        (WebCore::MediaEndpointSessionConfiguration::~MediaEndpointSessionConfiguration):
        (WebCore::MediaEndpointSessionConfiguration::sessionId):
        (WebCore::MediaEndpointSessionConfiguration::setSessionId):
        (WebCore::MediaEndpointSessionConfiguration::sessionVersion):
        (WebCore::MediaEndpointSessionConfiguration::setSessionVersion):
        (WebCore::MediaEndpointSessionConfiguration::mediaDescriptions):
        (WebCore::MediaEndpointSessionConfiguration::addMediaDescription):
        (WebCore::MediaEndpointSessionConfiguration::clone):
        (WebCore::MediaEndpointSessionConfiguration::MediaEndpointSessionConfiguration):
        * platform/mediastream/MediaPayload.h: Added.
        (WebCore::MediaPayload::create):
        (WebCore::MediaPayload::~MediaPayload):
        (WebCore::MediaPayload::type):
        (WebCore::MediaPayload::setType):
        (WebCore::MediaPayload::encodingName):
        (WebCore::MediaPayload::setEncodingName):
        (WebCore::MediaPayload::clockRate):
        (WebCore::MediaPayload::setClockRate):
        (WebCore::MediaPayload::channels):
        (WebCore::MediaPayload::setChannels):
        (WebCore::MediaPayload::ccmfir):
        (WebCore::MediaPayload::setCcmfir):
        (WebCore::MediaPayload::nackpli):
        (WebCore::MediaPayload::setNackpli):
        (WebCore::MediaPayload::nack):
        (WebCore::MediaPayload::setNack):
        (WebCore::MediaPayload::parameters):
        (WebCore::MediaPayload::addParameter):
        (WebCore::MediaPayload::clone):
        (WebCore::MediaPayload::MediaPayload):
        * platform/mediastream/PeerMediaDescription.h: Added.
        (WebCore::PeerMediaDescription::create):
        (WebCore::PeerMediaDescription::~PeerMediaDescription):
        (WebCore::PeerMediaDescription::type):
        (WebCore::PeerMediaDescription::setType):
        (WebCore::PeerMediaDescription::port):
        (WebCore::PeerMediaDescription::setPort):
        (WebCore::PeerMediaDescription::address):
        (WebCore::PeerMediaDescription::setAddress):
        (WebCore::PeerMediaDescription::mode):
        (WebCore::PeerMediaDescription::setMode):
        (WebCore::PeerMediaDescription::payloads):
        (WebCore::PeerMediaDescription::addPayload):
        (WebCore::PeerMediaDescription::setPayloads):
        (WebCore::PeerMediaDescription::rtcpMux):
        (WebCore::PeerMediaDescription::setRtcpMux):
        (WebCore::PeerMediaDescription::rtcpAddress):
        (WebCore::PeerMediaDescription::setRtcpAddress):
        (WebCore::PeerMediaDescription::rtcpPort):
        (WebCore::PeerMediaDescription::setRtcpPort):
        (WebCore::PeerMediaDescription::mediaStreamId):
        (WebCore::PeerMediaDescription::setMediaStreamId):
        (WebCore::PeerMediaDescription::mediaStreamTrackId):
        (WebCore::PeerMediaDescription::setMediaStreamTrackId):
        (WebCore::PeerMediaDescription::dtlsSetup):
        (WebCore::PeerMediaDescription::setDtlsSetup):
        (WebCore::PeerMediaDescription::dtlsFingerprintHashFunction):
        (WebCore::PeerMediaDescription::setDtlsFingerprintHashFunction):
        (WebCore::PeerMediaDescription::dtlsFingerprint):
        (WebCore::PeerMediaDescription::setDtlsFingerprint):
        (WebCore::PeerMediaDescription::cname):
        (WebCore::PeerMediaDescription::setCname):
        (WebCore::PeerMediaDescription::ssrcs):
        (WebCore::PeerMediaDescription::addSsrc):
        (WebCore::PeerMediaDescription::clearSsrcs):
        (WebCore::PeerMediaDescription::iceUfrag):
        (WebCore::PeerMediaDescription::setIceUfrag):
        (WebCore::PeerMediaDescription::icePassword):
        (WebCore::PeerMediaDescription::setIcePassword):
        (WebCore::PeerMediaDescription::iceCandidates):
        (WebCore::PeerMediaDescription::addIceCandidate):
        (WebCore::PeerMediaDescription::source):
        (WebCore::PeerMediaDescription::setSource):
        (WebCore::PeerMediaDescription::clone):
        (WebCore::PeerMediaDescription::PeerMediaDescription):

2016-02-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement Fetch API Response
        https://bugs.webkit.org/show_bug.cgi?id=154536

        Reviewed by Alex Christensen.

        Tests: imported/w3c/web-platform-tests/fetch/api/response/response-clone.html
               imported/w3c/web-platform-tests/fetch/api/response/response-consume.html
               imported/w3c/web-platform-tests/fetch/api/response/response-error.html
               imported/w3c/web-platform-tests/fetch/api/response/response-idl.html
               imported/w3c/web-platform-tests/fetch/api/response/response-init-001.html
               imported/w3c/web-platform-tests/fetch/api/response/response-init-002.html
               imported/w3c/web-platform-tests/fetch/api/response/response-static-error.html
               imported/w3c/web-platform-tests/fetch/api/response/response-static-redirect.html

        Adding Fetch Response as FetchResponse class.
        Constructor uses a built-in to pre-process the parameters.
        Support of body as ReadableStream is missing.

        * CMakeLists.txt:
        * DerivedSources.make:
        * Modules/fetch/FetchBody.h:
        (WebCore::FetchBody::empty):
        * Modules/fetch/FetchResponse.cpp: Added.
        (WebCore::JSFetchResponse::body):
        (WebCore::isRedirectStatus):
        (WebCore::isNullBodyStatus):
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::initializeWith):
        (WebCore::FetchResponse::FetchResponse):
        (WebCore::FetchResponse::clone):
        (WebCore::FetchResponse::type):
        * Modules/fetch/FetchResponse.h: Added.
        (WebCore::FetchResponse::create):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::url):
        (WebCore::FetchResponse::redirected):
        (WebCore::FetchResponse::status):
        (WebCore::FetchResponse::ok):
        (WebCore::FetchResponse::statusText):
        (WebCore::FetchResponse::headers):
        (WebCore::FetchResponse::isDisturbed):
        (WebCore::FetchResponse::arrayBuffer):
        (WebCore::FetchResponse::formData):
        (WebCore::FetchResponse::blob):
        (WebCore::FetchResponse::json):
        (WebCore::FetchResponse::text):
        * Modules/fetch/FetchResponse.idl: Added.
        * Modules/fetch/FetchResponse.js: Added.
        (initializeFetchResponse):
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:
        (WebCore::JSBuiltinFunctions::JSBuiltinFunctions):
        (WebCore::JSBuiltinFunctions::fetchResponseBuiltins):

2016-02-24  Ryosuke Niwa  <rniwa@webkit.org>

        A function named canTakeNextToken executing blocking scripts is misleading
        https://bugs.webkit.org/show_bug.cgi?id=154636

        Reviewed by Darin Adler.

        Merged canTakeNextToken into pumpTokenizer and extracted pumpTokenizerLoop out of pumpTokenizer.

        Inlined m_parserChunkSize in HTMLParserScheduler into checkForYieldBeforeToken, and removed needsYield
        from PumpSession in favor of making checkForYieldBeforeToken and checkForYieldBeforeScript return a bool.

        No new tests since this is a pure refactoring.

        * html/parser/HTMLDocumentParser.cpp:
        (WebCore::HTMLDocumentParser::canTakeNextToken): Deleted.
        (WebCore::HTMLDocumentParser::pumpTokenizerLoop): Extracted from pumpTokenizer. We don't have to check
        isStopped() at the beginning since pumpTokenizer asserts that. Return true when session.needsYield would
        have been set to true in the old code and return false elsewhere (for stopping or incomplete token).
        (WebCore::HTMLDocumentParser::pumpTokenizer):
        * html/parser/HTMLDocumentParser.h:
        * html/parser/HTMLParserScheduler.cpp:
        (WebCore::PumpSession::PumpSession):
        (WebCore::HTMLParserScheduler::HTMLParserScheduler):
        (WebCore::HTMLParserScheduler::shouldYieldBeforeExecutingScript): Renamed from checkForYieldBeforeScript.
        * html/parser/HTMLParserScheduler.h:
        (WebCore::HTMLParserScheduler::shouldYieldBeforeToken): Renamed from checkForYieldBeforeToken.
        (WebCore::HTMLParserScheduler::isScheduledForResume):
        (WebCore::HTMLParserScheduler::checkForYield): Extracted from checkForYieldBeforeToken. Reset
        processedTokens to 1 instead of setting it to 0 here and incrementing it later as done in the old code.

2016-02-24  Daniel Bates  <dabates@apple.com>

        CSP: Enable plugin-types directive by default
        https://bugs.webkit.org/show_bug.cgi?id=154420
        <rdar://problem/24730322>

        Reviewed by Brent Fulgham.

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::isExperimentalDirectiveName): Move plugin-types from the directives considered
        experimental to...
        (WebCore::isCSPDirectiveName): ...the list of standard directives.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the plugin-types
        directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.

2016-02-24  Ryan Haddad  <ryanhaddad@apple.com>

        Speculative fix for ios build.

        Unreviewed build fix.

        * bindings/objc/DOM.mm:
        (-[DOMNode nextFocusNode]):
        (-[DOMNode previousFocusNode]):

2016-02-24  Zalan Bujtas  <zalan@apple.com>

        Background of an absolutely positioned inline element inside text-indented parent is positioned statically.
        https://bugs.webkit.org/show_bug.cgi?id=154019

        Reviewed by Simon Fraser.

        This patch ensures that statically positioned out-of-flow renderers are also text-aligned
        even when none of the renderers on the first line generate a linebox (so we end up with no bidi runs at all).
        The fix is to pass IndentTextOrNot information to startAlignedOffsetForLine through updateStaticInlinePositionForChild
        so that we can compute the left position for this statically positioned out of flow renderer.

        Test: fast/css3-text/css3-text-indent/text-indent-with-absolute-pos-child.html

        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::adjustPositionedBlock):
        (WebCore::RenderBlockFlow::updateStaticInlinePositionForChild):
        * rendering/RenderBlockFlow.h:
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
        (WebCore::RenderBlockFlow::startAlignedOffsetForLine):
        * rendering/line/LineBreaker.cpp:
        (WebCore::LineBreaker::skipTrailingWhitespace):
        (WebCore::LineBreaker::skipLeadingWhitespace):
        * rendering/line/LineInlineHeaders.h: webkit.org/b/154628 fixes the bool vs IndentTextOrNot issue.
        (WebCore::setStaticPositions):

2016-02-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove IteratorKey and IteratorValue declarations from JSXX class declarations.
        https://bugs.webkit.org/show_bug.cgi?id=154577

        Reviewed by Myles C. Maxfield.

        No change of behavior.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader): Deleted declaration of IteratorKey and IteratorValue.
        * bindings/scripts/test/JS/JSTestObj.h:
        (WebCore::JSTestObj::createStructure): Rebasing of binding test expectation.

2016-02-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Refactor FetchHeaders initialization with iterators
        https://bugs.webkit.org/show_bug.cgi?id=154537

        Reviewed by Darin Adler.

        Covered by existing tests.

        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::initializeWith): Deleted.
        * Modules/fetch/FetchHeaders.h: Removed FetchHeaders::initializeWith.
        * Modules/fetch/FetchHeaders.idl: Ditto.
        * Modules/fetch/FetchHeaders.js:
        (initializeFetchHeaders): Making use of iterators to fill headers.

2016-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API break after r196998.

        webkit_dom_node_clone_node can now raise exceptions, so rename it
        as webkit_dom_node_clone_node_with_error and deprecate the old one
        that calls the new one ignoring the error.

        * bindings/gobject/WebKitDOMDeprecated.cpp:
        (webkit_dom_node_clone_node):
        * bindings/gobject/WebKitDOMDeprecated.h:
        * bindings/gobject/WebKitDOMDeprecated.symbols:
        * bindings/gobject/webkitdom.symbols:
        * bindings/scripts/CodeGeneratorGObject.pm:
        (FunctionUsedToNotRaiseException):
        (GenerateFunction):

2016-02-24  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r195949): [GTK] Test /webkit2/WebKitWebView/insert/link is failing since r195949
        https://bugs.webkit.org/show_bug.cgi?id=153747

        Reviewed by Michael Catanzaro.

        Do not return early when reaching a boundary if there's a range
        selection. In that case, the selection will be cleared and
        accessibility will be notified.

        Test: editing/selection/move-to-line-boundary-clear-selection.html

        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::modify):

2016-02-24  Alejandro G. Castro  <alex@igalia.com>

        [Gstreamer] Mediaplayer should observe the tracks and not the source
        https://bugs.webkit.org/show_bug.cgi?id=154582

        Reviewed by Philippe Normand.

        We have to observe the track objects that define the
        mediastream. Replace the source attributes with the new tracks and
        use them properly in the class.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp:
        (WebCore::MediaPlayerPrivateGStreamerOwr::~MediaPlayerPrivateGStreamerOwr):
        Make sure we are not observing anymore the tracks after
        destruction.
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasVideo): Used the track
        instead of the source.
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasAudio): Ditto.
        (WebCore::MediaPlayerPrivateGStreamerOwr::currentTime): Ditto.
        (WebCore::MediaPlayerPrivateGStreamerOwr::internalLoad): Ditto.
        (WebCore::MediaPlayerPrivateGStreamerOwr::stop): Ditto.
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackEnded): Added, new
        track observer API, make sure we disable the ended tracks.
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackMutedChanged):
        Added, new track observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackSettingsChanged):
        Added, new track observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::trackEnabledChanged):
        Added, new track observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceStopped): Deleted,
        source observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceMutedChanged):
        Deleted, source observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceSettingsChanged):
        Deleted, source observer API.
        (WebCore::MediaPlayerPrivateGStreamerOwr::preventSourceFromStopping):
        Deleted, source observer API.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h:
        Replaced the attributes representing the source with the tracks
        and added the new track observer functions.

2016-02-23  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] Swap the order of columns/rows in grid-gap shorthand
        https://bugs.webkit.org/show_bug.cgi?id=154584

        The latest editor's draft have just changed the order. Now it
        should be <grid-row-gap> <grid-column-gap>?.

        Reviewed by Darin Adler.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridGapShorthand):
        * css/CSSPropertyNames.in:

2016-02-24  Ryosuke Niwa  <rniwa@webkit.org>

        Move FocusNavigationScope into FocusController.cpp
        https://bugs.webkit.org/show_bug.cgi?id=154630

        Reviewed by Darin Adler.

        Moved FocusNavigationScope from FocusController.h to FocusController.cpp.

        * bindings/objc/DOM.mm:
        (-[DOMNode nextFocusNode]):
        (-[DOMNode previousFocusNode]):
        * page/FocusController.cpp:
        (WebCore::parentInScope):
        (WebCore::FocusNavigationScope::firstChildInScope): Moved into FocusNavigationScope.
        (WebCore::FocusNavigationScope::lastChildInScope): Ditto.
        (WebCore::FocusNavigationScope::nextInScope): Ditto.
        (WebCore::FocusNavigationScope::previousInScope): Ditto.
        (WebCore::FocusController::findFocusableElementAcrossFocusScope):
        (WebCore::FocusController::findFocusableElementRecursively):
        (WebCore::FocusController::findFocusableElement):
        (WebCore::nextElementWithGreaterTabIndex):
        (WebCore::previousElementWithLowerTabIndex):
        (WebCore::FocusController::nextFocusableElement): Added a variant for DOM.mm and WebPageIOS.mm.
        (WebCore::FocusController::previousFocusableElement): Ditto.
        (WebCore::FocusController::nextFocusableElement):
        (WebCore::FocusController::previousFocusableElement): Use if instead of for loop for clarity.
        * page/FocusController.h:

2016-02-24  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: RTCPeerConnection: Sort out responsibilities of close() and stop()
        https://bugs.webkit.org/show_bug.cgi?id=154581

        Reviewed by Eric Carlson.

        Let RTCPeerConnection::close() contain all teardown logic be called by stop().
        close() is also responisble for stopping the PeerConnectionBackend and stopping
        all RTCRtpSender objects.

        Test coverage:
        fast/mediastream/RTCRtpSender-replaceTrack.html (updated)
        fast/mediastream/RTCPeerConnection-closed-state.html

        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::close):
        (WebCore::RTCPeerConnection::stop):
        (WebCore::RTCPeerConnection::RTCPeerConnection): Deleted.
        * Modules/mediastream/RTCPeerConnection.h:

2016-02-24  Adam Bergkvist  <adam.bergkvist@ericsson.com>

        WebRTC: Add addReceiver() function to PeerConnectionBackendClient interface
        https://bugs.webkit.org/show_bug.cgi?id=154583

        Reviewed by Eric Carlson.

        The addRecevier() notifies the PeerConnectionBackendClient that a new RTCRtpReceiver,
        representing an MediaStreamTrack received from a remote peer, is added.

        * Modules/mediastream/PeerConnectionBackend.h:
        * Modules/mediastream/RTCPeerConnection.cpp:
        (WebCore::RTCPeerConnection::addReceiver):
        * Modules/mediastream/RTCPeerConnection.h:

2016-02-23  Olivier Blin  <olivier.blin@softathome.com>

        Support building LocaleICU with light ICU (UCONFIG_NO_FORMATTING)
        https://bugs.webkit.org/show_bug.cgi?id=154484

        Reviewed by Darin Adler.

        In this mode, this makes LocaleICU with UCONFIG_NO_FORMATTING
        essentially the same as LocaleNone, but allows to keep using ICU for
        other features.

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::LocaleICU):
        (WebCore::LocaleICU::~LocaleICU):
        (WebCore::LocaleICU::initializeLocaleData):
        * platform/text/LocaleICU.h:

2016-02-23  Myles C. Maxfield  <mmaxfield@apple.com>

        Remove dead FontLoader code
        https://bugs.webkit.org/show_bug.cgi?id=154625

        Reviewed by Darin Adler.

        This code has been replaced by FontFaceSet.

        No new tests because there is no behavior change.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSAllInOne.cpp:
        * css/FontLoader.cpp: Removed.
        (WebCore::LoadFontCallback::create): Deleted.
        (WebCore::LoadFontCallback::createFromParams): Deleted.
        (WebCore::LoadFontCallback::~LoadFontCallback): Deleted.
        (WebCore::LoadFontCallback::familyCount): Deleted.
        (WebCore::LoadFontCallback::LoadFontCallback): Deleted.
        (WebCore::LoadFontCallback::notifyLoaded): Deleted.
        (WebCore::LoadFontCallback::notifyError): Deleted.
        (WebCore::FontLoader::loadFontDone): Deleted.
        (WebCore::FontLoader::FontLoader): Deleted.
        (WebCore::FontLoader::~FontLoader): Deleted.
        (WebCore::FontLoader::eventTargetData): Deleted.
        (WebCore::FontLoader::ensureEventTargetData): Deleted.
        (WebCore::FontLoader::eventTargetInterface): Deleted.
        (WebCore::FontLoader::scriptExecutionContext): Deleted.
        (WebCore::FontLoader::didLayout): Deleted.
        (WebCore::FontLoader::activeDOMObjectName): Deleted.
        (WebCore::FontLoader::canSuspendForDocumentSuspension): Deleted.
        (WebCore::FontLoader::scheduleEvent): Deleted.
        (WebCore::FontLoader::firePendingEvents): Deleted.
        (WebCore::FontLoader::beginFontLoading): Deleted.
        (WebCore::FontLoader::fontLoaded): Deleted.
        (WebCore::FontLoader::loadError): Deleted.
        (WebCore::FontLoader::notifyWhenFontsReady): Deleted.
        (WebCore::FontLoader::loadingDone): Deleted.
        (WebCore::FontLoader::loadFont): Deleted.
        (WebCore::FontLoader::checkFont): Deleted.
        (WebCore::applyPropertyToCurrentStyle): Deleted.
        (WebCore::FontLoader::resolveFontStyle): Deleted.
        * css/FontLoader.h: Removed.
        * css/FontLoader.idl: Removed.
        * page/FrameView.cpp:

2016-02-23  Per Arne Vollan  <peavo@outlook.com>

        [WinCairo][MediaFoundation] Implement methods to set volume.
        https://bugs.webkit.org/show_bug.cgi?id=154580

        Reviewed by Alex Christensen.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::MediaPlayerPrivateMediaFoundation::paused):
        (WebCore::MediaPlayerPrivateMediaFoundation::setVolume):
        (WebCore::MediaPlayerPrivateMediaFoundation::supportsMuting):
        (WebCore::MediaPlayerPrivateMediaFoundation::setMuted):
        (WebCore::MediaPlayerPrivateMediaFoundation::networkState):
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

2016-02-23  Chris Dumez  <cdumez@apple.com>

        [Reflected] IDL attributes of integer types should use HTML rules for parsing integers
        https://bugs.webkit.org/show_bug.cgi?id=154573

        Reviewed by Darin Adler.

        [Reflected] IDL attributes of integer types should use HTML rules for
        parsing integers:
        - https://html.spec.whatwg.org/#reflecting-content-attributes-in-idl-attributes

        Those rules are defined here:
        - https://html.spec.whatwg.org/#rules-for-parsing-integers
        - https://html.spec.whatwg.org/#rules-for-parsing-non-negative-integers

        We already had an implementation for parsing HTML integers but our reflected
        attributes currently use WTFString::toInt() / toUint() instead.

        No new tests, already covered by existing tests.

        * dom/Element.cpp:
        (WebCore::Element::getIntegralAttribute):
        This method used by the bindings only, for reflected IDL attributed of
        type 'long'. Now call parseHTMLInteger() instead of String::toInt() to
        parse the content attribute as per the HTML specification.

        (WebCore::Element::getUnsignedIntegralAttribute):
        This method used by the bindings only, for reflected IDL attributed of
        type 'unsigned long'. Now call parseHTMLNonNegativeInteger() instead of
        String::toUInt() to parse the content attribute as per the HTML
        specification.

        * html/parser/HTMLParserIdioms.cpp:
        (WebCore::parseHTMLIntegerInternal):
        Fix a bug in our implementation of parseHTMLIntegerInternal() that
        would cause the string "−2147483648" to be parsed as 0. It should
        be parsed as −2147483648, which is in the valid range as per:
        http://heycam.github.io/webidl/#idl-long

2016-02-23  Chris Dumez  <cdumez@apple.com>

        Align our implementation of Range.createContextualFragment with the specification
        https://bugs.webkit.org/show_bug.cgi?id=154627

        Reviewed by Ryosuke Niwa.

        Align our implementation of Range.createContextualFragment with the
        specification:
        - https://w3c.github.io/DOM-Parsing/#widl-Range-createContextualFragment-DocumentFragment-DOMString-fragment

        In particular, if the Range's start node is a Document / DocumentFragment,
        we now create a new HTMLBodyElement and use it as context element, instead
        of throwing an exception.

        This also aligns our behavior with Firefox and Chrome.

        Tests: imported/blink/fast/dom/Range/create-contextual-fragment-from-bodyless-document-range.html
               imported/blink/fast/dom/Range/create-contextual-fragment-from-detached-text-node-range.html
               imported/blink/fast/dom/Range/create-contextual-fragment-from-document-fragment-range.html
               imported/blink/fast/dom/Range/create-contextual-fragment-from-document-range.html
               imported/blink/fast/dom/Range/create-contextual-fragment-from-xhtml-document-range.xhtml
               imported/blink/fast/dom/Range/create-contextual-fragment-script-not-ran.html
               imported/blink/fast/dom/Range/create-contextual-fragment-script-unmark-already-started.html

        * dom/Range.cpp:
        (WebCore::Range::createContextualFragment):

2016-02-23  Dan Bernstein  <mitz@apple.com>

        [Xcode] Linker errors display mangled names, but no longer should
        https://bugs.webkit.org/show_bug.cgi?id=154632

        Reviewed by Sam Weinig.

        * Configurations/Base.xcconfig: Stop setting LINKER_DISPLAYS_MANGLED_NAMES to YES.

2016-02-23  Dean Jackson  <dino@apple.com>

        [WebGL] iOS doesn't respect the alpha:false context creation attribute
        https://bugs.webkit.org/show_bug.cgi?id=154617
        <rdar://problem/13417023>

        Reviewed by Sam Weinig.

        On iOS we were not respecting the alpha:false context creation
        attribute, which meant you always got output that could
        have an alpha channel.

        The good news is that now we're setting the opaque flag on
        the CALayer, there should be a performance improvement when
        compositing WebGL into the page.

        Test: fast/canvas/webgl/context-attributes-alpha.html

        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::GraphicsContext3D::GraphicsContext3D): Don't tell the layer
        to be transparent.
        (WebCore::GraphicsContext3D::setRenderbufferStorageFromDrawable): Do it
        here instead, but based on the value of the alpha attribute.

2016-02-23  Daniel Bates  <dabates@apple.com>

        CSP: Enable base-uri directive by default
        https://bugs.webkit.org/show_bug.cgi?id=154521
        <rdar://problem/24762032>

        Reviewed by Brent Fulgham.

        Tests: http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored.html
               http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-base-uri-deny.html

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::isExperimentalDirectiveName): Move base-uri from the directives considered
        experimental to...
        (WebCore::isCSPDirectiveName): ...the list of standard directives.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the base-uri
        directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.

2016-02-23  Gavin Barraclough  <barraclough@apple.com>

        Remove HIDDEN_PAGE_DOM_TIMER_THROTTLING feature define
        https://bugs.webkit.org/show_bug.cgi?id=112323

        Reviewed by Chris Dumez.

        This feature is controlled by a runtime switch, and defaults off.

        * Configurations/FeatureDefines.xcconfig:
        * page/Page.cpp:
        (WebCore::Page::setTimerThrottlingEnabled):
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
        (WebCore::Settings::shouldRespectPriorityInCSSAttributeSetters):
        (WebCore::Settings::setHiddenPageDOMTimerThrottlingEnabled):
        (WebCore::Settings::setHiddenPageDOMTimerThrottlingAutoIncreases):
        * page/Settings.h:
        (WebCore::Settings::layoutInterval):
        (WebCore::Settings::hiddenPageDOMTimerThrottlingEnabled):
        (WebCore::Settings::hiddenPageDOMTimerThrottlingAutoIncreases):

2016-02-23  Gavin Barraclough  <barraclough@apple.com>

        Add a mechanism to automatically ramp up timer alignment.
        https://bugs.webkit.org/show_bug.cgi?id=154578

        Reviewed by Antti Koivisto & Chris Dumez.

        Allow timer alignment duration to be proportional to the time the page
        has been hidden. This implementation does so by scaling up the throttle
        in exponential steps, spaced exponentially far apart.

        * page/Page.cpp:
        (WebCore::Page::Page):
            - initialize timer.
        (WebCore::Page::hiddenPageDOMTimerThrottlingStateChanged):
            - if setting are changed fully disable/reenable to ensure new setting are read.
        (WebCore::Page::setTimerThrottlingEnabled):
            - enebled bool flag converted to an Optional<double>, tracking time throttling
              is enabled.
        (WebCore::Page::setDOMTimerAlignmentInterval):
            - when new mechanism is enabled schedule a timer to step up alignment.
        (WebCore::Page::timerAlignmentIntervalIncreaseTimerFired):
            - when timer fires increase alignment.
        * page/Page.h:
            - added new member.
        * page/Settings.cpp:
        (WebCore::Settings::Settings):
            - initialize new member.
        (WebCore::Settings::setHiddenPageDOMTimerThrottlingAutoIncreaseLimit):
            - added, update new setting. Setting to zero disabled. A non-zero value is a
              duration in seconds for timer throttling to ramp up to.
        * page/Settings.h:
        (WebCore::Settings::hiddenPageDOMTimerThrottlingAutoIncreases):
            - read as boolean whether throttle increasing is enabled.
        (WebCore::Settings::hiddenPageDOMTimerThrottlingAutoIncreaseLimit):
            - read throttle increasing limit.

2016-02-22  Ada Chan  <adachan@apple.com>

        Refactor script that updates fullscreen buttons.
        https://bugs.webkit.org/show_bug.cgi?id=154562

        Reviewed by Dean Jackson.

        Also expose extra property and element in getCurrentControlsStatus() for future testing.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.updatePictureInPictureButton):
        (Controller.prototype.updateFullscreenButtons):

2016-02-22  Ryosuke Niwa  <rniwa@webkit.org>

        Calling importNode on shadow root causes a crash
        https://bugs.webkit.org/show_bug.cgi?id=154570

        Reviewed by Anders Carlsson.

        The bug was caused by a missing check in cloneNode. Added cloneNodeForBindings to explicitly throw
        an NotSupportedError when it's called on a shadow root. We don't clone shadow root when deep-cloning
        the tree so we don't have to check that condition.

        The behavior of cloneNode is specified at:
        http://w3c.github.io/webcomponents/spec/shadow/#the-shadowroot-interface
        (it current says we should throw DATA_CLONE_ERR but I have an spec bug filed at
        https://github.com/w3c/webcomponents/issues/393)

        The behavior of importNode and adoptNode are specified in DOM4 specification:
        https://dom.spec.whatwg.org/#dom-document-importnode
        https://dom.spec.whatwg.org/#dom-document-adoptnode

        Tests: fast/shadow-dom/Document-prototype-adoptNode.html
               fast/shadow-dom/Document-prototype-importNode.html
               fast/shadow-dom/Node-prototype-cloneNode.html

        * dom/Document.cpp:
        (WebCore::Document::importNode): Throw NotSupportedError when importing a shadow root.
        * dom/Node.cpp:
        (WebCore::Node::cloneNodeForBindings): Added.
        * dom/Node.h:
        * dom/Node.idl: Use cloneNodeForBindings here.

2016-02-23  Daniel Bates  <dabates@apple.com>

        REGRESSION (r196892): No longer emit error message when CSP form-action directive is used as a source expression
        https://bugs.webkit.org/show_bug.cgi?id=154555
        <rdar://problem/24776777>

        Reviewed by Andy Estes.

        Fixes an issue where an error message is not emitted when directive form-action is used as a
        source expression. Prior to <http://trac.webkit.org/changeset/196892>, when directive form-action
        was used as a source expression a console error message would be emitted with the form:

            The Content Security Policy directive 'script-src' contains 'form-action' as a source expression.
            Did you mean 'script-src ...; form-action...' (note the semicolon)?

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::isCSPDirectiveName): Return true if the specified directive name is "form-action".

2016-02-23  Simon Fraser  <simon.fraser@apple.com>

        Lay the groundwork for more constness in StyleResolver-related code
        https://bugs.webkit.org/show_bug.cgi?id=154598

        Reviewed by Antti Koivisto.

        Make some of the leaf functions that are used by the style resolver take 
        const CSSValues, and use 'auto' more to automatically get const stack variables
        when appropriate.

        * css/CSSBorderImageSliceValue.h:
        (WebCore::CSSBorderImageSliceValue::slices):
        * css/CSSPrimitiveValue.h:
        (WebCore::CSSPrimitiveValue::isQuirkValue):
        * css/FontVariantBuilder.cpp:
        (WebCore::extractFontVariantLigatures):
        (WebCore::extractFontVariantNumeric):
        (WebCore::extractFontVariantEastAsian):
        * css/FontVariantBuilder.h:
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertReflection):
        (WebCore::StyleBuilderConverter::convertGridAutoFlow):
        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyValueSize):
        (WebCore::StyleBuilderCustom::applyValueStroke):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::colorFromPrimitiveValueIsDerivedFromElement):
        (WebCore::StyleResolver::colorFromPrimitiveValue):
        (WebCore::StyleResolver::createFilterOperations):
        * css/StyleResolver.h:
        * css/TransformFunctions.cpp:
        (WebCore::transformsForValue):
        * css/TransformFunctions.h:
        * rendering/style/StylePendingImage.h:
        * svg/SVGLength.cpp:
        (WebCore::SVGLength::fromCSSPrimitiveValue):
        * svg/SVGLength.h:

2016-02-23  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Avoid duplicated calls to resolution code
        https://bugs.webkit.org/show_bug.cgi?id=154336

        Reviewed by Sergio Villar Senin.

        We were calling GridResolvedPosition::resolveGridPositionsFromStyle()
        several times per item.

        We can store the GridCoordinates in
        RenderGrid::populateExplicitGridAndOrderIterator()
        and reuse them in the placement code.
        Once RenderGrid::placeItemsOnGrid() is over,
        all the items will have a definite position in both axis.

        No new tests, no change of behavior.

        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::cachedGridCoordinate):
        (WebCore::RenderGrid::cachedGridSpan):
        * rendering/RenderGrid.h:

2016-02-23  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Rows track sizes are optional in grid-template shorthand
        https://bugs.webkit.org/show_bug.cgi?id=154586

        Reviewed by Sergio Villar Senin.

        You can omit the size of the rows in grid-template shorthand,
        even if you specify a named grid line for the end of the row,
        due to a change in the spec back in 2014:
        https://github.com/w3c/csswg-drafts/commit/9f660c4183c73c1f5279c46904dc6cb314f76194

        Before if you want to specify a named grid line,
        you need to set the row size.

        Update parsing, so it nows accepts things like:
            grid-template: 100px / "a" [bottom];

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
        (WebCore::CSSParser::parseGridTemplateShorthand):

2016-02-23  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        [SVG] Update SVG source to return string literals as ASCIILiteral and add test cases for case sensitivity
        https://bugs.webkit.org/show_bug.cgi?id=154373

        Reviewed by Youenn Fablet.

        Update SVGAnimatedEnumeration toString method to return ASCIILiteral for string literals and add test cases for
        case-sensitivity for these elements.

        Test: svg/dom/SVGAnimatedEnumeration-case-sensitive.html

        * svg/SVGComponentTransferFunctionElement.h:
        (WebCore::SVGPropertyTraits<ComponentTransferType>::toString):
        * svg/SVGFEBlendElement.h:
        (WebCore::SVGPropertyTraits<BlendMode>::toString):
        * svg/SVGFEColorMatrixElement.h:
        (WebCore::SVGPropertyTraits<ColorMatrixType>::toString):
        * svg/SVGFECompositeElement.h:
        (WebCore::SVGPropertyTraits<CompositeOperationType>::toString):
        * svg/SVGFEConvolveMatrixElement.h:
        (WebCore::SVGPropertyTraits<EdgeModeType>::toString):
        * svg/SVGFEDisplacementMapElement.h:
        (WebCore::SVGPropertyTraits<ChannelSelectorType>::toString):
        * svg/SVGFEMorphologyElement.h:
        (WebCore::SVGPropertyTraits<MorphologyOperatorType>::toString):
        * svg/SVGFETurbulenceElement.h:
        (WebCore::SVGPropertyTraits<SVGStitchOptions>::toString):
        (WebCore::SVGPropertyTraits<TurbulenceType>::toString):
        * svg/SVGGradientElement.h:
        (WebCore::SVGPropertyTraits<SVGSpreadMethodType>::toString):
        * svg/SVGMarkerElement.h:
        (WebCore::SVGPropertyTraits<SVGMarkerUnitsType>::toString):
        * svg/SVGTextContentElement.h:
        (WebCore::SVGPropertyTraits<SVGLengthAdjustType>::toString):
        * svg/SVGTextPathElement.h:
        (WebCore::SVGPropertyTraits<SVGTextPathMethodType>::toString):
        (WebCore::SVGPropertyTraits<SVGTextPathSpacingType>::toString):
        * svg/SVGUnitTypes.h:
        (WebCore::SVGPropertyTraits<SVGUnitTypes::SVGUnitType>::toString):

2016-02-23  Csaba Osztrogonác  <ossy@webkit.org>

        [Mac][cmake] Unreviewed speculative buildfix after r196779. Just for fun.

        * PlatformMac.cmake:

2016-02-23  Antti Koivisto  <antti@apple.com>

        Remove tab suspension code
        https://bugs.webkit.org/show_bug.cgi?id=154585

        Reviewed by Andreas Kling.

        It causes too many problems.

        * page/Page.cpp:
        (WebCore::networkStateChanged):
        (WebCore::Page::Page):
        (WebCore::Page::setPageActivityState):
        (WebCore::Page::setIsVisible):
        (WebCore::Page::setIsVisibleInternal):
        (WebCore::Page::setIsPrerender):
        (WebCore::Page::setResourceUsageOverlayVisible):
        (WebCore::Page::canTabSuspend): Deleted.
        (WebCore::Page::setIsTabSuspended): Deleted.
        (WebCore::Page::setTabSuspensionEnabled): Deleted.
        (WebCore::Page::updateTabSuspensionState): Deleted.
        (WebCore::Page::tabSuspensionTimerFired): Deleted.
        * page/Page.h:
        (WebCore::Page::setEditable):
        (WebCore::Page::isEditable):
        (WebCore::Page::setShowAllPlugins):

2016-02-23  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Refactor DOM Iterator next signature
        https://bugs.webkit.org/show_bug.cgi?id=154531

        Reviewed by Myles C. Maxfield.

        Covered by existing tests.

        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next): Using Optional<KeyValuePair> to return iterator value.
        * Modules/fetch/FetchHeaders.h:
        * bindings/js/JSKeyValueIterator.h: Using Optional<KeyValuePair> as returned iterator value.
        (WebCore::keyValueIteratorForEach):
        (WebCore::JSKeyValueIterator<JSWrapper>::next):
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::Iterator::next): Using Optional<KeyValuePair> to return iterator value.
        * css/FontFaceSet.h:

2016-02-22  Gavin Barraclough  <barraclough@apple.com>

        Some timer alignment cleanup.
        https://bugs.webkit.org/show_bug.cgi?id=154559

        Reviewed by Chris Dumez.

        Document shouldn't override Page's timer alignment policy with a lower alignment,
        and m_domTimerAlignmentInterval isn't really a Settings, it's just the current state
        for the page.

        * dom/Document.cpp:
        (WebCore::Document::timerAlignmentInterval):
            - take the max of the possible intervals.
        * page/Page.cpp:
        (WebCore::Page::Page):
        (WebCore::Page::setTimerThrottlingEnabled):
        (WebCore::Page::setDOMTimerAlignmentInterval):
            - moved here from Settings.
        * page/Page.h:
        (WebCore::Page::domTimerAlignmentInterval):
            - moved here from Settings.
        * page/Settings.cpp:
        (WebCore::Settings::setDOMTimerAlignmentInterval): Deleted.
            - moved to Page.
        * page/Settings.h:
        (WebCore::Settings::domTimerAlignmentInterval): Deleted.
            - moved to Page.

2016-02-22  Myles C. Maxfield  <mmaxfield@apple.com>

        Font features specified in @font-face blocks don't apply to local() families
        https://bugs.webkit.org/show_bug.cgi?id=154554

        Reviewed by Dean Jackson.

        The correct variables just need to be wired up. In addition, our caches need to be sensitive
        to the new data.

        Test: css3/font-feature-font-face-local.html

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        * platform/graphics/FontCache.cpp:
        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
        (WebCore::FontPlatformDataCacheKey::operator==):
        (WebCore::FontPlatformDataCacheKeyHash::hash):
        (WebCore::FontCache::getCachedFontPlatformData):
        (WebCore::FontCache::fontForFamily):
        * platform/graphics/FontCache.h:
        * platform/graphics/FontFeatureSettings.h:
        (WebCore::FontFeature::operator!=):
        (WebCore::FontFeatureSettings::operator!=):
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::fontWithFamily):
        (WebCore::FontCache::createFontPlatformData):
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::FontCache::lastResortFallbackFont):
        * platform/text/TextFlags.h:
        (WebCore::FontVariantSettings::operator==):
        (WebCore::FontVariantSettings::operator!=):
        (WebCore::FontVariantSettings::uniqueValue):

2016-02-22  Daniel Bates  <dabates@apple.com>

        REGRESSION (r196892): Crash in DocumentLoader::startLoadingMainResource()
        https://bugs.webkit.org/show_bug.cgi?id=154563
        <rdar://problem/24780678>

        Reviewed by Alexey Proskuryakov.

        Fixes an issue where the provisional loader may be deallocated when starting
        a load. One example where this can occur is when cancelling the provisional load
        as part of a form submission because the Content Security Policy of the page
        blocks the submission (it violates the directive form-action).

        This crash is covered by the test http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): Take a ref before calling
        DocumentLoader::willSendRequest().

2016-02-16  Ada Chan  <adachan@apple.com>

        Implement basic functionality in WebVideoFullscreenInterfaceMac.
        https://bugs.webkit.org/show_bug.cgi?id=153241

        Reviewed by Beth Dakin.

        * platform/cocoa/WebVideoFullscreenInterface.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.h:
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::enterFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::exitFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::cleanupFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::invalidate):
        (WebCore::WebVideoFullscreenInterfaceMac::preparedToReturnToInline):

2016-02-22  Chris Dumez  <cdumez@apple.com>

        REGRESSION (r196563): Images not loading on https://klim.co.nz/blog/paypal-sans-design-information/
        https://bugs.webkit.org/show_bug.cgi?id=154547
        <rdar://problem/24772167>

        Reviewed by Gavin Barraclough.

        The Website was doing the following:
        $ var e = window.addEventListener;
        $ e("eventname", handler)

        In such case, the jsEventTargetPrototypeFunctionDispatchEvent() bindings
        implementation was caused with a thisValue which is a JSLexicalEnvironment
        and the implementation did not know how to convert it into a global object.
        The previous implementation on JSDOMWindow used to handle tis correctly
        because it was always calling JSValue::toThis() on the thisValue before
        trying to cast it to a JSDOMWindow, and JSLexicalEnvironment::toThis()
        gets the globalThisValue. This patch updates the EventTarget bindings
        code to call always call toThis() on the thisValue before trying to
        cast it. This should correctly deal with JSLexicalEnvironment and be a
        no-op in usual cases.

        No new tests, extended existing test.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateFunctionCastedThis):

2016-02-22  Simon Fraser  <simon.fraser@apple.com>

        Repeated background images have the wrong position when using bottom/right-relative background-position
        https://bugs.webkit.org/show_bug.cgi?id=154478

        Reviewed by Dave Hyatt.

        Fix RenderBoxModelObject::calculateBackgroundImageGeometry() to use the right position when
        painting repeated background images when right/bottom edges are used.

        Also rename BackgroundEdgeOrigin to Edge

        Test: fast/images/background-position.html

        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator Edge):
        (WebCore::CSSPrimitiveValue::operator BackgroundEdgeOrigin): Deleted.
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::resolveEdgeRelativeLength):
        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
        * rendering/style/FillLayer.cpp:
        (WebCore::FillLayer::FillLayer):
        * rendering/style/FillLayer.h:
        (WebCore::FillLayer::backgroundXOrigin):
        (WebCore::FillLayer::backgroundYOrigin):
        (WebCore::FillLayer::setBackgroundXOrigin):
        (WebCore::FillLayer::setBackgroundYOrigin):
        * rendering/style/RenderStyleConstants.cpp:
        (WebCore::operator<<):
        * rendering/style/RenderStyleConstants.h:

2016-02-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196935.
        https://bugs.webkit.org/show_bug.cgi?id=154557

        This change causes timeouts and crashes in LayoutTests
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Enable AVFoundationNSURLSessionEnabled by default"
        https://bugs.webkit.org/show_bug.cgi?id=154469
        http://trac.webkit.org/changeset/196935

2016-02-22  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Split CSSFontSelector into a FontFaceSet implementation and the rest of the class
        https://bugs.webkit.org/show_bug.cgi?id=153347

        Reviewed by Antti Koivisto.

        This patch implements the document.fonts Javascript object. It does so by briding the
        already-existing FontFaceSet Javascript object with the CSSFontSelector WebCore object.
        CSSFontSelector used to hold internal objects for each @font-face object in the
        Document. These objects have been moved into CSSFontFaceSet, so CSSFontSelector simply
        just owns an instance of a CSSFontFaceSet.

        The lifetime of the FontFace and FontFaceSet objects is a little interesting: because
        all the ownership references are inside the WebCore CSSFontFace{,Set} objects, the
        higher-level Javascript FontFace{,Set} objects are held through a WeakPtr. This means
        that if all the references to these higher-level objects go away, and you re-query the
        document for its FontFace objects, you may get a new object (albeit with the same
        state as a previous object). However, this won't occur if there are any references to
        the old object, which means it is almost not observable.

        This patch doesn't implement the relationship between the CSSOM and the FontFace
        objects. Changing one should result in a change in the other, but that will be
        implemented in a forthcoming patch.

        This patch also doesn't alter the lifetime of the CSSFontSelector, which means that all
        the Document's fonts may be destroyed and recreated from CSS. There are a few things
        which can trigger this. A subsequent patch will make the CSSFontSelector outlive the
        Document.

        This patch does implement (and test) the ability to add a new FontFace to the Document
        to cause a relayout, as well as changing properties of existing FontFace objects already
        in the Document to cause a relayout.

        Test: fast/text/font-face-set-document.html

        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next): Pass an extra argument.
        * Modules/fetch/FetchHeaders.h:
        * bindings/js/JSKeyValueIterator.h: The ExecState is necessary to build an external
        wrapper from an existing CSSFontFace object.
        (WebCore::JSKeyValueIterator<JSWrapper>::next):
        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::appendSources): Moved from CSSFontSelector.
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::notifyClientsOfFontPropertyChange):
        (WebCore::CSSFontFace::setFamilies):
        (WebCore::CSSFontFace::calculateStyle): Shared code between CSSFontFaceSet and
        CSSFontFace.
        (WebCore::CSSFontFace::setStyle): Update to use calculateStyle().
        (WebCore::CSSFontFace::calculateWeight): Ditto.
        (WebCore::CSSFontFace::setWeight): Update to use caculateWeight().
        (WebCore::CSSFontFace::setUnicodeRange): Notify clients.
        (WebCore::CSSFontFace::setVariantLigatures): Ditto.
        (WebCore::CSSFontFace::setVariantPosition): Ditto.
        (WebCore::CSSFontFace::setVariantCaps): Ditto.
        (WebCore::CSSFontFace::setVariantNumeric): Ditto.
        (WebCore::CSSFontFace::setVariantAlternates): Ditto.
        (WebCore::CSSFontFace::setVariantEastAsian): Ditto.
        (WebCore::CSSFontFace::setFeatureSettings): Ditto.
        (WebCore::CSSFontFace::removeClient):
        (WebCore::CSSFontFace::wrapper): Build a new wrapper if one doesn't already
        exist. Note that this requires an ExecState to create a promise.
        (WebCore::CSSFontFace::setStatus):
        (WebCore::CSSFontFace::fontLoaded):
        (WebCore::CSSFontFace::pump):
        (WebCore::CSSFontFace::font):
        * css/CSSFontFace.h:
        * css/CSSFontFaceSet.cpp:
        (WebCore::CSSFontFaceSet::CSSFontFaceSet): Moved code from CSSFontSelector.
        (WebCore::CSSFontFaceSet::~CSSFontFaceSet):
        (WebCore::CSSFontFaceSet::addClient): This object can now have multiple
        clients.
        (WebCore::CSSFontFaceSet::removeClient):
        (WebCore::CSSFontFaceSet::incrementActiveCount): Update for multiple clients.
        (WebCore::CSSFontFaceSet::decrementActiveCount): Ditto.
        (WebCore::CSSFontFaceSet::hasFace):
        (WebCore::CSSFontFaceSet::registerLocalFontFacesForFamily): Moved from
        CSSFontSelector.
        (WebCore::CSSFontFaceSet::familyNameFromPrimitive): Ditto.
        (WebCore::CSSFontFaceSet::addToFacesLookupTable): This helper function can
        be used when a property of a FontFace is changed.
        (WebCore::CSSFontFaceSet::add): Update to use addToFacesLookupTable().
        (WebCore::CSSFontFaceSet::removeFromFacesLookupTable): Same as
        addToFacesLookupTable().
        (WebCore::CSSFontFaceSet::remove): Update to use removeFromFacesLookupTable().
        (WebCore::CSSFontFaceSet::clear):
        (WebCore::CSSFontFaceSet::operator[]):
        (WebCore::computeFontTraitsMask): Moved from CSSFontSelector.
        (WebCore::CSSFontFaceSet::matchingFaces): Update to use new data structures.
        (WebCore::FontFaceComparator::FontFaceComparator): Moved from
        CSSFontSelector.
        (WebCore::FontFaceComparator::operator()):
        (WebCore::CSSFontFaceSet::getFontFace): Update to use new data structures.
        (WebCore::CSSFontFaceSet::fontStateChanged): Update to use multiple clients.
        (WebCore::CSSFontFaceSet::fontPropertyChanged): We must update our internal
        data structure if the family name changed.
        (WebCore::extractFamilies): Deleted.
        (WebCore::familiesIntersect): Deleted.
        (WebCore::CSSFontFaceSet::load): Deleted.
        (WebCore::CSSFontFaceSet::stateChanged): Deleted.
        * css/CSSFontFaceSet.h: Now needs to be RefCounted. New data structures are
        taken from CSSFontSelector.
        (WebCore::CSSFontFaceSetClient::faceFinished):
        (WebCore::CSSFontFaceSetClient::fontModified):
        (WebCore::CSSFontFaceSetClient::startedLoading):
        (WebCore::CSSFontFaceSetClient::completedLoading):
        * css/CSSFontFaceSource.h:
        * css/CSSFontSelector.cpp: Move code into CSSFontFaceSet.
        (WebCore::CSSFontSelector::CSSFontSelector):
        (WebCore::CSSFontSelector::~CSSFontSelector):
        (WebCore::CSSFontSelector::fontFaceSet):
        (WebCore::CSSFontSelector::isEmpty):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::CSSFontSelector::fontModified):
        (WebCore::CSSFontSelector::fontRangesForFamily):
        (WebCore::CSSFontSelector::clearDocument):
        (WebCore::CSSFontSelector::appendSources): Deleted.
        (WebCore::CSSFontSelector::familyNameFromPrimitive): Deleted.
        (WebCore::CSSFontSelector::registerLocalFontFacesForFamily): Deleted.
        (WebCore::FontFaceComparator::FontFaceComparator): Deleted.
        (WebCore::FontFaceComparator::operator()): Deleted.
        (WebCore::CSSFontSelector::getFontFace): Deleted.
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::CSSSegmentedFontFace):
        * css/CSSSegmentedFontFace.h:
        * css/FontFace.cpp:
        (WebCore::FontFace::create):
        (WebCore::FontFace::FontFace):
        (WebCore::FontFace::createWeakPtr):
        (WebCore::FontFace::fontStateChanged):
        (WebCore::FontFace::stateChanged): Deleted.
        * css/FontFace.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::create):
        (WebCore::FontFaceSet::FontFaceSet):
        (WebCore::FontFaceSet::~FontFaceSet):
        (WebCore::FontFaceSet::Iterator::next):
        (WebCore::FontFaceSet::has):
        (WebCore::FontFaceSet::size):
        (WebCore::FontFaceSet::add):
        (WebCore::FontFaceSet::remove):
        (WebCore::FontFaceSet::clear):
        (WebCore::FontFaceSet::load):
        (WebCore::FontFaceSet::check):
        (WebCore::FontFaceSet::status):
        (WebCore::FontFaceSet::canSuspendForDocumentSuspension):
        (WebCore::FontFaceSet::faceFinished):
        * css/FontFaceSet.h:
        * css/FontFaceSet.idl:
        * dom/Document.cpp:
        (WebCore::Document::fonts):
        * dom/Document.h:
        * dom/Document.idl:
        * svg/SVGFontFaceElement.h:

2016-02-22  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Moved library setup code to WEBKIT_FRAMEWORK macro.
        https://bugs.webkit.org/show_bug.cgi?id=154450

        Reviewed by Alex Christensen.

        No new tests needed.

        * CMakeLists.txt:

2016-02-22  Konstantin Tokarev  <annulen@yandex.ru>

        Workaround for ICE in GCC 4.8 appeared in r196846.
        https://bugs.webkit.org/show_bug.cgi?id=154535

        Reviewed by Chris Dumez.

        No new tests needed.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::autocomplete):

2016-02-22  Jer Noble  <jer.noble@apple.com>

        Enable AVFoundationNSURLSessionEnabled by default
        https://bugs.webkit.org/show_bug.cgi?id=154469

        Reviewed by Sam Weinig.

        * page/Settings.cpp:

2016-02-22  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Swap columns and rows in grid-template shorthand
        https://bugs.webkit.org/show_bug.cgi?id=154472

        Reviewed by Darin Adler.

        The spec was modified past December to change the order of
        columns and rows in the grid-template shorthand:
        https://github.com/w3c/csswg-drafts/commit/f6c7691679a519017a80ebae44fd86c3eae5c5f9

        Updated the parsing and modified the tests to follow the new syntax.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateColumns):
        (WebCore::CSSParser::parseGridTemplateRowsAndAreasAndColumns):
        (WebCore::CSSParser::parseGridTemplateShorthand):
        (WebCore::CSSParser::parseGridTemplateRowsAndAreas): Renamed to
        parseGridTemplateRowsAndAreasAndColumns().
        * css/CSSParser.h:

2016-02-22  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Swap columns and rows in grid shorthand
        https://bugs.webkit.org/show_bug.cgi?id=154449

        Reviewed by Darin Adler.

        The spec was modified past December to change the order of
        columns and rows in the grid shorthand:
        https://github.com/w3c/csswg-drafts/commit/7454c7c8c5857b61bbbe2ee5f07803c264bf37e4

        Updated the parsing and modified the tests to follow the new syntax.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridShorthand):

2016-02-22  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Binding generator should support key value iterable
        https://bugs.webkit.org/show_bug.cgi?id=154413

        Reviewed by Darin Adler.

        Covered by added layout and binding tests.

        iterable<key, value> in a IDL file will trigger the generation of entries, keys, values, [Symbol.iterator] and forEach methods to the prototype.
        Updated FetchHeaders and FontFaceSet to use it.

        IDLParser.pm parses the iterable<> and adds an iterable field in the interface containing the iterable information and objects for the five operations.
        IDLParser.pm is cleaned up a bit to remove previous Iterator support, which does not seem to be supported.

        CodeGeneratorJS.pm is updated to generate the code for the five operations, using JSKeyValueIterator. Set iterators are not yet supported.
        Moved definition of Iterator Key and Value Type to binding generated JSXX class based on iterable<> declaration in the IDL.

        Added binding test and Fetch Headers tests.

        * CMakeLists.txt:
        * Modules/fetch/FetchHeaders.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSFetchHeadersCustom.cpp: Removed.
        * bindings/js/JSFontFaceSetCustom.cpp:
        (WebCore::JSFontFaceSet::ready): Removed iterable custom methods.
        * bindings/js/JSKeyValueIterator.h:
        (WebCore::createKeyValueIterator):
        (WebCore::keyValueIteratorForEach):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GetFunctionName):
        (PrototypeFunctionCount):
        (PrototypePropertyCount):
        (GeneratePropertiesHashTable):
        (GenerateImplementation):
        (GenerateImplementationFunctionCall):
        (GenerateImplementationIterableFunctions):
        * bindings/scripts/IDLParser.pm:
        (parseOperationOrIterator):
        (parseOperationOrIteratorRest):
        (parseIterableRest):
        (parseOptionalIterableInterface):
        (applyMemberList):
        (parseSpecial): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::JSTestObjPrototype::finishCreation):
        (WebCore::jsTestObjPrototypeFunctionSymbolIterator):
        (WebCore::jsTestObjPrototypeFunctionEntries):
        (WebCore::jsTestObjPrototypeFunctionKeys):
        (WebCore::jsTestObjPrototypeFunctionValues):
        (WebCore::jsTestObjPrototypeFunctionForEach):
        * bindings/scripts/test/TestObj.idl:
        * css/FontFaceSet.idl:

2016-02-21  Chris Dumez  <cdumez@apple.com>

        HTMLScriptElement.crossOrigin / HTMLImageElement.crossOrigin should only return known values
        https://bugs.webkit.org/show_bug.cgi?id=154502

        Reviewed by Darin Adler.

        HTMLScriptElement.crossOrigin / HTMLImageElement.crossOrigin should only
        return known values and should be nullable as per the specification:
        - https://html.spec.whatwg.org/multipage/scripting.html#attr-script-crossorigin
        - https://html.spec.whatwg.org/multipage/embedded-content.html#attr-img-crossorigin
        - https://html.spec.whatwg.org/multipage/infrastructure.html#cors-settings-attribute

        This aligns our behavior with the HTML specification and Firefox.

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        Add support for nullable DOMString attributes. If such attribute is
        marked as nullable:
        - A null string is passed to the implementation if the setter is called
          with null/undefined.
        - null is returned to the Javascript if the getter implementation
          returns a null string.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl:
        Add test coverage for nullable DOMString attributes
        and rebaseline bindings tests.

        * html/HTMLImageElement.cpp:
        * html/HTMLImageElement.h:
        * html/HTMLImageElement.idl:
        * html/HTMLScriptElement.cpp:
        * html/HTMLScriptElement.h:
        * html/HTMLScriptElement.idl:
        * html/parser/HTMLParserIdioms.cpp:
        * html/parser/HTMLParserIdioms.h:

2016-02-21  Chris Dumez  <cdumez@apple.com>

        Make HTMLSelectElement.size behave as per the specification
        https://bugs.webkit.org/show_bug.cgi?id=154504

        Reviewed by Darin Adler.

        Make HTMLSelectElement.size behave as per the specification:
        - https://html.spec.whatwg.org/#htmlselectelement
        - https://html.spec.whatwg.org/#dom-select-size
        - https://html.spec.whatwg.org/#reflecting-content-attributes-in-idl-attributes:idl-unsigned-long

        In particular, it should be unsigned and be in the range [0; 2147483647].

        Also update several unsigned long attributes in our HTML implementation to use
        parseHTMLNonNegativeInteger() to parse unsigned integers as per the HTML
        specification, instead of calling String::toUint().

        No new tests, already covered by existing tests.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseAttribute):
        (WebCore::HTMLInputElement::size):
        (WebCore::HTMLInputElement::setSize):
        * html/HTMLInputElement.h:
        * html/HTMLSelectElement.cpp:
        (WebCore::HTMLSelectElement::parseAttribute):
        (WebCore::HTMLSelectElement::setSize):
        (WebCore::HTMLSelectElement::namedItem): Deleted.
        (WebCore::HTMLSelectElement::item): Deleted.
        * html/HTMLSelectElement.h:
        (WebCore::HTMLSelectElement::size):
        * html/HTMLSelectElement.idl:
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):
        (WebCore::HTMLTableColElement::setSpan):
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::parseAttribute):
        (WebCore::HTMLTextAreaElement::setCols):
        (WebCore::HTMLTextAreaElement::setRows):
        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyHTMLNonNegativeNumbersGreaterThanZero):
        (WebCore::limitToOnlyHTMLNonNegative):

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: Enable form-action directive by default
        https://bugs.webkit.org/show_bug.cgi?id=154520
        <rdar://problem/24762029>

        Reviewed by Sam Weinig.

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Move logic to parse the form-action
        directive outside the ENABLE(CSP_NEXT) macro guarded section/experimental feature runtime flag.
        (WebCore::isExperimentalDirectiveName): Remove form-action from the directives considered
        experimental.

2016-02-21  Chris Dumez  <cdumez@apple.com>

        Add username / password attributes to HTMLAnchorElement / HTMLAreaElement
        https://bugs.webkit.org/show_bug.cgi?id=154519

        Reviewed by Sam Weinig.

        Add username / password attributes to HTMLAnchorElement / HTMLAreaElement as per:
        https://html.spec.whatwg.org/#htmlhyperlinkelementutils

        Firefox and Chrome already implement these.

        Also stop treating null as the empty string for the HTMLHyperlinkElementUtils
        attributes. This behavior does not match the specification or other browsers
        (tested Firefox and Chrome).

        Test: fast/dom/HTMLAnchorElement/set-href-attribute-user-pass.html

        * CMakeLists.txt:
        * DerivedSources.make:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::username):
        (WebCore::HTMLAnchorElement::setUsername):
        (WebCore::HTMLAnchorElement::password):
        (WebCore::HTMLAnchorElement::setPassword):
        * html/HTMLAnchorElement.h:
        * html/HTMLAnchorElement.idl:
        * html/HTMLAreaElement.idl:
        * html/HTMLHyperlinkElementUtils.idl: Added.

2016-02-21  Chris Dumez  <cdumez@apple.com>

        iframe/frame/object.contentDocument should be on the prototype
        https://bugs.webkit.org/show_bug.cgi?id=154409

        Reviewed by Sam Weinig.

        Move iframe/frame/object.contentDocument to the prototype. They used
        to be on the instance due to the [CheckSecurityForNode] IDL extended
        attribute. This patch updates the bindings generator so that such
        attributes are now on the prototype. While they are now on the
        prototype, the security checks are still generated in the
        corresponding getters and setters so cross origin access is still
        prevented.

        Test: http/tests/security/cross-origin-iframe-contentDocument.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (AttributeShouldBeOnInstance): Deleted.

2016-02-21  Darin Adler  <darin@apple.com>

        Refactor LazyEventListener creation to separate Element and Document cases
        https://bugs.webkit.org/show_bug.cgi?id=154231

        Reviewed by Andreas Kling.

        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::create): Added. Newly factored to separate
        Element, Document, and DOMWindow with overloading.
        (WebCore::JSLazyEventListener::createForNode): Deleted.
        (WebCore::JSLazyEventListener::createForDOMWindow): Deleted.

        * bindings/js/JSLazyEventListener.h: Replaced the separate createForNode
        and createForDOMWindow functions with a single overloaded function create,
        which takes an Element, Document, or DOMWindow. Also changed indentation
        to match the style guide.

        * dom/Attr.h: Added newly needed forward class declaration.

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::setAttributeEventListener): Deleted.
        * dom/ContainerNode.h: Deleted setAttributeEventListener override; it's now
        done separately by Element and Document.

        * dom/Document.cpp:
        (WebCore::Document::setAttributeEventListener): Added. Makes the lazy event
        listener and calls through to the base class's setAttributeEventListener.
        (WebCore::Document::setWindowAttributeEventListener): Updated to call just
        create instead of createForDOMWindow.

        * dom/Document.h: Removed some unneeded forward declarations. Added the
        overload for setAttributeEventListener. Removed a no longer useful comment.

        * dom/Element.cpp:
        (WebCore::Element::setAttributeEventListener): Added. Makes the lazy event
        listener and calls through to the base class's setAttributeEventListener.

        * dom/Element.h: Removed some unneeded forward declarations. Added the
        overload for setAttributeEventListener.

        * dom/Node.h: Removed many unneeded forward declarations.

        * dom/NodeRareData.h: Added one forward declaration.

        * editing/Editor.h: Added one forward declaration.

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: Violation report should include column number
        https://bugs.webkit.org/show_bug.cgi?id=154418
        <rdar://problem/24729525>

        Reviewed by Brent Fulgham.

        Include column-number in the Content Security Policy violation report for the column number
        in the source script where the violation occurred (for a script violation) as per section
        Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        When a CSP report is created for a script violation the source file and line number of the
        source code line where the violation occurred are included in the report. We now include
        the column number in the source file where the violation occurred so as to help narrow
        down the operation that triggered the violation in a complicated source code line.

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation):

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: Violation report should include HTTP status code and effective-directive of protected resource
        https://bugs.webkit.org/show_bug.cgi?id=154288
        <rdar://problem/24674982>
        And
        https://bugs.webkit.org/show_bug.cgi?id=115707
        <rdar://problem/24383128>

        Reviewed by Brent Fulgham.

        Include status-code and effective-directive in the Content Security Policy violation report for
        the HTTP status code of the protected resource and name of the policy directive that was violated,
        respectively, as per section Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Test: http/tests/security/contentSecurityPolicy/report-status-code-zero-when-using-https.html

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation): Add key status-code to the report with value
        equal to the HTTP response code for the document or 0 depending on whether the document was
        delivered over HTTP or not. Additionally, remove ENABLE(CSP_NEXT)-guard/experimentalFeaturesEnabled()-condition
        around code to include the effective-directive property in the report.

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: report-url directive should be ignored when contained in a policy defined via a meta element
        https://bugs.webkit.org/show_bug.cgi?id=154307
        <rdar://problem/24684817>

        Reviewed by Brent Fulgham.

        The Content Security Policy report-uri directive should only be honored when defined via an HTTP header
        as per section report-uri of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Currently we honor the report-uri directive when enforcing or monitoring a policy defined either via
        an HTML meta element or an HTTP header. Instead we should only honor this directive when defined
        via an HTTP header and log a message to the Web Inspector console to explain that the directive
        was ignored as suggested in <https://www.w3.org/TR/2015/CR-CSP2-20150721/#delivery-html-meta-element>.

        Test: http/tests/security/contentSecurityPolicy/report-uri-in-meta-tag-ignored.html

        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::parse): Modified to ignore the directive report-uri when
        the Content Security Policy came from an HTML meta element.

2016-02-21  Daniel Bates  <dabates@apple.com>

        CSP: sandbox directive should be ignored when contained in a policy defined via a meta element
        https://bugs.webkit.org/show_bug.cgi?id=154299
        <rdar://problem/24680433>

        Reviewed by Brent Fulgham.

        The Content Security Policy sandbox directive should only be honored when enforcing a policy
        defined via an HTTP header as per section sandbox of the Content Security Policy 2.0 spec.,
        <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Currently we honor the sandbox directive when enforcing a policy defined either via an HTML
        meta element or an HTTP header. Instead we should only honor this directive when defined
        via an HTTP header and log a message to the Web Inspector console to explain that the directive
        was ignored as suggested in <https://www.w3.org/TR/2015/CR-CSP2-20150721/#delivery-html-meta-element>.

        Tests: http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header2.php
               http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header-inherited-by-subframe.php
               http/tests/security/contentSecurityPolicy/sandbox-empty-in-http-header.php
               http/tests/security/contentSecurityPolicy/sandbox-in-meta-tag-ignored.html

        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv): Substitute ContentSecurityPolicy::processHTTPEquiv() for
        ContentSecurityPolicy::didReceiveHeader() as the latter was made private.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::copyStateFrom): Updated as needed based on ContentSecurityPolicy::didReceiveHeader() change below.
        (WebCore::ContentSecurityPolicy::didReceiveHeaders): Ditto.
        (WebCore::ContentSecurityPolicy::didReceiveHeader): Modified to take argument of type ContentSecurityPolicy::PolicyFrom
        and pass it through to ContentSecurityPolicyDirectiveList::create().
        (WebCore::ContentSecurityPolicy::reportInvalidDirectiveInHTTPEquivMeta): Logs a message to the Web Inspector console
        that the specified directive was ignored because it was delivered via an HTML meta element.
        * page/csp/ContentSecurityPolicy.h: Made member function ContentSecurityPolicy::didReceiveHeader() private. Defined
        enum class PolicyFrom to represent the source of the Content Security Policy: HTTP equiv meta element, HTTP header, or
        inherited from another ContentSecurityPolicy object (this value is only used by ContentSecurityPolicy::copyStateFrom()).
        (WebCore::ContentSecurityPolicy::processHTTPEquiv): Added; turns around and calls ContentSecurityPolicy::didReceiveHeader().
        The name of this function better describes its purpose - to handle the processing of a Content Security Policy
        delivered via <meta http-equiv="Content-Security-Policy" content="...">.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::create): Modified to take argument of type ContentSecurityPolicy::PolicyFrom
        as pass it through to ContentSecurityPolicyDirectiveList::parse().
        (WebCore::ContentSecurityPolicyDirectiveList::parse): Modified to ignore the directive sandbox when the Content Security
        Policy came from an HTML meta element.
        * page/csp/ContentSecurityPolicyDirectiveList.h:

2016-02-21  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196866.
        https://bugs.webkit.org/show_bug.cgi?id=154515

        still crashy on EFL/GTK (Requested by smfr on #webkit).

        Reverted changeset:

        "Wheel event callback removing the window causes crash in
        WebCore."
        https://bugs.webkit.org/show_bug.cgi?id=150871
        http://trac.webkit.org/changeset/196866

2016-02-20  Simon Fraser  <simon.fraser@apple.com>

        Wheel event callback removing the window causes crash in WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=150871

        Reviewed by Brent Fulgham.

        Null check the FrameView before using it, since the iframe may have been removed
        from its parent document inside the event handler.

        The new test triggered a cross-load side-effect, where wheel event filtering wasn't
        reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
        which resets the filtering.

        Test: fast/events/wheel-event-destroys-frame.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        (WebCore::EventHandler::clearLatchedState):
        * page/Frame.cpp:
        (WebCore::Frame::setView): If the view doesn't change (e.g. was and is null)
        don't bother clearing the event handler; should avoid EventHandler::clearLatchedState()
        from accessing a deleted MainFrame.
        * page/WheelEventDeltaFilter.cpp:
        (WebCore::WheelEventDeltaFilter::filteredDelta):
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformCompleteWheelEvent):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):

2016-02-20  Antti Koivisto  <antti@apple.com>

        Resolve style iteratively
        https://bugs.webkit.org/show_bug.cgi?id=154355

        Reviewed by Andreas Kling.

        Instead of a set of recursive functions use ComposedTreeIterator for traversing the DOM
        tree in composed tree order.

        This, along with maintaining explicit parent stack makes style resolve code more tractable
        for future work.

        It also makes the ComposedTreeIterator the definite authority for the shape of the composed tree
        instead of duplicating it as a set of recursive style resolve functions. This eliminates
        a significant source of bugs and confusion.

        The render tree building code path remains recursive for now.

        * css/StyleInvalidationAnalysis.cpp:
        (WebCore::StyleInvalidationAnalysis::invalidateIfNeeded):

            Invalidate the host element instead of the shadow root. This reduces need for special handling for shadow roots.

        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::initializeContextStack):
        (WebCore::ComposedTreeIterator::dropAssertions):

            Add support for dropping DOM mutation assertions.

        (WebCore::ComposedTreeIterator::traverseShadowRoot):
        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::context):
        (WebCore::ComposedTreeIterator::current):
        * dom/PseudoElement.h:
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::TreeResolver::TreeResolver):
        (WebCore::Style::TreeResolver::Scope::Scope):
        (WebCore::Style::TreeResolver::Parent::Parent):
        (WebCore::Style::TreeResolver::pushScope):
        (WebCore::Style::resetStyleForNonRenderedDescendants):
        (WebCore::Style::pseudoStyleCacheIsInvalid):
        (WebCore::Style::TreeResolver::resolveElement):
        (WebCore::Style::resolveTextNode):
        (WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement):
        (WebCore::Style::TreeResolver::pushParent):
        (WebCore::Style::TreeResolver::popParent):
        (WebCore::Style::TreeResolver::popParentsToDepth):

            Maintain explicit parent stack.

        (WebCore::Style::TreeResolver::resolveComposedTree):

            The main loop that iterates over the composed tree and computes style for dirty elements.

        (WebCore::Style::TreeResolver::resolve):
        (WebCore::Style::detachRenderTree):
        (WebCore::Style::TreeResolver::resolveLocally): Deleted.
        (WebCore::Style::TreeResolver::resolveChildAtShadowBoundary): Deleted.
        (WebCore::Style::TreeResolver::resolveShadowTree): Deleted.
        (WebCore::Style::TreeResolver::resolveChildren): Deleted.
        (WebCore::Style::TreeResolver::resolveSlotAssignees): Deleted.
        (WebCore::Style::TreeResolver::resolveRecursively): Deleted.

            Recursive functions go away.

        * style/StyleTreeResolver.h:
        (WebCore::Style::TreeResolver::scope):
        (WebCore::Style::TreeResolver::parent):

2016-02-20  Andreas Kling  <akling@apple.com>

        REGRESSION(r196780): Fake memory handler takes too long to run now.

        Unreviewed bot fix.

        Put the footprint comparison code behind a compile-time flag for now.
        It's taking too long to run on bots, and memory is getting measured
        before all the pressure relief code has a chance to run.

        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::install):

2016-02-20  Olivier Blin  <olivier.blin@softathome.com>

        Do not require UDate in LocaleICU with !ENABLE_DATE_AND_TIME_INPUT_TYPES
        https://bugs.webkit.org/show_bug.cgi?id=154483

        Reviewed by Michael Catanzaro.

        Put initializeShortDateFormat(), dateFormat(), m_shortDateFormat and
        m_didCreateShortDateFormat under flag, since they are only used by
        code under the ENABLE_DATE_AND_TIME_INPUT_TYPES flag.

        This helps to build with a light ICU that does not provide UDate
        features (with UCONFIG_NO_FORMATTING).

        * platform/text/LocaleICU.cpp:
        (WebCore::LocaleICU::LocaleICU):
        (WebCore::LocaleICU::~LocaleICU):
        (WebCore::createFallbackMonthLabels): Deleted.
        (WebCore::createFallbackAMPMLabels): Deleted.
        * platform/text/LocaleICU.h:

2016-02-20  Olivier Blin  <olivier.blin@softathome.com>

        Remove declaration of unimplemented methods in LocaleICU
        https://bugs.webkit.org/show_bug.cgi?id=154482

        Reviewed by Michael Catanzaro.

        detectSignAndGetDigitRange() and matchedDecimalSymbolIndex() are
        implemented in PlatformLocale, not LocaleICU.

        They were moved out from LocaleICU to NumberLocalizer in r124459
        (2012), which has then been renamed as Localizer, then Locale, and
        finally PlatformLocale.

        * platform/text/LocaleICU.h:

2016-02-20  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196837.
        https://bugs.webkit.org/show_bug.cgi?id=154495

        It caused a lot of crashes in EFL and GTK bots (Requested by
        KaL on #webkit).

        Reverted changeset:

        "Wheel event callback removing the window causes crash in
        WebCore."
        https://bugs.webkit.org/show_bug.cgi?id=150871
        http://trac.webkit.org/changeset/196837

2016-02-19  Chris Dumez  <cdumez@apple.com>

        Land release assertions to help track down a possible HTMLCollection lifetime bug
        https://bugs.webkit.org/show_bug.cgi?id=154490

        Reviewed by Ryosuke Niwa.

        Land release assertions to help track down a possible HTMLCollection
        lifetime bug: <rdar://problem/24457478>.

        * bindings/js/JSHTMLCollectionCustom.cpp:
        (WebCore::JSHTMLCollection::getOwnPropertyNames):
        * html/HTMLCollection.cpp:
        (WebCore::HTMLCollection::HTMLCollection):
        (WebCore::HTMLCollection::~HTMLCollection):
        * html/HTMLCollection.h:
        (WebCore::HTMLCollection::wasDeletionStarted):
        * html/HTMLCollection.idl:

2016-02-19  Doug Russell  <d_russell@apple.com>

        Bug 154366 - AX: AXObjectCache::visiblePositionForTextMarkerData() doesn't account for equivalent visibly equivalent positions
        https://bugs.webkit.org/show_bug.cgi?id=154366

        Reviewed by Chris Fleizach.

        Test: accessibility/mac/text-marker-line-boundary.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):

2016-02-19  Simon Fraser  <simon.fraser@apple.com>

        Use more concrete types for parsing positions
        https://bugs.webkit.org/show_bug.cgi?id=154481

        Reviewed by Dean Jackson.

        Use CSSPrimitiveValues for position-parsing functions where possible, to avoid
        the need to downcast<> the values returned by the parsing functions.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parsePositionX):
        (WebCore::CSSParser::parsePositionY):
        (WebCore::CSSParser::parse4ValuesFillPosition):
        (WebCore::CSSParser::parse3ValuesFillPosition):
        (WebCore::CSSParser::parseFillPosition):
        (WebCore::CSSParser::parse2ValuesFillPosition):
        (WebCore::CSSParser::parseFillProperty):
        (WebCore::CSSParser::parseTransformOriginShorthand):
        (WebCore::CSSParser::parseBasicShapeCircle):
        (WebCore::CSSParser::parseBasicShapeEllipse):
        (WebCore::CSSParser::parseDeprecatedRadialGradient):
        (WebCore::CSSParser::parseRadialGradient):
        (WebCore::CSSParser::parseTransformOrigin):
        (WebCore::CSSParser::parsePerspectiveOrigin):
        * css/CSSParser.h:

2016-02-18  Gavin Barraclough  <barraclough@apple.com>

        JSObject::getPropertySlot - index-as-propertyname, override on prototype, & shadow
        https://bugs.webkit.org/show_bug.cgi?id=154416

        Reviewed by Geoff Garen.

        * testing/Internals.cpp:
        (WebCore::Internals::isReadableStreamDisturbed):
            - fastGetOwnPropertySlot -> getOwnPropertySlot
              (internal method removed; test shouldn't really have been using this anyway)

2016-02-19  Chris Dumez  <cdumez@apple.com>

        HTMLFormElement.autocomplete should only return known values
        https://bugs.webkit.org/show_bug.cgi?id=154247
        <rdar://problem/24658195>

        Reviewed by Ryosuke Niwa.

        Update HTMLFormElement.autocomplete to only return known values:
        - https://html.spec.whatwg.org/multipage/forms.html#dom-form-autocomplete
        - https://html.spec.whatwg.org/multipage/forms.html#attr-form-autocomplete

        Also, update HTMLInputElement.autocomplete to fall back to using the form
        owner's autocomplete attribute ("on" or "off") when it's autocomplete
        attribute is omitted and the input element is wearing the "autofill
        expectation mantle" (i.e. the input is not hidden). If there is no
        form owner, the "on" value is used instead. This behavior is specified
        in:
        https://html.spec.whatwg.org/multipage/forms.html#autofilling-form-controls:-the-autocomplete-attribute:attr-fe-autocomplete-7

        No new tests, already covered by existing tests.

        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::autocomplete):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::setAutocomplete):
        (WebCore::HTMLFormElement::autocomplete):
        * html/HTMLFormElement.h:
        * html/HTMLFormElement.idl:

2016-02-19  Chris Dumez  <cdumez@apple.com>

        Drop UnsafeVectorOverflow on ElementDescendantConstIterator::m_ancestorSiblingStack
        https://bugs.webkit.org/show_bug.cgi?id=154477

        Reviewed by Ryosuke Niwa.

        Drop UnsafeVectorOverflow on ElementDescendantConstIterator::m_ancestorSiblingStack to
        restore bounds checking.

        Andreas already dropped in on ElementDescendantIterator::m_ancestorSiblingStack in
        r178253 but did not update the "Const" counterpart.

