WebKit-https.git
4 years agoTemporary workaround for iOS EWS failing after the fix for bug 159539.
ap@apple.com [Tue, 19 Jul 2016 20:32:29 +0000 (20:32 +0000)]
Temporary workaround for iOS EWS failing after the fix for bug 159539.
To be deleted once the root cause is found and addressed.

* EWSTools/start-queue-mac.sh:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203417 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoREGRESSION (r203348-r203368): ASSERTION FAILED: from.isCell() && from.asCell()->JSCel...
fpizlo@apple.com [Tue, 19 Jul 2016 20:15:51 +0000 (20:15 +0000)]
REGRESSION (r203348-r203368): ASSERTION FAILED: from.isCell() && from.asCell()->JSCell::inherits(std::remove_pointer<To>::type::info())
https://bugs.webkit.org/show_bug.cgi?id=159930

Reviewed by Geoffrey Garen.

The problem is that the 32-bit DFG can flush the scope register as an unboxed cell, but the
Register::scope() method was causing us to assert that it's a JSValue with proper cell
boxing. We could have forced the DFG to flush it as a boxed JSValue, but I don't think that
would have made anything better. This fixes the issue by teaching Register::scope() that it
might see unboxed cells.

* runtime/JSScope.h:
(JSC::Register::scope):
(JSC::ExecState::lexicalGlobalObject):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203416 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agotheguardian.co.uk crossword puzzles are sometimes not displaying text
zalan@apple.com [Tue, 19 Jul 2016 20:10:02 +0000 (20:10 +0000)]
theguardian.co.uk crossword puzzles are sometimes not displaying text
https://bugs.webkit.org/show_bug.cgi?id=159924
<rdar://problem/27409483>

Reviewed by Simon Fraser.

Source/WebCore:

This patch fixes the case when
- 2 disjoint subtrees are dirty
- RenderView is also dirty.
and we end up not laying out one of the 2 subtrees.

In FrameView::scheduleRelayoutOfSubtree, we assume that when the RenderView is dirty
we already have a pending full layout which means that any previous subtree layouts have already been
converted to full layouts.
However this assumption is incorrect. RenderView can get dirty without checking if there's
already a pending subtree layout.
One option to solve this problem would be to override RenderObject::setNeedsLayout in RenderView
so that when the RenderView gets dirty, we could also convert any pending subtree layout to full layout.
However RenderObject::setNeedsLayout is a hot function and making it virtual would impact performance.
The other option is to always normalize subtree layouts in FrameView::scheduleRelayoutOfSubtree().
This patch implements the second option.

Test: fast/misc/subtree-layouts.html

* page/FrameView.cpp:
(WebCore::FrameView::scheduleRelayoutOfSubtree):

LayoutTests:

* fast/misc/subtree-layouts-expected.html: Added.
* fast/misc/subtree-layouts.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203415 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoSome payment authorization status values should keep the sheet active
andersca@apple.com [Tue, 19 Jul 2016 20:07:38 +0000 (20:07 +0000)]
Some payment authorization status values should keep the sheet active
https://bugs.webkit.org/show_bug.cgi?id=159936
rdar://problem/26756701

Reviewed by Tim Horton.

Source/WebCore:

* Modules/applepay/ApplePaySession.cpp:
(WebCore::ApplePaySession::completePayment):
Keep the sheet active if the status isn't a final state status.

* Modules/applepay/PaymentAuthorizationStatus.h:
(WebCore::isFinalStateStatus):
Add a new helper function that returns whether a given payment authorization status is "final",
meaning that once that status has been passed to completePayment, the session is finished.

Source/WebKit2:

* UIProcess/ApplePay/WebPaymentCoordinatorProxy.cpp:
(WebKit::WebPaymentCoordinatorProxy::completePaymentSession):
If the status isn't a final state status, bounce the current state back to active.

* UIProcess/ApplePay/cocoa/WebPaymentCoordinatorProxyCocoa.h:
Rename the _authorized ivar to _didReachFinalState.

* UIProcess/ApplePay/cocoa/WebPaymentCoordinatorProxyCocoa.mm:
(-[WKPaymentAuthorizationViewControllerDelegate paymentAuthorizationViewControllerDidFinish:]):
(WebKit::WebPaymentCoordinatorProxy::platformCompletePaymentSession):
Set _didReachFinalState based on the return value of isFinalStateStatus.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203414 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoB3 methods that mutate the successors array should take FrequentedBlock by value
fpizlo@apple.com [Tue, 19 Jul 2016 19:20:02 +0000 (19:20 +0000)]
B3 methods that mutate the successors array should take FrequentedBlock by value
https://bugs.webkit.org/show_bug.cgi?id=159935

Reviewed by Michael Saboff.

This bug was found by ASan testing. setSuccessors() takes a const FrequentedBlock&, and the
caller that caused the ASan crash was doing:

block->setSuccessors(block->notTaken())

So, inside setSuccessors(), after we resize() the successors array, the const
FrequentedBlock& points to nonsense.

The fix is to pass FrequentedBlock by value in all of these kinds of methods.

No new tests, but ASan testing catches this instantly for anything that triggers CFG
simplification in B3. So like half of our tests.

* b3/B3BasicBlock.cpp:
(JSC::B3::BasicBlock::clearSuccessors):
(JSC::B3::BasicBlock::appendSuccessor):
(JSC::B3::BasicBlock::setSuccessors):
* b3/B3BasicBlock.h:
(JSC::B3::BasicBlock::successors):
(JSC::B3::BasicBlock::successorBlock):
* b3/B3Value.cpp:
(JSC::B3::Value::replaceWithPhi):
(JSC::B3::Value::replaceWithJump):
(JSC::B3::Value::replaceWithOops):
* b3/B3Value.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203413 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoAX: Incorrect behavior for word related text marker functions when there's collapsed...
n_wang@apple.com [Tue, 19 Jul 2016 18:14:02 +0000 (18:14 +0000)]
AX: Incorrect behavior for word related text marker functions when there's collapsed whitespace
https://bugs.webkit.org/show_bug.cgi?id=159910

Reviewed by Chris Fleizach.

Source/WebCore:

We are getting a bad CharacterOffset when there's collapsed whitespace. Added a TraverseOptionValidateOffset
option to make sure we are getting the correct CharacterOffset based on the corresponding Range offset. And
fixed a word navigation issue based on that.

Test: accessibility/mac/text-marker-word-nav-collapsed-whitespace.html

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::traverseToOffsetInRange):
(WebCore::AXObjectCache::rangeForNodeContents):
(WebCore::AXObjectCache::startOrEndCharacterOffsetForRange):
(WebCore::AXObjectCache::characterOffsetFromVisiblePosition):
(WebCore::AXObjectCache::rightWordRange):
(WebCore::AXObjectCache::previousBoundary):
* accessibility/AXObjectCache.h:
(WebCore::AXObjectCache::isNodeInUse):

LayoutTests:

* accessibility/mac/text-marker-word-nav-collapsed-whitespace-expected.txt: Added.
* accessibility/mac/text-marker-word-nav-collapsed-whitespace.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203412 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[Streams API] ReadableStreamController methods should throw if its stream is not...
commit-queue@webkit.org [Tue, 19 Jul 2016 17:27:32 +0000 (17:27 +0000)]
[Streams API] ReadableStreamController methods should throw if its stream is not readable
https://bugs.webkit.org/show_bug.cgi?id=159871

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-19
Reviewed by Xabier Rodriguez-Calvar.

LayoutTests/imported/w3c:

* web-platform-tests/streams/readable-streams/bad-underlying-sources.https-expected.txt:

Source/WebCore:

Spec now mandates close and enqueue to throw if ReadableStream is not readable.
Covered by rebased and/or modified tests.

* Modules/streams/ReadableStreamController.js:
(enqueue): Throwing a TypeError if controlled stream is not readable.
(close): Ditto.

LayoutTests:

* streams/reference-implementation/pipe-to-options.html: Updated test case according whatwg original test.
* streams/reference-implementation/readable-stream-templated.html: Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203411 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoAdjust margins for first-line floating elements and add preset floating video sizing
jond@apple.com [Tue, 19 Jul 2016 17:23:59 +0000 (17:23 +0000)]
Adjust margins for first-line floating elements and add preset floating video sizing
https://bugs.webkit.org/show_bug.cgi?id=159898

Reviewed by Benjamin Poulain.

* wp-content/themes/webkit/style.css:
(article video.alignright):
(article .alignright:first-child):
(@media only screen and (max-width: 690px)):
    (article .alignright:first-child):
(@media only screen and (max-width: 415px)):
    (article video.alignright):
    (article .alignright:first-child):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203410 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoBubbles appear split for a brief moment in Messages
simon.fraser@apple.com [Tue, 19 Jul 2016 16:10:40 +0000 (16:10 +0000)]
Bubbles appear split for a brief moment in Messages
https://bugs.webkit.org/show_bug.cgi?id=159915
rdar://problem/27182267

Reviewed by David Hyatt.

Source/WebCore:

RenderView::repaintRootContents() had a long-standing bug in WebView when the
view is scrolled. repaint() uses visualOverflowRect() but, for the
RenderView, the visualOverflowRect() is the initial containing block
which is anchored at 0,0. When the view is scrolled it's clipped out and
calls to repaintRootContents() have no effect.

Change repaintRootContents() to use layoutOverflowRect(). ScrollView::repaintContentRectangle()
will clip it to the view if necessary.

Test: fast/repaint/scrolled-view-full-repaint.html

* rendering/RenderView.cpp:
(WebCore::RenderView::repaintRootContents):

LayoutTests:

* fast/repaint/scrolled-view-full-repaint-expected.txt: Added.
* fast/repaint/scrolled-view-full-repaint.html: Added.
* platform/ios-simulator-wk1/fast/repaint/scrolled-view-full-repaint-expected.txt: Added.
* platform/mac-wk1/fast/repaint/scrolled-view-full-repaint-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203409 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoRefresh WPT tests up to 98ec1ad
commit-queue@webkit.org [Tue, 19 Jul 2016 16:08:56 +0000 (16:08 +0000)]
Refresh WPT tests up to 98ec1ad
https://bugs.webkit.org/show_bug.cgi?id=159879

Patch by Youenn Fablet <youennf@gmail.com> on 2016-07-19
Reviewed by Alex Christensen.

This refresh concerns fetch API tests with a number of test fixes.
Rebasing both window and worker expectations.

* resources/TestRepositories:
* web-platform-tests/fetch/api/basic/mode-same-origin-expected.txt:
* web-platform-tests/fetch/api/basic/mode-same-origin-worker-expected.txt:
* web-platform-tests/fetch/api/basic/mode-same-origin-worker.html:
* web-platform-tests/fetch/api/basic/mode-same-origin.html:
* web-platform-tests/fetch/api/basic/mode-same-origin.js:
* web-platform-tests/fetch/api/cors/cors-basic-worker.html:
* web-platform-tests/fetch/api/cors/cors-basic.html:
* web-platform-tests/fetch/api/cors/cors-basic.js:
(cors):
* web-platform-tests/fetch/api/cors/cors-cookies-expected.txt:
* web-platform-tests/fetch/api/cors/cors-cookies-worker-expected.txt:
* web-platform-tests/fetch/api/cors/cors-cookies-worker.html:
* web-platform-tests/fetch/api/cors/cors-cookies.html:
* web-platform-tests/fetch/api/cors/cors-cookies.js:
(corsCookies):
* web-platform-tests/fetch/api/cors/cors-no-preflight-worker.html:
* web-platform-tests/fetch/api/cors/cors-no-preflight.html:
* web-platform-tests/fetch/api/cors/cors-no-preflight.js:
(corsNoPreflight):
* web-platform-tests/fetch/api/cors/cors-origin-worker.html:
* web-platform-tests/fetch/api/cors/cors-origin.html:
* web-platform-tests/fetch/api/cors/cors-origin.js:
(corsOrigin):
* web-platform-tests/fetch/api/cors/cors-preflight-redirect-worker.html:
* web-platform-tests/fetch/api/cors/cors-preflight-redirect.html:
* web-platform-tests/fetch/api/cors/cors-preflight-redirect.js:
* web-platform-tests/fetch/api/cors/cors-preflight-referrer-expected.txt:
* web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker-expected.txt:
* web-platform-tests/fetch/api/cors/cors-preflight-referrer-worker.html:
* web-platform-tests/fetch/api/cors/cors-preflight-referrer.html:
* web-platform-tests/fetch/api/cors/cors-preflight-referrer.js:
(corsPreflightReferrer):
* web-platform-tests/fetch/api/cors/cors-preflight-status-worker.html:
* web-platform-tests/fetch/api/cors/cors-preflight-status.html:
* web-platform-tests/fetch/api/cors/cors-preflight-status.js:
* web-platform-tests/fetch/api/cors/cors-redirect-credentials.html:
* web-platform-tests/fetch/api/cors/cors-redirect-credentials.js:
* web-platform-tests/fetch/api/cors/cors-redirect-worker.html:
* web-platform-tests/fetch/api/cors/cors-redirect.html:
* web-platform-tests/fetch/api/cors/cors-redirect.js:
* web-platform-tests/fetch/api/request/request-cache.html:
* web-platform-tests/fetch/api/request/resources/w3c-import.log:
* web-platform-tests/fetch/api/resources/get-host-info.sub.js: Added.
(get_host_info):
* web-platform-tests/fetch/api/resources/utils.js:
(validateBufferFromString):
* web-platform-tests/fetch/api/resources/w3c-import.log:
* web-platform-tests/fetch/api/response/response-clone-expected.txt:
* web-platform-tests/fetch/api/response/response-clone.html:
* web-platform-tests/fetch/api/response/response-consume-stream-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203408 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[win] Fixup the register name for STIX Math and Latin Modern Math
fred.wang@free.fr [Tue, 19 Jul 2016 14:33:16 +0000 (14:33 +0000)]
[win] Fixup the register name for STIX Math and Latin Modern Math

Unreviewed follow-up of r203406

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-19

* Scripts/webkitdirs.pm:
(checkInstalledTools):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203407 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[win] Update the list of MathML fonts
fred.wang@free.fr [Tue, 19 Jul 2016 14:18:19 +0000 (14:18 +0000)]
[win] Update the list of MathML fonts
https://bugs.webkit.org/show_bug.cgi?id=156838

The set of recommended math fonts is now described at
https://trac.webkit.org/wiki/MathML/Fonts
We update the Perl script to use the latest list of fonts.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-19
Reviewed by Brent Fulgham.

* Scripts/webkitdirs.pm:
(checkInstalledTools):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203406 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[Release WK2] LayoutTest imported/w3c/web-platform-tests/XMLHttpRequest/send-redirect...
commit-queue@webkit.org [Tue, 19 Jul 2016 14:12:58 +0000 (14:12 +0000)]
[Release WK2] LayoutTest imported/w3c/web-platform-tests/XMLHttpRequest/send-redirect-post-upload.htm failing
https://bugs.webkit.org/show_bug.cgi?id=159724

Unreviewed.

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-19

* TestExpectations: Marking test as failure,passs,crash.
* platform/ios-simulator-wk2/TestExpectations: Removing specific expectation.
* platform/mac-wk2/TestExpectations: Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203405 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago<rdar://problem/27420308> WebCore-7602.1.42 fails to build: error: unused parameter...
mitz@apple.com [Tue, 19 Jul 2016 14:12:22 +0000 (14:12 +0000)]
<rdar://problem/27420308> WebCore-7602.1.42 fails to build: error: unused parameter 'vm'

* bindings/js/JSDOMGlobalObject.cpp:
(WebCore::JSDOMGlobalObject::addBuiltinGlobals): Fixed the !ENABLE(STREAMS_API) build.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203404 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[Win] The test fast/scrolling/overflow-scroll-past-max.html is timing out.
pvollan@apple.com [Tue, 19 Jul 2016 10:56:09 +0000 (10:56 +0000)]
[Win] The test fast/scrolling/overflow-scroll-past-max.html is timing out.
https://bugs.webkit.org/show_bug.cgi?id=159342

Reviewed by Darin Adler.

Source/WebKit/win:

* WebFrame.h: Link fix.

Tools:

Implement required functions in event sender.

* DumpRenderTree/PlatformWin.cmake:
* DumpRenderTree/win/EventSender.cpp:
(monitorWheelEvents): Added.
(callAfterScrollingCompletes): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203403 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[Streams API] Make ReadableStream properties not enumerable
commit-queue@webkit.org [Tue, 19 Jul 2016 07:59:05 +0000 (07:59 +0000)]
[Streams API] Make ReadableStream properties not enumerable
https://bugs.webkit.org/show_bug.cgi?id=159868

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-19
Reviewed by Darin Adler.

LayoutTests/imported/w3c:

* web-platform-tests/streams/readable-streams/general.https-expected.txt:
* web-platform-tests/streams/readable-streams/readable-stream-reader.https-expected.txt:

Source/WebCore:

Covered by rebased tests.

Uopdating IDL definitions to mark all functions/attributes as not enumerable.
Updating IDL constructor definitions to correctly compute constructor length.
Updating built-in implementation to correctly compute pipeTo length to 1 (second parameter being optional).

* Modules/streams/ReadableStream.idl:
* Modules/streams/ReadableStream.js:
* Modules/streams/ReadableStreamController.idl:
* Modules/streams/ReadableStreamReader.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203402 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoform.enctype / encoding / method should treat null as "null" string
cdumez@apple.com [Tue, 19 Jul 2016 07:41:21 +0000 (07:41 +0000)]
form.enctype / encoding / method should treat null as "null" string
https://bugs.webkit.org/show_bug.cgi?id=159916

Reviewed by Ryosuke Niwa.

Source/WebCore:

form.enctype / encoding / method should treat null as "null" string:
- https://html.spec.whatwg.org/multipage/forms.html#htmlformelement

Previously, WebKit would treat null as the null String, which would
end up removing the existing attribute.

Firefox and Chrome match the specification.

Test: fast/dom/HTMLFormElement/null-handling.html

* html/HTMLFormElement.h:
* html/HTMLFormElement.idl:

LayoutTests:

Add layout test coverage.

* fast/dom/HTMLFormElement/null-handling-expected.txt: Added.
* fast/dom/HTMLFormElement/null-handling.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203401 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoAdd new aliases to http test server
commit-queue@webkit.org [Tue, 19 Jul 2016 07:38:55 +0000 (07:38 +0000)]
Add new aliases to http test server
https://bugs.webkit.org/show_bug.cgi?id=159878

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-19
Reviewed by Darin Adler.

Tools:

Adding testharness.css, testharness.js and testharnessreport.js new aliases to http test servers.
Adding explicitly these links to perl script.
Extracting default alias in an aliases.json file.
Reading that file from python scripts to initialize aliases from that file.

Python script changes covered by unit tests and changed layout test.

* Scripts/webkitperl/httpd.pm:
(getDefaultConfigForTestDirectory): Adding 3 new aliases
* Scripts/webkitpy/layout_tests/servers/aliases.json: Added.
* Scripts/webkitpy/layout_tests/servers/apache_http_server.py:
(LayoutTestApacheHttpd.__init__): Setting upper class tests_dir member if needed and according constructor parameter.
Adding -c directives for each alias.
* Scripts/webkitpy/layout_tests/servers/apache_http_server_unittest.py:
(TestLayoutTestApacheHttpd.test_start_cmd): Adding aliases.json mock-up file.
* Scripts/webkitpy/layout_tests/servers/http_server.py:
(Lighttpd.__init__): Setting upper class tests_dir member if needed and according constructor parameter.
Adding alias directive for each alias.
(Lighttpd._prepare_config):
* Scripts/webkitpy/layout_tests/servers/http_server_base.py:
(HttpServerBase.__init__): Adding tests_dir member with a default value being layout tests directory.
(HttpServerBase.aliases): Computing of alias from the json file, paths to the real files being relative to
layout tests directory.
* Scripts/webkitpy/layout_tests/servers/http_server_unittest.py:
(TestHttpServer.test_start_cmd): Adding aliases.json mock-up file and updating test expectation.
(TestHttpServer.test_win32_start_and_stop): Adding aliases.json mock-up file.

LayoutTests:

* http/tests/xmlhttprequest/set-bad-headervalue.html: Updating testharness.js and testharnessreport.js links to
ensure these new links are working on test servers.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203400 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoAll-in-one buildfix after r202439
ossy@webkit.org [Tue, 19 Jul 2016 06:50:49 +0000 (06:50 +0000)]
All-in-one buildfix after r202439
https://bugs.webkit.org/show_bug.cgi?id=159877

Reviewed by Chris Dumez.