        * dom/ElementDescendantIterator.h:

2016-02-19  Simon Fraser  <simon.fraser@apple.com>

        Wheel event callback removing the window causes crash in WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=150871

        Reviewed by Brent Fulgham.

        Null check the FrameView before using it, since the iframe may have been removed
        from its parent document inside the event handler.
        
        The new test triggered a cross-load side-effect, where wheel event filtering wasn't
        reset between page loads. Fix by calling clearLatchedState() in EventHandler::clear(),
        which resets the filtering.

        Test: fast/events/wheel-event-destroys-frame.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::clear):
        * page/WheelEventDeltaFilter.cpp:
        (WebCore::WheelEventDeltaFilter::filteredDelta):
        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformCompleteWheelEvent):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):

2016-02-19  Myles C. Maxfield  <mmaxfield@apple.com>

        [Win] [SVG -> OTF Converter] All uses of a font except the first one are invisible
        https://bugs.webkit.org/show_bug.cgi?id=154465

        Reviewed by Alex Christensen.

        We should re-use the existing converted data if it exists.

        Covered by existing tests.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):

2016-02-19  Antti Koivisto  <antti@apple.com>

        ComposedTreeIterator traverses normal children for elements with empty shadow root
        https://bugs.webkit.org/show_bug.cgi?id=154464

        Reviewed by Ryosuke Niwa.

        Test: fast/shadow-dom/composed-tree-basic.html

        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::initializeContextStack):
        (WebCore::ComposedTreeIterator::traverseShadowRoot):

            If the shadow root is empty continue by skipping the real children.

        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
        (WebCore::composedTreeAsText):
        (WebCore::ComposedTreeIterator::pushContext): Deleted.
        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::context):
        (WebCore::ComposedTreeIterator::current):
        (WebCore::ComposedTreeIterator::traverseNext):
        (WebCore::composedTreeChildren):
        * testing/Internals.cpp:
        (WebCore::Internals::composedTreeAsText):

            Testing support.

        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-19  Jer Noble  <jer.noble@apple.com>

        Adopt CachedRawResourceClient::shouldCacheResponse() in MediaResourceLoader and WebCoreNSURLSession
        https://bugs.webkit.org/show_bug.cgi?id=154466

        Reviewed by Alex Christensen.

        Adopt the new shouldCacheResponse() callback so that byte-range
        requests generated by WebCoreNSURLSession are not cached.

        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResource::shouldCacheResponse):
        * loader/MediaResourceLoader.h:
        * platform/graphics/PlatformMediaResourceLoader.h:
        (WebCore::PlatformMediaResourceClient::shouldCacheResponse):
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession downloadTaskWithRequest:]):
        (-[WebCoreNSURLSession streamTaskWithHostName:port:]):
        (-[WebCoreNSURLSession streamTaskWithNetService:]):
        (-[WebCoreNSURLSessionDataTask _timingData]):
        (-[WebCoreNSURLSessionDataTask resource:sentBytes:totalBytesToBeSent:]):

2016-02-12  Jer Noble  <jer.noble@apple.com>

        [Mac] CORS-compliant videos throw security errors when painting to Canvas
        https://bugs.webkit.org/show_bug.cgi?id=154188
        <rdar://problem/22959556>

        Reviewed by Alex Christensen.

        Pass the CORS access check results from WebCoreNSURLSession to it's client,
        MediaPlayerPrivateAVFoundationObjC.

        * WebCore.xcodeproj/project.pbxproj:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::didPassCORSAccessCheck): Ask the WebCoreNSURLSession.
        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession task:didReceiveCORSAccessCheckResult:]): Conditionally set _corsResults.
        (-[WebCoreNSURLSession didPassCORSAccessChecks]): Return _corsResults.
        (WebCoreNSURLSessionDataTaskClient::accessControlCheckFailed): Call -resource:accessControlCheckFailedWithError:.
        (WebCoreNSURLSessionDataTaskClient::loadFailed): Call -resource:loadFailedWithError:.
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]): Set _response within the delegate queue.
        (-[WebCoreNSURLSessionDataTask _resource:loadFinishedWithError:]): Renamed from resourceFinished:
        (-[WebCoreNSURLSessionDataTask resource:accessControlCheckFailedWithError:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resource:loadFailedWithError:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resourceFinished:]): Ditto.

2016-02-19  Chris Dumez  <cdumez@apple.com>

        Unreviewed build fix.

        * loader/cocoa/SubresourceLoaderCocoa.mm:
        (WebCore::SubresourceLoader::willCacheResponse):

2016-02-19  Nan Wang  <n_wang@apple.com>

        AX: Inconsistency between CharacterOffset and VisiblePostition
        https://bugs.webkit.org/show_bug.cgi?id=154431

        Reviewed by Chris Fleizach.

        VoiceOver is not getting the correct text marker from VisiblePostition when
        navigating using arrow keys. We should make the CharacterOffset behavior consistent
        with VisiblePosition so that the conversion between the two won't create different
        text markers.
        
        Changes are covered in the modified tests.

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::characterOffsetForTextMarkerData):
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
        (WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
        (WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
        (WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
        (WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):
        (WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
        (WebCore::AXObjectCache::accessibilityObjectForTextMarkerData):
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
        (WebCore::AXObjectCache::nextCharacterOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::endCharacterOffsetOfWord):
        (WebCore::AXObjectCache::previousWordStartCharacterOffset):
        (WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
        (WebCore::AXObjectCache::previousSentenceStartCharacterOffset):
        * accessibility/AXObjectCache.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):

2016-02-19  Jer Noble  <jer.noble@apple.com>

        Allow CachedRawResource clients to opt out of caching on a per-response basis
        https://bugs.webkit.org/show_bug.cgi?id=154453

        Reviewed by Brady Eidson.

        For CF or NS networking clients, the system loader will ask whether the client (the
        SubResourceLoader in this case) wants the response to be cached. This breaks for byte
        range requests due to <rdar://problem/20001985>. Allow the SubresourceLoader to query
        its clients, and return null, if they opt out.

        * loader/cache/CachedRawResource.cpp:
        (WebCore::CachedRawResource::shouldCacheResponse):
        * loader/cache/CachedRawResource.h:
        * loader/cache/CachedRawResourceClient.h:
        (WebCore::CachedRawResourceClient::shouldCacheResponse):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::shouldCacheResponse):
        * loader/cocoa/SubresourceLoaderCocoa.mm:
        (WebCore::SubresourceLoader::willCacheResponse):

2016-02-19  Zalan Bujtas  <zalan@apple.com>

        Blocked plug-in placeholder is sometimes not shown.
        https://bugs.webkit.org/show_bug.cgi?id=154434
        <rdar://problem/22584973>

        Reviewed by Brent Fulgham.

        m_isUnavailablePluginIndicatorHidden was set to false incorrectly as initial value.
        It prevented RenderEmbeddedObject from issuing repaint when the plugin indicator
        was set to visible (m_isUnavailablePluginIndicatorHidden <- false) the first time.
        (The reason why the indicator showed up most of the time was because some renderer
        triggered repaint on the view.)

        Unable to test.

        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsHidden):
        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject): Deleted.
        (WebCore::RenderEmbeddedObject::setUnavailablePluginIndicatorIsPressed): Deleted.
        * rendering/RenderEmbeddedObject.h:
        (WebCore::RenderEmbeddedObject::showsUnavailablePluginIndicator):

2016-02-19  Csaba Osztrogonác  <ossy@webkit.org>

        Fix pessimizing-move warnings
        https://bugs.webkit.org/show_bug.cgi?id=154395

        Reviewed by Michael Catanzaro.

        * platform/graphics/efl/CairoUtilitiesEfl.cpp:
        (WebCore::evasObjectFromCairoImageSurface):
        * platform/graphics/surfaces/GLTransportSurface.cpp:
        (WebCore::GLTransportSurface::createTransportSurface):
        (WebCore::GLTransportSurfaceClient::createTransportSurfaceClient):

2016-02-19  Philippe Normand  <pnormand@igalia.com>

        [GStreamer] clean-up various leaks
        https://bugs.webkit.org/show_bug.cgi?id=154285

        Reviewed by Carlos Garcia Campos.

        * platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
        (webkit_web_audio_src_init): Take full ownership of the GstTask.
        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef): Null pointer support in ASSERTs.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::initializeGStreamerAndRegisterWebKitElements): Take full ownership of the GstElementFactory pointers.
        (WebCore::MediaPlayerPrivateGStreamer::isAvailable): Ditto.

2016-02-18  Andy Estes  <aestes@apple.com>

        Revert to dispatching the popstate event synchronously
        https://bugs.webkit.org/show_bug.cgi?id=153297
        rdar://problem/24092294

        Reviewed by Brent Fulgham.

        r192369 made the popstate event dispatch asynchronously, which matches what the HTML5 spec says to do. However,
        due to compatibility regressions we need to revert back to dispatching synchronously. This change reverts
        r192369's changes to Document.cpp, but retains the new tests.

        Firing popstate synchronously makes both fast/loader/remove-iframe-during-history-navigation-different.html and
        fast/loader/remove-iframe-during-history-navigation-same.html crash, because their onpopstate handlers remove
        frames from the document that will later be accessed by HistoryController::recursiveGoToItem().

        To prevent the crashes, this change does two things:
        1. Keep a reference to the current frame inside FrameLoader::loadSameDocumentItem(), since calling
           loadInSameDocument() might otherwise delete it.
        2. Handle a null frame when iterating a HistoryItem's child frames in HistoryController::recursiveGoToItem(),
           since calling goToItem() on one frame might cause another frame to be deleted.

        Covered by existing tests. fast/loader/stateobjects/popstate-is-asynchronous.html was renamed to
        fast/loader/stateobjects/popstate-is-synchronous.html and modified to expect synchronous dispatch.

        * dom/Document.cpp:
        (WebCore::Document::enqueuePopstateEvent):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::loadSameDocumentItem):
        * loader/HistoryController.cpp:
        (WebCore::HistoryController::recursiveGoToItem):

2016-02-19  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Fix GObject DOM bindings API break after r196769.

        * html/HTMLTextAreaElement.idl:

2016-02-18  Gwang Yoon Hwang  <yoon@igalia.com>

        [GTK] Limit the number of tiles according to the visible area
        https://bugs.webkit.org/show_bug.cgi?id=126122

        Reviewed by Carlos Garcia Campos.

        TextureMapperTiledBackingStore creates tiles for whole layer bounds, which
        means it creates the huge amount of textures if there is an excessively big
        layer.  Not only it wastes the memory and the CPU time, it even can crash GPU
        drivers.

        This patch modifies TextureMapperTiledBackingStore to take into account the
        visible area with a coverage multiplier when creating tiles.

        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
        (WebCore::GraphicsLayerTextureMapper::GraphicsLayerTextureMapper):
        Set a flag to recalculate the visible area of the layer when there are
        geometric changes.
        (WebCore::GraphicsLayerTextureMapper::setContentsToImage):
        (WebCore::GraphicsLayerTextureMapper::flushCompositingStateForThisLayerOnly):
        (WebCore::GraphicsLayerTextureMapper::updateBackingStoreIncludingSubLayers):
        (WebCore::GraphicsLayerTextureMapper::updateBackingStoreIfNeeded):
        (WebCore::GraphicsLayerTextureMapper::markVisibleRectAsDirty):
        (WebCore::GraphicsLayerTextureMapper::selfOrAncestorHasActiveTransformAnimation):
        (WebCore::GraphicsLayerTextureMapper::computeTransformedVisibleRect):
        Compute the inverse transform matrix to map a global visible are to
        the local visible area.
        (WebCore::clampToContentsRectIfRectIsInfinite):
        (WebCore::GraphicsLayerTextureMapper::transformedVisibleRect):
        * platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:
        (WebCore::TextureMapperTiledBackingStore::paintToTextureMapper):
        In HiDPI, the directly composited image is uploaded to the unscaled
        texture to reduce memory usages. So we should apply device scale
        factor to render it correctly.
        (WebCore::TextureMapperTiledBackingStore::createOrDestroyTilesIfNeeded):
        Create tiles which covered by visible rect with a coverage multiplier.

2016-02-18  Brent Fulgham  <bfulgham@apple.com>

        Extend HashCountedSet with a method to efficiently set the count of an entry
        https://bugs.webkit.org/show_bug.cgi?id=154352

        Reviewed by Geoffrey Garen.

        Tested by new TestWebKitAPI tests.

        * loader/ResourceLoadStatistics.cpp:
        (WebCore::decodeHashCountedSet): Update to use new HashCountedSet::add method.

2016-02-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196790.
        https://bugs.webkit.org/show_bug.cgi?id=154439

        made fast/events/wheelevent-basic-actual.txt fail in WK2
        (Requested by alexchristensen on #webkit).

        Reverted changeset:

        "Wheel event callback removing the window causes crash in
        WebCore."
        https://bugs.webkit.org/show_bug.cgi?id=150871
        http://trac.webkit.org/changeset/196790

2016-02-18  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196791.
        https://bugs.webkit.org/show_bug.cgi?id=154438

        broke windows build (Requested by alexchristensen on #webkit).

        Reverted changeset:

        "Extend HashCountedSet with a method to efficiently set the
        count of an entry"
        https://bugs.webkit.org/show_bug.cgi?id=154352
        http://trac.webkit.org/changeset/196791

2016-02-18  Chris Dumez  <cdumez@apple.com>

        window.history / window.navigator should not be replaceable
        https://bugs.webkit.org/show_bug.cgi?id=154412

        Reviewed by Ryosuke Niwa.

        window.history / window.navigator should not be replaceable as per
        the latest HTML specification:
        https://html.spec.whatwg.org/multipage/browsers.html#the-window-object

        Firefox and Chrome already match the specification. This patch aligns
        our behavior.

        No new tests, already covered by existing tests.

        * page/DOMWindow.idl:

2016-02-18  Chris Dumez  <cdumez@apple.com>

        HTMLTableHeaderCellElement.scope should only return known values
        https://bugs.webkit.org/show_bug.cgi?id=154423
        <rdar://problem/24731018>

        Reviewed by Ryosuke Niwa.

        HTMLTableHeaderCellElement.scope should only return known values as per:
        - https://html.spec.whatwg.org/multipage/tables.html#dom-th-scope

        Known values are document here:
        - https://html.spec.whatwg.org/multipage/tables.html#attr-th-scope

        No new tests, already covered by existing test.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTableHeaderCellElement.cpp: Copied from Source/WebCore/html/HTMLTableHeaderCellElement.h.
        (WebCore::HTMLTableHeaderCellElement::scope):
        (WebCore::HTMLTableHeaderCellElement::setScope):
        * html/HTMLTableHeaderCellElement.h:
        * html/HTMLTableHeaderCellElement.idl:

2016-02-18  Brent Fulgham  <bfulgham@apple.com>

        Extend HashCountedSet with a method to efficiently set the count of an entry
        https://bugs.webkit.org/show_bug.cgi?id=154352

        Reviewed by Geoffrey Garen.

        Tested by new TestWebKitAPI tests.

        * loader/ResourceLoadStatistics.cpp:
        (WebCore::decodeHashCountedSet): Update to use new HashCountedSet::add method.

2016-02-18  Simon Fraser  <simon.fraser@apple.com>

        Wheel event callback removing the window causes crash in WebCore.
        https://bugs.webkit.org/show_bug.cgi?id=150871

        Reviewed by Brent Fulgham.
        
        Null check the FrameView before using it, since the iframe may have been removed
        from its parent document inside the event handler.

        Test: fast/events/wheel-event-destroys-frame.html

        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::platformCompleteWheelEvent):

2016-02-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix IDBGetResult encoder/decoder.
        https://bugs.webkit.org/show_bug.cgi?id=154421

        Reviewed by Alex Christensen.

        No new tests, as Modern IDB is still disabled for WK2.
        
        But if you manually enable it, "Basic IndexedDB Seems To Work"

        * Modules/indexeddb/IDBGetResult.h:
        (WebCore::IDBGetResult::encode):
        (WebCore::IDBGetResult::decode):

2016-02-18  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r196747.

        Unreviewed.

        * css/CSSFontFaceSet.h:
        * css/FontFaceSet.cpp:
        (WebCore::FontFaceSet::size):
        (WebCore::FontFaceSet::clear):
        * css/FontFaceSet.h:

2016-02-18  Zalan Bujtas  <zalan@apple.com>

        Soft hyphen is not shown when it is placed at the end of an inline element
        https://bugs.webkit.org/show_bug.cgi?id=153980

        Reviewed by David Hyatt.

        This patch handles the case when the character at the breaking position does not fit the
        line and soft-hyphen, as the first breaking opportunity, is followed by this overflowing character.
        (foo&shy;bar where b overflows the line).
        In such cases we don't yet have an item in the breaking history so we need to take a look at
        the current context instead.    

        Test: fast/text/soft-hyphen-as-first-breaking-opportunity.html

        * rendering/line/BreakingContext.h:
        (WebCore::BreakingContext::InlineIteratorHistory::nextBreakablePosition):
        (WebCore::BreakingContext::handleText):

2016-02-18  Andreas Kling  <akling@apple.com>

        Fake memory pressure handler should log detailed memory breakdown.
        <https://webkit.org/b/154415>

        Reviewed by Antti Koivisto.

        Piggyback on the RESOURCE_USAGE code to implement some detailed memory footprint diffing
        and have the fake memory handler dump before/after/diff after it runs.

        * page/ResourceUsageThread.h:
        (WebCore::TagInfo::TagInfo):
        * page/cocoa/ResourceUsageThreadCocoa.mm:
        (WebCore::logFootprintComparison):
        (WebCore::displayNameForVMTag):
        (WebCore::pagesPerVMTag):
        (WebCore::TagInfo::TagInfo): Deleted.
        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::install):

2016-02-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement server->client operations in WK2.
        https://bugs.webkit.org/show_bug.cgi?id=154411

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.
    
        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/server/IDBServer.h:
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        (WebCore::IDBTransactionInfo::encode):
        (WebCore::IDBTransactionInfo::decode):

2016-02-18  Csaba Osztrogonác  <ossy@webkit.org>

        Fix unused-const-variable warning on non Cocoa platforms
        https://bugs.webkit.org/show_bug.cgi?id=154394

        Reviewed by Michael Catanzaro.

        * html/HTMLPlugInImageElement.cpp:

2016-02-18  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement client->server operations in WK2.
        https://bugs.webkit.org/show_bug.cgi?id=154400

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/server/IDBServer.h:
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:

2016-02-18  Chris Dumez  <cdumez@apple.com>

        [Unforgeable] operations should not be writable as per Web IDL
        https://bugs.webkit.org/show_bug.cgi?id=154396
        <rdar://problem/24721063>

        Reviewed by Ryosuke Niwa.

        [Unforgeable] operations should not be writable as per the Web IDL specification:
        http://heycam.github.io/webidl/#es-operations

        They were currently non-configurable in WebKit but still writable.

        No new tests, already covered by existing test.

        * bindings/scripts/CodeGeneratorJS.pm:
        Mark [Unforgeable] operations as ReadOnly.

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        * bindings/scripts/test/TestObj.idl:
        Add bindings test coverage for [Unforgeable].

2016-02-18  Chris Dumez  <cdumez@apple.com>

        Fix behavior of reflecting unsigned long IDL attributes that are limited to only non-negative numbers greater than zero
        https://bugs.webkit.org/show_bug.cgi?id=154398

        Reviewed by Ryosuke Niwa.

        Fix behavior of reflecting unsigned long IDL attributes that are limited
        to only non-negative numbers greater than zero to comply with:
        - https://html.spec.whatwg.org/#limited-to-only-non-negative-numbers-greater-than-zero

        This patch updates the following IDL attributes:
        - colgroup.span
        - col.span
        - input.size
        - textarea.cols
        - textareal.rows

        All of them now:
        - Have "unsigned long" type on IDL size and "unsigned" type on native
          side.
        - On getting, return the value if it is in the range [1; 2147483647],
          otherwise return the default value.
        - On setting, set to the input value if it is in the range
          [1; 2147483647], otherwise, set to the default value.

        Note that as per the specification, we are supposed to throw an
        IndexSizeError exception when trying to set those attributes to zero.
        However, we instead use the default value to match other browsers.
        It would be risky to be the only browser to throw in this case.

        No new tests, already covered by existing test.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::parseAttribute):
        (WebCore::HTMLInputElement::setSize):
        * html/HTMLTableColElement.cpp:
        (WebCore::HTMLTableColElement::parseAttribute):
        (WebCore::HTMLTableColElement::setSpan):
        * html/HTMLTableColElement.h:
        * html/HTMLTableColElement.idl:
        * html/HTMLTextAreaElement.cpp:
        (WebCore::HTMLTextAreaElement::parseAttribute):
        (WebCore::HTMLTextAreaElement::setCols):
        (WebCore::HTMLTextAreaElement::setRows):
        (WebCore::HTMLTextAreaElement::shouldUseInputMethod): Deleted.
        * html/HTMLTextAreaElement.h:
        * html/HTMLTextAreaElement.idl:
        * html/parser/HTMLParserIdioms.h:
        (WebCore::limitToOnlyNonNegativeNumbersGreaterThanZero):

2016-02-18  David Kilzer  <ddkilzer@apple.com>

        Remove redundant ASSERT_WITH_MESSAGE_UNUSED() from SOFT_LINK_FRAMEWORK_FOR_SOURCE() macro

        Follow-up fix noted by Andy Estes for:

            [Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
            <http://webkit.org/b/154364>

        * platform/mac/SoftLinking.h:
        (SOFT_LINK_FRAMEWORK_FOR_SOURCE): Remove redundant
        ASSERT_WITH_MESSAGE_UNUSED().

2016-02-18  Andreas Kling  <akling@apple.com>

        Reduce tiling coverage immediately when memory pressure hits.
        <https://webkit.org/b/154374>

        Reviewed by Simon Fraser.

        We already had a policy that reduced tiling coverage to a minimum while the system
        is under memory pressure. However, that policy wouldn't kick in immediately after
        receiving the pressure notification, but the next time we flush compositing state.

        This change makes it happen sooner, improving our chances to escape death!

        * page/Page.h:
        * page/Page.cpp:
        (WebCore::Page::forEachPage):

            Add a little helper for visiting every Page.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseCriticalMemory):

            When under critical memory pressure, schedule a compositing flush in all Pages.
            This ensures that the reduced tiling coverage policy takes effect, allowing us to
            immediately drop several tiles in each visible web view.

        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::install):

            To ensure that this behavior is testable with the fake memory pressure notification,
            make the fake handler set the "in memory pressure" state just like the real one would.
            I don't know why we were not doing this previously, it was just an oversight.
            After the simulation completes, it schedules a runloop callback that resets the
            "in memory pressure" state.

2016-02-17  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Implement FontFaceSet
        https://bugs.webkit.org/show_bug.cgi?id=153348

        Reviewed by Simon Fraser.

        The CSS Font Loading spec includes a FontFaceSet object which represents
        a collection of FontFaces. This patch implements such an object, and
        backs it with a vector of FontFaces. Similarly to the FontFace object,
        FontFaceSet is separated into a FontFaceSet frontend object and a
        CSSFontFaceSet backend object, which actually owns the FontFace objects.
        All the interaction with Promises is performed in the frontend object.

        This patch does not implement the EventTarget part of the FontFaceSet
        API, so the only way to know when a font is finished loading is by using
        the associated Promise objects.

        The CSS Font Loading spec describes how the Document should vend an
        instance of FontFaceSet which represents the font faces currently
        associated with the Document. However, that functionality is
        forthcoming. Currently, the only way to get a FontFaceSet is to create
        one yourself (using the constructor). Therefore, this patch does not
        implement the spec's notion of a "CSS-connected font face."

        Test: fast/text/font-face-set-javascript.html

        * CMakeLists.txt: Add new files.
        * DerivedSources.make: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSFontFaceSetCustom.cpp: Added.
        (WebCore::JSFontFaceSet::ready): Use the Promise member.
        (WebCore::JSFontFaceSet::entries): Use existing iterator code.
        (WebCore::JSFontFaceSet::keys):
        (WebCore::JSFontFaceSet::values):
        * css/CSSAllInOne.cpp: Add new files.
        * css/CSSFontFace.cpp: We now have a collection of clients (instead of
        just one). Also, we need to keep a pointer to our FontFace wrapper.
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::addClient):
        (WebCore::CSSFontFace::removeClient):
        (WebCore::CSSFontFace::setStatus): Rename the delegate callback to be
        more clear.
        (WebCore::CSSFontFace::fontLoaded):
        (WebCore::CSSFontFace::addedToSegmentedFontFace): Deleted.
        (WebCore::CSSFontFace::removedFromSegmentedFontFace): Deleted.
        * css/CSSFontFace.h: Same as above.
        (WebCore::CSSFontFace::create):
        (WebCore::CSSFontFace::Client::~Client):
        (WebCore::CSSFontFace::Client::kick):
        (WebCore::CSSFontFace::Client::stateChanged):
        (WebCore::CSSFontFace::wrapper):
        (WebCore::CSSFontFaceClient::~CSSFontFaceClient): Deleted.
        * css/CSSFontFaceSet.cpp: Added. Initial imlementation.
        (WebCore::CSSFontFaceSet::CSSFontFaceSet):
        (WebCore::CSSFontFaceSet::~CSSFontFaceSet):
        (WebCore::CSSFontFaceSet::incrementActiveCount):
        (WebCore::CSSFontFaceSet::decrementActiveCount):
        (WebCore::CSSFontFaceSet::has):
        (WebCore::CSSFontFaceSet::add):
        (WebCore::CSSFontFaceSet::remove):
        (WebCore::extractFamilies):
        (WebCore::familiesIntersect): Because this is an initial imlementation,
        this function is not optimized. A subsequent patch (which implements
        Document.fonts) will optimize this.
        (WebCore::CSSFontFaceSet::matchingFaces):
        (WebCore::CSSFontFaceSet::load):
        (WebCore::CSSFontFaceSet::check):
        (WebCore::CSSFontFaceSet::stateChanged):
        * css/CSSFontFaceSet.h: Added.
        (WebCore::CSSFontFaceSetClient::~CSSFontFaceSetClient):
        (WebCore::CSSFontFaceSet::size):
        (WebCore::CSSFontFaceSet::operator[]):
        (WebCore::CSSFontFaceSet::status):
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::familyNameFromPrimitive):
        (WebCore::CSSFontSelector::registerLocalFontFacesForFamily):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::familyNameFromPrimitive): Deleted.
        (WebCore::CSSFontSelector::kick): Deleted.
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::~CSSSegmentedFontFace):
        (WebCore::CSSSegmentedFontFace::appendFontFace):
        (WebCore::CSSSegmentedFontFace::kick):
        (WebCore::CSSSegmentedFontFace::fontLoaded): Deleted.
        * css/CSSSegmentedFontFace.h:
        * css/FontFace.cpp:
        (WebCore::FontFace::FontFace):
        (WebCore::FontFace::~FontFace):
        (WebCore::FontFace::stateChanged): Renamed to make its purpose clearer.
        (WebCore::FontFace::kick): Deleted.
        * css/FontFace.h:
        * css/FontFaceSet.cpp: Added.
        (WebCore::createPromise):
        (WebCore::FontFaceSet::FontFaceSet):
        (WebCore::FontFaceSet::~FontFaceSet):
        (WebCore::FontFaceSet::Iterator::Iterator):
        (WebCore::FontFaceSet::Iterator::next):
        (WebCore::FontFaceSet::PendingPromise::PendingPromise):
        (WebCore::FontFaceSet::PendingPromise::~PendingPromise):
        (WebCore::FontFaceSet::has):
        (WebCore::FontFaceSet::size):
        (WebCore::FontFaceSet::add):
        (WebCore::FontFaceSet::remove):
        (WebCore::FontFaceSet::clear):
        (WebCore::FontFaceSet::load): Most of the complexity of loading is
        due to the promises involved. Rather than use the Javascript function
        Promise.all(), this patch builds a data structure to represent the
        promises which need to be resolved. When fonts finish loading, we look
        at the data structure to determine which promises to resolve.
        (WebCore::FontFaceSet::check):
        (WebCore::FontFaceSet::status):
        (WebCore::FontFaceSet::canSuspendForDocumentSuspension):
        (WebCore::FontFaceSet::startedLoading):
        (WebCore::FontFaceSet::completedLoading):
        (WebCore::FontFaceSet::fulfillPromise): Keep the promise alive.
        (WebCore::FontFaceSet::faceFinished):
        * css/FontFaceSet.h: Added.
        (WebCore::FontFaceSet::create):
        (WebCore::FontFaceSet::load):
        (WebCore::FontFaceSet::check):
        (WebCore::FontFaceSet::createIterator):
        (WebCore::FontFaceSet::PendingPromise::create):
        * css/FontFaceSet.idl: Added.
        * dom/EventNames.h:
        * dom/EventTargetFactory.in:

2016-02-17  Mark Lam  <mark.lam@apple.com>

        Callers of JSString::value() should check for exceptions thereafter.
        https://bugs.webkit.org/show_bug.cgi?id=154346

        Reviewed by Geoffrey Garen.

        No new tests.  The crash that results from this issue is dependent on a race
        condition where an OutOfMemory error occurs precisely at the point where the
        JSString::value() function is called on a rope JSString.

        * bindings/js/JSHTMLAllCollectionCustom.cpp:
        (WebCore::callHTMLAllCollection):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::putDelegate):
        - Added a comment at the site of the exception check to clarify the meaning of
          the return value.

2016-02-17  David Kilzer  <ddkilzer@apple.com>

        [Cocoa] Always check the return value of dlopen() and dlsym() in Release builds
        <http://webkit.org/b/154364>

        Reviewed by Alexey Proskuryakov.

        * platform/mac/SoftLinking.h:
        (SOFT_LINK_LIBRARY): Change ASSERT_WITH_MESSAGE() to
        RELEASE_ASSERT_WITH_MESSAGE().
        (SOFT_LINK_FRAMEWORK): Ditto.
        (SOFT_LINK_PRIVATE_FRAMEWORK): Ditto.
        (SOFT_LINK_STAGED_FRAMEWORK): Ditto.
        (SOFT_LINK_FRAMEWORK_IN_UMBRELLA): Ditto.
        (SOFT_LINK): Ditto.
        (SOFT_LINK_POINTER): Ditto.
        (SOFT_LINK_CONSTANT): Ditto.
        (SOFT_LINK_FRAMEWORK_FOR_SOURCE): Add
        RELEASE_ASSERT_WITH_MESSAGE() when soft-link is not
        optional.

2016-02-17  Chris Dumez  <cdumez@apple.com>

        Regression(r196648): http://w3c-test.org/html/dom/interfaces.html redirects at the end of the test
        https://bugs.webkit.org/show_bug.cgi?id=154357

        Reviewed by Alexey Proskuryakov.

        Make location.assign() / location.replace()'s parameter mandatory,
        as per the specification:
        https://html.spec.whatwg.org/multipage/browsers.html#the-location-interface

        Previously, calling location.assign() / location.replace() without
        parameter would be identical to calling location.assign("undefined") /
        location.replace("undefined"), which is not useful.

        After r196648, http://w3c-test.org/html/dom/interfaces.html was able to
        test location.assign() / location.replace() further because they are now
        on the instance (where they should be) instead of the prototype. One of
        these tests calls these functions without parameter, expecting them to
        throw an exception. However, in WebKit, it would not throw and it would
        redirect us to http://w3c-test.org/html/dom/undefined.

        Firefox and Chrome both follow the specification already and throw in
        this case.

        No new tests, already covered by existing test.

        * page/Location.idl:
        Make location.assign() / location.replace()'s parameter mandatory,
        as per the specification.

2016-02-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196738.
        https://bugs.webkit.org/show_bug.cgi?id=154380

        broke css3/calc/transforms-translate.html (Requested by
        alexchristensen on #webkit).

        Reverted changeset:

        "WebKitCSSMatrix transformList with calculated relative length
        crashes Safari."
        https://bugs.webkit.org/show_bug.cgi?id=153333
        http://trac.webkit.org/changeset/196738

2016-02-17  Dean Jackson  <dino@apple.com>

        WebKitCSSMatrix transformList with calculated relative length crashes Safari.
        https://bugs.webkit.org/show_bug.cgi?id=153333
        <rdar://problem/17198383>

        Reviewed by Simon Fraser.

        WebKitCSSMatrix objects should fail to construct when not
        using absolute lengths.

        Updated existing tests:
        - transforms/cssmatrix-2d-interface.xhtml
        - transforms/cssmatrix-3d-interface.xhtml

        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertTransform): Tell transformsForValue
        that we don't require absolute lengths.
        * css/TransformFunctions.cpp:
        (WebCore::convertToFloatLength): Add an optional parameter that will
        cause the conversion to fail if the primitive value has a non-absolute
        length.
        (WebCore::transformsForValue): Pass the parameter for requiring an
        absolute length on to convertToFloatLength when necessary.
        * css/TransformFunctions.h:
        * css/WebKitCSSMatrix.cpp:
        (WebCore::WebKitCSSMatrix::setMatrixValue): In this case we do
        require all transform strings to have absolute lengths, not ones
        that depend on the font size or are calculated.

2016-02-17  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196712.
        https://bugs.webkit.org/show_bug.cgi?id=154371

        This change caused 5 API test failures on ios-simulator
        (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "[iOS] Purge GraphicsServices font cache on memory warning."
        https://bugs.webkit.org/show_bug.cgi?id=154343
        http://trac.webkit.org/changeset/196712

2016-02-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: More Encoder/Decoder/Messaging scaffolding for WK2 IPC.
        https://bugs.webkit.org/show_bug.cgi?id=154356

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/shared/IDBDatabaseInfo.h:
        (WebCore::IDBDatabaseInfo::encode):
        (WebCore::IDBDatabaseInfo::decode):

        * Modules/indexeddb/shared/IDBError.h:
        (WebCore::IDBError::encode):
        (WebCore::IDBError::decode):

        * Modules/indexeddb/shared/IDBRequestData.h:
        (WebCore::IDBRequestData::decode):

        * Modules/indexeddb/shared/IDBResultData.h:
        (WebCore::IDBResultData::encode):
        (WebCore::IDBResultData::decode):

2016-02-17  Saam barati  <sbarati@apple.com>

        Implement Proxy [[Get]]
        https://bugs.webkit.org/show_bug.cgi?id=154081

        Reviewed by Michael Saboff.

        Tests are in JavaScriptCore.

        * bindings/js/JSCryptoAlgorithmDictionary.cpp:
        (WebCore::getProperty):
        (WebCore::getHashAlgorithm):
        * bindings/js/JSCryptoKeySerializationJWK.cpp:
        (WebCore::getJSArrayFromJSON):
        (WebCore::getStringFromJSON):
        (WebCore::getBooleanFromJSON):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::DialogHandler::returnValue):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::tryGetProperty):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::deleteProperty):
        (WebCore::JSStorage::deletePropertyByIndex):
        (WebCore::JSStorage::putDelegate):
        * bindings/js/SerializedScriptValue.cpp:
        (WebCore::CloneSerializer::getProperty):
        * testing/Internals.cpp:
        (WebCore::Internals::isReadableStreamDisturbed):

2016-02-17  Simon Fraser  <simon.fraser@apple.com>

        PDFPlugin's scrollableArea container is not properly unregistered when page is going into the PageCache
        https://bugs.webkit.org/show_bug.cgi?id=148182

        Reviewed by Brent Fulgham.

        When handling Command-arrow key while showing a scrollable PDF, the timing of PDFPlugin
        teardown and navigation could result in PDFPlugin::destroy() getting the wrong FrameView,
        so the old FrameView was left with a stale pointer in its scrollableAreaSet.

        Fix this by adding an explicit willDetatchRenderer() which is called on the plugin
        before the Frame gets a new FrameView.

        Also narrow the scope of the RefPtr<Widget> in HTMLPlugInElement::defaultEventHandler()
        so that the Widget is not kept alive over a possible navigation.

        I was unable to make an automated test, because reproducing the bug requires handling
        a Command-arrow key event in a way that the last ref to a Widget is held over the event
        handling, and this wasn't possible in an iframe.

        * html/HTMLPlugInElement.cpp:
        (WebCore::HTMLPlugInElement::defaultEventHandler):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::willDetachRenderers):
        * plugins/PluginViewBase.h:
        (WebCore::PluginViewBase::willDetatchRenderer):
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::detachRenderTree): Drive-by nullptr.

2016-02-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: Encoder/Decoder/Messaging scaffolding for WK2 IPC.
        https://bugs.webkit.org/show_bug.cgi?id=154351

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/IDBDatabaseIdentifier.h:
        (WebCore::IDBDatabaseIdentifier::encode):
        (WebCore::IDBDatabaseIdentifier::decode):
        
        * Modules/indexeddb/shared/IDBCursorInfo.h:
        (WebCore::IDBCursorInfo::encode):
        (WebCore::IDBCursorInfo::decode):
        
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        (WebCore::IDBIndexInfo::encode):
        (WebCore::IDBIndexInfo::decode):
        
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:
        (WebCore::IDBObjectStoreInfo::encode):
        (WebCore::IDBObjectStoreInfo::decode):
        
        * Modules/indexeddb/shared/IDBRequestData.h:
        (WebCore::IDBRequestData::encode):
        (WebCore::IDBRequestData::decode):
        
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:
        (WebCore::IDBResourceIdentifier::encode):
        (WebCore::IDBResourceIdentifier::decode):
        
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        (WebCore::IDBTransactionInfo::encode):
        (WebCore::IDBTransactionInfo::decode):

2016-02-17  Andreas Kling  <akling@apple.com>

        [iOS] Purge GraphicsServices font cache on memory warning.
        <https://webkit.org/b/154343>

        Reviewed by Antti Koivisto.

        The GS font cache was holding on to the last retain on CSS fonts after they stop being used.
        Call SPI to purge it on memory pressure.

        * platform/cocoa/MemoryPressureHandlerCocoa.mm:
        (WebCore::MemoryPressureHandler::platformReleaseMemory):
        * platform/spi/ios/GraphicsServicesSPI.h:

2016-02-17  Chris Dumez  <cdumez@apple.com>

        Regression(r196648): window.showModalDialog is no longer undefined if the client does not allow showing modal dialog
        https://bugs.webkit.org/show_bug.cgi?id=154330

        Reviewed by Gavin Barraclough.

        window.showModalDialog is no longer undefined if the client does not
        allow showing modal dialog after r196648. This patch fixes the issue
        and add test coverage for this.

        Test: fast/dom/Window/forbid-showModalDialog.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        - Move the DOMWindow::canShowModalDialog() check *before* checking
          for static properties as showModalDialog is now in the static
          property table after r196648.
        - Add check for Base::getOwnPropertySlot() first to support overriding
          window.showModalDialog (This behavior matches Firefox).
        - Return false if DOMWindow::canShowModalDialog() returns false as this
          seems cleaner than claiming that the property is there but undefined.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::canShowModalDialogNow): Deleted.
        This was indentical to canShowModalDialog().

        (WebCore::DOMWindow::canShowModalDialog):
        (WebCore::DOMWindow::setCanShowModalDialogOverride):
        (WebCore::DOMWindow::showModalDialog):
        * page/DOMWindow.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setCanShowModalDialogOverride):
        * testing/Internals.h:
        * testing/Internals.idl:
        Add support for overriding the ChromeClient's canShowModalDialog
        decision and hook it up to Internals to add layout test coverage.

2016-02-17  Brady Eidson  <beidson@apple.com>

        Modern IDB: More WK2 IPC Scaffolding.
        https://bugs.webkit.org/show_bug.cgi?id=154317

        Reviewed by Alex Christensen.

        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/shared/IDBCursorInfo.cpp:
        (WebCore::IDBCursorInfo::IDBCursorInfo):
        * Modules/indexeddb/shared/IDBCursorInfo.h:
        (WebCore::IDBCursorInfo::decode):
        * Modules/indexeddb/shared/IDBError.h:
        (WebCore::IDBError::decode):
        * Modules/indexeddb/shared/IDBIndexInfo.h:
        (WebCore::IDBIndexInfo::decode):
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:
        (WebCore::IDBObjectStoreInfo::decode):
        * Modules/indexeddb/shared/IDBRequestData.cpp:
        (WebCore::IDBRequestData::IDBRequestData):
        * Modules/indexeddb/shared/IDBRequestData.h:
        (WebCore::IDBRequestData::decode):
        * Modules/indexeddb/shared/IDBResourceIdentifier.cpp:
        (WebCore::IDBResourceIdentifier::IDBResourceIdentifier):
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:
        (WebCore::IDBResourceIdentifier::decode):
        * Modules/indexeddb/shared/IDBResultData.cpp:
        (WebCore::IDBResultData::IDBResultData):
        * Modules/indexeddb/shared/IDBResultData.h:
        (WebCore::IDBResultData::decode):
        * Modules/indexeddb/shared/IDBTransactionInfo.cpp:
        (WebCore::IDBTransactionInfo::IDBTransactionInfo):
        * Modules/indexeddb/shared/IDBTransactionInfo.h:
        (WebCore::IDBTransactionInfo::decode):
        * WebCore.xcodeproj/project.pbxproj:

2016-02-17  Eric Carlson  <eric.carlson@apple.com>

        [Win] Allow ports to disable automatic text track selection
        https://bugs.webkit.org/show_bug.cgi?id=154322
        <rdar://problem/24623986>

        Reviewed by Brent Fulgham.

        * page/CaptionUserPreferencesMediaAF.cpp:
        (MTEnableCaption2015BehaviorPtr): Implement for Windows.

2016-02-17  Gavin Barraclough  <barraclough@apple.com>

        JSDOMWindow::put should not do the same thing twice
        https://bugs.webkit.org/show_bug.cgi?id=154334

        Reviewed by Chris Dumez.

        It either calls JSGlobalObject::put or Base::put. Hint: these are basically the same thing.
        In the latter case it might call lookupPut. That's redundant; JSObject::put handles static
        table entries.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::put):
            - just call Base::put.
        (WebCore::JSDOMWindow::putByIndex):
            - just call Base::putByIndex.

2016-02-17  Nan Wang  <n_wang@apple.com>

        AX: Implement sentence related text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=154312

        Reviewed by Chris Fleizach.

        Using CharacterOffset to implement sentence related text marker calls. Reused
        logic from VisibleUnits class. Also fixed an issue where paragraph navigation
        should skip preceding and following BR nodes.

        Test: accessibility/mac/text-marker-sentence-nav.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::resetNodeAndOffsetForReplacedNode):
        (WebCore::setRangeStartOrEndWithCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::endCharacterOffsetOfWord):
        (WebCore::AXObjectCache::previousWordStartCharacterOffset):
        (WebCore::AXObjectCache::leftWordRange):
        (WebCore::AXObjectCache::rightWordRange):
        (WebCore::AXObjectCache::characterBefore):
        (WebCore::characterOffsetNodeIsBR):
        (WebCore::parentEditingBoundary):
        (WebCore::AXObjectCache::nextBoundary):
        (WebCore::AXObjectCache::previousBoundary):
        (WebCore::AXObjectCache::paragraphForCharacterOffset):
        (WebCore::AXObjectCache::nextParagraphEndCharacterOffset):
        (WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
        (WebCore::AXObjectCache::startCharacterOffsetOfSentence):
        (WebCore::AXObjectCache::endCharacterOffsetOfSentence):
        (WebCore::AXObjectCache::sentenceForCharacterOffset):
        (WebCore::AXObjectCache::nextSentenceEndCharacterOffset):
        (WebCore::AXObjectCache::previousSentenceStartCharacterOffset):
        (WebCore::AXObjectCache::rootAXEditableElement):
        (WebCore::startWordBoundary): Deleted.
        (WebCore::endWordBoundary): Deleted.
        (WebCore::AXObjectCache::nextWordBoundary): Deleted.
        (WebCore::AXObjectCache::previousWordBoundary): Deleted.
        * accessibility/AXObjectCache.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
        * editing/VisibleUnits.cpp:
        (WebCore::startWordBoundary):
        (WebCore::startOfWord):
        (WebCore::endWordBoundary):
        (WebCore::startSentenceBoundary):
        (WebCore::startOfSentence):
        (WebCore::endSentenceBoundary):
        * editing/VisibleUnits.h:

2016-02-17  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] GridSpan refactoring
        https://bugs.webkit.org/show_bug.cgi?id=153868

        Reviewed by Sergio Villar Senin.

        Add new enum to know if a GridSpan is definite or indefinite.
        That way we don't need GridUnresolvedSpan class (which is removed).
        We can always have two GridSpans in GridCoordinate,
        if the position is "auto" the GridSpan will be marked as indefinite.
        This will allow in a follow-up patch to avoid repeated calls
        to methods that resolve positions.

        Most operations in GridSpan are restricted to definite GridSpans (access
        to positions, iterator, etc.). For indefinite GridSpans we only need to
        know that they're indefinite, we shouldn't use the rest of the data.

        No new tests, no change of behavior.

        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::stringForPosition):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::resolveContentBasedTrackSizingFunctionsForNonSpanningItems):
        (WebCore::RenderGrid::insertItemIntoGrid):
        (WebCore::RenderGrid::placeItemsOnGrid):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::placeSpecifiedMajorAxisItemsOnGrid):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        (WebCore::RenderGrid::placeAutoMajorAxisItemsOnGrid): Deleted.
        (WebCore::RenderGrid::autoPlacementMinorAxisDirection): Deleted.
        (WebCore::RenderGrid::populateGridPositions): Deleted.
        * rendering/style/GridCoordinate.h:
        (WebCore::GridSpan::definiteGridSpan):
        (WebCore::GridSpan::indefiniteGridSpan):
        (WebCore::GridSpan::operator==):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::resolvedInitialPosition):
        (WebCore::GridSpan::resolvedFinalPosition):
        (WebCore::GridSpan::begin):
        (WebCore::GridSpan::end):
        (WebCore::GridSpan::isDefinite):
        (WebCore::GridSpan::GridSpan):
        (WebCore::GridCoordinate::GridCoordinate):
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::initialPositionSide):
        (WebCore::finalPositionSide):
        (WebCore::adjustGridPositionsFromStyle):
        (WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
        (WebCore::implicitNamedGridLineForSide): Deleted.
        (WebCore::GridResolvedPosition::isNonExistentNamedLineOrArea): Deleted.
        (WebCore::resolveNamedGridLinePositionFromStyle): Deleted.
        (WebCore::resolveGridPositionFromStyle): Deleted.
        * rendering/style/GridResolvedPosition.h:
        (WebCore::GridResolvedPosition::GridResolvedPosition): Deleted.
        (WebCore::GridResolvedPosition::operator*): Deleted.
        (WebCore::GridResolvedPosition::operator++): Deleted.
        (WebCore::GridResolvedPosition::operator==): Deleted.

2016-02-17  Chris Dumez  <cdumez@apple.com>

        Window should have its 'constructor' property on the prototype
        https://bugs.webkit.org/show_bug.cgi?id=154037
        <rdar://problem/24689078>

        Reviewed by Gavin Barraclough.

        Window should have its 'constructor' property on the prototype as per
        the Web IDL specification:
        http://heycam.github.io/webidl/#interface-prototype-object

        Firefox and Chrome already match the specification.

        No new tests, covered by:
        - fast/dom/Window/window-constructor-settable.html
        - fast/dom/Window/window-constructor.html
        - http/tests/security/cross-origin-window-property-access.html
        - imported/w3c/web-platform-tests/html/dom/interfaces.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (ConstructorShouldBeOnInstance): Deleted.
        Drop this routine as all constructors are now on the prototype.

        (InstancePropertyCount):
        Do not account for constructor properties as these can only be
        on the prototype now.

        (PrototypePropertyCount):
        Increment the property count by 1 if the interface has a constructor
        property (e.g. [NoInterfaceObject] interfaces do not have one).

        (GeneratePropertiesHashTable):
        Stop calling ConstructorShouldBeOnInstance() as it no longer exists.
        Always generated the "constructor" property if:
        1. We are generating the prototype hash table.
        and
        2. The interface needs a constructor (i.e. not marked as
           [NoInterfaceObject]).

        (GenerateImplementation):
        - Drop code handling the case where ConstructorShouldBeOnInstance()
          returns true as constructors are not always on the prototype and
          the ConstructorShouldBeOnInstance() routine has been dropped.
        - Drop code handling [CustomProxyToJSObject]. Now that the constructor
          is always on the prototype, we never need to cast thisValue to a
          JSDOMWindow (by calling toJSDOMWindow). In the Window case, thisValue
          is now casted to a JSDOMWindowPrototype*, similarly to other interfaces
          so we don't need a special casting function anymore.
        - Stop generating security checks. This only impacts Window as it is the
          only interface marked as [CheckSecurity]. The cross-origin checking code
          as it was would not work when "constructor" is on the prototype because
          thisValue is a JSDOMWindowPrototype, not a JSDOMWindow and we have no
          way of getting the wrapped window. Also, the security check is no longer
          needed because:
          1. Accessing crossOriginWindow.constructor will not work now that
             constructor is on the prototype because
             JSDOMWindow::getOwnPropertySlot() already prevents access to the
             prototype in the cross-origin case.
          2. "constructor" is a value property, not a getter/setter. Therefore,
             it is no possible to use the getter/setter from a same origin window
             instance and call it on a cross origin window.

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        Add a way to test ScrollAnimator
        https://bugs.webkit.org/show_bug.cgi?id=153479

        Reviewed by Michael Catanzaro.

        Tests: fast/scrolling/overlay-scrollbars-scroll-corner.html
               fast/scrolling/scroll-animator-basic-events.html
               fast/scrolling/scroll-animator-overlay-scrollbars-hovered.html
               fast/scrolling/scroll-animator-select-list-events.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * page/FrameView.cpp:
        (WebCore::FrameView::usesMockScrollAnimator):
        (WebCore::FrameView::logMockScrollAnimatorMessage):
        * page/FrameView.h:
        * page/Settings.cpp:
        (WebCore::Settings::setUsesMockScrollAnimator):
        (WebCore::Settings::usesMockScrollAnimator):
        * page/Settings.h:
        * platform/ScrollableArea.cpp:
        (WebCore::ScrollableArea::scrollAnimator):
        * platform/ScrollableArea.h:
        (WebCore::ScrollableArea::usesMockScrollAnimator):
        (WebCore::ScrollableArea::logMockScrollAnimatorMessage):
        * platform/mock/ScrollAnimatorMock.cpp: Added.
        (WebCore::ScrollAnimatorMock::create):
        (WebCore::ScrollAnimatorMock::ScrollAnimatorMock):
        (WebCore::ScrollAnimatorMock::~ScrollAnimatorMock):
        (WebCore::ScrollAnimatorMock::didAddVerticalScrollbar):
        (WebCore::ScrollAnimatorMock::didAddHorizontalScrollbar):
        (WebCore::ScrollAnimatorMock::willRemoveVerticalScrollbar):
        (WebCore::ScrollAnimatorMock::willRemoveHorizontalScrollbar):
        (WebCore::ScrollAnimatorMock::mouseEnteredContentArea):
        (WebCore::ScrollAnimatorMock::mouseMovedInContentArea):
        (WebCore::ScrollAnimatorMock::mouseExitedContentArea):
        (WebCore::ScrollAnimatorMock::mouseEnteredScrollbar):
        (WebCore::ScrollAnimatorMock::mouseExitedScrollbar):
        (WebCore::ScrollAnimatorMock::mouseIsDownInScrollbar):
        * platform/mock/ScrollAnimatorMock.h: Added.
        * platform/mock/ScrollbarThemeMock.cpp:
        (WebCore::ScrollbarThemeMock::usesOverlayScrollbars):
        * platform/mock/ScrollbarThemeMock.h:
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::usesMockScrollAnimator):
        (WebCore::RenderLayer::logMockScrollAnimatorMessage):
        * rendering/RenderLayer.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::usesMockScrollAnimator):
        (WebCore::RenderListBox::logMockScrollAnimatorMessage):
        * rendering/RenderListBox.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setUsesMockScrollAnimator):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        Unreviewed. Enable overlay scrollbars in GTK+ after r196641.

        This was blocked by bug #153404, but the commit that introduced
        the regression was rolled out in r196641.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk):

2016-02-16  Gavin Barraclough  <barraclough@apple.com>

        JSDOMWindow::getOwnPropertySlot should just call getStaticPropertySlot
        https://bugs.webkit.org/show_bug.cgi?id=154257

        Reviewed by Chris Dumez.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
            - JSDOMWindow::getOwnPropertySlot should just call getStaticPropertySlot

2016-02-16  Gavin Barraclough  <barraclough@apple.com>

        JSDOMWindow::getOwnPropertySlot should not search photo chain
        https://bugs.webkit.org/show_bug.cgi?id=154102

        Reviewed by Chris Dumez.

        Should only return *own* properties.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):

2016-02-16  Alex Christensen  <achristensen@webkit.org>

        CMake build fix.

        * PlatformMac.cmake:

2016-02-16  Chris Dumez  <cdumez@apple.com>

        Navigator.geolocation should not be marked a [Replaceable] and should be on the prototype
        https://bugs.webkit.org/show_bug.cgi?id=154304
        <rdar://problem/24685092>

        Reviewed by Gavin Barraclough.

        1. Drop the [Replaceable] IDL extended attribute for navigator.geolocation
           as this does not match other browsers or the specification:
           - https://dev.w3.org/geo/api/spec-source.html#geolocation_interface
        2. Move Navigator attributes to the prototype, where they should be as
           per the Web IDL specification.

        The previous behavior was meant as a workaround for a bug in the Amazon
        iOS app (rdar://problem/16332749). However, I have confirmed that the
        latest Amazon App no longer has any issue with those changes.

        Test: js/navigator-set-geolocation.html

        * Modules/geolocation/NavigatorGeolocation.idl:
        * bindings/scripts/CodeGeneratorJS.pm:
        (InterfaceRequiresAttributesOnInstanceForCompatibility): Deleted.

2016-02-16  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION(r196268): WTFCrashWithSecurityImplication on SVG path animation tests
        https://bugs.webkit.org/show_bug.cgi?id=154221

        Reviewed by Brent Fulgham.

        In r196268, a destructor was added to SVGListPropertyTearOff that notifies
        its wrapper (the SVGAnimatedListPropertyTearoff) about its deletion. This
        allows the wrapper to nullify any references to the wrapped content.
        
        We needed to do the same thing for SVGPathSegListPropertyTearOff. Both
        SVGPathSegListPropertyTearOff and SVGListPropertyTearOff inherit from
        SVGListProperty and both hold pointers to SVGAnimatedListPropertyTearOff
        which needs to be notified.
        
        Tests: exiting svg path animation tests should not crash.

        * svg/properties/SVGPathSegListPropertyTearOff.h:
        (WebCore::SVGPathSegListPropertyTearOff::~SVGPathSegListPropertyTearOff):

2016-02-16  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION (r190430): WTFCrashWithSecurityImplication in:void SVGRootInlineBox::layoutCharactersInTextBoxes()
        https://bugs.webkit.org/show_bug.cgi?id=154185

        Reviewed by Ryosuke Niwa.

        This is a regression caused by adding support for HTMLSlotElement. The
        crash happens when adding an HTMLSlotElement to anther element which should
        not have it as a child like SVGTextElement for example. In this case, we
        were creating a RenderText which should not be happen inside an SVG document.
        The RenderText::createTextBox() was creating InlineTextBox for the slot's
        text and attach it to the SVGRootInlineBox. In layoutCharactersInTextBoxes(),
        the assumption is the inline box is either SVGInlineTextBox or SVGInlineFlowBox.
        But since we have an InlineTextBox instead, the crash happens when casting
        the InlineTextBox to SVGInlineFlowBox.

        The fix is for createRenderTreeForSlotAssignees() to not create a renderer
        when the parent element should not have a renderer for the this element.
        This is the same thing we do for createRenderer() which handles the non
        HTMLSlotElement case and which is called also from createRenderTreeRecursively().
        
        Test: fast/shadow-dom/text-slot-child-crash.svg

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::moveToFlowThreadIfNeeded):
        (WebCore::Style::TreeResolver::createRenderer): Delete the check for
        shouldCreateRenderer() and handling the case when resolvedStyle is null
        since these are handled by the caller createRenderTreeRecursively().
        
        (WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
        Assert shouldCreateRenderer() is true for this element.
        
        (WebCore::Style::TreeResolver::createRenderTreeRecursively): Don't create
        the renderer if shouldCreateRenderer() returns false. Also handle the case
        when resolvedStyle is null and pass the new style to createRenderer().
        
        * style/StyleTreeResolver.h:

2016-02-16  Simon Fraser  <simon.fraser@apple.com>

        Every RenderLayer should not have to remove itself from the scrollableArea set
        https://bugs.webkit.org/show_bug.cgi?id=154311

        Reviewed by Zalan Bujtas.

        A subset of RenderLayers are are scrollable, and get registered on the FrameView,
        but we pay the cost of a hash lookup for removal on every RenderLayer, which is a waste.
        
        Store a bit that tells RenderLayer that it's in the set and needs to be removed.

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        (WebCore::RenderLayer::~RenderLayer):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:

2016-02-16  Daniel Bates  <dabates@apple.com>

        CSP: Update violation report 'Content-Type' header
        https://bugs.webkit.org/show_bug.cgi?id=153166
        <rdar://problem/24383327>

        Reviewed by Brent Fulgham.

        Inspired by Blink patch:
        <https://src.chromium.org/viewvc/blink?view=rev&revision=154215>

        Post the Content Security Policy violation report with Content-Type application/csp-report as
        per section Reporting of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Currently we post CSP violation reports with Content-Type application/json.

        * html/parser/XSSAuditorDelegate.cpp:
        (WebCore::XSSAuditorDelegate::didBlockScript): Use report type ViolationReportType::XSSAuditor to PingLoader.
        * loader/PingLoader.cpp:
        (WebCore::PingLoader::sendViolationReport): Modified to take argument of type ViolationReportType
        to determine the appropriate Content-Type header to use for the report. For a XSS Auditor violation report
        we use Content-Type application/json. For a Content Security Policy violation report we use Content-Type
        application/csp-report. Additionally, pass a ASCIILiteral() to ResourceRequestBase::setHTTPMethod()
        as opposed to a constant string literal to avoid a copy of a constant string literal.
        * loader/PingLoader.h: Add enum class ViolationReportType.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation): Use report type ViolationReportType::ContentSecurityPolicy.

2016-02-16  Alex Christensen  <achristensen@webkit.org>

        Add checks before redirecting with NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=154298

        Reviewed by Andy Estes.

        This fixes http/tests/security/cors-post-redirect-307.html and 
        http/tests/navigation/post-307-response.html when using NetworkSession.

        * platform/network/ResourceRequestBase.h:
        WEBCORE_EXPORT some functions newly used in WebKit2.

2016-02-16  Daniel Bates  <dabates@apple.com>

        CSP: Fix parsing of 'host/path' source expressions
        https://bugs.webkit.org/show_bug.cgi?id=153170
        <rdar://problem/24383407>

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by Mike West):
        <https://src.chromium.org/viewvc/blink?revision=154875&view=revision>

        Fixes an issue where a source of the form example.com/A/ was incorrectly considered
        invalid and hence such a requested resource would be blocked. A source of this form
        is valid by the definition of host-source in section Source List Syntax of the Content
        Security Policy 2.0 spec., <http://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::parseSource):

2016-02-16  Daniel Bates  <dabates@apple.com>

        CSP: Disallow an empty host in a host-source source expression
        https://bugs.webkit.org/show_bug.cgi?id=153168
        <rdar://problem/24383366>

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by rob@robwu.nl):
        <https://src.chromium.org/viewvc/blink?revision=180407&view=revision>

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::parseSource):

2016-02-16  Brady Eidson  <beidson@apple.com>

        Modern IDB: WK2 IPC Scaffolding.
        https://bugs.webkit.org/show_bug.cgi?id=154296

        Reviewed by Alex Christensen.
        
        No change in behavior yet; Just laying the groundwork.

        * Modules/indexeddb/client/IDBConnectionToServer.h:
        * Modules/indexeddb/server/IDBConnectionToClient.h:
        * Modules/indexeddb/shared/IDBResourceIdentifier.h:

2016-02-16  Chris Dumez  <cdumez@apple.com>

        [Web IDL] Operations should be on the instance for global objects or if [Unforgeable]
        https://bugs.webkit.org/show_bug.cgi?id=154120
        <rdar://problem/24613231>

        Reviewed by Gavin Barraclough.

        Operations should be on the instance for global objects or if
        [Unforgeable] as per the Web IDL specification:
        - http://heycam.github.io/webidl/#es-operations
        - http://heycam.github.io/webidl/#dfn-unforgeable-on-an-interface

        This patch implements this behavior in order to align
        with the specification and other browsers.

        No new tests, already covered by existing tests.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
        Update function names now that they have "Instance" in their
        name instead of "Prototype".

        (WebCore::JSDOMWindow::getOwnPropertySlot):
        - Update function names now that they have "Instance" in their
          name instead of "Prototype".
        - Move the functions hard-coding *before* the static table check
          now that these functions are in the static table to maintain
          the previous behavior.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::getOwnPropertySlotDelegate):
        Update function names now that they have "Instance" in their
        name instead of "Prototype".

        * bindings/scripts/CodeGeneratorJS.pm:
        - Move functions to the instance if their interface is a global
          object or if they are marked as [Unforgeable]. Operations are
          now treated more like attributes, as they can now be either on
          the instance or the prototype. In a lot of places, I now use
          the naming "properties" instead of "attributes" as "properties"
          refer both "attributes" and "operations" / "functions".

        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        Rebaseline bindings tests.

2016-02-16  Simon Fraser  <simon.fraser@apple.com>

        Rollout r188659. This broke scrolling of iframes and overflow when
        navigating back to a page in the page cache.
        
        The fix was overly agressive and had no layout test. I will fix the original
        issue a different way.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        * page/FrameView.cpp:
        (WebCore::FrameView::clearScrollableAreas): Deleted.
        * page/FrameView.h:

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] No hover-horizontal scrolling available
        https://bugs.webkit.org/show_bug.cgi?id=122859

        Reviewed by Michael Catanzaro.

        This is a regression of WebKit2, because in WebKit1 we used native
        widgets for frame scrollbars that handled this automatically. Now
        we need to also check if the mouse is over frame scrollbars to
        adjust the wheel event.

        Test: platform/gtk/scrollbars/main-frame-scrollbar-horizontal-wheel-scroll.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleWheelEvent): Pass the adjusted wheel
        event to platformCompleteWheelEvent().
        * page/gtk/EventHandlerGtk.cpp:
        (WebCore::EventHandler::shouldTurnVerticalTicksIntoHorizontal):
        Check also frame scrollbars.

2016-02-16  Antti Koivisto  <antti@apple.com>

        Factor id mutation style invalidation code into a class
        https://bugs.webkit.org/show_bug.cgi?id=154287

        Reviewed by Andreas Kling.

        Also add a cheap basic optimization that avoids descendant invalidation if they can not be affected.

        It would be easy to implement fine grained invalidation like with classes and attribute selectors.
        However dynamic id changes are not common enough (nor recommended) to pay the memory cost of
        the required data structures.

        Test: fast/css/style-invalidation-id-change-descendants.html

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * css/RuleFeature.cpp:
        (WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
        (WebCore::RuleFeatureSet::add):
        (WebCore::RuleFeatureSet::clear):
        * css/RuleFeature.h:
        * dom/Element.cpp:
        (WebCore::makeIdForStyleResolution):
        (WebCore::Element::attributeChanged):
        (WebCore::checkNeedsStyleInvalidationForIdChange): Deleted.
        * style/IdChangeInvalidation.cpp: Added.
        (WebCore::Style::IdChangeInvalidation::invalidateStyle):
        * style/IdChangeInvalidation.h: Added.
        (WebCore::Style::IdChangeInvalidation::IdChangeInvalidation):
        (WebCore::Style::IdChangeInvalidation::~IdChangeInvalidation):

2016-02-16  Andreas Kling  <akling@apple.com>

        Drop StyleResolver and SelectorQueryCache when entering PageCache.
        <https://webkit.org/b/154238>

        Reviewed by Antti Koivisto.

        Stop keeping these around for cached pages to save lots of memory.
        We can easily rebuild them if a cached navigation occurs, and this
        way we also don't need to worry about invalidating style for cached
        pages in all the right places.

        Restoring a cached page will now lead to a forced style recalc.
        We don't try to defer this (beyond a zero-timer) since it's going
        to happen anyway, and it's nicer to front-load the cost rather than
        stuttering on the first user content interaction.

        * dom/Document.cpp:
        (WebCore::Document::setInPageCache):
        * history/CachedPage.cpp:
        (WebCore::CachedPage::restore):
        (WebCore::CachedPage::clear): Deleted.
        * history/CachedPage.h:
        (WebCore::CachedPage::markForVisitedLinkStyleRecalc): Deleted.
        (WebCore::CachedPage::markForFullStyleRecalc): Deleted.
        * history/PageCache.cpp:
        (WebCore::PageCache::markPagesForVisitedLinkStyleRecalc): Deleted.
        (WebCore::PageCache::markPagesForFullStyleRecalc): Deleted.
        * history/PageCache.h:
        * page/Frame.cpp:
        (WebCore::Frame::setPageAndTextZoomFactors): Deleted.
        * page/Page.cpp:
        (WebCore::Page::setViewScaleFactor): Deleted.
        (WebCore::Page::setDeviceScaleFactor): Deleted.
        (WebCore::Page::setPagination): Deleted.
        (WebCore::Page::setPaginationLineGridEnabled): Deleted.
        (WebCore::Page::setVisitedLinkStore): Deleted.

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] clicking on the scrollbar trough steps rather than jumps to the clicked position
        https://bugs.webkit.org/show_bug.cgi?id=115363

        Reviewed by Michael Catanzaro.

        Allow ScrollbarTheme to decide the behavior of a button press event,
        instead of only deciding whether to center on thumb or not. This
        way we can match the current GTK+ behavior in WebKit, without
        affecting other ports.

        * platform/ScrollTypes.h: Add ScrollbarButtonPressAction enum.
        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::mouseDown): Ask ScrollbarTheme to handle the
        event for the pressed part and do the requested action.
        * platform/ScrollbarTheme.cpp:
        (WebCore::ScrollbarTheme::handleMousePressEvent): Add default
        implementation. It's equivalent to the previous default implementation.
        * platform/ScrollbarTheme.h:
        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::handleMousePressEvent): Match current
        GTK+ behavior: left click centers on thumb and right click
        scrolls. Dragging the thumb works for left and middle buttons.
        * platform/gtk/ScrollbarThemeGtk.h:
        * platform/ios/ScrollbarThemeIOS.h: Remove shouldCenterOnThumb,
        and don't override handleMousePressEvent since iOS wants the
        default behavior.
        * platform/ios/ScrollbarThemeIOS.mm:
        * platform/mac/ScrollbarThemeMac.h: Override handleMousePressEvent
        and remove shouldCenterOnThumb.
        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::shouldCenterOnThumb): Same implementation just made it
        static to be used as helper.
        (WebCore::ScrollbarThemeMac::handleMousePressEvent): Return the
        desired action keeping the same behavior.
        * platform/win/ScrollbarThemeWin.cpp:
        (WebCore::ScrollbarThemeWin::handleMousePressEvent): Ditto.
        * platform/win/ScrollbarThemeWin.h:
        * rendering/RenderScrollbarTheme.h:

2016-02-16  Carlos Garcia Campos  <cgarcia@igalia.com>

        Mouse cursor doesn't change when entering scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=154243

        Reviewed by Simon Fraser.

        If the scrollbar is over or very close to text or a link, when
        entering the scrollbar the cursor is not changed, keeping the beam
        or hand cursor when using the scrollbar. Same happens for image
        documents where the magnifier cursor is used and it remains when
        entering the scrollbars. We should use pointer cursor always for
        scrollbars.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::updateCursor): Request also to include
        frame scrollbars in hit test result.
        (WebCore::EventHandler::selectCursor): Use always pointer cursor
        for scrollbars.

2016-02-15  Antti Koivisto  <antti@apple.com>

        Optimize style invalidations for attribute selectors
        https://bugs.webkit.org/show_bug.cgi?id=154242

        Reviewed by Andreas Kling.

        Currently we invalidate the whole element subtree if there are any attribute selectors for the changed attribute.
        This is slow as generally few if any elements are really affected. Using attribute selectors for dynamic styling
        should be performant.

        This patch implements optimization strategy for attributes similar to what we already have for classes:

        - Collect a map of all rules that contains descendant-affecting attribute selectors for a given attribute.
        - When an attribute value changes check if there are any such rules for it.
        - Check if the value change affects the results of any of the attribute selectors.
        - Only if it does invalidate the exact descendant elements affected by the rules.

        Test: fast/css/style-invalidation-attribute-change-descendants.html

        * WebCore.xcodeproj/project.pbxproj:
        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::ancestorClassRules):
        (WebCore::DocumentRuleSets::ancestorAttributeRulesForHTML):

            Create optimization RuleSets when needed.

        * css/DocumentRuleSets.h:
        (WebCore::DocumentRuleSets::uncommonAttribute):
        (WebCore::DocumentRuleSets::features):
        * css/RuleFeature.cpp:
        (WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):
        (WebCore::makeAttributeSelectorKey):
        (WebCore::RuleFeatureSet::collectFeatures):

            Collect rules with descendant affecting attribute selectors.

        (WebCore::RuleFeatureSet::add):
        (WebCore::RuleFeatureSet::clear):
        (WebCore::RuleFeatureSet::shrinkToFit):
        * css/RuleFeature.h:
        * css/SelectorChecker.cpp:
        (WebCore::anyAttributeMatches):
        (WebCore::SelectorChecker::attributeSelectorMatches):

            Expose function for matching single attribute selectors.

        (WebCore::canMatchHoverOrActiveInQuirksMode):
        * css/SelectorChecker.h:
        * dom/Attr.cpp:
        (WebCore::Attr::setValue):
        (WebCore::Attr::childrenChanged):
        * dom/Element.cpp:
        (WebCore::Element::setAttributeInternal):
        (WebCore::makeIdForStyleResolution):
        (WebCore::Element::attributeChanged):
        (WebCore::Element::removeAttributeInternal):
        (WebCore::Element::addAttributeInternal):
        (WebCore::Element::removeAttribute):

            Add AttributeChangeInvalidation where needed.

        (WebCore::Element::needsStyleInvalidation):

            Move to Element from ClassChangeInvalidation.

        (WebCore::Element::willModifyAttribute):

            No more full style invalidation on attribute change.

        * style/AttributeChangeInvalidation.cpp: Added.
        (WebCore::Style::AttributeChangeInvalidation::invalidateStyle):

            Invalidate local style.
            Check if we need to invalidate descendants by looking into ancestorAttributeRules.

        (WebCore::Style::AttributeChangeInvalidation::invalidateDescendants):

            Use StyleInvalidationAnalysis to invalidate the subtree for the relevant rules.

        * style/AttributeChangeInvalidation.h: Added.
        (WebCore::Style::AttributeChangeInvalidation::needsInvalidation):
        (WebCore::Style::AttributeChangeInvalidation::AttributeChangeInvalidation):
        (WebCore::Style::AttributeChangeInvalidation::~AttributeChangeInvalidation):

            If needed, invalidate descendants before and after attribute change to catch rules that start and stop applying.

2016-02-16  Chris Dumez  <cdumez@apple.com>

        Do security checks early in JSDOMWindow::put*()
        https://bugs.webkit.org/show_bug.cgi?id=154270

        Reviewed by Gavin Barraclough.

        Do security checks early in JSDOMWindow::put() / JSDOMWindow::putByIndex()
        and return as soon as possible. This makes it less error-prone as we need
        to do the security check only once, at the top of the function.

        Also lock down the security further by calling lookupPut() only if the
        property name is "location". The "location" property is the only one that
        can be set cross-origin. Previously, trying to set a property such as
        "name" (which cannot be set cross-origin) relied on the attribute setter
        doing the security check when getting called. The new check is less error
        prone and will correctly prevent overriding window's method cross-origin
        once these move down from the prototype (Bug 154120).

        Finally, the previous code was failing to set the "location" property
        cross-origin after the window has been reified. This patch fixes the
        issue by always calling the original "location" property setter from the
        static table in the cross-origin case.

        Test: http/tests/security/cross-origin-reified-window-location-setting.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::put):
        (WebCore::JSDOMWindow::putByIndex):

2016-02-15  Brent Fulgham  <bfulgham@apple.com>

        [Mac] Gather some rudimentary statistics during resource load 
        https://bugs.webkit.org/show_bug.cgi?id=153575
        <rdar://problem/24075254>

        Reviewed by Brady Eidson.

        Tested by: http/tests/navigation/statistics.html

        * CMakeLists.txt:
        * PlatformWin.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Document.cpp:
        (WebCore::Document::updateLastHandledUserGestureTimestamp): Log user interaction
        with the ResourceLoadObserver.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::willSendRequest): Track load statistics if the
        user interacted with the document.
        * loader/ResourceLoadObserver.cpp: Added.
        * loader/ResourceLoadObserver.h: Added.
        * loader/ResourceLoadStatistics.cpp: Added.
        * loader/ResourceLoadStatistics.h: Added.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal): Track load statistics.
        * page/Settings.cpp:
        (WebCore::Settings::setResourceLoadStatisticsEnabled): Added.
        * page/Settings.h:
        (WebCore::Settings::resourceLoadStatisticsEnabled): Added.
        * platform/Logging.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resourceLoadStatisticsForOrigin):
        (WebCore::Internals::setResourceLoadStatisticsEnabled):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-15  Chris Dumez  <cdumez@apple.com>

        The following properties should exist on the global object: AudioTrackList, AudioTrack, VideoTrackList, VideoTrack
        https://bugs.webkit.org/show_bug.cgi?id=154250
        <rdar://problem/24660829>

        Reviewed by Eric Carlson.

        The following properties should exist on the global object:
        - AudioTrackList, AudioTrack, VideoTrackList, VideoTrack

        These interfaces are not marked as [NoInterfaceObject] in:
        - https://html.spec.whatwg.org/#audiotracklist-and-videotracklist-objects

        No new tests, already covered by existing tests.

        * html/track/AudioTrack.idl:
        * html/track/AudioTrackList.idl:
        * html/track/VideoTrack.idl:
        * html/track/VideoTrackList.idl:

2016-02-15  Sam Weinig  <sam@webkit.org>

        Stop using NSMapTable in places where we were only using it to be GC safe
        <rdar://problem/24063723>
        https://bugs.webkit.org/show_bug.cgi?id=154264

        Reviewed by Dan Bernstein.

        Switch from NSMapTable to HashMap.

        * WebCore.xcodeproj/project.pbxproj:
        * bindings/objc/DOMInternal.h:
        * bindings/objc/DOMInternal.mm:
        * bindings/objc/WebScriptObject.mm:
        * bridge/objc/objc_instance.mm:
        * platform/spi/cocoa/NSPointerFunctionsSPI.h: Removed. No longer used.

2016-02-15  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] Implement FontFace JavaScript object
        https://bugs.webkit.org/show_bug.cgi?id=153345

        Reviewed by Antti Koivisto.

        Test: fast/text/font-face-javascript.html

        This patch implements the FontFace Javascript object. This object mostly consists of
        style getters / setters, which we implement by parsing input strings and generating
        output strings similarly to getComputedStyle(). This object also has a load() function
        which returns a promise which will be fulfilled or rejected depending on the load.
        There is also a "loaded" attribute which exposes this promise directly. Also, a status
        field is exposed so script knows what the state of the load is.

        Currently, loading depends on our CachedResourceLoader which is part of the Document,
        so this API is not available in a non-document context.

        Another caveat is that immediate-mode font loading (where the content provides an
        ArrayBuffer containing the bytes of the font file) is forthcoming. This requires
        changing the relationship between CSSFontFaceSource and CachedFont.

        CSSFontFace has been modified to keep a strong reference to the CSSFontSelector. This
        is because the lifetime of the CSSFontFace can now outlive the CSSFontSelector. When
        the CSSFontSelector is removed from the Document, it explicitly clears its constituent
        CSSFontFaces, thereby breaking the reference cycle.

        Test: fast/text/font-face-javascript-expected.html

        * CMakeLists.txt: Add new files.
        * DerivedSources.cpp: Ditto.
        * DerivedSources.make: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj: Ditto.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSDOMPromise.cpp:
        (WebCore::DeferredWrapper::globalObject): Remove whitespace.
        (WebCore::DeferredWrapper::deferred): Allow access to the inner JSC object.
        * bindings/js/JSDOMPromise.h:
        (WebCore::DOMPromise::deferred): Ditto.
        * bindings/js/JSFontFaceCustom.cpp: Copied from Source/WebCore/bindings/js/JSDOMPromise.cpp.
        (WebCore::JSFontFace::loaded):
        (WebCore::JSFontFace::load):
        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::CSSFontFace): 
        (WebCore::CSSFontFace::adoptSource):
        (WebCore::CSSFontFace::updateStatus): Enforce the state machine's transitions.
        (WebCore::CSSFontFace::fontLoaded):
        (WebCore::CSSFontFace::pump):
        (WebCore::CSSFontFace::load):
        * css/CSSFontFace.h:
        (WebCore::CSSFontFaceClient::~CSSFontFaceClient):
        (WebCore::CSSFontFace::create):
        (WebCore::CSSFontFace::status):
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::appendSources): Update for new CSSFontFace API.
        (WebCore::CSSFontSelector::registerLocalFontFacesForFamily): Ditto.
        (WebCore::CSSFontSelector::addFontFaceRule): Ditto.
        (WebCore::CSSFontSelector::kick): Ditto.
        (WebCore::appendSources): Deleted.
        (WebCore::registerLocalFontFacesForFamily): Deleted.
        * css/CSSFontSelector.h:
        * css/CSSUnicodeRangeValue.cpp: Use for serializing the "unicodeRange" property.
        * css/FontFace.cpp:
        (WebCore::createPromise): Implement the remaining Javascript API functions.
        (WebCore::valueFromDictionary):
        (WebCore::FontFace::create):
        (WebCore::FontFace::FontFace):
        (WebCore::FontFace::parseString):
        (WebCore::FontFace::status):
        (WebCore::FontFace::kick):
        (WebCore::FontFace::load):
        (WebCore::FontFace::fulfillPromise):
        (WebCore::FontFace::rejectPromise):
        (WebCore::parseString): Deleted.
        * css/FontFace.h:
        (WebCore::FontFace::promise):
        (WebCore::FontFace::backing):
        (WebCore::FontFace::create): Deleted.
        * css/FontFace.idl: Copied from Source/WebCore/bindings/js/JSDOMPromise.cpp.