* Modules/webaudio/AudioDestinationNode.h:
(WebCore::AudioDestinationNode::resume):
(WebCore::AudioDestinationNode::suspend):
(WebCore::AudioDestinationNode::close):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203399 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoFix the --minimal build fail in InjectedBundle.cpp
ossy@webkit.org [Tue, 19 Jul 2016 06:50:02 +0000 (06:50 +0000)]
Fix the --minimal build fail in InjectedBundle.cpp
https://bugs.webkit.org/show_bug.cgi?id=159770

Reviewed by Benjamin Poulain.

* WebProcess/InjectedBundle/InjectedBundle.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203398 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMove parsing of subscriptshift and superscriptshift from rendering to element classes
fred.wang@free.fr [Tue, 19 Jul 2016 05:42:46 +0000 (05:42 +0000)]
Move parsing of subscriptshift and superscriptshift from rendering to element classes
https://bugs.webkit.org/show_bug.cgi?id=159622

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-18
Reviewed by Darin Adler.

We introduce a new MathMLScriptsElement that is used for elements msub, msup, msubsup and
mmultiscripts in order to create RenderMathMLScripts and parse and expose the values of the
subscriptshift and superscriptshift attributes. This is one more step toward moving MathML
attribute parsing to the DOM (bug 156536).

No new tests, rendering is unchanged.

* CMakeLists.txt: Add MathMLScriptsElement files.
* WebCore.xcodeproj/project.pbxproj: Ditto.
* mathml/MathMLAllInOne.cpp: Ditto.
* mathml/MathMLInlineContainerElement.cpp: Remove handling of scripts.
(WebCore::MathMLInlineContainerElement::createElementRenderer): Deleted.
* mathml/MathMLScriptsElement.cpp: Added. New class to handle scripted elements supporting
parsing for the subscriptshift and superscriptshift MathML lengths.
(WebCore::MathMLScriptsElement::MathMLScriptsElement):
(WebCore::MathMLScriptsElement::create):
(WebCore::MathMLScriptsElement::subscriptShift): Expose the cached length for the shift,
parsing the attribute again if necessary.
(WebCore::MathMLScriptsElement::superscriptShift): Ditto.
(WebCore::MathMLScriptsElement::parseAttribute): Mark attributes dirty.
(WebCore::MathMLScriptsElement::createElementRenderer): Create RenderMathMLScripts.
* mathml/MathMLScriptsElement.h: Ditto.
* mathml/mathtags.in: Map msub, msup, msubsup and mmultiscripts to MathMLScriptsElement.
* rendering/mathml/RenderMathMLScripts.cpp:
(WebCore::RenderMathMLScripts::scriptsElement): Helper function to cast the node to a
MathMLScriptsElement.
(WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded): Resolve the attributes
using the functions from the MathMLScriptsElement class.
* rendering/mathml/RenderMathMLScripts.h: Declare scriptsElement.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203396 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoDo not store gap and shift parameters on RenderMathMLFraction
fred.wang@free.fr [Tue, 19 Jul 2016 05:36:16 +0000 (05:36 +0000)]
Do not store gap and shift parameters on RenderMathMLFraction
https://bugs.webkit.org/show_bug.cgi?id=159876

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-18
Reviewed by Darin Adler.

After r203285, the stack and fraction layout parameters are only used in layoutBlock so we
do not need to store them on the class. We remove them and split updateLayoutParameters into
three functions: one to update the linethickness and two others to retrieve the fraction and
stack respectively.

No new tests, rendering is unchanged.

* rendering/mathml/RenderMathMLFraction.cpp:
(WebCore::RenderMathMLFraction::updateLineThickness): Move code to update thickness members here.
(WebCore::RenderMathMLFraction::getFractionParameters): Move code to retrieve fraction parameters here.
(WebCore::RenderMathMLFraction::getStackParameters): Move code to retrieve stack parameters here.
(WebCore::RenderMathMLFraction::layoutBlock): Use the new helper functions and local variables
for fraction and stack parameters.
(WebCore::RenderMathMLFraction::updateLayoutParameters): Deleted.
* rendering/mathml/RenderMathMLFraction.h: Declare new helper functions and remove members
for stack and fraction parameters.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203395 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoinput.formEnctype / formMethod and button.formEnctype / formMethod / type should...
cdumez@apple.com [Tue, 19 Jul 2016 04:45:53 +0000 (04:45 +0000)]
input.formEnctype / formMethod and button.formEnctype / formMethod / type should treat null as "null"
https://bugs.webkit.org/show_bug.cgi?id=159908

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

Rebaseline now that more checks are passing.

* web-platform-tests/html/dom/reflection-forms-expected.txt:

Source/WebCore:

input.formEnctype / formMethod and button.formEnctype / formMethod / type
should treat null as "null" String:
- https://html.spec.whatwg.org/multipage/forms.html#htmlinputelement
- https://html.spec.whatwg.org/multipage/forms.html#htmlbuttonelement

In WebKit, we would treat null as a null String which would end up
removing the corresponding attribute. This does not match the
specification. Firefox and Chrome match the specification here.

Tests:
- fast/dom/HTMLButtonElement/null-handling.html
- fast/dom/HTMLInputElement/null-handling.html

* html/HTMLButtonElement.idl:
* html/HTMLInputElement.idl:

LayoutTests:

Add layout test coverage.

* fast/dom/HTMLButtonElement/change-type-expected.txt:
* fast/dom/HTMLButtonElement/change-type.html:
* fast/dom/HTMLButtonElement/null-handling-expected.txt: Added.
* fast/dom/HTMLButtonElement/null-handling.html: Added.
* fast/dom/HTMLInputElement/null-handling-expected.txt: Added.
* fast/dom/HTMLInputElement/null-handling.html: Added.
* fast/forms/submit-form-attributes-expected.txt:
* fast/forms/submit-form-attributes.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203394 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMake builtin TypeErrors consistent
commit-queue@webkit.org [Tue, 19 Jul 2016 02:45:35 +0000 (02:45 +0000)]
Make builtin TypeErrors consistent
https://bugs.webkit.org/show_bug.cgi?id=159899

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2016-07-18
Reviewed by Keith Miller.

Source/JavaScriptCore:

Converge on the single TypeError for non-coercible this objects in builtins.
Also update some other style to be more consistent with-in builtins.

* builtins/ArrayIteratorPrototype.js:
(next):
* builtins/ArrayPrototype.js:
(values):
(keys):
(entries):
(reduce):
(reduceRight):
(every):
(forEach):
(filter):
(map):
(some):
(fill):
(find):
(findIndex):
(includes):
(sort):
(concatSlowPath):
(copyWithin):
* builtins/StringPrototype.js:
(match):
(repeat):
(padStart):
(padEnd):
(intrinsic.StringPrototypeReplaceIntrinsic.replace):
(localeCompare):
(search):
(split):
* tests/es6/String.prototype_methods_String.prototype.padEnd.js:
* tests/es6/String.prototype_methods_String.prototype.padStart.js:
* tests/stress/array-iterators-next-error-messages.js:
(catch):
* tests/stress/array-iterators-next-with-call.js:
* tests/stress/regexp-match.js:
(shouldThrow):
* tests/stress/regexp-search.js:
(shouldThrow):

LayoutTests:

* js/array-find-expected.txt:
* js/array-findIndex-expected.txt:
* js/array-includes-expected.txt:
* js/dom/array-prototype-properties-expected.txt:
* js/dom/script-tests/string-prototype-properties.js:
* js/dom/string-prototype-properties-expected.txt:
* js/script-tests/array-find.js:
* js/script-tests/array-findIndex.js:
* js/script-tests/string-localeCompare.js:
* js/string-localeCompare-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.10_String.prototype.match/S15.5.4.10_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.12_String.prototype.search/S15.5.4.12_A1_T3-expected.txt:
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.14_String.prototype.split/S15.5.4.14_A1_T3-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203393 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agowebbookmarksd needs to use the same AppCache directory as MobileSafari
achristensen@apple.com [Tue, 19 Jul 2016 02:02:37 +0000 (02:02 +0000)]
webbookmarksd needs to use the same AppCache directory as MobileSafari
https://bugs.webkit.org/show_bug.cgi?id=159912
Source/WebCore:

Reviewed by Alexey Proskuryakov.

No new tests.  This only changes behavior for webbookmarksd.

* platform/RuntimeApplicationChecks.h:
* platform/RuntimeApplicationChecks.mm:
(WebCore::IOSApplication::isWebBookmarksD): Added.

Source/WebKit2:

<rdar://problem/27056844>

Reviewed by Alexey Proskuryakov.

* UIProcess/API/Cocoa/APIWebsiteDataStoreCocoa.mm:
(API::WebsiteDataStore::defaultApplicationCacheDirectory):
Make webbookmarksd match MobileSafari by adding a matching runtime exception.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203392 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoEventTarget.dispatchEvent() parameter should not be nullable
cdumez@apple.com [Tue, 19 Jul 2016 01:18:06 +0000 (01:18 +0000)]
EventTarget.dispatchEvent() parameter should not be nullable
https://bugs.webkit.org/show_bug.cgi?id=159897

Reviewed by Benjamin Poulain.

Source/WebCore:

EventTarget.dispatchEvent() parameter should not be nullable:
- https://dom.spec.whatwg.org/#interface-eventtarget

Even though the parameter was marked as nullable in our IDL, our
implementation does a null check and we already throw a TypeError
when calling dispatchEvent(null).

Update our IDL so that it matches the specification and so that
the null check is generated in the bindings instead.

No new tests, rebaseline existing tests.

* dom/EventTarget.cpp:
(WebCore::EventTarget::dispatchEventForBindings):
* dom/EventTarget.h:
* dom/EventTarget.idl:

LayoutTests:

Update layout tests as the message of the TypeError exception being
thrown when calling dispatchEvent(null) is now more helpful.

* fast/dom/Window/dispatchEvent-expected.txt:
* fast/events/dispatchEvent-crash-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203391 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoImplement table-based switches in B3/Air
fpizlo@apple.com [Tue, 19 Jul 2016 01:16:24 +0000 (01:16 +0000)]
Implement table-based switches in B3/Air
https://bugs.webkit.org/show_bug.cgi?id=151141

Reviewed by Benjamin Poulain.
Source/JavaScriptCore:

If a switch statement gets large, it's better to express it as an indirect jump rather than
using a binary switch (divide-and-conquer tree of comparisons leading to O(log n) branches to
get to the switch case). When dealing with integer switches, FTL will already use the B3
Switch and expect this to get lowered as efficiently as possible; it's a bug that B3 will
always use a binary switch rather than indirect jumps. When dealing with switches over some
more sophisticated types, we'd want FTL to build an indirect jump table itself and use
something like a hashtable to feed it. In that case, there will be no B3 Switch; we'll want
some way for the FTL to directly express an indirection jump when emitting B3.