2016-02-15  Jer Noble  <jer.noble@apple.com>

        Null-deref crash in DefaultAudioDestinationNode::suspend()
        https://bugs.webkit.org/show_bug.cgi?id=154248

        Reviewed by Alex Christensen.

        Drive-by fix: AudioContext should be a reference, not a pointer.

        * Modules/webaudio/AnalyserNode.cpp:
        (WebCore::AnalyserNode::AnalyserNode):
        * Modules/webaudio/AnalyserNode.h:
        (WebCore::AnalyserNode::create):
        * Modules/webaudio/AudioBasicInspectorNode.cpp:
        (WebCore::AudioBasicInspectorNode::AudioBasicInspectorNode):
        (WebCore::AudioBasicInspectorNode::connect):
        (WebCore::AudioBasicInspectorNode::disconnect):
        (WebCore::AudioBasicInspectorNode::checkNumberOfChannelsForInput):
        (WebCore::AudioBasicInspectorNode::updatePullStatus):
        * Modules/webaudio/AudioBasicInspectorNode.h:
        * Modules/webaudio/AudioBasicProcessorNode.cpp:
        (WebCore::AudioBasicProcessorNode::AudioBasicProcessorNode):
        (WebCore::AudioBasicProcessorNode::checkNumberOfChannelsForInput):
        * Modules/webaudio/AudioBasicProcessorNode.h:
        * Modules/webaudio/AudioBufferSourceNode.cpp:
        (WebCore::AudioBufferSourceNode::create):
        (WebCore::AudioBufferSourceNode::AudioBufferSourceNode):
        (WebCore::AudioBufferSourceNode::renderFromBuffer):
        (WebCore::AudioBufferSourceNode::setBuffer):
        (WebCore::AudioBufferSourceNode::startPlaying):
        (WebCore::AudioBufferSourceNode::looping):
        (WebCore::AudioBufferSourceNode::setLooping):
        * Modules/webaudio/AudioBufferSourceNode.h:
        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::AudioContext):
        (WebCore::AudioContext::createBufferSource):
        (WebCore::AudioContext::createMediaElementSource):
        (WebCore::AudioContext::createMediaStreamDestination):
        (WebCore::AudioContext::createScriptProcessor):
        (WebCore::AudioContext::createBiquadFilter):
        (WebCore::AudioContext::createWaveShaper):
        (WebCore::AudioContext::createPanner):
        (WebCore::AudioContext::createConvolver):
        (WebCore::AudioContext::createDynamicsCompressor):
        (WebCore::AudioContext::createAnalyser):
        (WebCore::AudioContext::createGain):
        (WebCore::AudioContext::createDelay):
        (WebCore::AudioContext::createChannelSplitter):
        (WebCore::AudioContext::createChannelMerger):
        (WebCore::AudioContext::createOscillator):
        * Modules/webaudio/AudioContext.h:
        (WebCore::operator==):
        (WebCore::operator!=):
        * Modules/webaudio/AudioDestinationNode.cpp:
        (WebCore::AudioDestinationNode::AudioDestinationNode):
        (WebCore::AudioDestinationNode::render):
        (WebCore::AudioDestinationNode::updateIsEffectivelyPlayingAudio):
        * Modules/webaudio/AudioDestinationNode.h:
        * Modules/webaudio/AudioNode.cpp:
        (WebCore::AudioNode::AudioNode):
        (WebCore::AudioNode::connect):
        (WebCore::AudioNode::disconnect):
        (WebCore::AudioNode::setChannelCount):
        (WebCore::AudioNode::setChannelCountMode):
        (WebCore::AudioNode::setChannelInterpretation):
        (WebCore::AudioNode::scriptExecutionContext):
        (WebCore::AudioNode::processIfNecessary):
        (WebCore::AudioNode::checkNumberOfChannelsForInput):
        (WebCore::AudioNode::propagatesSilence):
        (WebCore::AudioNode::pullInputs):
        (WebCore::AudioNode::enableOutputsIfNecessary):
        (WebCore::AudioNode::deref):
        (WebCore::AudioNode::finishDeref):
        * Modules/webaudio/AudioNode.h:
        (WebCore::AudioNode::context):
        * Modules/webaudio/AudioNodeInput.cpp:
        (WebCore::AudioNodeInput::connect):
        (WebCore::AudioNodeInput::disconnect):
        (WebCore::AudioNodeInput::disable):
        (WebCore::AudioNodeInput::enable):
        (WebCore::AudioNodeInput::updateInternalBus):
        (WebCore::AudioNodeInput::bus):
        (WebCore::AudioNodeInput::internalSummingBus):
        (WebCore::AudioNodeInput::sumAllConnections):
        (WebCore::AudioNodeInput::pull):
        * Modules/webaudio/AudioNodeOutput.cpp:
        (WebCore::AudioNodeOutput::setNumberOfChannels):
        (WebCore::AudioNodeOutput::updateNumberOfChannels):
        (WebCore::AudioNodeOutput::propagateChannelCount):
        (WebCore::AudioNodeOutput::pull):
        (WebCore::AudioNodeOutput::bus):
        (WebCore::AudioNodeOutput::fanOutCount):
        (WebCore::AudioNodeOutput::paramFanOutCount):
        (WebCore::AudioNodeOutput::addInput):
        (WebCore::AudioNodeOutput::removeInput):
        (WebCore::AudioNodeOutput::disconnectAllInputs):
        (WebCore::AudioNodeOutput::addParam):
        (WebCore::AudioNodeOutput::removeParam):
        (WebCore::AudioNodeOutput::disconnectAllParams):
        (WebCore::AudioNodeOutput::disable):
        (WebCore::AudioNodeOutput::enable):
        * Modules/webaudio/AudioNodeOutput.h:
        (WebCore::AudioNodeOutput::context):
        * Modules/webaudio/AudioParam.cpp:
        (WebCore::AudioParam::value):
        (WebCore::AudioParam::smooth):
        (WebCore::AudioParam::calculateSampleAccurateValues):
        (WebCore::AudioParam::calculateFinalValues):
        (WebCore::AudioParam::calculateTimelineValues):
        (WebCore::AudioParam::connect):
        (WebCore::AudioParam::disconnect):
        * Modules/webaudio/AudioParam.h:
        (WebCore::AudioParam::create):
        (WebCore::AudioParam::AudioParam):
        * Modules/webaudio/AudioParamTimeline.cpp:
        (WebCore::AudioParamTimeline::valueForContextTime):
        * Modules/webaudio/AudioParamTimeline.h:
        * Modules/webaudio/AudioScheduledSourceNode.cpp:
        (WebCore::AudioScheduledSourceNode::AudioScheduledSourceNode):
        (WebCore::AudioScheduledSourceNode::updateSchedulingInfo):
        (WebCore::AudioScheduledSourceNode::start):
        (WebCore::AudioScheduledSourceNode::finish):
        * Modules/webaudio/AudioScheduledSourceNode.h:
        * Modules/webaudio/AudioSummingJunction.cpp:
        (WebCore::AudioSummingJunction::AudioSummingJunction):
        (WebCore::AudioSummingJunction::~AudioSummingJunction):
        (WebCore::AudioSummingJunction::changedOutputs):
        (WebCore::AudioSummingJunction::updateRenderingState):
        * Modules/webaudio/AudioSummingJunction.h:
        (WebCore::AudioSummingJunction::context):
        * Modules/webaudio/BiquadFilterNode.cpp:
        (WebCore::BiquadFilterNode::BiquadFilterNode):
        * Modules/webaudio/BiquadFilterNode.h:
        (WebCore::BiquadFilterNode::create):
        * Modules/webaudio/BiquadProcessor.cpp:
        (WebCore::BiquadProcessor::BiquadProcessor):
        * Modules/webaudio/BiquadProcessor.h:
        * Modules/webaudio/ChannelMergerNode.cpp:
        (WebCore::ChannelMergerNode::create):
        (WebCore::ChannelMergerNode::ChannelMergerNode):
        (WebCore::ChannelMergerNode::checkNumberOfChannelsForInput):
        * Modules/webaudio/ChannelMergerNode.h:
        * Modules/webaudio/ChannelSplitterNode.cpp:
        (WebCore::ChannelSplitterNode::create):
        (WebCore::ChannelSplitterNode::ChannelSplitterNode):
        * Modules/webaudio/ChannelSplitterNode.h:
        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::ConvolverNode):
        (WebCore::ConvolverNode::setBuffer):
        * Modules/webaudio/ConvolverNode.h:
        (WebCore::ConvolverNode::create):
        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::DefaultAudioDestinationNode):
        (WebCore::DefaultAudioDestinationNode::resume):
        (WebCore::DefaultAudioDestinationNode::suspend):
        (WebCore::DefaultAudioDestinationNode::close):
        * Modules/webaudio/DefaultAudioDestinationNode.h:
        (WebCore::DefaultAudioDestinationNode::create):
        * Modules/webaudio/DelayNode.cpp:
        (WebCore::DelayNode::DelayNode):
        * Modules/webaudio/DelayNode.h:
        (WebCore::DelayNode::create):
        * Modules/webaudio/DelayProcessor.cpp:
        (WebCore::DelayProcessor::DelayProcessor):
        * Modules/webaudio/DelayProcessor.h:
        * Modules/webaudio/DynamicsCompressorNode.cpp:
        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
        * Modules/webaudio/DynamicsCompressorNode.h:
        (WebCore::DynamicsCompressorNode::create):
        * Modules/webaudio/GainNode.cpp:
        (WebCore::GainNode::GainNode):
        (WebCore::GainNode::checkNumberOfChannelsForInput):
        * Modules/webaudio/GainNode.h:
        (WebCore::GainNode::create):
        * Modules/webaudio/MediaElementAudioSourceNode.cpp:
        (WebCore::MediaElementAudioSourceNode::create):
        (WebCore::MediaElementAudioSourceNode::MediaElementAudioSourceNode):
        (WebCore::MediaElementAudioSourceNode::setFormat):
        * Modules/webaudio/MediaElementAudioSourceNode.h:
        * Modules/webaudio/MediaStreamAudioDestinationNode.cpp:
        (WebCore::MediaStreamAudioDestinationNode::create):
        (WebCore::MediaStreamAudioDestinationNode::MediaStreamAudioDestinationNode):
        * Modules/webaudio/MediaStreamAudioDestinationNode.h:
        * Modules/webaudio/MediaStreamAudioSourceNode.cpp:
        (WebCore::MediaStreamAudioSourceNode::MediaStreamAudioSourceNode):
        (WebCore::MediaStreamAudioSourceNode::setFormat):
        * Modules/webaudio/OfflineAudioDestinationNode.cpp:
        (WebCore::OfflineAudioDestinationNode::OfflineAudioDestinationNode):
        (WebCore::OfflineAudioDestinationNode::offlineRender):
        (WebCore::OfflineAudioDestinationNode::notifyComplete):
        * Modules/webaudio/OfflineAudioDestinationNode.h:
        (WebCore::OfflineAudioDestinationNode::create):
        * Modules/webaudio/OscillatorNode.cpp:
        (WebCore::OscillatorNode::create):
        (WebCore::OscillatorNode::OscillatorNode):
        * Modules/webaudio/OscillatorNode.h:
        * Modules/webaudio/PannerNode.cpp:
        (WebCore::PannerNode::PannerNode):
        (WebCore::PannerNode::pullInputs):
        (WebCore::PannerNode::process):
        (WebCore::PannerNode::listener):
        (WebCore::PannerNode::setPanningModel):
        * Modules/webaudio/PannerNode.h:
        (WebCore::PannerNode::create):
        * Modules/webaudio/ScriptProcessorNode.cpp:
        (WebCore::ScriptProcessorNode::create):
        (WebCore::ScriptProcessorNode::ScriptProcessorNode):
        (WebCore::ScriptProcessorNode::initialize):
        (WebCore::ScriptProcessorNode::fireProcessEvent):
        * Modules/webaudio/ScriptProcessorNode.h:
        * Modules/webaudio/WaveShaperNode.cpp:
        (WebCore::WaveShaperNode::WaveShaperNode):
        (WebCore::WaveShaperNode::setOversample):
        * Modules/webaudio/WaveShaperNode.h:
        (WebCore::WaveShaperNode::create):

2016-02-15  Jer Noble  <jer.noble@apple.com>

        Null-deref crash in DefaultAudioDestinationNode::suspend()
        https://bugs.webkit.org/show_bug.cgi?id=154248

        Reviewed by Alex Christensen.

        Null-check scriptExecutionContext() before deref.

        * Modules/webaudio/DefaultAudioDestinationNode.cpp:
        (WebCore::DefaultAudioDestinationNode::resume):
        (WebCore::DefaultAudioDestinationNode::suspend):
        (WebCore::DefaultAudioDestinationNode::close):

2016-02-15  Chris Dumez  <cdumez@apple.com>

        XMLHttpRequest / XMLHttpRequestUpload should inherit XMLHttpRequestEventTarget
        https://bugs.webkit.org/show_bug.cgi?id=154230

        Reviewed by Alex Christensen.

        MLHttpRequest / XMLHttpRequestUpload should inherit XMLHttpRequestEventTarget
        as per:
        https://xhr.spec.whatwg.org/#xmlhttprequesteventtarget

        Firefox and Chrome already match the specification.

        No new tests, already covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * xml/XMLHttpRequest.h:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestEventTarget.h: Added.
        * xml/XMLHttpRequestEventTarget.idl: Copied from Source/WebCore/xml/XMLHttpRequestUpload.idl.
        * xml/XMLHttpRequestUpload.h:
        * xml/XMLHttpRequestUpload.idl:

2016-02-15  Jiewen Tan  <jiewen_tan@apple.com>

        Refine SimulatedMouseEvent to support Event.isTrusted
        https://bugs.webkit.org/show_bug.cgi?id=154133
        <rdar://problem/24616246>

        Reviewed by Darin Adler.

        This patch extracts everything related to create/dispatch SimulatedMouseEvent from MouseEvent.h/cpp
        and EventDispatcher.h/cpp, and produces SimulateClick.h/cpp which will handle simulated click solely.
        After that, we hide the SimulatedMouseEvent and only expose simulateClick to be called. The reason is
        that we both want to tell whether the call sites are from user agent/bindings and keep the
        SimulatedMouseEvent intact.

        Also, this patch separate Element::dispatchSimulatedClick into two: one for the user agent, and another
        for the bindings. Therefore, HTMLElement.click will be treated as untrusted.

        Some of the changes in this patch referred Blink r200401:
        https://codereview.chromium.org/1285793004

        Modified test:
        LayoutTests/imported/blink/fast/events/event-trusted.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.cpp:
        (WebCore::Element::dispatchSimulatedClick):
        (WebCore::Element::dispatchSimulatedClickForBindings):
        * dom/Element.h:
        * dom/EventDispatcher.cpp:
        (WebCore::EventDispatcher::dispatchSimulatedClick): Deleted.
        * dom/EventDispatcher.h:
        * dom/MouseEvent.cpp:
        (WebCore::SimulatedMouseEvent::create): Deleted.
        (WebCore::SimulatedMouseEvent::~SimulatedMouseEvent): Deleted.
        (WebCore::SimulatedMouseEvent::SimulatedMouseEvent): Deleted.
        * dom/MouseEvent.h:
        * dom/SimulatedClick.cpp: Added.
        (WebCore::simulateMouseEvent):
        (WebCore::simulateClick):
        * dom/SimulatedClick.h: Added.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::click):

2016-02-15  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Web Workers have no access to console for debugging
        https://bugs.webkit.org/show_bug.cgi?id=26237

        Reviewed by Timothy Hatcher.

        This adds the most basic console message support to Workers.
        Messages logged from workers get surfaced through the Page's console.
        This lacks support for logging and interacting with arguments,
        which would be addressed when adding more complete Worker
        debugging tools.

        Test: inspector/console/messageAdded-from-worker.html

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::~WorkerScriptController):
        (WebCore::WorkerScriptController::initScript):
        Set the ConsoleClient for the Worker's global object. We route
        the messages to the Page's console.

        * bindings/js/WorkerScriptController.h:
        * workers/WorkerConsoleClient.h: Added.
        * workers/WorkerConsoleClient.cpp: Added.
        (WebCore::WorkerConsoleClient::WorkerConsoleClient):
        (WebCore::WorkerConsoleClient::~WorkerConsoleClient):
        (WebCore::WorkerConsoleClient::profile):
        (WebCore::WorkerConsoleClient::profileEnd):
        (WebCore::WorkerConsoleClient::count):
        (WebCore::WorkerConsoleClient::time):
        (WebCore::WorkerConsoleClient::timeEnd):
        (WebCore::WorkerConsoleClient::timeStamp):
        Stub most console methods in a Worker.

        (WebCore::WorkerConsoleClient::messageWithTypeAndLevel):
        Send worker log messages to the global scope and on to the main page.

        * workers/WorkerGlobalScope.h:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::addConsoleMessage):
        (WebCore::WorkerGlobalScope::addMessageToWorkerConsole):
        Ideally we want to converge on simple addConsoleMessage
        APIs that just take a ConsoleMessage, without a barrage
        of parameters. Add these versions now.

2016-02-15  Alex Christensen  <achristensen@webkit.org>

        CMake build fix.

        * PlatformMac.cmake:

2016-02-15  Chris Dumez  <cdumez@apple.com>

        Regression(r196563): It is no longer possible to call window.addEventListener without an explicit 'this'
        https://bugs.webkit.org/show_bug.cgi?id=154245

        Reviewed by Ryosuke Niwa.

        This patch adds support for calling the EventListener API without an
        explicit 'this' value. If no explicit 'this' value is passed, then we
        fall back to using the global object. This matches Chrome and Firefox's
        behavior. It also fixes the Dromaeo/cssquery-dojo.html test.

        Test: fast/dom/Window/addEventListener-implicit-this.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateFunctionCastedThis):

2016-02-14  Gavin Barraclough  <barraclough@apple.com>

        Organize, deduplicate & comment JSDOMWindowCustom getOwnPropertySlot
        https://bugs.webkit.org/show_bug.cgi?id=154224

        Reviewed by Chris Dumez.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
        (WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
            - organized property access sequence into a more logical order, removed
              duplicated code & added comments.
        (WebCore::namedItemGetter): Deleted.
            - there was no need for a custom callback here; merged functionality into
              jsDOMWindowGetOwnPropertySlotNamedItemGetter.
        (WebCore::jsDOMWindowGetOwnPropertySlotCrossOrigin): Deleted.
            - renamed to jsDOMWindowGetOwnPropertySlotRestrictedAccess
              (this now also handles frameless access).

2016-02-15  Daniel Bates  <dabates@apple.com>

        CSP: 'sandbox' should be ignored in report-only mode
        https://bugs.webkit.org/show_bug.cgi?id=153167
        <rdar://problem/22708669>

        Reviewed by Brent Fulgham.

        Merged from Blink (patch by Mike West):
        <https://src.chromium.org/viewvc/blink?revision=165322&view=revision>

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode): Added. Logs a
        console message to the console to explain that the specified directive is invalid in
        report-only mode.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::applySandboxPolicy): Do not apply sandbox
        policy when in report-only mode and call ContentSecurityPolicy::reportInvalidDirectiveInReportOnlyMode()
        to log a message to the console.

2016-02-15  Daniel Bates  <dabates@apple.com>

        CSP: Allow schemeless source expressions to match an HTTP or HTTPS resource
        https://bugs.webkit.org/show_bug.cgi?id=154177
        <rdar://problem/22708772>

        Reviewed by Brent Fulgham.

        Allow a schemeless source expression to match an HTTP or HTTPS subresource when the page is
        delivered over HTTP as per section Matching Source Expressions of the Content Security Policy
        2.0 spec., <https://www.w3.org/TR/2015/CR-CSP2-20150721/> (21 July 2015).

        Currently we have logic that implements this functionality, but it is guarded behind the compile-
        time macro ENABLE(CSP_NEXT) that is disabled by default. Instead we should always compile such
        code. In subsequent commits we will move more code out from under the ENABLE(CSP_NEXT)-guard
        towards removing the ENABLE_CSP_NEXT macro entirely.

        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::protocolMatchesSelf):

2016-02-15  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Consolidated Linux-specific file lists.
        https://bugs.webkit.org/show_bug.cgi?id=154219

        Reviewed by Gyuyoung Kim.

        No new tests needed.

        * PlatformEfl.cmake: Moved Linux files and include dir to Linux.cmake.
        * PlatformGTK.cmake: Ditto.
        * platform/Linux.cmake: Added.

2016-02-15  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !(ENABLE(SVG_FONTS) || ENABLE(SVG_OTF_CONVERTER)) build after r196322
        https://bugs.webkit.org/show_bug.cgi?id=154104

        Reviewed by Myles C. Maxfield.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::CSSFontFaceSource):

2016-02-14  Antti Koivisto  <antti@apple.com>

        Add test for class change style invalidation optimization
        https://bugs.webkit.org/show_bug.cgi?id=154226

        Reviewed by Myles Maxfield.

        Test for https://trac.webkit.org/r196383

        Add internals.styleChangeType function.

        Test: fast/css/style-invalidation-class-change-descendants.html

        * testing/Internals.cpp:
        (WebCore::Internals::nodeNeedsStyleRecalc):
        (WebCore::asString):
        (WebCore::Internals::styleChangeType):
        (WebCore::Internals::description):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-14  Simon Fraser  <simon.fraser@apple.com>

        [CSS Filters] When applying an SVG filter on a composited image using CSS the image is rendered without the filter
        https://bugs.webkit.org/show_bug.cgi?id=154108

        Reviewed by Sam Weinig.
        
        When checking whether we can directly composite an image, we need to check for software-rendered
        filters.

        Test: compositing/filters/simple-image-with-svg-filter.html

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::isDirectlyCompositedImage):

2016-02-14  Chris Dumez  <cdumez@apple.com>

        Drop the [EventTarget] WebKit-specific IDL extended attribute
        https://bugs.webkit.org/show_bug.cgi?id=154171

        Reviewed by Sam Weinig.

        Drop the [EventTarget] WebKit-specific IDL extended attribute now that
        all interfaces inherit EventTarget when they should.

        No new tests, no Web-Exposed behavior change.

        * Modules/battery/BatteryManager.idl:
        * Modules/encryptedmedia/MediaKeySession.idl:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBOpenDBRequest.idl:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.idl:
        * Modules/mediasession/MediaRemoteControls.idl:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/MediaStreamTrack.idl:
        * Modules/mediastream/RTCDTMFSender.idl:
        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/notifications/Notification.idl:
        * Modules/speech/SpeechSynthesisUtterance.idl:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/AudioNode.idl:
        * Modules/webaudio/OfflineAudioContext.idl:
        * Modules/websockets/WebSocket.idl:
        * bindings/scripts/CodeGeneratorGObject.pm:
        (ImplementsInterface):
        (SkipFunction): Deleted.
        (GenerateCFile): Deleted.
        * bindings/scripts/CodeGeneratorJS.pm:
        (InstanceNeedsVisitChildren):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/TestEventTarget.idl:
        * bindings/scripts/test/TestNode.idl:
        * css/FontLoader.idl:
        * dom/EventTarget.idl:
        * dom/MessagePort.idl:
        * dom/Node.idl:
        * dom/WebKitNamedFlow.idl:
        * fileapi/FileReader.idl:
        * html/MediaController.idl:
        * html/track/AudioTrackList.idl:
        * html/track/TextTrack.idl:
        * html/track/TextTrackCue.idl:
        * html/track/TextTrackList.idl:
        * html/track/VideoTrackList.idl:
        * loader/appcache/DOMApplicationCache.idl:
        * page/DOMWindow.idl:
        * page/EventSource.idl:
        * page/Performance.idl:
        * workers/WorkerGlobalScope.idl:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestUpload.idl:

2016-02-14  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix the Mac CMake build after r196136

        * PlatformMac.cmake:

2016-02-14  Chris Dumez  <cdumez@apple.com>

        Unreviewed attempt to fix the Windows build.

        * Modules/webdatabase/Database.cpp:
        * bridge/c/c_utility.cpp:
        * platform/MemoryPressureHandler.cpp:

2016-02-14  Chris Dumez  <cdumez@apple.com>

        Window and WorkerGlobalScope should inherit EventTarget
        https://bugs.webkit.org/show_bug.cgi?id=154170
        <rdar://problem/24642377>

        Reviewed by Darin Adler.

        Window and WorkerGlobalScope should inherit EventTarget instead of
        duplicating the EventTarget API in their IDL. These were the last
        interfaces that needed fixing. The next step will be to get rid
        of the [EventTarget] IDL extended attribute and rely entirely
        on the EventTarget inheritance.

        Test:
        - fast/frames/detached-frame-eventListener.html
        - Covered by existing tests.

        * WebCore.xcodeproj/project.pbxproj:
        Add JSEventTargetCustom.h header to the project.

        * bindings/js/JSDOMWindowCustom.cpp:
        Drop custom bindings for Window's addEventListener() and
        removeEventListener(). The only reason these needed custom
        code was to add a check for frameless windows. The frameless
        Window checks was moved to the respective methods in the
        JSEventTarget generated bindings.

        * bindings/js/JSDOMWindowShell.cpp:
        (WebCore::JSDOMWindowShell::setWindow):
        Set WindowPrototype's prototype to EventTarget's prototype.

        * bindings/js/JSDOMWindowShell.h:
        * bindings/js/JSDictionary.cpp:
        Include "DOMWindow.h" to fix the build.

        * bindings/js/JSEventTargetCustom.cpp:
        (WebCore::JSEventTarget::toWrapped):
        Handle DOMWindow and WorkerGlobalScope explicitely in toWrapped()
        and get rid of the DOM_EVENT_TARGET_INTERFACES_FOR_EACH(TRY_TO_UNWRAP_WITH_INTERFACE)
        now that all interfaces inherit EventTarget when they should.
        The reason DOMWindow and WorkerGlobalScope still need special
        handling is because their wrappers (JSDOMWindow /
        JSWorkerGlobalScope) do not subclass JSEventTarget.

        (WebCore::JSEventTargetOrGlobalScope::create):
        * bindings/js/JSEventTargetCustom.h: Added.
        (WebCore::JSEventTargetOrGlobalScope::wrapped):
        (WebCore::JSEventTargetOrGlobalScope::operator JSC::JSObject&):
        (WebCore::JSEventTargetOrGlobalScope::JSEventTargetOrGlobalScope):
        Add a wrapper type for JSEventTarget / JSDOMWindow and
        JSWorkerGlobalScope for use in the generated bindings. This is
        needed because JSDOMWindow and JSWorkerGlobalScope do not
        subclass JSEventTarget. Subclassing JSEventTarget would be
        complicated for them because they already subclass
        JSDOMWindowBase / JSWorkerGlobalScopeBase, which subclasses
        JSDOMGlobalObject.

        * bindings/js/WorkerScriptController.cpp:
        (WebCore::WorkerScriptController::initScript):
        Set WorkerGlobalScopePrototype's prototype to EventTarget's prototype.

        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldGenerateToJSDeclaration):
        Do not generate to toJS() implementation for interfaces that use
        the [CustomProxyToJSObject] IDL extended attribute, even if they
        inherit EventTarget.

        (GetCastingHelperForThisObject):
        To initialize castedThis from thisValue JSValue, we now use the
        JSEventTargetOrGlobalScope wrapper for the EventTarget
        implementation. This is to work around the fact that JSDOMWindow
        and JSWorkerGlobalScope do not subclass JSEventTarget.

        (GenerateFunctionCastedThis):
        - Drop code handling [WorkerGlobalScope] IDL extended attribute
          as there is no such attribute.
        - Use auto instead of auto* type for castedThis because
          JSEventTargetOrGlobalScope::create() returns a unique_ptr.
        - Do not check that castedThis inherits JSEventTarget in the
          EventTarget bindings code as this no longer holds true.

        (GenerateImplementation):
        Generate frameless window() and security checks for EventTarget
        methods when thisValue is a JSDOMWindow.

        * dom/EventTarget.idl:
        Add [JSCustomHeader] IDL Extended attribute as we need a header
        to expose JSEventTargetOrGlobalScope class.

        * page/DOMWindow.idl:
        * workers/WorkerGlobalScope.idl:
        Inherit EventTarget and stop duplicating the EventTarget API.
        This matches the HTML specification.

2016-02-14  Darin Adler  <darin@apple.com>

        Small tweaks to some SimpleLineLayout code
        https://bugs.webkit.org/show_bug.cgi?id=154229

        Reviewed by Zalan Bujtas.

        * rendering/SimpleLineLayoutFunctions.cpp:
        (WebCore::SimpleLineLayout::paintFlow): Use std::ceil instead of ceilf.
        Use auto instead of const auto& for a for loop where the local object is
        copied and not a reference.
        (WebCore::SimpleLineLayout::hitTestFlow): Use modern for loop.
        (WebCore::SimpleLineLayout::collectFlowOverflow): Use std::ceil instead of
        ceilf. Use a modern for loop, and use slightly more descriptive local
        variable names.
        (WebCore::SimpleLineLayout::computeBoundingBox): Use auto instead of
        const auto& as above.
        (WebCore::SimpleLineLayout::computeFirstRunLocation): Use auto and use
        the name "range" for the range rather than the name "it", since the range
        is not an iterator.
        (WebCore::SimpleLineLayout::collectAbsoluteRects): Use auto instead of
        const auto& as above.
        (WebCore::SimpleLineLayout::collectAbsoluteQuads): Ditto.
        (WebCore::SimpleLineLayout::showLineLayoutForFlow): Use modern for loop.

        * rendering/SimpleLineLayoutResolver.cpp:
        (WebCore::SimpleLineLayout::RunResolver::Run::text): Convert from a String
        to a StringView using the StringView constructor instead of writing out
        explicit 8-bit and 16-bit cases.

2016-02-13  Antti Koivisto  <antti@apple.com>

        Factor class change style invalidation code into a class
        https://bugs.webkit.org/show_bug.cgi?id=154163

        Reviewed by Andreas Kling.

        Factor this piece of functionality out of Element and into ClassChangeInvalidation class.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.cpp:
        (WebCore::classStringHasClassName):
        (WebCore::Element::classAttributeChanged):
        (WebCore::collectClasses): Deleted.
        (WebCore::computeClassChange): Deleted.
        (WebCore::invalidateStyleForClassChange): Deleted.
        * style/ClassChangeInvalidation.cpp: Added.
        (WebCore::Style::ClassChangeInvalidation::computeClassChange):
        (WebCore::Style::ClassChangeInvalidation::invalidateStyle):
        * style/ClassChangeInvalidation.h: Added.
        (WebCore::Style::ClassChangeInvalidation::needsInvalidation):
        (WebCore::Style::ClassChangeInvalidation::ClassChangeInvalidation):
        (WebCore::Style::ClassChangeInvalidation::~ClassChangeInvalidation):

2016-02-13  Myles C. Maxfield  <mmaxfield@apple.com>

        [Win] [SVG -> OTF Converter] SVG fonts drawn into ImageBuffers are invisible
        https://bugs.webkit.org/show_bug.cgi?id=154222

        Reviewed by Antti Koivisto.

        Windows ImageBuffer code is sensitive to broken bounding box and
        descent code.

        Covered by existing tests.

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::appendHHEATable):
        (WebCore::SVGToOTFFontConverter::appendOS2Table):
        (WebCore::SVGToOTFFontConverter::processGlyphElement):
        (WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter):

2016-02-13  Antti Koivisto  <antti@apple.com>

        Add version number for default stylesheet
        https://bugs.webkit.org/show_bug.cgi?id=154220

        Reviewed by Ryosuke Niwa.

        We currently fail to update RuleFeatureSets for shadow trees when the default stylesheet grows
        (for example when media controls stylesheet is initialized).

        No test since this is not causing known bugs. It is blocking optimizations in shadow trees that
        rely on rule features being up-to-date.

        * css/CSSDefaultStyleSheets.cpp:
        (WebCore::CSSDefaultStyleSheets::loadSimpleDefaultStyle):
        (WebCore::CSSDefaultStyleSheets::ensureDefaultStyleSheetsForElement):

            Increment version number when the default stylesheet changes.

        * css/CSSDefaultStyleSheets.h:
        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::appendAuthorStyleSheets):
        (WebCore::DocumentRuleSets::collectFeatures):

            Store the current default stylesheet version number.

        * css/DocumentRuleSets.h:
        (WebCore::DocumentRuleSets::features):

            Collect features again if the default stylesheet has changed.

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForElement):

2016-02-13  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Consolidate building of GStreamer and OpenWebRTC code.
        https://bugs.webkit.org/show_bug.cgi?id=154116

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * PlatformEfl.cmake: Migrated shared code to GStreamer.cmake.
        * PlatformGTK.cmake: Ditto.
        * platform/GStreamer.cmake: Added.

2016-02-13  Mark Lam  <mark.lam@apple.com>

        Add thread violation checks to WebView public APIs.
        https://bugs.webkit.org/show_bug.cgi?id=154183

        Reviewed by Timothy Hatcher.

        No new tests.  Just adding a new thread violation round.

        * platform/ThreadCheck.h:
        * platform/mac/ThreadCheck.mm:
        - Adding WebCoreThreadViolationCheckRoundThree().

2016-02-12  Nan Wang  <n_wang@apple.com>

        AX: Implement paragraph related text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=154098
        <rdar://problem/24269675>

        Reviewed by Chris Fleizach.

        Using CharacterOffset to implement paragraph related text marker calls. Reused
        logic from VisibleUnits class. And refactored textMarkerForCharacterOffset method
        to get better performance. Also fixed an issue where we can't navigate through a text
        node with line breaks in it using next/previousCharacterOffset call.

        Test: accessibility/mac/text-marker-paragraph-nav.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
        (WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
        (WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
        (WebCore::AXObjectCache::textMarkerDataForNextCharacterOffset):
        (WebCore::AXObjectCache::textMarkerDataForPreviousCharacterOffset):
        (WebCore::AXObjectCache::nextNode):
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
        (WebCore::AXObjectCache::nextCharacterOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::startWordBoundary):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::endCharacterOffsetOfWord):
        (WebCore::AXObjectCache::previousWordStartCharacterOffset):
        (WebCore::AXObjectCache::previousWordBoundary):
        (WebCore::AXObjectCache::startCharacterOffsetOfParagraph):
        (WebCore::AXObjectCache::endCharacterOffsetOfParagraph):
        (WebCore::AXObjectCache::paragraphForCharacterOffset):
        (WebCore::AXObjectCache::nextParagraphEndCharacterOffset):
        (WebCore::AXObjectCache::previousParagraphStartCharacterOffset):
        (WebCore::AXObjectCache::rootAXEditableElement):
        * accessibility/AXObjectCache.h:
        (WebCore::CharacterOffset::remaining):
        (WebCore::CharacterOffset::isNull):
        (WebCore::CharacterOffset::isEqual):
        (WebCore::AXObjectCache::isNodeInUse):
        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (+[WebAccessibilityTextMarker textMarkerWithCharacterOffset:cache:]):
        (-[WebAccessibilityObjectWrapper nextMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper previousMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper rangeForTextMarkers:]):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (startOrEndTextmarkerForRange):
        (nextTextMarkerForCharacterOffset):
        (previousTextMarkerForCharacterOffset):
        (-[WebAccessibilityObjectWrapper nextTextMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper previousTextMarkerForCharacterOffset:]):
        (-[WebAccessibilityObjectWrapper textMarkerForCharacterOffset:]):
        (textMarkerForCharacterOffset):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
        (-[WebAccessibilityObjectWrapper nextTextMarkerForNode:offset:]): Deleted.
        (-[WebAccessibilityObjectWrapper previousTextMarkerForNode:offset:]): Deleted.
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:ignoreStart:]): Deleted.
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:]): Deleted.
        * editing/VisibleUnits.cpp:
        (WebCore::nextSentencePosition):
        (WebCore::findStartOfParagraph):
        (WebCore::findEndOfParagraph):
        (WebCore::startOfParagraph):
        (WebCore::endOfParagraph):
        * editing/VisibleUnits.h:

2016-02-12  Ryan Haddad  <ryanhaddad@apple.com>

        Reset results for bindings tests after r196520

        Unreviewed test gardening.

        No new tests needed.

        * bindings/scripts/test/GObject/WebKitDOMTestEventTarget.cpp:
        (webkit_dom_test_event_target_dispatch_event):
        * bindings/scripts/test/GObject/WebKitDOMTestNode.cpp:
        (webkit_dom_test_node_dispatch_event):

2016-02-12  Saam barati  <sbarati@apple.com>

        Attempting build fix from https://bugs.webkit.org/show_bug.cgi?id=154144.

        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):

2016-02-12  Daniel Bates  <dabates@apple.com>

        CSP: 'blob:' URLs should not match 'self' in CSP source expression lists.
        https://bugs.webkit.org/show_bug.cgi?id=153158
        <rdar://problem/24383264>

        Reviewed by Brent Fulgham.

        A blob URL should not match source 'self' by section Security Considerations for GUID URL schemes
        of the Content Security Policy 2.0 spec., <https://www.w3.org/TR/CSP2/> (21 July 2015).

        Tests: http/tests/security/contentSecurityPolicy/blob-url-does-not-match-source-self.html
               http/tests/security/contentSecurityPolicy/blob-url-matches-source-blob.html

        * page/csp/ContentSecurityPolicySourceList.cpp:
        (WebCore::ContentSecurityPolicySourceList::matches): Do not make a distinction between URLs that
        contain a nested URL (e.g. blob://http://www.example.com/...) and URLs that do not contain a nested
        URL. The URL of the requested resource should be matched against the source list source expressions.

2016-02-12  Daniel Bates  <dabates@apple.com>

        CSP: Implement child-src directive
        https://bugs.webkit.org/show_bug.cgi?id=153562
        <rdar://problem/24610087>

        Reviewed by Brent Fulgham.

        Add support for the child-src directive, <https://w3c.github.io/webappsec-csp/2/#child_src> (29 August 2015),
        which formally replaces the deprecated frame-src directive as of the Content Security Policy 2.0 spec. The
        child-src directive was first introduced in the Content Security Policy 1.1 spec, <https://www.w3.org/TR/2014/WD-CSP11-20140211/>.

        As a side effect of this change, the script URL for a Web Worker is checked against the child-src directive
        as opposed to the script-src directive. This is a backward incompatible change from the CSP 1.0 spec.

        Tests: http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/child-src/frame-fires-load-event-when-redirect-blocked.html
               http/tests/security/contentSecurityPolicy/1.1/child-src/frame-src-takes-precedence-over-child-src.html
               http/tests/security/contentSecurityPolicy/1.1/child-src/worker-redirect-blocked.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker-redirect.html

        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Check child-src directive (if applicable).
        * loader/ThreadableLoader.h: Add enum value EnforceChildSrcDirective to enum class ContentSecurityPolicyEnforcement to
        enforce the child-src directive on redirect.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::allowChildContextFromSource): Added.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirectiveList.cpp:
        (WebCore::ContentSecurityPolicyDirectiveList::checkSourceAndReportViolation): Add message prefix for a child-src violation.
        We use the same message prefix as used by Blink.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildContextFromSource): Added.
        (WebCore::ContentSecurityPolicyDirectiveList::allowChildFrameFromSource): Modified to check the frame-src
        directive (if specified) before checking the child-src directive by <https://w3c.github.io/webappsec-csp/2/#directive-child-src-nested>.
        (WebCore::ContentSecurityPolicyDirectiveList::addDirective): Parse the child-src directive.
        * page/csp/ContentSecurityPolicyDirectiveList.h:
        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::resolveURL): Check if the script URL for the worker is allowed by the child-src directive
        as opposed to the script-src directive. This is a backwards incompatible change from the CSP 1.0 spec.
        * workers/Worker.cpp:
        (WebCore::Worker::create): Enforce the child-src directive on redirects (if applicable).

2016-02-12  Saam barati  <sbarati@apple.com>

        The parser doesn't properly protect against global variable references in builtins
        https://bugs.webkit.org/show_bug.cgi?id=154144

        Reviewed by Geoffrey Garen.

        Change JS builtins to no longer reference global variables.

        No new tests because old tests cover the issues here.

        * Modules/mediastream/NavigatorUserMedia.js:
        (webkitGetUserMedia):
        * Modules/mediastream/RTCPeerConnection.js:
        (addIceCandidate):
        (getStats):
        * Modules/mediastream/RTCPeerConnectionInternals.js:
        (setLocalOrRemoteDescription):
        * Modules/plugins/QuickTimePluginReplacement.js:
        (Replacement.prototype.handleEvent):
        * Modules/streams/ByteLengthQueuingStrategy.js:
        (initializeByteLengthQueuingStrategy):
        * Modules/streams/CountQueuingStrategy.js:
        (initializeCountQueuingStrategy):
        * Modules/streams/ReadableStreamInternals.js:
        (teeReadableStream):
        * bindings/js/JSDOMGlobalObject.cpp:
        (WebCore::JSDOMGlobalObject::addBuiltinGlobals):
        * bindings/js/WebCoreBuiltinNames.h:

2016-02-12  Jiewen Tan  <jiewen_tan@apple.com>

        WebKit should expose the DOM 4 Event.isTrusted property
        https://bugs.webkit.org/show_bug.cgi?id=76121
        <rdar://problem/22558494>

        Reviewed by Darin Adler.

        Implements Event.isTrusted. The implementation here is slitely different from and better than
        the DOM specification. Here Event.isTrusted will be initialized differently depending on the
        callers of the constructors/create methods. If the caller is from user agent, the isTrusted
        will be true. Otherwise, it will be false. Since a user agent dispatched event can be catched
        and re-initialized/redispatched by the bindings, the flag will be unset at *Event::init*Event
        and EventTarget::dispatchEventForBindings. As currently there is no way to let user agent to
        dispatch a bindings created event, therefore we ensure that the Event.isTrusted is set for
        events dispatched by user agent, and unset for those by bindings.

        EventTarget::dispatchEvent(Event*, ExceptionCode&) is renamed to EventTarget::dispatchEventForBindings
        in this patch as well. So that, together with the improved design of the API, developers in
        the future will be less likely using a wrong dispatchEvent method and setting Event.isTrusted
        incorrectly comparing to the DOM design.

        After this patch, all events that are created by user agent should be dispatched by
        EventTarget::dispatchEvent, and those are created by bindings should be dispatched by
        EventTarget::dispatchEventForBindings.

        Some of the changes in this patch referred Blink r198996:
        https://codereview.chromium.org/1241613004

        Test: imported/blink/fast/events/event-trusted.html

        * bindings/scripts/CodeGeneratorGObject.pm:
        (GenerateEventTargetIface):
        * dom/Event.cpp:
        (WebCore::Event::Event):
        (WebCore::Event::initEvent):
        * dom/Event.h:
        (WebCore::Event::isTrusted):
        (WebCore::Event::setUntrusted):
        * dom/Event.idl:
        * dom/EventTarget.cpp:
        (WebCore::EventTarget::dispatchEventForBindings):
        (WebCore::EventTarget::dispatchEvent): Deleted.
        * dom/EventTarget.h:
        * dom/EventTarget.idl:
        * page/DOMWindow.idl:
        * page/EventHandler.cpp:
        (WebCore::EventHandler::dispatchDragEvent):
        * workers/WorkerGlobalScope.idl:

2016-02-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDBObjectStore and IDBIndex need to be ActiveDOMObjects.
        https://bugs.webkit.org/show_bug.cgi?id=154153

        Reviewed by Alex Christensen.

        No new tests (No testable change in behavior).

        This is needed so that IDBObjectStore and IDBIndex JS wrappers are not garbage collected
        while their IDBTransaction is still in progress.

        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::IDBIndex):
        (WebCore::IDBClient::IDBIndex::activeDOMObjectName):
        (WebCore::IDBClient::IDBIndex::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBIndex::hasPendingActivity):
        * Modules/indexeddb/client/IDBIndexImpl.h:
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::create):
        (WebCore::IDBClient::IDBObjectStore::IDBObjectStore):
        (WebCore::IDBClient::IDBObjectStore::activeDOMObjectName):
        (WebCore::IDBClient::IDBObjectStore::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBObjectStore::hasPendingActivity):
        (WebCore::IDBClient::IDBObjectStore::index):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::objectStore):
        (WebCore::IDBClient::IDBTransaction::createObjectStore):
        (WebCore::IDBClient::IDBTransaction::createIndex):

2016-02-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: Simplify the relationship between IDBObjectStore and IDBIndex.
        https://bugs.webkit.org/show_bug.cgi?id=154187

        Reviewed by Alex Christensen.

        Tests: storage/indexeddb/modern/deleteindex-3-private.html
               storage/indexeddb/modern/deleteindex-3.html

        Instead of allowing IDBIndex to have two different lifecycle modes, it is now always
        owned by an IDBObjectStore.
        
        To support the case where an IDBIndex is deleted from its IDBObjectStore, the object
        store simply hangs on to deleted indexes until it is destroyed itself.
        
        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::markAsDeleted):
        (WebCore::IDBClient::IDBIndex::ref):
        (WebCore::IDBClient::IDBIndex::deref):
        * Modules/indexeddb/client/IDBIndexImpl.h:
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::deleteIndex):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:

2016-02-12  Myles C. Maxfield  <mmaxfield@apple.com>

        [CSS Font Loading] Implement CSSFontFace Boilerplate
        https://bugs.webkit.org/show_bug.cgi?id=154145

        Reviewed by Dean Jackson.

        The CSS Font Loading spec[1] dictates that the FontFace object needs to have string
        accessors and mutators for a bunch of properties. Our CSSFontFace object currently
        contains this parsed information, but it isn't accessible via string-based methods.
        This patch adds the necessary accessors and mutators, and migrates CSSFontSelector
        to use these mutators where necessary.

        There is more work to come on CSSFontFace; the next step is to create an .idl file
        and hook it up to our CSSFontFace object. In this patch I have left some
        unimplemented pieces (for example: where the spec dictates that some operation should
        throw a JavaScript exception) which will be implemented in a follow-up patch. This
        patch does not have any visible behavior change; I'm separating out the boilerplate
        into this patch in order to ease reviewing burden.

        This patch separates the externally-facing JavaScript API into a new class, FontFace.
        This class owns a CSSFontFace, which provides the backing implementation. There will
        be a system of shared ownership of these objects once FontFaceSet is implemented.

        No new tests because there is no behavior change.

        * CMakeLists.txt: Add new files to CMake builds.
        * WebCore.vcxproj/WebCore.vcxproj: Ditto for Windows.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto for Cocoa.
        * css/CSSAllInOne.cpp: Ditto for All-In-One builds.
        * css/CSSFontFace.cpp: Move shared code from CSSFontSelector into CSSFontFace.
        (WebCore::CSSFontFace::CSSFontFace):
        (WebCore::CSSFontFace::~CSSFontFace):
        (WebCore::CSSFontFace::setFamilies):
        (WebCore::CSSFontFace::setStyle):
        (WebCore::CSSFontFace::setWeight):
        (WebCore::CSSFontFace::setUnicodeRange):
        (WebCore::CSSFontFace::setVariantLigatures):
        (WebCore::CSSFontFace::setVariantPosition):
        (WebCore::CSSFontFace::setVariantCaps):
        (WebCore::CSSFontFace::setVariantNumeric):
        (WebCore::CSSFontFace::setVariantAlternates):
        (WebCore::CSSFontFace::setVariantEastAsian):
        (WebCore::CSSFontFace::setFeatureSettings):
        * css/CSSFontFace.h: Clean up.
        (WebCore::CSSFontFace::create):
        (WebCore::CSSFontFace::families):
        (WebCore::CSSFontFace::traitsMask):
        (WebCore::CSSFontFace::featureSettings):
        (WebCore::CSSFontFace::variantSettings):
        (WebCore::CSSFontFace::setVariantSettings):
        (WebCore::CSSFontFace::setTraitsMask):
        (WebCore::CSSFontFace::isLocalFallback):
        (WebCore::CSSFontFace::addRange): Deleted.
        (WebCore::CSSFontFace::insertFeature): Deleted.
        (WebCore::CSSFontFace::setVariantCommonLigatures): Deleted.
        (WebCore::CSSFontFace::setVariantDiscretionaryLigatures): Deleted.
        (WebCore::CSSFontFace::setVariantHistoricalLigatures): Deleted.
        (WebCore::CSSFontFace::setVariantContextualAlternates): Deleted.
        (WebCore::CSSFontFace::setVariantPosition): Deleted.
        (WebCore::CSSFontFace::setVariantCaps): Deleted.
        (WebCore::CSSFontFace::setVariantNumericFigure): Deleted.
        (WebCore::CSSFontFace::setVariantNumericSpacing): Deleted.
        (WebCore::CSSFontFace::setVariantNumericFraction): Deleted.
        (WebCore::CSSFontFace::setVariantNumericOrdinal): Deleted.
        (WebCore::CSSFontFace::setVariantNumericSlashedZero): Deleted.
        (WebCore::CSSFontFace::setVariantAlternates): Deleted.
        (WebCore::CSSFontFace::setVariantEastAsianVariant): Deleted.
        (WebCore::CSSFontFace::setVariantEastAsianWidth): Deleted.
        (WebCore::CSSFontFace::setVariantEastAsianRuby): Deleted.
        (WebCore::CSSFontFace::CSSFontFace): Deleted.
        * css/CSSFontSelector.cpp: Migrate shared code into CSSFontFace, and udpate
        to use the new API.
        (WebCore::appendSources):
        (WebCore::registerLocalFontFacesForFamily):
        (WebCore::CSSFontSelector::addFontFaceRule):
        (WebCore::computeTraitsMask): Deleted.
        (WebCore::createFontFace): Deleted.
        * css/FontFace.cpp: Added. External JavaScript API. Owns a CSSFontFace.
        (WebCore::FontFace::FontFace):
        (WebCore::FontFace::~FontFace):
        (WebCore::parseString):
        (WebCore::FontFace::setFamily):
        (WebCore::FontFace::setStyle):
        (WebCore::FontFace::setWeight):
        (WebCore::FontFace::setStretch):
        (WebCore::FontFace::setUnicodeRange):
        (WebCore::FontFace::setVariant):
        (WebCore::FontFace::setFeatureSettings):
        (WebCore::FontFace::family):
        (WebCore::FontFace::style):
        (WebCore::FontFace::weight):
        (WebCore::FontFace::stretch):
        (WebCore::FontFace::unicodeRange):
        (WebCore::FontFace::variant):
        (WebCore::FontFace::featureSettings):
        * css/FontFace.h: Added. Ditto.
        (WebCore::FontFace::create):
        * css/FontVariantBuilder.cpp: Added. Moved code here from FontVariantBuilder.h.
        Refactored to support a new client (CSSFontFace).
        (WebCore::extractFontVariantLigatures):
        (WebCore::extractFontVariantNumeric):
        (WebCore::extractFontVariantEastAsian):
        (WebCore::computeFontVariant):
        * css/FontVariantBuilder.h: Moved code from here into FontVariantBuilder.cpp.
        (WebCore::applyValueFontVariantLigatures): Deleted.
        (WebCore::applyValueFontVariantNumeric): Deleted.
        (WebCore::applyValueFontVariantEastAsian): Deleted.
        * css/StyleBuilderCustom.h: Update for new FontVariantBuilder API.
        (WebCore::StyleBuilderCustom::applyValueFontVariantLigatures):
        (WebCore::StyleBuilderCustom::applyValueFontVariantNumeric):
        (WebCore::StyleBuilderCustom::applyValueFontVariantEastAsian):
        * platform/text/TextFlags.h: Provide convenience classes.
        (WebCore::FontVariantLigaturesValues::FontVariantLigaturesValues):
        (WebCore::FontVariantNumericValues::FontVariantNumericValues):
        (WebCore::FontVariantEastAsianValues::FontVariantEastAsianValues):

2016-02-12  Jer Noble  <jer.noble@apple.com>

        Build fix after r196506; publish MediaResourceLoader.h as a private header so it can be used by
        TestWebKitAPI.

        * WebCore.xcodeproj/project.pbxproj:

2016-02-11  Jer Noble  <jer.noble@apple.com>

        [Mac] Adopt MediaResourceLoader (instead of CachedResourceLoader) in WebCoreNSURLSession.
        https://bugs.webkit.org/show_bug.cgi?id=154136

        Reviewed by Alex Christensen.

        MediaResourceLoader already supports using CORS attribute to verify CORS access requirements
        when loading media resources, so use it, rather than CachedResourceLoader, as the backing for
        WebCoreNSURLSession.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession delegateQueue]):
        (-[WebCoreNSURLSession streamTaskWithNetService:]):
        (-[WebCoreNSURLSession isKindOfClass:]):
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:request:]):
        (-[WebCoreNSURLSessionDataTask _restart]):
        (-[WebCoreNSURLSessionDataTask _cancel]):
        (-[WebCoreNSURLSessionDataTask resume]):
        (-[WebCoreNSURLSessionDataTask _timingData]):
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):
        (-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]): Deleted.
        (-[WebCoreNSURLSession loader]): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::dataSent): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::responseReceived): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::dataReceived): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::redirectReceived): Deleted.
        (WebCore::WebCoreNSURLSessionDataTaskClient::notifyFinished): Deleted.
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:URL:]): Deleted.
        (-[WebCoreNSURLSessionDataTask _finish]): Deleted.
        (-[WebCoreNSURLSessionDataTask _setDefersLoading:]): Deleted.
        (-[WebCoreNSURLSessionDataTask resource:sentBytes:totalBytesToBeSent:]): Deleted.
        (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]): Deleted.
        (-[WebCoreNSURLSessionDataTask resourceFinished:]): Deleted.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):

2016-02-12  Alex Christensen  <achristensen@webkit.org>

        Fix non-internal builds when using NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=152285

        * platform/spi/cf/CFNetworkSPI.h:
        Add SPI declaration used in r194156.

2016-02-12  Andreas Kling  <akling@apple.com>

        Throw out all live resource decoded data on memory pressure / suspension.
        <https://webkit.org/b/154176>

        Reviewed by Antti Koivisto.

        When pruning live resource decoded data from the memory cache,
        we normally avoid pruning anything that's been painted in the last second.
        This is an optimization to avoid getting into image decoding loops.

        For memory pressure / process suspension scenarios this doesn't really
        make sense though:

            - In the pressure case, if we have to render again soon it'll likely
              be a new GIF frame which we have to decode anyway.

            - In the process suspension case, we might *never* render again,
              so we should be good citizens and drop all the decoded data we can.

        This patch makes us drop all the decoded data, recently painted or not.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseCriticalMemory):

2016-02-12  Gavin Barraclough  <barraclough@apple.com>

        Separate out !allowsAccess path in JSDOMWindowCustom getOwnPropertySlot
        https://bugs.webkit.org/show_bug.cgi?id=154156

        Reviewed by Chris Dumez.

        JSDOMWindowCustom getOwnPropertySlot currently allows cross-origin access to all
        static properties, relying on the property to perform the access check. This is
        a little insecure, since it is error prone - someone could easily add a property
        to the static table without realizing it would be automatcially exposed.

        Instead, add a hard-coded filter to restrict access. As a future implementation
        we might consider autogenerating this (the properties are already tagged in IDL,
        we might be able to track this in a flag on the static table).

        By separating out the handling of the same- and cross-origin access we can
        simplify & make the policy being enforced much clearer.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::objectToStringFunctionGetter): Deleted.
            - removed objectToStringFunctionGetter - this duplicated functionality of
              nonCachingStaticFunctionGetter.
        * bindings/js/JSDOMBinding.h:
        (WebCore::objectToStringFunctionGetter): Deleted.
            - removed objectToStringFunctionGetter - this duplicated functionality of
              nonCachingStaticFunctionGetter.
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotDisallowAccess):
            - explicitly handle providing access to only the things we do want to allow cross-origin.
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
            - push all !allowsAccess handling to jsDOMWindowGetOwnPropertySlotDisallowAccess
        (WebCore::childFrameGetter): Deleted.
            - this was just a deoptimiztion - moving access into a callback saved very
              little & caused more work to be duplicated.

2016-02-12  Sukolsak Sakshuwong  <sukolsak@gmail.com>

        Update ICU header files to version 52
        https://bugs.webkit.org/show_bug.cgi?id=154160

        Reviewed by Alex Christensen.

        Update ICU header files to version 52 to allow the use of newer APIs.

        No new tests because there is no behavior change.

        * icu/unicode/bytestream.h:
        * icu/unicode/chariter.h:
        * icu/unicode/localpointer.h:
        * icu/unicode/platform.h:
        * icu/unicode/ptypes.h:
        * icu/unicode/putil.h:
        * icu/unicode/rep.h:
        (Replaceable::Replaceable):
        * icu/unicode/std_string.h:
        * icu/unicode/strenum.h:
        * icu/unicode/stringpiece.h:
        * icu/unicode/ubrk.h:
        * icu/unicode/uchar.h:
        * icu/unicode/ucnv.h:
        * icu/unicode/ucol.h:
        * icu/unicode/ucoleitr.h:
        * icu/unicode/uconfig.h:
        * icu/unicode/ucsdet.h:
        * icu/unicode/uenum.h:
        * icu/unicode/uidna.h:
        * icu/unicode/uiter.h:
        * icu/unicode/uloc.h:
        * icu/unicode/umachine.h:
        * icu/unicode/unistr.h:
        (UnicodeString::UnicodeString):
        (UnicodeString::operator== ):
        (UnicodeString::startsWith):
        (UnicodeString::setTo):
        (UnicodeString::remove):
        (UnicodeString::replace): Deleted.
        (UnicodeString::extract): Deleted.
        (UnicodeString::char32At): Deleted.
        (UnicodeString::getChar32Start): Deleted.
        (UnicodeString::getChar32Limit): Deleted.
        (UnicodeString::getTerminatedBuffer): Deleted.
        (UnicodeString::append): Deleted.
        (UnicodeString::truncate): Deleted.
        * icu/unicode/unorm2.h:
        * icu/unicode/uobject.h:
        * icu/unicode/urename.h:
        * icu/unicode/uscript.h:
        * icu/unicode/usearch.h:
        * icu/unicode/uset.h:
        * icu/unicode/ushape.h:
        * icu/unicode/ustring.h:
        * icu/unicode/utext.h:
        * icu/unicode/utf.h:
        * icu/unicode/utf16.h:
        * icu/unicode/utf8.h:
        * icu/unicode/utf_old.h:
        * icu/unicode/utypes.h:
        * icu/unicode/uvernum.h:
        * icu/unicode/uversion.h:

2016-02-12  Andreas Kling  <akling@apple.com>

        [Mac] BitmapImage::decodedDataIsPurgeable() is telling lies and causing massive memory usage.
        <https://webkit.org/b/154172>

        Reviewed by Antti Koivisto.

        The underlying mechanism in CoreAnimation that made this work is no longer in place.

        Instead of keeping purgeable frames and juggling volatility bits, we were simply caching
        every single frame of large GIF animations, sometimes leading to monstrous memory usage.

        Remove the code from WebCore since it's not doing at all what it means to.

        Now iOS and Mac will behave the same again, and frame caching decisions will be
        made by WebKit, based on total pixel byte size.

        * loader/cache/CachedImage.h:
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::decodedDataIsPurgeable): Deleted.
        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::pruneLiveResourcesToSize): Deleted.
        * platform/graphics/BitmapImage.cpp:
        (WebCore::BitmapImage::decodedDataIsPurgeable): Deleted.
        (WebCore::BitmapImage::destroyDecodedDataIfNecessary): Deleted.
        * platform/graphics/BitmapImage.h:
        * platform/graphics/Image.h:
        (WebCore::Image::decodedDataIsPurgeable): Deleted.
        * platform/graphics/cg/BitmapImageCG.cpp:
        (WebCore::BitmapImage::decodedDataIsPurgeable): Deleted.
        * platform/graphics/cg/ImageSourceCG.cpp:
        (WebCore::ImageSource::createFrameAtIndex): Deleted.

2016-02-12  Brady Eidson  <beidson@apple.com>

        Modern IDB: Ref cycle between IDBObjectStore and IDBIndex.
        https://bugs.webkit.org/show_bug.cgi?id=154110

        Reviewed by Darin Adler.

        No new tests (Currently untestable).

        The lifetime of IDBObjectStore and IDBIndex are closely intertwined, but we have to break the ref cycle.
        
        This patch does a few semi-gnarly things:
        1 - Makes both IDBIndex and IDBObjectStore have a custom marking function so they can add each other as 
            opaque roots.
        2 - Adds a lock to protect IDBObjectStore's collection of referenced indexes to support #1, as GC marking
            can happen on any thread.
        3 - Makes IDBIndex not be traditionally RefCounted; Instead, IDBIndex::ref()/deref() simply ref()/deref()
            the owning IDBObjectStore.
        4 - ...Except when somebody deletes an IDBIndex from its IDBObjectStore. Once that happens, the object
            store no longer has a reference back to the index, but the index still needs a reference back to the
            object store. To support this, the IDBIndex becomes "traditionally RefCounted" while holding a ref to
            its IDBObjectStore.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/IDBIndex.h:
        (WebCore::IDBIndex::isModern):
        * Modules/indexeddb/IDBIndex.idl:
        
        * Modules/indexeddb/IDBObjectStore.h:
        (WebCore::IDBObjectStore::isModern):
        * Modules/indexeddb/IDBObjectStore.idl:
        
        * Modules/indexeddb/client/IDBIndexImpl.cpp:
        (WebCore::IDBClient::IDBIndex::objectStore):
        (WebCore::IDBClient::IDBIndex::openCursor):
        (WebCore::IDBClient::IDBIndex::doCount):
        (WebCore::IDBClient::IDBIndex::openKeyCursor):
        (WebCore::IDBClient::IDBIndex::doGet):
        (WebCore::IDBClient::IDBIndex::doGetKey):
        (WebCore::IDBClient::IDBIndex::markAsDeleted):
        (WebCore::IDBClient::IDBIndex::ref):
        (WebCore::IDBClient::IDBIndex::deref):
        (WebCore::IDBClient::IDBIndex::create): Deleted.
        * Modules/indexeddb/client/IDBIndexImpl.h:
        (WebCore::IDBClient::IDBIndex::modernObjectStore):
        
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::createIndex):
        (WebCore::IDBClient::IDBObjectStore::index):
        (WebCore::IDBClient::IDBObjectStore::deleteIndex):
        (WebCore::IDBClient::IDBObjectStore::visitReferencedIndexes):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        
        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::createIndex):
        * Modules/indexeddb/client/IDBTransactionImpl.h:
        
        * Modules/indexeddb/legacy/LegacyIndex.cpp:
        (WebCore::LegacyIndex::ref):
        (WebCore::LegacyIndex::deref):
        * Modules/indexeddb/legacy/LegacyIndex.h:
        
        * bindings/js/JSIDBIndexCustom.cpp: Added.
        (WebCore::JSIDBIndex::visitAdditionalChildren):
        
        * bindings/js/JSIDBObjectStoreCustom.cpp:
        (WebCore::JSIDBObjectStore::visitAdditionalChildren):

2016-02-12  Csaba Osztrogonác  <ossy@webkit.org>

        [EFL][GTK] Fix ENABLE(SVG_OTF_CONVERTER) build
        https://bugs.webkit.org/show_bug.cgi?id=154165

        Reviewed by Alex Christensen.

        * CMakeLists.txt:
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        * svg/SVGToOTFFontConversion.cpp:
        * svg/SVGToOTFFontConversion.h:

2016-02-12  Chris Dumez  <cdumez@apple.com>

        Unreviewed nit fixes after r196466.

        * Modules/speech/SpeechSynthesisUtterance.idl: Fix curly bracket
          placement.
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader): Use wrappableObject instead of domObject.
        * bindings/scripts/test/*: Rebaseline.
        * dom/WebKitNamedFlow.idl: Drop unnecessary #if case.

2016-02-12  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Properly handle classes inheriting from EventTarget
        https://bugs.webkit.org/show_bug.cgi?id=154158

        Reviewed by Michael Catanzaro.

        Instead of removing its parent we now handle the case of classes
        having EventTarget as parent to make them implement the interface
        instead.

        * bindings/scripts/CodeGeneratorGObject.pm:
        (ShouldBeExposedAsInterface): Whether the parent given class
        should be exposed as an interface instead of a parent class.
        (GetParentClassName): Return Object as parent for classes having
        a parent that should be exposed as an interface.
        (GetParentImplClassName): Ditto.
        (GetBaseClass): Ditto.
        (GetParentGObjType): Ditto.
        (SkipFunction): Add FIXME comment.
        (ImplementsInterface): Helper function to check if a class
        implements the given interface.
        (GenerateCFile): Check whether the class implements EventTarget to
        generate the interface implementation.
        (GenerateInterface): Do not remove the parent class when it's EventTarget.

2016-02-12  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196470.
        https://bugs.webkit.org/show_bug.cgi?id=154167

        Broke some tests (Requested by anttik on #webkit).

        Reverted changeset:

        "Factor class change style invalidation code into a class"
        https://bugs.webkit.org/show_bug.cgi?id=154163
        http://trac.webkit.org/changeset/196470

2016-02-12  Antti Koivisto  <antti@apple.com>

        Factor class change style invalidation code into a class
        https://bugs.webkit.org/show_bug.cgi?id=154163

        Reviewed by Andreas Kling.

        Factor this piece of functionality out of Element and into ClassChangeInvalidation class.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.cpp:
        (WebCore::classStringHasClassName):
        (WebCore::Element::classAttributeChanged):
        (WebCore::collectClasses): Deleted.
        (WebCore::computeClassChange): Deleted.
        (WebCore::invalidateStyleForClassChange): Deleted.
        * style/ClassChangeInvalidation.cpp: Added.
        (WebCore::Style::ClassChangeInvalidation::computeClassChange):
        (WebCore::Style::ClassChangeInvalidation::invalidateStyle):
        * style/ClassChangeInvalidation.h: Added.
        (WebCore::Style::ClassChangeInvalidation::needsInvalidation):
        (WebCore::Style::ClassChangeInvalidation::ClassChangeInvalidation):
        (WebCore::Style::ClassChangeInvalidation::~ClassChangeInvalidation):

2016-02-12  Csaba Osztrogonác  <ossy@webkit.org>

        GCC buildfix in Source/WebCore/svg/SVGToOTFFontConversion.cpp
        https://bugs.webkit.org/show_bug.cgi?id=154162

        Reviewed by Andreas Kling.

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::finishAppendingKERNSubtable):

2016-02-12  Andreas Kling  <akling@apple.com>

        Don't invalidate the FontCache on memory pressure.
        <https://webkit.org/b/154161>

        Reviewed by Antti Koivisto.

        Invalidating the FontCache does more harm than good:

            - Anything that's still in the cache at this point is also
              referenced outside the cache, thus will not actually get deleted.

            - Future deduplication will fail, leading to more objects.

            - The global FontCache generation gets bumped, causing future style
              recalcs to be less efficient and breaking style sharing.

            - All FontSelector invalidation callbacks will fire, potentially
              causing forced full-document style recalcs.

        In fact, the only win from invalidating the FontCache comes from some
        minor shrinkage in the containers that make up the cache itself.

        * platform/MemoryPressureHandler.cpp:
        (WebCore::MemoryPressureHandler::releaseCriticalMemory): Deleted.

2016-02-11  Chris Dumez  <cdumez@apple.com>

        [Web IDL] interfaces should inherit EventTarget instead of duplicating the EventTarget API
        https://bugs.webkit.org/show_bug.cgi?id=154121
        <rdar://problem/24613234>

        Reviewed by Gavin Barraclough.

        Interfaces should inherit EventTarget instead of duplicating the
        EventTarget API in their IDL. Not only the duplication is ugly and
        error-prone, but this also does not match the specifications and
        have subtle web-exposed differences.

        This patch takes care of all interfaces except for DOMWindow and
        WorkerGlobalScope. Those will be updated in the follow-up patch
        as they will require a little bit more work and testing.

        We should also be able to get rid of the [EventTarget] WebKit IDL
        attribute in a follow-up.

        No new tests, already covered by existing tests.

        * Modules/battery/BatteryManager.idl:
        * Modules/encryptedmedia/MediaKeySession.idl:
        * Modules/indexeddb/IDBDatabase.h:
        * Modules/indexeddb/IDBDatabase.idl:
        * Modules/indexeddb/IDBRequest.h:
        * Modules/indexeddb/IDBRequest.idl:
        * Modules/indexeddb/IDBTransaction.h:
        * Modules/indexeddb/IDBTransaction.idl:
        * Modules/mediasession/MediaRemoteControls.idl:
        * Modules/mediasource/MediaSource.h:
        * Modules/mediasource/MediaSource.idl:
        * Modules/mediasource/SourceBuffer.h:
        * Modules/mediasource/SourceBuffer.idl:
        * Modules/mediasource/SourceBufferList.h:
        * Modules/mediasource/SourceBufferList.idl:
        * Modules/mediastream/MediaStream.h:
        * Modules/mediastream/MediaStream.idl:
        * Modules/mediastream/MediaStreamTrack.h:
        * Modules/mediastream/MediaStreamTrack.idl:
        * Modules/mediastream/RTCDTMFSender.h:
        * Modules/mediastream/RTCDTMFSender.idl:
        * Modules/mediastream/RTCDataChannel.h:
        * Modules/mediastream/RTCDataChannel.idl:
        * Modules/mediastream/RTCPeerConnection.h:
        * Modules/mediastream/RTCPeerConnection.idl:
        * Modules/notifications/Notification.idl:
        * Modules/speech/SpeechSynthesisUtterance.idl:
        * Modules/webaudio/AudioContext.idl:
        * Modules/webaudio/AudioNode.idl:
        * Modules/websockets/WebSocket.idl:
        * css/FontLoader.idl:
        * dom/EventTarget.h:
        * dom/MessagePort.idl:
        * dom/Node.h:
        * dom/Node.idl:
        * dom/WebKitNamedFlow.idl:
        * fileapi/FileReader.idl:
        * html/MediaController.idl:
        * html/track/AudioTrackList.idl:
        * html/track/TextTrack.idl:
        * html/track/TextTrackCue.idl:
        * html/track/TextTrackList.idl:
        * html/track/VideoTrackList.idl:
        * loader/appcache/DOMApplicationCache.h:
        * loader/appcache/DOMApplicationCache.idl:
        * page/EventSource.idl:
        * page/Performance.h:
        * page/Performance.idl:
        * workers/Worker.idl:
        * xml/XMLHttpRequest.h:
        * xml/XMLHttpRequest.idl:
        * xml/XMLHttpRequestUpload.idl:
        - Drop hardcoded EventTarget operations and inherit EventTarget instead.
        - Drop JSGenerateToNativeObject / JSGenerateToJSObject IDL extended
          attributes for interfaces inheriting the EventTarget interface as
          the bindings generator now does this automatically for us.
        - On native side, have EventTarget subclass ScriptWrappable instead of
          each of its subclasses doing so. The issue was that
          EventTargetOwner::finalize() was calling uncacheWrapper() with an
          EventTarget*, which would not clear inlined cached wrapped (see
          clearInlineCachedWrapper()) because EventTarget did not subclass
          ScriptWrappable. However, cacheWrapper() is called is a specific
          subtype pointer (e.g. Node*) and we would decide to create an
          inline cached wrapper because Node subclassed ScriptWrappable
          (as well as EventTarget).

        * WebCore.xcodeproj/project.pbxproj:
        Export JSEventTarget.h as private header to fix the build.

        * bindings/js/JSDOMBinding.h:
        (WebCore::wrapperKey):
        (WebCore::getCachedWrapper):
        (WebCore::cacheWrapper):
        (WebCore::uncacheWrapper):
        Use new wrapperKey() function that is generated for each bindings
        class that also has wrapperOwner(). This is used instead of the
        C cast to void* in order to cast to the base wrapped type to fix
        issues with multiple inheritance. The issue was that cacheWrapper()
        was getting called with a DOM object subtype pointer (e.g.
        AudioContext*) but uncacheWrapper() was getting called with a base
        wrapped type pointer (e.g. EventTarget*). Most of our DOM classes
        use multiple inheritance and thus the pointer values (used as keys
        in the weak map) may differ.

        * bindings/js/JSTrackCustom.cpp:
        (WebCore::toJS):
        Call CREATE_DOM_WRAPPER() with an actual wrapped type (e.g. AudioTrack)
        instead of TrackBase type. TrackBase does not have corresponding
        generated bindings and therefore does not have a wrapperKey()
        function.

        * bindings/scripts/CodeGeneratorJS.pm:
        (ShouldGenerateToWrapped):
        (ShouldGenerateToJSDeclaration):
        (GenerateHeader):
        - Generate a wrapperKey() utility function along-side wrapperOwner()
          to help cast to the base wrapped type.
        - Generate toWrapped() / toJS() utility functions for interfaces
          that inherit EventTarget as those are required by our
          implementation and this avoids having to explicitly have them in
          the IDL.

        * bindings/scripts/test/*:
        Rebaseline bindings tests.

2016-02-11  Brent Fulgham  <bfulgham@apple.com>

        Optimize texture-complete checks
        https://bugs.webkit.org/show_bug.cgi?id=98308

        Reviewed by Dean Jackson.

        No new tests: No change in behavior.

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::initializeNewContext): Initially consider all
        textures as suspect.
        (WebCore::WebGLRenderingContextBase::extensions): New helper function.
        (WebCore::WebGLRenderingContextBase::reshape): Mark textures as invalid when appropriate.
        (WebCore::WebGLRenderingContextBase::bindTexture): Identify invalid textures and mark
        them for later fix-up. Likewise, remove 'known good' textures from the fix-up pass.
        (WebCore::WebGLRenderingContextBase::deleteTexture): Remove instances of the deleted texture
        from our set of invalid textures.
        (WebCore::WebGLRenderingContextBase::checkTextureCompleteness): Only iterate through
        the 'bad' textures, rather than checking every single texture.
        * html/canvas/WebGLRenderingContextBase.h:

2016-02-11  Alex Christensen  <achristensen@webkit.org>

        Assert that IDBTransaction::transitionedToFinishing transitions to finishing.
        https://bugs.webkit.org/show_bug.cgi?id=154061

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::transitionedToFinishing):
        Added assertion that we are transitioning to a finished or finishing state, based on Darin's feedback.

2016-02-11  Enrica Casucci  <enrica@apple.com>

        WebContent process crashes when performing data detection on content with existing data detector links.
        https://bugs.webkit.org/show_bug.cgi?id=154118
        rdar://problem/24511860

        Reviewed by Tim Horton.

        The DOM mutation caused by removing the existing links, can shift the range endpoints.
        We now save the range enpoints as positions so that we can recreate the ranges,
        if a DOM mutation occurred.

        * editing/cocoa/DataDetection.mm:
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):
        (WebCore::DataDetection::detectContentInRange):

2016-02-11  Jer Noble  <jer.noble@apple.com>

        Make MediaResourceLoader behave more like a CachedResourceLoader.
        https://bugs.webkit.org/show_bug.cgi?id=154117

        Reviewed by Alex Christensen.

        MediaResourceLoader currently can only handle a single request at a time. Split the class
        into two, MediaResourceLoader and MediaResource, effectively wrapping CachedResourceLoader
        and CachedRawResource respectively. With this devision, the same loader can be used to issue
        multiple simultaneous resource requests.

        This necessecitates splitting PlatformMediaResource into two classes as well.  To simplify
        the HTMLMediaElement, MediaPlayer, and MediaPlayerClient APIs, do not require a client
        object when creating the loader; instead, the client is required to create the resource.
        This also matches the CachedRawResource API.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerCreateResourceLoader): Remove the client parameter.
        * html/HTMLMediaElement.h:
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::MediaResourceLoader):
        (WebCore::MediaResourceLoader::~MediaResourceLoader):
        (WebCore::MediaResourceLoader::requestResource): Renamed from start().
        (WebCore::MediaResourceLoader::removeResource): Remove resource from live resource list.
        (WebCore::MediaResource::create): Utility factory.
        (WebCore::MediaResource::MediaResource):
        (WebCore::MediaResource::~MediaResource):
        (WebCore::MediaResource::stop): Moved from MediaResourceLoader.
        (WebCore::MediaResource::setDefersLoading): Ditto.
        (WebCore::MediaResource::responseReceived): Ditto.
        (WebCore::MediaResource::redirectReceived): Ditto.
        (WebCore::MediaResource::dataSent): Ditto.
        (WebCore::MediaResource::dataReceived): Ditto.
        (WebCore::MediaResource::notifyFinished): Ditto.
        (WebCore::MediaResource::getOrCreateReadBuffer): Ditto.
        * loader/MediaResourceLoader.h:
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::createResourceLoader):
        * platform/graphics/MediaPlayer.h:
        (WebCore::MediaPlayerClient::mediaPlayerCreateResourceLoader):
        * platform/graphics/PlatformMediaResourceLoader.h:
        (WebCore::PlatformMediaResourceClient::~PlatformMediaResourceClient): Renamed from PlatformMediaResourceLoaderClient.
        (WebCore::PlatformMediaResourceClient::responseReceived): Client methods now take a reference to the resource.
        (WebCore::PlatformMediaResourceClient::redirectReceived): Ditto.
        (WebCore::PlatformMediaResourceClient::dataSent): Ditto. 
        (WebCore::PlatformMediaResourceClient::dataReceived): Ditto.
        (WebCore::PlatformMediaResourceClient::accessControlCheckFailed): Ditto.
        (WebCore::PlatformMediaResourceClient::loadFailed): Ditto.
        (WebCore::PlatformMediaResourceClient::loadFinished): Ditto.
        (WebCore::PlatformMediaResourceClient::getOrCreateReadBuffer): Ditto.
        (WebCore::PlatformMediaResourceLoader::PlatformMediaResourceLoader): Ditto.
        (WebCore::PlatformMediaResource::PlatformMediaResource): 
        (WebCore::PlatformMediaResource::~PlatformMediaResource): 
        (WebCore::PlatformMediaResource::setClient):
        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
        (webKitWebSrcStart):
        (webKitWebSrcNeedData):
        (webKitWebSrcEnoughData):
        (CachedResourceStreamingClient::getOrCreateReadBuffer):
        (CachedResourceStreamingClient::responseReceived):
        (CachedResourceStreamingClient::dataReceived):
        (CachedResourceStreamingClient::accessControlCheckFailed):
        (CachedResourceStreamingClient::loadFailed):
        (CachedResourceStreamingClient::loadFinished):

2016-02-11  Zalan Bujtas  <zalan@apple.com>

        Subpixel rendering: Make focusring painting subpixel aware.
        https://bugs.webkit.org/show_bug.cgi?id=154111

        Reviewed by David Hyatt.