This implies that we want B3 to have the ability to lower Switch to indirect jumps and to
expose those indirect jumps in IR so that the FTL could do its own indirect jumps for
switches over more complicated things like strings. But indirect jumps are tough to express
in IR. For example, the LLVM approach ("indirectbr" and "blockaddress", see
http://blog.llvm.org/2010/01/address-of-label-and-indirect-branches.html) means that some
control flow edges cannot be split. Indirectbr takes an address as input and jumps to it, and
blockaddress lets you build jump tables out of basic block addresses. This means that the
compiler can never change any successor of an indirectbr, since the client will have already
arranged for that indirectbr to jump to exactly those successors. We don't want such
restrictions in B3, since B3 relies on being able to break critical edges for SSA conversion.
Also, indirectbr is not cloneable, which would break any hope of doing specialization-based
transformations like we want to do for multiple entrypoints (bug 159391). The goal of this
change is to let clients do indirect jumps without placing any restrictions on IR.

The trick is to allow Patchpoints to be used as block terminals. Patchpoints already allow
clients of B3 to emit whatever code they like. Patchpoints are friendly to B3's other
transformations because the client of the patchpoint has to play along with whatever
decisions B3 had made around the patchpoint: what registers got used, what the control flow
looks like, etc. Patchpoints can even be cloned by B3, and the client has to accommodate this
in their patchpoint generator. It turns out that using Patchpoints as terminals is quite
natural. We accomplish this by moving the successor edges out of ControlValue and into
BasicBlock, and removing ControlValue entirely. This way, any Value subclass can be a
terminal. It was already true that a Value is a terminal if value->effects().terminal, which
works great with Patchpoints since they control their effects via PatchpointValue::effects.
You can make your Patchpoint into a terminal by placing it at the end of a block and doing:

patchpoint->effects.terminal = true;

A Patchpoints in terminal position gets access to additional API in StackmapGenerationParams.
The generator can get a Box<Label> for each successor to its owning block. For example, to
implement a jump-table-based switch, you would make your patchpoint take the table index as
its sole input. Inside the generator, you allocate the jump table and emit a BaseIndex jump
that uses the jump table pointer (which will be a constant known to the generator since it
just allocated it) as the base and the patchpoint input as an index. The jump table can be
populated by MacroAssemblerCodePtr's computed by installing a link task to resolve the labels
to concrete locations. This change makes LowerMacros do such a lowering for Switches that can
benefit from jump tables. This happens recursively: if the original Switch is too sparse, we
will divide-and-conquer as before. If at any recursion step we find that the remaining cases
are dense and large enough to profit from a jump table, then those cases will be lowered to a
Patchpoint that does the table jump. This is a fun way to do stepwise lowering: LowerMacros
is essentially pre-lowering the Switch directly to machine code, and wrapping that machine
code in a Patchpoint so that the rest of the compiler doesn't have to know anything about
what happened. I suspect that in the future we will want to do other pre-lowerings this way,
whenever the B3 IR phases have some special knowledge about what machine code should be
emitted and it would be annoying to drag that knowledge through the rest of the compiler.

One downside of this change is that we used ControlValue in so many places. Most of this
patch involves removing references to ControlValue. It would be less than 100kb if it wasn't
for that. To make this a bit easier, I added "appendNewControlValue" methods to BasicBlock,
which allocate a Value and set the successors as if you had done "appendNew<ControlValue>".
This made for an easy search-and-replace in testb3 and FTLOutput. I filed bug 159440 to
remove this ugly stopgap method.

I think that we will also end up using this facility to extend our use of snippets. We
already use shared snippet generators for the generic forms of arithmetic. We will probably
also want to do this for generic forms of branches. This wouldn't have been possible prior to
this change, since there would have been no way to emit a control snippet in FTL. Now we can
emit control snippets using terminal patchpoints.

This is a ~30% speed-up on microbenchmarks that have big switch statements (~60 cases). It's
not a speed-up on mainstream benchmarks.

This also adds a new test to testb3 for terminal Patchpoints, Get, and Set. The FTL does not
currently use terminal Patchpoints directly, but we want this to be possible. It also doesn't
use Get/Set directly even though we want this to be possible. It's important to test these
since opcodes that result from lowering don't affect early phases, so we could have
regressions in early phases related to these opcodes that wouldn't be caught by any JS test.
So, this adds a very basic threaded interpreter to testb3 for a Brainfuck-style language, and
tests it by having it run a program that prints the numbers 1..100 in a loop. Unlike a real
threaded interpreter, it uses a common dispatch block rather than having dispatch at the
terminus of each opcode. That's necessary because PolyJump is not cloneable. The state of the
interpreter is represented using Variables that we Get and Set, so it tests Get/Set as well.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::jump):
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::jump):
* assembler/X86Assembler.h:
(JSC::X86Assembler::jmp_m):
* b3/B3BasicBlock.cpp:
(JSC::B3::BasicBlock::append):
(JSC::B3::BasicBlock::appendNonTerminal):
(JSC::B3::BasicBlock::removeLast):
(JSC::B3::BasicBlock::appendIntConstant):
(JSC::B3::BasicBlock::clearSuccessors):
(JSC::B3::BasicBlock::appendSuccessor):
(JSC::B3::BasicBlock::setSuccessors):
(JSC::B3::BasicBlock::replaceSuccessor):
(JSC::B3::BasicBlock::addPredecessor):
(JSC::B3::BasicBlock::deepDump):
(JSC::B3::BasicBlock::appendNewControlValue):
* b3/B3BasicBlock.h:
(JSC::B3::BasicBlock::numSuccessors):
(JSC::B3::BasicBlock::successor):
(JSC::B3::BasicBlock::successors):
(JSC::B3::BasicBlock::successorBlock):
(JSC::B3::BasicBlock::successorBlocks):
(JSC::B3::BasicBlock::numPredecessors):
(JSC::B3::BasicBlock::predecessor):
(JSC::B3::BasicBlock::frequency):
* b3/B3BasicBlockInlines.h:
(JSC::B3::BasicBlock::replaceLastWithNew):
(JSC::B3::BasicBlock::taken):
(JSC::B3::BasicBlock::notTaken):
(JSC::B3::BasicBlock::fallThrough):
(JSC::B3::BasicBlock::numSuccessors): Deleted.
(JSC::B3::BasicBlock::successor): Deleted.
(JSC::B3::BasicBlock::successors): Deleted.
(JSC::B3::BasicBlock::successorBlock): Deleted.
(JSC::B3::BasicBlock::successorBlocks): Deleted.
* b3/B3BlockInsertionSet.cpp:
(JSC::B3::BlockInsertionSet::splitForward):
* b3/B3BreakCriticalEdges.cpp:
(JSC::B3::breakCriticalEdges):
* b3/B3CaseCollection.cpp: Added.
(JSC::B3::CaseCollection::dump):
* b3/B3CaseCollection.h: Added.
(JSC::B3::CaseCollection::CaseCollection):
(JSC::B3::CaseCollection::operator[]):
(JSC::B3::CaseCollection::iterator::iterator):
(JSC::B3::CaseCollection::iterator::operator*):
(JSC::B3::CaseCollection::iterator::operator++):
(JSC::B3::CaseCollection::iterator::operator==):
(JSC::B3::CaseCollection::iterator::operator!=):
(JSC::B3::CaseCollection::begin):
(JSC::B3::CaseCollection::end):
* b3/B3CaseCollectionInlines.h: Added.
(JSC::B3::CaseCollection::fallThrough):
(JSC::B3::CaseCollection::size):
(JSC::B3::CaseCollection::at):
* b3/B3CheckSpecial.cpp:
(JSC::B3::CheckSpecial::CheckSpecial):
(JSC::B3::CheckSpecial::hiddenBranch):
* b3/B3Common.h:
(JSC::B3::is64Bit):
* b3/B3ControlValue.cpp: Removed.
* b3/B3ControlValue.h: Removed.
* b3/B3DataSection.cpp:
(JSC::B3::DataSection::DataSection):
* b3/B3DuplicateTails.cpp:
* b3/B3FixSSA.cpp:
* b3/B3FoldPathConstants.cpp:
* b3/B3LowerMacros.cpp:
* b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::run):
(JSC::B3::Air::LowerToAir::lower):
* b3/B3MathExtras.cpp:
(JSC::B3::powDoubleInt32):
* b3/B3Opcode.h:
(JSC::B3::isConstant):
(JSC::B3::isDefinitelyTerminal):
* b3/B3PatchpointSpecial.cpp:
(JSC::B3::PatchpointSpecial::generate):
(JSC::B3::PatchpointSpecial::isTerminal):
(JSC::B3::PatchpointSpecial::dumpImpl):
* b3/B3PatchpointSpecial.h:
* b3/B3Procedure.cpp:
(JSC::B3::Procedure::resetReachability):
* b3/B3Procedure.h:
(JSC::B3::Procedure::lastPhaseName):
(JSC::B3::Procedure::byproducts):
* b3/B3ReduceStrength.cpp:
* b3/B3StackmapGenerationParams.cpp:
(JSC::B3::StackmapGenerationParams::unavailableRegisters):
(JSC::B3::StackmapGenerationParams::successorLabels):
(JSC::B3::StackmapGenerationParams::fallsThroughToSuccessor):
(JSC::B3::StackmapGenerationParams::proc):
* b3/B3StackmapGenerationParams.h:
(JSC::B3::StackmapGenerationParams::gpScratch):
(JSC::B3::StackmapGenerationParams::fpScratch):
* b3/B3SwitchValue.cpp:
(JSC::B3::SwitchValue::~SwitchValue):
(JSC::B3::SwitchValue::removeCase):
(JSC::B3::SwitchValue::hasFallThrough):
(JSC::B3::SwitchValue::setFallThrough):
(JSC::B3::SwitchValue::appendCase):
(JSC::B3::SwitchValue::dumpSuccessors):
(JSC::B3::SwitchValue::dumpMeta):
(JSC::B3::SwitchValue::cloneImpl):
(JSC::B3::SwitchValue::SwitchValue):
* b3/B3SwitchValue.h:
(JSC::B3::SwitchValue::accepts):
(JSC::B3::SwitchValue::caseValues):
(JSC::B3::SwitchValue::cases):
(JSC::B3::SwitchValue::fallThrough): Deleted.
(JSC::B3::SwitchValue::size): Deleted.
(JSC::B3::SwitchValue::at): Deleted.
(JSC::B3::SwitchValue::operator[]): Deleted.
(JSC::B3::SwitchValue::iterator::iterator): Deleted.
(JSC::B3::SwitchValue::iterator::operator*): Deleted.
(JSC::B3::SwitchValue::iterator::operator++): Deleted.
(JSC::B3::SwitchValue::iterator::operator==): Deleted.
(JSC::B3::SwitchValue::iterator::operator!=): Deleted.
(JSC::B3::SwitchValue::begin): Deleted.
(JSC::B3::SwitchValue::end): Deleted.
* b3/B3Validate.cpp:
* b3/B3Value.cpp:
(JSC::B3::Value::replaceWithPhi):
(JSC::B3::Value::replaceWithJump):
(JSC::B3::Value::replaceWithOops):
(JSC::B3::Value::dump):
(JSC::B3::Value::deepDump):
(JSC::B3::Value::dumpSuccessors):
(JSC::B3::Value::negConstant):
(JSC::B3::Value::typeFor):
* b3/B3Value.h:
* b3/air/AirCode.cpp:
(JSC::B3::Air::Code::addFastTmp):
(JSC::B3::Air::Code::addDataSection):
(JSC::B3::Air::Code::jsHash):
* b3/air/AirCode.h:
(JSC::B3::Air::Code::isFastTmp):
(JSC::B3::Air::Code::setLastPhaseName):
* b3/air/AirCustom.h:
(JSC::B3::Air::PatchCustom::shouldTryAliasingDef):
(JSC::B3::Air::PatchCustom::isTerminal):
(JSC::B3::Air::PatchCustom::hasNonArgNonControlEffects):
(JSC::B3::Air::PatchCustom::generate):
(JSC::B3::Air::CCallCustom::admitsStack):
(JSC::B3::Air::CCallCustom::isTerminal):
(JSC::B3::Air::CCallCustom::hasNonArgNonControlEffects):
(JSC::B3::Air::ShuffleCustom::admitsStack):
(JSC::B3::Air::ShuffleCustom::isTerminal):
(JSC::B3::Air::ShuffleCustom::hasNonArgNonControlEffects):
* b3/air/AirGenerate.cpp:
(JSC::B3::Air::generate):
* b3/air/AirGenerationContext.h:
* b3/air/AirInst.h:
(JSC::B3::Air::Inst::hasNonControlEffects):
* b3/air/AirSimplifyCFG.cpp:
(JSC::B3::Air::simplifyCFG):
* b3/air/AirSpecial.cpp:
(JSC::B3::Air::Special::shouldTryAliasingDef):
(JSC::B3::Air::Special::isTerminal):
(JSC::B3::Air::Special::hasNonArgNonControlEffects):
* b3/air/AirSpecial.h:
* b3/air/AirValidate.cpp:
* b3/air/opcode_generator.rb:
* b3/testb3.cpp:
* ftl/FTLLowerDFGToB3.cpp:
* ftl/FTLOutput.cpp:
(JSC::FTL::Output::jump):
(JSC::FTL::Output::branch):
(JSC::FTL::Output::ret):
(JSC::FTL::Output::unreachable):
(JSC::FTL::Output::speculate):
(JSC::FTL::Output::trap):
(JSC::FTL::Output::anchor):
(JSC::FTL::Output::decrementSuperSamplerCount):
(JSC::FTL::Output::addIncomingToPhi):
* ftl/FTLOutput.h:
(JSC::FTL::Output::constIntPtr):
(JSC::FTL::Output::callWithoutSideEffects):
(JSC::FTL::Output::switchInstruction):
(JSC::FTL::Output::phi):
(JSC::FTL::Output::addIncomingToPhi):