        Do not integral snap focusring rects while collecting them (use device pixel snapping instead
        right before passing them to GraphicsContext::drawFocusRing).

        Unable to test.

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/displaylists/DisplayListItems.h:
        (WebCore::DisplayList::DrawFocusRingRects::create):
        (WebCore::DisplayList::DrawFocusRingRects::rects):
        (WebCore::DisplayList::DrawFocusRingRects::DrawFocusRingRects):
        * platform/graphics/displaylists/DisplayListRecorder.cpp:
        (WebCore::DisplayList::Recorder::drawFocusRing):
        * platform/graphics/displaylists/DisplayListRecorder.h:
        * platform/graphics/mac/GraphicsContextMac.mm:
        (WebCore::GraphicsContext::drawFocusRing):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::addFocusRingRectsForInlineChildren):
        (WebCore::RenderBlock::addFocusRingRects):
        * rendering/RenderBlock.h:
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::addFocusRingRectsForInlineChildren):
        * rendering/RenderBlockFlow.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::addFocusRingRects):
        * rendering/RenderBox.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::paintFocusRing):
        (WebCore::RenderElement::issueRepaintForOutlineAuto):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::absoluteRects):
        (WebCore::RenderInline::addFocusRingRects):
        * rendering/RenderInline.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::addFocusRingRects):
        * rendering/RenderListBox.h:
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::addPDFURLRect):
        (WebCore::RenderObject::absoluteFocusRingQuads):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::addFocusRingRects):
        * rendering/RenderTextControl.cpp:
        (WebCore::RenderTextControl::addFocusRingRects):
        * rendering/RenderTextControl.h:
        * rendering/svg/RenderSVGContainer.cpp:
        (WebCore::RenderSVGContainer::addFocusRingRects):
        * rendering/svg/RenderSVGContainer.h:
        * rendering/svg/RenderSVGImage.cpp:
        (WebCore::RenderSVGImage::addFocusRingRects):
        * rendering/svg/RenderSVGImage.h:
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::addFocusRingRects):
        * rendering/svg/RenderSVGShape.h:

2016-02-11  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r196393

        Unreviewed.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::getFontFace):
        * css/CSSSegmentedFontFace.h:

2016-02-11  Antti Koivisto  <antti@apple.com>

        Rename Element::style() to Element::cssomStyle()
        https://bugs.webkit.org/show_bug.cgi?id=154107

        Reviewed by Alex Christensen.

        It implements the IDL "style" attribute that returns a CSSOM object.
        Inside WebCore "style" generally refers to a RenderStyle.

        * dom/Element.cpp:
        (WebCore::Element::hasAttributeNS):
        (WebCore::Element::cssomStyle):
        (WebCore::Element::focus):
        (WebCore::Element::style): Deleted.
        * dom/Element.h:
        (WebCore::Element::tagQName):
        * dom/Element.idl:
        * dom/StyledElement.cpp:
        (WebCore::StyledElement::~StyledElement):
        (WebCore::StyledElement::cssomStyle):
        (WebCore::StyledElement::style): Deleted.
        * dom/StyledElement.h:
        (WebCore::StyledElement::synchronizeStyleAttributeInternal):
        (WebCore::StyledElement::collectStyleForPresentationAttribute):
        * editing/Editor.cpp:
        (WebCore::Editor::applyEditingStyleToElement):
        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::getMatchedStylesForNode):
        (WebCore::InspectorCSSAgent::getInlineStylesForNode):
        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
        * inspector/InspectorStyleSheet.cpp:
        (WebCore::InspectorStyleSheetForInlineStyle::didModifyElementAttribute):
        (WebCore::InspectorStyleSheetForInlineStyle::inlineStyle):
        (WebCore::InspectorStyleSheetForInlineStyle::elementStyleText):
        * svg/SVGElement.idl:

2016-02-11  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Consolidate TextureMapper file and include dir lists.
        https://bugs.webkit.org/show_bug.cgi?id=154106

        Reviewed by Michael Catanzaro.

        No new tests needed.

        * CMakeLists.txt: Moved texmap include dir and source list to
        TextureMapper.cmake, removed non-existent include dir "filters/texmap".
        * PlatformEfl.cmake: Moved texmap and coordinatedgraphics include
        dirs and source list to TextureMapper.cmake.
        * PlatformGTK.cmake: Ditto, also removed non-existent include dir
        "texmap/threadedcompositor"
        * PlatformWinCairo.cmake: Moved texmap files to TextureMapper.cmake.
        * platform/TextureMapper.cmake: Added.

2016-02-11  Chris Dumez  <cdumez@apple.com>

        Move 'length' property to the prototype
        https://bugs.webkit.org/show_bug.cgi?id=154051
        <rdar://problem/24577385>

        Reviewed by Darin Adler.

        Move 'length' property to the prototype, where it should be. We used to
        keep it on the instance because our implementation of
        getOwnPropertySlot() was wrong for interfaces with a named property
        getter. However, our implementation of getOwnPropertySlot() is now
        spec-compliant so this should be OK.

        Moving 'length' to the prototype is also a little bit risky in terms of
        performance, especially for HTMLCollection / NodeList. However, I did
        not see an impact on realistic benchmarks like Speedometer and only saw
        a small impact (< 5%) on micro-benchmarks. I propose we make our behavior
        correct and monitor performance. If we see any benchmark we care about
        regress then we should try and optimize while keeping the attribute on
        the prototype.

        No new tests, already covered by existing tests.

        * bindings/js/JSDOMBinding.h:
        (WebCore::getStaticValueSlotEntryWithoutCaching):
        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::getOwnPropertySlot):
        (WebCore::JSHTMLDocument::nameGetter): Deleted.
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        * bindings/js/JSPluginElementFunctions.h:
        (WebCore::pluginElementCustomGetOwnPropertySlot):
        * bindings/js/JSStorageCustom.cpp:
        (WebCore::JSStorage::deleteProperty):
        (WebCore::JSStorage::deletePropertyByIndex):
        (WebCore::JSStorage::putDelegate):
        Leverage the new hasStaticPropertyTable static property in the
        generated bindings for performance.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        Generate a "hasStaticPropertyTable" static const boolean property
        for each bindings class so we can check at build time if
        ClassInfo::staticPropHashTable is null.

        (AttributeShouldBeOnInstance):
        Move "length" to the prototype.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.h:
        * bindings/scripts/test/JS/JSTestEventTarget.h:
        * bindings/scripts/test/JS/JSTestException.h:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
        * bindings/scripts/test/JS/JSTestInterface.h:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
        * bindings/scripts/test/JS/JSTestNode.h:
        * bindings/scripts/test/JS/JSTestNondeterministic.h:
        * bindings/scripts/test/JS/JSTestObj.h:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
        * bindings/scripts/test/JS/JSTestTypedefs.h:
        * bindings/scripts/test/JS/JSattribute.h:
        * bindings/scripts/test/JS/JSreadonly.h:
        Rebaseline bindings tests.


2016-02-11  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !(ENABLE(SHADOW_DOM) || ENABLE(DETAILS_ELEMENT)) after r196281
        https://bugs.webkit.org/show_bug.cgi?id=154035

        Reviewed by Antti Koivisto.

        Follow-up fix after r196365. Removed guards around slotNodeIndex.

        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::Context::Context):

2016-02-10  Ryan Haddad  <ryanhaddad@apple.com>

        Updating bindings test reference file for JSTestEventConstructor.cpp after r196400

        Unreviewed test gardening.

        No new tests needed.

        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::JSTestEventConstructorConstructor::construct):

2016-02-10  Eric Carlson  <eric.carlson@apple.com>

        Update "manual" caption track logic
        https://bugs.webkit.org/show_bug.cgi?id=154084
        <rdar://problem/24530516>

        Reviewed by Dean Jackson.

        No new tests, media/track/track-manual-mode.html was updated.

        * English.lproj/Localizable.strings: Add new string.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addTextTrack): track.setManualSelectionMode is no more.
        (WebCore::HTMLMediaElement::configureTextTrackGroup): Never enable a track automatically when
          in manual selection mode.
        (WebCore::HTMLMediaElement::captionPreferencesChanged):  track.setManualSelectionMode is no more.

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::containsOnlyForcedSubtitles): Return true for forced tracks.
        (WebCore::TextTrack::kind): Deleted.
        * html/track/TextTrack.h:

        * html/track/TrackBase.h:
        (WebCore::TrackBase::kind): De-virtualize, nobody overrides it.

        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::trackDisplayName): Include "forced" in the name of forced tracks.

        * platform/LocalizedStrings.cpp:
        (WebCore::forcedTrackMenuItemText): New.
        * platform/LocalizedStrings.h:

2016-02-10  Jiewen Tan  <jiewen_tan@apple.com>

        Rename *Event::create* which creates events for bindings to *Event::createForBindings* and cleanup corresponding paths
        https://bugs.webkit.org/show_bug.cgi?id=153903
        <rdar://problem/24518146>

        Reviewed by Darin Adler.

        Rename Event::create(const AtomicString&, const EventInit&) to Event::createForBindings
        (const AtomicString&, const EventInit&) and for all the subclasses as well in order to
        support Event.isTrusted. Besides, some of the subclasses use the create method for bindings
        to create events not for bindings and vice versa. Therefore, this patch also cleanup
        corresponding paths to ensure no misuse of the create mehtod. The same for Event::create()
        as it is combined with Event::initEvent to create an event for bindings for legacy content.

        After this patch, all call sites of *Event::create* are supposed to use *Event::create
        to create events for user agent and *Event::createForBindings for bindings.

        No change in behavior.

        * Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.h:
        (WebCore::WebKitPlaybackTargetAvailabilityEvent::create):
        (WebCore::WebKitPlaybackTargetAvailabilityEvent::createForBindings):
        (WebCore::WebKitPlaybackTargetAvailabilityEventInit::WebKitPlaybackTargetAvailabilityEventInit): Deleted.
        * Modules/encryptedmedia/MediaKeyMessageEvent.cpp:
        (WebCore::MediaKeyMessageEvent::MediaKeyMessageEvent):
        (WebCore::MediaKeyMessageEventInit::MediaKeyMessageEventInit): Deleted.
        * Modules/encryptedmedia/MediaKeyMessageEvent.h:
        (WebCore::MediaKeyMessageEvent::create):
        (WebCore::MediaKeyMessageEvent::createForBindings):
        * Modules/encryptedmedia/MediaKeyNeededEvent.cpp:
        (WebCore::MediaKeyNeededEvent::MediaKeyNeededEvent):
        (WebCore::MediaKeyNeededEventInit::MediaKeyNeededEventInit): Deleted.
        * Modules/encryptedmedia/MediaKeyNeededEvent.h:
        (WebCore::MediaKeyNeededEvent::create):
        (WebCore::MediaKeyNeededEvent::createForBindings):
        * Modules/encryptedmedia/MediaKeySession.cpp:
        (WebCore::MediaKeySession::sendMessage):
        * Modules/gamepad/GamepadEvent.h:
        (WebCore::GamepadEvent::create):
        (WebCore::GamepadEvent::createForBindings):
        (WebCore::GamepadEventInit::GamepadEventInit): Deleted.
        * Modules/indieui/UIRequestEvent.cpp:
        (WebCore::UIRequestEvent::createForBindings):
        (WebCore::UIRequestEvent::UIRequestEvent):
        (WebCore::UIRequestEventInit::UIRequestEventInit): Deleted.
        (WebCore::UIRequestEvent::create): Deleted.
        * Modules/indieui/UIRequestEvent.h:
        * Modules/mediastream/MediaStreamEvent.cpp:
        (WebCore::MediaStreamEvent::createForBindings):
        (WebCore::MediaStreamEventInit::MediaStreamEventInit): Deleted.
        (WebCore::MediaStreamEvent::create): Deleted.
        * Modules/mediastream/MediaStreamEvent.h:
        * Modules/mediastream/MediaStreamTrackEvent.cpp:
        (WebCore::MediaStreamTrackEvent::createForBindings):
        (WebCore::MediaStreamTrackEventInit::MediaStreamTrackEventInit): Deleted.
        (WebCore::MediaStreamTrackEvent::create): Deleted.
        * Modules/mediastream/MediaStreamTrackEvent.h:
        * Modules/mediastream/RTCDTMFToneChangeEvent.cpp:
        (WebCore::RTCDTMFToneChangeEvent::createForBindings):
        (WebCore::RTCDTMFToneChangeEvent::create): Deleted.
        * Modules/mediastream/RTCDTMFToneChangeEvent.h:
        * Modules/mediastream/RTCDataChannelEvent.cpp:
        (WebCore::RTCDataChannelEvent::createForBindings):
        (WebCore::RTCDataChannelEvent::create): Deleted.
        * Modules/mediastream/RTCDataChannelEvent.h:
        * Modules/mediastream/RTCIceCandidateEvent.cpp:
        (WebCore::RTCIceCandidateEvent::createForBindings):
        (WebCore::RTCIceCandidateEvent::create): Deleted.
        * Modules/mediastream/RTCIceCandidateEvent.h:
        * Modules/mediastream/RTCTrackEvent.cpp:
        (WebCore::RTCTrackEvent::createForBindings):
        (WebCore::RTCTrackEventInit::RTCTrackEventInit): Deleted.
        (WebCore::RTCTrackEvent::create): Deleted.
        * Modules/mediastream/RTCTrackEvent.h:
        * Modules/speech/SpeechSynthesisEvent.cpp:
        (WebCore::SpeechSynthesisEvent::createForBindings):
        (WebCore::SpeechSynthesisEvent::create):
        (WebCore::SpeechSynthesisEvent::SpeechSynthesisEvent):
        * Modules/speech/SpeechSynthesisEvent.h:
        * Modules/webaudio/AudioProcessingEvent.cpp:
        (WebCore::AudioProcessingEvent::create): Deleted.
        * Modules/webaudio/AudioProcessingEvent.h:
        (WebCore::AudioProcessingEvent::create):
        (WebCore::AudioProcessingEvent::createForBindings):
        * Modules/webaudio/OfflineAudioCompletionEvent.cpp:
        (WebCore::OfflineAudioCompletionEvent::createForBindings):
        (WebCore::OfflineAudioCompletionEvent::create): Deleted.
        * Modules/webaudio/OfflineAudioCompletionEvent.h:
        * Modules/websockets/CloseEvent.h:
        (WebCore::CloseEvent::create):
        (WebCore::CloseEvent::createForBindings):
        (WebCore::CloseEvent::CloseEvent):
        (WebCore::CloseEventInit::CloseEventInit): Deleted.
        * bindings/objc/DOM.mm:
        (-[DOMNode nextFocusNode]):
        (-[DOMNode previousFocusNode]):
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateConstructorDefinition):
        * dom/AnimationEvent.cpp:
        (WebCore::AnimationEventInit::AnimationEventInit): Deleted.
        * dom/AnimationEvent.h:
        * dom/BeforeLoadEvent.h:
        (WebCore::BeforeLoadEventInit::BeforeLoadEventInit): Deleted.
        * dom/ClipboardEvent.h:
        * dom/CompositionEvent.cpp:
        (WebCore::CompositionEventInit::CompositionEventInit): Deleted.
        * dom/CompositionEvent.h:
        * dom/CustomEvent.cpp:
        (WebCore::CustomEventInit::CustomEventInit): Deleted.
        * dom/CustomEvent.h:
        * dom/DeviceMotionEvent.h:
        * dom/DeviceOrientationEvent.h:
        * dom/Document.cpp:
        (WebCore::Document::createEvent):
        * dom/Element.cpp:
        (WebCore::Element::dispatchMouseEvent):
        * dom/ErrorEvent.cpp:
        (WebCore::ErrorEventInit::ErrorEventInit): Deleted.
        * dom/ErrorEvent.h:
        * dom/Event.cpp:
        (WebCore::EventInit::EventInit): Deleted.
        * dom/Event.h:
        (WebCore::Event::createForBindings):
        (WebCore::Event::create): Deleted.
        * dom/FocusEvent.cpp:
        (WebCore::FocusEventInit::FocusEventInit): Deleted.
        * dom/FocusEvent.h:
        * dom/HashChangeEvent.h:
        (WebCore::HashChangeEventInit::HashChangeEventInit): Deleted.
        * dom/KeyboardEvent.cpp:
        (WebCore::KeyboardEvent::KeyboardEvent):
        (WebCore::KeyboardEventInit::KeyboardEventInit): Deleted.
        * dom/KeyboardEvent.h:
        * dom/MessageEvent.cpp:
        (WebCore::MessageEvent::MessageEvent):
        (WebCore::MessageEventInit::MessageEventInit): Deleted.
        * dom/MessageEvent.h:
        * dom/MouseEvent.cpp:
        (WebCore::MouseEvent::createForBindings):
        (WebCore::MouseEvent::create):
        (WebCore::MouseEvent::MouseEvent):
        (WebCore::MouseEvent::cloneFor):
        (WebCore::MouseEventInit::MouseEventInit): Deleted.
        * dom/MouseEvent.h:
        (WebCore::MouseEvent::createForBindings):
        (WebCore::MouseEvent::create): Deleted.
        * dom/MouseRelatedEvent.cpp:
        (WebCore::MouseRelatedEvent::MouseRelatedEvent):
        (WebCore::MouseRelatedEvent::init):
        * dom/MouseRelatedEvent.h:
        (WebCore::MouseRelatedEvent::screenX):
        (WebCore::MouseRelatedEvent::screenY):
        (WebCore::MouseRelatedEvent::screenLocation):
        (WebCore::MouseRelatedEvent::clientX):
        (WebCore::MouseRelatedEvent::clientY):
        (WebCore::MouseRelatedEvent::movementX):
        (WebCore::MouseRelatedEvent::movementY):
        (WebCore::MouseRelatedEvent::clientLocation):
        (WebCore::MouseRelatedEvent::isSimulated):
        (WebCore::MouseRelatedEvent::absoluteLocation):
        (WebCore::MouseRelatedEvent::setAbsoluteLocation):
        * dom/MutationEvent.h:
        * dom/OverflowEvent.cpp:
        (WebCore::OverflowEvent::OverflowEvent):
        (WebCore::OverflowEvent::initOverflowEvent):
        (WebCore::OverflowEventInit::OverflowEventInit): Deleted.
        * dom/OverflowEvent.h:
        * dom/PageTransitionEvent.cpp:
        (WebCore::PageTransitionEventInit::PageTransitionEventInit): Deleted.
        * dom/PageTransitionEvent.h:
        * dom/PopStateEvent.cpp:
        (WebCore::PopStateEvent::createForBindings):
        (WebCore::PopStateEventInit::PopStateEventInit): Deleted.
        (WebCore::PopStateEvent::PopStateEvent): Deleted.
        (WebCore::PopStateEvent::create): Deleted.
        * dom/PopStateEvent.h:
        * dom/ProgressEvent.cpp:
        (WebCore::ProgressEventInit::ProgressEventInit): Deleted.
        * dom/ProgressEvent.h:
        (WebCore::ProgressEvent::createForBindings):
        (WebCore::ProgressEvent::create): Deleted.
        * dom/SecurityPolicyViolationEvent.h:
        (WebCore::SecurityPolicyViolationEventInit::SecurityPolicyViolationEventInit): Deleted.
        * dom/TextEvent.cpp:
        (WebCore::TextEvent::createForBindings):
        (WebCore::TextEvent::create): Deleted.
        * dom/TextEvent.h:
        * dom/TouchEvent.h:
        * dom/TransitionEvent.cpp:
        (WebCore::TransitionEventInit::TransitionEventInit): Deleted.
        * dom/TransitionEvent.h:
        * dom/UIEvent.cpp:
        (WebCore::UIEventInit::UIEventInit): Deleted.
        * dom/UIEvent.h:
        (WebCore::UIEvent::createForBindings):
        (WebCore::UIEvent::create): Deleted.
        * dom/UIEventWithKeyState.h:
        (WebCore::UIEventWithKeyState::ctrlKey):
        (WebCore::UIEventWithKeyState::shiftKey):
        (WebCore::UIEventWithKeyState::altKey):
        (WebCore::UIEventWithKeyState::metaKey):
        (WebCore::UIEventWithKeyState::UIEventWithKeyState):
        * dom/WebKitAnimationEvent.cpp:
        (WebCore::WebKitAnimationEventInit::WebKitAnimationEventInit): Deleted.
        * dom/WebKitAnimationEvent.h:
        * dom/WebKitTransitionEvent.cpp:
        (WebCore::WebKitTransitionEventInit::WebKitTransitionEventInit): Deleted.
        * dom/WebKitTransitionEvent.h:
        * dom/WheelEvent.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerKeyAdded):
        (WebCore::HTMLMediaElement::mediaPlayerKeyError):
        (WebCore::HTMLMediaElement::mediaPlayerKeyMessage):
        (WebCore::HTMLMediaElement::mediaPlayerKeyNeeded):
        * html/MediaKeyEvent.cpp:
        (WebCore::MediaKeyEvent::MediaKeyEvent):
        (WebCore::MediaKeyEventInit::MediaKeyEventInit): Deleted.
        * html/MediaKeyEvent.h:
        * html/canvas/WebGLContextEvent.cpp:
        (WebCore::WebGLContextEventInit::WebGLContextEventInit): Deleted.
        * html/canvas/WebGLContextEvent.h:
        * html/track/TrackEvent.cpp:
        (WebCore::TrackEvent::TrackEvent):
        (WebCore::TrackEventInit::TrackEventInit): Deleted.
        * html/track/TrackEvent.h:
        * html/track/TrackListBase.cpp:
        (TrackListBase::scheduleTrackEvent):
        (TrackListBase::scheduleChangeEvent):
        * page/EventSource.cpp:
        (WebCore::EventSource::createMessageEvent):
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::reportViolation):
        (WebCore::gatherSecurityPolicyViolationEventData): Deleted.
        * storage/StorageEvent.cpp:
        (WebCore::StorageEvent::createForBindings):
        (WebCore::StorageEventInit::StorageEventInit): Deleted.
        (WebCore::StorageEvent::create): Deleted.
        * storage/StorageEvent.h:
        * svg/SVGZoomEvent.h:
        (WebCore::SVGZoomEvent::createForBindings):
        (WebCore::SVGZoomEvent::create): Deleted.
        * xml/XMLHttpRequestProgressEvent.h:
        (WebCore::XMLHttpRequestProgressEvent::createForBindings):
        (WebCore::XMLHttpRequestProgressEvent::create): Deleted.

2016-02-10  Ryan Haddad  <ryanhaddad@apple.com>

        Rebaselining bindings tests

        Unreviewed test gardening.

        No new tests needed.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestCallback.cpp:
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        * bindings/scripts/test/JS/JSreadonly.cpp:

2016-02-10  Konstantin Tokarev  <annulen@yandex.ru>

        [cmake] Consolidate CMake code related to image decoders.
        https://bugs.webkit.org/show_bug.cgi?id=154074

        Reviewed by Alex Christensen.

        Common image decoder sources, includes and libs are moved to
        platform/ImageDecoders.cmake.

        Also, added include directories of libjpeg and libpng to
        WebCore_SYSTEM_INCLUDE_DIRECTORIES.

        No new tests needed.

        * CMakeLists.txt: Moved common include paths to ImageDecoders.cmake.
        * PlatformEfl.cmake: Moved common sources and libs to ImageDecoders.cmake.
        * PlatformGTK.cmake: Ditto.
        * PlatformWinCairo.cmake: Moved common sources to ImageDecoders.cmake.
        * platform/ImageDecoders.cmake: Added.

2016-02-10  Myles C. Maxfield  <mmaxfield@apple.com>

        CSSSegmentedFontFace does not need to be reference counted
        https://bugs.webkit.org/show_bug.cgi?id=154083

        Reviewed by Antti Koivisto.

        ...There is only ever a single reference to one.

        No new tests because there is no behavior change.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::getFontFace):
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.h:
        (WebCore::CSSSegmentedFontFace::create): Deleted.

2016-02-10  Myles C. Maxfield  <mmaxfield@apple.com>

        FontCache's clients should use references instead of pointers
        https://bugs.webkit.org/show_bug.cgi?id=154085

        Reviewed by Antti Koivisto.

        They are never null.

        No new tests because there is no behavior change.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::CSSFontSelector):
        (WebCore::CSSFontSelector::~CSSFontSelector):
        * platform/graphics/FontCache.cpp:
        (WebCore::FontCache::addClient):
        (WebCore::FontCache::removeClient):
        * platform/graphics/FontCache.h:

2016-02-10  Chris Dumez  <cdumez@apple.com>

        [Web IDL] interface objects should be Function objects
        https://bugs.webkit.org/show_bug.cgi?id=154038
        <rdar://problem/24569358>

        Reviewed by Geoffrey Garen.

        interface objects should be Function objects as per Web IDL:
        - http://heycam.github.io/webidl/#interface-object
        - http://heycam.github.io/webidl/#es-interfaces

        So window.Event should be a Function object for e.g. but in WebKit it
        is a regular EventConstructor JSObject.
        Firefox and Chrome match the specification.

        Test: js/interface-objects.html

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::callThrowTypeError):
        (WebCore::DOMConstructorObject::getCallData):
        When calling the interface object as a function, we throw a TypeError
        with a message asking to use the 'new' operator to match the behavior
        of Firefox and Chrome.

        * bindings/js/JSDOMBinding.h:
        Add JSC::TypeOfShouldCallGetCallData structure flag and implement
        getCallData() so that typeof returns "function", as per the
        specification and the behavior of other browsers.

        (WebCore::DOMConstructorObject::className):
        Implement className() and return "Function" to match the specification and
        other browsers. Otherwise, it would fall back to using ClassInfo::className
        which os the function name and interface name (e.g. "Event").

        * bindings/js/JSDOMConstructor.h:
        (WebCore::JSDOMConstructorNotConstructable::callThrowTypeError):
        (WebCore::JSDOMConstructorNotConstructable::getCallData):
        As per the specification, interfaces that do not have a [Constructor]
        should throw a TypeError when called as a function. Use the "Illegal
        constructor" error message to match Firefox and Chrome.

        * bindings/js/JSDOMGlobalObject.h:
        (WebCore::getDOMConstructor):
        Instead of using objectPrototype as prototype for all DOM constructors,
        we now call the prototypeForStructure() static function that is
        generated for each bindings class. As per the Web IDL specification,
        The [[Prototype]] internal property of an interface object for a
        non-callback interface is determined as follows:
        1. If the interface inherits from some other interface, the value of
           [[Prototype]] is the interface object for that other interface.
        2. If the interface doesn't inherit from any other interface, the value
           of [[Prototype]] is %FunctionPrototype% ([ECMA-262], section 6.1.7.4).

        * bindings/js/JSImageConstructor.cpp:
        (WebCore::JSImageConstructor::prototypeForStructure):
        Have the Image's interface object use HTMLElement's interface object
        as prototype as HTMLImageElement inherits HTMLElement.

        * bindings/scripts/CodeGenerator.pm:
        (getInterfaceExtendedAttributesFromName):
        Add a utility function to cheaply retrieve an interface's IDL extended
        attributes without actually parsing the IDL. This is used to check if
        an interface's parent is marked as [NoInterfaceObject] currently.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        (GenerateCallbackHeader):
        (GenerateCallbackImplementation):
        Mark JSGlobalObject* parameter as const as the implementation does not
        alter the globalObject.

        (GenerateConstructorHelperMethods):
        - Generate prototypeForStructure() function for each bindings class that
          is not marked as [NoInterfaceObject] so getDOMConstructor() knows which
          prototype to use for the interface object / constructor when constructing
          it.
        - Use the interface name for the interface object, without the "Constructor"
          suffix, to match the behavior of Firefox and Chrome.

        * bindings/scripts/test/*:
        Rebaseline bindings tests.

2016-02-10  Jer Noble  <jer.noble@apple.com>

        [Mac] Graphical corruption in videos when enabling custom loading path
        https://bugs.webkit.org/show_bug.cgi?id=154044

        Reviewed by Alex Christensen.

        Revert the "Drive-by fix" in r196345 as it breaks the WebCoreNSURLSessionTests.BasicOperation API test.

        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):

2016-02-10  Myles C. Maxfield  <mmaxfield@apple.com>

        CSSSegmentedFontFace does not need to be reference counted
        https://bugs.webkit.org/show_bug.cgi?id=154083

        Reviewed by Antti Koivisto.

        ...There is only ever a single reference to one.

        No new tests because there is no behavior change.

        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::getFontFace):
        * css/CSSFontSelector.h:
        * css/CSSSegmentedFontFace.h:
        (WebCore::CSSSegmentedFontFace::create): Deleted.

2016-02-10  Antti Koivisto  <antti@apple.com>

        Optimize style invalidation after class attribute change
        https://bugs.webkit.org/show_bug.cgi?id=154075
        rdar://problem/12526450

        Reviewed by Andreas Kling.

        Currently a class attribute change invalidates style for the entire element subtree for any class found in the
        active stylesheet set.

        This patch optimizes class changes by building a new optimization structure called ancestorClassRules. It contains
        rules that have class selectors in the portion of the complex selector that matches ancestor elements. The sets
        of rules are hashes by the class name.

        On class attribute change the existing StyleInvalidationAnalysis mechanism is used with ancestorClassRules to invalidate
        exactly those descendants that are affected by the addition or removal of the class name. This is fast because the CSS JIT
        makes selector matching cheap and the number of relevant rules is typically small.

        This optimization is very effective on many dynamic pages. For example when focusing and unfocusing the web inspector it
        cuts down the number of resolved elements from ~1000 to ~50. Even in PLT it reduces the number of resolved elements by ~11%.

        * css/DocumentRuleSets.cpp:
        (WebCore::DocumentRuleSets::collectFeatures):
        (WebCore::DocumentRuleSets::ancestorClassRules):

            Create optimization RuleSets on-demand when there is an actual dynamic class change.

        * css/DocumentRuleSets.h:
        (WebCore::DocumentRuleSets::features):
        (WebCore::DocumentRuleSets::sibling):
        (WebCore::DocumentRuleSets::uncommonAttribute):
        * css/ElementRuleCollector.cpp:
        (WebCore::ElementRuleCollector::ElementRuleCollector):

            Add a new constructor that doesn't requires DocumentRuleSets. Only the user and author style is required.

        (WebCore::ElementRuleCollector::matchAuthorRules):
        (WebCore::ElementRuleCollector::matchUserRules):
        * css/ElementRuleCollector.h:
        * css/RuleFeature.cpp:
        (WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):

            Collect class names that show up in the ancestor portion of the selector.
            Make this a member.

        (WebCore::RuleFeatureSet::collectFeatures):

            Move this code from RuleData.
            Add the rule to ancestorClassRules if needed.

        (WebCore::RuleFeatureSet::add):
        (WebCore::RuleFeatureSet::clear):
        (WebCore::RuleFeatureSet::shrinkToFit):
        (WebCore::recursivelyCollectFeaturesFromSelector): Deleted.
        (WebCore::RuleFeatureSet::collectFeaturesFromSelector): Deleted.
        * css/RuleFeature.h:
        (WebCore::RuleFeature::RuleFeature):
        (WebCore::RuleFeatureSet::RuleFeatureSet): Deleted.
        * css/RuleSet.cpp:
        (WebCore::RuleData::RuleData):
        (WebCore::RuleSet::RuleSet):
        (WebCore::RuleSet::~RuleSet):
        (WebCore::RuleSet::addToRuleSet):
        (WebCore::RuleSet::addRule):
        (WebCore::RuleSet::addRulesFromSheet):
        (WebCore::collectFeaturesFromRuleData): Deleted.
        * css/RuleSet.h:
        (WebCore::RuleSet::tagRules):
        (WebCore::RuleSet::RuleSet): Deleted.
        * css/StyleInvalidationAnalysis.cpp:
        (WebCore::shouldDirtyAllStyle):
        (WebCore::StyleInvalidationAnalysis::StyleInvalidationAnalysis):

            Add a new constructor that takes a ready made RuleSet instead of a stylesheet.

        (WebCore::StyleInvalidationAnalysis::invalidateIfNeeded):
        (WebCore::StyleInvalidationAnalysis::invalidateStyleForTree):
        (WebCore::StyleInvalidationAnalysis::invalidateStyle):
        (WebCore::StyleInvalidationAnalysis::invalidateStyle):

            New function for invalidating a subtree instead of the whole document.

        * css/StyleInvalidationAnalysis.h:
        (WebCore::StyleInvalidationAnalysis::dirtiesAllStyle):
        (WebCore::StyleInvalidationAnalysis::hasShadowPseudoElementRulesInAuthorSheet):
        * dom/Element.cpp:
        (WebCore::classStringHasClassName):
        (WebCore::collectClasses):
        (WebCore::computeClassChange):

            Factor to return the changed classes.

        (WebCore::invalidateStyleForClassChange):

            First filter out classes that don't show up in stylesheets. If something remains invalidate the current
            element for inline style change (that is a style change that doesn't affect descendants).

            Next check if there are any ancestorClassRules for the changed class. If so use the StyleInvalidationAnalysis
            to find any affected descendants and invalidate them with inline style change as well.

        (WebCore::Element::classAttributeChanged):

            Invalidate for removed classes before setting new attribute value, invalidate for added classes afterwards.

        (WebCore::Element::absoluteLinkURL):
        (WebCore::checkSelectorForClassChange): Deleted.
        * dom/ElementData.h:
        (WebCore::ElementData::setClassNames):
        (WebCore::ElementData::classNames):
        (WebCore::ElementData::classNamesMemoryOffset):
        (WebCore::ElementData::clearClass): Deleted.
        (WebCore::ElementData::setClass): Deleted.

2016-02-10  Myles C. Maxfield  <mmaxfield@apple.com>

        Addressing post-review comments after r196322

        Unreviwed.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        * css/CSSFontFaceSource.h:

2016-02-10  Chris Dumez  <cdumez@apple.com>

        Attributes on the Window instance should be configurable unless [Unforgeable]
        https://bugs.webkit.org/show_bug.cgi?id=153920
        <rdar://problem/24563211>

        Reviewed by Darin Adler.

        Attributes on the Window instance should be configurable unless [Unforgeable]:
        1. 'constructor' property:
           - http://www.w3.org/TR/WebIDL/#interface-prototype-object
        2. Constructor properties (e.g. window.Node):
           - http://www.w3.org/TR/WebIDL/#es-interfaces
        3. IDL attributes:
           - http://heycam.github.io/webidl/#es-attributes (configurable unless
             [Unforgeable], e.g. window.location)

        Firefox complies with the WebIDL specification but WebKit does not for 1. and 3.

        Test: fast/dom/Window/window-properties-configurable.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        For known Window properties (i.e. properties in the static property table),
        if we have reified and this is same-origin access, then call
        Base::getOwnPropertySlot() to get the property from the local property
        storage. If we have not reified yet, or this is cross-origin access, query
        the static property table. This is to match the behavior of Firefox and
        Chrome which seem to keep returning the original properties upon cross
        origin access, even if those were deleted or redefined.

        (WebCore::JSDOMWindow::put):
        The previous code used to call the static property setter for properties in
        the static table. However, this does not do the right thing if properties
        were reified. For example, deleting window.name and then trying to set it
        again would not work. Therefore, update this code to only do this if the
        properties have not been reified, similarly to what is done in
        JSObject::putInlineSlow().

        * bindings/scripts/CodeGeneratorJS.pm:
        (ConstructorShouldBeOnInstance):
        Add a FIXME comment indicating that window.constructor should be on
        the prototype as per the Web IDL specification.

        (GenerateAttributesHashTable):
        - Mark 'constructor' property as configurable for Window, as per the
          specification and consistently with other 'constructor' properties:
          http://www.w3.org/TR/WebIDL/#interface-prototype-object
        - Mark properties as configurable even though they are on the instance.
          Window has its properties on the instance as per the specification:
          1. http://heycam.github.io/webidl/#es-attributes
          2. http://heycam.github.io/webidl/#PrimaryGlobal (window is [PrimaryGlobal]
          However, these properties should be configurable as long as they are
          not marked as [Unforgeable], as per 1.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        Rebaseline bindings tests.

2016-02-10  Brady Eidson  <beidson@apple.com>

        Modern IDB: Ref cycle between IDBObjectStore and IDBTransaction.
        https://bugs.webkit.org/show_bug.cgi?id=154061

        Reviewed by Alex Christensen.

        No new tests (Currently untestable).

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::transitionedToFinishing): Make sure the new state makes sense,
          set the new state, and then clear the set of referenced object stores which is no longer needed.
        (WebCore::IDBClient::IDBTransaction::abort):
        (WebCore::IDBClient::IDBTransaction::commit):
        * Modules/indexeddb/client/IDBTransactionImpl.h:

2016-02-10  Jer Noble  <jer.noble@apple.com>

        REGRESSION(r195770): Use-after-free in ResourceLoaderOptions::cachingPolicy
        https://bugs.webkit.org/show_bug.cgi?id=153727
        <rdar://problem/24429886>

        Reviewed by Darin Adler.

        Follow-up after r195965. Only protect those parts of CachedResource::removeClient() which
        affect the MemoryCache when allowsCaching() is false.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::removeClient):

2016-02-10  Csaba Osztrogonác  <ossy@webkit.org>

        Fix the !(ENABLE(SHADOW_DOM) || ENABLE(DETAILS_ELEMENT)) after r196281
        https://bugs.webkit.org/show_bug.cgi?id=154035

        Reviewed by Antti Koivisto.

        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::Context::Context):

2016-02-09  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Toggle buttons are blurry with GTK+ 3.19
        https://bugs.webkit.org/show_bug.cgi?id=154007

        Reviewed by Michael Catanzaro.

        Use min-width/min-height style properties when GTK+ >= 3.19.7 to
        get the size of toggle buttons.

        * rendering/RenderThemeGtk.cpp:
        (WebCore::setToggleSize):
        (WebCore::paintToggle):

2016-02-09  Aakash Jain  <aakash_jain@apple.com>

        Headers that use WEBCORE_EXPORT should include PlatformExportMacros.h
        https://bugs.webkit.org/show_bug.cgi?id=146984

        Reviewed by Alexey Proskuryakov.

        * Modules/speech/SpeechSynthesis.h:
        * contentextensions/ContentExtensionError.h:
        * dom/DeviceOrientationClient.h:
        * platform/graphics/Color.h:
        * platform/ios/wak/WebCoreThread.h:
        * platform/network/CacheValidation.h:
        * platform/network/cf/CertificateInfo.h:

2016-02-09  Nan Wang  <n_wang@apple.com>

        AX: Implement word related text marker functions using TextIterator
        https://bugs.webkit.org/show_bug.cgi?id=153939
        <rdar://problem/24269605>

        Reviewed by Chris Fleizach.

        Using CharacterOffset to implement word related text marker calls. Reused
        logic from previousBoundary and nextBoundary in VisibleUnits class.

        Test: accessibility/mac/text-marker-word-nav.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        (WebCore::AXObjectCache::rangeForNodeContents):
        (WebCore::isReplacedNodeOrBR):
        (WebCore::characterOffsetsInOrder):
        (WebCore::resetNodeAndOffsetForReplacedNode):
        (WebCore::setRangeStartOrEndWithCharacterOffset):
        (WebCore::AXObjectCache::rangeForUnorderedCharacterOffsets):
        (WebCore::AXObjectCache::setTextMarkerDataWithCharacterOffset):
        (WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
        (WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
        (WebCore::AXObjectCache::characterOffsetForNodeAndOffset):
        (WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
        (WebCore::AXObjectCache::previousNode):
        (WebCore::AXObjectCache::visiblePositionFromCharacterOffset):
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
        (WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
        (WebCore::AXObjectCache::nextCharacterOffset):
        (WebCore::AXObjectCache::previousCharacterOffset):
        (WebCore::startWordBoundary):
        (WebCore::endWordBoundary):
        (WebCore::AXObjectCache::startCharacterOffsetOfWord):
        (WebCore::AXObjectCache::endCharacterOffsetOfWord):
        (WebCore::AXObjectCache::previousWordStartCharacterOffset):
        (WebCore::AXObjectCache::nextWordEndCharacterOffset):
        (WebCore::AXObjectCache::leftWordRange):
        (WebCore::AXObjectCache::rightWordRange):
        (WebCore::characterForCharacterOffset):
        (WebCore::AXObjectCache::characterAfter):
        (WebCore::AXObjectCache::characterBefore):
        (WebCore::parentEditingBoundary):
        (WebCore::AXObjectCache::nextWordBoundary):
        (WebCore::AXObjectCache::previousWordBoundary):
        (WebCore::AXObjectCache::rootAXEditableElement):
        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::removeNodeForUse):
        (WebCore::AXObjectCache::isNodeInUse):
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper previousTextMarkerForNode:offset:]):
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:ignoreStart:]):
        (-[WebAccessibilityObjectWrapper textMarkerForNode:offset:]):
        (textMarkerForCharacterOffset):
        (-[WebAccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
        * editing/VisibleUnits.cpp:
        (WebCore::rightWordPosition):
        (WebCore::prepend):
        (WebCore::appendRepeatedCharacter):
        (WebCore::suffixLengthForRange):
        (WebCore::prefixLengthForRange):
        (WebCore::backwardSearchForBoundaryWithTextIterator):
        (WebCore::forwardSearchForBoundaryWithTextIterator):
        (WebCore::previousBoundary):
        (WebCore::nextBoundary):
        * editing/VisibleUnits.h:

2016-02-09  Daniel Bates  <dabates@apple.com>

        CSP: Extract helper classes into their own files
        https://bugs.webkit.org/show_bug.cgi?id=154040
        <rdar://problem/24571189>

        Reviewed by Brent Fulgham.

        No functionality was changed. So, no new tests.

        * CMakeLists.txt: Add files ContentSecurityPolicy{DirectiveList, MediaListDirective, Source, SourceList, SourceListDirective}.cpp.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * page/csp/ContentSecurityPolicy.cpp: Clean up #includes. Include header ParsingUtilities.h so that we can remove our own
        variants of skip{Exactly, Until, While}(). Update code as necessary for class renames.
        (WebCore::skipExactly): Deleted; instead use the analogous function in ParsingUtilities.h.
        (WebCore::skipUntil): Deleted; instead use the analogous function in ParsingUtilities.h.
        (WebCore::skipWhile): Deleted; instead use the analogous function in ParsingUtilities.h.
        (WebCore::isSourceListNone): Moved to file ContentSecurityPolicySourceList.cpp.
        (WebCore::CSPSource): Deleted; moved implementation to files ContentSecurityPolicySource.{cpp, h}.
        (WebCore::CSPSourceList): Deleted; moved implementation to files ContentSecurityPolicySourceList.{cpp, h}.
        (WebCore::CSPDirective): Deleted; moved implementation to file ContentSecurityPolicyDirective.h.
        (WebCore::MediaListDirective): Deleted; moved implementation to files ContentSecurityPolicyMediaListDirective.{cpp, h}.
        (WebCore::SourceListDirective): Deleted; moved implementation to files ContentSecurityPolicySourceListDirective.{cpp, h}.
        (WebCore::CSPDirectiveList): Deleted; moved implementation to files ContentSecurityPolicyDirectiveList.{cpp, h}.
        * page/csp/ContentSecurityPolicy.h:
        * page/csp/ContentSecurityPolicyDirective.h: Added.
        * page/csp/ContentSecurityPolicyDirectiveList.cpp: Added; removed use of ternary operator where it made the code less readable.
        Updated code to make use of the functions defined in ParsingUtilities.h.
        (WebCore::isExperimentalDirectiveName): Moved from file ContentSecurityPolicy.cpp.
        (WebCore::isCSPDirectiveName): Ditto.
        (WebCore::isDirectiveNameCharacter): Ditto.
        (WebCore::isDirectiveValueCharacter): Ditto.
        (WebCore::isNotASCIISpace): Ditto.
        * page/csp/ContentSecurityPolicyDirectiveList.h: Added.
        * page/csp/ContentSecurityPolicyMediaListDirective.cpp: Added. Updated code to make use of the functions defined in ParsingUtilities.h.
        (WebCore::isMediaTypeCharacter): Moved from file ContentSecurityPolicy.cpp.
        (WebCore::isNotASCIISpace): Ditto.
        * page/csp/ContentSecurityPolicyMediaListDirective.h: Added.
        * page/csp/ContentSecurityPolicySource.cpp: Added.
        * page/csp/ContentSecurityPolicySource.h: Added.
        * page/csp/ContentSecurityPolicySourceList.cpp: Added. Updated code to make use of the functions defined in ParsingUtilities.h.
        (WebCore::isSourceCharacter): Moved from file ContentSecurityPolicy.cpp.
        (WebCore::isHostCharacter): Ditto.
        (WebCore::isPathComponentCharacter): Ditto.
        (WebCore::isSchemeContinuationCharacter): Ditto.
        (WebCore::isNotColonOrSlash): Ditto.
        (WebCore::isSourceListNone): Ditto.
        * page/csp/ContentSecurityPolicySourceList.h: Added.
        * page/csp/ContentSecurityPolicySourceListDirective.cpp: Added.
        * page/csp/ContentSecurityPolicySourceListDirective.h: Added.

2016-02-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: TransactionOperation objects leak.
        https://bugs.webkit.org/show_bug.cgi?id=154054

        Reviewed by Alex Christensen.

        No new tests (Currently untestable).

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::abortOnServerAndCancelRequests): Remove the TransactionOperation from
          the map, as this operation doesn't complete "normally" like most others.
        (WebCore::IDBClient::IDBTransaction::commitOnServer): Ditto.
        
        * Modules/indexeddb/client/TransactionOperation.h:
        (WebCore::IDBClient::TransactionOperation::perform): Clear the m_performFunction after use,
          as it holds a lambda that holds a RefPtr to the IDBTransaction, as well as a self-ref.
        (WebCore::IDBClient::TransactionOperation::completed): Clear m_completeFunction for the same reasons.

2016-02-09  Jer Noble  <jer.noble@apple.com>

        [Mac] Graphical corruption in videos when enabling custom loading path
        https://bugs.webkit.org/show_bug.cgi?id=154044

        Reviewed by Alex Christensen.

        The NSOperationQueue provided by AVFoundation from the AVAssetResourceLoader queue is not
        set to be a serial queue. So when adding dataReceived operations to that queue, there exists
        the possibility that some operations are handled before others, and the client will receieve
        data out of order.

        A real NSURLSession object will only issue another operation when the first operation
        completes, so emulate this behavior in WebCoreNSURLSession by using a serial dispatch queue.
        The internal queue will enqueue an operation to the resource loader's queue, and block until
        that operation completes, thus ensuring ordering of the data (and other) operations.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]): Initialize _internalQueue
        (-[WebCoreNSURLSession addDelegateOperation:]): Added utility method.
        (-[WebCoreNSURLSession taskCompleted:]): Call -addDelegateOperation:
        (-[WebCoreNSURLSession finishTasksAndInvalidate]): Ditto.
        (-[WebCoreNSURLSession resetWithCompletionHandler:]): Ditto.
        (-[WebCoreNSURLSession flushWithCompletionHandler:]): Ditto.
        (-[WebCoreNSURLSession getTasksWithCompletionHandler:]): Ditto.
        (-[WebCoreNSURLSession getAllTasksWithCompletionHandler:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]): Ditto.
        (-[WebCoreNSURLSessionDataTask resourceFinished:]): Ditto.

        Drive-by fix:
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]): Set countOfBytesReceived outside the operation,
            queue, matching NSURLSessionDataTask's behavior.

2016-02-09  Nan Wang  <n_wang@apple.com>

        [iOS Simulator] accessibility/text-marker/text-marker-range-stale-node-crash.html crashing
        https://bugs.webkit.org/show_bug.cgi?id=154039

        Reviewed by Chris Fleizach.

        We are accessing the derefed node in the CharacterOffset object, we should create an empty
        CharacterOffset object if the node is not in use.

        It's covered by the test accessibility/text-marker/text-marker-range-stale-node-crash.html.

        * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
        (-[WebAccessibilityTextMarker characterOffset]):
        (-[WebAccessibilityTextMarker isIgnored]):

2016-02-09  Myles C. Maxfield  <mmaxfield@apple.com>

        Unreviewed build fix after r196322

        Unreviewed.

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::font):

2016-02-09  Zalan Bujtas  <zalan@apple.com>

        Outline corners do not align properly for multiline inlines.
        https://bugs.webkit.org/show_bug.cgi?id=154025

        Reviewed by David Hyatt.

        Adjust border position when outline-offset > 0. This patch also
        removes integral pixelsnapping (drawLineForBoxSide takes care of
        device pixelsnapping). 

        Test: fast/inline/outline-corners-with-offset.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutlineForLine):

2016-02-09  Jer Noble  <jer.noble@apple.com>

        [Mac] Adopt NSURLSession properties in AVAssetResourceLoader

        Rubber-stamped by Eric Carlson;

        Set the correct global variable from setAVFoundationNSURLSessionEnabled().

        * page/Settings.cpp:
        (WebCore::Settings::setAVFoundationNSURLSessionEnabled):

2016-02-07  Gavin Barraclough  <barraclough@apple.com>

        GetValueFunc/PutValueFunc should not take both slotBase and thisValue
        https://bugs.webkit.org/show_bug.cgi?id=154009

        Reviewed by Geoff Garen.

        In JavaScript there are two types of properties - regular value properties, and accessor properties.
        One difference between these is how they are reflected by getOwnPropertyDescriptor, and another is
        what object they operate on in the case of a prototype access. If you access a value property of a
        prototype object it return a value pertinent to the prototype, but in the case of a prototype object
        returning an accessor, then the accessor function is applied to the base object of the access.

        JSC supports special 'custom' properties implemented as a c++ callback, and these custom properties
        can be used to implement either value- or accessor-like behavior. getOwnPropertyDescriptor behavior
        is selected via the CustomAccessor attribute. Value- or accessor-like object selection is current
        supported by passing both the slotBase and the thisValue to the callback,and hoping it uses the
        right one. This is probably inefficient, bug-prone, and leads to crazy like JSBoundSlotBaseFunction.

        Instead, just pass one thisValue to the callback functions, consistent with CustomAccessor.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::printErrorMessageForFrame):
        (WebCore::objectToStringFunctionGetter):
        * bindings/js/JSDOMBinding.h:
        (WebCore::propertyNameToString):
        (WebCore::getStaticValueSlotEntryWithoutCaching<JSDOMObject>):
        (WebCore::nonCachingStaticFunctionGetter):
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::visitAdditionalChildren):
        (WebCore::childFrameGetter):
        (WebCore::namedItemGetter):
        (WebCore::jsDOMWindowWebKit):
        (WebCore::jsDOMWindowIndexedDB):
            - add missing null check, in case indexDB acessor is applied to non-window object.
        * bindings/js/JSPluginElementFunctions.cpp:
        (WebCore::pluginScriptObject):
        (WebCore::pluginElementPropertyGetter):
        * bindings/js/JSPluginElementFunctions.h:
        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateHeader):
        (GenerateImplementation):
        * bridge/runtime_array.cpp:
        (JSC::RuntimeArray::destroy):
        (JSC::RuntimeArray::lengthGetter):
        * bridge/runtime_array.h:
        * bridge/runtime_method.cpp:
        (JSC::RuntimeMethod::finishCreation):
        (JSC::RuntimeMethod::lengthGetter):
        * bridge/runtime_method.h:
        * bridge/runtime_object.cpp:
        (JSC::Bindings::RuntimeObject::invalidate):
        (JSC::Bindings::RuntimeObject::fallbackObjectGetter):
        (JSC::Bindings::RuntimeObject::fieldGetter):
        (JSC::Bindings::RuntimeObject::methodGetter):
        * bridge/runtime_object.h:
            - Merged slotBase & thisValue to custom property callbacks.

2016-02-09  Jer Noble  <jer.noble@apple.com>

        Build-fix; add Nullibility macros around previously un-macro'd class definitions.

        * platform/spi/mac/AVFoundationSPI.h:

2016-02-04  Jer Noble  <jer.noble@apple.com>

        [Mac] Adopt NSURLSession properties in AVAssetResourceLoader
        https://bugs.webkit.org/show_bug.cgi?id=153873

        Reviewed by Eric Carlson.

        Adopt a new AVAssetResourceLoader API allowing clients to specify a NSURLSession object to
        use for media loading, and control the use of this property with a new Setting.

        * page/Settings.cpp:
        (WebCore::Settings::setAVFoundationNSURLSessionEnabled):
        * page/Settings.h:
        (WebCore::Settings::isAVFoundationNSURLSessionEnabled):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL):
        * platform/spi/mac/AVFoundationSPI.h:

2016-02-09  Myles C. Maxfield  <mmaxfield@apple.com>

        Decouple font creation from font loading
        https://bugs.webkit.org/show_bug.cgi?id=153414

        Reviewed by Darin Adler.

        Previously, CSSFontFaceSource never triggered a font download until that font was actually used. This means
        that the function which triggers the download also has the goal of returning a font to use. However,
        the CSS Font Loading JavaScript API requires being able to trigger a font download without this extra font
        creation overhead.

        In addition, this patch adds an explicit (and enforced) state transition diagram. The diagram looks like
        this:
                            => Success
                          //
        Pending => Loading
                          \\
                            => Failure

        Therefore, the API for CSSFontFaceSource has changed to expose the concept of these new states. This means
        that its user (CSSSegmentedFontFaceSource) has been updated to handle each possible state that its constituent
        CSSFontFaceSources may be in.

        No new tests because there is no behavior change.

        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::allSourcesFailed): Renamed to make the name clearer.
        (WebCore::CSSFontFace::addedToSegmentedFontFace): Use references instead of pointers.
        (WebCore::CSSFontFace::removedFromSegmentedFontFace): Ditto.
        (WebCore::CSSFontFace::adoptSource): Renamed to make the name clearer.
        (WebCore::CSSFontFace::fontLoaded): Use references instead of pointers. Also, remove old dead code.
        (WebCore::CSSFontFace::font): Adapt to the new API of CSSFontFaceSource.
        (WebCore::CSSFontFace::isValid): Deleted.
        (WebCore::CSSFontFace::addSource): Deleted.
        (WebCore::CSSFontFace::notifyFontLoader): Deleted. Old dead code.
        (WebCore::CSSFontFace::notifyLoadingDone): Deleted. Old dead code.
        * css/CSSFontFace.h:
        (WebCore::CSSFontFace::create): Remove old dead code.
        (WebCore::CSSFontFace::CSSFontFace): Use references instead of pointers.
        (WebCore::CSSFontFace::loadState): Deleted. Remove old dead code.
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::setStatus): Enforce state transitions.
        (WebCore::CSSFontFaceSource::CSSFontFaceSource): Explicitly handle new state transitions.
        (WebCore::CSSFontFaceSource::fontLoaded): Update for new states.
        (WebCore::CSSFontFaceSource::load): Pulled out code from font().
        (WebCore::CSSFontFaceSource::font): Moved code into load().
        (WebCore::CSSFontFaceSource::isValid): Deleted.
        (WebCore::CSSFontFaceSource::isDecodeError): Deleted.
        (WebCore::CSSFontFaceSource::ensureFontData): Deleted.
        * css/CSSFontFaceSource.h: Much cleaner API.
        * css/CSSFontSelector.cpp:
        (WebCore::createFontFace): Migrate to references instead of pointers. This requires a little
        reorganization.
        (WebCore::registerLocalFontFacesForFamily): Update to new CSSFontFaceSource API.
        (WebCore::CSSFontSelector::addFontFaceRule): Ditto.
        (WebCore::CSSFontSelector::getFontFace): Ditto.
        * css/CSSSegmentedFontFace.cpp:
        (WebCore::CSSSegmentedFontFace::CSSSegmentedFontFace): Migrate to references instead of pointers.
        (WebCore::CSSSegmentedFontFace::~CSSSegmentedFontFace): Ditto.
        (WebCore::CSSSegmentedFontFace::fontLoaded): Remove old dead code.
        (WebCore::CSSSegmentedFontFace::appendFontFace): Cleanup.
        (WebCore::CSSSegmentedFontFace::fontRanges): Adopt to new API.
        (WebCore::CSSSegmentedFontFace::pruneTable): Deleted.
        (WebCore::CSSSegmentedFontFace::isLoading): Deleted. Old dead code.
        (WebCore::CSSSegmentedFontFace::checkFont): Deleted. Ditto.
        (WebCore::CSSSegmentedFontFace::loadFont): Deleted. Ditto.
        * css/CSSSegmentedFontFace.h:
        (WebCore::CSSSegmentedFontFace::create): Migrate to references instead of pointers.
        (WebCore::CSSSegmentedFontFace::fontSelector): Ditto.
        (WebCore::CSSSegmentedFontFace::LoadFontCallback::~LoadFontCallback): Deleted.
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::didAddClient): Migrate to references instead of pointers.
        (WebCore::CachedFont::checkNotify): Ditto.
        * loader/cache/CachedFontClient.h:
        (WebCore::CachedFontClient::fontLoaded): Ditto.

2016-02-09  Brady Eidson  <beidson@apple.com>

        Modern IDB: IDBOpenDBRequests leak.
        https://bugs.webkit.org/show_bug.cgi?id=154032

        Reviewed by Alex Christensen.

        No new tests (Currently untestable).

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        Add a simple Event subclass that holds a ref to an IDBRequest, to make sure that we
        drop the last ref to the request after its last event fires or is otherwise destroyed:
        * Modules/indexeddb/IDBRequestCompletionEvent.cpp: Added.
        (WebCore::IDBRequestCompletionEvent::IDBRequestCompletionEvent):
        * Modules/indexeddb/IDBRequestCompletionEvent.h: Added.
        (WebCore::IDBRequestCompletionEvent::create):

        * Modules/indexeddb/client/IDBOpenDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBOpenDBRequest::onError): IDBRequestCompletionEvent instead of Event.
        (WebCore::IDBClient::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit): Ditto.
        (WebCore::IDBClient::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion): Ditto.
        (WebCore::IDBClient::IDBOpenDBRequest::onSuccess): Ditto.

        * Modules/indexeddb/client/IDBTransactionImpl.cpp:
        (WebCore::IDBClient::IDBTransaction::dispatchEvent): After setting up the request's 
          completion event to fire, clear the back-ref to the request.

2016-02-09  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196286.
        https://bugs.webkit.org/show_bug.cgi?id=154026

        Looks like 5% iOS PLT regression (Requested by kling on
        #webkit).

        Reverted changeset:

        "[iOS] Throw away some unlinked code when navigating to a new
        page."
        https://bugs.webkit.org/show_bug.cgi?id=154014
        http://trac.webkit.org/changeset/196286

2016-02-08  Chris Dumez  <cdumez@apple.com>

        Attribute getters should not require an explicit 'this' value for Window properties
        https://bugs.webkit.org/show_bug.cgi?id=153968

        Reviewed by Darin Adler.

        Attribute getters should not require an explicit 'this' value for
        Window properties. This is because the Window interface is marked
        as [ImplicitThis]:
        - http://heycam.github.io/webidl/#ImplicitThis
        - https://www.w3.org/Bugs/Public/show_bug.cgi?id=29421

        This matches the behavior of Firefox and the expectations of the W3C
        web-platform-tests.

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        In attribute getters of an interface marked as [ImplicitThis],
        if 'thisValue' is undefined or null, fall back to using the
        global object as 'thisValue'.

        * bindings/scripts/IDLAttributes.txt:
        Add support for [ImplicitThis]:
        http://heycam.github.io/webidl/#ImplicitThis

        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        Rebaseline bindings tests.

        * page/DOMWindow.idl:
        Mark Window as [ImplicitThis]:
        http://heycam.github.io/webidl/#ImplicitThis

2016-02-08  Nan Wang  <n_wang@apple.com>

        AX: crash at WebCore::Range::selectNodeContents(WebCore::Node*, int&)
        https://bugs.webkit.org/show_bug.cgi?id=154018

        Reviewed by Chris Fleizach.

        Sometimes rangeForUnorderedCharacterOffsets call is accessing derefed node objects
        and leading to a crash. Fixed it by checking isNodeInUse before creating the CharacterOffset
        object.

        Test: accessibility/text-marker/text-marker-range-stale-node-crash.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::visiblePositionForTextMarkerData):
        (WebCore::AXObjectCache::characterOffsetForTextMarkerData):
        (WebCore::AXObjectCache::traverseToOffsetInRange):
        * accessibility/AXObjectCache.h:
        * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
        (-[WebAccessibilityObjectWrapper rangeForTextMarkerRange:]):
        (characterOffsetForTextMarker):
        (-[WebAccessibilityObjectWrapper characterOffsetForTextMarker:]):
        (textMarkerForVisiblePosition):

2016-02-08  Andreas Kling  <akling@apple.com>

        [iOS] Throw away some unlinked code when navigating to a new page.
        <https://webkit.org/b/154014>

        Reviewed by Gavin Barraclough.

        Extended the mechanism introduced earlier to also throw away unlinked code
        that's only relevant to the page that we're navigating away from.

        The new JSC::VM API is deleteAllCodeExceptCaches() and it does what it sounds
        like, deleting unlinked and linked code but leaving code caches alone.

        This means that if the page we're navigating to wants to parse some of the
        same JS that the page we're leaving had on it, it might still be found in the
        JSC::CodeCache.

        Doing a back navigation to a PageCache'd page may now incur some reparsing,
        just like leaving the app or tab would.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::deleteAllCodeExceptCaches):
        (WebCore::GCController::deleteAllLinkedCode): Deleted.
        * bindings/js/GCController.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-02-08  Daniel Bates  <dabates@apple.com>

        CSP connect-src directive should block redirects
        https://bugs.webkit.org/show_bug.cgi?id=69359
        <rdar://problem/24383025>

        Reviewed by Brent Fulgham.

        Inspired by Blink patch:
        <https://src.chromium.org/viewvc/blink?revision=150246&view=revision>

        Apply the connect-src directive of the Content Security Policy for the document or worker to the redirect URL
        of an XMLHttpRequest and EventSource load so as to conform to section Paths and Redirects of the CSP 2.0 spec.,
        <https://w3c.github.io/webappsec-csp/2/#source-list-paths-and-redirects> (29 August 2015).

        Additionally, check that each requested script URL passed to WorkerGlobalScope.importScripts() is allowed by
        the CSP of the worker before initiating a load for it. If some URL i is blocked by the CSP policy
        then we do not try to load URLs j >= i.

        Tests: http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports.html
               http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked.html
               http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin.html
               http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-allowed.html
               http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked.html
               http/tests/security/contentSecurityPolicy/worker-without-csp-importScripts-redirect-cross-origin-allowed.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-for-xhr-redirect.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-importScript-redirect-cross-origin.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker-importScripts-redirect-cross-origin.html
               http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr-redirect-cross-origin.html
               http/tests/security/isolatedWorld/bypass-worker-csp-for-xhr.html

        * fileapi/FileReaderLoader.cpp:
        (WebCore::FileReaderLoader::start): Do not enforce a CSP directive as CSP is not applicable to File API.
        * inspector/InspectorNetworkAgent.cpp:
        (WebCore::InspectorNetworkAgent::loadResource): Do not enforce a CSP directive as CSP should not interfere
        with the Web Inspector.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Modified to take an optional ContentSecurityPolicy
        and pass it through to DocumentThreadableLoader::create().
        (WebCore::DocumentThreadableLoader::create): Modified to take an optional ContentSecurityPolicy and pass it through
        to DocumentThreadableLoader::DocumentThreadableLoader().
        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Modified to take an optional ContentSecurityPolicy.
        Asserts that the CSP allows the load of the request URL so as to catch when a caller creates a loader for a request
        that is not allowed by the CSP. The caller should not create a loader for such a request.
        (WebCore::DocumentThreadableLoader::redirectReceived): Check if the CSP allows the redirect URL. If it does not
        then notify the client that the redirect check failed.
        (WebCore::DocumentThreadableLoader::loadRequest): Ditto.
        (WebCore::DocumentThreadableLoader::isAllowedByContentSecurityPolicy): Checks that the specified URL is allowed
        by the enforced CSP directive.
        (WebCore::DocumentThreadableLoader::contentSecurityPolicy): Returns the ContentSecurityPolicy object passed to
        DocumentThreadableLoader on instantiation or the ContentSecurityPolicy object of the associated document.
        * loader/DocumentThreadableLoader.h: Add overloaded variants of DocumentThreadableLoader::{create, loadResourceSynchronously}()
        that take a std::unique_ptr<ContentSecurityPolicy>&&. Remove some unnecessary headers.
        * loader/ThreadableLoader.cpp:
        (WebCore::ThreadableLoaderOptions::ThreadableLoaderOptions): Take the CSP directive to enforce and store it.
        (WebCore::ThreadableLoaderOptions::isolatedCopy): Copy the CSP directive to enforce.
        * loader/ThreadableLoader.h: Added member field to store the CSP directive to enforce (defaults to enforce the
        directive connect-src - the most appropriate directive in most circumstances). As of the time of writing,
        only WorkerGlobalScope.importScripts() enforces a different directive: script-src.
        * loader/WorkerThreadableLoader.cpp:
        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader): Pass the SecurityOrigin and ContentSecurityPolicy associated
        with the WorkerGlobalScope to WorkerThreadableLoader::MainThreadBridge::MainThreadBridge().
        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge): Pass a copy of the worker's ContentSecurityPolicy
        to the DocumentThreadableLoader.
        * loader/WorkerThreadableLoader.h:
        * page/EventSource.cpp:
        (WebCore::EventSource::connect): Enforce the CSP directive connect-src on redirects unless we are running in an isolated world.
        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::resolveURL): Modified to take a boolean whether to bypass the main world Content Security Policy
        instead of querying for it directly.
        * workers/AbstractWorker.h:
        * workers/Worker.cpp:
        (WebCore::Worker::create): Added FIXME to enforce child-src directive of the document's CSP to the worker's script URL
        on redirect once we fix <https://bugs.webkit.org/show_bug.cgi?id=153562>. For now, do not enforce a CSP policy on redirect
        of the worker's script URL.
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::importScripts): Check that the requested URL is allowed by the CSP of the worker (if applicable).
        Enforce the CSP directive script-src on redirects unless we are running in an isolated world.
        * workers/WorkerScriptLoader.cpp:
        (WebCore::WorkerScriptLoader::loadSynchronously): Pass SecurityOrigin and ContentSecurityPolicyEnforcement to WorkerThreadableLoader.
        (WebCore::WorkerScriptLoader::loadAsynchronously): Ditto.
        * workers/WorkerScriptLoader.h:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Enforce the CSP directive connect-src on redirects unless we are running in
        an isolated world.

2016-02-08  Antti Koivisto  <antti@apple.com>

        Try to fix Yosemite build.

        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
        (WebCore::ComposedTreeIterator::traverseNext):

2016-02-08  Antti Koivisto  <antti@apple.com>

        Implement ComposedTreeIterator in terms of ElementAndTextDescendantIterator
        https://bugs.webkit.org/show_bug.cgi?id=154003

        Reviewed by Darin Adler.

        Currently ComposedTreeIterator implements tree traversal using NodeTraversal. This makes it overly complicated.
        It can also return nodes other than Element and Text which should not be part of the composed tree.

        This patch adds a new iterator type, ElementAndTextDescendantIterator, similar to the existing ElementDescendantIterator.
        ComposedTreeIterator is then implemented using this new iterator.

        When entering a shadow tree or a slot the local iterator is pushed along with the context stack and a new local
        iterator is initialized for the new context. When leaving a shadow tree the context stack is popped and the previous
        local iterator becomes active.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/ComposedTreeIterator.cpp:
        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
        (WebCore::ComposedTreeIterator::initializeContextStack):
        (WebCore::ComposedTreeIterator::pushContext):
        (WebCore::ComposedTreeIterator::traverseNextInShadowTree):
        (WebCore::ComposedTreeIterator::traverseNextLeavingContext):
        (WebCore::ComposedTreeIterator::advanceInSlot):
        (WebCore::ComposedTreeIterator::traverseSiblingInSlot):
        (WebCore::ComposedTreeIterator::initializeShadowStack): Deleted.
        (WebCore::ComposedTreeIterator::traverseParentInShadowTree): Deleted.
        (WebCore::ComposedTreeIterator::traverseNextSiblingSlot): Deleted.
        (WebCore::ComposedTreeIterator::traversePreviousSiblingSlot): Deleted.
        * dom/ComposedTreeIterator.h:
        (WebCore::ComposedTreeIterator::operator*):
        (WebCore::ComposedTreeIterator::operator->):
        (WebCore::ComposedTreeIterator::operator==):
        (WebCore::ComposedTreeIterator::operator!=):
        (WebCore::ComposedTreeIterator::operator++):
        (WebCore::ComposedTreeIterator::Context::Context):
        (WebCore::ComposedTreeIterator::context):
        (WebCore::ComposedTreeIterator::current):
        (WebCore::ComposedTreeIterator::ComposedTreeIterator):
        (WebCore::ComposedTreeIterator::traverseNext):
        (WebCore::ComposedTreeIterator::traverseNextSkippingChildren):
        (WebCore::ComposedTreeIterator::traverseNextSibling):
        (WebCore::ComposedTreeIterator::traversePreviousSibling):
        (WebCore::ComposedTreeDescendantAdapter::ComposedTreeDescendantAdapter):
        (WebCore::ComposedTreeDescendantAdapter::begin):
        (WebCore::ComposedTreeDescendantAdapter::end):
        (WebCore::ComposedTreeDescendantAdapter::at):
        (WebCore::ComposedTreeChildAdapter::Iterator::Iterator):
        (WebCore::ComposedTreeChildAdapter::ComposedTreeChildAdapter):
        (WebCore::ComposedTreeChildAdapter::begin):
        (WebCore::ComposedTreeChildAdapter::end):
        (WebCore::ComposedTreeChildAdapter::at):
        (WebCore::ComposedTreeIterator::ShadowContext::ShadowContext): Deleted.
        (WebCore::ComposedTreeIterator::traverseParent): Deleted.
        * dom/ElementAndTextDescendantIterator.h: Added.

            New iterator type that traverses Element and Text nodes (that is renderable nodes only).
            It also tracks depth for future use.

2016-02-08  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: copy({x:1}) should copy "{x:1}", not "[object Object]"
        https://bugs.webkit.org/show_bug.cgi?id=148605

        Reviewed by Brian Burg.

        Test: inspector/console/command-line-api-copy.html

        * inspector/CommandLineAPIModuleSource.js:
        (CommandLineAPIImpl.prototype.copy):
        Support copying different types. This is meant to be more
        convenient then just JSON.stringify, so it handles types
        like Node, Symbol, RegExp, and Function a bit better.

2016-02-08  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION(r181345): SVG polyline and polygon leak page
        https://bugs.webkit.org/show_bug.cgi?id=152759

        Reviewed by Darin Adler.

        The leak happens because of cyclic reference between SVGListPropertyTearOff 
        and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
        There is also cyclic reference between SVGAnimatedProperty and SVGElement
        and this causes the whole document to be leaked. So if the JS requests, for
        example, an instance of SVGPolylineElement.points, the whole document will be
        leaked.

        The fix depends on having the cyclic reference as is since the owning and the
        owned classes have to live together if any of them is referenced. But the owning
        class caches a raw 'ref-counted' pointer of the owned class. If it is requested
        for an instance of the owned class it returned a RefPtr<> of it. Once the owned
        class is not used, it can delete itself. The only thing needed here is to notify
        the owner class of the deletion so it cleans its caches and be able to create a
        new pointer if it is requested for an instance of the owned class later.

        Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
        to break the cyclic reference between SVGElement and SVGAnimatedProperty.
        
        Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
        animVal() to break cyclic reference between SVGListPropertyTearOff and
        SVGAnimatedListPropertyTearOff.

        Test: svg/animations/smil-leak-list-property-instances.svg

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): The SVG non-string list tear-off properties became of
        type RefPtr<>. So we need to use get() with the casting expressions.
        
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::orientType):
        Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().

        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::pathByteStream):
        (WebCore::SVGPathElement::lookupOrCreateDWrapper):
        Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to 
        use get() for the casting expressions.
        
        (WebCore::SVGPathElement::pathSegList):
        (WebCore::SVGPathElement::normalizedPathSegList):
        (WebCore::SVGPathElement::animatedPathSegList):
        (WebCore::SVGPathElement::animatedNormalizedPathSegList):
        * svg/SVGPathElement.h:
        Change the return value from raw pointer to RefPtr<>.

        * svg/SVGPathSegWithContext.h:
        (WebCore::SVGPathSegWithContext::animatedProperty):
        Change the return type to be RefPtr<> to preserve the value from being deleted.
        
        * svg/SVGPolyElement.cpp:
        (WebCore::SVGPolyElement::parseAttribute):
        Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to 
        use get() for the casting expressions.
        
        (WebCore::SVGPolyElement::points):
        (WebCore::SVGPolyElement::animatedPoints):
        * svg/SVGPolyElement.h:
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/SVGViewSpec.cpp:
        (WebCore::SVGViewSpec::setTransformString):
        Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to 
        use get() for the casting expressions.

        (WebCore::SVGViewSpec::transform):
        * svg/SVGViewSpec.h:
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/properties/SVGAnimatedListPropertyTearOff.h:
        (WebCore::SVGAnimatedListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedListPropertyTearOff::animVal):
        Change the return value from raw pointer to RefPtr<> and change the cached
        value from RefPtr<> to raw pointer. If the property is null, it will be
        created, its raw pointer will be cached and the only ref-counted RefPtr<>
        will be returned. This will guarantee, the RefPtr<> will be deleted once
        it is not used anymore. 
        
        (WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
        Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
        actual pointer. This function will be called from the destructor of
        SVGListPropertyTearOff.
        
        (WebCore::SVGAnimatedListPropertyTearOff::findItem):
        (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
        We have to ensure the baseVal() is created before using it.
        
        (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
        (WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
        (WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
        (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
        (WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
        (WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
        For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
        to the animVal(). This will prevent deleting m_animVal while animation.
        
        * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
        Same as what is done in SVGAnimatedListPropertyTearOff.
        
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
        Same as what is done in SVGAnimatedListPropertyTearOff.
        
        * svg/properties/SVGAnimatedProperty.h:
        (WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
        Change the return value from raw reference to Ref<> and change the
        cached value from Ref<> to raw pointer. This reverts the change of
        r181345 in this function.
        
        (WebCore::SVGAnimatedProperty::lookupWrapper):
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/properties/SVGAnimatedPropertyMacros.h:
        Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
        
        * svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
        (WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
        Same as what is done in SVGAnimatedListPropertyTearOff.

        * svg/properties/SVGListPropertyTearOff.h:
        (WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
        Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
        its raw pointers when the RefPtr<> deletes itself.

2016-02-08  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] WebKitWebView should send crossing events to the WebProcess
        https://bugs.webkit.org/show_bug.cgi?id=153740

        Reviewed by Michael Catanzaro.

        Update the target element under the mouse also when only updating
        scrollbars, so that if the mouse enters the page when the window
        is not active, the scroll animator is notified that the mouse
        entered the scrollable area.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseMoveEvent): Call
        updateMouseEventTargetNode() before early returning in case of
        only updating scrollbars.

2016-02-08  Jeremy Jones  <jeremyj@apple.com>

        PiP and external playback are mutually exclusive.
        https://bugs.webkit.org/show_bug.cgi?id=153988
        rdar://problem/24108661

        Reviewed by Eric Carlson.

        Adding isPlayingOnSecondScreen to isPlayingOnExternalScreen allows AVKit to disable PiP
        when appropriate. Testing video fullscreen mode in updateDisableExternalPlayback allows us to 
        turn-off external playback when entering picture-in-picture.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenMode):
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateDisableExternalPlayback):
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerController isPlayingOnExternalScreen]):
        (+[WebAVPlayerController keyPathsForValuesAffectingPlayingOnExternalScreen]):

2016-02-08  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196253.
        https://bugs.webkit.org/show_bug.cgi?id=153990

        Caused several crashes in GTK+ bots (Requested by KaL on
        #webkit).

        Reverted changeset:

        "[GTK] WebKitWebView should send crossing events to the
        WebProcess"
        https://bugs.webkit.org/show_bug.cgi?id=153740
        http://trac.webkit.org/changeset/196253

2016-02-08  Jeremy Jones  <jeremyj@apple.com>

        WebAVPlayerController should implement currentTimeWithinEndTimes.
        https://bugs.webkit.org/show_bug.cgi?id=153983
        rdar://problem/22864621

        Reviewed by Eric Carlson.

        Implement currentTimeWithinEndTimes in terms of seekToTime and AVTiming. This is a trivial
        implementation becuase AVPlayer start and end times aren't used.

        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerController currentTimeWithinEndTimes]):
        (-[WebAVPlayerController setCurrentTimeWithinEndTimes:]):
        (+[WebAVPlayerController keyPathsForValuesAffectingCurrentTimeWithinEndTimes]):

2016-02-08  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] WebKitWebView should send crossing events to the WebProcess
        https://bugs.webkit.org/show_bug.cgi?id=153740

        Reviewed by Michael Catanzaro.

        Update the target element under the mouse also when only updating
        scrollbars, so that if the mouse enters the page when the window
        is not active, the scroll animator is notified that the mouse
        entered the scrollable area.

        * page/EventHandler.cpp:
        (WebCore::EventHandler::handleMouseMoveEvent): Call
        updateMouseEventTargetNode() before early returning in case of
        only updating scrollbars.

2016-02-08  Jeremy Jones  <jeremyj@apple.com>

        WebVideoFullscreenInterface should handle video resizing.
        https://bugs.webkit.org/show_bug.cgi?id=153982
        rdar://problem/22031249

        Reviewed by Eric Carlson.

        Video fullscreen can be initiated before video dimension are available.
        Protect against an initial width or height of zero and observe resize events 
        to update once video dimensions become available or change.

        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::updateForEventName):
        (WebVideoFullscreenModelVideoElement::observedEventNames):
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        (-[WebAVPlayerLayer layoutSublayers]):
        (-[WebAVPlayerLayer videoRect]):
        (WebVideoFullscreenInterfaceAVKit::setVideoDimensions):

2016-02-08  Adrien Plazas  <aplazas@igalia.com>

        Indent inline box test fails due to assertion in VisibleSelection::selectionFromContentsOfNode()
        https://bugs.webkit.org/show_bug.cgi?id=153824

        Reviewed by Michael Catanzaro.