Websites/webkit.org:

Update documentation to reflect Patchpoint's new powers.

* docs/b3/intermediate-representation.html:

LayoutTests:

* js/regress/bigswitch-expected.txt: Added.
* js/regress/bigswitch.html: Added.
* js/regress/script-tests/bigswitch.js: Added.
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203390 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoDocType's publicId / systemId should not be nullable
cdumez@apple.com [Tue, 19 Jul 2016 00:57:18 +0000 (00:57 +0000)]
DocType's publicId / systemId should not be nullable
https://bugs.webkit.org/show_bug.cgi?id=159901

Reviewed by Benjamin Poulain.

LayoutTests/imported/w3c:

Rebaseline now that more checks regarding DocumentType serialization
are passing.

* web-platform-tests/domparsing/xml-serialization-expected.txt:

Source/WebCore:

DocType's publicId / systemId should not be nullable. While they were
not marked as nullable in our IDL, they could be stored as null Strings
in our implementation depending on how the Node was constructed. This
led to subtle bugs where String() != emptyString().

In particular, Node.isEqualNode() would return false when DocumentType
nodes would mismatch because of their publicId / systemId being null
instead of the emptyString.

Serialization would DocumentType nodes would also be wrong when
publicId / systemId were empty Strings instead of null strings. The
new behavior now matches:
- https://www.w3.org/TR/DOM-Parsing/#dfn-concept-serialize-doctype (steps 7-9)

To address these issues, we now always store publicId / systemId as
non-null Strings inside the DocumentType class.

Test: fast/dom/DocumentType/isEqualNode.html

* dom/DocumentType.cpp:
(WebCore::DocumentType::DocumentType):
* editing/MarkupAccumulator.cpp:
(WebCore::MarkupAccumulator::appendDocumentType):

LayoutTests:

Add test coverage for comparison of DocumentType nodes
using isEqualNode(). This tests used to fail and now passes.
The test passes in Firefox and Chrome as well.

* fast/dom/DocumentType/isEqualNode-expected.txt: Added.
* fast/dom/DocumentType/isEqualNode.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203389 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoIf previous media session interruptions were prevented, still allow subsequent interr...
commit-queue@webkit.org [Tue, 19 Jul 2016 00:47:40 +0000 (00:47 +0000)]
If previous media session interruptions were prevented, still allow subsequent interruptions to try.
https://bugs.webkit.org/show_bug.cgi?id=157553
rdar://problem/25740804

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-07-18
Reviewed by Eric Carlson.

Source/WebCore:

Test: platform/ios-simulator/media/video-interruption-suspendunderlock.html

When suspending under lock on iOS, there is first a resign active event, then a
suspend under lock. PiP prevents resign active from interrupting playback. But it should allow the
suspend under lock to interrupt playback.

Currently if there are nested interruptions only the first one is acted upon.

This change allows subsequent, nested interruptions to have a chance to interrupt playback if the
previous interruptions were ignored.

This test is for iPad only, so it must be run manually.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::shouldOverrideBackgroundPlaybackRestriction):
* platform/audio/PlatformMediaSession.cpp:
(WebCore::PlatformMediaSession::beginInterruption):
* testing/Internals.cpp:
(WebCore::Internals::beginMediaSessionInterruption):

LayoutTests:

When suspending under lock on iOS, there is first a resign active event, then a
suspend under lock. PiP prevents resign active from interrupting playback. But it should allow the
suspend under lock to interrupt playback.

Currently if there are nested interruptions only the first one is acted upon.

This change allows subsequent, nested interruptions to have a chance to interrupt playback if the
previous interruptions were ignored.

This test is for iPad only, so it must be run manually.

* platform/ios-simulator/TestExpectations:
* platform/ios-simulator/media/video-interruption-suspendunderlock-expcted.txt: Added.
* platform/ios-simulator/media/video-interruption-suspendunderlock.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203388 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoDon't null out the IPC::Connection's XPC connection
andersca@apple.com [Tue, 19 Jul 2016 00:38:23 +0000 (00:38 +0000)]
Don't null out the IPC::Connection's XPC connection
https://bugs.webkit.org/show_bug.cgi?id=159911
rdar://problem/27018065

Reviewed by Alex Christensen.

The function that nulls out the XPC connection, platformInvalidate(), is called from the connection queue,
whereas the XPC connection is normally accessed from the main thread leading to inconsistencies when the
connection is being invalidated while the main thread is trying to access it.

Fix this by simply never nulling out the XPC connection. It will be released when the IPC::Connection is destroyed anyway.

* Platform/IPC/mac/ConnectionMac.mm:
(IPC::Connection::platformInvalidate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203387 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoEWS console logs doesn't go to log file
aakash_jain@apple.com [Tue, 19 Jul 2016 00:24:50 +0000 (00:24 +0000)]
EWS console logs doesn't go to log file
https://bugs.webkit.org/show_bug.cgi?id=159539
<rdar://problem/24464570>

Reviewed by David Kilzer.

* Scripts/webkitpy/common/system/logutils.py:
(configure_logger_to_log_to_file): Added method to configure the logger to log to file.
(FileSystemHandler): Added class which uses logging.FileHandler as base class and supports writing
to filesystem. It also supports passing MockFilesystem.
(FileSystemHandler.__init__): Initialize the class and calls base class __init__.
(FileSystemHandler._open): Overrides the base class _open method to use filesystem object.
* Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
(AbstractEarlyWarningSystemTest.test_failing_tests_message): Added MockHost() parameter.
(_test_ews): Same.
* Scripts/webkitpy/tool/commands/queues.py:
(AbstractQueue.begin_work_queue): Configure the logger to log to file.
(AbstractQueue._log_directory): Using filesystem object instead of os.
(AbstractQueue.queue_log_path): Same.
(AbstractQueue.__init__): Passed host parameter.
(PatchProcessingQueue.__init__): Same.
(CommitQueue.__init__): Same.
(AbstractReviewQueue.__init__): Same.
(StyleQueue.__init__): Same.
* Scripts/webkitpy/tool/commands/queues_unittest.py:
(TestCommitQueue): Passed MockHost() as host.
(TestCommitQueue.__init__): Same.
(TestQueue.__init__): Same.
(TestReviewQueue.__init__): Same.
(TestFeederQueue.__init__): Same.
(AbstractPatchQueueTest.test_next_patch): Same.
(PatchProcessingQueueTest.test_upload_results_archive_for_patch): Same.
(test_commit_queue_failure): Same.
(MockCommitQueueTask.results_from_patch_test_run): Same.
(test_rollout_lands): Same.
(test_non_valid_patch): Same.
(test_auto_retry): Same.
(test_style_queue_with_watch_list_exception): Same.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203386 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoTapping on an apple.com tab in tab overview stutters when switching to it
timothy_horton@apple.com [Tue, 19 Jul 2016 00:24:28 +0000 (00:24 +0000)]
Tapping on an apple.com tab in tab overview stutters when switching to it
https://bugs.webkit.org/show_bug.cgi?id=159904
<rdar://problem/27192350>

Reviewed by Simon Fraser.