        * editing/markup.cpp:
        (WebCore::highestAncestorToWrapMarkup):

2016-02-07  Sam Weinig  <sam@webkit.org>

        Remove unused enum ScrollbarOverlayState.

        Rubber-stamped by Dan Bernstein.

        * platform/ScrollTypes.h:

2016-02-07  Sam Weinig  <sam@webkit.org>

        Remove unnecessary respondsToSelector checks for methods that exist on all supported platforms
        https://bugs.webkit.org/show_bug.cgi?id=153970

        Reviewed by Dan Bernstein.

        -[NSScrollerImp mouseEnteredScroller], -[NSScrollerImp expansionTransitionProgress],
        -[NSScrollerImpPair contentAreaScrolledInDirection:], and -[NSScrollerImp setExpanded:]
        are now available on all supported OS's. No need to check for them.

        * platform/mac/ScrollAnimatorMac.mm:
        (macScrollbarTheme):
        (-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
        (WebCore::ScrollAnimatorMac::mouseEnteredScrollbar):
        (WebCore::ScrollAnimatorMac::mouseExitedScrollbar):
        (WebCore::ScrollAnimatorMac::sendContentAreaScrolled):
        (WebCore::ScrollAnimatorMac::sendContentAreaScrolledTimerFired):
        (supportsUIStateTransitionProgress): Deleted.
        (supportsExpansionTransitionProgress): Deleted.
        (supportsContentAreaScrolledInDirection): Deleted.
        * platform/mac/ScrollbarThemeMac.mm:
        (+[WebScrollbarPrefsObserver appearancePrefsChanged:]):
        (+[WebScrollbarPrefsObserver behaviorPrefsChanged:]):
        (WebCore::ScrollbarThemeMac::scrollbarThickness):

2016-02-07  Sam Weinig  <sam@webkit.org>

        Use modern SPI header idiom for NSScrollerImp and NSScrollerImpPair
        https://bugs.webkit.org/show_bug.cgi?id=153969

        Reviewed by Dan Bernstein.

        * WebCore.xcodeproj/project.pbxproj:
        Add new file NSScrollerImpSPI.h

        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        Use new include of NSScrollerImpSPI.h.

        * platform/ScrollbarThemeComposite.h:
        Define ScrollbarPainter more precisely as NSScrollerImp * now that the type is available to us.

        * platform/mac/NSScrollerImpDetails.h:
        Remove NSObject category based SPI usage with the modern one NSScrollerImpSPI.h

        * platform/mac/NSScrollerImpDetails.mm:
        (WebCore::recommendedScrollerStyle):
        Simplify recommendedScrollerStyle() now that all OS's we ship on have +[NSScroller preferredScrollerStyle].

        * platform/mac/ScrollAnimatorMac.mm:
        (supportsUIStateTransitionProgress):
        (supportsExpansionTransitionProgress):
        (supportsContentAreaScrolledInDirection):
        Stop using NSClassFromString now that we can reference the classes explicitly.

        (-[WebScrollbarPainterControllerDelegate invalidate]):
        (-[WebScrollbarPainterControllerDelegate contentAreaRectForScrollerImpPair:]):
        (-[WebScrollbarPainterControllerDelegate inLiveResizeForScrollerImpPair:]):
        (-[WebScrollbarPainterControllerDelegate mouseLocationInContentAreaForScrollerImpPair:]):
        (-[WebScrollbarPainterControllerDelegate scrollerImpPair:convertContentPoint:toScrollerImp:]):
        (-[WebScrollbarPainterControllerDelegate scrollerImpPair:setContentAreaNeedsDisplayInRect:]):
        (-[WebScrollbarPainterControllerDelegate scrollerImpPair:updateScrollerStyleForNewRecommendedScrollerStyle:]):
        (-[WebScrollbarPainterDelegate layer]):
        (-[WebScrollbarPainterDelegate mouseLocationInScrollerForScrollerImp:]):
        (-[WebScrollbarPainterDelegate convertRectToLayer:]):
        (-[WebScrollbarPainterDelegate shouldUseLayerPerPartForScrollerImp:]):
        (-[WebScrollbarPainterDelegate setUpAlphaAnimation:scrollerPainter:part:animateAlphaTo:duration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateKnobAlphaTo:duration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateTrackAlphaTo:duration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateUIStateTransitionWithDuration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:animateExpansionTransitionWithDuration:]):
        (-[WebScrollbarPainterDelegate scrollerImp:overlayScrollerStateChangedTo:]):
        (WebCore::ScrollAnimatorMac::ScrollAnimatorMac):
        (WebCore::ScrollAnimatorMac::lockOverlayScrollbarStateToHidden):
        (WebCore::ScrollAnimatorMac::didAddVerticalScrollbar):
        (WebCore::ScrollAnimatorMac::didAddHorizontalScrollbar):
        (WebCore::ScrollAnimatorMac::updateScrollerStyle):
        Add proper conforming to protocols and replace ids with proper types.

        * platform/mac/ScrollbarThemeMac.mm:
        (WebCore::supportsExpandedScrollbars):
        (WebCore::ScrollbarThemeMac::registerScrollbar):
        (WebCore::ScrollbarThemeMac::scrollbarThickness):
        (WebCore::ScrollbarThemeMac::setUpContentShadowLayer):
        Stop using NSClassFromString now that we can reference the classes explicitly.

        * platform/spi/mac/NSScrollerImpSPI.h: Added.

2016-02-07  Zalan Bujtas  <zalan@apple.com>

        Outline does not clip when ancestor has overflow: hidden and requires layer.
        https://bugs.webkit.org/show_bug.cgi?id=153901

        Now that outline is part of visual overflow, we no longer need the special outline cliprect.
        PaintPhaseChildOutlines drawing will switch to foreground cliprect. It ensures proper overflow clipping
        at parent level. PaintPhaseSelfOutline drawing will start using the visual overflow inflated background cliprect.
        With this change, outline will be using the same cliprects as the other visual overflow properties (box-shadow etc). 

        Reviewed by David Hyatt.

        Test: fast/repaint/outline-with-overflow-hidden-ancestor.html

        * rendering/LayerFragment.h:
        (WebCore::LayerFragment::setRects):
        (WebCore::LayerFragment::moveBy): Deleted.
        (WebCore::LayerFragment::intersect): Deleted.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::collectFragments):
        (WebCore::RenderLayer::paintOutlineForFragments):
        (WebCore::RenderLayer::calculateClipRects):
        (WebCore::RenderLayer::paintForegroundForFragments): Deleted.
        * rendering/RenderLayer.h:
        * rendering/RenderTreeAsText.cpp:
        (WebCore::write):
        (WebCore::writeLayers):

2016-02-07  Daniel Bates  <dabates@apple.com>

        CSP: Allow Web Workers initiated from an isolated world to bypass the main world Content Security Policy
        https://bugs.webkit.org/show_bug.cgi?id=153622
        <rdar://problem/24400023>

        Reviewed by Gavin Barraclough.

        Fixes an issue where Web Workers initiated from an isolated world (say, a Safari Content Script Extension)
        would be subject to the Content Security Policy of the page.

        Currently code in an isolated world that does not execute in a Web Worker is exempt from the CSP of
        the page. However, code that runs inside a Web Worker that was initiated from an isolated world is
        subject to the CSP of the page. Instead, such Web Worker code should also be exempt from the CSP of
        the page.

        Tests: http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-eval.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker-blob-xhr.html
               http/tests/security/isolatedWorld/bypass-main-world-csp-worker.html

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect): Modified to ask the script execution context whether to bypass the
        main world Content Security Policy now that script execution context knows this information.
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::shouldBypassMainWorldContentSecurityPolicy): Deleted; moved logic from here...
        * bindings/js/ScriptController.h:
        * dom/Document.cpp:
        (WebCore::Document::shouldBypassMainWorldContentSecurityPolicy): ...to here.
        * dom/Document.h:
        * dom/ScriptExecutionContext.h:
        (WebCore::ScriptExecutionContext::shouldBypassMainWorldContentSecurityPolicy): Added; defaults to false -
        do not bypass the main world Content Security Policy.
        * page/EventSource.cpp:
        (WebCore::EventSource::create): Modified to ask the script execution context whether to bypass the
        main world Content Security Policy now that script execution context knows this information.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::shouldBypassMainWorldContentSecurityPolicy): Deleted.
        * page/csp/ContentSecurityPolicy.h:
        * workers/AbstractWorker.cpp:
        (WebCore::AbstractWorker::resolveURL): Bypass the main world Content Security Policy if applicable.
        Added FIXME comment to enforce the child-src directive of the document's CSP (as opposed to the script-src
        directive) on the worker's script URL. Also, scriptExecutionContext()->contentSecurityPolicy() should
        always be non-null just as we expect scriptExecutionContext()->securityOrigin() to be non-null. Assert
        this invariant to catch cases where a ScriptExecutionContext is not properly initialized.
        * workers/DedicatedWorkerGlobalScope.cpp:
        (WebCore::DedicatedWorkerGlobalScope::create): Modified to take boolean argument shouldBypassMainWorldContentSecurityPolicy
        as to whether to bypass the main world Content Security Policy and only apply the Content Security
        Policy headers when shouldBypassMainWorldContentSecurityPolicy is false.
        (WebCore::DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
        as to whether to bypass the main world Content Security Policy.
        * workers/DedicatedWorkerGlobalScope.h:
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread): Ditto.
        (WebCore::DedicatedWorkerThread::createWorkerGlobalScope): Ditto.
        * workers/DedicatedWorkerThread.h:
        * workers/Worker.cpp:
        (WebCore::Worker::create): Store whether we should bypass the main world Content Security Policy so
        that we can pass it to WorkerMessagingProxy::startWorkerGlobalScope() in Worker::notifyFinished().
        We need to store this decision here as opposed to determining it at any later time (say, in Worker::notifyFinished())
        because it is dependent on the current JavaScript program stack at the time this function is invoked.
        (WebCore::Worker::notifyFinished): Pass whether to bypass the main world Content Security Policy.
        * workers/Worker.h:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope): Modified to take a boolean as to whether to bypass the
        main world Content Security Policy and store it in a member field. Also, always instantiate a Content
        Security Policy object as our current code assumes that one is always created.
        * workers/WorkerGlobalScope.h:
        * workers/WorkerGlobalScopeProxy.h:
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerGlobalScope): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
        as to whether to bypass the main world Content Security Policy.
        * workers/WorkerMessagingProxy.h:
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData): Modified to take a boolean argument as to
        whether to bypass the main world Content Security Policy and store it in a member field.
        (WebCore::WorkerThread::WorkerThread): Pass through a boolean argument shouldBypassMainWorldContentSecurityPolicy
        as to whether to bypass the main world Content Security Policy.
        (WebCore::WorkerThread::workerThread): Ditto.
        * workers/WorkerThread.h:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open): Modified to ask the script execution context whether to bypass the
        main world Content Security Policy now that script execution context knows this information.

2016-02-07  Dan Bernstein  <mitz@apple.com>

        [Cocoa] Replace __has_include guards around inclusion of Apple-internal-SDK headers with USE(APPLE_INTERNAL_SDK)
        https://bugs.webkit.org/show_bug.cgi?id=153963

        Reviewed by Sam Weinig.

        * accessibility/mac/AXObjectCacheMac.mm:
        * crypto/CommonCryptoUtilities.cpp:
        * crypto/CommonCryptoUtilities.h:
        * editing/mac/TextUndoInsertionMarkupMac.h:
        * editing/mac/TextUndoInsertionMarkupMac.mm:
        * platform/cocoa/TelephoneNumberDetectorCocoa.cpp:
        * platform/graphics/cg/ImageSourceCG.cpp:
        * platform/graphics/mac/PDFDocumentImageMac.mm:
        * platform/network/ios/NetworkStateNotifierIOS.mm:
        * platform/network/mac/BlobDataFileReferenceMac.mm:
        * platform/network/mac/ResourceHandleMac.mm:
        * rendering/RenderThemeMac.mm:

2016-02-07  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r195661): [GTK] Scrollbar tests crashing after overlay scrollbar groundwork
        https://bugs.webkit.org/show_bug.cgi?id=153695

        Reviewed by Michael Catanzaro.

        The problem is that ScrollAnimation objects are not destroyed by
        the ScrollAnimator destructor, because I forgot to add a virtual
        destructor for ScrollAnimation in r195661.

        * platform/ScrollAnimation.h:
        (WebCore::ScrollAnimation::~ScrollAnimation):

2016-02-06  Chris Dumez  <cdumez@apple.com>

        Prevent cross-origin access to window.history
        https://bugs.webkit.org/show_bug.cgi?id=153931

        Reviewed by Darin Adler.

        Prevent cross-origin access to window.history to match the specification [1]
        and the behavior of other browsers (tested Firefox and Chrome).

        [1] https://html.spec.whatwg.org/multipage/browsers.html#security-window

        No new tests, already covered by existing tests that
        were updated in this patch.

        * bindings/js/JSHistoryCustom.cpp:
        (WebCore::JSHistory::pushState):
        (WebCore::JSHistory::replaceState):
        (WebCore::JSHistory::state): Deleted.
        * page/DOMWindow.idl:
        * page/History.idl:

2016-02-06  Beth Dakin  <bdakin@apple.com>

        ScrollbarPainters needs to be deallocated on the main thread
        https://bugs.webkit.org/show_bug.cgi?id=153932
        -and corresponding-
        rdar://problem/24015483

        Reviewed by Dan Bernstein.

        Darin pointed out that this was still race-y. There was still a race 
        condition between the destruction of the two local variables and the
        destruction of the lambda on the main thread. This should fix that. 
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::releaseReferencesToScrollbarPaintersOnTheMainThread):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-06  Darin Adler  <darin@apple.com>

        Finish auditing call sites of upper() and lower(), eliminate many, and rename the functions
        https://bugs.webkit.org/show_bug.cgi?id=153905

        Reviewed by Sam Weinig.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::isTypeSupported): Use convertToASCIILowercase on MIME type.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::selectText): Use new names for lower and upper. Also
        tweaked style a tiny bit and used u_toupper rather than converting an entire
        string to uppercase.

        * dom/Document.cpp:
        (WebCore::Document::addImageElementByCaseFoldedUsemap): Renamed to reflect the use
        of case folding rather than lowercasing.
        (WebCore::Document::removeImageElementByCaseFoldedUsemap): Ditto.
        (WebCore::Document::imageElementByCaseFoldedUsemap): Ditto.
        * dom/Document.h: Ditto.
        * dom/DocumentOrderedMap.cpp:
        (WebCore::DocumentOrderedMap::getElementByCaseFoldedMapName): Ditto.
        (WebCore::DocumentOrderedMap::getElementByCaseFoldedUsemap): Ditto.
        * dom/DocumentOrderedMap.h: Ditto.

        * dom/TreeScope.cpp:
        (WebCore::TreeScope::getImageMap): Removed unneeded special case for null string.
        Simplified logic for cases where the URL does not have a "#" character in it.
        Use case folding instead of lowercase.

        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::_processText): Removed unneded special case for the empty string.
        Use makCapitalized instead of Cocoa function for "capitalize". Use upper and lower
        functions by their new names.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::parseAttribute): Use case folding instead of
        lowerasing for the usemap attribute.
        (WebCore::HTMLImageElement::insertedInto): Ditto.
        (WebCore::HTMLImageElement::removedFrom): Ditto.
        (WebCore::HTMLImageElement::matchesCaseFoldedUsemap): Ditto.
        * html/HTMLImageElement.h: Rename since usemap is case folded now, not lowercased.

        * html/HTMLMapElement.cpp:
        (WebCore::HTMLMapElement::imageElement): Use case folding instead of lowercasing
        for usemap.
        (WebCore::HTMLMapElement::parseAttribute): Ditto.

        * platform/Language.cpp:
        (WebCore::canonicalLanguageIdentifier): Use convertToASCIILowercase for language code.
        (WebCore::indexOfBestMatchingLanguageInList): Ditto.

        * platform/graphics/harfbuzz/HarfBuzzShaper.cpp:
        (WebCore::HarfBuzzShaper::shapeHarfBuzzRuns): Use new name for the upper function.

        * platform/network/HTTPParsers.cpp:
        (WebCore::parseContentTypeOptionsHeader): Use equalLettersIgnoringASCIICase instead
        of lowercasing to check for a specific header value.

        * platform/network/MIMEHeader.cpp:
        (WebCore::retrieveKeyValuePairs): Use convertToASCIILowercase for MIME header name.
        (WebCore::MIMEHeader::parseContentTransferEncoding): Use equalLettersIgnoringASCIICase
        instead of lowercasing.

        * platform/network/cf/ResourceHandleCFNet.cpp:
        (WebCore::allowsAnyHTTPSCertificateHosts): Make this hash ASCII case-insensitive.
        (WebCore::clientCertificates): Ditto.
        (WebCore::ResourceHandle::createCFURLConnection): Remove call to lower since the
        set is now ASCII case-insensitive.
        (WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Ditto.
        (WebCore::ResourceHandle::setClientCertificate): Ditto.

        * platform/network/curl/CookieJarCurl.cpp:
        (WebCore::getNetscapeCookieFormat): Use equalLettersIgnoringASCIICase instead of
        lowercasing.

        * platform/network/curl/MultipartHandle.cpp:
        (WebCore::MultipartHandle::didReceiveResponse): Use convertToASCIILowercase to
        make a MIME type lowercase.

        * platform/network/curl/ResourceHandleCurl.cpp:
        (WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Removed unneeded
        conversion to lowercase now that the set is ASCII case-insensitive.
        (WebCore::ResourceHandle::setClientCertificate): Removed code that populates a map
        that is then never used for anything.

        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::headerCallback): Use convertToASCIILowercase for MIME type.

        * platform/network/curl/SSLHandle.cpp: Made hash maps keyed by host names
        ASCII case-insensitive.
        (WebCore::addAllowedClientCertificate): Removed lowercasing since the map itself
        is now ASCII case insensitve.
        (WebCore::setSSLClientCertificate): Ditto. Also use auto for iterator type so we
        don't have to write out the map type.
        (WebCore::sslIgnoreHTTPSCertificate): Ditto.
        (WebCore::certVerifyCallback): Ditto.

        * platform/network/soup/ResourceHandleSoup.cpp: Made hash maps keyed by host names
        ASCII case-insensitive.
        (WebCore::allowsAnyHTTPSCertificateHosts): Ditto.
        (WebCore::handleUnignoredTLSErrors): Ditto.
        (WebCore::ResourceHandle::setHostAllowsAnyHTTPSCertificate): Ditto.
        (WebCore::ResourceHandle::setClientCertificate): Ditto.

        * platform/text/LocaleToScriptMappingDefault.cpp: Made hash maps keyed by script
        names ASCII case-insensitive. USE WTF_ARRAY_LENGTH as appropriate.
        (WebCore::scriptNameToCode): Use modern style to initialize the map. Removed
        unnecessary lowercasing of the script name before looking at the map.
        (WebCore::localeToScriptCodeForFontSelection): Ditto.

        * platform/text/win/LocaleWin.cpp:
        (WebCore::convertLocaleNameToLCID): Made map ASCII case-insensitive and removed
        unneeded lowercasing.

        * platform/win/PasteboardWin.cpp:
        (WebCore::clipboardTypeFromMIMEType): Use equalLettersIgnoringASCIICase instead
        of lowercasing.

        * rendering/RenderText.cpp:
        (WebCore::applyTextTransform): Use new names for the upper and lower functions.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseIsXML): Remove unneeded lowercasing, since
        DOMImplementation now has ASCII case-insensitive handling of MIME types.

2016-02-06  Zalan Bujtas  <zalan@apple.com>

        Outline should contribute to visual overflow.
        https://bugs.webkit.org/show_bug.cgi?id=153299

        This patch eliminates the special outline handling (RenderView::setMaximalOutlineSize).
        Now that outline is part of visual overflow, we don't have to inflate the layers to accomodate
        outline borders.
        This patch fixes several focusring related repaint issues. However when both the outline: auto
        and the descendant renderer are composited, we still don't paint properly in certain cases. -not a regression.
        (Also when parent renderer has overflow: hidden repaint does not take outline into account. -regression.)
        It changes column behavior (see TestExpectations) since outline behaves now like any other visual overflow properties.

        Reviewed by David Hyatt.

        Test: fast/repaint/focus-ring-repaint.html
              fast/repaint/focus-ring-repaint-with-negative-offset.html

        * css/html.css: resetting to old behavior.
        (:focus):
        (input:focus, textarea:focus, isindex:focus, keygen:focus, select:focus):
        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::addToLine):
        (WebCore::InlineFlowBox::addOutlineVisualOverflow):
        (WebCore::InlineFlowBox::computeOverflow):
        (WebCore::InlineFlowBox::paint): Deleted.
        * rendering/InlineFlowBox.h:
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computeOverflow):
        (WebCore::RenderBlock::outlineStyleForRepaint):
        (WebCore::RenderBlock::paint): Deleted.
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::layoutBlock): Deleted.
        (WebCore::RenderBlockFlow::addFocusRingRectsForInlineChildren): Deleted.
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::addOverflowFromInlineChildren):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::addVisualEffectOverflow):
        (WebCore::RenderBox::applyVisualEffectOverflow):
        (WebCore::RenderBox::clippedOverflowRectForRepaint): Deleted.
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderDetailsMarker.cpp:
        (WebCore::RenderDetailsMarker::paint): Deleted.
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::insertChildInternal):
        (WebCore::RenderElement::styleDidChange):
        (WebCore::RenderElement::repaintAfterLayoutIfNeeded):
        (WebCore::RenderElement::issueRepaintForOutlineAuto):
        (WebCore::RenderElement::updateOutlineAutoAncestor):
        (WebCore::RenderElement::computeMaxOutlineSize): Deleted.
        (WebCore::RenderElement::styleWillChange): Deleted.
        * rendering/RenderElement.h:
        (WebCore::RenderElement::hasContinuation):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::paintOutlineForLine): Deleted.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::anyLineIntersectsRect):
        (WebCore::RenderLineBoxList::lineIntersectsDirtyRect):
        (WebCore::RenderLineBoxList::paint):
        (WebCore::isOutlinePhase): Deleted.
        * rendering/RenderLineBoxList.h:
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::computePreferredLogicalWidths):
        * rendering/RenderListMarker.cpp:
        (WebCore::RenderListMarker::paint): Deleted.
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::propagateRepaintToParentWithOutlineAutoIfNeeded): The renderer with outline: auto is responsible for
        painting focusring around the descendants. If we issued repaint only on the descendant when it changes,
        the focusring would not refresh properly. We have to find the ancestor with outline: auto, inflate the repaint rect and
        issue the repaint on the ancestor if we crossed repaint container.
 
        (WebCore::RenderObject::repaintUsingContainer):
        (WebCore::RenderObject::adjustRectForOutlineAndShadow):
        (WebCore::RenderObject::setHasOutlineAutoAncestor):
        (WebCore::RenderObject::adjustRectWithMaximumOutline): Deleted.
        
        * rendering/RenderObject.h: We mark the descendants of outline: auto so that
        when a child renderer changes we can propagate the repaint to the ancestor with outline.

        (WebCore::RenderObject::hasOutlineAutoAncestor):
        (WebCore::RenderObject::RenderObjectRareData::RenderObjectRareData):
        * rendering/RenderRegion.cpp:
        (WebCore::RenderRegion::overflowRectForFlowThreadPortion):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::shouldPaint): Deleted.
        (WebCore::RenderReplaced::clippedOverflowRectForRepaint): Deleted.
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paint): Deleted.
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::clippedOverflowRectForRepaint): Deleted.
        (WebCore::RenderTableCell::paintCollapsedBorders): Deleted.
        * rendering/RenderTableRow.cpp:
        (WebCore::RenderTableRow::layout):
        (WebCore::RenderTableRow::clippedOverflowRectForRepaint): Deleted.
        * rendering/RenderTableSection.cpp:
        (WebCore::RenderTableSection::layoutRows):
        (WebCore::RenderTableSection::computeOverflowFromCells): Deleted.
        (WebCore::RenderTableSection::paintObject): Deleted.
        * rendering/RenderTheme.h:
        (WebCore::RenderTheme::platformFocusRingWidth):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::setMaximalOutlineSize): Deleted.
        * rendering/RenderView.h:
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeAffectsVisualOverflow):
        (WebCore::RenderStyle::outlineWidth):
        * rendering/style/RenderStyle.h:

2016-02-06  Andreas Kling  <akling@apple.com>

        [iOS] Throw away linked code when navigating to a new page.
        <https://webkit.org/b/153851>

        Reviewed by Gavin Barraclough.

        When navigating to a new page, tell JSC to throw out any linked code it has lying around.
        Linked code is tied to a specific global object, and as we're creating a new one for the
        new page, none of it is useful to us here.

        In the event that the user navigates back, the cost of relinking some code will be far
        lower than the memory cost of keeping all of it around.

        This landed previously but was rolled out due to a Speedometer regression. I've made one
        minor but important change here: only throw away code if we're navigating away from an
        existing history item. Or in other words, don't throw away code for "force peeks" or any
        other navigations that are not traditional top-level main frame navigations.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::deleteAllLinkedCode):
        * bindings/js/GCController.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-02-06  Konstantin Tokarev  <annulen@yandex.ru>

        Added implementations of AXObjectCache methods for !HAVE(ACCESSIBILITY).
        https://bugs.webkit.org/show_bug.cgi?id=153924

        Reviewed by Andreas Kling.

        No new tests needed.

        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::ariaModalNode): Added stub implementation.
        (WebCore::AXObjectCache::postLiveRegionChangeNotification): Ditto.
        (WebCore::AXObjectCache::rangeForNodeContents): Ditto.
        (WebCore::AXObjectCache::setIsSynchronizingSelection): Ditto.
        (WebCore::AXObjectCache::setTextSelectionIntent): Ditto.
        (WebCore::AXAttributeCacheEnabler::AXAttributeCacheEnabler): Ditto.
        (WebCore::AXAttributeCacheEnabler::~AXAttributeCacheEnabler): Ditto.

2016-02-04  Antti Koivisto  <antti@apple.com>

        Use scope stack instead of nested TreeResolvers for shadow trees
        https://bugs.webkit.org/show_bug.cgi?id=153893

        Reviewed by Andreas Kling.

        Make TreeResolver per-document. This is a step towards iterative style resolve.

        This is done replacing use of nested TreeResolvers with a scope stack that maintains
        the style resolver and the selector filter for the current tree scope.

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::ensurePlaceholderStyle):
        (WebCore::Style::TreeResolver::Scope::Scope):
        (WebCore::Style::TreeResolver::TreeResolver):
        (WebCore::Style::shouldCreateRenderer):
        (WebCore::Style::TreeResolver::styleForElement):
        (WebCore::Style::TreeResolver::createRenderTreeForShadowRoot):
        (WebCore::Style::TreeResolver::createRenderTreeForSlotAssignees):
        (WebCore::Style::TreeResolver::createRenderTreeRecursively):
        (WebCore::Style::TreeResolver::resolveLocally):
        (WebCore::Style::TreeResolver::resolveShadowTree):
        (WebCore::Style::TreeResolver::resolveBeforeOrAfterPseudoElement):
        (WebCore::Style::TreeResolver::resolveChildren):
        (WebCore::Style::TreeResolver::resolveSlotAssignees):
        (WebCore::Style::TreeResolver::resolveRecursively):
        (WebCore::Style::TreeResolver::resolve):
        (WebCore::Style::detachRenderTree):
        * style/StyleTreeResolver.h:
        (WebCore::Style::TreeResolver::scope):
        (WebCore::Style::TreeResolver::pushScope):
        (WebCore::Style::TreeResolver::pushEnclosingScope):
        (WebCore::Style::TreeResolver::popScope):

2016-02-06  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r196104.
        https://bugs.webkit.org/show_bug.cgi?id=153940

        Regressed Speedometer on iOS (Requested by kling on #webkit).

        Reverted changeset:

        "[iOS] Throw away linked code when navigating to a new page."
        https://bugs.webkit.org/show_bug.cgi?id=153851
        http://trac.webkit.org/changeset/196104

2016-02-05  Beth Dakin  <bdakin@apple.com>

        ScrollbarPainters needs to be deallocated on the main thread
        https://bugs.webkit.org/show_bug.cgi?id=153932
        -and corresponding-
        rdar://problem/24015483

        Reviewed by Geoff Garen.

        Follow-up fix since the first one was still race-y.
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-05  Beth Dakin  <bdakin@apple.com>

        ScrollbarPainters needs to be deallocated on the main thread
        https://bugs.webkit.org/show_bug.cgi?id=153932
        -and corresponding-
        rdar://problem/24015483

        Reviewed by Tim Horton.

        Ensure the the destructor of ScrollingTreeFrameScrollingNodeMac and the 
        assignments done in this class are not responsible for deallocating the 
        ScrollbarPainter. 
        * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
        (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
        (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-05  Chris Dumez  <cdumez@apple.com>

        Instance property getters / setters cannot be called on another instance of the same type
        https://bugs.webkit.org/show_bug.cgi?id=153895

        Reviewed by Gavin Barraclough.

        It should be possible to call instance property getters / setters on
        other instances of the same type, as per the WEB IDL specification:
        - http://heycam.github.io/webidl/#dfn-attribute-getter
        - http://heycam.github.io/webidl/#dfn-attribute-setter

        This matches the behavior of Firefox.

        The issue without our bindings was that the getters / setters were
        using |slotBase| instead of |thisValue| and therefore ended up using
        the instance the getter was taken from instead of the actual target
        object.

        Test:
        js/instance-property-getter-other-instance.html
        js/instance-property-setter-other-instance.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        - Have instance getters / setters use thisValue instead of slotBase.
        - In the case of interfaces that have attributes on the instance for
          compatibility reasons, try the prototype object if |thisValue| does
          does have the right type, instead of using slotBase like previously.
          I believe this maintains the original compatibility intention while
          also behaving correctly when called on another instance.

        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestException.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        Rebaseline bindings tests.

2016-02-05  Brady Eidson  <beidson@apple.com>

        Modern IDB: UniqueIDBDatabase's m_databaseInfo is unsafely used from multiple threads.
        https://bugs.webkit.org/show_bug.cgi?id=153912

        Reviewed by Alex Christensen.

        No new tests (Anything testable about this patch is already covered by existing tests).

        * Modules/indexeddb/server/IDBBackingStore.h:

        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::infoForObjectStore):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:

        Teach the SQLiteIDBBackingStore to actually keep its m_databaseInfo up to date as it changes,
        and to revert it when version change transactions abort:
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::beginTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::abortTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::commitTransaction):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::infoForObjectStore):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd): Use the IDBBackingStore's copy of the 
          IDBObjectStoreInfo, meant only for the database thread, instead of the UniqueIDBDatabase's copy, 
          which is meant only for the main thread.

2016-02-05  Alex Christensen  <achristensen@webkit.org>

        Clean up Blob code
        https://bugs.webkit.org/show_bug.cgi?id=153910

        Reviewed by Alexey Proskuryakov.

        No new tests, no change in behavior.

        * css/StyleSheet.h:
        * fileapi/Blob.cpp:
        (WebCore::Blob::Blob):
        (WebCore::Blob::normalizedContentType):
        (WebCore::Blob::isNormalizedContentType):
        (WebCore::Blob::registry):
        * fileapi/Blob.h:
        * fileapi/BlobURL.cpp:
        (WebCore::BlobURL::createPublicURL):
        * fileapi/BlobURL.h:
        (WebCore::BlobURL::BlobURL):
        (WebCore::BlobURL::blobProtocol): Deleted.
        * platform/PlatformStrategies.cpp:
        (WebCore::setPlatformStrategies):
        (WebCore::hasPlatformStrategies): Deleted.
        * platform/PlatformStrategies.h:
        * platform/network/BlobRegistry.cpp:
        (WebCore::blobRegistry):
        * platform/network/BlobRegistry.h:
        * platform/network/BlobRegistryImpl.cpp:
        (WebCore::BlobRegistryImpl::~BlobRegistryImpl):
        (WebCore::createResourceHandle):
        (WebCore::registerBlobResourceHandleConstructor):
        (WebCore::BlobRegistryImpl::createResourceHandle):
        (WebCore::BlobRegistryImpl::appendStorageItems):
        (WebCore::BlobRegistryImpl::registerFileBlobURL):
        (WebCore::BlobRegistryImpl::registerBlobURL):
        * platform/network/BlobRegistryImpl.h:
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::loadResourceSynchronously):
        (WebCore::BlobResourceHandle::BlobResourceHandle):
        * platform/network/ResourceHandle.h:

2016-02-05  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Scrollbars incorrectly rendered with older versions of GTK+
        https://bugs.webkit.org/show_bug.cgi?id=153861

        Reviewed by Michael Catanzaro.

        The theme doesn't really know it's a scrollbar. Older versions of
        GTK+ require to explicitly add the scrollbar style class to the
        child GtkStyleContext.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::createChildStyleContext):

2016-02-05  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Scrollbars not correctly rendered in non GNOME environments
        https://bugs.webkit.org/show_bug.cgi?id=153860

        Reviewed by Michael Catanzaro.

        I noticed this in a matchbox environment, where there's no
        gnome-setting-daemon running. The problem is only with the
        scrollbars, because we initialize the GtkSettings in
        RenderThemeGtk and notify the ScrollbarTheme when it changes, but
        ScrollbarTheme is created before RenderThemeGtk so we initialize
        the theme properties before the GtkSettings have been
        initialized. We can just let the ScrollbarTheme monitor the
        theme itself instead of relying on being notified by the WebCore
        layer.

        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::themeChangedCallback):
        (WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk):
        * rendering/RenderThemeGtk.cpp:
        (WebCore::gtkStyleChangedCallback): Deleted.

2016-02-05  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Remove DOMWrapped parameter from JSKeyValueIterator
        https://bugs.webkit.org/show_bug.cgi?id=153859

        Reviewed by Sam Weinig.

        No change in behavior.

        Using std::declval to infer DOMWrapped from JSWrapper::wrapped.

        * bindings/js/JSFetchHeadersCustom.cpp:
        (WebCore::JSFetchHeaders::entries):
        (WebCore::JSFetchHeaders::keys):
        (WebCore::JSFetchHeaders::values):
        * bindings/js/JSKeyValueIterator.h:
        (WebCore::createIterator):
        (WebCore::JSKeyValueIterator<JSWrapper>::destroy):
        (WebCore::JSKeyValueIterator<JSWrapper>::next):
        (WebCore::JSKeyValueIteratorPrototypeFunctionNext):
        (WebCore::JSKeyValueIteratorPrototype<JSWrapper>::finishCreation):

2016-02-05  Nan Wang  <n_wang@apple.com>

        AX: WebKit hanging when VoiceOver attempts to focus in on page
        https://bugs.webkit.org/show_bug.cgi?id=153899
        <rdar://problem/24506603>

        Reviewed by Chris Fleizach.

        The VisiblePosition to CharacterOffset conversion will lead to an infinite loop if the
        nextVisiblePostion call is returning the original VisiblePosition. Fixed it by breaking out
        of the loop early in that situation. 

        Test: accessibility/text-marker/character-offset-visible-position-conversion-hang.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::characterOffsetFromVisiblePosition):

2016-02-04  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: InspectorTimelineAgent doesn't need to recompile functions because it now uses the sampling profiler
        https://bugs.webkit.org/show_bug.cgi?id=153500
        <rdar://problem/24352458>

        Reviewed by Timothy Hatcher.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::supportsLegacyProfiling):
        (WebCore::JSDOMWindowBase::supportsRichSourceInfo):
        (WebCore::JSDOMWindowBase::supportsProfiling): Deleted.
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::supportsLegacyProfiling):
        (WebCore::JSWorkerGlobalScopeBase::supportsProfiling): Deleted.
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * inspector/InspectorController.h:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::legacyProfilerEnabled):
        (WebCore::InspectorController::setLegacyProfilerEnabled):
        Be more explicit about enabling legacy profiling.

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend): Deleted.
        TimelineAgent doesn't need to recompile if using the sampling profiler.
        This breaks console.profile, but console.profile should move to using
        the sampling profiler as well.

        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        (WebCore::startProfiling): Deleted.
        (WebCore::stopProfiling): Deleted.
        Inlined the use once static functions.

        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::profile):
        (WebCore::PageConsoleClient::profileEnd):
        Added FIXMEs for improving console.profile and profileEnd.

        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setLegacyJavaScriptProfilingEnabled):
        (WebCore::Internals::setJavaScriptProfilingEnabled): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:
        Be more explicit about enabling legacy profiling.

2016-02-04  Brent Fulgham  <bfulgham@apple.com>

        Follow-up: Add "WebKit built-in PDF" Plugin to set of publicly visible plugins
        https://bugs.webkit.org/show_bug.cgi?id=153657
        <rdar://problem/24413107>

        Reviewed by Darin Adler.

        * plugins/PluginData.cpp:
        (WebCore::shouldBePubliclyVisible): Revise comments to provide a
        better explanation of the function and why it exists.

2016-02-04  Jonathan Davis  <jond@apple.com>

        Add Fetch API and CSS Variables to feature status
        https://bugs.webkit.org/show_bug.cgi?id=153896

        Reviewed by Timothy Hatcher.

        * features.json:

2016-02-04  Daniel Bates  <dabates@apple.com>

        WebKit for iOS Simulator fails to build with public iOS SDK
        https://bugs.webkit.org/show_bug.cgi?id=153881

        Reviewed by Alex Christensen.

        Make constants have internal linkage to match the Apple Internal SDK.

        * platform/spi/ios/MobileGestaltSPI.h:

2016-02-04  Chris Dumez  <cdumez@apple.com>

        Object.getOwnPropertyDescriptor() returns incomplete descriptor for instance properties
        https://bugs.webkit.org/show_bug.cgi?id=153817

        Reviewed by Geoffrey Garen.

        Update the bindings generator so that property getters / setters now
        make sure |this| has the right type and throw a TypeError if it does
        not, as per:
        - http://heycam.github.io/webidl/#dfn-attribute-getter (step 2.4.2)
        - http://heycam.github.io/webidl/#dfn-attribute-setter (step 3.5)

        This was an issue when doing something like:
        Object.getOwnPropertyDescriptor(window, "location").get.call(nonWindow)

        We would call toJSDOMWindow(thisValue), which would return null as
        thisValue is not a JSDOMWindow. We would then dereference this null
        pointer and crash. We now do a null check and throw a TypeError in
        this case, as per the Web IDL specification.

        The generated bindings still have some non-spec compliant behavior
        though:
        1. The getters / setters of instance properties use slotBase instead
           of thisValue, which means that calling instanceA's getter on
           instanceB returns instanceA's property insteas of instanceB's.
        2. Global object property getters should not require an explicit
           |this| so calling the following should work:
           - Object.getOwnPropertyDescriptor(window, "location").get.call()
           We currently throw in this case.

        These issues will be addressed in follow-up patches.

        Tests: js/getOwnPropertyDescriptor-unforgeable-attributes.html
               js/getOwnPropertyDescriptor-window-attributes.html
               js/instance-property-getter-other-instance.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::jsTestActiveDOMObjectExcitingAttr):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::jsTestExceptionName):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjConstructorTestSubObj):
        (WebCore::jsTestObjTestSubObjEnabledBySettingConstructor):
        (WebCore::jsTestObjConditionalAttr4Constructor):
        (WebCore::jsTestObjConditionalAttr5Constructor):
        (WebCore::jsTestObjConditionalAttr6Constructor):
        (WebCore::jsTestObjContentDocument):
        (WebCore::setJSTestObjTestSubObjEnabledBySettingConstructor):
        (WebCore::setJSTestObjConditionalAttr4Constructor):
        (WebCore::setJSTestObjConditionalAttr5Constructor):
        (WebCore::setJSTestObjConditionalAttr6Constructor):
        (WebCore::setJSTestObjConstructor): Deleted.
        (WebCore::setJSTestObjConstructorStaticStringAttr): Deleted.
        (WebCore::setJSTestObjConditionalAttr3): Deleted.
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::jsTestTypedefsConstructorTestSubObj):

2016-02-04  Brady Eidson  <beidson@apple.com>

        Modern IDB: LayoutTest imported/w3c/indexeddb/keyorder-private.html is flaky.
        https://bugs.webkit.org/show_bug.cgi?id=153438.

        Reviewed by Alex Christensen.

        Tests: storage/indexeddb/modern/idbkey-array-equality-private.html
               storage/indexeddb/modern/idbkey-array-equality.html

        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::loggingString):
        (WebCore::IDBKeyData::operator==): Fix obvious bug.

2016-02-04  Chris Dumez  <cdumez@apple.com>

        Unreviewed, fix the EFL clean build after r196123
        https://bugs.webkit.org/show_bug.cgi?id=153875

        * CMakeLists.txt:
        * PlatformGTK.cmake:
        * PlatformMac.cmake:
        * html/DOMSettableTokenList.h:
        * html/DOMSettableTokenList.idl:

2016-02-04  Eric Carlson  <eric.carlson@apple.com>

        PageGroup::captionPreferences should return a reference
        https://bugs.webkit.org/show_bug.cgi?id=153877
        <rdar://problem/24506917>

        Reviewed by Jer Noble.

        No new tests, no functional change.

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::sortedTrackListForMenu):
        (WebCore::MediaControlsHost::displayNameForTrack):
        (WebCore::MediaControlsHost::captionMenuOffItem):
        (WebCore::MediaControlsHost::captionDisplayMode):
        * dom/Document.cpp:
        (WebCore::Document::registerForCaptionPreferencesChangedCallbacks):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::addTextTrack):
        (WebCore::HTMLMediaElement::configureTextTrackGroup):
        (WebCore::HTMLMediaElement::setSelectedTextTrack):
        (WebCore::HTMLMediaElement::configureTextTracks):
        (WebCore::HTMLMediaElement::captionPreferencesChanged):
        (WebCore::HTMLMediaElement::mediaPlayerPreferredAudioCharacteristics):
        * html/shadow/MediaControlElements.cpp:
        (WebCore::MediaControlClosedCaptionsTrackListElement::updateDisplay):
        (WebCore::MediaControlClosedCaptionsTrackListElement::rebuildTrackListMenu):
        (WebCore::MediaControlTextTrackContainerElement::updateActiveCuesFontSize):
        * page/PageGroup.cpp:
        (WebCore::PageGroup::captionPreferencesChanged):
        (WebCore::PageGroup::captionPreferences):
        * page/PageGroup.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        (WebVideoFullscreenModelVideoElement::updateLegibleOptions):
        * testing/InternalSettings.cpp:
        (WebCore::InternalSettings::setShouldDisplayTrackKind):
        (WebCore::InternalSettings::shouldDisplayTrackKind):
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::Internals):
        (WebCore::Internals::userPreferredAudioCharacteristics):
        (WebCore::Internals::setUserPreferredAudioCharacteristic):
        (WebCore::Internals::captionsStyleSheetOverride):
        (WebCore::Internals::setCaptionsStyleSheetOverride):
        (WebCore::Internals::setPrimaryAudioTrackLanguageOverride):
        (WebCore::Internals::setCaptionDisplayMode):

2016-02-04  Konstantin Tokarev  <annulen@yandex.ru>

        Removed unused Settings::setPrivateBrowsingEnabled.
        https://bugs.webkit.org/show_bug.cgi?id=153869

        Reviewed by Alexey Proskuryakov.

        Implementation of Settings::setPrivateBrowsingEnabled was removed
        in r166661, but declaration is still here.

        No new tests needed.

        * page/Settings.h:
        (WebCore::Settings::setPrivateBrowsingEnabled): Deleted.

2016-02-04  Eric Carlson  <eric.carlson@apple.com>

        Don't discard in-band cues with negative start times
        https://bugs.webkit.org/show_bug.cgi?id=153867
        <rdar://problem/19588632>

        Reviewed by Jer Noble.

        No new tests, updated and un-skipped http/tests/media/track-in-band-hls-metadata.html.

        * platform/graphics/avfoundation/InbandMetadataTextTrackPrivateAVF.cpp:
        (WebCore::InbandMetadataTextTrackPrivateAVF::addDataCue):  ASSERT if passed negative time value.
        (WebCore::InbandMetadataTextTrackPrivateAVF::updatePendingCueEndTimes): Ditto. Correct logging.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::processCue): ASSERT if passed negative time value.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::metadataDidArrive): Convert negative cue times to zero.
        (-[WebCoreAVFMovieObserver legibleOutput:didOutputAttributedStrings:nativeSampleBuffers:forItemTime:]):
          Ditto.

2016-02-04  Hyemi Shin  <hyemi.sin@samsung.com>

        Specify an exception for createChannelMerger, createChannelSplitter and createPeriodicWave
        https://bugs.webkit.org/show_bug.cgi?id=150925

        Reviewed by Darin Adler.

        createChannelMerger and createChannelSplitter should throw INDEX_SIZE_ERR
        for invalid numberOfInputs value.
        createPeriodicWave should throw INDEX_SIZE_ERR for invalid lengths of parameters.

        Tests: webaudio/audiochannelmerger-basic.html
               webaudio/audiochannelsplitter.html
               webaudio/periodicwave-lengths.html

        * Modules/webaudio/AudioContext.cpp:
        (WebCore::AudioContext::createChannelSplitter):
        (WebCore::AudioContext::createChannelMerger):
        (WebCore::AudioContext::createPeriodicWave):

2016-02-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add support for iterating over Headers
        https://bugs.webkit.org/show_bug.cgi?id=153787

        Reviewed by Darin Adler.

        Relanding, updating bindings/js/JSKeyValueIterator.h for Windows bots.

        Covered by updated tests.
        Introducing template class (JSKeyValueIterator) to support key-value iterators in DOM classes.
        Using JSKeyValueIterator to implement Headers entries(), keys() and values() as custom methods.
        Binding generator should be updated to generate directly these custom methods and handle iterator Symbol.

        * CMakeLists.txt:
        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next):
        (WebCore::FetchHeaders::Iterator::Iterator):
        * Modules/fetch/FetchHeaders.h:
        (WebCore::FetchHeaders::createIterator):
        * Modules/fetch/FetchHeaders.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDOMBinding.h:
        (WebCore::jsPair):
        * bindings/js/JSFetchHeadersCustom.cpp: Added.
        (WebCore::JSFetchHeaders::entries):
        (WebCore::JSFetchHeaders::keys):
        (WebCore::JSFetchHeaders::values):
        * bindings/js/JSKeyValueIterator.h: Added.
        (WebCore::JSKeyValueIteratorPrototype::create):
        (WebCore::JSKeyValueIteratorPrototype::createStructure):
        (WebCore::JSKeyValueIteratorPrototype::JSKeyValueIteratorPrototype):
        (WebCore::createIterator):
        (WebCore::DOMWrapped>::destroy):
        (WebCore::DOMWrapped>::next):
        (WebCore::DOMWrapped>::finishCreation):

2016-02-04  Chris Dumez  <cdumez@apple.com>

        Merge DOMTokenList and DOMSettableTokenList
        https://bugs.webkit.org/show_bug.cgi?id=153677
        <rdar://problem/24419675>

        Reviewed by Sam Weinig.

        Merge DOMTokenList and DOMSettableTokenList, as per a recent
        specification change:
        - https://github.com/whatwg/dom/pull/120
        - https://github.com/whatwg/html/issues/361

        No new tests, already covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * dom/Element.idl:
        * dom/Node.h:
        * dom/NodeRareData.h:
        * html/AttributeDOMTokenList.h:
        * html/DOMSettableTokenList.cpp: Removed.
        * html/DOMSettableTokenList.h:
        * html/DOMSettableTokenList.idl:
        * html/DOMTokenList.cpp:
        (WebCore::DOMTokenList::setValue):
        * html/DOMTokenList.h:
        * html/DOMTokenList.idl:
        * html/HTMLAnchorElement.idl:
        * html/HTMLAreaElement.idl:
        * html/HTMLElement.cpp:
        * html/HTMLElement.idl:
        * html/HTMLIFrameElement.cpp:
        (WebCore::HTMLIFrameElement::sandbox):
        * html/HTMLIFrameElement.h:
        * html/HTMLIFrameElement.idl:
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::sizes):
        * html/HTMLLinkElement.h:
        * html/HTMLLinkElement.idl:
        * html/HTMLOutputElement.cpp:
        (WebCore::HTMLOutputElement::htmlFor):
        * html/HTMLOutputElement.h:
        * html/HTMLOutputElement.idl:
        * html/HTMLTableCellElement.idl:
        * page/DOMWindow.cpp:
        * page/DOMWindow.idl:

2016-02-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        Unreviewed.
        Reverting r196115 and r19116, related tohttps://bugs.webkit.org/show_bug.cgi?id=153787.

2016-02-04  Alejandro G. Castro  <alex@igalia.com>

        [GTK] Implement mediastream mediaplayer
        https://bugs.webkit.org/show_bug.cgi?id=153541

        Reviewed by Martin Robinson.

        Added the implementation of the mediaplayer for the
        mediastream. The code was implemented by Philippe Normand and
        Alessandro Decina.

        * PlatformGTK.cmake: Added the file to the compilation.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setSrcObject): Set the src of the
        media element to the mediastream.
        * platform/graphics/MediaPlayer.cpp:
        (WebCore::buildMediaEnginesVector): Register the mediastream
        mediaplayer as an option in the media engines vector.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.cpp: Added.
        (WebCore::MediaPlayerPrivateGStreamerOwr::MediaPlayerPrivateGStreamerOwr):
        (WebCore::MediaPlayerPrivateGStreamerOwr::~MediaPlayerPrivateGStreamerOwr):
        (WebCore::MediaPlayerPrivateGStreamerOwr::play):
        (WebCore::MediaPlayerPrivateGStreamerOwr::pause):
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasVideo):
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasAudio):
        (WebCore::MediaPlayerPrivateGStreamerOwr::currentTime):
        (WebCore::MediaPlayerPrivateGStreamerOwr::load):
        (WebCore::MediaPlayerPrivateGStreamerOwr::loadingFailed):
        (WebCore::MediaPlayerPrivateGStreamerOwr::didLoadingProgress):
        (WebCore::MediaPlayerPrivateGStreamerOwr::internalLoad):
        (WebCore::MediaPlayerPrivateGStreamerOwr::stop):
        (WebCore::MediaPlayerPrivateGStreamerOwr::registerMediaEngine):
        (WebCore::MediaPlayerPrivateGStreamerOwr::getSupportedTypes):
        (WebCore::MediaPlayerPrivateGStreamerOwr::supportsType):
        (WebCore::MediaPlayerPrivateGStreamerOwr::isAvailable):
        (WebCore::MediaPlayerPrivateGStreamerOwr::createGSTAudioSinkBin):
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceStopped):
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceMutedChanged):
        (WebCore::MediaPlayerPrivateGStreamerOwr::sourceSettingsChanged):
        (WebCore::MediaPlayerPrivateGStreamerOwr::preventSourceFromStopping):
        (WebCore::MediaPlayerPrivateGStreamerOwr::createVideoSink):
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerOwr.h: Added.
        (WebCore::MediaPlayerPrivateGStreamerOwr::engineDescription):
        (WebCore::MediaPlayerPrivateGStreamerOwr::load):
        (WebCore::MediaPlayerPrivateGStreamerOwr::cancelLoad):
        (WebCore::MediaPlayerPrivateGStreamerOwr::prepareToPlay):
        (WebCore::MediaPlayerPrivateGStreamerOwr::duration):
        (WebCore::MediaPlayerPrivateGStreamerOwr::seek):
        (WebCore::MediaPlayerPrivateGStreamerOwr::seeking):
        (WebCore::MediaPlayerPrivateGStreamerOwr::setRate):
        (WebCore::MediaPlayerPrivateGStreamerOwr::setPreservesPitch):
        (WebCore::MediaPlayerPrivateGStreamerOwr::paused):
        (WebCore::MediaPlayerPrivateGStreamerOwr::hasClosedCaptions):
        (WebCore::MediaPlayerPrivateGStreamerOwr::setClosedCaptionsVisible):
        (WebCore::MediaPlayerPrivateGStreamerOwr::maxTimeSeekable):
        (WebCore::MediaPlayerPrivateGStreamerOwr::buffered):
        (WebCore::MediaPlayerPrivateGStreamerOwr::totalBytes):
        (WebCore::MediaPlayerPrivateGStreamerOwr::bytesLoaded):
        (WebCore::MediaPlayerPrivateGStreamerOwr::canLoadPoster):
        (WebCore::MediaPlayerPrivateGStreamerOwr::setPoster):
        (WebCore::MediaPlayerPrivateGStreamerOwr::isLiveStream):
        (WebCore::MediaPlayerPrivateGStreamerOwr::audioSink):

2016-02-04  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Add support for iterating over Headers
        https://bugs.webkit.org/show_bug.cgi?id=153787

        Reviewed by Darin Adler.

        Covered by updated tests.
        Introducing template class (JSKeyValueIterator) to support key-value iterators in DOM classes.
        Using JSKeyValueIterator to implement Headers entries(), keys() and values() as custom methods.
        Binding generator should be updated to generate directly these custom methods and handle iterator Symbol.

        * CMakeLists.txt:
        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::FetchHeaders::Iterator::next):
        (WebCore::FetchHeaders::Iterator::Iterator):
        * Modules/fetch/FetchHeaders.h:
        (WebCore::FetchHeaders::createIterator):
        * Modules/fetch/FetchHeaders.idl:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSDOMBinding.h:
        (WebCore::jsPair):
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSFetchHeadersCustom.cpp: Added.
        (WebCore::JSFetchHeaders::entries):
        (WebCore::JSFetchHeaders::keys):
        (WebCore::JSFetchHeaders::values):
        * bindings/js/JSKeyValueIterator.h: Added.
        (WebCore::JSKeyValueIteratorPrototype::create):
        (WebCore::JSKeyValueIteratorPrototype::createStructure):
        (WebCore::JSKeyValueIteratorPrototype::JSKeyValueIteratorPrototype):
        (WebCore::JSKeyValueIteratorPrototypeFuncNext):

2016-02-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        Do not show context menu when right clicking on a scrollbar
        https://bugs.webkit.org/show_bug.cgi?id=153493

        Reviewed by Michael Catanzaro.

        Scrollbars don't currently handle right clicks, but we are showing
        the context menu when they are right clicked. This is not desired
        at least in GTK+ and I've checked that it isn't consistent with
        other applications in Mac either.

        Test: fast/events/contextmenu-on-scrollbars.html

        * page/EventHandler.cpp:
        (WebCore::EventHandler::sendContextMenuEvent):

2016-02-03  Andreas Kling  <akling@apple.com>

        [iOS] Throw away linked code when navigating to a new page.
        <https://webkit.org/b/153851>

        Reviewed by Gavin Barraclough.

        When navigating to a new page, tell JSC to throw out any linked code it has lying around.
        Linked code is tied to a specific global object, and as we're creating a new one for the
        new page, none of it is useful to us here.
        In the event that the user navigates back, the cost of relinking some code will be far
        lower than the memory cost of keeping all of it around.

        * bindings/js/GCController.cpp:
        (WebCore::GCController::deleteAllLinkedCode):
        * bindings/js/GCController.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-02-03  Alex Christensen  <achristensen@webkit.org>

        Report wasBlocked and cannotShowURL errors when using NetworkSession
        https://bugs.webkit.org/show_bug.cgi?id=153846

        Reviewed by Antti Koivisto.

        No new tests, but this fixes http/tests/xmlhttprequest/redirect-cross-origin-2.html
        when using NetworkSession.

        * platform/URL.h:
        WEBCORE_EXPORT because we are using portAllowed in WebKit2 now.

2016-02-03  Jer Noble  <jer.noble@apple.com>

        iOS build fix after Yosemite build fix broke iOS build.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:

2016-02-03  Beth Dakin  <bdakin@apple.com>

        Accepted candidates should not be autocorrected
        https://bugs.webkit.org/show_bug.cgi?id=153813
        -and corresponding-
        rdar://problem/24066924

        Reviewed by Darin Adler.

        New document marker to mark inserted candidates. This was we can treat 
        inserted candidates just like a RejectedCorrection and we won’t accidentally 
        autocorrect them later on.
        * dom/DocumentMarker.h:
        (WebCore::DocumentMarker::AllMarkers::AllMarkers):
        * editing/AlternativeTextController.cpp:
        (WebCore::AlternativeTextController::processMarkersOnTextToBeReplacedByResult):

        When handling an acceptant candidate, set m_isHandlingAcceptedCandidate to
        true while the text is being inserted, and then mark the range as an accepted 
        candidate.
        * editing/Editor.cpp:
        (WebCore::Editor::handleAcceptedCandidate):
        * editing/Editor.h:
        (WebCore::Editor::isHandlingAcceptedCandidate):

        If frame.editor. isHandlingAcceptedCandidate() then return early from 
        markMisspellingsAfterTyping.
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::markMisspellingsAfterTyping):

        Add some test infrastructure. 
        * testing/Internals.cpp:
        (WebCore::Internals::handleAcceptedCandidate):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-02-03  Jer Noble  <jer.noble@apple.com>

        [Win] Pass entire request (rather than just URL) to clients of WebCoreAVCFResourceLoader
        https://bugs.webkit.org/show_bug.cgi?id=153653

        Reviewed by Brent Fulgham.

        This will allow those clients to see the byte-range request ("Range:") header and respond
        appropriately.

        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading):

2016-02-03  Jer Noble  <jer.noble@apple.com>

        Yosemite build fix; hide the entire WebCoreNSURLSessionDataTask class from Yosemite and prior.

        * platform/network/cocoa/WebCoreNSURLSession.h:
        * platform/network/cocoa/WebCoreNSURLSession.mm:
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:URL:]):
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:request:]):

2016-02-03  Jer Noble  <jer.noble@apple.com>

        [EME][Mac] MediaKeys.createSession() fails with initData containing a contentId whose length is > 1/2 the initData.
        https://bugs.webkit.org/show_bug.cgi?id=153517
        <rdar://problem/24303782>

        Reviewed by Eric Carlson.

        The length of contentId is given in bytes, not Uint16 characters. Use the former when extracting
        the contentId string from the initData.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::extractKeyURIKeyIDAndCertificateFromInitData):

2016-02-03  Jer Noble  <jer.noble@apple.com>

        [Mac] Wrap a resource and resource loader in a NSURLSession-like object for use by lower level frameworks
        https://bugs.webkit.org/show_bug.cgi?id=153669

        Reviewed by Alex Christensen.

        API Test: WebCore.WebCoreNSURLSession

        Add a NSURLSession-like object, which wraps a CachedResourceLoader and CachedRawResource, which we can
        hand to lower-level frameworks, so that network loads by those frameworks use WebKit's loader.

        * platform/network/cocoa/WebCoreNSURLSession.h: Added.
        * platform/network/cocoa/WebCoreNSURLSession.mm: Added.
        (-[WebCoreNSURLSession initWithResourceLoader:delegate:delegateQueue:]):
        (-[WebCoreNSURLSession dealloc]):
        (-[WebCoreNSURLSession copyWithZone:]):
        (-[WebCoreNSURLSession delegateQueue]):
        (-[WebCoreNSURLSession configuration]):
        (-[WebCoreNSURLSession loader]):
        (-[WebCoreNSURLSession finishTasksAndInvalidate]):
        (-[WebCoreNSURLSession invalidateAndCancel]):
        (-[WebCoreNSURLSession resetWithCompletionHandler:]):
        (-[WebCoreNSURLSession flushWithCompletionHandler:]):
        (-[WebCoreNSURLSession getTasksWithCompletionHandler:]):
        (-[WebCoreNSURLSession getAllTasksWithCompletionHandler:]):
        (-[WebCoreNSURLSession dataTaskWithRequest:]):
        (-[WebCoreNSURLSession dataTaskWithURL:]):
        (-[WebCoreNSURLSession uploadTaskWithRequest:fromFile:]):
        (-[WebCoreNSURLSession uploadTaskWithRequest:fromData:]):
        (-[WebCoreNSURLSession uploadTaskWithStreamedRequest:]):
        (-[WebCoreNSURLSession downloadTaskWithRequest:]):
        (-[WebCoreNSURLSession downloadTaskWithURL:]):
        (-[WebCoreNSURLSession downloadTaskWithResumeData:]):
        (-[WebCoreNSURLSession streamTaskWithHostName:port:]):
        (-[WebCoreNSURLSession streamTaskWithNetService:]):
        (-[WebCoreNSURLSession isKindOfClass:]):

        Add a C++ class which can act as a CachedRawResourceClient, passing the results back to a WebCoreNSURLSessionDataTask:

        (WebCore::WebCoreNSURLSessionDataTaskClient::WebCoreNSURLSessionDataTaskClient):
        (WebCore::WebCoreNSURLSessionDataTaskClient::dataSent):
        (WebCore::WebCoreNSURLSessionDataTaskClient::responseReceived):
        (WebCore::WebCoreNSURLSessionDataTaskClient::dataReceived):
        (WebCore::WebCoreNSURLSessionDataTaskClient::redirectReceived):
        (WebCore::WebCoreNSURLSessionDataTaskClient::notifyFinished):

        Add a NSURLSessionDataTask-like object, which takes a request, then uses it to create and wrap a CachedRawResource.
        Becase NSURSessionDataTask is intended to be used off-main-thread, care must be taken to dispatch back to the main-
        (or web-) thread before calling CachedRawResource functions.

        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:URL:]):
        (-[WebCoreNSURLSessionDataTask initWithSession:identifier:request:]):
        (-[WebCoreNSURLSessionDataTask copyWithZone:]):
        (-[WebCoreNSURLSessionDataTask _restart]):
        (-[WebCoreNSURLSessionDataTask _cancel]):
        (-[WebCoreNSURLSessionDataTask _finish]):
        (-[WebCoreNSURLSessionDataTask _setDefersLoading:]):
        (-[WebCoreNSURLSessionDataTask cancel]):
        (-[WebCoreNSURLSessionDataTask suspend]):
        (-[WebCoreNSURLSessionDataTask resume]):
        (-[WebCoreNSURLSessionDataTask _timingData]):
        (-[WebCoreNSURLSessionDataTask resource:sentBytes:totalBytesToBeSent:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedResponse:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedData:length:]):
        (-[WebCoreNSURLSessionDataTask resource:receivedRedirect:request:]):
        (-[WebCoreNSURLSessionDataTask resourceFinished:]):
        * WebCore.xcodeproj/project.pbxproj: Add new files to project.

2016-02-03  Darin Adler  <darin@apple.com>

        Convert another batch of String::lower callsites to something better, typically convertToASCIILowercase
        https://bugs.webkit.org/show_bug.cgi?id=153789

        Reviewed by Sam Weinig.

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::isXMLMIMEType): Use equalLettersIgnoringASCIICase
        and the boolean argument to endsWith to ignore ASCII case.
        (WebCore::DOMImplementation::isTextMIMEType): Ditto. Also simplified the logic
        by removing an if statement.

        * dom/Document.cpp:
        (WebCore::isSeparator): Deleted. Moved to WindowFeatures.cpp.
        (WebCore::processArguments): Ditto.
        (WebCore::Document::processViewport): Call the processFeaturesString function
        from WindowFeatures.h; the code here was originally just a pasted copy of that code!
        (WebCore::Document::processFormatDetection): Ditto.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::toEncodingMimeType): Remove now-unneeded
        lowercasing of MIME type before calling isSupportedImageMIMETypeForEncoding,
        since the MIME type registry now ignores ASCII case. Use convertToASCIILowercase
        on the return value, to preserve behavior.
        (WebCore::HTMLCanvasElement::toDataURL): Minor coding style tweaks.

        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::parseAttribute): Use convertToASCIILowercase for
        the service type here.

        * html/HTMLImageElement.cpp:
        (WebCore::HTMLImageElement::bestFitSourceFromPictureElement): Remove now-unneeded
        lowercasing since MIME type registry now ignores ASCII case. And use
        equalLettersIgnoringASCIICase for the case here.

        * html/HTMLInputElement.cpp:
        (WebCore::parseAcceptAttribute): Use convertToASCIILowercase for the type here.

        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::parseAttribute): Use convertToASCIILowercase for the
        media value here.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::canPlayType): Use convertToASCIILowercase for the
        content type here.
        (WebCore::HTMLMediaElement::selectNextSourceChild): Ditto.

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::parseAttribute): Use convertToASCIILowercase for
        the service type here.

        * html/HTMLTrackElement.cpp:
        (WebCore::HTMLTrackElement::parseAttribute): Use convertToASCIILowercase for
        the kind here.
        (WebCore::HTMLTrackElement::ensureTrack): Ditto. Also use fastGetAttribute
        since this is neither the style attribute nor an animatable SVG attribute.

        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::createCaseMap): Use convertToASCIILowercase for the local names here.

        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchNode): Use containsIgnoringASCIICase instead
        of combining lower with find == notFound here.
        (WebCore::nodeName): Use convertToASCIILowercase here.

        * inspector/InspectorOverlay.cpp:
        (WebCore::buildObjectForElementData): Use convertToASCIILowercase for node
        name here.

        * inspector/InspectorPageAgent.cpp:
        (WebCore::createXHRTextDecoder): Remove a now-unneeded call to lower since
        DOMImplementation::isXMLMIMEType now ignores ASCII case.

        * inspector/InspectorStyleSheet.cpp:
        (WebCore::lowercasePropertyName): Use convertToASCIILowercase for property
        names here. Also use startsWith rather than a hand-written alternative.
        (WebCore::InspectorStyle::populateAllProperties): Use the return value of
        the add function to avoid doing a double hash table lookp.
        (WebCore::InspectorStyle::styleWithProperties): Use convertToASCIILowercase
        to lowercase the property name.

        * inspector/NetworkResourcesData.cpp:
        (WebCore::createOtherResourceTextDecoder): Remove unneeded call to lower since
        DOMImplement::isXMLMIMEType now ignores ASCII case.

        * loader/CrossOriginAccessControl.cpp:
        (WebCore::createAccessControlPreflightRequest): Use convertToASCIILowercase
        to lowercase the access control request header field value.

        * loader/cache/CachedScript.cpp:
        (WebCore::CachedScript::mimeType): Use convertToASCIILowercase on the content type.

        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::languageIdentifier): Use convertToASCIILowercase on the language code.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::open): Call parseWindowFeatures instead of using the
        constructor for WindowFeatures.
        (WebCore::DOMWindow::showModalDialog): Call parseDialogFeatures instead of
        using the constructor for WindowFeatures.

        * page/EventHandler.cpp:
        (WebCore::findDropZone): Remove unneeded lowercasing and empty string checking,
        and use the option SpaceSplitString already has to convert to lowercase.
        (WebCore::EventHandler::handleAccessKey): Remove unneeded call to lower since
        getElementByAccessKey now ignores case. Also tweaked coding style a bit.

        * page/OriginAccessEntry.cpp:
        (WebCore::OriginAccessEntry::OriginAccessEntry): Use convertToASCIILowercase
        on the protocol and host.
        (WebCore::OriginAccessEntry::matchesOrigin): Ditto.

        * page/SecurityOrigin.cpp:
        (WebCore::shouldTreatAsUniqueOrigin): Remove unneeded call to lower since
        SchemeRegistry now ignores ASCII case.
        (WebCore::SecurityOrigin::SecurityOrigin): Use convertToASCIILowercase on
        the protocol and host.
        (WebCore::SecurityOrigin::setDomainFromDOM): Use convertToASCIILowercase on
        the domain.
        (WebCore::SecurityOrigin::canDisplay): Remove call to lower since SchemeRegistry
        now ignores ASCII case and because this now uses equalIgnoringASCIICase in
        one place that used to use exact matching.

        * page/WindowFeatures.cpp: Refactored so this is now some helper functions
        plus a struct rather than a class.
        (WebCore::isSeparator): Renamed this and removed special handling for NUL.
        (WebCore::parseWindowFeatures): Moved the code that was formerly in the
        WindowFeatures constructor in here. Refactored the parsing into the
        processFeaturesString function, shared with the functions in Document that
        do the same kind of parsing. Removed the code that converts the entire string
        to lowercase before parsing.
        (WebCore::processFeaturesString): Moved the improved version of this function
        here from Document.cpp; more efficient because it doesn't allocate strings.
        (WebCore::setWindowFeature): Changed to be a function private to this file
        with internal linkage. Use equalLettersIgnoringASCIICase so we no longer
        rely on converting the string to lowercase before parsing.
        (WebCore::parseDialogFeatures): Similar refactoring, but also changed all
        the default handling to use Optional<> instead of default values.
        (WebCore::boolFeature): Changed to use option and to ignore ASCII case.
        (WebCore::floatFeature): Ditto.
        (WebCore::parseDialogFeaturesMap): Removed the calls to lower, which are
        not needed any more.

        * page/WindowFeatures.h: Added default values for all the data members,
        and removed all the functions from the WindowFeatures struct. Added the two
        functions for parsing window and dialog features. Also added the
        processFeaturesString function so we can share it with Document.cpp.

        * platform/SchemeRegistry.cpp:
        (WebCore::SchemeRegistry::removeURLSchemeRegisteredAsLocal): Use
        equalLettersIgnoringASCIICase to ignore ASCII case.

        * platform/efl/MIMETypeRegistryEfl.cpp:
        (WebCore::MIMETypeRegistry::getMIMETypeForExtension): Use a modern for loop,
        and equalIgnoringASCIICase rather than calling lower.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::load): Use convertToASCIILowercase on MIME type and
        key system.
        (WebCore::MediaPlayer::generateKeyRequest): Ditto.
        (WebCore::MediaPlayer::addKey): Ditto.
        (WebCore::MediaPlayer::cancelKeyRequest): Ditto.

        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon): Use
        convertToASCIILowercase on vendor string.

        * platform/gtk/MIMETypeRegistryGtk.cpp:
        (WebCore::MIMETypeRegistry::getMIMETypeForExtension): Use a modern for loop,
        and equalIgnoringASCIICase rather than calling lower.

        * platform/mac/PasteboardMac.mm:
        (WebCore::cocoaTypeFromHTMLClipboardType): Use convertToASCIILowercase
        on the type. Also did a bit of renaming and tweaking the logic.

2016-02-03  Dave Hyatt  <hyatt@apple.com>

        Implement hanging-punctuation property parsing.
        https://bugs.webkit.org/show_bug.cgi?id=18109.

        Reviewed by Zalan Bujtas.

        Added parsing test in fast/css.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::renderEmphasisPositionFlagsToCSSValue):
        (WebCore::hangingPunctuationToCSSValue):
        (WebCore::fillRepeatToCSSValue):
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseTextIndent):
        (WebCore::CSSParser::parseHangingPunctuation):
        (WebCore::CSSParser::parseLineBoxContain):
        * css/CSSParser.h:
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator HangingPunctuation):
        (WebCore::CSSPrimitiveValue::operator LineBreak):
        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertRegionBreakInside):
        (WebCore::StyleBuilderConverter::convertHangingPunctuation):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresLayout):
        * rendering/style/RenderStyle.h:
        * rendering/style/RenderStyleConstants.h:
        (WebCore::operator| ):
        (WebCore::operator|= ):
        * rendering/style/StyleRareInheritedData.cpp:
        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
        (WebCore::StyleRareInheritedData::operator==):
        * rendering/style/StyleRareInheritedData.h:

2016-02-03  Jessie Berlin  <jberlin@webkit.org>

        Build fix.

        [NSEvent context] has always returned nil. Replace uses with nullptr.

        * page/mac/EventHandlerMac.mm:
        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):

2016-02-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Layout Test http/tests/appcache/different-https-origin-resource-main.html is failing
        https://bugs.webkit.org/show_bug.cgi?id=145253

        Reviewed by Michael Catanzaro.

        The problem is that when the load is cancelled while the
        connection is still being established,
        SoupMessage::notify::tls-errors is emitted and the handler calls
        ResourceHandleClient::didFail() which can delete the ResourceHandle.

        * platform/network/soup/ResourceHandleSoup.cpp:
        (WebCore::tlsErrorsChangedCallback): Protect the ResourceHandle
        for the scope of the callback because
        ResourceHandleClient::didFail() could delete the object.

2016-02-03  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r191948): [GStreamer] 4 new timeouts on layout tests.
        https://bugs.webkit.org/show_bug.cgi?id=152797

        Reviewed by Darin Adler.

        Always schedule messages to the main thread, even when the bus
        sync handlder was called in the main thread. It seems that
        GStreamer expects things to happen in the next main loop
        iteration.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):

2016-02-03  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] CompositingCoordinator should store the overlay layer, flush it as appropriate
        https://bugs.webkit.org/show_bug.cgi?id=152058

        Reviewed by Michael Catanzaro.

        Previously, the CompositingCoordinator only added the overlay layer to the
        layer tree, but flushing its compositing state is also required. For that to
        happen, CompositingCoordinator has to store a pointer to the overlay layer
        object and flush it in ::flushPendingLayerChanges().

        Overlay layers are most prominently used by the Web Inspector to highlight
        the DOM elements on the Web page that are being hovered in the inspector.

        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
        (WebCore::CompositingCoordinator::CompositingCoordinator):
        (WebCore::CompositingCoordinator::setRootCompositingLayer):
        (WebCore::CompositingCoordinator::flushPendingLayerChanges):
        * platform/graphics/texmap/coordinated/CompositingCoordinator.h:

2016-02-03  Zan Dobersek  <zdobersek@igalia.com>

        [CoordinatedGraphics] CompositingCoordinator destructor is scheduling layer flushes
        https://bugs.webkit.org/show_bug.cgi?id=153823

        Reviewed by Carlos Garcia Campos.

        Purging the backing stores during the CompositingCoordinator destructor
        is also scheduling layer flushes in the object's client, which is an object
        of the LayerTreeHost-deriving class that owns the CompositingCoordinator
        object in question and is also being destroyed.

        In case of ThreadedCoordinatedLayerTreeHost, this scheduling can access
        the RunLoop::Timer object which has already been destroyed, causing a
        crash. Another problem with this is that we're invoking a virtual function
        on an object that's being destructed, which works well enough in this case
        but should be discouraged in general.

        In order to avoid this, add the m_isDestructing boolean to the
        CompositingCoordinator class, flip it to true during the destruction,
        and check for its falseness before scheduling a layer flush.

        * platform/graphics/texmap/coordinated/CompositingCoordinator.cpp:
        (WebCore::CompositingCoordinator::CompositingCoordinator):
        (WebCore::CompositingCoordinator::~CompositingCoordinator):
        (WebCore::CompositingCoordinator::notifyFlushRequired):
        * platform/graphics/texmap/coordinated/CompositingCoordinator.h:

2016-02-03  Zan Dobersek  <zdobersek@igalia.com>

        [TexMap] Don't use RELEASE_ASSERT in TextureMapperLayer::computeTransformsRecursive()
        https://bugs.webkit.org/show_bug.cgi?id=153822

        Reviewed by Carlos Garcia Campos.

        * platform/graphics/texmap/TextureMapperLayer.cpp:
        (WebCore::TextureMapperLayer::computeTransformsRecursive):
        Use ASSERT to check that the m_children members are indeed children
        of the current layer, RELEASE_ASSERT probably slipped in unnoticed
        at some point.

2016-02-03  Zan Dobersek  <zdobersek@igalia.com>

        PlatformPathCairo: Lazily allocate the path surface
        https://bugs.webkit.org/show_bug.cgi?id=153821

        Reviewed by Carlos Garcia Campos.

        Move the static variable that holds the Cairo surface into
        the pathSurface() function (previously getPathSurface). This
        way the surface will only be allocated once the function is
        called for the first time from the CairoPath surface.

        No change in functionality, just a cleanup.

        * platform/graphics/cairo/PlatformPathCairo.cpp:
        (WebCore::pathSurface):
        (WebCore::CairoPath::CairoPath):
        (WebCore::getPathSurface): Deleted.

2016-02-02  Fujii Hironori  <Hironori.Fujii@jp.sony.com>

        ASSERTION FAILED: roundedIntPoint(rendererMappedResult) == roundedIntPoint(result)
        https://bugs.webkit.org/show_bug.cgi?id=153576

        Reviewed by Darin Adler.

        Tests: fast/block/geometry-map-assertion-with-rounding-negative-half.html

        The results of roundedIntPoint of FloatPoint and LayoutPoint may be different
        because of the uniqueness of LayoutUnit::round introduced by this bug
        <https://bugs.webkit.org/show_bug.cgi?id=107208>.
        Should convert a FloatPoint to a LayoutPoint before rounding.

        * rendering/RenderGeometryMap.cpp:
        (WebCore::RenderGeometryMap::mapToContainer):

2016-02-02  Aakash Jain  <aakash_jain@apple.com>

        Remove references to CallFrameInlines.h
        https://bugs.webkit.org/show_bug.cgi?id=153810

        Reviewed by Mark Lam.

        * ForwardingHeaders/interpreter/CallFrameInlines.h: Removed.

2016-02-02  Jinyoung Hur  <hur.ims@navercorp.com>

        WEBGL_debug_shaders should be disabled for OpenGLES backend also
        https://bugs.webkit.org/show_bug.cgi?id=153788

        Reviewed by Darin Adler.

        WEBGL_debug_shaders extension is disabled for OpenGL backed platform
        because the implementation is not fully compliant to the spec yet.
        Because this is not an OpenGL-specific problem, WEBGL_debug_shaders extension
        should be disabled for OpenGLES backed platforms also.

        No new tests, already covered by existing tests.

        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
        (WebCore::Extensions3DOpenGL::supportsExtension): Deleted.
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        (WebCore::Extensions3DOpenGLCommon::supports):

2016-02-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-primary-key-order.html fails with SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153800

        Reviewed by Alex Christensen.

        No new tests (Existing tests now unskipped).

        The IndexRecords SQL schema did not order things by primaryKey.
        
        Easy fix to the schema. Sadly requires a migration...

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::v1IndexRecordsTableSchema):
        (WebCore::IDBServer::v1IndexRecordsTableSchemaAlternate):
        (WebCore::IDBServer::v2IndexRecordsTableSchema):
        (WebCore::IDBServer::v2IndexRecordsTableSchemaAlternate):
        (WebCore::IDBServer::SQLiteIDBBackingStore::ensureValidIndexRecordsTable):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

2016-02-02  Tim Horton  <timothy_horton@apple.com>

        <attachment> should attempt to guess the icon from the file extension if all else fails
        https://bugs.webkit.org/show_bug.cgi?id=153804
        <rdar://problem/24448146>

        Reviewed by Anders Carlsson.