* UIProcess/mac/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::waitForDidUpdateViewState):
In any case where we get to waitForDidUpdateViewState (usually a tab switch),
if we have an outstanding didUpdate message, the Web process will not commit
a new layer tree until it receives the didUpdate message. However, since
waitForDidUpdateViewState synchronously blocks the UI process, we also
won't *send* the didUpdate message, so we block for the full timeout duration.

Instead, if we get to waitForDidUpdateViewState, just send the didUpdate without
waiting for the DisplayLink or anything else, because calling rAF slightly too
quickly, once, is certainly better than blocking the UI process for a whole second.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203385 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[GTK] ENABLE_OPENGL=OFF build broken since r201802
clopez@igalia.com [Tue, 19 Jul 2016 00:20:23 +0000 (00:20 +0000)]
[GTK] ENABLE_OPENGL=OFF build broken since r201802
https://bugs.webkit.org/show_bug.cgi?id=159909

Reviewed by Antonio Gomes.

* WebProcess/WebPage/LayerTreeHost.h: Add missing include.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203384 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoDon't associate form-associated elements with forms in other trees.
bfulgham@apple.com [Tue, 19 Jul 2016 00:13:49 +0000 (00:13 +0000)]
Don't associate form-associated elements with forms in other trees.
https://bugs.webkit.org/show_bug.cgi?id=119451
<rdar://problem/27382946>

Change is based on the Blink change (patch by <adamk@chromium.org>):
<https://chromium.googlesource.com/chromium/blink/+/0b33128be67e7845d495d5219614c02ccfe7a414>

Reviewed by Chris Dumez.

Source/WebCore:

Prevent elements from being associated with forms that are not part of the same home subtree.
This brings us in line with the WhatWG HTML specification as of September, 2013.

Tests: fast/forms/image-disconnected-during-parse.html
       fast/forms/input-disconnected-during-parse.html

* dom/Element.h:
(WebCore::Node::rootElement): Added.
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::insertedInto): If the element is associated with a form that
is not part of the same tree, remove the association.
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::insertedInto): Ditto.

LayoutTests:

* fast/forms/image-disconnected-during-parse-expected.txt: Added.
* fast/forms/image-disconnected-during-parse.html: Added.
* fast/forms/input-disconnected-during-parse-expected.txt: Added.
* fast/forms/input-disconnected-during-parse.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203383 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoWebKit nightly fails to build on macOS Sierra
andersca@apple.com [Mon, 18 Jul 2016 23:54:37 +0000 (23:54 +0000)]
WebKit nightly fails to build on macOS Sierra
https://bugs.webkit.org/show_bug.cgi?id=159902
rdar://problem/27365672

Reviewed by Tim Horton.

Source/JavaScriptCore:

* icu/unicode/ucurr.h: Added.
Add ucurr.h from ICU.

Source/WebCore:

* Modules/applepay/cocoa/PaymentCocoa.mm:
* Modules/applepay/cocoa/PaymentContactCocoa.mm:
* Modules/applepay/cocoa/PaymentMerchantSessionCocoa.mm:
* Modules/applepay/cocoa/PaymentMethodCocoa.mm:
Use new PassKitSPI header.

* WebCore.xcodeproj/project.pbxproj:
Add new PassKitSPI header.

* icu/unicode/ucurr.h: Added.
Add ucurr.h from ICU.

* platform/spi/cocoa/PassKitSPI.h: Added.
Add new PassKitSPI header.

Source/WebKit/mac:

* icu/unicode/ucurr.h: Added.
Add ucurr.h from ICU.

Source/WebKit2:

* Shared/Cocoa/WebCoreArgumentCodersCocoa.mm:
* UIProcess/ApplePay/cocoa/WebPaymentCoordinatorProxyCocoa.h:
* UIProcess/ApplePay/cocoa/WebPaymentCoordinatorProxyCocoa.mm:
* UIProcess/ApplePay/mac/WebPaymentCoordinatorProxyMac.mm:
Use new PassKitSPI header.

Source/WTF:

* icu/unicode/ucurr.h: Added.
Add ucurr.h from ICU.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203381 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoREGRESSION (r202950): Image zoom animations are broken at medium.com (159861)
dino@apple.com [Mon, 18 Jul 2016 23:39:38 +0000 (23:39 +0000)]
REGRESSION (r202950): Image zoom animations are broken at medium.com (159861)
https://bugs.webkit.org/show_bug.cgi?id=159906
<rdar://problem/27391725>

Reviewed by Simon Fraser.

The fix for webkit.org/b/157569 in r200769 broke AMP pages.
The followup fix for webkit.org/b/159450 in r202950 broke Medium pages.

Revert them both until we have better testing.

Source/WebCore:

* css/CSSParser.cpp:
(WebCore::CSSParser::addPropertyWithPrefixingVariant):
(WebCore::CSSParser::parseValue):
(WebCore::CSSParser::parseAnimationShorthand):
(WebCore::CSSParser::parseTransitionShorthand): Deleted.
* css/CSSPropertyNames.in:
* css/PropertySetCSSStyleDeclaration.cpp:
(WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
(WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
(WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValueInternal):
(WebCore::PropertySetCSSStyleDeclaration::getPropertyValueInternal):
* css/StyleProperties.cpp:
(WebCore::MutableStyleProperties::removeShorthandProperty):
(WebCore::MutableStyleProperties::removeProperty):
(WebCore::MutableStyleProperties::removePrefixedOrUnprefixedProperty):
(WebCore::MutableStyleProperties::setProperty):
(WebCore::getIndexInShorthandVectorForPrefixingVariant):
(WebCore::MutableStyleProperties::appendPrefixingVariantProperty):
(WebCore::MutableStyleProperties::setPrefixingVariantProperty):
(WebCore::StyleProperties::asText): Deleted.
* css/StyleProperties.h:

LayoutTests:

* animations/fill-mode-forwards-zero-duration.html:
* animations/play-state-start-paused.html:
* animations/script-tests/spring-parsing.js:
(testSpring):
* animations/spring-parsing-expected.txt:
* animations/unprefixed-properties-expected.txt:
* animations/unprefixed-properties.html:
* fast/css/prefixed-unprefixed-variant-style-declaration-expected.txt:
* fast/css/shorthand-omitted-initial-value-overrides-shorthand-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203380 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoThere should be a way to simulate memory pressure in layout tests
akling@apple.com [Mon, 18 Jul 2016 23:16:24 +0000 (23:16 +0000)]
There should be a way to simulate memory pressure in layout tests
<https://webkit.org/b/159743>

Reviewed by Simon Fraser.

Source/WebCore:

Add three window.internal APIs:

    - boolean isUnderMemoryPressure (readonly attribute)
    - void beginSimulatedMemoryPressure()
    - void endSimulatedMemoryPressure()

These make it possible to write tests that exercise behaviors that only
occur during memory pressure situations.

I also implemented the "org.WebKit.lowMemory" notification handler using the new API.

Test: memory/memory-pressure-simulation.html

* platform/MemoryPressureHandler.cpp:
(WebCore::MemoryPressureHandler::beginSimulatedMemoryPressure):
(WebCore::MemoryPressureHandler::endSimulatedMemoryPressure):
* platform/MemoryPressureHandler.h:
(WebCore::MemoryPressureHandler::isUnderMemoryPressure):
* platform/cocoa/MemoryPressureHandlerCocoa.mm:
(WebCore::MemoryPressureHandler::platformReleaseMemory):
(WebCore::MemoryPressureHandler::install):
* testing/Internals.cpp:
(WebCore::Internals::isUnderMemoryPressure):
(WebCore::Internals::beginSimulatedMemoryPressure):
(WebCore::Internals::endSimulatedMemoryPressure):
* testing/Internals.h:
* testing/Internals.idl:

LayoutTests:

Add a basic test for the new APIs.

* memory/memory-pressure-simulation-expected.txt: Added.
* memory/memory-pressure-simulation.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203379 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[iOS] PDFDocumentImage should cache only a sub image of the PDF when caching the...
commit-queue@webkit.org [Mon, 18 Jul 2016 22:46:37 +0000 (22:46 +0000)]
[iOS] PDFDocumentImage should cache only a sub image of the PDF when caching the whole image is expensive
https://bugs.webkit.org/show_bug.cgi?id=158715

Source/WebCore:

Patch by Said Abou-Hallawa <sabouhallawa@apple,com> on 2016-07-18
Reviewed by Dean Jackson.

Test: fast/images/displaced-non-cached-pdf.html

For iOS, we need to ensure the size of the cached PDF images will not
exceed some limit. Also we should be caching only a sub image of the PDF
if caching the whole image will exceed the memory limit.

* page/Settings.cpp:
(WebCore::Settings::Settings):
(WebCore::Settings::setCachedPDFImageEnabled):
* page/Settings.h:
(WebCore::Settings::isCachedPDFImageEnabled):
    Add an option to disable caching the PDF images.

* platform/graphics/cg/PDFDocumentImage.cpp:
(WebCore::PDFDocumentImage::setCachedPDFImageEnabled):
    Allow the caller of draw() to disable caching the PDF images.

(WebCore::PDFDocumentImage::cacheParametersMatch):
    Match the context dirty rectangle with the cached image rectangle.

(WebCore::transformContextForPainting):
    When preparing the context for drawing the PDF, take the location
    of the destination rectangle into account. We do not need to scale
    the location of the source rectangle because we scale the size of
    the rectangle but we don't scale the whole coordinate system.

(WebCore::cachedImageRect):
    Calculate the rectangle of the cached image such that it does not
    exceed the limit. Start from the center of the dirty rectangle and
    then expand around it.

(WebCore::PDFDocumentImage::decodedSizeChanged):
    In addition to notifying the ImageObserver, it keeps track of the size
    of all the cached PDF images.