        Test: fast/attachment/attachment-icon-from-file-extension.html

        * platform/graphics/Icon.h:
        * platform/graphics/mac/IconMac.mm:
        (WebCore::Icon::createIconForFileExtension):
        * rendering/RenderThemeMac.mm:
        (WebCore::iconForAttachment):
        If we can't find an icon any other way, try assuming that the title is a filename,
        grab its extension, and have NSWorkspace try to work out an icon for it.

2016-02-02  Antti Koivisto  <antti@apple.com>

        Factor style sharing code out of StyleResolver
        https://bugs.webkit.org/show_bug.cgi?id=153768

        Reviewed by Darin Adler.

        Move the code to a new class, Style::SharingResolver.

        When resolving document style we query the sharing resolver first before using the regular style resolver.
        Other paths that call style resolver were mostly already disabling it with DisallowStyleSharing flag.

        * WebCore.xcodeproj/project.pbxproj:
        * css/ElementRuleCollector.cpp:
        (WebCore::MatchRequest::MatchRequest):
        (WebCore::ElementRuleCollector::matchAllRules):
        (WebCore::ElementRuleCollector::hasAnyMatchingRules):

            More const.

        * css/ElementRuleCollector.h:
        (WebCore::ElementRuleCollector::setRegionForStyling):
        (WebCore::ElementRuleCollector::setMedium):
        * css/MediaQueryMatcher.cpp:
        (WebCore::MediaQueryMatcher::prepareEvaluator):
        * css/StyleMedia.cpp:
        (WebCore::StyleMedia::matchMedium):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::State::cacheBorderAndBackground):
        (WebCore::StyleResolver::StyleResolver):
        (WebCore::StyleResolver::sweepMatchedPropertiesCache):
        (WebCore::StyleResolver::State::State):
        (WebCore::StyleResolver::State::setStyle):
        (WebCore::isAtShadowBoundary):
        (WebCore::StyleResolver::styleForElement):
        (WebCore::StyleResolver::classNamesAffectedByRules): Deleted.
        (WebCore::parentElementPreventsSharing): Deleted.
        (WebCore::StyleResolver::locateCousinList): Deleted.
        (WebCore::StyleResolver::styleSharingCandidateMatchesRuleSet): Deleted.
        (WebCore::StyleResolver::canShareStyleWithControl): Deleted.
        (WebCore::elementHasDirectionAuto): Deleted.
        (WebCore::StyleResolver::sharingCandidateHasIdenticalStyleAffectingAttributes): Deleted.
        (WebCore::StyleResolver::canShareStyleWithElement): Deleted.
        (WebCore::StyleResolver::findSiblingForStyleSharing): Deleted.
        (WebCore::StyleResolver::locateSharedStyle): Deleted.

            Style sharing code moves to SharingResolver.

        * css/StyleResolver.h:
        (WebCore::StyleResolver::mediaQueryEvaluator):
        (WebCore::StyleResolver::State::regionForStyling):
        (WebCore::StyleResolver::State::elementLinkState):
        (WebCore::StyleResolver::State::setApplyPropertyToRegularStyle):
        (WebCore::StyleResolver::State::setApplyPropertyToVisitedLinkStyle):
        (WebCore::StyleResolver::state):
        (WebCore::StyleResolver::setTextOrientation):
        (WebCore::StyleResolver::State::setElementAffectedByClassRules): Deleted.
        (WebCore::StyleResolver::State::elementAffectedByClassRules): Deleted.
        (WebCore::StyleResolver::styleNotYetAvailable): Deleted.

            Placeholder code moves to TreeResolver.

        * dom/VisitedLinkState.cpp:
        (WebCore::linkAttribute):
        (WebCore::VisitedLinkState::invalidateStyleForAllLinks):
        (WebCore::linkHashForElement):
        (WebCore::VisitedLinkState::invalidateStyleForLink):
        (WebCore::VisitedLinkState::determineLinkStateSlowCase):
        * dom/VisitedLinkState.h:
        (WebCore::VisitedLinkState::determineLinkState):
        * html/HTMLFormControlElement.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::getUncachedPseudoStyle):
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::computeStyleInRegion):
        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::isStyleAvailable):
        (WebCore::RenderStyle::hasUniquePseudoStyle):
        * style/StyleSharingResolver.cpp: Added.
        (WebCore::Style::SharingResolver::SharingResolver):
        (WebCore::Style::parentElementPreventsSharing):
        (WebCore::Style::elementHasDirectionAuto):
        (WebCore::Style::SharingResolver::searchSimilar):
        (WebCore::Style::SharingResolver::findSibling):
        (WebCore::Style::SharingResolver::locateCousinList):
        (WebCore::Style::canShareStyleWithControl):
        (WebCore::Style::SharingResolver::canShareStyleWithElement):
        (WebCore::Style::SharingResolver::styleSharingCandidateMatchesRuleSet):
        (WebCore::Style::SharingResolver::sharingCandidateHasIdenticalStyleAffectingAttributes):
        (WebCore::Style::SharingResolver::classNamesAffectedByRules):
        * style/StyleSharingResolver.h: Added.
        * style/StyleTreeResolver.cpp:
        (WebCore::Style::ensurePlaceholderStyle):
        (WebCore::Style::TreeResolver::TreeResolver):
        (WebCore::Style::TreeResolver::styleForElement):

            Try to use SharingResolver first.
            Also move placeholder style handling here, it is only relevant when resolving document style.

        (WebCore::Style::postResolutionCallbacksAreSuspended):
        (WebCore::Style::isPlaceholderStyle):
        * style/StyleTreeResolver.h:
        * svg/SVGElement.cpp:
        (WebCore::SVGElement::customStyleForRenderer):
        * svg/SVGElementRareData.h:
        (WebCore::SVGElementRareData::overrideComputedStyle):

2016-02-02  Tim Horton  <timothy_horton@apple.com>

        <attachment> icon should be a folder for the custom MIME type multipart/x-folder
        https://bugs.webkit.org/show_bug.cgi?id=153795
        <rdar://problem/24416632>

        Reviewed by Anders Carlsson.

        Test: fast/attachment/attachment-folder-icon.html

        * rendering/RenderThemeMac.mm:
        (WebCore::iconForAttachment):
        (WebCore::paintAttachmentIcon):
        Mail uses this special MIME type to indicate that something is a folder, which there
        isn't a normal non-deprecated MIME type for.

2016-02-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/cursor-continue-validity.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=153791

        Reviewed by Alex Christensen.

        No new tests (Existing test now unskipped).

        There was a preexisting check in the SQLite cursor for remembering the current record and
        refusing to refetch it.
        
        This check was causing this bug, because we needed to refetch the current record.
        
        Removing the check (and its associated flag) doesn't regress any other test, and fixes this one.

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::resetAndRebindStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:

2016-02-01  Dave Hyatt  <hyatt@apple.com>

        Add a line grid pagination SPI to WebKit.
        https://bugs.webkit.org/show_bug.cgi?id=153757
        <rdar://problem/23041598>

        Reviewed by Anders Carlsson.

        New tests in fast/multicol/pagination.

        * page/Page.cpp:
        (WebCore::Page::setPaginationLineGridEnabled):
        * page/Page.h:
        (WebCore::Page::paginationLineGridEnabled):
        Add a boolean to the page to turn the line grid on and off.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):
        Propagate the body's font up to the paginated RenderView so that
        it can be used to establish the line grid.

        * style/StyleResolveForDocument.cpp:
        (WebCore::Style::resolveForDocument):
        Set up a line grid with containment snapping by default if the
        line grid enabled flag is set.

        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setPagination):
        (WebCore::Internals::setPaginationLineGridEnabled):
        (WebCore::Internals::configurationForViewport):
        * testing/Internals.h:
        (WebCore::Internals::setPagination):
        * testing/Internals.idl:
        Add support for testing the grid being enabled.

2016-02-01  Antti Koivisto  <antti@apple.com>

        Tab suspension code shouldn't use page cache cacheability logic
        https://bugs.webkit.org/show_bug.cgi?id=153680

        Reviewed by Andreas Kling.

        Most of PageCache::canCache() is unnecessary for tab suspension.

        Also improve robustness and introduce 1 minute delay before suspending.

        * page/Page.cpp:
        (WebCore::Page::setPageActivityState):
        (WebCore::Page::setIsVisible):
        (WebCore::Page::setIsVisibleInternal):
        (WebCore::Page::setIsPrerender):
        (WebCore::Page::canTabSuspend):

            Include visibility test here.

            Instead of calling PageCache::canCache() just check for each frame
            - that the document is loaded
            - that active DOM objects allow suspension

        (WebCore::Page::setIsTabSuspended):
        (WebCore::Page::setTabSuspensionEnabled):
        (WebCore::Page::updateTabSuspensionState):

            Refactor for robustness.

        (WebCore::Page::tabSuspensionTimerFired):

            Call canTabSuspend, the result might have changed.

        (WebCore::Page::scheduleTabSuspension): Deleted.
        * page/Page.h:

2016-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>

        [JSC] Introduce BytecodeIntrinsic constant rep like @undefined
        https://bugs.webkit.org/show_bug.cgi?id=153737

        Reviewed by Darin Adler.

        * Modules/fetch/FetchHeaders.js:
        (initializeFetchHeaders):
        * Modules/streams/ReadableStream.js:
        (initializeReadableStream):
        (closeDestination):
        (abortDestination):
        (pipeTo):
        * Modules/streams/ReadableStreamInternals.js:
        (privateInitializeReadableStreamController):
        (teeReadableStream):
        (isReadableStreamReader):
        (errorReadableStream):
        (finishClosingReadableStream):
        (enqueueInReadableStream):
        (readFromReadableStreamReader):
        * Modules/streams/ReadableStreamReader.js:
        (releaseLock):
        * Modules/streams/StreamInternals.js:
        (shieldingPromiseResolve):
        (promiseInvokeOrNoopNoCatch):
        (promiseInvokeOrFallbackOrNoop):
        (validateAndNormalizeQueuingStrategy):
        * Modules/streams/WritableStream.js:
        (initializeWritableStream):
        (write):
        * Modules/streams/WritableStreamInternals.js:
        (errorWritableStream):

2016-02-02  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/dont-wedge.html sometimes ASSERTs.
        https://bugs.webkit.org/show_bug.cgi?id=153790

        Reviewed by Tim Horton.

        No new tests (Failing test now unskipped).

        This test uncovered an unhandled race where the main thread tried to perform an OpenDB operation 
        multiple times while it was already in-progress on the server thread.

        There was already a flag meant to cover this race, and it just needed to be applied to one more site.
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation):
        (WebCore::IDBServer::UniqueIDBDatabase::openBackingStore):

2016-02-02  Daniel Bates  <dabates@apple.com>

        CSP: Support checking content security policy without a script execution context
        https://bugs.webkit.org/show_bug.cgi?id=153748
        <rdar://problem/24439149>

        Reviewed by Darin Alder.

        Towards checking a Web Worker's content security policy against a redirected worker
        script load or redirected XHR request for an XHR request initiated from it, we should
        support instantiating a ContentSecurityPolicy object without a ScriptExecutionContext.

        No functionality was changed. So, no new tests.

        * dom/Document.cpp:
        (WebCore::Document::initSecurityContext): Pass |this| as a reference instead of as a pointer.
        * page/csp/ContentSecurityPolicy.cpp: Remove extraneous includes ScriptState.h, TextEncoding.h,
        and URL.h as they are included by ContentSecurityPolicy.h, FormDataList.h and FormData.h, respectively.
        (WebCore::CSPSource::CSPSource): Take a constant reference to a ContentSecurityPolicy instead
        of a pointer since we never expected a null pointer.
        (WebCore::CSPSource::schemeMatches): Move logic for checking the protocol of source "self"
        from here to ContentSecurityPolicy::protocolMatchesSelf() because we may not have a security
        origin if ContentSecurityPolicy was initiated without a ScriptExecutionContext object.
        (WebCore::CSPSourceList::allowSelf): Added.
        (WebCore::CSPSourceList::CSPSourceList): Take a constant reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer. Remove fields from member
        initialization list that can be initialized using C++11 in-class initialization syntax.
        (WebCore::CSPSourceList::matches): Call ContentSecurityPolicy::urlMatchesSelf() to match the
        effective URL against the URL of source "self".
        (WebCore::CSPSourceList::parse): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::CSPSourceList::parseSource): Simplify code by setting internal member fields directly
        instead of via member functions.
        (WebCore::CSPSourceList::parsePath): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::CSPDirective::CSPDirective): Take a constant reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer.
        (WebCore::CSPDirective::policy): Return a reference to a const ContentSecurityPolicy.
        (WebCore::MediaListDirective::MediaListDirective): Take a constant reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer.
        (WebCore::MediaListDirective::parse): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::SourceListDirective::SourceListDirective): Take a constant reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer.
        (WebCore::SourceListDirective::allows): Write in terms of CSPSourceList::allowSelf() because we
        may not have a security origin to get a URL from if ContentSecurityPolicy was initiated without
        a ScriptExecutionContext object.
        (WebCore::CSPDirectiveList::reportURIs): Change return type from Vector<URL> to Vector<String>
        The caller will convert the strings to URLs with respect to the script execution context.
        (WebCore::CSPDirectiveList::parseReportURI): Store the report URI as a string instead of a URL
        because we may not have a security origin to compute the absolute URL if ContentSecurityPolicy
        was initiated without a ScriptExecutionContext object.
        (WebCore::CSPDirectiveList::CSPDirectiveList): Take a reference to a ContentSecurityPolicy
        instead of a pointer since we never expected a null pointer. It would be better to take a const
        reference to a ContentSecurityPolicy, but ContentSecurityPolicy::applySandboxPolicy() needs to set
        state on ContentSecurityPolicy :(
        (WebCore::CSPDirectiveList::create): Ditto.
        (WebCore::CSPDirectiveList::reportViolation): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::CSPDirectiveList::checkEvalAndReportViolation): Ditto.
        (WebCore::CSPDirectiveList::checkInlineAndReportViolation): Ditto.
        (WebCore::CSPDirectiveList::parseDirective): Ditto.
        (WebCore::CSPDirectiveList::parseReportURI): Store the report URI as a string instead of a URL
        because we may not have a security origin to compute the absolute URL if ContentSecurityPolicy
        was initiated without a ScriptExecutionContext object.
        (WebCore::CSPDirectiveList::setCSPDirective): Update code as necessary now that m_policy is a reference
        instead of a pointer.
        (WebCore::CSPDirectiveList::applySandboxPolicy): Ditto.
        (WebCore::CSPDirectiveList::parseReflectedXSS): Ditto.
        (WebCore::CSPDirectiveList::addDirective): Ditto.
        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy): Modified to take the ScriptExecutionObject
        as a reference and compute the CSPSource object for "self" and cache the protocol for "self". Removed
        field m_overrideInlineStyleAllowed from the member initialization list and used C++11 in-class
        initialization syntax to initialize it. Added overloaded constructor that takes a SecurityOrigin object.
        We are not making use of this overloaded constructor at this time. We will in a subsequent patch.
        (WebCore::ContentSecurityPolicy::didReceiveHeader): Store the eval disabled error message for
        the last parsed policy in a member field instead of using it as part of disabling eval execution
        on the script execution context because we may not have such a context.
        (WebCore::ContentSecurityPolicy::applyPolicyToScriptExecutionContext): Applies the content security
        policy eval and sandbox restrictions to the script execution context.
        (WebCore::ContentSecurityPolicy::urlMatchesSelf): Match the specified URL against the URL for
        source "self".
        (WebCore::ContentSecurityPolicy::protocolMatchesSelf): Match the protocol of the specified URL
        against the protocol for source "self".
        (WebCore::ContentSecurityPolicy::gatherReportURIs): Modified to use the script execution context
        to compute the absolute URL for each report URI.
        (WebCore::ContentSecurityPolicy::reportViolation): Bail out if we do not have a script execution
        context.
        (WebCore::ContentSecurityPolicy::logToConsole): Only log to the console if we have a script
        execution context.
        (WebCore::ContentSecurityPolicy::reportBlockedScriptExecutionToInspector): Only report blocked
        script execution to the Web Inspector if we have a script execution context.
        (WebCore::CSPSourceList::addSourceSelf): Deleted.
        (WebCore::CSPSourceList::addSourceStar): Deleted.
        (WebCore::CSPSourceList::addSourceUnsafeInline): Deleted.
        (WebCore::CSPSourceList::addSourceUnsafeEval): Deleted.
        (WebCore::CSPDirectiveList::gatherReportURIs): Deleted.
        (WebCore::ContentSecurityPolicy::securityOrigin): Deleted.
        (WebCore::ContentSecurityPolicy::url): Deleted.
        (WebCore::ContentSecurityPolicy::completeURL): Deleted.
        (WebCore::ContentSecurityPolicy::enforceSandboxFlags): Deleted.
        * page/csp/ContentSecurityPolicy.h:
        (WebCore::ContentSecurityPolicy::enforceSandboxFlags): Accumulates the parsed sandbox flags. We
        will apply the sandbox flags in ContentSecurityPolicy::applyPolicyToScriptExecutionContext().
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::WorkerGlobalScope): Instantiate ContentSecurityPolicy.
        (WebCore::WorkerGlobalScope::applyContentSecurityPolicyResponseHeaders): Move instantiation of
        ContentSecurityPolicy from here to constructor.

2016-02-02  Eric Carlson  <eric.carlson@apple.com>

        Allow ports to disable automatic text track selection
        https://bugs.webkit.org/show_bug.cgi?id=153761
        <rdar://problem/24416768>

        Reviewed by Darin Adler.

        Test: media/track/track-manual-mode.html

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::manualKeyword): New.
        (WebCore::MediaControlsHost::captionDisplayMode): Support 'manual' mode.
        * Modules/mediacontrols/MediaControlsHost.h:

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.buildCaptionMenu): Check the 'off' item when in manual mode.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::addTextTrack): Update m_captionDisplayMode when called for the first
          time so it is always correct. Set the track's manual selection mode as appropriate.
        (WebCore::HTMLMediaElement::captionPreferencesChanged): Set each track's manual selection 
          mode as appropriate.

        * html/track/TextTrack.cpp:
        (WebCore::TextTrack::kind): Return 'subtitles' for forced tracks when in manual mode.
        * html/track/TextTrack.h:

        * html/track/TrackBase.h:
        (WebCore::TrackBase::kind): Make virtual.

        * page/CaptionUserPreferences.cpp:
        (WebCore::CaptionUserPreferences::beginBlockingNotifications): New.
        (WebCore::CaptionUserPreferences::endBlockingNotifications): Ditto.
        (WebCore::CaptionUserPreferences::notify): Don't notify when blocked.
        * page/CaptionUserPreferences.h:

        * page/CaptionUserPreferencesMediaAF.cpp:
        (WebCore::CaptionUserPreferencesMediaAF::CaptionUserPreferencesMediaAF): Set manual mode 
          when appropriate.
        (WebCore::CaptionUserPreferencesMediaAF::captionDisplayMode): Check manual mode.
        (WebCore::CaptionUserPreferencesMediaAF::setCaptionDisplayMode): Ditto.
        (WebCore::CaptionUserPreferencesMediaAF::setPreferredLanguage): Ditto.
        (WebCore::CaptionUserPreferencesMediaAF::textTrackSelectionScore): Return zero when in manual mode.
        (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu): Consider manual mode. Fix
          typos in logging.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::mediaDescriptionForKind): Return 'auxiliary' when in manual mode.

        * testing/Internals.cpp:
        (WebCore::Internals::setCaptionDisplayMode): Support manual mode.

2016-02-02  Adrien Plazas  <aplazas@igalia.com>

        REGRESSION(r195899): ASSERTION FAILED: is<Target>(source) in EventPath::retargetTouch() since r195899
        https://bugs.webkit.org/show_bug.cgi?id=153741

        Reviewed by Ryosuke Niwa.

        * dom/EventDispatcher.cpp:
        (WebCore::EventPath::retargetTouch):

2016-02-01  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: High Level Memory Overview Instrument
        https://bugs.webkit.org/show_bug.cgi?id=153516
        <rdar://problem/24356378>

        Reviewed by Brian Burg.

        Add a new agent that gathers data from the ResourceUsageThread
        and sends to the frontend.

        Test: inspector/memory/tracking.html

        * CMakeLists.txt:
        * Configurations/FeatureDefines.xcconfig:
        * WebCore.xcodeproj/project.pbxproj:
        New files.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        Add the new agent.

        * inspector/InspectorMemoryAgent.h: Added.
        * inspector/InspectorMemoryAgent.cpp: Added.
        (WebCore::InspectorMemoryAgent::InspectorMemoryAgent):
        (WebCore::InspectorMemoryAgent::didCreateFrontendAndBackend):
        (WebCore::InspectorMemoryAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorMemoryAgent::startTracking):
        (WebCore::InspectorMemoryAgent::stopTracking):
        (WebCore::InspectorMemoryAgent::collectSample):
        Implement the agent by adding / removing it as a ResourceUsage
        observer. When receiving the data forward it to the frontend.

2016-02-01  Alex Christensen  <achristensen@webkit.org>

        Fix CMake build.

        * PlatformMac.cmake:

2016-02-01  Brady Eidson  <beidson@apple.com>

        Modern IDB: Cursors (still) do not keep their opening request alive.
        https://bugs.webkit.org/show_bug.cgi?id=153724

        Reviewed by Alex Christensen.

        No new tests (All existing tests pass without flakiness).

        IDBCursors did not properly keep their JS wrappers alive.
        Making them ActiveDOMObjects that keep track of how many requests might be in flight fixes this.
        This also makes them actually keep their opening-request live via the opaque-root mechanism.
        
        IDBCursorWithValue also needed to opt in to all of these mechanisms.

        * CMakeLists.txt:
        * WebCore.xcodeproj/project.pbxproj:

        * Modules/indexeddb/IDBCursor.h:
        (WebCore::IDBCursor::hasPendingActivity): The base IDBCursor always has no pending activity,
          to maintain current behavior in LegacyIDB. This weirdness will go away when LegacyIDB does.
        * Modules/indexeddb/IDBCursor.idl:
        * Modules/indexeddb/IDBCursorWithValue.idl:

        Track a count for all outstanding requests to keep the cursor alive as an ActiveDOMObject.
        * Modules/indexeddb/client/IDBCursorImpl.cpp:
        (WebCore::IDBClient::IDBCursor::IDBCursor):
        (WebCore::IDBClient::IDBCursor::update):
        (WebCore::IDBClient::IDBCursor::uncheckedIterateCursor):
        (WebCore::IDBClient::IDBCursor::deleteFunction):
        (WebCore::IDBClient::IDBCursor::activeDOMObjectName):
        (WebCore::IDBClient::IDBCursor::canSuspendForDocumentSuspension):
        (WebCore::IDBClient::IDBCursor::hasPendingActivity):
        (WebCore::IDBClient::IDBCursor::decrementOutstandingRequestCount):
        * Modules/indexeddb/client/IDBCursorImpl.h:
        
        Rework the "delete" family of functions on the object store to allow for returning a modern IDBRequest.
        A lot of this can go away when LegacyIDB does.
        * Modules/indexeddb/client/IDBObjectStoreImpl.cpp:
        (WebCore::IDBClient::IDBObjectStore::deleteFunction):
        (WebCore::IDBClient::IDBObjectStore::doDelete):
        (WebCore::IDBClient::IDBObjectStore::modernDelete):
        * Modules/indexeddb/client/IDBObjectStoreImpl.h:
        
        * Modules/indexeddb/client/IDBRequestImpl.cpp:
        (WebCore::IDBClient::IDBRequest::setSource): Setup a ScopeGuard to decrement the cursor's request
          count whenever it makes sense to do so.
        (WebCore::IDBClient::IDBRequest::dispatchEvent): Clear the ScopeGuard (if it exists) to decrement the count.
        (WebCore::IDBClient::IDBRequest::willIterateCursor): Set the ScopeGuard.
        (WebCore::IDBClient::IDBRequest::didOpenOrIterateCursor): Clear the ScopeGuard (if it exists) to decrement the count.
        * Modules/indexeddb/client/IDBRequestImpl.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::ScopeGuard::ScopeGuard): Deleted.
        (WebCore::IDBServer::ScopeGuard::~ScopeGuard): Deleted.
        (WebCore::IDBServer::ScopeGuard::enable): Deleted.
        (WebCore::IDBServer::ScopeGuard::disable): Deleted.
        
        * bindings/js/JSIDBCursorWithValueCustom.cpp: Added.
        (WebCore::JSIDBCursorWithValue::visitAdditionalChildren):
        
        * platform/ScopeGuard.h: Added.
        (WebCore::ScopeGuard::ScopeGuard):
        (WebCore::ScopeGuard::~ScopeGuard):
        (WebCore::ScopeGuard::enable):
        (WebCore::ScopeGuard::disable):

2016-02-01  Sun-woo Nam  <sunny.nam@samsung.com>

        Free Colormap when XWindow is destroyed.
        https://bugs.webkit.org/show_bug.cgi?id=153413

        Reviewed by Žan Doberšek.

        Colormap is needed to create XWindow and it should be freed when XWindow is destroyed.
        Unless Colormap is freed before destroying XWindow, memory leak is suspected.
        XFreeColormap therefore is needed on X11Helper.

        * platform/graphics/surfaces/glx/X11Helper.cpp: Added XFreeColormap.
        (WebCore::X11Helper::destroyWindow):

2016-02-01  Tim Horton  <timothy_horton@apple.com>

        Move some SPI declarations into the appropriate SPI header
        https://bugs.webkit.org/show_bug.cgi?id=153755

        Reviewed by Darin Adler.

        * platform/graphics/cocoa/IOSurface.mm:
        * platform/spi/cg/CoreGraphicsSPI.h:

2016-02-01  Tim Horton  <timothy_horton@apple.com>

        Snapshot surfaces are forever wired after being compressed
        https://bugs.webkit.org/show_bug.cgi?id=153751
        <rdar://problem/24354546>

        Reviewed by Darin Adler.

        * platform/graphics/cocoa/IOSurface.mm:
        (IOSurface::convertToFormat):
        Allow IOSurfaceAccelerator to unwire surfaces after they're transformed.

2016-02-01  Dan Bernstein  <mitz@apple.com>

        <rdar://problem/20150072> [iOS] Remove some file upload code only needed before iOS 9
        https://bugs.webkit.org/show_bug.cgi?id=153754

        Reviewed by Darin Adler.

        * English.lproj/Localizable.strings: Updated for removal of WebKit2 string.

2016-02-01  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Cache the Path instead of creating it every time it is required
        https://bugs.webkit.org/show_bug.cgi?id=152939

        Reviewed by Darin Adler.

        Instead of creating the Path object every time it is required, we should 
        cache it in an LRU cache. TinyLRUCache returns a reference to the cached
        entry so we do not have to pay the cost of copying it either.

        * platform/graphics/FloatRoundedRect.h:
        (WebCore::operator!=):
        Implement the inequality operator for FloatRoundedRect since it is
        called by TinyLRUCache.
        
        * rendering/ClipPathOperation.h:
        Return a reference to the path in the cache since instead of creating a
        new copy.
        
        * rendering/style/BasicShapes.cpp:
        (WebCore::SVGPathTranslatedByteStream::SVGPathTranslatedByteStream):
        (WebCore::SVGPathTranslatedByteStream::operator==):
        (WebCore::SVGPathTranslatedByteStream::operator!=):
        (WebCore::SVGPathTranslatedByteStream::isEmpty):
        (WebCore::SVGPathTranslatedByteStream::path):
        This struct holds an offset and an SVGPathByteStream. It is the key of 
        the LRU cache for the the translated SVGPathByteStream.
        
        (WebCore::EllipsePathPolicy::isKeyNull):
        (WebCore::EllipsePathPolicy::createValueForKey):
        (WebCore::RoundedRectPathPolicy::isKeyNull):
        (WebCore::RoundedRectPathPolicy::createValueForKey):
        (WebCore::PolygonPathPolicy::isKeyNull):
        (WebCore::PolygonPathPolicy::createValueForKey):
        (WebCore::TranslatedByteStreamPathPolicy::isKeyNull):
        (WebCore::TranslatedByteStreamPathPolicy::createValueForKey):
        Inherit from the LRU cache policy template, so have a specific name for
        the desired path contents and pass this class explicitly to the LRU cache
        template.
        
        (WebCore::cachedEllipsePath):
        (WebCore::cachedRoundedRectPath):
        (WebCore::cachedPolygonPath):
        (WebCore::cachedTranslatedByteStreamPath):
        Return a cached path object for specific path contents.
        
        (WebCore::BasicShapeCircle::path):
        (WebCore::BasicShapeEllipse::path):
        (WebCore::BasicShapePolygon::path):
        (WebCore::BasicShapePath::path):
        (WebCore::BasicShapeInset::path):
        Get the Path object from the cache; create a new one if it does not exist.
        
        * rendering/style/BasicShapes.h:
        Change the prototype of the path() function to return a reference to the
        path in the cache instead of a having to copying it.
        
        * svg/SVGPathByteStream.h:
        (WebCore::SVGPathByteStream::operator!=):
        Implement the inequality operator for SVGPathByteStream because it is
        called by TinyLRUCache.

2016-02-01  Chris Dumez  <cdumez@apple.com>

        Move properties that use custom bindings to the prototype
        https://bugs.webkit.org/show_bug.cgi?id=153735

        Reviewed by Darin Adler.

        Move properties that use custom bindings to the prototype. Whether a
        property's bindings code is generated or custom-written should not
        impact where the property is located.

        No new tests, already covered by existing tests.

        * bindings/js/JSHTMLDocumentCustom.cpp:
        (WebCore::JSHTMLDocument::getOwnPropertySlot):
        Add null-check for staticPropHashTable. HTMLDocument no longer has
        any property on the instance so staticPropHashTable is now null.

        * bindings/scripts/CodeGeneratorJS.pm:

2016-02-01  Jer Noble  <jer.noble@apple.com>

        REGRESSION(r195770): Use-after-free in ResourceLoaderOptions::cachingPolicy
        https://bugs.webkit.org/show_bug.cgi?id=153727
        <rdar://problem/24429886>

        Reviewed by Chris Dumez.

        The `this` object may be freed after calling deleteIfPossible(). Make the early-return-if-
        deleted more explicit, and only check allowsCaching() after the deleteIfPossible() return
        value check.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::removeClient):

2016-02-01  Dan Bernstein  <mitz@apple.com>

        Tried to fix a build after r195899.

        * dom/EventContext.h: Enabled TouchEventContext type trait specialization on iOS.

2016-02-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement Fetch API Request
        https://bugs.webkit.org/show_bug.cgi?id=153437

        Added support for Fetch Request and Body.
        Body is sharing functionality between Request and Response.
        Conversion between various body types are not implemented yet.

        Added a FetchOptions class. Options in this class are partially redundant with ResourceLoaderOptions.

        Fixing bug in Headers constructor.
        Making error reporting in case of modifying headers compliant with the spec.

        Reviewed by Darin Adler.

        Tests: imported/w3c/web-platform-tests/fetch/api/request/request-clone.sub.html
               imported/w3c/web-platform-tests/fetch/api/request/request-consume.html
               imported/w3c/web-platform-tests/fetch/api/request/request-disturbed.html
               imported/w3c/web-platform-tests/fetch/api/request/request-error.html
               imported/w3c/web-platform-tests/fetch/api/request/request-headers.html
               imported/w3c/web-platform-tests/fetch/api/request/request-idl.html
               imported/w3c/web-platform-tests/fetch/api/request/request-init-001.sub.html
               imported/w3c/web-platform-tests/fetch/api/request/request-init-002.html
               imported/w3c/web-platform-tests/fetch/api/request/request-init-003.sub.html
               imported/w3c/web-platform-tests/fetch/api/request/request-structure.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * Modules/fetch/FetchBody.cpp: Added.
        (WebCore::FetchBody::initBody):
        (WebCore::FetchBody::clear):
        (WebCore::FetchBody::processIfEmptyOrDisturbed):
        (WebCore::FetchBody::arrayBuffer):
        (WebCore::FetchBody::formData):
        (WebCore::FetchBody::blob):
        (WebCore::FetchBody::text):
        (WebCore::FetchBody::json):
        * Modules/fetch/FetchBody.h: Added.
        (WebCore::FetchBody::~FetchBody):
        (WebCore::FetchBody::isEmpty):
        (WebCore::FetchBody::isDisturbed):
        (WebCore::FetchBody::setDisturbed):
        (WebCore::FetchBody::setMimeType):
        (WebCore::FetchBody::mimeType):
        * Modules/fetch/FetchBody.idl: Added.
        * Modules/fetch/FetchHeaders.cpp:
        (WebCore::canWriteHeader):
        (WebCore::FetchHeaders::append):
        (WebCore::FetchHeaders::remove):
        (WebCore::FetchHeaders::set):
        (WebCore::FetchHeaders::fill): Helper routine implementing https://fetch.spec.whatwg.org/#concept-headers-fill
        * Modules/fetch/FetchHeaders.h: Adding header getter/setter for FetchRequest.
        (WebCore::FetchHeaders::fastGet):
        (WebCore::FetchHeaders::fastSet):
        * Modules/fetch/FetchHeaders.js: Fixing bug in constructor (covered by modified headers-basc.html test).
        (initializeFetchHeaders):
        * Modules/fetch/FetchOptions.h: Added.
        (WebCore::FetchOptions::FetchOptions):
        (WebCore::FetchOptions::type):
        (WebCore::FetchOptions::destination):
        (WebCore::FetchOptions::mode):
        (WebCore::FetchOptions::credentials):
        (WebCore::FetchOptions::cache):
        (WebCore::FetchOptions::redirect):
        (WebCore::FetchOptions::referrerPolicy):
        (WebCore::FetchOptions::setType):
        (WebCore::FetchOptions::setDestination):
        (WebCore::FetchOptions::setMode):
        (WebCore::FetchOptions::setCredentials):
        (WebCore::FetchOptions::setCache):
        (WebCore::FetchOptions::setRedirect):
        (WebCore::FetchOptions::setReferrerPolicy):
        * Modules/fetch/FetchRequest.cpp: Added.
        (WebCore::FetchRequest::create):
        (WebCore::FetchRequest::FetchRequest):
        (WebCore::FetchRequest::init):
        (WebCore::FetchRequest::setReferrer):
        (WebCore::FetchRequest::setReferrerPolicy):
        (WebCore::FetchRequest::setMode):
        (WebCore::FetchRequest::setCredentials):
        (WebCore::FetchRequest::setCache):
        (WebCore::FetchRequest::setRedirect):
        (WebCore::FetchRequest::type):
        (WebCore::FetchRequest::destination):
        (WebCore::FetchRequest::referrerPolicy):
        (WebCore::FetchRequest::referrer):
        (WebCore::FetchRequest::mode):
        (WebCore::FetchRequest::credentials):
        (WebCore::FetchRequest::cache):
        (WebCore::FetchRequest::redirect):
        (WebCore::FetchRequest::setMethod):
        (WebCore::FetchRequest::clone):
        * Modules/fetch/FetchRequest.h: Added.
        (WebCore::FetchRequest::method):
        (WebCore::FetchRequest::url):
        (WebCore::FetchRequest::integrity):
        (WebCore::FetchRequest::headers):
        * Modules/fetch/FetchRequest.idl: Added.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/Dictionary.h:
        (WebCore::Dictionary::execState):
        * bindings/js/JSDictionary.cpp:
        (WebCore::JSDictionary::convertValue):
        * bindings/js/JSDictionary.h:
        (WebCore::JSDictionary::get):

2016-01-31  Jeremy Jones  <jeremyj@apple.com>

        Add resize event for HTMLMediaElement
        https://bugs.webkit.org/show_bug.cgi?id=125715

        Reviewed by Darin Adler.

        Tests: http/tests/media/hls/hls-video-resize.html
               media/video-resize.html

        Move resize javascript event from DOMWindow.idl to GlobalEventHandlers.idl
        per https://html.spec.whatwg.org/multipage/webappapis.html#globaleventhandlers

        Post resize event from video element when metadata loads and when content size changes.

        * dom/GlobalEventHandlers.idl: Add onresize.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::createEventHandlerNameMap): Add onresizeAttr.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::setReadyState):
        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
        * html/HTMLMediaElement.h:
        (WebCore::HTMLMediaElement::scheduleResizeEvent):
        (WebCore::HTMLMediaElement::scheduleResizeEventIfSizeChanged):
        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::scheduleResizeEvent): Sechedule event.
        (WebCore::HTMLVideoElement::scheduleResizeEventIfSizeChanged): Schedule event if size has changed.
        * html/HTMLVideoElement.h: Add declarations.
        * page/DOMWindow.idl: Remove onresize.

2016-01-31  Darin Adler  <darin@apple.com>

        Revert accidental behavior change from previous patch.

        * platform/URL.cpp:
        (WebCore::mimeTypeFromDataURL): Restore behavior where an empty MIME type would
        be turned into "text/plain".

2016-01-31  Darin Adler  <darin@apple.com>

        Cut down on calls to String::lower; mostly replace with convertToASCIILowercase
        https://bugs.webkit.org/show_bug.cgi?id=153732

        Reviewed by Dean Jackson.

        * Modules/mediasource/MediaSource.cpp:
        (WebCore::MediaSource::isTypeSupported): Added comment about mysterious call
        to lower(); should probably return here and remove it.

        * Modules/navigatorcontentutils/NavigatorContentUtils.cpp:
        (WebCore::initProtocolHandlerWhitelist): Deleted. Moved into isProtocolWhitelisted.
        (WebCore::isProtocolWhitelisted): Changed set to be ASCIICaseInsensitiveHash and
        initialized it using a lambda instead of a separate function.
        (WebCore::verifyProtocolHandlerScheme): Added a FIXME about some case sensitive
        checking of the protocol prefix here.

        * Modules/plugins/QuickTimePluginReplacement.mm:
        (WebCore::QuickTimePluginReplacement::supportsMimeType): Changed set to be
        ASCIICaseInsensitiveHash and initialized it using a lambda instead of using
        an explict check for empty.
        (WebCore::QuickTimePluginReplacement::supportsFileExtension): Ditto.

        * Modules/plugins/YouTubePluginReplacement.cpp:
        (WebCore::queryKeysAndValues): Use convertToASCIILowercase. The keys here are
        going to be all ASCII.
        (WebCore::isYouTubeURL): Use equalLettersIgnoringASCIICase instead of lowercasing
        the string.
        (WebCore::processAndCreateYouTubeURL): Use url.protocolIsInHTTPFamily instead of
        listing "http" and then "https" explicitly. Use equalLettersIgnoringASCIICase
        instead of lowercasing a string.
        (WebCore::YouTubePluginReplacement::youTubeURL): Ditto.

        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::hostName): Use convertToASCIILowercase on host name.
        (WebCore::WebSocketHandshake::host): Ditto.

        * accessibility/atk/WebKitAccessibleWrapperAtk.cpp:
        (webkitAccessibleGetAttributes): Call convertToASCIILowercase instead of lower
        to lowercase an element's tag name. This is a strange way to do things; typically
        would be better to use some other function on Element, since tagName goes out of
        its way to be capitalized, but some ATK expert can improve this later.

        * css/CSSGrammar.y.in: Use the new convertToASCIILowercaseInPlace function rather
        than the old lower function. We only need to lowercase the ASCII letters, and it's
        also better to have the function have a clearer name.

        * css/CSSParser.cpp:
        (WebCore::convertToASCIILowercaseInPlace): Renamed from makeLower and made it deal
        with only ASCII lowercasing.
        (WebCore::CSSParserString::convertToASCIILowercaseInPlace): Renamed from lower.
        (WebCore::isUniversalKeyword): Added. Helper for the function below that uses
        equalLettersIgnoringASCIICase rather than lowercasing the string.
        (WebCore::parseKeywordValue): Use isUniversalKeyword. Also clarified a comment.
        (WebCore::CSSParser::parseAttr): Use convertToASCIILowercaseInPlace and delay
        String creation until later in the function, using CSSParserString operations more.

        * css/CSSParserValues.cpp:
        (WebCore::CSSParserSelector::parsePseudoElementSelector): Use
        convertToASCIILowercaseInPlace by its new name, with its new behavior.

        * css/CSSParserValues.h: Tweaked comment and formatting a bit. Replaced the lower
        function with the convertToASCIILowercaseInPlace function.

        * css/CSSSelector.cpp:
        (WebCore::CSSSelector::RareData::parseNth): Rewrote this to avoid the need to
        make a lowercased copy of m_argument. Use equalLettersIgnoringASCIICase, and two
        calls to find. Also use String::toIntStrict so we don't have to create String
        objects for substrings.

        * css/MediaQuery.cpp:
        (WebCore::MediaQuery::MediaQuery): Use convertToASCIILowercase for media type name.
        * css/MediaQueryExp.cpp:
        (WebCore::MediaQueryExp::serialize): Use convertToASCIILowercase for media feature name.

        * dom/Document.cpp:
        (WebCore::isSeparator): Tweaked formatting and removed non-helpful comment.
        (WebCore::processArguments): Changed this from a static member function to a non-member
        file internal function. Use a std::function instead of a function pointer with a void*
        pointer. Rewrote algorithm to simplify it and use StringView instead of String for the
        keys and values.
        (WebCore::Document::processViewport): Use a lambda instead of a function pointer to
        call setViewportFeature, so that function's interface is no longer dictated by
        the exact type of the function pointer argument to processArguments.
        (WebCore::Document::processFormatDetection): Use a lambda instead of the
        setParserFeature function above; use equalLettersIgnoringASCIICase for both the
        key and the value, since processArguments no longer lowercases the string.
        (WebCore::Document::processArguments): Deleted.

        * dom/Document.h: Removed unnecessary declaration of processArguments and
        ArgumentsCallback. Both are now private to the cpp file.

        * dom/Element.cpp:
        (WebCore::makeIdForStyleResolution): Use convertToASCIILowercase. When in quirks mode,
        we want to match IDs in an ASCII case-insensitive way not match compatibility caseless.

        * dom/ScriptElement.cpp:
        (WebCore::ScriptElement::isScriptTypeSupported): Remove the use of lower here since
        the MIME type registry is now itself ASCII case-insensitive.

        * dom/ViewportArguments.cpp:
        (WebCore::numericPrefix): Changed to use StringView and take a Document&, rearranged
        argument order so Document& comes first.
        (WebCore::findSizeValue): Ditto.
        (WebCore::findScaleValue): Ditto.
        (WebCore::findBooleanValue): Ditto. Also use std::abs instead of fabs, possibly
        avoiding a conversion from float to double (not sure it was happening before but it's
        definitely not happening now).
        (WebCore::setViewportFeature): Changed to put arguments in a more logical order, to take
        the ViewportArguments as a reference, not a void*, and to use StringView to avoid forcing
        the caller to allocate strings. Also changed to use equalLettersIgnoringASCIICase so we
        don't rely on the caller to make the key lowercase for us.
        (WebCore::reportViewportWarning): Changed argument types. Added a couple comments about
        mistakes in the function.

        * dom/ViewportArguments.h: Removed unnecessary declaration of reportViewportWarning,
        which is now private to the cpp file. Updated for new arguments to setViewportFeature.

        * editing/EditorCommand.cpp:
        (WebCore::executeFormatBlock): Use convertToASCIILowercase on the argument, which is
        specifying a tag name.

        * fileapi/Blob.cpp:
        (WebCore::Blob::isValidContentType): Removed unnecessary separate loops for
        8-bit and 16-bit strings. Content types are short strings and this small optimization is
        not worth the additional code complexity.
        (WebCore::Blob::normalizedContentType): Use convertToASCIILowercase since valid
        content types are guaranteed to be all ASCII.
        (WebCore::Blob::isNormalizedContentType): Removed unnecessary separate loops for
        8-bit and 16-bit strings. Content types are short strings and this small optimization is
        not worth the additional code complexity.

        * html/parser/HTMLParserIdioms.cpp: Added now-needed include of QualifiedName.h.

        * html/parser/HTMLParserIdioms.h: Removed unneeded include of QualifiedName.h and
        WTFString.h. Made sure every function is declared first, even if it's also defined
        later in the header in the section for functions templates and inline functions.

        * loader/archive/ArchiveFactory.cpp:
        (WebCore::ArchiveFactory::registerKnownArchiveMIMETypes): Use auto& for the type of
        the set of MIME types here, since it's now using ASCIICaseInsensitiveHash.

        * platform/MIMETypeRegistry.cpp: Changed the MIME type sets to use
        ASCIICaseInsensitiveHash since MIME type are not case sensitive.
        (WebCore::initializeSupportedImageMIMETypes): Use a modern for loop.
        (WebCore::initializeSupportedImageMIMETypesForEncoding): Updated for HashSet type change.
        (WebCore::initializePDFMIMETypes): Use a modern for loop.
        (WebCore::initializeSupportedNonImageMimeTypes): Use a modern for loop.
        (WebCore::initializeSupportedMediaMIMETypes): Updated for HashSet type change.
        (WebCore::initializeUnsupportedTextMIMETypes): Use a modern for loop.
        (WebCore::initializeMIMETypeRegistry): Updated for HashSet type change.
        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding): Ditto.
        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getPDFMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getPDFAndPostScriptMIMETypes): Ditto.
        (WebCore::MIMETypeRegistry::getUnsupportedTextMIMETypes): Ditto.
        (WebCore::mimeTypeAssociationMap): Use ASCIICaseInsensitiveHash.
        (WebCore::MIMETypeRegistry::getNormalizedMIMEType): Use auto to make code tighter.

        * platform/MIMETypeRegistry.h: Changed return types of the getMIMETypes functions
        to use ASCIICaseInsensitiveHash.

        * platform/SchemeRegistry.cpp:
        (WebCore::schemesForbiddenFromDomainRelaxation): Changed type to
        use ASCIICaseInsensitiveHash.

        * platform/URL.cpp:
        (WebCore::mimeTypeFromDataURL): Use convertToASCIILowercase instead of lower.
        Also removed some dead code that tried to handle the case where the data URL
        has a comma as one of the first 5 characters: That can't happen since it's a
        precondition of this function that the first five characters are "data:".

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::getSupportedTypes): Change type of argument to
        a HashSet with ASCIICaseInsensitiveHash.
        * platform/graphics/MediaPlayer.h: Ditto.

        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
        (WebCore::MediaPlayerPrivateAVFoundation::staticMIMETypeList):
        Changed type of HashSet to use ASCIICaseInsensitiveHash.
        * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.h: Ditto.

        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::avfMIMETypes):
        Changed type of HashSet to use ASCIICaseInsensitiveHash.
        (WebCore::MediaPlayerPrivateAVFoundationCF::getSupportedTypes): Ditto.
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h: Ditto.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        Changed type of HashSet to use ASCIICaseInsensitiveHash.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::paintWithImageGenerator): Removed
        an unnecessary line of code to set a local variable to 0 just before it falls
        out of scope.
        (WebCore::avfMIMETypes): Ditto. Also tightened up the code a bit.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::getSupportedTypes): Ditto.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        Changed type of HashSet to use ASCIICaseInsensitiveHash.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::mimeTypeCache): Ditto.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::getSupportedTypes): Ditto.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.h: Ditto.
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaStreamAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaStreamAVFObjC::getSupportedTypes): Ditto.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
        (WebCore::mimeTypeCache): Ditto.
        (WebCore::MediaPlayerPrivateGStreamer::getSupportedTypes): Ditto.
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h: Ditto.

        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Ditto.
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::shouldRejectMIMEType): Made this non-case-sensitive by using startsWith
        and the "false" argument. Later change this to startsWithIgnoringASCIICase or
        startsWithLettersIgnoringASCIICase.
        (WebCore::addFileTypesToCache): Use ASCIICaseInsensitiveHash. ALso rewrote to
        tighten up the code a bit and use modern Objective-C for loops.
        (WebCore::mimeCommonTypesCache): Use ASCIICaseInsensitiveHash.
        (WebCore::mimeModernTypesCache): Ditto.
        (WebCore::concatenateHashSets): Ditto.
        (WebCore::MediaPlayerPrivateQTKit::getSupportedTypes): Ditto.
        (WebCore::MediaPlayerPrivateQTKit::disableUnsupportedTracks): Initialied
        track type set using lambda, but left it case sensitive.

        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
        (WebCore::mimeTypeCache): Changed type of HashSet to use ASCIICaseInsensitiveHash.
        (WebCore::MediaPlayerPrivateMediaFoundation::getSupportedTypes): Ditto.
        * platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

        * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
        (WebCore::mimeTypeCache): Ditto.
        (WebCore::MockMediaPlayerMediaSource::getSupportedTypes): Ditto.
        * platform/mock/mediasource/MockMediaPlayerMediaSource.h: Ditto.

2016-01-31  Brent Fulgham  <bfulgham@apple.com>

        Add "WebKit built-in PDF" Plugin to set of publicly visible plugins
        https://bugs.webkit.org/show_bug.cgi?id=153657
        <rdar://problem/24413107>

        Reviewed by Darin Adler.

        Tested by http/tests/plugins/visible_plugins.html.

        A number of poorly-coded sites break when WebKit reports that it understands PDF mime types,
        but does not have a list of plugins that the site can iterate through.

        To avoid this compatibility problem, we should also expose the "WebKit built-in PDF" plugin
        to avoid this edge case.

        * plugins/PluginData.cpp:
        (WebCore::shouldBePubliclyVisible): Add "WebKit built-in PDF" plugin.

2016-01-31  Doug Russell  <d_russell@apple.com>

        AX: Add a boundary value to AXTextStateChangeType
        https://bugs.webkit.org/show_bug.cgi?id=153085

        Reviewed by Darin Adler.

        Post an AT notification when navigation is attempted past
        an editable element's boundaries.

        Test: accessibility/mac/selection-boundary-userinfo.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::showIntent):
        * accessibility/AXTextStateChangeIntent.h:
        * accessibility/mac/AXObjectCacheMac.mm:
        (platformChangeTypeForWebCoreChangeType):
        (WebCore::AXObjectCache::postTextStateChangePlatformNotification):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::modifyMovingRight):
        (WebCore::FrameSelection::modifyMovingForward):
        (WebCore::FrameSelection::modifyMovingLeft):
        (WebCore::FrameSelection::modifyMovingBackward):
        (WebCore::textSelectionWithDirectionAndGranularity):
        (WebCore::FrameSelection::modify):
        (WebCore::FrameSelection::modifyExtendingBackward): Deleted.
        (WebCore::FrameSelection::textSelectionIntent): Deleted.
        * editing/FrameSelection.h:
        * editing/VisiblePosition.cpp:
        (WebCore::VisiblePosition::next):
        (WebCore::VisiblePosition::previous):
        (WebCore::VisiblePosition::left):
        (WebCore::VisiblePosition::right):
        (WebCore::VisiblePosition::honorEditingBoundaryAtOrBefore):
        (WebCore::VisiblePosition::honorEditingBoundaryAtOrAfter):
        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate): Deleted.
        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate): Deleted.
        * editing/VisiblePosition.h:
        * editing/VisibleUnits.cpp:
        (WebCore::startOfLine):
        (WebCore::logicalStartOfLine):
        (WebCore::endOfLine):
        (WebCore::logicalEndOfLine):
        (WebCore::leftBoundaryOfLine):
        (WebCore::rightBoundaryOfLine):
        (WebCore::inSameLogicalLine): Deleted.
        (WebCore::endOfEditableContent): Deleted.
        (WebCore::isEndOfEditableOrNonEditableContent): Deleted.
        * editing/VisibleUnits.h:

2016-01-31  Daniel Bates  <dabates@apple.com>

        CSP: Use the served CSP header for dedicated workers
        https://bugs.webkit.org/show_bug.cgi?id=153157
        <rdar://problem/24383254>
        And
        https://bugs.webkit.org/show_bug.cgi?id=153156
        <rdar://problem/24383246>

        Reviewed by Brent Fulgham.

        Inspired by Blink commit:
        <https://src.chromium.org/viewvc/blink?revision=194143&view=revision>

        Implement support for respecting Content Security Policy (CSP) HTTP headers included in the
        HTTP response for a Web Worker's script as per section Workers of the CSP 2.0 spec,
        <https://w3c.github.io/webappsec-csp/2/#processing-model-workers> (29 August 2015).

        Currently a Web Worker always inherits the CSP of its owner document. Instead a web worker
        will inherit the CSP of its owner document only if its script is incapable of defining a
        content security policy (i.e. its origin is a globally unique identifier). Otherwise, the
        CSP HTTP headers delivered with the script will be used to define the CSP for the worker.

        Tests: fast/workers/worker-inherits-csp-blocks-eval.html
               fast/workers/worker-inherits-csp-blocks-xhr.html
               http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-blocks-eval.html

        * CMakeLists.txt: Add file ContentSecurityPolicyResponseHeaders.cpp.
        * WebCore.vcxproj/WebCore.vcxproj: Add files ContentSecurityPolicyResponseHeaders.{cpp, h}.
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * dom/Document.cpp:
        (WebCore::Document::processHttpEquiv): Update code to use enum class ContentSecurityPolicyHeaderType.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::didBeginDocument): Extract logic to collect Content Security Policy HTTP headers
        into class ContentSecurityPolicyResponseHeaders and make use of it here.
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::CSPDirectiveList::headerType): Modified to use enum class ContentSecurityPolicyHeaderType.
        (WebCore::CSPDirectiveList::CSPDirectiveList): Ditto.
        (WebCore::CSPDirectiveList::create): Ditto.
        (WebCore::ContentSecurityPolicy::responseHeaders): Creates and returns a ContentSecurityPolicyResponseHeaders
        object with the parsed CSP policy headers.
        (WebCore::ContentSecurityPolicy::didReceiveHeaders): Processed the CSP policy headers represented by the
        specified ContentSecurityPolicyResponseHeaders object.
        (WebCore::ContentSecurityPolicy::deprecatedHeader): Deleted.
        (WebCore::ContentSecurityPolicy::deprecatedHeaderType): Deleted.
        * page/csp/ContentSecurityPolicy.h: Defines a class that represents a collection of CSP policy headers.
        This class has two purposes:
            - It extracts the CSP policy headers from a HTTP response (ResourceResponse object). We make use of
            this functionality in both FrameLoader::didBeginDocument() and Worker::didReceiveResponse().
            - It serves as a memento that externalizes the internal CSP policy details of an instance of
            ContentSecurityPolicy. We make use of this memento functionality to support inheriting the
            CSP policy of the worker's owner document in a thread-safe manner. You can create and restore
            a memento using ContentSecurityPolicy::responseHeaders() and ContentSecurityPolicy::didReceiveHeaders(), respectively.
        * page/csp/ContentSecurityPolicyResponseHeaders.cpp: Added.
        (WebCore::ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders): Extracts the
        CSP HTTP headers from a ResourceResponse object.
        (WebCore::ContentSecurityPolicyResponseHeaders::isolatedCopy): Make a copy of this object that is
        safe to pass to another thread.
        * page/csp/ContentSecurityPolicyResponseHeaders.h: Added.
        * workers/DedicatedWorkerGlobalScope.cpp:
        (WebCore::DedicatedWorkerGlobalScope::create): Modified to use class ContentSecurityPolicyResponseHeaders.
        * workers/DedicatedWorkerGlobalScope.h:
        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::create): Ditto.
        (WebCore::DedicatedWorkerThread::DedicatedWorkerThread): Ditto.
        (WebCore::DedicatedWorkerThread::createWorkerGlobalScope): Ditto.
        * workers/DedicatedWorkerThread.h:
        * workers/Worker.cpp:
        (WebCore::Worker::didReceiveResponse): Create a ContentSecurityPolicyResponseHeaders if the origin of
        the worker's script is capable of providing a CSP. Otherwise, we will inherit the CSP of the worker's owner
        document in Worker::notifyFinished().
        (WebCore::Worker::notifyFinished): Pass the appropriate CSP response headers to WorkerMessagingProxy::startWorkerGlobalScope().
        * workers/Worker.h:
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::applyContentSecurityPolicyResponseHeaders): Renamed; formerly named applyContentSecurityPolicyFromString().
        Modified to take a ContentSecurityPolicyResponseHeaders and apply it to the ContentSecurityPolicy object associated with the worker.
        (WebCore::WorkerGlobalScope::applyContentSecurityPolicyFromString): Deleted.
        * workers/WorkerGlobalScope.h:
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::startWorkerGlobalScope): Pass the worker's ContentSecurityPolicyResponseHeaders object.
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData): Added field m_contentSecurityPolicyResponseHeaders to store
        the CSP response headers to be applied to the worker's ContentSecurityPolicy object.
        (WebCore::WorkerThread::WorkerThread): Modified to use ContentSecurityPolicyResponseHeaders.
        (WebCore::WorkerThread::workerThread): Pass the ContentSecurityPolicyResponseHeaders object from the start up data struct
        to DedicatedWorkerThread::createWorkerGlobalScope().
        * workers/WorkerThread.h:

2016-01-31  Darin Adler  <darin@apple.com>

        Get rid of most calls to String::upper; mostly replace them with convertToASCIIUppercase
        https://bugs.webkit.org/show_bug.cgi?id=153715

        Reviewed by Gyuyoung Kim.

        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::computedAttributesForElement): Use convertToASCIILowercase to fold
        ASCII case when searching for fonts by name.

        * platform/network/cf/ResourceResponseCFNet.cpp:
        (WebCore::ResourceResponse::platformLazyInit): Use convertToASCIIUppercase to make
        the HTTP version string canonical. Not sure why it's needed at all, but the letters
        we might be uppercasing are "HTTP", so no need to handle non-ASCII.
        * platform/network/cocoa/ResourceResponseCocoa.mm:
        (WebCore::ResourceResponse::platformLazyInit): Ditto.

        * rendering/svg/SVGRenderTreeAsText.cpp:
        (WebCore::operator<<): Use convertToASCIIUppercase when writing the spread
        method type into a text stream. The method types are all ASCII.

2016-01-31  Dan Bernstein  <mitz@apple.com>

        [Cocoa] Remove __has_include guards around use of WebKitAdditions
        https://bugs.webkit.org/show_bug.cgi?id=153728

        Reviewed by Andy Estes.

        Guard WebKitAdditions includes with #if USE(APPLE_INTERNAL_SDK) rather than with __has_include.

        * dom/EventNames.h:
        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * page/MainFrame.cpp:
        (WebCore::MainFrame::MainFrame):
        * page/MainFrame.h:
        * page/PageConfiguration.h:
        * platform/cocoa/WebKitAdditions.mm:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        * platform/ios/LegacyTileGridTile.mm:

2016-01-31  Darin Adler  <darin@apple.com>

        Replace CaseFoldingHash with ASCIICaseInsensitiveHash
        https://bugs.webkit.org/show_bug.cgi?id=153639

        Reviewed by Filip Pizlo.

        * Modules/webdatabase/DatabaseAuthorizer.h: Use ASCIICaseInsensitiveHash
        for whitelisted functions. Function names are all ASCII.

        * accessibility/AccessibilityObject.cpp: Use ASCIICaseInsensitiveHash
        for ARIA roles. ARIA roles are all ASCII.

        * crypto/CryptoAlgorithmRegistry.h: Use ASCIICaseInsensitiveHash for
        crypto algorithm names. Algorithm names are all ASCII.

        * css/CSSFontSelector.cpp:
        (WebCore::registerLocalFontFacesForFamily): Use ASCIICaseInsensitiveHash
        for font faces. Face names should use ASCII case insensitive matching;
        there is no need for non-ASCII case folding.
        * css/CSSFontSelector.h: Ditto.

        * dom/DOMImplementation.cpp: Use ASCIICaseInsensitiveHash for the
        FeatureSet. The features are all ASCII.

        * dom/Document.h: Use ASCIICaseInsensitiveHash for the access key
        map. Access keys are all ASCII.

        * dom/ScriptElement.cpp:
        (WebCore::isLegacySupportedJavaScriptLanguage): Use ASCIICaseInsensitiveHash
        for the language set. These strings are all ASCII.

        * editing/EditorCommand.cpp: Use ASCIICaseInsensitiveHash for editor
        command names. These names are all ASCII.

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::parametersForPlugin): Use ASCIICaseInsensitiveHash
        for parameter names. These names are all ASCII.

        * html/InputType.cpp: Use ASCIICaseInsensitiveHash for the input types.
        The input types are all ASCII.

        * loader/CrossOriginAccessControl.h: Use ASCIICaseInsensitiveHash for
        HTTP header field names. These names are all ASCII.
        * loader/CrossOriginPreflightResultCache.h: Ditto.

        * loader/archive/ArchiveFactory.cpp: Use ASCIICaseInsensitiveHash for
        MIME types. MIME types are all ASCII.
        * platform/MIMETypeRegistry.cpp:
        (WebCore::initializeSupportedImageMIMETypes): Ditto.

        * platform/SchemeRegistry.h: Use ASCIICaseInsensitiveHas for URL schemes.
        URL schemes are all ASCII.
        * platform/URL.cpp: Ditto.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontPlatformDataCacheKey::operator==): Use ASCIICaseInsensitiveHash.
        (WebCore::FontPlatformDataCacheKeyHash::hash): Use ASCIICaseInsensitiveHash.

        * platform/graphics/FontCascade.cpp:
        (WebCore::keysMatch): Rename from operator== since this operation is not
        equality. Changed to equalIgnoringASCIICase and did a little streamlining.
        (WebCore::makeFontCascadeCacheKey): Use reserveInitialCapacity for slightly
        better memory use.
        (WebCore::computeFontCascadeCacheHash): Use IntegerHasher to make computing
        a hash more efficient by eliminating the overhead of building a vector and
        even possible heap allocation and deallocation.
        (WebCore::retrieveOrAddCachedFonts): Use keysMatch instead of ==.

        * platform/graphics/cocoa/FontCacheCoreText.cpp: Use ASCIICaseInsensitiveHash
        for font family names. These names should use ASCII case insensitive matching;
        there is no need for non-ASCII case folding.

        * platform/network/HTTPHeaderMap.h: Use ASCIICaseInsensitiveHash for
        HTTP header field names. These names are all ASCII.

        * rendering/style/RenderStyle.cpp:
        (WebCore::computeFontHash): Use IntegerHasher to avoid allocating memory just
        to compute a hash. Use ASCIICaseInsensitiveHash.

2016-01-31  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce PassRefPtr uses in dom - 5
        https://bugs.webkit.org/show_bug.cgi?id=153470

        Reviewed by Darin Adler.

        As a step to remove PassRefPtr, this patch reduces uses of PassRefPtr in WebCore/dom. 

        * dom/Document.cpp:
        (WebCore::Document::adoptNode):
        (WebCore::Document::implicitClose):
        (WebCore::Document::enqueuePopstateEvent):
        (WebCore::Document::setInputCursor):
        * dom/Document.h:
        * dom/DocumentMarker.cpp:
        (WebCore::DocumentMarkerTextMatch::instanceFor):
        * dom/Event.cpp:
        (WebCore::Event::setUnderlyingEvent):
        * dom/Event.h:
        * dom/EventDispatcher.h:
        * dom/GenericEventQueue.cpp:
        (WebCore::GenericEventQueue::enqueueEvent):
        * dom/GenericEventQueue.h:
        * dom/MouseEvent.cpp:
        (WebCore::SimulatedMouseEvent::SimulatedMouseEvent):
        * dom/Node.cpp:
        (WebCore::Node::dispatchDOMActivateEvent):
        * dom/NodeIterator.h:
        * dom/PendingScript.h:
        * dom/PopStateEvent.cpp:
        (WebCore::PopStateEvent::create):
        * dom/PopStateEvent.h:
        * dom/ProcessingInstruction.cpp:
        (WebCore::ProcessingInstruction::setCSSStyleSheet): Deleted. Nobody calls this function.
        * dom/ProcessingInstruction.h:
        * dom/RangeBoundaryPoint.h:
        (WebCore::RangeBoundaryPoint::RangeBoundaryPoint):
        * dom/TextEvent.cpp:
        (WebCore::TextEvent::createForFragmentPaste):
        (WebCore::TextEvent::TextEvent):
        * dom/TextEvent.h:
        * editing/Editor.cpp:
        (WebCore::Editor::pasteAsFragment):
        * editing/Editor.h:
        * editing/mac/EditorMac.mm:
        (WebCore::Editor::replaceNodeFromPasteboard):

2016-01-31  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Use std::make_unique<> when creating an unique_ptr object.
        https://bugs.webkit.org/show_bug.cgi?id=153705

        Reviewed by Darin Adler.

        Some factory functions have used std::unique_ptr<> for creating an unique_ptr object.
        It is wrong. We have to use std::make_unique<>.

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::mockPicker):
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::internalStart):
        * platform/cf/RunLoopObserver.cpp:
        (WebCore::RunLoopObserver::create): Deleted.
        * platform/cf/RunLoopObserver.h:
        (WebCore::RunLoopObserver::RunLoopObserver):
        * platform/graphics/avfoundation/WebMediaSessionManagerMac.cpp:
        (WebCore::WebMediaSessionManagerMac::platformPicker):
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.h:
        * platform/graphics/avfoundation/objc/MediaPlaybackTargetPickerMac.mm:
        (WebCore::MediaPlaybackTargetPickerMac::create): Deleted.
        * platform/graphics/ca/cocoa/LayerFlushSchedulerMac.cpp:
        (WebCore::LayerFlushScheduler::LayerFlushScheduler):
        * platform/mock/MediaPlaybackTargetPickerMock.cpp:
        (WebCore::MediaPlaybackTargetPickerMock::create): Deleted.
        * platform/mock/MediaPlaybackTargetPickerMock.h:
        * rendering/FloatingObjects.cpp:
        (WebCore::FloatingObject::copyToNewContainer):

2016-01-30  Michael Catanzaro  <mcatanzaro@igalia.com>

        Unreviewed, fix GTK debug build after r195899

        * dom/EventContext.h:
        (isType):

2016-01-30  Jeremy Huddleston Sequoia  <jeremyhu@apple.com>

        Add missing include to fix building debug configuration
        https://bugs.webkit.org/show_bug.cgi?id=153719

        Reviewed by Darin Adler.

        No new tests.

        * rendering/RenderObject.cpp:

2016-01-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195911.
        https://bugs.webkit.org/show_bug.cgi?id=153723

        Caused frequent assertion failures on bots (Requested by ap on
        #webkit).

        Reverted changeset:

        "Replace CaseFoldingHash with ASCIICaseInsensitiveHash"
        https://bugs.webkit.org/show_bug.cgi?id=153639
        http://trac.webkit.org/changeset/195911

2016-01-30  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195799 and r195828.
        https://bugs.webkit.org/show_bug.cgi?id=153722

        Caused assertion failures, severely affecting EWS (Requested
        by ap on #webkit).

        Reverted changesets:

        "Web Inspector: InspectorTimelineAgent doesn't need to
        recompile functions because it now uses the sampling profiler"
        https://bugs.webkit.org/show_bug.cgi?id=153500
        http://trac.webkit.org/changeset/195799

        "Attempt to fix the Windows build after r195799"
        http://trac.webkit.org/changeset/195828

2016-01-30  Brady Eidson  <beidson@apple.com>

        Modern IDB: Some tests crash with specific odd database names.
        https://bugs.webkit.org/show_bug.cgi?id=153688

        Reviewed by Darin Adler.

        No new tests (2 existing tests now pass).

        * platform/FileSystem.cpp:
        (WebCore::shouldEscapeUChar): Return true for some surrogate-pair situations.
        (WebCore::encodeForFileName): Pass along the previous and next characters, as well,
          and do a two byte escaping for some characters.

2016-01-30  Eric Carlson  <eric.carlson@apple.com>

        More than one audio and/or text track sometimes selected in media controls menu
        https://bugs.webkit.org/show_bug.cgi?id=153664

        Use an <img> element for the track menu item checkmark instead of a background image and
        the ::before selector.

        Reviewed by Jer Noble.

        Test: media/controls/track-menu.html

        * Modules/mediacontrols/mediaControlsApple.css:
        (audio::-webkit-media-controls-closed-captions-container li:hover):
        (audio::-webkit-media-controls-closed-captions-container li .checkmark-container):
        (audio::-webkit-media-controls-closed-captions-container li.selected .checkmark-container):
        (audio::-webkit-media-controls-closed-captions-container li.selected:hover .checkmark-container):
        (audio::-webkit-media-controls-closed-captions-container li.selected::before): Deleted.
        (audio::-webkit-media-controls-closed-captions-container li.selected:hover::before): Deleted.
        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.buildCaptionMenu):
        (Controller.prototype.):
        (Controller.prototype.getCurrentControlsStatus):

2016-01-30  Darin Adler  <darin@apple.com>

        Replace CaseFoldingHash with ASCIICaseInsensitiveHash
        https://bugs.webkit.org/show_bug.cgi?id=153639

        Reviewed by Filip Pizlo.

        * Modules/webdatabase/DatabaseAuthorizer.h: Use ASCIICaseInsensitiveHash
        for whitelisted functions. Function names are all ASCII.

        * accessibility/AccessibilityObject.cpp: Use ASCIICaseInsensitiveHash
        for ARIA roles. ARIA roles are all ASCII.

        * crypto/CryptoAlgorithmRegistry.h: Use ASCIICaseInsensitiveHash for
        crypto algorithm names. Algorithm names are all ASCII.

        * css/CSSFontSelector.cpp:
        (WebCore::registerLocalFontFacesForFamily): Use ASCIICaseInsensitiveHash
        for font faces. Face names should use ASCII case insensitive matching;
        there is no need for non-ASCII case folding.
        * css/CSSFontSelector.h: Ditto.

        * dom/DOMImplementation.cpp: Use ASCIICaseInsensitiveHash for the
        FeatureSet. The features are all ASCII.

        * dom/Document.h: Use ASCIICaseInsensitiveHash for the access key
        map. Access keys are all ASCII.

        * dom/ScriptElement.cpp:
        (WebCore::isLegacySupportedJavaScriptLanguage): Use ASCIICaseInsensitiveHash
        for the language set. These strings are all ASCII.

        * editing/EditorCommand.cpp: Use ASCIICaseInsensitiveHash for editor
        command names. These names are all ASCII.

        * html/HTMLObjectElement.cpp:
        (WebCore::HTMLObjectElement::parametersForPlugin): Use ASCIICaseInsensitiveHash
        for parameter names. These names are all ASCII.

        * html/InputType.cpp: Use ASCIICaseInsensitiveHash for the input types.
        The input types are all ASCII.

        * loader/CrossOriginAccessControl.h: Use ASCIICaseInsensitiveHash for
        HTTP header field names. These names are all ASCII.
        * loader/CrossOriginPreflightResultCache.h: Ditto.

        * loader/archive/ArchiveFactory.cpp: Use ASCIICaseInsensitiveHash for
        MIME types. MIME types are all ASCII.
        * platform/MIMETypeRegistry.cpp:
        (WebCore::initializeSupportedImageMIMETypes): Ditto.

        * platform/SchemeRegistry.h: Use ASCIICaseInsensitiveHas for URL schemes.
        URL schemes are all ASCII.
        * platform/URL.cpp: Ditto.

        * platform/graphics/FontCache.cpp: Reworked FontPlatformDataCacheKey struct:
        Made it a conventional struct with non-prefixed data members names. Removed
        the "==" operator since it was appropriate for hash table lookup but wasn't
        a true equality operator. Tightened the implementations of the constructors.
        (WebCore::FontPlatformDataCacheKeyHash::hash): Use ASCIICaseInsensitiveHash.
        (WebCore::FontPlatformDataCacheKeyHash::equal): Do the equality check here,
        not using the == operator. And use equalIgnoringASCIICase.
        (WebCore::FontPlatformDataCacheKeyTraits::isEmptyValue): Added this entire
        traits struct so we check empty values in a more efficient way.
        (WebCore::FontCache::getCachedFontPlatformData): Added comments and tweaked
        style in this function.

        * platform/graphics/FontCascade.cpp:
        (WebCore::keysMatch): Rename from operator== since this operation is not
        equality. Changed to equalIgnoringASCIICase and did a little streamlining.
        (WebCore::makeFontCascadeCacheKey): Use reserveInitialCapacity for slightly
        better memory use.
        (WebCore::computeFontCascadeCacheHash): Use IntegerHasher to make computing
        a hash more efficient by eliminating the overhead of building a vector and
        even possible heap allocation and deallocation.
        (WebCore::retrieveOrAddCachedFonts): Use keysMatch instead of ==.

        * platform/graphics/cocoa/FontCacheCoreText.cpp: Use ASCIICaseInsensitiveHash
        for font family names. These names should use ASCII case insensitive matching;
        there is no need for non-ASCII case folding.

        * platform/network/HTTPHeaderMap.h: Use ASCIICaseInsensitiveHash for
        HTTP header field names. These names are all ASCII.

        * rendering/style/RenderStyle.cpp:
        (WebCore::computeFontHash): Use IntegerHasher to avoid allocating memory just
        to compute a hash. Use ASCIICaseInsensitiveHash.

2016-01-30  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rolling out r195871.

        Caused several layout tests to time out

        Reverted changeset:

        "Tab suspension code shouldn't use page cache cacheability
        logic"
        https://bugs.webkit.org/show_bug.cgi?id=153680
        http://trac.webkit.org/changeset/195871

2016-01-30  Chris Dumez  <cdumez@apple.com>

        Unreviewed, rebaseline bindings tests after r195904.

        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::JSTestCustomNamedGetter::getOwnPropertySlot):
        (WebCore::jsTestCustomNamedGetterConstructor):
        (WebCore::setJSTestCustomNamedGetterConstructor):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::JSTestEventTarget::getOwnPropertySlot):
        (WebCore::jsTestEventTargetConstructor):
        (WebCore::setJSTestEventTargetConstructor):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::JSTestOverrideBuiltins::getOwnPropertySlot):
        (WebCore::jsTestOverrideBuiltinsConstructor):
        (WebCore::setJSTestOverrideBuiltinsConstructor):

2016-01-30  Chris Dumez  <cdumez@apple.com>

        [JS Bindings] prototype.constructor should be writable
        https://bugs.webkit.org/show_bug.cgi?id=149412
        <rdar://problem/22545096>

        Reviewed by Darin Adler.

        prototype.constructor should have the following properties:
        { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }

        as per the Web IDL specification:
        https://heycam.github.io/webidl/#interface-prototype-object

        In WebKit, it is currently not writable. It is writable in Firefox.

        This patch was first landed in r190085 but was rolled out for causing
        crashes: <rdar://problem/22825602>. The issue was that even though we
        marked constructor as writable, we failed to generate a setter for it.
        This patch addresses the issue and the crash in <rdar://problem/22825602>
        no longer occurs after this change. A regression test is also added for
        this crash.

        Tests:
        fast/dom/HTMLDocument/constructor-setter-crash.html
        fast/dom/prototype-constructor-setter.html

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateAttributesHashTable):
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
        (WebCore::setJSTestActiveDOMObjectConstructor):
        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
        (WebCore::setJSTestClassWithJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
        (WebCore::setJSTestCustomConstructorWithNoInterfaceObjectConstructor):
        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
        (WebCore::setJSTestCustomNamedGetterConstructor):
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        (WebCore::setJSTestEventConstructorConstructor):
        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
        (WebCore::setJSTestEventTargetConstructor):
        * bindings/scripts/test/JS/JSTestException.cpp:
        (WebCore::setJSTestExceptionConstructor):
        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
        (WebCore::setJSTestGenerateIsReachableConstructor):
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        (WebCore::setJSTestInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
        (WebCore::setJSTestJSBuiltinConstructorConstructor):
        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
        (WebCore::setJSTestMediaQueryListListenerConstructor):
        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
        (WebCore::setJSTestNamedConstructorConstructor):
        * bindings/scripts/test/JS/JSTestNode.cpp:
        (WebCore::setJSTestNodeConstructor):
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        (WebCore::setJSTestNondeterministicConstructor):
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::setJSTestObjConstructor):
        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
        (WebCore::setJSTestOverloadedConstructorsConstructor):
        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
        (WebCore::setJSTestOverrideBuiltinsConstructor):
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        (WebCore::setJSTestSerializedScriptValueInterfaceConstructor):
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        (WebCore::setJSTestTypedefsConstructor):
        * bindings/scripts/test/JS/JSattribute.cpp:
        (WebCore::setJSattributeConstructor):
        * bindings/scripts/test/JS/JSreadonly.cpp:
        (WebCore::setJSreadonlyConstructor):
        * page/DOMWindow.idl:

2016-01-30  Chris Dumez  <cdumez@apple.com>

        Move more 'constructor' properties to the prototype
        https://bugs.webkit.org/show_bug.cgi?id=153667

        Reviewed by Darin Adler.

        Move more 'constructor' properties to the prototype. In particular, we
        used to keep the 'constructor' on the instance for interfaces that have
        an indexed / named property getter because our getOwnPropertySlot()
        implementation used to be wrong for such interfaces.

        However, getOwnPropertySlot() should be correct after r188590 so we
        should now be able to move the 'constructor' up to the prototype for
        these interfaces, as per the specification:
        http://heycam.github.io/webidl/#interface-prototype-object

        No new tests, already covered by existing tests.

        * bindings/js/JSPluginElementFunctions.h:
        (WebCore::pluginElementCustomGetOwnPropertySlot):
        Add a null check for staticPropHashTable. It is now null because this
        type no longer has any property on the instance now that 'constructor'
        is on the prototype.

        * bindings/scripts/CodeGeneratorJS.pm:
        (ConstructorShouldBeOnInstance):

2016-01-29  Ada Chan  <adachan@apple.com>

        Enable VIDEO_PRESENTATION_MODE only in Debug and Release builds on Mac
        https://bugs.webkit.org/show_bug.cgi?id=153665

        Reviewed by Dan Bernstein.

        * Configurations/FeatureDefines.xcconfig:

2016-01-30  David Kilzer  <ddkilzer@apple.com>

        [iOS] WebKit1 apps crash in ___ZN7WebCore16DiskCacheMonitorC2ERKNS_15ResourceRequestENS_9SessionIDEPK20_CFCachedURLResponse_block_invoke1
        <http://webkit.org/b/153710>
        <rdar://problem/23116706>

        Reviewed by Darin Adler.