(WebCore::PDFDocumentImage::updateCachedImageIfNeeded):
    Ensure the size of all the cached images does not exceed the limit

(WebCore::PDFDocumentImage::destroyDecodedData):
* platform/graphics/cg/PDFDocumentImage.h:

* rendering/RenderImage.cpp:
(WebCore::RenderImage::paintIntoRect):
    Pass the option to disable caching the PDF images to PDFDocumentImage.

* testing/InternalSettings.cpp:
(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::setCachedPDFImageEnabled):
* testing/InternalSettings.h:
* testing/InternalSettings.idl:
    Add an internal option to disable caching the PDF images.

LayoutTests:

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2016-07-18
Reviewed by Dean Jackson.

Make sure the PDF image will be displayed at the correct position if caching
the PDF image is disabled.

* fast/images/displaced-non-cached-pdf-expected.html: Added.
* fast/images/displaced-non-cached-pdf.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203378 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoThe 2 first parameters to addEventListener() / removeEventListener() should be mandatory
cdumez@apple.com [Mon, 18 Jul 2016 22:33:32 +0000 (22:33 +0000)]
The 2 first parameters to addEventListener() / removeEventListener() should be mandatory
https://bugs.webkit.org/show_bug.cgi?id=158008

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline several W3C tests now that more checks are passing.

* web-platform-tests/XMLHttpRequest/interfaces-expected.txt:
* web-platform-tests/dom/interfaces-expected.txt:
* web-platform-tests/html/dom/interfaces-expected.txt:

Source/WebCore:

The 2 first parameters to addEventListener() / removeEventListener() should be
mandatory:
- https://dom.spec.whatwg.org/#interface-eventtarget

Firefox 46 and Chrome 50 both match the specification and throw an exception when those
parameters are omitted. However, those parameters were marked as optional in WebKit and
the calls were no-ops if those parameters were omitted. This patch aligns our behavior
with the specification and other browsers.

Test: fast/dom/eventtarget-api-parameters.html

* bindings/scripts/CodeGeneratorJS.pm:
(GetFunctionLength): Deleted.
* dom/EventTarget.idl:

LayoutTests:

* fast/dom/Window/window-legacy-event-listener-expected.txt: Removed.
* fast/dom/Window/window-legacy-event-listener.html: Removed.
* fast/dom/XMLHttpRequest-legacy-event-listener-expected.txt: Removed.
* fast/dom/XMLHttpRequest-legacy-event-listener.html: Removed.
* fast/dom/node-legacy-event-listener-expected.txt: Removed.
* fast/dom/node-legacy-event-listener.html: Removed.
Drop legacy tests that expect the addEventListener() / removeEventListener()
parameters to be optional.

* fast/dom/eventtarget-api-parameters-expected.txt: Added.
* fast/dom/eventtarget-api-parameters.html: Added.
Add layout test to check that the 2 first parameters of addEventListener()
and removeEventListener() are now mandatory. It also checks that the
second parameter is nullable.

* media/video-remote-control-playpause.html:
Drop useless call to addEventListener() without a listener as it now throws.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203377 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoASSERTION FAILED: : (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0...
msaboff@apple.com [Mon, 18 Jul 2016 22:20:50 +0000 (22:20 +0000)]
ASSERTION FAILED: : (year >= 1970 && yearday >= 0) || (year < 1970 && yearday < 0) -- WTF/wtf/DateMath.cpp
https://bugs.webkit.org/show_bug.cgi?id=159883

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

New test.

* tests/stress/regress-159883.js: Added.

Source/WTF:

The function daysFrom1970ToYear() takes an integer year and returns a double result.
The calculation uses 1970 as a baseline year and subtracts 1970 from the argument year.
It does that subtraction using integer arithmetic, which given negative years close to
INT_MIN can underflow as a result of subtracting 1970.  Since we want a double result,
the fix is to cast year as a double before the subtraction, which eliminates the underflow.

* wtf/DateMath.cpp:
(WTF::daysFrom1970ToYear):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203376 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMarkedBlocks should know that they can be used for more than JSCells
fpizlo@apple.com [Mon, 18 Jul 2016 21:33:45 +0000 (21:33 +0000)]
MarkedBlocks should know that they can be used for more than JSCells
https://bugs.webkit.org/show_bug.cgi?id=159643

Reviewed by Geoffrey Garen.

This teaches the Heap that a MarkedBlock may hold either JSCells, or Auxiliary, which is
not a JSCell. It teaches the heap and all of the things that walk the heap to ignore
non-JSCells whenever they are looking for global objects, JSObjects, and things to trace
for debugging or profiling. The idea is that we will be able to allocate butterflies and
typed array backing stores as Auxiliary in MarkedSpace rather than allocating those things
in CopiedSpace. That's what bug 159658 is all about.

This gives us a new type, called HeapCell, which is just meant to be a class distinct from
JSCell or any type we would use for Auxiliary. For convenience, JSCell is a subclass of
HeapCell. HeapCell has an enum called HeapCell::Kind, which is either HeapCell::JSCell or
HeapCell::Auxiliary. MarkedSpace no longer speaks of JSCells directly except when dealing
with destruction.

This change required doing a lot of stuff to all of those functor callbacks, since they
now take HeapCell* instead of JSCell* and they take an extra HeapCell::Kind argument to
tell them if they are dealing with JSCells or Auxiliary. I figured that this would be as
good a time as any to convert those functors to being lambda-compatible. This means that
operator() must be const. In some cases, converting the operator() to be const would have
taken more work than just turning the whole thing into a lambda. Whenever this was the
case, I converted the code to use lambdas. I left a lot of functors alone. In cases where
the functor would benefit from being a lambda, for example because it would get rid of
const_casts or mutables, I put in a FIXME referencing bug 159644.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* debugger/Debugger.cpp:
(JSC::Debugger::SetSteppingModeFunctor::SetSteppingModeFunctor):
(JSC::Debugger::SetSteppingModeFunctor::operator()):
(JSC::Debugger::ToggleBreakpointFunctor::ToggleBreakpointFunctor):
(JSC::Debugger::ToggleBreakpointFunctor::operator()):
(JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor::ClearCodeBlockDebuggerRequestsFunctor):
(JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor::operator()):
(JSC::Debugger::ClearDebuggerRequestsFunctor::ClearDebuggerRequestsFunctor):
(JSC::Debugger::ClearDebuggerRequestsFunctor::operator()):
* heap/CodeBlockSet.h:
(JSC::CodeBlockSet::iterate):
* heap/HandleSet.h:
(JSC::HandleNode::next):
(JSC::HandleSet::forEachStrongHandle):
* heap/Heap.cpp:
(JSC::GatherHeapSnapshotData::GatherHeapSnapshotData):
(JSC::GatherHeapSnapshotData::operator()):
(JSC::RemoveDeadHeapSnapshotNodes::RemoveDeadHeapSnapshotNodes):
(JSC::RemoveDeadHeapSnapshotNodes::operator()):
(JSC::Heap::protectedGlobalObjectCount):
(JSC::Heap::globalObjectCount):
(JSC::Heap::protectedObjectCount):
(JSC::Heap::protectedObjectTypeCounts):
(JSC::Heap::objectTypeCounts):
(JSC::Heap::deleteAllCodeBlocks):
(JSC::MarkedBlockSnapshotFunctor::MarkedBlockSnapshotFunctor):
(JSC::MarkedBlockSnapshotFunctor::operator()):
(JSC::Zombify::visit):
(JSC::Zombify::operator()):
(JSC::Heap::zombifyDeadObjects):
(JSC::Heap::flushWriteBarrierBuffer):
* heap/Heap.h:
(JSC::Heap::handleSet):
(JSC::Heap::handleStack):
* heap/HeapCell.cpp: Added.
(WTF::printInternal):
* heap/HeapCell.h: Added.
(JSC::HeapCell::HeapCell):
(JSC::HeapCell::zap):
(JSC::HeapCell::isZapped):
* heap/HeapInlines.h:
(JSC::Heap::deprecatedReportExtraMemory):
(JSC::Heap::forEachCodeBlock):
(JSC::Heap::forEachProtectedCell):
(JSC::Heap::allocateWithDestructor):
* heap/HeapStatistics.cpp:
(JSC::StorageStatistics::visit):
(JSC::StorageStatistics::operator()):
* heap/HeapVerifier.cpp:
(JSC::GatherLiveObjFunctor::visit):
(JSC::GatherLiveObjFunctor::operator()):
* heap/MarkedAllocator.cpp:
(JSC::MarkedAllocator::allocateBlock):
(JSC::MarkedAllocator::addBlock):
(JSC::MarkedAllocator::reset):
(JSC::MarkedAllocator::lastChanceToFinalize):
(JSC::LastChanceToFinalize::operator()): Deleted.
* heap/MarkedAllocator.h:
(JSC::MarkedAllocator::takeLastActiveBlock):
(JSC::MarkedAllocator::resumeAllocating):
(JSC::MarkedAllocator::forEachBlock):
* heap/MarkedBlock.cpp:
(JSC::MarkedBlock::create):
(JSC::MarkedBlock::destroy):
(JSC::MarkedBlock::MarkedBlock):
(JSC::MarkedBlock::callDestructor):
(JSC::MarkedBlock::specializedSweep):
(JSC::SetNewlyAllocatedFunctor::SetNewlyAllocatedFunctor):
(JSC::SetNewlyAllocatedFunctor::operator()):
(JSC::MarkedBlock::stopAllocating):
(JSC::MarkedBlock::didRetireBlock):
* heap/MarkedBlock.h:
(JSC::MarkedBlock::CountFunctor::CountFunctor):
(JSC::MarkedBlock::CountFunctor::count):
(JSC::MarkedBlock::CountFunctor::returnValue):
(JSC::MarkedBlock::needsDestruction):
(JSC::MarkedBlock::cellKind):
(JSC::MarkedBlock::size):
(JSC::MarkedBlock::clearNewlyAllocated):
(JSC::MarkedBlock::isMarkedOrNewlyAllocated):
(JSC::MarkedBlock::isLive):
(JSC::MarkedBlock::isLiveCell):
(JSC::MarkedBlock::forEachCell):
(JSC::MarkedBlock::forEachLiveCell):
(JSC::MarkedBlock::forEachDeadCell):
* heap/MarkedSpace.cpp:
(JSC::MarkedSpace::MarkedSpace):
(JSC::MarkedSpace::~MarkedSpace):
(JSC::MarkedSpace::lastChanceToFinalize):
(JSC::MarkedSpace::sweep):
(JSC::MarkedSpace::zombifySweep):
(JSC::MarkedSpace::resetAllocators):
(JSC::MarkedSpace::visitWeakSets):
(JSC::MarkedSpace::reapWeakSets):
(JSC::MarkedSpace::forEachAllocator):
(JSC::MarkedSpace::stopAllocating):
(JSC::MarkedSpace::resumeAllocating):
(JSC::MarkedSpace::isPagedOut):
(JSC::MarkedSpace::shrink):
(JSC::clearNewlyAllocatedInBlock):
(JSC::MarkedSpace::clearNewlyAllocated):
(JSC::MarkedSpace::clearMarks):
(JSC::Free::Free): Deleted.
(JSC::Free::operator()): Deleted.
(JSC::FreeOrShrink::FreeOrShrink): Deleted.
(JSC::FreeOrShrink::operator()): Deleted.
(JSC::VisitWeakSet::VisitWeakSet): Deleted.
(JSC::VisitWeakSet::operator()): Deleted.
(JSC::ReapWeakSet::operator()): Deleted.
(JSC::LastChanceToFinalize::operator()): Deleted.
(JSC::StopAllocatingFunctor::operator()): Deleted.
(JSC::ResumeAllocatingFunctor::operator()): Deleted.
(JSC::ClearNewlyAllocated::operator()): Deleted.
(JSC::VerifyNewlyAllocated::operator()): Deleted.
* heap/MarkedSpace.h:
(JSC::MarkedSpace::forEachLiveCell):
(JSC::MarkedSpace::forEachDeadCell):
(JSC::MarkedSpace::allocatorFor):
(JSC::MarkedSpace::allocateWithDestructor):
(JSC::MarkedSpace::forEachBlock):
(JSC::MarkedSpace::didAddBlock):
(JSC::MarkedSpace::objectCount):
(JSC::MarkedSpace::size):
(JSC::MarkedSpace::capacity):
(JSC::ClearMarks::operator()): Deleted.
(JSC::Sweep::operator()): Deleted.
(JSC::ZombifySweep::operator()): Deleted.
(JSC::MarkCount::operator()): Deleted.
(JSC::Size::operator()): Deleted.
* runtime/JSCell.h:
(JSC::JSCell::zap): Deleted.
(JSC::JSCell::isZapped): Deleted.
* runtime/JSCellInlines.h:
(JSC::allocateCell):
(JSC::JSCell::isObject):
(JSC::isZapped): Deleted.
* runtime/JSGlobalObject.cpp:
* tools/JSDollarVMPrototype.cpp:
(JSC::CellAddressCheckFunctor::CellAddressCheckFunctor):
(JSC::CellAddressCheckFunctor::operator()):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203375 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUnreviewed, rolling out r203373.
bfulgham@apple.com [Mon, 18 Jul 2016 21:15:02 +0000 (21:15 +0000)]
Unreviewed, rolling out r203373.