        * loader/cocoa/DiskCacheMonitorCocoa.mm:
        (WebCore::DiskCacheMonitor::DiskCacheMonitor):
        - Fix race condition on iOS WebKit1 clients by calling the block
          to cancel the DiskCacheMonitor on the WebThread, which is the
          same thread where the CFCachedURLResponseCallBackBlock is
          called.
        - Removed whitespace to adhere to style.

2016-01-30  Ryosuke Niwa  <rniwa@webkit.org>

        TouchList should be retargeted
        https://bugs.webkit.org/show_bug.cgi?id=149592

        Reviewed by Antti Koivisto.

        Retarget touch target's using the same algorithm as the one used for related targets instead of
        EventRelatedNodeResolver which is removed in this patch.

        Also enable the retargeting on iOS.

        Test: fast/shadow-dom/touch-event-ios.html

        * dom/EventContext.cpp:
        (WebCore::TouchEventContext::TouchEventContext):
        (WebCore::TouchEventContext::handleLocalEvents):
        (WebCore::TouchEventContext::checkReachability):
        * dom/EventContext.h:
        (WebCore::toTouchEventContext):
        (WebCore::EventContext::isUnreachableNode):
        * dom/EventDispatcher.cpp:
        (WebCore::EventRelatedNodeResolver): Deleted.
        (WebCore::EventPath::EventPath):
        (WebCore::EventDispatcher::dispatchEvent): 
        (WebCore::addRelatedNodeResolversForTouchList): Deleted.
        (WebCore::EventPath::updateTouchLists): Deleted.
        (WebCore::EventPath::setRelatedTarget): Removed superfluous UNUSED_PARAM since the argument is always used.
        (WebCore::EventPath::retargetTouch): Extracted from updateTouchLists/setRelatedTarget. Clones Touch object
        with the new target for each event context just like related targets.
        (WebCore::EventPath::retargetTouchLists): Renamed from updateTouchLists. Calls retargetTouch on each Touch
        object in each TouchList.
        * dom/TouchEvent.h:

2016-01-30 Dave Hyatt  <hyatt@apple.com>

        Support break-after, break-before and break-inside.
        https://bugs.webkit.org/show_bug.cgi?id=148814

        Reviewed by Dean Jackson.

        New tests added in printing/, fast/multicol/, and fast/regions.

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::convertToPageBreak):
        (WebCore::convertToColumnBreak):
        (WebCore::convertToRegionBreak):
        For backwards compatibility, keep support for all the old properties in
        computed style. This means we have to convert the break-* property values
        into keywords that make sense for the legacy properties. This mainly
        involves mapping "page", "column", "region" to "always" (similar rule for
        the avoid-* versions as well).

        (WebCore::ComputedStyleExtractor::propertyValue):
        Add support for the three new break-* properties.

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        Add support for the new break properties.

        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::operator BreakBetween):
        (WebCore::CSSPrimitiveValue::operator BreakInside):
        Add converters for the new BreakBetween and BreakInside enums. Remove
        the EPageBreak enum, since it is no longer used.

        * css/CSSPropertyNames.in:
        * css/CSSValueKeywords.in:
        Add the new properties and the new values supported by the properties
        to the keywords lists.

        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertFontSynthesis):
        (WebCore::StyleBuilderConverter::convertPageBreakBetween):
        (WebCore::StyleBuilderConverter::convertPageBreakInside):
        (WebCore::StyleBuilderConverter::convertColumnBreakBetween):
        (WebCore::StyleBuilderConverter::convertColumnBreakInside):
        (WebCore::StyleBuilderConverter::convertRegionBreakBetween):
        (WebCore::StyleBuilderConverter::convertRegionBreakInside):
        In order to map the legacy properties into the new break-* values
        we have custom converter functions.

        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintChild):
        (WebCore::RenderBlock::childBoxIsUnsplittableForFragmentation):
        (WebCore::RenderBlock::computeRegionRangeForBoxChild):
        * rendering/RenderBlockFlow.cpp:
        (WebCore::RenderBlockFlow::applyBeforeBreak):
        (WebCore::RenderBlockFlow::applyAfterBreak):
        Patch the block code to check the correct new break-* constants. For
        avoidance, this means checking both the general avoid value and the
        specific value (e.g., avoid-page). In place of "always", we check
        the specific value (e.g., column) and then for page specifically, we
        also treat "left", "right", "recto" and "verso" as "always break" for now.

        * rendering/style/RenderStyle.cpp:
        (WebCore::RenderStyle::changeRequiresLayout):
        Make sure changes to the break properties trigger relayout.

        * rendering/style/RenderStyle.h:
        Add getters and setters for the break-* properties and remove all
        occurrences of the legacy page, column and region values from the RenderStyle.

        * rendering/style/RenderStyleConstants.cpp:
        (WebCore::alwaysPageBreak):
        We have a helper function here for mapping several constant values to "page".

        * rendering/style/RenderStyleConstants.h:
        Definitions of the new BreakBetween and BreakInside enums.

        * rendering/style/StyleMultiColData.cpp:
        (WebCore::StyleMultiColData::StyleMultiColData):
        (WebCore::StyleMultiColData::operator==):
        * rendering/style/StyleMultiColData.h:
        Remove the column-specific break data.

        * rendering/style/StyleRareNonInheritedData.cpp:
        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
        (WebCore::StyleRareNonInheritedData::operator==):
        * rendering/style/StyleRareNonInheritedData.h:
        Remove the region-specific break data and replace it with generic break
        data that is now used by all three pagination models.

2016-01-29  Per Arne Vollan  <peavo@outlook.com>

        [Win] Fix compile error.
        https://bugs.webkit.org/show_bug.cgi?id=153646

        Reviewed by Darin Adler.

        * platform/text/win/LocaleWin.cpp:
        (WebCore::LCIDFromLocaleInternal):

2016-01-29  Antti Koivisto  <antti@apple.com>

        Tab suspension code shouldn't use page cache cacheability logic
        https://bugs.webkit.org/show_bug.cgi?id=153680

        Reviewed by Andreas Kling.

        Most of PageCache::canCache() is unnecessary for tab suspension.

        Also improve robustness.

        * page/Page.cpp:
        (WebCore::Page::setPageActivityState):
        (WebCore::Page::setIsVisible):
        (WebCore::Page::setIsVisibleInternal):
        (WebCore::Page::setIsPrerender):
        (WebCore::Page::canTabSuspend):

            Include visibility test here.

            Instead of calling PageCache::canCache() just check for each frame that
            - that the document is loaded
            - that active DOM objects allow suspension

        (WebCore::Page::setIsTabSuspended):
        (WebCore::Page::setTabSuspensionEnabled):
        (WebCore::Page::updateTabSuspensionState):

            Refactor for robustness.

        (WebCore::Page::tabSuspensionTimerFired):

            Call canTabSuspend, the result might have changed.

        (WebCore::Page::scheduleTabSuspension): Deleted.
        * page/Page.h:

2016-01-29  Ryosuke Niwa  <rniwa@webkit.org>

        fast/shadow-dom/Element-interface-attachShadow.html fails on iOS
        https://bugs.webkit.org/show_bug.cgi?id=153681

        Reviewed by Antti Koivisto.

        The bug was caused by canHaveUserAgentShadowRoot() returning false on a meter element since it's disabled on iOS.
        Override HTMLUnknownElement's canHaveUserAgentShadowRoot to return false for compatbility on iOS.

        * html/HTMLUnknownElement.h:
        (WebCore::HTMLUnknownElement::canHaveUserAgentShadowRoot):

2016-01-29  Brady Eidson  <beidson@apple.com>

        Modern IDB: Getting records for key ranges with null keys aren't properly handled in SQLite backend
        https://bugs.webkit.org/show_bug.cgi?id=153666

        Reviewed by Tim Horton.

        No new tests (Two failing tests now pass).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):

2016-01-29  Simon Fraser  <simon.fraser@apple.com>

        image-rendering: -webkit-optimize-contrast not working for background images
        https://bugs.webkit.org/show_bug.cgi?id=97991

        Reviewed by Darin Adler.
        
        Don't equate "pixelated" and "crisp-edges" values for image-rendering with low
        quality scaling; they should map to InterpolationNone, not InterpolationLow.
        
        To support this change ImageQualityController to return a InterpolationQuality
        from the renamed chooseInterpolationQuality(). If the returned value is not
        InterpolationDefault, set the GraphicsContext image interpolation when drawing
        images and image buffers.
        
        Remove the redundant "useLowQualityScale" from 

        Test: fast/images/image-rendering-interpolation.html

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::paint):
        * html/HTMLCanvasElement.h:
        * page/DragController.cpp:
        (WebCore::DragController::doImageDrag):
        * platform/graphics/GraphicsContext.cpp:
        (WebCore::GraphicsContext::drawImage):
        (WebCore::GraphicsContext::drawTiledImage):
        (WebCore::GraphicsContext::drawImageBuffer):
        (WebCore::GraphicsContext::drawConsumingImageBuffer):
        (WebCore::InterpolationQualityMaintainer::InterpolationQualityMaintainer): Deleted.
        (WebCore::InterpolationQualityMaintainer::~InterpolationQualityMaintainer): Deleted.
        * platform/graphics/GraphicsContext.h:
        (WebCore::ImagePaintingOptions::ImagePaintingOptions):
        (WebCore::ImagePaintingOptions::usesDefaultInterpolation):
        (WebCore::InterpolationQualityMaintainer::InterpolationQualityMaintainer):
        (WebCore::InterpolationQualityMaintainer::~InterpolationQualityMaintainer):
        * platform/graphics/GraphicsTypes.h:
        * platform/graphics/ImageBuffer.h:
        * platform/graphics/cg/ImageBufferCG.cpp:
        (WebCore::ImageBuffer::drawConsuming):
        (WebCore::ImageBuffer::draw):
        * rendering/ImageQualityController.cpp:
        (WebCore::ImageQualityController::interpolationQualityFromStyle):
        (WebCore::ImageQualityController::chooseInterpolationQuality):
        (WebCore::ImageQualityController::ImageQualityController): Deleted.
        (WebCore::ImageQualityController::shouldPaintAtLowQuality): Deleted.
        * rendering/ImageQualityController.h:
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::chooseInterpolationQuality):
        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
        (WebCore::RenderBoxModelObject::shouldPaintAtLowQuality): Deleted.
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderEmbeddedObject.cpp:
        (WebCore::RenderEmbeddedObject::paintSnapshotImage):
        * rendering/RenderHTMLCanvas.cpp:
        (WebCore::RenderHTMLCanvas::paintReplaced):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::paintIntoRect):
        * rendering/RenderSnapshottedPlugIn.cpp:
        (WebCore::RenderSnapshottedPlugIn::paintSnapshot):
        * rendering/style/RenderStyle.h:

2016-01-29  Brady Eidson  <beidson@apple.com>

        Modern IDB: storage/indexeddb/modern/index-3.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=153661

        Reviewed by Tim Horton.

        No new tests (1 failing test now passes, others get closer).

        When indexing a new record fails due to uniqueness constraints, remove all traces of the record.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):

2016-01-29  Brent Fulgham  <bfulgham@apple.com>

        [WebGL] Check vertex array bounds before permitting a glDrawArrays to execute
        https://bugs.webkit.org/show_bug.cgi?id=153643
        <rdar://problem/23424456>

        Reviewed by Dean Jackson.

        Tested by fast/canvas/webgl/webgl-drawarrays-crash.html.

        * html/canvas/WebGLRenderingContextBase.cpp:
        (WebCore::WebGLRenderingContextBase::validateDrawArrays): Make sure that we have at
        least one buffer bound to a program if a drawArray call with a non-zero range of
        requested data is being made.
        (WebCore::WebGLRenderingContextBase::validateDrawElements): Drive-by formatting fix.

2016-01-29  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix logging that overwhelms python with strings of excessive length.
        https://bugs.webkit.org/show_bug.cgi?id=153652

        Reviewed by Tim Horton.

        No new tests (Two skipped tests now pass).

        * Modules/indexeddb/IDBKeyData.cpp:
        (WebCore::IDBKeyData::loggingString): Limit the length of the string.
        
        * Modules/indexeddb/IDBKeyRangeData.cpp:
        (WebCore::IDBKeyRangeData::loggingString): Limit the length of the string.

2016-01-29  Jer Noble  <jer.noble@apple.com>

        Unreviewed Windows build fix; one more ResourceLoaderOptions call site which needs to
        be updated after adding the CachingPolicy parameter.

        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading):

2016-01-29  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK] Implement overlay scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=153405

        Reviewed by Michael Catanzaro.

        Add support for overlay scrollbars to GTK+ platform following the
        same style and behavior than GtkScrolledWindow. They are only
        available for GTK+ >= 3.19, but honoring the GTK_OVERLAY_SCROLLING
        environment variable, so they could be disable at run time, except
        when threaded compositor is enabled. A new ScrollAnimator class
        has been added for GTK+ to implement overlay scrollbars and still
        allow smooth scrolling when available.

        * PlatformGTK.cmake: Add ScrollAnimatorGtk and stop building ScrollAnimatorSmooth.
        * platform/ScrollAnimator.h:
        (WebCore::ScrollAnimator::ScrollAnimator::mouseEnteredContentArea):
        Remove const to allow the ScrollAnimator to be updated.
        (WebCore::ScrollAnimator::ScrollAnimator::mouseExitedContentArea): Ditto.
        (WebCore::ScrollAnimator::ScrollAnimator::mouseMovedInContentArea): Ditto.
        (WebCore::ScrollAnimator::ScrollAnimator::contentAreaDidShow): Ditto.
        (WebCore::ScrollAnimator::ScrollAnimator::contentAreaDidHide): Ditto.
        * platform/Scrollbar.h:
        (WebCore::Scrollbar::opacity): Get scrollbar opacity.
        (WebCore::Scrollbar::setOpacity): Set scrollbar opacity.
        * platform/gtk/ScrollAnimatorGtk.cpp: Added.
        (WebCore::ScrollAnimator::create): Create a ScrollAnimatorGtk.
        (WebCore::ScrollAnimatorGtk::ScrollAnimatorGtk):
        (WebCore::ScrollAnimatorGtk::~ScrollAnimatorGtk):
        (WebCore::ScrollAnimatorGtk::ensureSmoothScrollingAnimation):
        Initialize the ScrollAnimationSmooth if it doesn't exist.
        (WebCore::ScrollAnimatorGtk::scroll): Ensure we have a
        ScrollAnimationSmooth if smooth scrolling is enabled. This also
        fixes the problem of having to reload the page after changing the
        smooth scrolling setting.
        (WebCore::ScrollAnimatorGtk::scrollToOffsetWithoutAnimation):
        (WebCore::ScrollAnimatorGtk::willEndLiveResize):
        (WebCore::ScrollAnimatorGtk::didAddVerticalScrollbar): Register
        the scrollbar if it's an overlay scrollbar and make it visible
        without animating it. Start the hide animation.
        (WebCore::ScrollAnimatorGtk::didAddHorizontalScrollbar): Ditto.
        (WebCore::ScrollAnimatorGtk::willRemoveVerticalScrollbar):
        Unregister the scrollbar if it was registered and resrt the
        animation state if it was the only scrollbar.
        (WebCore::ScrollAnimatorGtk::willRemoveHorizontalScrollbar): Ditto.
        (WebCore::ScrollAnimatorGtk::updateOverlayScrollbarsOpacity): Update
        the scrollbars opacity and invalidate the indicator.
        (WebCore::easeOutCubic):
        (WebCore::ScrollAnimatorGtk::overlayScrollbarAnimationTimerFired):
        Update the scrollbars opacity and schedule a next frame if the
        animation didn't finish or start the hide animation otherwhise.
        (WebCore::ScrollAnimatorGtk::showOverlayScrollbars): Start the
        fade animation to show the scrollbars if needed.
        (WebCore::ScrollAnimatorGtk::hideOverlayScrollbars): Start the
        dafe animation to hide the scrollbars if needed.
        (WebCore::ScrollAnimatorGtk::mouseEnteredContentArea): Call
        showOverlayScrollbars().
        (WebCore::ScrollAnimatorGtk::mouseExitedContentArea): Call
        hideOverlayScrollbars().
        (WebCore::ScrollAnimatorGtk::mouseMovedInContentArea): Call
        showOverlayScrollbars().
        (WebCore::ScrollAnimatorGtk::contentAreaDidShow): Ditto.
        (WebCore::ScrollAnimatorGtk::contentAreaDidHide): Hide the
        scrollbars without animations.
        (WebCore::ScrollAnimatorGtk::notifyContentAreaScrolled): Call
        showOverlayScrollbars().
        (WebCore::ScrollAnimatorGtk::lockOverlayScrollbarStateToHidden):
        Update the lock state and hide or show the scrollbars when locked
        or unlocked.
        * platform/gtk/ScrollAnimatorGtk.h: Added.
        * platform/gtk/ScrollbarThemeGtk.cpp:
        (WebCore::ScrollbarThemeGtk::backButtonRect): Pass
        StyleContextMode to getOrCreateStyleContext depending on the
        painting parameter.
        (WebCore::ScrollbarThemeGtk::forwardButtonRect): Ditto.
        (WebCore::ScrollbarThemeGtk::trackRect): Ditto.
        (WebCore::ScrollbarThemeGtk::getOrCreateStyleContext): Add
        StyleContextMode parameter to add the hovering class
        unconditionally when using overlay scrollbars in layout mode. In
        paint mode we add the hovering clas only when the scrollbar is
        hovered. This way we always claim the size of the scrollbar when
        hovered to be able to show the full scrollbar when the mouse is
        close enough to the indicator.
        (WebCore::ScrollbarThemeGtk::ScrollbarThemeGtk): Initialize
        m_usesOverlayScrollbars.
        (WebCore::ScrollbarThemeGtk::thumbRect): Pass the scrollbar to
        getOrCreateStyleContext().
        (WebCore::adjustRectAccordingToMargin): Fix the top margin.
        (WebCore::ScrollbarThemeGtk::paintTrackBackground): Pass the
        scrollbar and paint mode to getOrCreateStyleContext().
        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground): Ditto.
        (WebCore::ScrollbarThemeGtk::paintThumb): Adjust the thumb
        rectangle when overlay scrollbar is not hovered to its current
        size, since we always claim the size of the scrollbar in hovered
        mode.
        (WebCore::ScrollbarThemeGtk::paintButton): Pass the scrollbar and
        paint mode to getOrCreateStyleContext().
        (WebCore::ScrollbarThemeGtk::paint): Take the scrollbar opacity
        into account when rendering overlay scrollbars as indicators. Also
        get the scrollbar opacity from the GTK+ theme and use a
        transparency group when the global opacity is not full opaque.
        (WebCore::ScrollbarThemeGtk::buttonSize): Pass the scrollbar to
        getOrCreateStyleContext().
        * platform/gtk/ScrollbarThemeGtk.h:
        * platform/mac/ScrollAnimatorMac.h:
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::mouseEnteredContentArea):
        (WebCore::ScrollAnimatorMac::mouseExitedContentArea):
        (WebCore::ScrollAnimatorMac::mouseMovedInContentArea):
        (WebCore::ScrollAnimatorMac::contentAreaDidShow):
        (WebCore::ScrollAnimatorMac::contentAreaDidHide):

2016-01-29  ChangSeok Oh  <changseok.oh@collabora.com>

        [GStreamer] built-in media player doesn't update
        https://bugs.webkit.org/show_bug.cgi?id=151816

        Reviewed by Xabier Rodriguez-Calvar.

        The timeline of audio controls in media document is not properly updated since it is assumed
        that the controls are hidden as soon as playing. However, such full page audio always has
        opacity : 1 declared by video:-webkit-full-page-media::-webkit-media-controls-panel.no-video.
        i.e. it is not actually hidden. We can fix this by simply returning false for no-video media
        in controlsAreHidden();

        Test: media/audio-controls-timeline-in-media-document.html

        * Modules/mediacontrols/mediaControlsBase.js:
        (Controller.prototype.controlsAreAlwaysVisible):
        (Controller.prototype.controlsAreHidden):

2016-01-29  Manuel Rego Casasnovas  <rego@igalia.com>

        [css-grid] Store lines instead of tracks in GridResolvedPosition
        https://bugs.webkit.org/show_bug.cgi?id=153592

        Reviewed by Sergio Villar Senin.

        Due to the new feature that allows to create implicit tracks before the
        explicit ones, we will need to use lines instead of tracks in the
        code to be able to implement it properly.

        This is just a first simple patch using lines instead of tracks in
        GridResolvedPosition. It modifies the code that was using it, as it was
        considering that the resolvedFinalPosition was a track index and
        not a line index.

        So if we've an item positioned like:
          grid-column: 2 / 5;
          grid-row: 1 / span 2;

        Before we were storing this information on the GridSpan:
        * columns:
          * resolvedInitialPosition: 1
          * resolvedFinalPosition:  3
        * rows:
          * resolvedInitialPosition: 0
          * resolvedFinalPosition:  1

        And now we're storing:
        * columns:
          * resolvedInitialPosition: 1
          * resolvedFinalPosition:  4
        * rows:
          * resolvedInitialPosition: 0
          * resolvedFinalPosition:  2

        No new tests, no change of behavior.

        * css/CSSGridTemplateAreasValue.cpp:
        (WebCore::stringForPosition):
        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridTemplateAreasRow):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::createImplicitNamedGridLinesFromGridArea):
        * rendering/RenderGrid.cpp:
        (WebCore::RenderGrid::GridIterator::nextEmptyGridArea):
        (WebCore::RenderGrid::computeUsedBreadthOfGridTracks):
        (WebCore::RenderGrid::ensureGridSize):
        (WebCore::RenderGrid::populateExplicitGridAndOrderIterator):
        (WebCore::RenderGrid::placeAutoMajorAxisItemOnGrid):
        (WebCore::RenderGrid::offsetAndBreadthForPositionedChild):
        (WebCore::RenderGrid::gridAreaBreadthForChildIncludingAlignmentOffsets):
        (WebCore::RenderGrid::columnAxisOffsetForChild):
        (WebCore::RenderGrid::rowAxisOffsetForChild):
        * rendering/RenderGrid.h:
        * rendering/style/GridCoordinate.h:
        (WebCore::GridSpan::GridSpan):
        (WebCore::GridSpan::integerSpan):
        (WebCore::GridSpan::end):
        (WebCore::GridCoordinate::GridCoordinate):
        * rendering/style/GridResolvedPosition.cpp:
        (WebCore::resolveRowStartColumnStartNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveRowEndColumnEndNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveNamedGridLinePositionAgainstOppositePosition):
        (WebCore::resolveGridPositionAgainstOppositePosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromAutoPlacementPosition):
        (WebCore::GridResolvedPosition::resolveGridPositionsFromStyle):
        (WebCore::resolveNamedGridLinePositionFromStyle): Deleted.
        * rendering/style/GridResolvedPosition.h:

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: SQLite backend mismanages key generator values.
        https://bugs.webkit.org/show_bug.cgi?id=153625

        Reviewed by Andy Estes.

        No new tests (Many failing tests pass, a few get closer).

        There's mixed assumptions about whether the value stored is the current value or the next value.

        Fixing those assumptions fixes tests.
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::generateKeyNumber): Store/retrieve the correct value.
        (WebCore::IDBServer::SQLiteIDBBackingStore::revertGeneratedKeyNumber): Ditto.
        (WebCore::IDBServer::SQLiteIDBBackingStore::maybeUpdateKeyGeneratorNumber): Ditto.

2016-01-28  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: InspectorTimelineAgent doesn't need to recompile functions because it now uses the sampling profiler
        https://bugs.webkit.org/show_bug.cgi?id=153500
        <rdar://problem/24352458>

        Reviewed by Timothy Hatcher.

        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::supportsLegacyProfiling):
        (WebCore::JSDOMWindowBase::supportsRichSourceInfo):
        (WebCore::JSDOMWindowBase::supportsProfiling): Deleted.
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::supportsLegacyProfiling):
        (WebCore::JSWorkerGlobalScopeBase::supportsProfiling): Deleted.
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * inspector/InspectorController.h:
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::legacyProfilerEnabled):
        (WebCore::InspectorController::setLegacyProfilerEnabled):
        Be more explicit about enabling legacy profiling.

        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::willDestroyFrontendAndBackend):
        (WebCore::InspectorTimelineAgent::didCreateFrontendAndBackend): Deleted.
        TimelineAgent doesn't need to recompile if using the sampling profiler.
        This breaks console.profile, but console.profile should move to using
        the sampling profiler as well.

        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        (WebCore::startProfiling): Deleted.
        (WebCore::stopProfiling): Deleted.
        Inlined the use once static functions.

        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::profile):
        (WebCore::PageConsoleClient::profileEnd):
        Added FIXMEs for improving console.profile and profileEnd.

        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState):
        (WebCore::Internals::setLegacyJavaScriptProfilingEnabled):
        (WebCore::Internals::setJavaScriptProfilingEnabled): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:
        Be more explicit about enabling legacy profiling.

2016-01-28  Chris Dumez  <cdumez@apple.com>

        Move attributes to the prototype for List types / and types with indexed/named property getters
        https://bugs.webkit.org/show_bug.cgi?id=153599

        Reviewed by Darin Adler.

        Move attributes to the prototype for List types / and types with indexed/named property getters.

        We used to keep them on the instance because:
        1. Our GetOwnProperty lookup used to be in incorrect order for interfaces with indexed/named property getters.
        -> This was fixed recently and we now match the specification and other browsers.
        2. This used to regress performance when iterating over those list types
        -> Local testing seems to show that this is no longer a regression (tested Speedometer and various related Bindings PerformanceTests).

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (InterfaceRequiresAttributesOnInstance): Deleted.
        (AttributeShouldBeOnInstanceForCompatibility): Deleted.

2016-01-28  Antti Koivisto  <antti@apple.com>

        Tab suspension code hits asserts
             

        Reviewed by Chris Dumez.

        Enabling tab suspension and navigating around in a few tabs hits an assert in
        ScriptExecutionContext::suspendActiveDOMObject. This is because suspend/resume reasons don't pair properly

        * dom/Document.cpp:
        (WebCore::Document::documentWillBecomeInactive):
        (WebCore::Document::suspend):
        (WebCore::Document::resume):

            Provide the reason as argument.

        * dom/Document.h:
        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore):

            No need to call resumeActiveDOMObjects/resumeScriptedAnimationControllerCallbacks explicitly as Document::resume does that.

        (WebCore::CachedFrame::CachedFrame):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):
        * page/Page.cpp:
        (WebCore::Page::canTabSuspend):
        (WebCore::Page::setIsTabSuspended):

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix several more problems with object store changes during cursor iteration in SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153616

        Reviewed by Alex Christensen.

        No new tests (A few failing tests pass, a few get closer).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::clearObjectStore):
        
        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::resetAndRebindStatement):
        (WebCore::IDBServer::SQLiteIDBCursor::bindArguments):
        
        * Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
        (WebCore::IDBServer::UniqueIDBDatabaseTransaction::iterateCursor):

2016-01-28  Daniel Bates  <dabates@apple.com>

        Cleanup: Make DedicatedWorkerThread::create() an inline template method
        https://bugs.webkit.org/show_bug.cgi?id=153612

        Reviewed by Andy Estes.

        Make use of variadic template arguments and std::forward() to forward the arguments passed
        from DedicatedWorkerThread::create() to DedicatedWorkerThread::DedicatedWorkerThread(). This
        removes the need to duplicate code whenever we modify the parameter types or number of
        parameters taken by DedicatedWorkerThread::DedicatedWorkerThread().

        * workers/DedicatedWorkerThread.cpp:
        (WebCore::DedicatedWorkerThread::create): Deleted.
        * workers/DedicatedWorkerThread.h: Reorganized listing of member functions such that we
        group the creation/constructor and destructor functions.
        (WebCore::DedicatedWorkerThread::create): Modified to be an inline template with variadic
        parameters that std::forward()s its arguments to DedicatedWorkerThread::DedicatedWorkerThread().

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: SQLite backend doesn't handle mutation during cursor iteration.
        https://bugs.webkit.org/show_bug.cgi?id=153614

        Reviewed by Alex Christensen.

        No new tests (A few failing tests pass, a few get closer).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange): Call notifyCursorsOfChanges.
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord): Ditto.

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::~SQLiteIDBCursor):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:

        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::maybeOpenBackingStoreCursor): Remember these transient backing 
          store cursors so they can be notified of changes.
        (WebCore::IDBServer::SQLiteIDBTransaction::closeCursor): Handle removing the cursor from the right set.
        (WebCore::IDBServer::SQLiteIDBTransaction::notifyCursorsOfChanges):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: SQLite backend doesn't support deleting ranges with more than one key.
        https://bugs.webkit.org/show_bug.cgi?id=153604

        Reviewed by Andy Estes.

        No new tests (A few failing tests pass, a few get closer).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange):

2016-01-28  Alex Christensen  <achristensen@webkit.org>

        Fix Windows build after r195774.

        * platform/network/ParsedContentRange.cpp:

2016-01-28  Anders Carlsson  <andersca@apple.com>

        Add an ArrayValue::get overload that returns a string
        https://bugs.webkit.org/show_bug.cgi?id=153613

        Reviewed by Tim Horton.

        * bindings/js/ArrayValue.cpp:
        (WebCore::ArrayValue::get):
        * bindings/js/ArrayValue.h:

2016-01-28  Chris Dumez  <cdumez@apple.com>

        EventHandler IDL attributes should be enumerable
        https://bugs.webkit.org/show_bug.cgi?id=153595

        Reviewed by Sam Weinig.

        Most of our EventHandler IDL attributes were marked as [NotEnumerable]
        but should not have been according to the specification:
        - https://html.spec.whatwg.org/#globaleventhandlers
        - https://html.spec.whatwg.org/#windoweventhandlers

        Firefox and Chrome behave according to the specification.
        This patch aligns our behavior.

        No new tests, already covered by existing tests.

        * dom/Document.idl:
        * dom/GlobalEventHandlers.idl:
        * page/WindowEventHandlers.idl:

2016-01-28  Jer Noble  <jer.noble@apple.com>

        Windows build fix; PRId64 formatting macro for int64_t undefined, so provide Windows-specific alternative.

        * platform/network/ParsedContentRange.cpp:

2016-01-28  ChangSeok Oh  <changseok.oh@collabora.com>

        [ThreadedCompositor] Fix flickers happening on video when entering/leaving fullscreen.
        https://bugs.webkit.org/show_bug.cgi?id=153585

        Reviewed by Michael Catanzaro.

        Video thumbnail flickers where threaded compositor is enabled. This is because
        a content buffer is not set to a target layer which changes before swapBuffer.
        This is a very rare case though, it happens where video size changes many times in a short period.

        * platform/graphics/texmap/TextureMapperPlatformLayerProxy.cpp:
        (WebCore::TextureMapperPlatformLayerProxy::activateOnCompositingThread):

2016-01-27  Jer Noble  <jer.noble@apple.com>

        Allow CachedResourceLoader clients to opt out of the MemoryCache.
        https://bugs.webkit.org/show_bug.cgi?id=153549

        Reviewed by Darin Adler.

        Add a flag to ResourceLoaderOptions which allow loader clients to opt out of having
        resources stored in the MemoryCache. 

        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
        (WebCore::ResourceLoaderOptions::cachingPolicy):

        Existing clients will have to add the (default) AllowCaching flag when they create a
        ResourceLoaderOptions object.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource):
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::start):
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader):
        (WebCore::ResourceLoaderOptions::setCachingPolicy):
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading):
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading):

        Every time the CachedResource or CachedResourceLoader accesses the MemoryCache, check
        to see whether the resource or the request have allowed caching before adding resources
        to, removing resources from, or sourcing resource data from the MemoryCache.

        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::~CachedResource):
        (WebCore::CachedResource::failBeforeStarting):
        (WebCore::CachedResource::addClientToSet):
        (WebCore::CachedResource::removeClient):
        (WebCore::CachedResource::setDecodedSize):
        (WebCore::CachedResource::setEncodedSize):
        (WebCore::CachedResource::didAccessDecodedData):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::allowsCaching):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet):
        (WebCore::CachedResourceLoader::requestResource):
        (WebCore::CachedResourceLoader::revalidateResource):
        (WebCore::CachedResourceLoader::loadResource):
        (WebCore::CachedResourceLoader::printPreloadStats):
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions):
        * loader/cache/CachedResourceRequest.h:
        (WebCore::CachedResourceRequest::allowsCaching):

2016-01-28  Enrica Casucci  <enrica@apple.com>

        Should avoid navigation for some data detector urls.
        https://bugs.webkit.org/show_bug.cgi?id=153600

        Reviewed by Tim Horton.

        Adding helper function to decide whether the default action should be performed.

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::shouldCancelDefaultAction):

2016-01-28  Dave Hyatt  <hyatt@apple.com>

        Roll out r194555, as it introduced some bad regressions and was not
        correct.

        * rendering/RenderText.cpp:
        (WebCore::RenderText::computePreferredLogicalWidths):

2016-01-28  Brady Eidson  <beidson@apple.com>

        Modern IDB: Index uniqueness broken in the SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153596

        Reviewed by Alex Christensen.

        No new tests (Many failing tests now pass, others improve).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedHasIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexKey):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateOneIndexForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateAllIndexesForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateIndexesForAddRecord): Deleted.
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

2016-01-08  Jer Noble  <jer.noble@apple.com>

        Custom protocol loading through AVFoundation does not support byte-range requests.
        https://bugs.webkit.org/show_bug.cgi?id=152919
        <rdar://problem/23664657>

        Reviewed by Alex Christensen.

        Tests: http/tests/xmlhttprequest/blob-request-byte-range.html
               TestWebkitAPI/Tests/WebCore/ParsedContentRange.cpp

        When loading data through the AVAssetResourceLoaderDelegateProtocol, AVFoundation will issue
        requests for specific byte-ranges by adding a "Range:" HTTP header to the NSURLRequest it
        passes to the delegate.  WebCore ignores this header, loads the entire resource, and replies
        to the callback with the requested subset of the entire resource.

        For byte-range requests near the end of a resource, this is inefficient, as the entire
        resource up to, and including, the requested range must be loaded before any data can be
        returned. Explicitly handle byte-range requests by creating a CachedResourceRequest with the
        underlying NSURLRequest (which includes the "Range:" header) rather than just the request's
        URL. BlobResourceHandle must be modified to add the "Content-Range:" response header to the
        ResourceResponse. 

        To facilitate both generating and parsing the "Content-Range:" header, add a new
        ParsedContentRange class for use by ResourceResponse and its clients. This class provides
        methods both for parsing a "Content-Range" header value string, and for generating the
        header value from elemental values.

        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading):
        (WebCore::WebCoreAVFResourceLoader::responseReceived):
        (WebCore::WebCoreAVFResourceLoader::fulfillRequestWithResource):
        * platform/network/BlobResourceHandle.cpp:
        (WebCore::BlobResourceHandle::BlobResourceHandle):
        (WebCore::BlobResourceHandle::didGetSize):
        (WebCore::BlobResourceHandle::seek):
        (WebCore::BlobResourceHandle::notifyResponseOnSuccess):
        * platform/network/BlobResourceHandle.h:
        * platform/network/HTTPHeaderNames.in:
        * platform/network/ParsedContentRange.cpp: Added.
        (WebCore::areContentRangeValuesValid):
        (WebCore::parseContentRange):
        (WebCore::ParsedContentRange::ParsedContentRange):
        (WebCore::ParsedContentRange::headerValue):
        * platform/network/ParsedContentRange.h: Added.
        (WebCore::ParsedContentRange::ParsedContentRange):
        (WebCore::ParsedContentRange::isValid):
        (WebCore::ParsedContentRange::firstBytePosition):
        (WebCore::ParsedContentRange::lastBytePosition):
        (WebCore::ParsedContentRange::instanceLength):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::updateHeaderParsedState):
        (WebCore::parseContentRangeInHeader):
        (WebCore::ResourceResponseBase::contentRange):
        * platform/network/ResourceResponseBase.h:
        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:

2016-01-28  Chris Dumez  <cdumez@apple.com>

        Storage interface's attributes / operations should be enumerable
        https://bugs.webkit.org/show_bug.cgi?id=153573

        Reviewed by Darin Adler.

        Storage interface's attributes / operations should be enumerable:
        - https://html.spec.whatwg.org/#the-storage-interface

        Firefox matches the specification.

        No new tests, already covered by existing test.

        * storage/Storage.idl:

2016-01-26  Ada Chan  <adachan@apple.com>

        Get WebVideoFullscreenManager and related classes to also compile for Mac platform
        with video presentation mode support.
        https://bugs.webkit.org/show_bug.cgi?id=153221

        Reviewed by Eric Carlson.

        No new tests, no actual behavior change with a stub implementation of WebVideoFullscreenInterfaceMac.

        * WebCore.xcodeproj/project.pbxproj:
        Add PlatformView.h, WebVideoFullscreenChangeObserver.h, and WebVideoFullscreenInterfaceMac.h.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::mediaPlayerEngineUpdated):
        (WebCore::HTMLMediaElement::shouldOverrideBackgroundPlaybackRestriction):
        * html/HTMLMediaElement.h:
        Enable the code that deals with the video fullscreen layer also for Mac platform with
        video presentation mode support.

        * platform/cocoa/PlatformView.h:
        Header file for declaring the view types for each Cocoa platform.

        * platform/cocoa/WebVideoFullscreenChangeObserver.h:
        (WebCore::WebVideoFullscreenChangeObserver::~WebVideoFullscreenChangeObserver):
        Interface declaration moved from WebVideoFullscreenInterfaceAVKit.h.

        * platform/cocoa/WebVideoFullscreenInterface.h:
        Stop guarding the declaration of WebVideoFullscreenInterface to be iOS specific. It is now
        enabled for iOS and Mac platform with video presentation mode support.

        * platform/cocoa/WebVideoFullscreenModel.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h:
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm:
        Enable also for Mac platform with video presentation mode support.
        (WebVideoFullscreenModelVideoElement::setVideoFullscreenLayer):
        Set the video fullscreen layer's anchor point to (0, 0) since we are not changing the position of
        the video layer on Mac.

        * platform/ios/WebVideoFullscreenControllerAVKit.mm:
        Import WebVideoFullscreenChangeObserver.h now that the interface declaration has been moved to that file.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
        Move the declaration of WebVideoFullscreenChangeObserver to a separate header.
        * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
        Import WebVideoFullscreenChangeObserver.h now that the interface declaration has been moved to that file.

        * platform/mac/WebVideoFullscreenInterfaceMac.h: Added.
        * platform/mac/WebVideoFullscreenInterfaceMac.mm:
        (WebCore::WebVideoFullscreenInterfaceMac::~WebVideoFullscreenInterfaceMac):
        (WebCore::WebVideoFullscreenInterfaceMac::setWebVideoFullscreenModel):
        (WebCore::WebVideoFullscreenInterfaceMac::setWebVideoFullscreenChangeObserver):
        (WebCore::WebVideoFullscreenInterfaceMac::resetMediaState):
        (WebCore::WebVideoFullscreenInterfaceMac::setDuration):
        (WebCore::WebVideoFullscreenInterfaceMac::setCurrentTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setBufferedTime):
        (WebCore::WebVideoFullscreenInterfaceMac::setRate):
        (WebCore::WebVideoFullscreenInterfaceMac::setVideoDimensions):
        (WebCore::WebVideoFullscreenInterfaceMac::setSeekableRanges):
        (WebCore::WebVideoFullscreenInterfaceMac::setCanPlayFastReverse):
        (WebCore::WebVideoFullscreenInterfaceMac::setAudioMediaSelectionOptions):
        (WebCore::WebVideoFullscreenInterfaceMac::setLegibleMediaSelectionOptions):
        (WebCore::WebVideoFullscreenInterfaceMac::setExternalPlayback):
        (WebCore::WebVideoFullscreenInterfaceMac::setWirelessVideoPlaybackDisabled):
        (WebCore::WebVideoFullscreenInterfaceMac::setupFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::enterFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::exitFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::cleanupFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::invalidate):
        (WebCore::WebVideoFullscreenInterfaceMac::requestHideAndExitFullscreen):
        (WebCore::WebVideoFullscreenInterfaceMac::preparedToReturnToInline):
        (WebCore::WebVideoFullscreenInterfaceMac::setMode):
        (WebCore::WebVideoFullscreenInterfaceMac::clearMode):
        (WebCore::WebVideoFullscreenInterfaceMac::mayAutomaticallyShowVideoPictureInPicture):
        (WebCore::WebVideoFullscreenInterfaceMac::applicationDidBecomeActive):
        (WebCore::supportsPictureInPicture):
        Add a stub implementation of WebVideoFullscreenInterfaceMac.

2016-01-28  Nikos Andronikos  <nikos.andronikos-webkit@cisra.canon.com.au>

        [SVG] Add support for 'lighter' operator in feComposite
        https://bugs.webkit.org/show_bug.cgi?id=141376

        Reviewed by Darin Adler.

        Added new cases where needed to support the lighter (aka 'plus')
        Porter Duff operator in SVG Filter Effects.
        https://www.w3.org/TR/filter-effects/#valdef-operator-lighter
        Note that in the specification, no constant was added to the IDL for
        the lighter operator. 

        Test: svg/filters/feCompositeOpaque.html
              svg/dom/script-tests/SVGAnimatedEnumeration-SVGFECompositeElement.js

        * platform/graphics/filters/FEComposite.cpp:
        (WebCore::FEComposite::platformApplySoftware):
          Add case to support lighter.
        (WebCore::operator<<):
          Add case to support lighter for text stream operations.
        * platform/graphics/filters/FEComposite.h:
          Add case for lighter to CompositeOperationType enum.
        * svg/SVGFECompositeElement.h:
        (WebCore::SVGIDLEnumLimits<CompositeOperationType>::highestExposedEnumValue):
          Higest exposed value is arithmetic - do not expose lighter.
        (WebCore::SVGPropertyTraits<CompositeOperationType>::highestEnumValue):
          Highest possible value is now lighter.
        (WebCore::SVGPropertyTraits<CompositeOperationType>::toString):
          Add case to support lighter.
        (WebCore::SVGPropertyTraits<CompositeOperationType>::fromString):
          Add case to support lighter.

2016-01-28  Darin Adler  <darin@apple.com>

        Remove equalIgnoringCase since all callers really wanted equalIgnoringASCIICase
        https://bugs.webkit.org/show_bug.cgi?id=153411

        Reviewed by Ryosuke Niwa.

        Tests: fast/media/media-query-non-ASCII-case-folding.html
               fast/dom/HTMLAnchorElement/anchor-non-ASCII-case-folding.html
               fast/xpath/xpath-non-ASCII-case-folding.html

        No tests included that cover the minor behavior changes in Document::setDomain,
        CSPSource::schemeMatches, CSPSource::hostMatches, OriginAccessEntry::operator==,
        UserContentURLPattern::matches, UserContentURLPattern::matchesHost,
        ContentFilterUnblockHandler::canHandleRequest. Would like to add tests for those
        if possible, but it seems clear all are progressions.

        For background on why this is the right thing to do in almost every case:

        - MIME types are all ASCII and not case sensitive (details in RFC 2045)
          <http://tools.ietf.org/html/rfc2045>
        - case insensitive comparisons in HTML are all "ASCII case-insensitive"
          https://www.w3.org/TR/html/infrastructure.html#ascii-case-insensitive
        - same for CSS

        * Modules/webdatabase/DatabaseAuthorizer.cpp:
        (WebCore::DatabaseAuthorizer::denyBasedOnTableName): Use equalIgnoringASCIICase.
        No change in behavior since the string we are comparing with is always
        "__WebKitDatabaseInfoTable__" in practice.

        * accessibility/AccessibilityNodeObject.cpp:
        (WebCore::siblingWithAriaRole): Changed argument type to take a const char*,
        added some FIXMEs and use equalIgnoringCase. No change in behavior since the
        strings we are comparing with are "menu" and "menuitem".
        (WebCore::AccessibilityNodeObject::menuElementForMenuButton): Updated to pass
        arguments in reverse order.
        (WebCore::AccessibilityNodeObject::menuItemElementForMenu): Ditto.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFontFaceValue): Use equalIgnoringASCIICase.
        No change in behavior because the property names are all ASCII constants.

        * css/CSSParserValues.h: Removed unused equalIgnoringCase function.

        * css/MediaQueryEvaluator.cpp:
        (WebCore::MediaQueryEvaluator::mediaTypeMatch): Use equalIgnoringASCIICase.
        Changes behavior: No non-ASCII case folding when matching media types.
        Covered by new test.
        (WebCore::MediaQueryEvaluator::mediaTypeMatchSpecific): Use equalIgnoringASCIICase.
        No change in behavior since the only string this is ever called with is "print".

        * dom/DataTransfer.cpp:
        (WebCore::DataTransfer::hasFileOfType): Use equalIgnoringASCIICase.
        No change in behavior because local files will not have content types with
        non-ASCII characters in them. In the extremely unlikely case that this is incorrect,
        the change in behavior is a progression.

        * dom/Document.cpp:
        (WebCore::Document::setDomain): Use equalIgnoringASCIICase.
        Changes behavior: Domains considered equal because of non-ASCII case folding
        would get through without an error before, and now will properly throw an exception.

        * dom/Element.cpp:
        (WebCore::isStyleAttribute): Refactored into a helper function. Use
        equalLettersIgnoringASCIICase. No change in behavior.
        (WebCore::Element::synchronizeAttribute): Use isStyleAttribute.

        * dom/TreeScope.cpp:
        (WebCore::TreeScope::findAnchor): Use equalIgnoringASCIICase.
        Changes behavior: Could go to an anchor and it would be considered a match because
        of non-ASCII case folding. Covered by new test.

        * html/HiddenInputType.cpp:
        (WebCore::HiddenInputType::appendFormData): Use equalIgnoringASCIICase.
        No change in behavior: comparing with an ASCII literal.
        * html/canvas/WebGL2RenderingContext.cpp:
        (WebCore::WebGL2RenderingContext::getExtension): Ditto.
        * html/canvas/WebGLRenderingContext.cpp:
        (WebCore::WebGLRenderingContext::getExtension): Ditto.

        * html/parser/CSSPreloadScanner.cpp:
        (WebCore::CSSPreloadScanner::emitRule): Use equalLettersIgnoringASCIICase and
        StringView to avoid needing a special ruleEqualIgnoringCase function.
        No change in behavior.

        * inspector/InspectorNodeFinder.cpp:
        (WebCore::InspectorNodeFinder::matchesElement): Use equalIgnoringASCIICase.
        Changes behavior, but it's an inspector UI thing, not a web behavior thing,
        so I don't think a new regression test is needed.

        * loader/HistoryController.cpp:
        (WebCore::HistoryController::currentItemShouldBeReplaced): Use
        equalIgnoringASCIICase. No change in behavior because we are comparing
        with "about:blank".

        * loader/SubframeLoader.cpp:
        (WebCore::findPluginMIMETypeFromURL): Use equalIgnoringASCIICase.
        No change in behavior unless a plug-in claims an extension with non-ASCII
        characters. I don't think a new regression test is needed.

        * loader/appcache/ApplicationCacheHost.cpp:
        (WebCore::ApplicationCacheHost::shouldLoadResourceFromApplicationCache):
        Use equalIgnoringASCIICase. No change in behavior because both strings are
        protocols from URLs and we don't parse non-ASCII characters into protocol strings;
        non-ASCII are already encoding as punycode.
        * loader/appcache/ManifestParser.cpp:
        (WebCore::parseManifest): Ditto.

        * page/ContentSecurityPolicy.cpp:
        (WebCore::isExperimentalDirectiveName): Added. Used by isDirectiveName.
        Uses equalLettersIgnoringASCIICase. No change in behavior.
        (WebCore::isDirectiveName): Use equalLettersIgnoringASCIICase.
        No change in behavior.
        (WebCore::isSourceListNone): Use equalLettersIgnoringASCIICase. No
        change in behavior.
        (WebCore::CSPSource::schemeMatches): Use equalLettersIgnoringASCIICase
        and equalIgnoringASCIICase. It's all about comparing URL protocols. The
        old code might have done something strange if someone specified a protocol
        with a non-ASCII character in it.
        (WebCore::CSPSource::hostMatches): Use equalIgnoringASCIICase.
        (WebCore::CSPSourceList::parseSource): Use equalLettersIgnoringASCIICase.
        No change in behavior.
        (WebCore::CSPDirectiveList::checkSourceAndReportViolation): Tweaked code
        to do less unnecessary String allocation.
        (WebCore::CSPDirectiveList::parseReflectedXSS): Use
        equalLettersIgnoringASCIICase. No change in behavior.
        (WebCore::CSPDirectiveList::addDirective): Ditto.
        (WebCore::ContentSecurityPolicy::reportUnsupportedDirective): Use
        equalLettersIgnoringASCIICase and remove unneeded global constant strings.
        No change in behavior.
        (WebCore::ContentSecurityPolicy::reportDirectiveAsSourceExpression):
        Tweak code to eliminate unneeded local.
        (WebCore::ContentSecurityPolicy::reportDuplicateDirective): Ditto.
        (WebCore::ContentSecurityPolicy::reportInvalidSourceExpression): Use
        equalLettersIgnoringASCIICase. No change in behavior.

        * page/OriginAccessEntry.h:
        (WebCore::operator==): Use equalLettersIgnoringASCIICase.

        * page/Performance.cpp:
        (WebCore::Performance::webkitGetEntriesByName): Use equalLettersIgnoringASCIICase.
        No change in behavior.

        * page/UserContentURLPattern.cpp:
        (WebCore::UserContentURLPattern::matches): Use equalIgnoringASCIICase to match
        schemes.
        (WebCore::UserContentURLPattern::matchesHost): Use equalIgnoringASCIICase to
        match host names.

        * platform/URL.cpp:
        (WebCore::URL::init): Use equalIgnoringASCIICase, and also use StringView to
        avoid having to allocate a second string just for comparison purposes. Should be
        better for efficiency with no change in behavior.

        * platform/cocoa/ContentFilterUnblockHandlerCocoa.mm:
        (WebCore::ContentFilterUnblockHandler::canHandleRequest): Use equalIgnoringASCIICase
        to compare hosts.

        * platform/efl/PlatformSpeechSynthesisProviderEfl.cpp:
        (WebCore::PlatformSpeechSynthesisProviderEfl::voiceName): Use StringView and
        equalIgnoringASCIICase to compare language tags. No test needed because there are
        no language tags with non-ASCII characters in them.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontPlatformDataCacheKey::operator==): Changed to use the equal
        function from CaseFoldingHash. In a subsequent patch we will change this to be
        ASCIICaseFoldingHash since font names don't need to compare non-ASCII characters
        in a case folding manner, but for now preserve behavior.
        (WebCore::alternateFamilyName): Use equalLettersIgnoringASCIICase to avoid having
        to use a special familyNameEqualIgnoringCase function. This does mean there will
        be a null check and a length check that wasn't there before, but the actual
        comparison function will be tighter. Guessing it will be a wash. Also improved
        the comments and sorted the Windows cases in with the others. No behavior change.

        * platform/graphics/FontCascade.cpp:
        (WebCore::operator==): Changed to use the equal function from CaseFoldingHash.
        Same rationale as above in FontPlatformDataCacheKey.

        * platform/graphics/FontDescription.cpp:
        (WebCore::FontCascadeDescription::familiesEqualForTextAutoSizing): Use
        equalIgnoringASCIICase to compare font family names. Only possible change in
        behavior would be if actual fonts with non-ASCII names but that were specified
        with different case in style sheets. Highly unlikely this exists.

        * platform/graphics/MediaPlayer.cpp:
        (WebCore::MediaPlayer::supportsType): Use equalLettersIgnoringASCIICase.
        No change in behavior.
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::keySystemIsSupported): Ditto.

        * platform/graphics/freetype/FontCacheFreeType.cpp:
        (WebCore::isCommonlyUsedGenericFamily): Added.
        (WebCore::FontCache::createFontPlatformData): Moved code into the
        isCommonlyUsedGenericFamily helper and used equalIgnoringASCIICase.

        * platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
        (WebCore::FontCustomPlatformData::supportsFormat): Use
        equalLettersIgnoringASCIICase. No change in behavior.
        * platform/graphics/win/FontCacheWin.cpp:
        (WebCore::adjustedGDIFontWeight): Ditto.
        (WebCore::FontCache::createFontPlatformData): Ditto.
        * platform/graphics/win/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::supportsFormat): Ditto.
        * platform/graphics/win/FontCustomPlatformDataCairo.cpp:
        (WebCore::FontCustomPlatformData::supportsFormat): Ditto.

        * platform/mac/PlatformSpeechSynthesizerMac.mm:
        (-[WebSpeechSynthesisWrapper speakUtterance:]): Use equalIgnoringASCIICase to
        compare languages. No change in behavior because languages have all-ASCII names.

        * platform/network/CacheValidation.cpp:
        (WebCore::shouldUpdateHeaderAfterRevalidation): Use equalIgnoringASCIICase.
        No change in behavior since it's a fixed list of all ASCII headers.
        * platform/network/curl/ResourceHandleManager.cpp:
        (WebCore::isAppendableHeader): Ditto.

        * platform/network/mac/ResourceHandleMac.mm:
        (WebCore::ResourceHandle::willSendRequest): Use equalIgnoringASCIICase.
        No change in behavior because HTTP methods are all ASCII letters.

        * platform/text/mac/LocaleMac.mm:
        (WebCore::determineLocale): Use equalIgnoringASCIICase. No change in behavior
        because locale languages identifiers are all ASCII.
        * platform/text/win/LocaleWin.cpp:
        (WebCore::LCIDFromLocaleInternal): Ditto.

        * svg/SVGToOTFFontConversion.cpp:
        (WebCore::SVGToOTFFontConverter::appendArabicReplacementSubtable):
        Use equalIgnoringASCIICase. No change in behavior because Arabic form attribute
        values are all ASCII.

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::uppercaseKnownHTTPMethod): Use equalIgnoringASCIICase.
        No change in behavior because these are all fixed known ASCII HTTP method names.

        * xml/XPathFunctions.cpp:
        (WebCore::XPath::FunLang::evaluate): Use equalIgnoringASCIICase. Changes behavior
        if specifying a non-ASCII character. Covered by new test.

        * xml/XPathStep.cpp:
        (WebCore::XPath::nodeMatchesBasicTest): Use equalIgnoringASCIICase. Changes
        behavior if an element local name or XPath predicate has a non-ASCII character.
        Covered by new test.

2016-01-28  Zalan Bujtas  <zalan@apple.com>

        Unexpected content wrapping at http://email.osh.com/H/2/v100000152474feb8ec7c1a1f4bbe5c7c0/HTML
        https://bugs.webkit.org/show_bug.cgi?id=153430

        Reviewed by Simon Fraser.

        Ensure that min/max preferred and computed widths never shrink while converting LayoutUnit to float and back.

        Test: fast/table/fixed-size-table-with-fixed-size-content.html

        * rendering/AutoTableLayout.cpp:
        (WebCore::AutoTableLayout::recalcColumn):
        (WebCore::AutoTableLayout::calcEffectiveLogicalWidth):
        (WebCore::AutoTableLayout::layout):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::computePreferredLogicalWidths): Deleted.

2016-01-28  Gwang Yoon Hwang  <yoon@igalia.com>

        [GStreamer] Clean up includes and headers related with GStreamerGL
        https://bugs.webkit.org/show_bug.cgi?id=153590

        Reviewed by Philippe Normand.

        Remove gstglmemory from the including list and reorder includes to
        organize GSTREAMER_GL related headers. It violates style rules of the
        include order, but there is no clean way to include gst/gl/gl.h
        without violating it.

        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:

2016-01-28  Gwang Yoon Hwang  <yoon@igalia.com>

        [GStreamer] MediaPlayerPrivateGStreamerBase::handleSyncMessage leaks GstContext
        https://bugs.webkit.org/show_bug.cgi?id=153580

        Reviewed by Philippe Normand.

        When we creates GstContext using gst_context_new it increases refcount itself.
        And the refcount of GstContext is increased when it is passed to
        gst_element_set_context, also. Therefore We should unref GstContext after
        using it to prevent GstContext leaks.

        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
        (WTF::adoptGRef): Added for GstContext.
        (WTF::refGPtr<GstContext>): Ditto
        (WTF::derefGPtr<GstContext>): Ditto
        * platform/graphics/gstreamer/GRefPtrGStreamer.h:
        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
        (WebCore::MediaPlayerPrivateGStreamerBase::handleSyncMessage):
        Use GRefPtr<GstContext> to handle currect refcounting

2016-01-27  Alex Christensen  <achristensen@webkit.org>

        Fix clean CMake build after r195711.

        * PlatformWin.cmake:
        Copy forwarding headers from the new directory to find ContentSecurityPolicy.h.
        This should fix EWS issues like the one seen in bug 153573.

2016-01-27  Chris Dumez  <cdumez@apple.com>

        Expose ValidityState on the global Window object
        https://bugs.webkit.org/show_bug.cgi?id=153582

        Reviewed by Antti Koivisto.

        Expose ValidityState on the global Window object:
        https://html.spec.whatwg.org/#validitystate

        Firefox and Chrome match the specification.

        No new tests, already covered by existing tests.

        * html/ValidityState.idl:

2016-01-27  Chris Dumez  <cdumez@apple.com>

        Expose ApplicationCache on the global Window object
        https://bugs.webkit.org/show_bug.cgi?id=153578

        Reviewed by Antti Koivisto.

        Expose ApplicationCache on the global Window object as per:
        https://html.spec.whatwg.org/#the-storage-interface

        Chrome follows the spec.

        No new tests, already covered by existing test.

        * loader/appcache/DOMApplicationCache.idl:

2016-01-27  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r190430): Assertion failure in Text::~Text()
        https://bugs.webkit.org/show_bug.cgi?id=153577

        Reviewed by Antti Koivisto.

        The bug was caused by destroyRenderTreeIfNeeded exiting early on all HTMLSlotElement as it lacks a render object.
        Fixed it by explicitly avoiding the early return when child is a HTMLSlotElement.

        Test: fast/shadow-dom/slot-removal-crash-2.html

        * dom/ContainerNode.cpp:
        (WebCore::destroyRenderTreeIfNeeded):

2016-01-27  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Garbage is displayed when root svg element has mix-blend-mode set
        https://bugs.webkit.org/show_bug.cgi?id=150556

        Reviewed by Darin Adler.

        This bug happens when compositing on a CALayer and drawing on a transparent
        layer, so it happens with WK2 with <svg style="mix-blend-mode...">. And it
        can happen with WK1 also with <svg style="opacity=...;mix-blend-mode...">.
        But in both cases, the SVG root renderer should be the root of the render
        tree. So it happens only with the stand alone SVG documents.

        SVGRenderContext::prepareToRenderSVGContent() ignores the opacity of
        the SVG root but it creates a transparent layer for the blend-mode.

        But RenderLayer::beginTransparencyLayers() creates a transparent layer
        for opacity and it sets the blend-mode also.

        The fix is to begin two transparent layers for the SVG root renderer: one
        for the opacity and the second for the blend-mode. The opacity transparent
        layer will be still managed by RenderLayer::beginTransparencyLayers(). While
        the blend-mode transparent layer will be managed by SVGRenderContext
        ::prepareToRenderSVGContent().

        Tests: svg/css/mix-blend-mode-background-root.svg
               svg/css/mix-blend-mode-opacity-root.svg

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::beginTransparencyLayers):

2016-01-27  Enrica Casucci  <enrica@apple.com>

        Cache results of data detection in the UI process when load completes.
        https://bugs.webkit.org/show_bug.cgi?id=153560

        Reviewed by Tim Horton.

        Adding new FrameLoaderClient method to notify that data
        detection is complete and provide the results.

        * loader/EmptyClients.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * loader/FrameLoaderClient.h:

2016-01-27  Daniel Bates  <dabates@apple.com>

        Move ContentSecurityPolicy.{cpp, h} to its own directory
        https://bugs.webkit.org/show_bug.cgi?id=153527
        <rdar://problem/24359892>

        Reviewed by Sam Weinig.

        Move ContentSecurityPolicy.{cpp, h} from Source/WebCore/page to Source/WebCore/page/csp.
        This will facilitate separating out the policy support classes (e.g. CSPDirectiveList)
        into their own files to improve the hackability of this code.

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * page/csp/ContentSecurityPolicy.cpp: Renamed from Source/WebCore/page/ContentSecurityPolicy.cpp.
        * page/csp/ContentSecurityPolicy.h: Renamed from Source/WebCore/page/ContentSecurityPolicy.h.

2016-01-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: Incorrect handling of iterating cursors to their end.
        https://bugs.webkit.org/show_bug.cgi?id=153569

        Reviewed by Alex Christensen.

        No new tests (3 tests now pass, others are closer to passing).

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::advance):
        (WebCore::IDBServer::SQLiteIDBCursor::internalAdvanceOnce):

2016-01-27  Nan Wang  <n_wang@apple.com>

        AX: Crash in AccessibilityTableColumn::headerObject
        https://bugs.webkit.org/show_bug.cgi?id=153553
        <rdar://problem/23196278>

        Reviewed by Chris Fleizach.

        Webkit was crashing sometimes when we asked for column headers of a table.
        The columns vector of the table was reset during the iteration when we
        were asking for the headerObject of each column. The column's addChildren()
        function calls elementRect() for each child cell and that sometimes causes 
        the parent table to reset its children.
        Fixed it by caching the columns vector and moving out the elementRect() logic
        from AccessibilityTalbeColumn::addChildren().  

        * accessibility/AccessibilityTable.cpp:
        (WebCore::AccessibilityTable::columnHeaders):
        (WebCore::AccessibilityTable::rowHeaders):
        * accessibility/AccessibilityTableColumn.cpp:
        (WebCore::AccessibilityTableColumn::elementRect):
        (WebCore::AccessibilityTableColumn::headerObject):
        (WebCore::AccessibilityTableColumn::addChildren):
        * accessibility/AccessibilityTableColumn.h:

2016-01-27  Chris Dumez  <cdumez@apple.com>

        Settings a reflected DOMString attribute to null should set it to the "null" string rather than the empty string
        https://bugs.webkit.org/show_bug.cgi?id=153504
        <rdar://problem/24353072>

        Reviewed by Ryosuke Niwa.

        Settings a reflected DOMString attribute to null should set it to the "null"
        string rather than the empty string:
        - https://html.spec.whatwg.org/#reflecting-content-attributes-in-idl-attributes
        - http://heycam.github.io/webidl/#es-DOMString
        - http://people.mozilla.org/~jorendorff/es6-draft.html#sec-tostring

        Firefox and Chrome match the specification here.

        This is causing a lot of W3C HTML reflection tests to fail on WebKit, e.g.:
        - http://w3c-test.org/html/dom/reflection-text.html

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (JSValueToNative):
        Call toString() instead of valueToStringWithNullCheck() for reflected
        attributes. This way, null gets converted to the string "null", as
        expected, instead of a null String object.

        * html/HTMLInputElement.idl:
        Dropping [TreatNullAs=NullString] IDL extended attribute for
        input.defaultValue, as this is not present in the specification:
        - https://html.spec.whatwg.org/#htmlinputelement

        Without this change, assigning null to input.defaultValue would not
        set to to the "null" string, as is expected.

        * html/HTMLTextAreaElement.idl:
        Dropping [TreatNullAs=NullString] IDL extended attribute for
        textArea.defaultValue, as this is not present in the specification:
        - https://html.spec.whatwg.org/#htmltextareaelement

        Without this change, assigning null to textArea.defaultValue would not
        set to to the "null" string, as is expected.

        * html/HTMLTitleElement.idl:
        Dropping [TreatNullAs=NullString] IDL extended attribute for
        title.text, as this is not present in the specification:
        - https://html.spec.whatwg.org/#htmltitleelement

        Without this change, assigning null to title.text would not
        set to to the "null" string, as is expected.

2016-01-27  Simon Fraser  <simon.fraser@apple.com>

        Support CSS3 Images values for the image-rendering property
        https://bugs.webkit.org/show_bug.cgi?id=153556

        Reviewed by Dean Jackson.

        CSS3 Images has the following values for image-rendering:
            auto, crisp-edges, pixelated

        The old code supported:
            optimizeSpeed, optimizeQuality, -webkit-crisp-edges, -webkit-optimize-contrast

        Add support for the new values without prefixes. Map -webkit-crisp-edges to crisp-edges,
        and -webkit-optimize-contrast to crisp-edges. Support pixelated which behaves like 
        crisp-edges (a low quality scale).

        The spec says that optimizeQuality should behave like 'auto', but that would be
        a behavior change since ImageQualityController::shouldPaintAtLowQuality() currently
        uses it as a trigger to avoid low quality scaling, so don't change that for now.

        No new tests, covered by fast/css/script-tests/image-rendering-parsing.js

        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator EImageRendering):
        * css/CSSValueKeywords.in:
        * rendering/ImageQualityController.cpp:
        (WebCore::ImageQualityController::shouldPaintAtLowQuality):
        * rendering/RenderHTMLCanvas.cpp:
        (WebCore::RenderHTMLCanvas::paintReplaced):
        * rendering/style/RenderStyleConstants.h:
        * rendering/style/StyleRareInheritedData.h: Need another bit.

2016-01-27  Anders Carlsson  <andersca@apple.com>

        Add WebKitAdditions extension points to WebCore, WebKit and WebKitLegacy
        https://bugs.webkit.org/show_bug.cgi?id=153550

        Reviewed by Sam Weinig.

        * DerivedSources.make:
        Add the ability for WebKitAdditions to add events and event targets.

        * WebCore.xcodeproj/project.pbxproj:
        Add new files.

        * bindings/scripts/InFilesCompiler.pm:
        (initializeFromCommandLine):
        (compile):
        Handle multiple --input parameters.

        * dom/EventNames.h:
        Handle adding more event names.

        * loader/EmptyClients.cpp:
        (WebCore::fillWithEmptyClients):
        * page/MainFrame.cpp:
        (WebCore::MainFrame::MainFrame):
        * page/MainFrame.h:
        * page/PageConfiguration.h:
        Add extension points.

        * platform/cocoa/WebKitAdditions.mm: Added.
        Import additions.

2016-01-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: Fix many Index tests.
        https://bugs.webkit.org/show_bug.cgi?id=153561

        Reviewed by Alex Christensen.

        No new tests (Many failing tests now pass).

        * Modules/indexeddb/server/MemoryIndex.cpp:
        (WebCore::IDBServer::MemoryIndex::getResultForKeyRange):
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexKey):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::iterateCursor):
        
        * Modules/indexeddb/server/SQLiteIDBCursor.h:
        (WebCore::IDBServer::SQLiteIDBCursor::didComplete):

2016-01-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: Cursors are utterly broken in the SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153558

        Reviewed by Alex Christensen.

        No new tests (35 failures now pass, others improve).

        - Fixes incorrect usage of Index cursors when ObjectStore cursors are intended.
        - Improves the state of getting the cursor value vs. reaching the end of a cursor.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::openCursor):
        (WebCore::IDBServer::SQLiteIDBBackingStore::iterateCursor):

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::currentData):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:

2016-01-27  Chris Dumez  <cdumez@apple.com>

        Getting / Setting property on prototype object must throw TypeError
        https://bugs.webkit.org/show_bug.cgi?id=153547
        <rdar://problem/24370650>

        Reviewed by Ryosuke Niwa.

        Gettingi / Setting property on prototype object must throw TypeError as per
        Web IDL specification:
        http://heycam.github.io/webidl/#dfn-attribute-getter (Step 2.4.2)
        http://heycam.github.io/webidl/#dfn-attribute-setter (Step 3.5)

        Firefox and Chrome already throw a TypeError in this case, as per
        the specification. However, WebKit was returning null and merely
        logging a deprecation error message. This patch aligns our behavior
        with other browsers and the specification.

        This patch also adds support for the [LenientThis] IDL extended
        attribute:
        http://heycam.github.io/webidl/#LenientThis

        For [LenientThis] attributes, we do not throw a TypeError if the
        attribute getter / setter is called on an object which does not
        implement the expected interface, as per:
        http://heycam.github.io/webidl/#dfn-attribute-getter (Step 2.4.1)
        http://heycam.github.io/webidl/#dfn-attribute-setter (Step 3.5)

        No new tests, already covered by existing tests.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        * bindings/scripts/IDLAttributes.txt:
        Add support for [LenientThis]:
        http://heycam.github.io/webidl/#LenientThis

        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
        * bindings/scripts/test/JS/JSTestInterface.cpp:
        * bindings/scripts/test/JS/JSTestNode.cpp:
        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
        * bindings/scripts/test/JS/JSTestObj.cpp:
        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
        * bindings/scripts/test/JS/JSattribute.cpp:
        * bindings/scripts/test/ObjC/DOMTestObj.h:
        * bindings/scripts/test/ObjC/DOMTestObj.mm:
        Rebaseline bindings tests.

        * bindings/scripts/test/TestObj.idl:
        Add coverage for [LenientThis] attributes.

        * dom/Document.idl:
        Mark 'onreadystatechange' as [LenientThis] as per the HTML
        specification:
        https://html.spec.whatwg.org/#document

        * dom/GlobalEventHandlers.idl:
        Mark 'onmouseeneter' / 'onmouseleave' as [LenientThis] as per the
        HTML specification:
        https://html.spec.whatwg.org/#globaleventhandlers

2016-01-27  Chris Dumez  <cdumez@apple.com>

        window.atob() should ignore spaces in input
        https://bugs.webkit.org/show_bug.cgi?id=153522
        <rdar://problem/24357822>

        Reviewed by Benjamin Poulain.

        window.atob() should ignore spaces in input as per:
        - https://html.spec.whatwg.org/#dom-windowbase64-atob (Step 3)

        Previously, WebKit would throw an exception and it was the only browser
        to do so. Firefox and Chrome behavior according to the specification.

        This was causing us to fail 10 checks in the following W3C HTML test:
        http://w3c-test.org/html/webappapis/atob/base64.html

        No new tests, updated existing test.

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::atob):
        * page/Page.cpp:
        (WebCore::Page::userStyleSheetLocationChanged):
        * platform/network/DataURL.cpp:
        (WebCore::handleDataURL):
        * platform/network/DataURLDecoder.cpp:
        (WebCore::DataURLDecoder::decodeBase64):

2016-01-27  Ada Chan  <adachan@apple.com>

        Move some logic related to the presentation mode button from mediaControlsiOS.js to mediaControlsApple.js
        https://bugs.webkit.org/show_bug.cgi?id=153476

        Reviewed by Eric Carlson.

        Also, add the necessary styles to support that control in mediaControlsApple.css.

        * Modules/mediacontrols/mediaControlsApple.css:
        (video::-webkit-media-controls-panel.picture-in-picture):
        (audio::-webkit-media-controls-wireless-playback-status.picture-in-picture):
        (audio::-webkit-media-controls-wireless-playback-text-top.picture-in-picture):
        (audio::-webkit-media-controls-wireless-playback-text-bottom.picture-in-picture):
        (video::-webkit-media-controls-panel .picture-in-picture-button):
        Use the same mask image as iOS, but with a different size and a background color specified
        (since there's another rule that makes buttons within the panel have a transparent
        background color).
        (video::-webkit-media-controls-panel .picture-in-picture-button.return-from-picture-in-picture):

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.addVideoListeners):
        (Controller.prototype.removeVideoListeners):
        Listen for (and stop listening for) the webkitpresentationmodechanged event if presentation
        mode is supported for this video element.
        (Controller.prototype.createControls):
        Add a class name to the pictureInPictureButton so we can query for it in the stylesheet.
        (Controller.prototype.configureInlineControls):
        Call updatePictureInPictureButton().
        (Controller.prototype.presentationMode):
        Moved from mediaControlsiOS.js.
        (Controller.prototype.isFullScreen):
        Ditto, with a bug fix to not call presentationMode(), since that method calls isFullScreen(),
        resulting in infinite recursion.
        (Controller.prototype.updatePictureInPictureButton):
        Ditto.
        (Controller.prototype.handlePresentationModeChange):
        Ditto.
        (Controller.prototype.handleFullscreenChange):
        Call handlePresentationModeChanged() if presentation mode is supported for this video element.
        (Controller.prototype.controlsAlwaysVisible):
        Ditto.
        (Controller.prototype.handlePictureInPictureButtonClicked):
        Ditto.
        * Modules/mediacontrols/mediaControlsiOS.js:
        (ControllerIOS.prototype.handlePresentationModeChange):
        Most logic has been moved to the same method in mediaControlsApple.js, except
        updating the style of the panelContainer, which doesn't exist in the Mac controls.
        (ControllerIOS.prototype.addVideoListeners): Deleted.
        (ControllerIOS.prototype.removeVideoListeners): Deleted.
        (ControllerIOS.prototype.presentationMode): Deleted.
        (ControllerIOS.prototype.isFullScreen): Deleted.
        (ControllerIOS.prototype.handlePictureInPictureButtonClicked): Deleted.
        (ControllerIOS.prototype.updatePictureInPictureButton): Deleted.
        (ControllerIOS.prototype.handleFullscreenChange): Deleted.
        (ControllerIOS.prototype.controlsAlwaysVisible): Deleted.
        Delete all code that's already handled in the Controller.

2016-01-26  Ada Chan  <adachan@apple.com>

        Enable API related to the video fullscreen layer in MediaPlayerPrivateMediaSourceAVFObjC
        also on Mac platform with video presentation mode support.
        https://bugs.webkit.org/show_bug.cgi?id=153223

        Reviewed by Jer Noble.

        Reuse VideoFullscreenLayerManager to manage moving the video layer between the fullscreen
        layer and the inline layer depending on the current presentation mode.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::MediaPlayerPrivateMediaSourceAVFObjC):
        Create m_videoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::platformLayer):
        Return the video inline layer from the VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::addDisplayLayer):
        Call VideoFullscreenLayerManager::setVideoLayer() with the m_sampleBufferDisplayLayer.
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::removeDisplayLayer):
        Call VideoFullscreenLayerManager::didDestroyVideoLayer().
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setVideoFullscreenLayer):
        Call VideoFullscreenLayerManager::setVideoFullscreenLayer().
        (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setVideoFullscreenFrame):
        Call VideoFullscreenLayerManager::setVideoFullscreenFrame().

2016-01-27  Brady Eidson  <beidson@apple.com>

        Modern IDB: SQLite backend doesn't update index records as object records are added.
        https://bugs.webkit.org/show_bug.cgi?id=153548

        Reviewed by Alex Christensen.

        No new tests (4 more tests pass, others improve).

        * Modules/indexeddb/server/IDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::addRecord):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::initializeVM):
        (WebCore::IDBServer::SQLiteIDBBackingStore::vm):
        (WebCore::IDBServer::SQLiteIDBBackingStore::globalObject):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexKey):
        (WebCore::IDBServer::SQLiteIDBBackingStore::updateIndexesForAddRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::performPutOrAdd):
        
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:

2016-01-27  Ryosuke Niwa  <rniwa@webkit.org>

        Add API to access closed shadowRoot in InjectedBundle
        https://bugs.webkit.org/show_bug.cgi?id=153533

        Reviewed by Antti Koivisto.

        Always return the shadow root in Element.shadowRootForBindings when the DOM wrapper world has
        shadowRootIsAlwaysOpen set to true. Also renamed bindingShadowRoot to shadowRootForBindings
        to be consistent.

        * bindings/js/DOMWrapperWorld.h:
        (WebCore::DOMWrapperWorld::setShadowRootIsAlwaysOpen): Added.
        (WebCore::DOMWrapperWorld::shadowRootIsAlwaysOpen): Added.
        * dom/Element.cpp:
        (WebCore::Element::shadowRootForBindings): Renamed from bindingShadowRoot.
        * dom/Element.h:
        * dom/Element.idl:

2016-01-27  Zhuo Li  <zachli@apple.com>

        Need ability to specify alternate image for AutoFill button in input fields.
        https://bugs.webkit.org/show_bug.cgi?id=153116.
        rdar://problem/23384854.

        Reviewed by Darin Adler.

        Add a new AutoFill button that can be shown in <input> elements.

        Tests: fast/forms/auto-fill-button/input-contacts-auto-fill-button.html
               fast/forms/auto-fill-button/show-correct-auto-fill-button-when-auto-fill-button-type-changes.html

        * css/html.css:
        (input::-webkit-contacts-auto-fill-button):
        (input::-webkit-contacts-auto-fill-button:hover):
        (input::-webkit-contacts-auto-fill-button:active):
        Add default style rules for the Contacts AutoFill button based on the ones used for
        Manual AutoFill button.

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setShowAutoFillButton):
        * html/HTMLInputElement.h:
        (WebCore::HTMLInputElement::autoFillButtonType):
        - Replace the boolean parameter with a new parameter to specify the type of the AutoFill button.
        - Declare a private variable to keep a record of the type of the current AutoFill
        button.
        (WebCore::HTMLInputElement::showAutoFillButton): Deleted.

        * html/HTMLTextFormControlElement.h:
        Declare enum for AutoFill button type.

        * html/TextFieldInputType.cpp:
        (WebCore::autoFillButtonTypeToAutoFillButtonPseudoClassName):
        (WebCore::isAutoFillButtonTypeChanged):
        (WebCore::TextFieldInputType::shouldDrawAutoFillButton): None means the AutoFill button is not
        enabled.
        (WebCore::TextFieldInputType::createAutoFillButton): Only create the AutoFill button
        if the type is expected.
        (WebCore::TextFieldInputType::updateAutoFillButton):
        Handle the case where AutoFill button type changes in the text field.
        * html/TextFieldInputType.h:

        * testing/Internals.cpp:
        (WebCore::stringToAutoFillButtonType): Convert the string to AutoFill button type.
        (WebCore::Internals::setShowAutoFillButton): Add a new parameter to specify the type of the AutoFill button.
        * testing/Internals.h: Ditto.
        * testing/Internals.idl: Ditto.

2016-01-26  Ryosuke Niwa  <rniwa@webkit.org>

        Add Node.treeRoot
        https://bugs.webkit.org/show_bug.cgi?id=153537

        Reviewed by Antti Koivisto.

        Exposed highestAncestor as Node.prototype.treeRoot, which was added to shadow DOM spec in
        https://github.com/w3c/webcomponents/commit/6864a40fe4efa8a737e78512e3c85319ddc5bf8b

        See also:
        http://w3c.github.io/webcomponents/spec/shadow/#extensions-to-node-interface

        Test: fast/shadow-dom/Node-interface-treeRoot.html

        * dom/Node.idl:

2016-01-26  Ryosuke Niwa  <rniwa@webkit.org>

        Rename HTMLSlotElement.getDistributedNodes to getAssignedNodes
        https://bugs.webkit.org/show_bug.cgi?id=153534

        Reviewed by Antti Koivisto.

        Did the rename.

        * html/HTMLSlotElement.idl:

2016-01-27  Tim Horton  <timothy_horton@apple.com>

        Need to be able to specify MIME type for <attachment> without filename or handle
        https://bugs.webkit.org/show_bug.cgi?id=153552
        <rdar://problem/20145857>

        Reviewed by Anders Carlsson.

        Tests: fast/attachment/attachment-default-icon.html
               fast/attachment/attachment-type-attribute.html

        * html/HTMLAttachmentElement.cpp:
        (WebCore::HTMLAttachmentElement::parseAttribute):
        Invalidate attachment when 'type' attribute changes.

        (WebCore::HTMLAttachmentElement::attachmentType):
        * html/HTMLAttachmentElement.h:
        * platform/graphics/Icon.h:
        * platform/graphics/mac/IconMac.mm:
        (WebCore::Icon::createIconForUTI):
        (WebCore::Icon::createIconForMIMEType):
        Add Icon class methods to retrieve an icon given a UTI or MIME type.

        * rendering/RenderThemeMac.mm:
        (WebCore::paintAttachmentIcon):
        Use the 'type' attribute (a MIME type) if we have one. Otherwise,
        use the filename. Lastly fall back to a plain file icon (using the root
        file UTI, public.data).

2016-01-27  Alexey Proskuryakov  <ap@apple.com>

        Remove ENABLE_CURRENTSRC
        https://bugs.webkit.org/show_bug.cgi?id=153545

        Reviewed by Simon Fraser.

        * Configurations/FeatureDefines.xcconfig:

2016-01-26  Anders Carlsson  <andersca@apple.com>

        Stop echoing echo commands to stdout
        https://bugs.webkit.org/show_bug.cgi?id=153531

        Reviewed by Csaba Osztrogonác.

        * DerivedSources.make:

2016-01-26  Jer Noble  <jer.noble@apple.com>

        Calling video.controls=true during a scrub operation cancels scrub.
        https://bugs.webkit.org/show_bug.cgi?id=153494

        Reviewed by Eric Carlson.

        Test: media/media-controls-drag-timeline-set-controls-property.html

        Verify that the video.controls attribute actually changed before tearing down and
        re-adding the media controls to the Shadow DOM.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.handleControlsChange):
        (Controller.prototype.hasControls):

2016-01-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        [GTK][EFL] Rename ScrollAnimationNone as ScrollAnimationSmooth
        https://bugs.webkit.org/show_bug.cgi?id=153481

        Reviewed by Simon Fraser.

        ScrollAnimationNone has always been used by EFL and GTK ports to
        implement smooth scrolling. I think it should be possible for
        other scroll animators to implement smooth scrolling or even
        implement other kind of scroll animations. For example, in the
        future I would like to have kinetic scrolling implemented for the
        GTK+ port to match all other GTK+ application and decide at
        runtime between different animations without having to use a
        different scroll animator class. So, this patch also moves the
        smooth scrolling animation implementation to its own class
        ScrollAnimationSmooth that impements an interface ScrollAnimation
        that could be used to implement other animations. This will allow
        the GTK+ port to add its own scroll animator class and still
        support smooth scrolling sharing the code with the
        ScrollAnimationSmooth.

        * PlatformEfl.cmake: Add new files to compilation and remove ScrollAnimationNone.
        * PlatformGTK.cmake: Ditto.
        * platform/ScrollAnimation.h: Added.
        (WebCore::ScrollAnimation::serviceAnimation):
        (WebCore::ScrollAnimation::ScrollAnimation):
        * platform/ScrollAnimationSmooth.cpp: Added.
        (WebCore::ScrollAnimationSmooth::ScrollAnimationSmooth):
        (WebCore::ScrollAnimationSmooth::scroll):
        (WebCore::ScrollAnimationSmooth::stop):
        (WebCore::ScrollAnimationSmooth::updateVisibleLengths):
        (WebCore::ScrollAnimationSmooth::setCurrentPosition):
        (WebCore::ScrollAnimationSmooth::serviceAnimation):
        (WebCore::ScrollAnimationSmooth::~ScrollAnimationSmooth):
        (WebCore::curveAt):
        (WebCore::attackCurve):
        (WebCore::releaseCurve):
        (WebCore::coastCurve):
        (WebCore::curveIntegralAt):
        (WebCore::attackArea):
        (WebCore::releaseArea):
        (WebCore::getAnimationParametersForGranularity):
        (WebCore::ScrollAnimationSmooth::updatePerAxisData):
        (WebCore::ScrollAnimationSmooth::animateScroll):
        (WebCore::ScrollAnimationSmooth::animationTimerFired):
        (WebCore::ScrollAnimationSmooth::startNextTimer):
        (WebCore::ScrollAnimationSmooth::animationTimerActive):
        * platform/ScrollAnimationSmooth.h: Added.
        * platform/ScrollAnimator.cpp:
        (WebCore::ScrollAnimator::scroll):
        (WebCore::ScrollAnimator::scrollToOffsetWithoutAnimation):
        (WebCore::ScrollAnimator::setCurrentPosition):
        (WebCore::ScrollAnimator::updateActiveScrollSnapIndexForOffset):
        (WebCore::ScrollAnimator::notifyPositionChanged):
        (WebCore::ScrollAnimator::scrollOffsetOnAxis):
        * platform/ScrollAnimator.h:
        (WebCore::ScrollAnimator::ScrollAnimator::currentPosition):
        * platform/ScrollAnimatorNone.cpp: Removed.
        * platform/ScrollAnimatorNone.h: Removed.
        * platform/ScrollAnimatorSmooth.cpp: Added.
        (WebCore::ScrollAnimator::create):
        (WebCore::ScrollAnimatorSmooth::ScrollAnimatorSmooth):
        (WebCore::ScrollAnimatorSmooth::~ScrollAnimatorSmooth):
        (WebCore::ScrollAnimatorSmooth::scroll):
        (WebCore::ScrollAnimatorSmooth::scrollToOffsetWithoutAnimation):
        (WebCore::ScrollAnimatorSmooth::cancelAnimations):
        (WebCore::ScrollAnimatorSmooth::serviceScrollAnimations):
        (WebCore::ScrollAnimatorSmooth::willEndLiveResize):
        (WebCore::ScrollAnimatorSmooth::didAddVerticalScrollbar):
        (WebCore::ScrollAnimatorSmooth::didAddHorizontalScrollbar):
        * platform/ScrollAnimatorSmooth.h: Added.
        * platform/mac/ScrollAnimatorMac.mm:
        (WebCore::ScrollAnimatorMac::immediateScrollToPosition):
        (WebCore::ScrollAnimatorMac::immediateScrollBy):

2016-01-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        Overlay scrollbars should always use the whole contents
        https://bugs.webkit.org/show_bug.cgi?id=153352

        Reviewed by Michael Catanzaro.

        In case of having both horizontal and vertical scrollbars, the
        scrollbars respect the scroll corner. That looks good for legacy
        scrollbars that show the track, but with the overlay indicators
        it looks weird that the indicator stops so early before the end of
        the contents, giving the impression that there's something else to
        scroll. This happens because the scroll corner is transparent, so
        it's not obvious that's the scroll corner. It also happens with
        the text areas having a resizer. Legacy scrollbars take into
        account the resizer, which is good, but I expect overlay
        scrollbars to be rendered also over the resizer. The resizer takes
        precedence so you can still click and drag to resize the text area.
        In the case of main frame scrollbars we are indeed returning an
        empty rectangle from ScrollView::scrollCornerRect() when using
        overlay scrollbars, but when calculating the size of the
        scrollbars we are using the actual width/height instead of the
        occupied with/height. For other scrollbars
        RenderLayer::scrollCornerRect() is not checking whether scrollbars
        are overlay or not and we are always returning a scroll corner
        rectangle when scrollbars are present.

        * platform/ScrollView.cpp:
        (WebCore::ScrollView::updateScrollbars): Use the occupied
        width/height when calculating the space the one scrollbar
        should leave for the other.
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollCornerRect): Return an empty
        rectangle when using overlay scrollbars.

2016-01-27  Carlos Garcia Campos  <cgarcia@igalia.com>

        ScrollAnimator is not notified when mouse entered, moved or exited a RenderListBox
        https://bugs.webkit.org/show_bug.cgi?id=153398

        Reviewed by Michael Catanzaro.

        EvenHandler is checking whether the enclosing layer of a node is
        registered as scrollable area of its frame view. That doesn't work
        for list boxes, because they are the scrollable area
        themselves. Also when entering a list box the node under mouse is
        not usually the list box itself, but any of its children, a
        HTMLOptionElement or a HTMLOptGroupElement. Instead of comparing
        layers, we should find the enclosing scrollable area of the target
        elements and compare them to decide whether the mouse has entered,
        left or moved a scrollable area.

        * page/EventHandler.cpp:
        (WebCore::enclosingScrollableArea): Return the enclosing
        scrollable area of the given node. If the node doesn't have a
        renderer, it traverses its parents. If the renderer is a
        RenderListBox it is returned, otherwhise the enclosing layer is
        returned.
        (WebCore::EventHandler::mouseMoved): Use enclosingScrollableArea.
        (WebCore::EventHandler::updateMouseEventTargetNode): Ditto.

2016-01-26  Sam Weinig  <sam@webkit.org>

        Try touching DerivedSources.make to force rebuilding.

        * DerivedSources.make:
        * page/DOMWindow.idl:

2016-01-26  Sam Weinig  <sam@webkit.org>

        Try to force a rebuild.

        * page/DOMWindow.idl:

2016-01-26  Chris Dumez  <cdumez@apple.com>

        fast/history/page-cache-webdatabase-no-transaction-db.html flakily crashes
        https://bugs.webkit.org/show_bug.cgi?id=153525

        Reviewed by Andreas Kling.

        The test was crashing because DatabaseThread::hasPendingDatabaseActivity()
        was accessing m_openDatabaseSet from the main thread without any locking
        mechanism. This is an issue because m_openDatabaseSet is altered by the
        database thread.

        No new tests, already covered by fast/history/page-cache-webdatabase-no-transaction-db.html.

        * Modules/webdatabase/DatabaseThread.cpp:
        (WebCore::DatabaseThread::databaseThread):
        (WebCore::DatabaseThread::recordDatabaseOpen):
        (WebCore::DatabaseThread::recordDatabaseClosed):
        (WebCore::DatabaseThread::hasPendingDatabaseActivity):
        * Modules/webdatabase/DatabaseThread.h:

2016-01-26  Joseph Pecoraro  <pecoraro@apple.com>

        Unreviewed CMake build fix after r195644.

        * PlatformMac.cmake:

2016-01-26  Brady Eidson  <beidson@apple.com>

        Modern IDB: Key generator support for SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153427

        Reviewed by Alex Christensen.

        No new tests (Existing failing tests now pass, others improved).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedGetKeyGeneratorValue):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedSetKeyGeneratorValue):
        (WebCore::IDBServer::SQLiteIDBBackingStore::generateKeyNumber):
        (WebCore::IDBServer::SQLiteIDBBackingStore::revertGeneratedKeyNumber):
        (WebCore::IDBServer::SQLiteIDBBackingStore::maybeUpdateKeyGeneratorNumber):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

2016-01-26  Simon Fraser  <simon.fraser@apple.com>

        Allow canvas to use display-list drawing for testing
        https://bugs.webkit.org/show_bug.cgi?id=153475

        Reviewed by Dean Jackson.

        Optionally have 2D <canvas> use display-list drawing, which is only enabled
        via Internals for now.

        Support displayListAsText() and replayDisplayListAsText() on canvas, so we can
        use it to test playback optimizations. [Note that displayListAsText() always
        returns an empty string currently, because the display list is cleared when the
        canvas is painted to the page.]

        Display list rendering is implemented by giving CanvasRenderingContext2D an
        optional DisplayListDrawingContext, which packages up a display list, recorder
        and recording context. The existing paintRenderingResultsToCanvas() is overridden
        to replay the recorded display list into the primary canvas context.

        Tracked replay display lists are stored in a static map, keyed by the CanvasRenderingContext2D.

        Test: displaylists/canvas-display-list.html

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
        (WebCore::HTMLCanvasElement::getContext):
        (WebCore::HTMLCanvasElement::paint):
        (WebCore::HTMLCanvasElement::setUsesDisplayListDrawing):
        (WebCore::HTMLCanvasElement::setTracksDisplayListReplay):
        (WebCore::HTMLCanvasElement::displayListAsText):
        (WebCore::HTMLCanvasElement::replayDisplayListAsText):
        * html/HTMLCanvasElement.h:
        * html/canvas/CanvasRenderingContext.h:
        * html/canvas/CanvasRenderingContext2D.cpp:
        (WebCore::DisplayListDrawingContext::DisplayListDrawingContext):
        (WebCore::contextDisplayListMap):
        (WebCore::CanvasRenderingContext2D::~CanvasRenderingContext2D):
        (WebCore::CanvasRenderingContext2D::setTracksDisplayListReplay):
        (WebCore::CanvasRenderingContext2D::displayListAsText):
        (WebCore::CanvasRenderingContext2D::replayDisplayListAsText):
        (WebCore::CanvasRenderingContext2D::paintRenderingResultsToCanvas):
        (WebCore::CanvasRenderingContext2D::drawingContext):
        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D): Deleted.
        * html/canvas/CanvasRenderingContext2D.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setElementUsesDisplayListDrawing):
        (WebCore::Internals::setElementTracksDisplayListReplay):
        (WebCore::Internals::displayListForElement):
        (WebCore::Internals::replayDisplayListForElement):

2016-01-26  Joseph Pecoraro  <pecoraro@apple.com>

        Generalize ResourceUsageData gathering to be used outside of ResourceUsageOverlay
        https://bugs.webkit.org/show_bug.cgi?id=153509
        <rdar://problem/24354291>

        Reviewed by Andreas Kling.

        * CMakeLists.txt:
        * PlatformMac.cmake:
        * WebCore.xcodeproj/project.pbxproj:
        * page/Page.cpp:
        * page/Page.h:
        * page/Settings.cpp:
        * page/Settings.h:
        * page/ResourceUsageOverlay.cpp:
        * page/ResourceUsageOverlay.h:
        Add new files to the build and updated ENABLE flag name.

        * page/ResourceUsageData.cpp: Added.
        (WebCore::ResourceUsageData::ResourceUsageData):
        * page/ResourceUsageData.h: Added.
        (WebCore::MemoryCategoryInfo::MemoryCategoryInfo):
        Platform agnostic resource data that may be used by multiple clients,
        such as the ResourceUsageOverlay and later the Inspector.

        * page/ResourceUsageThread.h: Added.
        * page/ResourceUsageThread.cpp: Added.
        (WebCore::ResourceUsageThread::ResourceUsageThread):
        (WebCore::ResourceUsageThread::singleton):
        (WebCore::ResourceUsageThread::addObserver):
        (WebCore::ResourceUsageThread::removeObserver):
        (WebCore::ResourceUsageThread::waitUntilObservers):
        (WebCore::ResourceUsageThread::notifyObservers):
        (WebCore::ResourceUsageThread::createThreadIfNeeded):
        (WebCore::ResourceUsageThread::threadCallback):
        (WebCore::ResourceUsageThread::threadBody):
        Platform agnostic resource usage thread that can be used to gather data
        into a ResourceUsageData struct on a background thread and notify observers
        on the main thread. Platforms need only implement ResourceUsageThread::platformThreadBody
        to populate the ResourceUsageData struct with data.

        * page/cocoa/ResourceUsageOverlayCocoa.mm:
        (WebCore::HistoricMemoryCategoryInfo::HistoricMemoryCategoryInfo):
        (WebCore::HistoricResourceUsageData::HistoricResourceUsageData):
        (WebCore::historicUsageData):
        (WebCore::appendDataToHistory):
        (WebCore::ResourceUsageOverlay::platformInitialize):
        (WebCore::ResourceUsageOverlay::platformDestroy):
        (WebCore::drawMemHistory):
        (WebCore::drawMemoryPie):
        (WebCore::ResourceUsageOverlay::platformDraw):
        Move CPU and memory resource usage calculations to ResourceUsageThread.
        The overlay adds itself as an observer, and builds its RingBuffer list
        of data from notifications from the ResourceUsageThread. Renamed
        some of the fields.

        * page/cocoa/ResourceUsageThreadCocoa.mm: Added.
        (WebCore::vmPageSize):
        (WebCore::TagInfo::TagInfo):
        (WebCore::pagesPerVMTag):
        (WebCore::cpuUsage):
        (WebCore::categoryForVMTag):
        (WebCore::ResourceUsageThread::platformThreadBody):
        Extracted from ResourceUsageOverlayCocoa.

        * page/scrolling/ScrollingThread.cpp:
        (WebCore::ScrollingThread::dispatch):
        Drive-by, don't call singleton again, we already have the result.

2016-01-26  Simon Fraser  <simon.fraser@apple.com>

        Use initializers in HTMLCanvasElement
        https://bugs.webkit.org/show_bug.cgi?id=153472

        Reviewed by Michael Catanzaro.

        Use initializers, and re-order member variables for better packing.

        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
        * html/HTMLCanvasElement.h:

2016-01-26  Chris Dumez  <cdumez@apple.com>

        Setting HTMLInputElement.value to null to set its value to the empty string
        https://bugs.webkit.org/show_bug.cgi?id=153519

        Reviewed by Ryosuke Niwa.

        Setting HTMLInputElement.value to null to set its value to the empty string:
        - https://html.spec.whatwg.org/#htmlinputelement
        - http://heycam.github.io/webidl/#TreatNullAs

        WebKit would previously unset the value attribute instead, which caused
        it to fallback to input.defaultValue if set.

        Firefox and Chrome behave correctly.

        Test: fast/dom/HTMLInputElement/input-value-set-null.html

        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::setValue):

2016-01-26  Anders Carlsson  <andersca@apple.com>

        WebKitAdditions should be able to modify derived source rules
        https://bugs.webkit.org/show_bug.cgi?id=153514

        Reviewed by Tim Horton.

        * DerivedSources.make:
        Include WebCoreDerivedSourcesAdditions.make.

        * WebCore.xcodeproj/project.pbxproj:
        Pass our WebKitAdditions paths as include paths to make.

2016-01-26  Chris Dumez  <cdumez@apple.com>

        document.open() / write() should be prevented in beforeunload event handlers
        https://bugs.webkit.org/show_bug.cgi?id=153432

        Reviewed by Ryosuke Niwa.

        document.open() / write() should be prevented in beforeunload event handlers:
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)
        - https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter
        - https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document

        Test: fast/frames/page-beforeunload-document-open.html

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::dispatchBeforeUnloadEvent):

2016-01-26  Chris Dumez  <cdumez@apple.com>

        Add support for HTMLDataElement
        https://bugs.webkit.org/show_bug.cgi?id=153459

        Reviewed by Ryosuke Niwa.

        Add support for HTMLDataElement:
        https://html.spec.whatwg.org/multipage/semantics.html#the-data-element

        Firefox already supports it.

        No new tests, already covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * html/HTMLDataElement.cpp: Added.
        (WebCore::HTMLDataElement::create):
        (WebCore::HTMLDataElement::HTMLDataElement):
        * html/HTMLDataElement.h: Added.
        * html/HTMLDataElement.idl: Added.
        * html/HTMLElementsAllInOne.cpp:
        * html/HTMLTagNames.in:

2016-01-26  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195610.
        https://bugs.webkit.org/show_bug.cgi?id=153513

        The test added with this change is timing out on almost every
        run (Requested by ryanhaddad on #webkit).

        Reverted changeset:

        "Calling video.controls=true during a scrub operation cancels
        scrub."
        https://bugs.webkit.org/show_bug.cgi?id=153494
        http://trac.webkit.org/changeset/195610

2016-01-26  Brady Eidson  <beidson@apple.com>

        History.pushState causes intense memory pressure.
        https://bugs.webkit.org/show_bug.cgi?id=153435

        Reviewed by Sam Weinig, Oliver Hunt, and Geoff Garen.

        Tests: fast/loader/stateobjects/pushstate-frequency-iframe.html
               fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html
               fast/loader/stateobjects/pushstate-frequency.html
               fast/loader/stateobjects/replacestate-frequency-iframe.html
               fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html
               fast/loader/stateobjects/replacestate-frequency.html
               loader/stateobjects/pushstate-size-iframe.html
               loader/stateobjects/pushstate-size.html
               loader/stateobjects/replacestate-size-iframe.html
               loader/stateobjects/replacestate-size.html

        Add restrictions on how frequently push/replaceState can be called,
        as well as how much of a cumulative payload they can deliver.
        
        * bindings/js/JSHistoryCustom.cpp:
        (WebCore::JSHistory::pushState):
        (WebCore::JSHistory::replaceState):
        
        * page/History.cpp:
        (WebCore::History::stateObjectAdded):
        * page/History.h:

2016-01-26  Anders Carlsson  <andersca@apple.com>

        Add a Dictionary overload that returns an Optional result
        https://bugs.webkit.org/show_bug.cgi?id=153507

        Reviewed by Tim Horton.

        * bindings/js/Dictionary.h:
        (WebCore::Dictionary::get):

2016-01-26  Philip Rogers  <pdr@chromium.org>

        Let SVG images not taint canvases except when containing foreignObjects
        https://bugs.webkit.org/show_bug.cgi?id=119639

        Reviewed by Brent Fulgham.

        r153876 caused SVG images to not taint canvases but the patch allowed
        for subimage resources. This can be a problem if a subimage (e.g., data
        uri image) contains a foreignObject which can violate security (e.g.,
        visited links).

        This patch updates SVGImage::hasSingleSecurityOrigin to check if the
        image contains any foreignObjects or images that themselves contain
        foreignObjects. SVG images without foreignObjects are allowed to not
        taint canvases.

        Canvas patterns are problematic because an animated SVG image can switch
        between tainting and not tainting the canvas. A FIXME has been added to
        solve this, and in the meantime we cause SVG images to taint patterns.

        Tests: svg/as-image/svg-canvas-pattern-with-link-tainted.html
               svg/as-image/svg-canvas-svg-with-feimage-with-link-tainted.html
               svg/as-image/svg-canvas-svg-with-image-with-link-tainted.html

        * html/canvas/CanvasPattern.cpp:
        (WebCore::CanvasPattern::CanvasPattern):
        (WebCore::CanvasPattern::~CanvasPattern):
        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::~SVGFEImageElement):
        (WebCore::SVGFEImageElement::hasSingleSecurityOrigin):
        (WebCore::SVGFEImageElement::clearResourceReferences):
        * svg/SVGFEImageElement.h:
        * svg/SVGImageElement.cpp:
        (WebCore::SVGImageElement::create):
        (WebCore::SVGImageElement::hasSingleSecurityOrigin):
        (WebCore::SVGImageElement::isSupportedAttribute):
        * svg/SVGImageElement.h:
        * svg/graphics/SVGImage.cpp:
        (WebCore::SVGImage::hasSingleSecurityOrigin):

2016-01-26  Michael Catanzaro  <mcatanzaro@igalia.com>

        CSSGrammar.y:1742.31-34: warning: unused value: $3
        https://bugs.webkit.org/show_bug.cgi?id=153462

        Reviewed by Alex Christensen.

        This warning indicates that we have a memory leak. From the bison manual:

        "Right-hand side symbols of a rule that explicitly triggers a syntax error via YYERROR are
        not discarded automatically. As a rule of thumb, destructors are invoked only when user
        actions cannot manage the memory."

        Arguably a design error, but that's how it is.

        * css/CSSGrammar.y.in:

2016-01-26  Jer Noble  <jer.noble@apple.com>

        Calling video.controls=true during a scrub operation cancels scrub.
        https://bugs.webkit.org/show_bug.cgi?id=153494

        Reviewed by Eric Carlson.

        Test: media/media-controls-drag-timeline-set-controls-property.html

        Verify that the video.controls attribute actually changed before tearing down and
        re-adding the media controls to the Shadow DOM.

        * Modules/mediacontrols/mediaControlsApple.js:
        (Controller.prototype.handleControlsChange):
        (Controller.prototype.hasControls):

2016-01-26  Jeremy Noble  <jer.noble@apple.com>

        [EME][Mac] Crash in [AVStreamSession addStreamDataParser:]; uncaught exception
        https://bugs.webkit.org/show_bug.cgi?id=153495

        Reviewed by Eric Carlson.

        When AVContentKeySession is not available, fall back to pre-AVContentKeySession behavior;
        namely, immediately create an AVStreamSession object in
        willProvideContentKeyRequestInitializationData, rather than waiting for didProvide.

        * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
        (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):

2016-01-26  Dean Jackson  <dino@apple.com>

        [iOS] Documents without an explicit width should not get fast tapping
        https://bugs.webkit.org/show_bug.cgi?id=153465
        <rdar://problem/23962529>

        Reviewed by Simon Fraser (and Wenson Hseih).

        As the title says, documents that do not set a viewport should
        not get the fast click behaviour. There were complaints that we broke
        double-tap to scroll in ImageDocuments where the image was narrow and long.

        The fix is to just keep a flag that tells the UI process if the
        width was explicit. However, it turns out that those ImageDocuments
        are given an explicit device-width, which is fine for scaling but
        really should behave as auto for fast tapping. So we also need
        to tell the UIProcess if the viewport arguments came from an
        ImageDocument.

        Test: fast/events/ios/viewport-no-width-value-allows-double-tap.html

        * dom/ViewportArguments.cpp:
        (WebCore::findSizeValue): Add a parameter that toggles a flag
        if the size was explicitly set.
        (WebCore::setViewportFeature): Remember if the width was
        explicit.
        * dom/ViewportArguments.h: Add a widthWasExplicit flag.
        (WebCore::ViewportArguments::operator==):

2016-01-25  Dave Hyatt  <hyatt@apple.com>

        Speculative fixes for crashing in viewportChangeAffectedPicture
        https://bugs.webkit.org/show_bug.cgi?id=153450

        Reviewed by Dean Jackson.

        Don't attach any conditions to the removal of a picture element from
        the document's HashSet. This ensures that if the condition is ever
        wrong for any reason, we'll still remove the picture element on
        destruction.

        Fix the media query evaluation to match the other evaluations (used by
        the preload scanner and HTMLImageElement). This includes using the
        document element's computed style instead of our own and also null
        checking the document element first. This is the likely cause of the
        crashes.

        * html/HTMLPictureElement.cpp:
        (WebCore::HTMLPictureElement::~HTMLPictureElement):
        (WebCore::HTMLPictureElement::didMoveToNewDocument):
        (WebCore::HTMLPictureElement::viewportChangeAffectedPicture):

2016-01-26  Chris Dumez  <cdumez@apple.com>

        Make sure a page is still PageCache-able after firing the 'pagehide' events
        https://bugs.webkit.org/show_bug.cgi?id=153449

        Reviewed by Andreas Kling.

        Make sure a page is still PageCache-able after firing the 'pagehide'
        events and abort if it isn't. This should improve robustness and it is
        easy for pagehide event handlers to do things that would make a Page no
        longer PageCache-able and this leads to bugs that are difficult to
        investigate.

        To achieve this, the 'pagehide' event firing logic was moved out of the
        CachedFrame constructor. It now happens earlier in
        PageCache::addIfCacheable() after checking if the page is cacheable and
        before constructing the CachedPage / CachedFrames. After firing the
        'pagehide' event in PageCache::addIfCacheable(), we check again that
        the page is still cacheable and we abort early if it is not.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        * history/PageCache.cpp:
        (WebCore::setInPageCache):
        (WebCore::firePageHideEventRecursively):
        (WebCore::PageCache::addIfCacheable):
        * history/PageCache.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-01-26  Beth Dakin  <bdakin@apple.com>

        Rubber-stamped by Tim Horton.

        Add one more bit of SPI.
        * platform/spi/mac/NSSpellCheckerSPI.h:

2016-01-26  Olivier Blin  <olivier.blin@softathome.com>

        Fix build with ENABLE_DEVICE_ORIENTATION on non-iOS platforms
        https://bugs.webkit.org/show_bug.cgi?id=153490

        Reviewed by Michael Catanzaro.

        This has been broken since r178702, which changed the Page
        argument from a pointer to a reference in logCanCachePageDecision().

        No new tests since this is a build fix.

        * history/PageCache.cpp:
        (WebCore::canCachePage):

2016-01-25  Ada Chan  <adachan@apple.com>

        Move WebVideoFullscreenManager and related classes from iOS specific folders to cocoa folders
        https://bugs.webkit.org/show_bug.cgi?id=153473

        Reviewed by Eric Carlson.

        No new tests, just moving files.

        * WebCore.xcodeproj/project.pbxproj:
        Update due to changes to the file locations.
        * platform/cocoa/WebVideoFullscreenModel.h: Renamed from Source/WebCore/platform/ios/WebVideoFullscreenModel.h.
        * platform/cocoa/WebVideoFullscreenModelVideoElement.h: Renamed from Source/WebCore/platform/ios/WebVideoFullscreenModelVideoElement.h.
        (WebCore::WebVideoFullscreenModelVideoElement::create):
        Fix a style error by moving the opening curly brace down one line.
        * platform/cocoa/WebVideoFullscreenModelVideoElement.mm: Renamed from Source/WebCore/platform/ios/WebVideoFullscreenModelVideoElement.mm.

2016-01-26  Konstantin Tokarev  <annulen@yandex.ru>

        Do not convert GlyphBufferAdvance to FloatSize
        https://bugs.webkit.org/show_bug.cgi?id=153429

        GlyphBufferAdvance is not necessaryly convertible to FloatSize.
        Also, this code was doing extra work by transforming height value.

        Reviewed by Antti Koivisto.

        No new tests needed.

        * rendering/svg/SVGTextRunRenderingContext.cpp:
        (WebCore::SVGGlyphToPathTranslator::extents):

2016-01-22  Ada Chan  <adachan@apple.com>

        Enable API related to the video fullscreen layer in MediaPlayerPrivateAVFoundationObjC
        also on Mac with video presentation mode support.
        https://bugs.webkit.org/show_bug.cgi?id=153222

        Reviewed by Eric Carlson.

        No new tests. Covered by existing tests.

        Introduce VideoFullscreenLayerManager to deal with the video layer when switching
        between inline and fullscreen mode. We'll reuse it in other MediaPlayerPrivateInterface
        implementations.

        Now that MediaPlayerPrivateAVFoundationObjC's platform layer can be a WebVideoContainerLayer,
        this exposes a bug in PlatformCALayerCocoa::clone() where we assumed the platform layer
        is always an AVPlayerLayer if the PlatformCALayer's layer type is LayerTypeAVPlayerLayer.
        Add a helper method to get an AVPlayerLayer from a PlatformCALayerCocoa (which also handles
        WebVideoContainerLayer case) and use it in PlatformCALayerCocoa::clone().

        * WebCore.xcodeproj/project.pbxproj:
        Add VideoFullscreenLayerManager to the project.

        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::MediaPlayerPrivateAVFoundationObjC):
        Create m_videoFullscreenLayerManager. The video inline layer, video fullscreen layer,
        and the video fullscreen frame are now managed by that class.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer):
        Just call VideoFullscreenLayerManager::setVideoLayer() to handle adding the video
        layer in either the inline or fullscreen layer.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer):
        Call VideoFullscreenLayerManager::didDestroyVideoLayer().
        (WebCore::MediaPlayerPrivateAVFoundationObjC::platformLayer):
        Get the video inline layer from VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer):
        Call VideoFullscreenLayerManager::setVideoFullscreenLayer().
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenFrame):
        Call VideoFullscreenLayerManager::setVideoFullscreenFrame().
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenMode):
        Guard the iOS specific code properly.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::updateVideoLayerGravity):
        Get the video fullscreen layer from VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::requiresTextTrackRepresentation):
        Ditto.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::syncTextTrackBounds):
        Get the video fullscreen layer and video fullscreen frame from VideoFullscreenLayerManager.
        (WebCore::MediaPlayerPrivateAVFoundationObjC::setTextTrackRepresentation):
        Get the video fullscreen layer from VideoFullscreenLayerManager.

        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.h: Added.
        (WebCore::VideoFullscreenLayerManager::videoInlineLayer):
        (WebCore::VideoFullscreenLayerManager::videoFullscreenLayer):
        (WebCore::VideoFullscreenLayerManager::videoFullscreenFrame):
        * platform/graphics/avfoundation/objc/VideoFullscreenLayerManager.mm: Added.
        (-[WebVideoContainerLayer setBounds:]):
        (-[WebVideoContainerLayer setPosition:]):
        WebVideoContainerLayer was moved from MediaPlayerPrivateAVFoundationObjC.mm.
        (WebCore::VideoFullscreenLayerManager::create):
        (WebCore::VideoFullscreenLayerManager::VideoFullscreenLayerManager):
        (WebCore::VideoFullscreenLayerManager::setVideoLayer):
        Code moved from MediaPlayerPrivateAVFoundationObjC::createAVPlayerLayer().
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenLayer):
        Code moved from MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenLayer().
        (WebCore::VideoFullscreenLayerManager::setVideoFullscreenFrame):
        Code moved from MediaPlayerPrivateAVFoundationObjC::setVideoFullscreenFrame().
        (WebCore::VideoFullscreenLayerManager::didDestroyVideoLayer):
        Code moved from MediaPlayerPrivateAVFoundationObjC::destroyVideoLayer().

        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.h:
        * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:
        (PlatformCALayerCocoa::clone):
        Use the new PlatformCALayerCocoa::avPlayerLayer() method to get the AVPlayerLayer from both the
        destination and source PlatformCALayers.
        (PlatformCALayerCocoa::avPlayerLayer):
        Return nil if the layer type is not LayerTypeAVPlayerLayer. Otherwise, return the
        platform layer if it is indeed an AVPlayerLayer. If not, it should be a WebVideoContainerLayer
        and we should return its sublayer which should be an AVPlayerLayer.

2016-01-26  Chris Dumez  <cdumez@apple.com>

        First parameter to window.showModalDialog() should be mandatory
        https://bugs.webkit.org/show_bug.cgi?id=153436

        Reviewed by Youenn Fablet.

        Make window.showModalDialog()'s first parameter mandatory to match the
        last specification containing it:
        http://dev.w3.org/html5/spec-preview/user-prompts.html#dialogs-implemented-using-separate-documents

        The new behavior also matches Firefox, while Chrome no longer supports
        this operation.

        With this change, the W3C HTML test suite no longer hangs in the middle
        because it mistakenly pops up a modal dialog during testing.

        Test: fast/dom/Window/showModalDialog-mandatory-parameter.html

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::JSDOMWindow::showModalDialog):

2016-01-26  Eric Carlson  <eric.carlson@apple.com>

        LayoutTest media/airplay-target-availability.html is flaky
        https://bugs.webkit.org/show_bug.cgi?id=153100
        <rdar://problem/24346796>

        Reviewed by Daniel Bates.

        No new tests, media/airplay-target-availability.html was updated

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::WebMediaSessionManager::clientStateDidChange): Schedule a configuration scan if
          any of the config flags have changed.
        (WebCore::WebMediaSessionManager::configurePlaybackTargetMonitoring): Update logging.

2016-01-25  Carlos Garcia Campos  <cgarcia@igalia.com>

        Main frame scrollbars not updated on hovering when using overlay scrollbars
        https://bugs.webkit.org/show_bug.cgi?id=153304

        Reviewed by Michael Catanzaro.

        Legacy scrollbars were fixed in r194155, but overlay scrollbars
        are not notified when they are hovered. This is because the layer
        hit test in RenderView::hitTest always returns true when using
        overlay scrollbars and we are returning early in such case,
        ignoring the HitTestRequest::AllowFrameScrollbars flag. So, in
        case of using overlay scrollbars we still need to check the
        RenderView scrollbars even when the layer hit test succeeded.

        * rendering/RenderView.cpp:
        (WebCore::RenderView::hitTest):

2016-01-26  Daniel Bates  <dabates@apple.com>

        LayoutTest http/tests/security/xssAuditor/embed-tag-in-path-unterminated.html crashing
        https://bugs.webkit.org/show_bug.cgi?id=153250
        <rdar://problem/12172843>
        And
        <rdar://problem/24248040>

        Reviewed by Alexey Proskuryakov.

        Remove an incorrect assertion that the absolute URL associated with a protection space cannot
        contain consecutive forward slash (/) characters. A URL can contain consecutive forward slashes.
        This also makes the invariants for CredentialStorage::findDefaultProtectionSpaceForURL() symmetric
        with the invariants for WebCore::protectionSpaceMapKeyFromURL().

        Tests: http/tests/loading/basic-auth-load-URL-with-consecutive-slashes.html
               http/tests/xmlhttprequest/basic-auth-load-URL-with-consecutive-slashes.html

        * platform/network/CredentialStorage.cpp:
        (WebCore::CredentialStorage::findDefaultProtectionSpaceForURL):

2016-01-26  Daniel Bates  <dabates@apple.com>

        Remove XMLHttpRequestException
        https://bugs.webkit.org/show_bug.cgi?id=102698
        <rdar://problem/24338476>

        Reviewed by Chris Dumez.

        Inspired by a patch by Erik Arvidsson.

        As per <https://xhr.spec.whatwg.org> (21 January 2016) and <https://html.spec.whatwg.org/multipage/workers.html#dom-workerglobalscope-importscripts> (25 January 2016)
        XMLHttpRequest and WorkerGlobalScope.importScripts() should throw a DOMException object instead
        of a XMLHttpRequestException object when a NetworkError, AbortError, or TimeoutError occur. This
        makes the behavior of WebKit more closely conform to these standards as well as the behavior of
        other browsers.

        * CMakeLists.txt: Remove entries for XMLHttpRequestException.idl and XMLHttpRequestException.cpp.
        * DerivedSources.make: Remove entry for XMLHttpRequestException.idl.
        * WebCore.order: Remove exported symbols for XMLHttpRequestException.
        * WebCore.vcxproj/WebCore.vcxproj: Remove entries for JSXMLHttpRequestException.{cpp, h}, XMLHttpRequestException.{cpp, h}
        * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
        * WebCore.xcodeproj/project.pbxproj: Ditto.
        * bindings/js/JSExceptionBase.cpp:
        (WebCore::toExceptionBase): Remove logic for XMLHttpRequestException.
        * dom/DOMExceptions.in: Remove entry for XMLHttpRequestException.
        * workers/WorkerGlobalScope.cpp:
        (WebCore::WorkerGlobalScope::importScripts): Throw DOMException.NETWORK_ERR instead of XMLHttpRequestException.NETWORK_ERR.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Ditto.
        (WebCore::XMLHttpRequest::didFail): Throw DOMException.ABORT_ERR instead of XMLHttpRequestException.ABORT_ERR.
        (WebCore::XMLHttpRequest::didReachTimeout): Throw DOMException.TIMEOUT_ERR instead of XMLHttpRequestException.TIMEOUT_ERR.
        * xml/XMLHttpRequestException.cpp: Removed.
        * xml/XMLHttpRequestException.h: Removed.
        * xml/XMLHttpRequestException.idl: Removed.

2016-01-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        WebCoreJSBuiltins do not use to do conditional include
        https://bugs.webkit.org/show_bug.cgi?id=153306

        Reviewed by Alex Christensen.

        Removing compilation guards as builtin generator adds them in the files themselves.
        Fixing MediaDevices.js to generate MEDIA_STREAM compilation guard.

        No change in behavior.

        * Modules/mediastream/MediaDevices.js: Changing @optional to @conditional.
        * Modules/mediastream/NavigatorUserMedia.js: Making it @conditional.
        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:

2016-01-25  Alex Christensen  <achristensen@webkit.org>

        Fix internal Windows build
        https://bugs.webkit.org/show_bug.cgi?id=153469

        Reviewed by Brent Fulgham.

        * CMakeLists.txt:
        Pass the GPERF_EXECUTABLE that we found to perl scripts so they can use it instead of just calling gperf.
        This is needed for builds where gperf is not in the PATH.
        * DerivedSources.make:
        Pass "gperf" as the gperf command to retain existing functionality on mac.
        * bindings/scripts/preprocess-idls.pl:
        (CygwinPathIfNeeded):
        * bindings/scripts/preprocessor.pm:
        (applyPreprocessor):
        Add /cygdrive/c/cygwin/bin to the PATH before calling cygpath.
        This is needed for builds where we are using cygwin, but C:/cygwin/bin is not in the PATH.
        * css/makeSelectorPseudoClassAndCompatibilityElementMap.py:
        * css/makeSelectorPseudoElementsMap.py:
        * css/makeprop.pl:
        * platform/network/create-http-header-name-table:
        Use the gperf executable passed in as a command line parameter if it is given.

2016-01-25  Simon Fraser  <simon.fraser@apple.com>

        DisplayList items can log paths now
        https://bugs.webkit.org/show_bug.cgi?id=153417

        Reviewed by Zalan Bujtas.

        Now that Path supports TextStream logging, clean up its output a little and
        enable dumping of Paths in DisplayListItems.

        * platform/graphics/Path.cpp:
        (WebCore::operator<<):
        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::operator<<):

2016-01-25  Antti Koivisto  <antti@apple.com>

        Fix the comment.

        * rendering/style/RenderStyle.h:

2016-01-25  Enrica Casucci  <enrica@apple.com>

        Add support for DataDetectors in WK (iOS).
        https://bugs.webkit.org/show_bug.cgi?id=152989
        rdar://problem/22855960

        Reviewed by Tim Horton.

        Adding new helper functions for data detection related tasks.
        The patch also fixes a bug when creating DOM ranges from DDQueryRange
        spanning multiple fragments.

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::DataDetection::isDataDetectorLink):
        (WebCore::DataDetection::dataDetectorIdentifier):
        (WebCore::detectItemAtPositionWithRange):
        (WebCore::DataDetection::detectItemAroundHitTestResult):
        (WebCore::resultIsURL):
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):
        (WebCore::DataDetection::detectContentInRange):

2016-01-25  Myles C. Maxfield  <mmaxfield@apple.com>

        Remove broken cache from CSSFontFaceSource
        https://bugs.webkit.org/show_bug.cgi?id=153440

        Reviewed by Simon Fraser.

        This cache has been broken since 2013 (r158085). Given we didn't notice a perf
        hit when it broke, and the fact it's been broken for years, it clearly isn't
        necessary.

        https://bugs.webkit.org/show_bug.cgi?id=153414 consists of a fairly invasive
        change to CSSFontFaceSource; this patch includes a working version of this
        cache, along with an easy way to enable/disable it (to measure possible perf
        changes).

        This patch is a short-term cleanup patch in the mean time until the above
        invasive change gets landed.

        No new tests because there is no behavior (or performance!) change.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        (WebCore::CSSFontFaceSource::~CSSFontFaceSource): Deleted.
        (WebCore::CSSFontFaceSource::pruneTable): Deleted.
        (WebCore::CSSFontFaceSource::fontLoaded): Deleted.
        * css/CSSFontFaceSource.h:

2016-01-25  Sam Weinig  <sam@webkit.org>

        Try to fix the simulator build.

        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-01-25  Sam Weinig  <sam@webkit.org>

        Roll back in r195559 with a build fix.

        * WebCore.xcodeproj/project.pbxproj:
        * editing/cocoa/DataDetection.mm:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm: Added.
        * platform/cocoa/DataDetectorsCoreSoftLink.h: Added.
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-01-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195559.
        https://bugs.webkit.org/show_bug.cgi?id=153458

        This change broke the iOS build (Requested by ryanhaddad on
        #webkit).

        Reverted changeset:

        "Fix the ASAN build."
        http://trac.webkit.org/changeset/195559

2016-01-25  Antti Koivisto  <antti@apple.com>

        Resolving direction and writing mode properties should not mutate document
        https://bugs.webkit.org/show_bug.cgi?id=153446

        Reviewed by Andreas Kling.

        Replace directionSetOnDocumentElement/writingModeSetOnDocumentElement document flags them with style flags.

        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyValueDirection):
        (WebCore::StyleBuilderCustom::resetEffectiveZoom):
        (WebCore::StyleBuilderCustom::applyValueWebkitWritingMode):
        (WebCore::StyleBuilderCustom::applyValueWebkitTextOrientation):
        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::styleForElement):
        * dom/Document.cpp:
        (WebCore::Document::Document):
        * dom/Document.h:
        (WebCore::Document::markers):
        (WebCore::Document::directionSetOnDocumentElement): Deleted.
        (WebCore::Document::writingModeSetOnDocumentElement): Deleted.
        (WebCore::Document::setDirectionSetOnDocumentElement): Deleted.
        (WebCore::Document::setWritingModeSetOnDocumentElement): Deleted.
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::styleDidChange):
        * rendering/style/RenderStyle.h:
        * style/StyleResolveForDocument.cpp:
        (WebCore::Style::resolveForDocument):

2016-01-25  Sam Weinig  <sam@webkit.org>

        Fix the ASAN build.

        * WebCore.xcodeproj/project.pbxproj:
        * editing/cocoa/DataDetection.mm:
        * platform/cocoa/DataDetectorsCoreSoftLink.mm: Added.
        * platform/cocoa/DataDetectorsCoreSoftLink.h: Added.
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:

2016-01-25  Alex Christensen  <achristensen@webkit.org>

        [Win] Another build fix after r195545

        * CMakeLists.txt:
        r195548 didn't change all the pre-builds back to post-builds.

2016-01-25  Alex Christensen  <achristensen@webkit.org>

        [Win] Fix clean build after r195545.

        * CMakeLists.txt:
        * PlatformWin.cmake:
        I got a little carried away.  WebCore already had a pre-build event.  It was correct before r195545.

2016-01-25  Beth Dakin  <bdakin@apple.com>

        Handle soft spaces after accepted candidates
        https://bugs.webkit.org/show_bug.cgi?id=153331
        -and corresponding-
        rdar://problem/23958418

        Reviewed by Darin Adler.

        Candidates now come with built-in spaces, so we should not insert a space for 
        them.
        * editing/Editor.cpp:
        (WebCore::Editor::handleAcceptedCandidate):

        New SPI to properly handle these soft spaces.
        * platform/spi/mac/NSSpellCheckerSPI.h:

2016-01-25  Alex Christensen  <achristensen@webkit.org>

        [Win] Copy forwarding headers before building a project
        https://bugs.webkit.org/show_bug.cgi?id=153434

        Reviewed by Brent Fulgham.

        * CMakeLists.txt:
        * PlatformWin.cmake:

2016-01-25  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement getIndexRecord in the SQLite backing store.
        https://bugs.webkit.org/show_bug.cgi?id=153425

        Reviewed by Darin Adler.

        No new tests (Some failures now pass, other failures progressed closer to passing).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):

2016-01-25  Eric Carlson  <eric.carlson@apple.com>

        Media "ended" event incorrectly fires when currentTime is set
        https://bugs.webkit.org/show_bug.cgi?id=150348
        <rdar://problem/24247974>

        Reviewed by Jer Noble.

        Test: media/media-ended-fired-once.html

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::invalidateCachedTime): Always mark m_cachedTime as invalid.

2016-01-25  Konstantin Tokarev  <annulen@yandex.ru>

        Do not convert GlyphBufferAdvance to FloatSize
        https://bugs.webkit.org/show_bug.cgi?id=153421

        Reviewed by Simon Fraser.

        No new tests needed.

        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::DrawGlyphs::computeBounds):

2016-01-22  Ryosuke Niwa  <rniwa@webkit.org>

        document.createElement should be able to create a custom element
        https://bugs.webkit.org/show_bug.cgi?id=153173

        Reviewed by Darin Adler.

        Added the support for constructing a custom element via document.createElement.

        Extracted HTMLElementFactory::createKnownElement, which returns nullptr when the specified name doesn't match
        any builtin element instead of out of HTMLUnknownElement, out of HTMLElementFactory::createElement.

        Test: fast/custom-elements/Document-createElement.html

        * bindings/js/JSCustomElementInterface.cpp:
        (WebCore::JSCustomElementInterface::constructHTMLElement): Added. Constructs a custom element by invoking its
        constructor. We allow exceptions to be thrown by the constructor so the caller is responsible for checking
        any exceptions in the ExecState before preceeding if the returned value is null.

        * bindings/js/JSCustomElementInterface.h:
        (WebCore::JSCustomElementInterface::constructSVGElement): Added.
        * bindings/js/JSElementCustom.cpp:
        (WebCore::toJSNewlyCreated): Exit early if the element is a custom element as the wrapper had already been
        created by super() call inside the custom element'c constructor.

        * bindings/js/JSMainThreadExecState.h:
        (WebCore::JSMainThreadExecState):
        * bindings/js/JSMainThreadExecStateInstrumentation.h:
        (WebCore::JSMainThreadExecState::instrumentFunctionInternal): Generalized from instrumentFunctionCall so that
        we can use it for both call and construct.
        (WebCore::JSMainThreadExecState::instrumentFunctionCall): Specialized the above function for call.
        (WebCore::JSMainThreadExecState::instrumentFunctionConstruct): Ditto for construct.

        * dom/CustomElementDefinitions.cpp:
        (WebCore::CustomElementDefinitions::findInterface): Added.
        * dom/CustomElementDefinitions.h:

        * dom/Document.cpp:
        (WebCore::createHTMLElementWithNameValidation): Extracted from createElement.
        (WebCore::Document::createElementForBindings): Renamed from createElement. Specifies
        ShouldCreateCustomElement::Create to create a custom element before using fallback elements.
        * dom/Document.h:
        * dom/Document.idl:

        * dom/Node.h:
        (WebCore::Node::isCustomElement): Added. This flag is used to identify a custom element.
        (WebCore::Node::setIsCustomElement): Added.

        * dom/make_names.pl: Extracted createKnownElement from createElement for createHTMLElementWithNameValidation.

        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::createInspectorStyleSheetForDocument): Use qualified name object to instantiate
        a style element and set type content attribute.
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setNodeName): Use createElementForBindings here since we might be creating an
        arbitrary element here. Also use RefPtr instead of raw pointers while mutating DOM for safety.

2016-01-25  Carlos Garcia Campos  <cgarcia@igalia.com>

        REGRESSION(r192773): [GTK] maps.google.com unresponsive/stalls since r192773
        https://bugs.webkit.org/show_bug.cgi?id=153194

        Reviewed by Michael Catanzaro.

        In r192773 we implemented the JavaScriptCore garbage collector
        timers for the GTK+ port. Those timers schedule sources in the
        current thread default main context, but JS web worker threads
        implementation doesn't use WTF::RunLoop, but its own WorkerRunLoop
        class that doesn't create a GMainContext for the new thread. This
        means that for web sites using workers, we are now doing garbage
        collection of worker VMs in the main thread which ends up in a
        deadlock at some point. We need to ensure that worker threads
        create a GMainContext and push it as the default one for the
        thread before the WorkerGlobalScope is created. This way when the
        worker Heap is created, the GC timers use the right context to
        schedule their sources. And then we need to check if there are
        sources pending in the thread main context on every worker run
        loop iteration.

        * workers/WorkerRunLoop.cpp:
        (WebCore::WorkerRunLoop::runInMode):
        * workers/WorkerThread.cpp:
        (WebCore::WorkerThread::workerThread):

2016-01-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195533.
        https://bugs.webkit.org/show_bug.cgi?id=153423

        It is again breaking builds of several ports (Requested by
        youenn on #webkit).

        Reverted changeset:

        "WebCoreJSBuiltins do not use to do conditional include"
        https://bugs.webkit.org/show_bug.cgi?id=153306
        http://trac.webkit.org/changeset/195533

2016-01-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        WebCoreJSBuiltins do not use to do conditional include
        https://bugs.webkit.org/show_bug.cgi?id=153306

        Reviewed by Alex Christensen.

        Removing compilation guards as builtin generator adds them in the files themselves.
        Fixing MediaDevices.js to generate MEDIA_STREAM compilation guard.

        No change in behavior.

        * Modules/mediastream/MediaDevices.js: Changing @optional to @conditional.
        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:

2016-01-25  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195531.
        https://bugs.webkit.org/show_bug.cgi?id=153420

        It is breaking builds of several ports (Requested by youenn on
        #webkit).

        Reverted changeset:

        "WebCoreJSBuiltins do not use to do conditional include"
        https://bugs.webkit.org/show_bug.cgi?id=153306
        http://trac.webkit.org/changeset/195531

2016-01-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        WebCoreJSBuiltins do not use to do conditional include
        https://bugs.webkit.org/show_bug.cgi?id=153306

        Reviewed by Alex Christensen.

        Removing compilation guards as builtin generator adds them in the files themselves.

        No change in behavior.

        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:

2016-01-25  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement Fetch API Headers
        https://bugs.webkit.org/show_bug.cgi?id=152384

        Reviewed by Darin Adler.

        Adding Fetch Headers API as a wapper around HTTPHeaderMap.

        Tests: imported/w3c/web-platform-tests/fetch/api/headers/headers-basic.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-casing.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-errors.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-idl.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-nameshake.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-normalize.html
               imported/w3c/web-platform-tests/fetch/api/headers/headers-structure.html

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * Modules/fetch/FetchHeaders.cpp: Added.
        (WebCore::FetchHeaders::initializeWith):
        (WebCore::isForbiddenHeaderName):
        (WebCore::isForbiddenResponseHeaderName):
        (WebCore::isSimpleHeader):
        (WebCore::canWriteHeader):
        (WebCore::FetchHeaders::append):
        (WebCore::FetchHeaders::remove):
        (WebCore::FetchHeaders::get):
        (WebCore::FetchHeaders::has):
        (WebCore::FetchHeaders::set):
        * Modules/fetch/FetchHeaders.h: Added.
        (WebCore::FetchHeaders::create):
        (WebCore::FetchHeaders::~FetchHeaders):
        (WebCore::FetchHeaders::internalHeaders):
        (WebCore::FetchHeaders::FetchHeaders):
        * Modules/fetch/FetchHeaders.idl: Added.
        * Modules/fetch/FetchHeaders.js: Added.
        (initializeFetchHeaders):
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/WebCoreBuiltinNames.h:
        * bindings/js/WebCoreJSBuiltins.cpp:
        * bindings/js/WebCoreJSBuiltins.h:
        (WebCore::JSBuiltinFunctions::JSBuiltinFunctions):
        (WebCore::JSBuiltinFunctions::fetchHeadersBuiltins):
        * platform/network/HTTPHeaderMap.cpp:
        (WebCore::HTTPHeaderMap::contains):
        (WebCore::HTTPHeaderMap::remove):
        * platform/network/HTTPHeaderMap.h:

2016-01-22  Sergio Villar Senin  <svillar@igalia.com>

        [css-grid] grid shorthand must reset gap properties to their initial values
        https://bugs.webkit.org/show_bug.cgi?id=153354

        Reviewed by Darin Adler.

        Both 'grid-row-gap' & 'grid-column-gap' are considered reset-only subproperties of the
        'grid' shorthand meaning that, even thought the shorthand does not offer a way to set
        their values, it must in any case reset them to the initial ones.

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseGridShorthand):
        * css/CSSPropertyNames.in:

2016-01-24  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement deleteIndex and getCount for the SQLite backing store.
        https://bugs.webkit.org/show_bug.cgi?id=153415

        Reviewed by Darin Adler.

        No new tests (Handful of tests now pass, improvements on a handful of others).

        * Modules/indexeddb/server/IDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryIDBBackingStore.cpp:
        (WebCore::IDBServer::MemoryIDBBackingStore::deleteIndex):
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        
        * Modules/indexeddb/server/MemoryObjectStore.cpp:
        (WebCore::IDBServer::MemoryObjectStore::takeIndexByIdentifier):
        (WebCore::IDBServer::MemoryObjectStore::deleteIndex):
        (WebCore::IDBServer::MemoryObjectStore::deleteAllIndexes):
        (WebCore::IDBServer::MemoryObjectStore::takeIndexByName): Deleted.
        * Modules/indexeddb/server/MemoryObjectStore.h:
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getCount):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::maybeCreateBackingStoreCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:
        
        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::maybeOpenBackingStoreCursor):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::deleteIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::performDeleteIndex):
        (WebCore::IDBServer::UniqueIDBDatabase::didPerformDeleteIndex):
        * Modules/indexeddb/server/UniqueIDBDatabase.h:
        
        * Modules/indexeddb/shared/IDBObjectStoreInfo.cpp:
        (WebCore::IDBObjectStoreInfo::deleteIndex):
        * Modules/indexeddb/shared/IDBObjectStoreInfo.h:

2016-01-24  Brady Eidson  <beidson@apple.com>

        Unreviewed, speculative fix for:
        Modern IDB: Some IDB tests crash in ~SQLiteIDBBackingStore
        https://bugs.webkit.org/show_bug.cgi?id=153418

        No new tests.

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::~SQLiteIDBBackingStore): Clear the global object
          before wiping out the VM.

2016-01-24  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

        Reduce PassRefPtr uses in dom - 4
        https://bugs.webkit.org/show_bug.cgi?id=153270

        Reviewed by Darin Adler.

        As a step to remove PassRefPtr uses, this patch reduces the uses in WebCore/dom.

        * bindings/js/JSDeviceMotionEventCustom.cpp:
        (WebCore::JSDeviceMotionEvent::initDeviceMotionEvent):
        * dom/DeviceMotionData.cpp:
        (WebCore::DeviceMotionData::create):
        (WebCore::DeviceMotionData::DeviceMotionData):
        * dom/DeviceMotionData.h:
        * dom/Document.cpp:
        (WebCore::Document::setBodyOrFrameset):
        (WebCore::Document::setFocusedElement):
        (WebCore::Document::setDecoder):
        (WebCore::Document::pushCurrentScript):
        * dom/Document.h:
        * dom/Event.cpp:
        (WebCore::Event::cloneFor):
        * dom/Event.h:
        * dom/MouseEvent.cpp:
        (WebCore::MouseEvent::cloneFor):
        * dom/MouseEvent.h:
        * dom/NodeIterator.cpp:
        (WebCore::NodeIterator::NodePointer::NodePointer):
        (WebCore::NodeIterator::NodeIterator):
        * dom/NodeIterator.h:
        (WebCore::NodeIterator::create):
        * html/RadioInputType.cpp:
        (WebCore::RadioInputType::handleKeydownEvent):
        * platform/ios/DeviceMotionClientIOS.mm:
        (WebCore::DeviceMotionClientIOS::motionChanged):
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::createDocumentFromSource):

2016-01-24  Myles C. Maxfield  <mmaxfield@apple.com>

        [Font Loading] General cleanup
        https://bugs.webkit.org/show_bug.cgi?id=153403

        Reviewed by Darin Adler.

        It turns out that CSSFontFaceSource::m_hasExternalSVGFont exactly equals
        whether or not CSSFontFaceSource::m_font is a CachedSVGFont. Therefore,
        the variable is redundant.

        In addition, it was being passed to functions on CSSFontFaceSource::m_font,
        which means it was always true inside the CachedSVGFont subclass and
        always false for the CachedFont. Therefore, there is no reason pass this
        variable to these functions because its value can be determined at
        authorship time.

        No new tests because there is no behavior change.

        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font):
        (WebCore::CSSFontFaceSource::CSSFontFaceSource): Deleted.
        * css/CSSFontFaceSource.h:
        * css/CSSFontSelector.cpp:
        (WebCore::createFontFace):
        * loader/cache/CachedFont.cpp:
        (WebCore::CachedFont::ensureCustomFontData):
        (WebCore::CachedFont::createFont):
        * loader/cache/CachedFont.h:
        * loader/cache/CachedSVGFont.cpp:
        (WebCore::CachedSVGFont::createFont):
        (WebCore::CachedSVGFont::ensureCustomFontData):
        * loader/cache/CachedSVGFont.h:
        * platform/network/HTTPParsers.cpp:
        (WebCore::isValidHTTPToken):
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::uppercaseKnownHTTPMethod):

2016-01-24  Chris Dumez  <cdumez@apple.com>

        An XMLDocument interface should be exposed on the global Window object
        https://bugs.webkit.org/show_bug.cgi?id=153378
        <rdar://problem/24315465>

        Reviewed by Darin Adler.

        Expose an XMLDocument interface on the global Window object, as per:
        - https://dom.spec.whatwg.org/#xmldocument

        DOMImplementation.createDocument() now returns an XMLDocument instead
        of a Document, as per:
        - https://dom.spec.whatwg.org/#dom-domimplementation-createdocument

        Previously, WebKit would alias XMLDocument to Document which caused
        some W3C tests to fail.

        Chrome and Firefox already match the specification here.

        No new tests, already covered by existing tests.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.vcxproj/WebCore.vcxproj.filters:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::createNewDocumentWrapper):
        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createDocument):
        * dom/DOMImplementation.h:
        * dom/DOMImplementation.idl:
        * dom/Document.cpp:
        (WebCore::Document::cloneDocumentWithoutChildren):
        * dom/Document.h:
        (WebCore::Document::isXMLDocument):
        (WebCore::Document::create): Deleted.
        (WebCore::Document::createNonRenderedPlaceholder): Deleted.
        * dom/XMLDocument.h: Added.
        (WebCore::XMLDocument::create):
        (WebCore::XMLDocument::createXHTML):
        (WebCore::XMLDocument::XMLDocument):
        (isType):
        * dom/XMLDocument.idl: Added.
        * inspector/DOMPatchSupport.cpp:
        (WebCore::DOMPatchSupport::patchDocument):
        * inspector/InspectorDOMAgent.cpp:
        (WebCore::InspectorDOMAgent::setOuterHTML):
        * page/DOMWindow.idl:
        * page/PageSerializer.cpp:
        (WebCore::SerializerMarkupAccumulator::SerializerMarkupAccumulator):
        * svg/SVGDocument.cpp:
        (WebCore::SVGDocument::SVGDocument):
        * svg/SVGDocument.h:
        * svg/SVGDocument.idl:
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::responseXML):
        * xml/XSLTProcessor.cpp:
        (WebCore::XSLTProcessor::createDocumentFromSource):

2016-01-24  Brady Eidson  <beidson@apple.com>

        Modern IDB: Support IDBObjectStore.createIndex in the SQLite backing store.
        https://bugs.webkit.org/show_bug.cgi?id=153410

        Reviewed by Darin Adler.

        No new tests (Covered by unskipping many existing tests).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::~SQLiteIDBBackingStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedHasIndexRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::uncheckedPutIndexRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

        * Modules/indexeddb/server/SQLiteIDBCursor.cpp:
        (WebCore::IDBServer::SQLiteIDBCursor::maybeCreateBackingStoreCursor):
        (WebCore::IDBServer::SQLiteIDBCursor::SQLiteIDBCursor):
        * Modules/indexeddb/server/SQLiteIDBCursor.h:

        * Modules/indexeddb/server/SQLiteIDBTransaction.cpp:
        (WebCore::IDBServer::SQLiteIDBTransaction::maybeOpenBackingStoreCursor):
        * Modules/indexeddb/server/SQLiteIDBTransaction.h:

2016-01-24  Simon Fraser  <simon.fraser@apple.com>

        Make the dumped display list representation a bit more compact
        https://bugs.webkit.org/show_bug.cgi?id=153409

        Reviewed by Zalan Bujtas.

        Don't make a group for every display list item.

        * platform/graphics/displaylists/DisplayList.cpp:
        (WebCore::DisplayList::DisplayList::asText):

2016-01-24  Simon Fraser  <simon.fraser@apple.com>

        Add testing for display list replay, and skip clipped-out items on replay
        https://bugs.webkit.org/show_bug.cgi?id=153408

        Reviewed by Zalan Bujtas.
        
        Make it possible to save and serialize a DisplayList of Items which were
        actually applied on replay, so that replay-time optimizations can be tested.
        
        This exposes internals.setElementTracksDisplayListReplay() and
        internals.replayDisplayListForElement().
        
        Do a trivial replay-time optimization, which is to skip items whose extents are
        outside the replay clip.

        Test: displaylists/replay-skip-clipped-rect.html

        * platform/graphics/GraphicsLayer.cpp:
        (WebCore::GraphicsLayer::GraphicsLayer):
        * platform/graphics/GraphicsLayer.h:
        (WebCore::GraphicsLayer::setIsTrackingDisplayListReplay):
        (WebCore::GraphicsLayer::isTrackingDisplayListReplay):
        (WebCore::GraphicsLayer::replayDisplayListAsText):
        * platform/graphics/ca/GraphicsLayerCA.cpp:
        (WebCore::layerDisplayListMap): Use a singleton map to store the replay display lists
        to avoid bloating GraphicsLayerCA for test-only code. The map stores a pair of the
        replay list and a clip rect, which are both dumped. Dumping the clip rect ensures that
        we're reporting the replay for the correct tile in a test (since there will be a replay
        for each tile).
        (WebCore::GraphicsLayerCA::~GraphicsLayerCA):
        (WebCore::GraphicsLayerCA::platformCALayerPaintContents):
        (WebCore::GraphicsLayerCA::setIsTrackingDisplayListReplay):
        (WebCore::GraphicsLayerCA::replayDisplayListAsText):
        * platform/graphics/ca/GraphicsLayerCA.h:
        * platform/graphics/displaylists/DisplayList.h:
        (WebCore::DisplayList::DisplayList::appendItem):
        * platform/graphics/displaylists/DisplayListReplayer.cpp:
        (WebCore::DisplayList::Replayer::replay): In the unlikely event of tracking replays,
        allocate a new DisplayList and append to it items which actually get applied.
        * platform/graphics/displaylists/DisplayListReplayer.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::setIsTrackingDisplayListReplay):
        (WebCore::RenderLayerBacking::replayDisplayListAsText):
        * rendering/RenderLayerBacking.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setElementTracksDisplayListReplay):
        (WebCore::Internals::replayDisplayListForElement):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-01-23  Wonchul Lee  <wonchul.lee@collabora.co.uk>

        [GTK] Fix media controls displaying without controls attribute
        https://bugs.webkit.org/show_bug.cgi?id=152500

        Media controls is not displayed without controls attribute by default
        when the video element has text track. It'll be displayed on fullscreen
        regardless of controls attribute.

        Reviewed by Michael Catanzaro.

        * Modules/mediacontrols/mediaControlsGtk.js:
        (ControllerGtk.prototype.shouldHaveControls):
        (ControllerGtk.prototype.reconnectControls):
        (ControllerGtk.prototype.removeControls):
        (ControllerGtk.prototype.configureControls): Deleted.
2016-01-23  Alex Christensen  <achristensen@webkit.org>

        Use credentials from a URL with NetworkSession like we did with ResourceHandle
        https://bugs.webkit.org/show_bug.cgi?id=153328

        Reviewed by Alexey Proskuryakov.

        This patch fixes at least http/tests/xmlhttprequest/basic-auth-credentials-escaping.html when using NetworkSession.

        * platform/network/ProtectionSpaceBase.h:
        (WebCore::ProtectionSpaceBase::encodingRequiresPlatformData):
        * platform/network/ResourceRequestBase.h:
        Add some WEBCORE_EXPORT macros for functions that are now used in WebKit2.

2016-01-23  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement clearing object stores and opening cursors in the SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153396

        Reviewed by Alex Christensen.

        No new tests (Some failing tests now pass, others improved).

        Copy more LegacyIDB SQLite backend code over to the new SQLite backend.
        
        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::clearObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::openCursor):
        (WebCore::IDBServer::SQLiteIDBBackingStore::iterateCursor):

2016-01-22  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r195493.
        https://bugs.webkit.org/show_bug.cgi?id=153397

        Broke authenticaiton tests (leaks credentials) (Requested by
        ap on #webkit).

        Reverted changeset:

        "LayoutTest http/tests/security/xssAuditor/embed-tag-in-path-
        unterminated.html crashing"
        https://bugs.webkit.org/show_bug.cgi?id=153250
        http://trac.webkit.org/changeset/195493

2016-01-20  Ryosuke Niwa  <rniwa@webkit.org>

        HTMLElement::nodeName should not upper case non-ASCII characters
        https://bugs.webkit.org/show_bug.cgi?id=153231

        Reviewed by Darin Adler.

        Use the newly added convertToASCIIUppercase to generate the string for tagName and nodeName.

        Test: fast/dom/Element/tagName-must-be-ASCII-uppercase-in-HTML-document.html

        * dom/QualifiedName.cpp:
        (WebCore::QualifiedName::localNameUpper): Use convertToASCIIUppercase.
        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::nodeName): Use convertToASCIIUppercase.

2016-01-22  Brady Eidson  <beidson@apple.com>

        Modern IDB: Disable simultaneous transactions in the SQLite backend for now.
        https://bugs.webkit.org/show_bug.cgi?id=153381

        Reviewed by Alex Christensen.

        No new tests (This resolves many of the currently crashing/asserting tests).

        Right now we're porting the Legacy IDB SQLite backend to Modern IDB.
        
        The way the Legacy backend works is restricted to one transaction at a time.
        
        There's many tricks we can play to resolve this, but that task is better performed
        once all of the basic functionality is done.
        
        Fixing this limitation is covered by https://bugs.webkit.org/show_bug.cgi?id=153382

        * Modules/indexeddb/server/IDBBackingStore.h: Add a "supports simultaneous transactions" getter.
        * Modules/indexeddb/server/MemoryIDBBackingStore.h:
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:
        
        * Modules/indexeddb/server/UniqueIDBDatabase.cpp:
        (WebCore::IDBServer::UniqueIDBDatabase::deleteBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::openBackingStore):
        (WebCore::IDBServer::UniqueIDBDatabase::enqueueTransaction):
        (WebCore::IDBServer::UniqueIDBDatabase::takeNextRunnableTransaction): If the backing store does
          not support simultaneous transactions but there is a transaction in progress, return.
        * Modules/indexeddb/server/UniqueIDBDatabase.h:

2016-01-22  Chris Dumez  <cdumez@apple.com>

        document.charset should be an alias for document.characterSet
        https://bugs.webkit.org/show_bug.cgi?id=153367

        Reviewed by Ryosuke Niwa.

        document.charset should be an alias for document.characterSet:
        - https://dom.spec.whatwg.org/#dom-document-charset

        It should also be read-only.

        Chrome matches the specification.

        No new tests, already covered by existing tests.

        * dom/Document.h:
        * dom/Document.idl:

2016-01-22  Chris Dumez  <cdumez@apple.com>

        Document.open / Document.write should be prevented while the document is being unloaded
        https://bugs.webkit.org/show_bug.cgi?id=153255
        <rdar://problem/22741293>

        Reviewed by Ryosuke Niwa.

        Document.open / Document.write should be prevented while the document
        is being unloaded, as per the HTML specification:
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)

        This patch is aligning our behavior with the specification and Firefox.
        Calling Document.open / Document.write during the document was being
        unloaded would cause us to crash as this was unexpected.

        Tests: fast/frames/page-hide-document-open.html
               fast/frames/page-unload-document-open.html

        * WebCore.xcodeproj/project.pbxproj:
        Add new IgnoreOpensDuringUnloadCountIncrementer.h header.

        * dom/Document.cpp:
        (WebCore::Document::open):
        Abort if the document's ignore-opens-during-unload counter is greater
        than zero, as per:
        https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)

        (WebCore::Document::write):
        Abort if the insertion point is undefined and the document's
        ignore-opens-during-unload counter is greater than zero, as per:
        https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)

        * dom/Document.h:
        Add data member to maintain the document's ignore-opens-during-unload counter:
        https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter

        * dom/IgnoreOpensDuringUnloadCountIncrementer.h: Added.
        Add utility class to increment / decrement a document's
        ignore-opens-during-unload counter.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        When a page goes into PageCache, we don't end up calling
        FrameLoader::detachChildren() so we need to increment the document's
        ignore-opens-during-unload counter before calling stopLoading() on each
        subframe.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::detachChildren):
        detachChildren() will end up firing the pagehide / unload events in each
        child frame so we increment the parent frame's document's
        ignore-opens-during-unload counter. This behavior matches the text of:
        https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document

        As per the spec, the document's ignore-opens-during-unload counter should
        be incremented before firing the pagehide / unload events at the document's
        Window object. It should be decremented only after firing the pagehide /
        unload events in each subframe. This is needed in case a subframe tries to
        call document.open / document.write on a parent frame's document, from its
        pagehide or unload handler.

        (WebCore::FrameLoader::dispatchUnloadEvents):
        Increment the document's ignore-opens-during-unload counter before firing
        the pagehide / unload events and decrement it after. As per the spec, we
        are not supposed to decrement this early. We actually supposed to wait
        until the pagehide / unload events have been fired in all the subframes.
        For this reason, we take care of re-incrementing the document's
        ignore-opens-during-unload in detachChildren(), which will take care of
        firing the pagehide / unload in the subframes.

2016-01-22  Brady Eidson  <beidson@apple.com>

        Modern IDB: Implement put, get, and delete records for the SQLite backend.
        https://bugs.webkit.org/show_bug.cgi?id=153375

        Reviewed by Alex Christensen.

        No new tests (Covered by many existing tests now passing).

        * Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
        (WebCore::IDBServer::SQLiteIDBBackingStore::keyExistsInObjectStore):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::deleteRange):
        (WebCore::IDBServer::SQLiteIDBBackingStore::addRecord):
        (WebCore::IDBServer::SQLiteIDBBackingStore::getRecord):
        * Modules/indexeddb/server/SQLiteIDBBackingStore.h:

2016-01-22  Enrica Casucci  <enrica@apple.com>

        Add support for DataDetectors in WK (iOS).
        https://bugs.webkit.org/show_bug.cgi?id=152989
        rdar://problem/22855960

        Reviewed by Tim Horton.

        This patch adds the logic to perform data detection and modify
        the DOM by adding data detector links as appropriate.
        The data detector results returned by detectContentInRange are
        stored in the Frame object.

        * editing/cocoa/DataDetection.h:
        * editing/cocoa/DataDetection.mm:
        (WebCore::resultIsURL):
        (WebCore::constructURLStringForResult):
        (WebCore::removeResultLinksFromAnchor):
        (WebCore::searchForLinkRemovingExistingDDLinks):
        (WebCore::dataDetectorTypeForCategory):
        (WebCore::buildQuery):
        (WebCore::DataDetection::detectContentInRange):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
        * page/Frame.h:
        (WebCore::Frame::setDataDetectionResults):
        (WebCore::Frame::dataDetectionResults):
        * platform/spi/cocoa/DataDetectorsCoreSPI.h:
        (DDQueryOffsetCompare):

2016-01-22  Daniel Bates  <dabates@apple.com>

        LayoutTest http/tests/security/xssAuditor/embed-tag-in-path-unterminated.html crashing
        https://bugs.webkit.org/show_bug.cgi?id=153250
        <rdar://problem/12172843>
        And
        <rdar://problem/24248040>

        Reviewed by Alexey Proskuryakov.

        Remove an incorrect assertion that the absolute URL associated with a protection space cannot
        contain consecutive forward slash (/) characters. A URL can contain consecutive forward slashes.
        This also makes the invariants for CredentialStorage::findDefaultProtectionSpaceForURL() symmetric
        with the invariants for WebCore::protectionSpaceMapKeyFromURL().

        Tests: http/tests/loading/basic-auth-load-URL-with-consecutive-slashes.html
               http/tests/xmlhttprequest/basic-auth-load-URL-with-consecutive-slashes.html

        * platform/network/CredentialStorage.cpp:
        (WebCore::CredentialStorage::findDefaultProtectionSpaceForURL):

2016-01-22  Chris Dumez  <cdumez@apple.com>

        DOMImplementation.createHTMLDocument("") should append an empty Text Node to the title Element
        https://bugs.webkit.org/show_bug.cgi?id=153374

        Reviewed by Ryosuke Niwa.

        DOMImplementation.createHTMLDocument("") should append an empty Text
        Node to the title Element as per the steps at:
        - https://dom.spec.whatwg.org/#dom-domimplementation-createhtmldocument (step 6)

        Firefox and Chrome follow the specification here.

        Previously, WebKit would rely on HTMLTitleElement.text setter which
        does not create a Text Node if the title is the empty string, as per:
        - https://html.spec.whatwg.org/multipage/semantics.html#dom-title-text
        - https://dom.spec.whatwg.org/#dom-node-textcontent

        No new tests, already covered by existing test.

        * dom/DOMImplementation.cpp:
        (WebCore::DOMImplementation::createHTMLDocument):

2016-01-17  Ada Chan  <adachan@apple.com>

        Add a mode parameter to MediaControllerInterface::supportsFullscreen() and ChromeClient::supportsVideoFullscreen().
        https://bugs.webkit.org/show_bug.cgi?id=153220

        Reviewed by Eric Carlson.

        No new tests, just code refactoring.

        * Modules/mediacontrols/MediaControlsHost.cpp:
        (WebCore::MediaControlsHost::supportsFullscreen):
        Just pass in VideoFullscreenModeStandard as this is used for checking the standard fullscreen case.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::enterFullscreen):
        Only use the FullScreen API if the mode is VideoFullscreenModeStandard. Call ChromeClient::supportsVideoFullscreen()
        with the mode.
        (WebCore::HTMLMediaElement::exitFullscreen):
        Move the fullscreen element check up so we can use this method to exit picture-in-picture mode.
        * html/HTMLMediaElement.h:

        * html/HTMLVideoElement.cpp:
        (WebCore::HTMLVideoElement::supportsFullscreen):
        Ditto.
        (WebCore::HTMLVideoElement::webkitEnterFullscreen):
        Pass in VideoFullscreenModeStandard to supportsFullscreen() as this is used for the standard fullscreen case.
        (WebCore::HTMLVideoElement::webkitSupportsFullscreen):
        Ditto.
        (WebCore::HTMLVideoElement::webkitSupportsPresentationMode):
        Pass in the correct VideoFullscreenMode to supportsFullscreen() corresponding to the mode string passed in.
        (WebCore::HTMLVideoElement::setFullscreenMode):
        Pass in the mode to supportsFullscreen().
        * html/HTMLVideoElement.h:

        * html/MediaController.h:
        * html/MediaControllerInterface.h:
        Make supportsFullscreen() take a VideoFullscreenMode.

        * html/shadow/MediaControls.cpp:
        (WebCore::MediaControls::reset):
        Pass in VideoFullscreenModeStandard to supportsFullscreen() here since this is used for the standard
        fullscreen button.
        * html/shadow/MediaControlsApple