Unaddressed

Reverted changeset:

"Don't associate form-associated elements with forms in other
trees."
https://bugs.webkit.org/show_bug.cgi?id=119451
http://trac.webkit.org/changeset/203373

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203374 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoDon't associate form-associated elements with forms in other trees.
bfulgham@apple.com [Mon, 18 Jul 2016 21:12:14 +0000 (21:12 +0000)]
Don't associate form-associated elements with forms in other trees.
https://bugs.webkit.org/show_bug.cgi?id=119451
<rdar://problem/27382946>

Change is based on the Blink change (patch by <adamk@chromium.org>):
<https://chromium.googlesource.com/chromium/blink/+/0b33128be67e7845d495d5219614c02ccfe7a414>

Reviewed by Zalan Bujtas.

Source/WebCore:

Prevent elements from being associated with forms that are not part of the same home subtree.
This brings us in line with the WhatWG HTML specification as of September, 2013.

Tests: fast/forms/image-disconnected-during-parse.html
       fast/forms/input-disconnected-during-parse.html

* dom/NodeTraversal.h:
(WebCore::NodeTraversal::highestAncestorOrSelf): Added.
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::insertedInto): If the element is associated with a form that
is not part of the same tree, remove the association.
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::insertedInto): Ditto.

LayoutTests:

* fast/forms/image-disconnected-during-parse-expected.txt: Added.
* fast/forms/image-disconnected-during-parse.html: Added.
* fast/forms/input-disconnected-during-parse-expected.txt: Added.
* fast/forms/input-disconnected-during-parse.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203373 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMarking storage/indexeddb/modern/handle-user-delete.html as flaky on mac-wk2
ryanhaddad@apple.com [Mon, 18 Jul 2016 20:59:10 +0000 (20:59 +0000)]
Marking storage/indexeddb/modern/handle-user-delete.html as flaky on mac-wk2
https://bugs.webkit.org/show_bug.cgi?id=159896

Unreviewed test gardening.

* platform/mac-wk2/TestExpectations:
* platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203372 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMail contents are temporarily obscured by black rectangles when returning from suspen...
timothy_horton@apple.com [Mon, 18 Jul 2016 20:41:18 +0000 (20:41 +0000)]
Mail contents are temporarily obscured by black rectangles when returning from suspend and in app switcher
https://bugs.webkit.org/show_bug.cgi?id=159894
<rdar://problem/26973202>

Reviewed by Simon Fraser.

* UIProcess/ApplicationStateTracker.h:
* UIProcess/ApplicationStateTracker.mm:
(WebKit::ApplicationStateTracker::ApplicationStateTracker):
(WebKit::ApplicationStateTracker::~ApplicationStateTracker):
(WebKit::ApplicationStateTracker::applicationDidCreateWindowContext):
* UIProcess/ios/WKContentView.mm:
(-[WKContentView didMoveToWindow]):
(-[WKContentView _applicationDidCreateWindowContext]):
(-[WKContentView _applicationWillEnterForeground]): Deleted.
* UIProcess/ios/WKPDFView.mm:
(-[WKPDFView didMoveToWindow]):
(-[WKPDFView _applicationDidCreateWindowContext]):
* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::applicationDidFinishSnapshottingAfterEnteringBackground):
Hide content at window context creation time, instead of when the application
becomes foregrounded. Otherwise, background snapshots (which create/destroy
window contexts, but do not bring the app into the foreground) can have
parented layers that have volatile surfaces in them. In the normal case,
we will subsequently get foregrounded and re-build the layer tree; in the
background snapshot case, we will just have an empty layer tree.

In the future, we should consider making ApplicationStateTracker use
window context creation/destruction to drive web process lifetime, so
that we can actually paint correctly for background snapshots.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203371 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoSource/JavaScriptCore:
fpizlo@apple.com [Mon, 18 Jul 2016 20:31:20 +0000 (20:31 +0000)]
Source/JavaScriptCore:
Repeatedly creating and destroying workers that enqueue DFG plans can outpace the DFG worklist, which then causes VM shutdown to stall, which then causes memory growth
https://bugs.webkit.org/show_bug.cgi?id=159754

Reviewed by Geoffrey Garen.

If you create and destroy workers at a high rate and those workers enqueue some DFG plans
that are still not compiled at the time that the worker is closed, then the closed workers
end up stalling in VM::~VM waiting for the DFG worklist thread to finish those plans. Since
we don't actually cancel the plans, it's easy to create a situation where the workers
outpace the DFG worklist, especially if you create many workers at a time and each one
finishes just after enqueueing those plans.

The solution is to allow VM::~VM to remove plans from the DFG worklist that are related to
that VM but aren't currently being worked on. That turns out to be an easy change.

I have a test that repros this, but it's quite long-running. I call it workers/bomb.html. We
may want to exclude it from test runs because of how long it takes.

* dfg/DFGWorklist.cpp:
(JSC::DFG::Worklist::removeDeadPlans):
(JSC::DFG::Worklist::removeNonCompilingPlansForVM):
(JSC::DFG::Worklist::queueLength):
(JSC::DFG::Worklist::runThread):
* dfg/DFGWorklist.h:
* runtime/VM.cpp:
(JSC::VM::~VM):

LayoutTests:
Repeatedly creating and destroying workers that enqueue DFG plans can outpace the DFG worklist, which then causes VM shutdown to stall, which then causes a memory growth
https://bugs.webkit.org/show_bug.cgi?id=159754

Reviewed by Geoffrey Garen.

Adds two tests that create a lot of workers that do sophisticated things. These are
long-running tests so we may want to skip them. It's OK if we end up only running them
manually occasionally.

* workers: Added.
* workers/bomb.html: Added.
* workers/bomb-expected.txt: Added.
* workers/bomb-with-v8.html: Added.
* workers/tests: Added.
* workers/tests/3d-cube.js: Added.
* workers/tests/3d-morph.js: Added.
* workers/tests/3d-raytrace.js: Added.
* workers/tests/access-binary-trees.js: Added.
* workers/tests/access-fannkuch.js: Added.
* workers/tests/access-nbody.js: Added.
* workers/tests/access-nsieve.js: Added.
* workers/tests/bitops-3bit-bits-in-byte.js: Added.
* workers/tests/bitops-bits-in-byte.js: Added.
* workers/tests/bitops-bitwise-and.js: Added.
* workers/tests/bitops-nsieve-bits.js: Added.
* workers/tests/controlflow-recursive.js: Added.
* workers/tests/crypto-aes.js: Added.
* workers/tests/crypto-md5.js: Added.
* workers/tests/crypto-sha1.js: Added.
* workers/tests/date-format-tofte.js: Added.
* workers/tests/date-format-xparb.js: Added.
* workers/tests/math-cordic.js: Added.
* workers/tests/math-partial-sums.js: Added.
* workers/tests/math-spectral-norm.js: Added.
* workers/tests/regexp-dna.js: Added.
* workers/tests/string-base64.js: Added.
* workers/tests/string-fasta.js: Added.
* workers/tests/string-tagcloud.js: Added.
* workers/tests/string-unpack-code.js: Added.
* workers/tests/string-validate-input.js: Added.
* workers/tests/v8-crypto.js: Added.
* workers/tests/v8-deltablue.js: Added.
* workers/tests/v8-earley-boyer.js: Added.
* workers/tests/v8-raytrace.js: Added.
* workers/tests/v8-regexp.js: Added.
* workers/tests/v8-richards.js: Added.
* workers/tests/v8-splay.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203370 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMarking storage/indexeddb/modern/abort-requests-cancelled.html as flaky on mac-wk1
ryanhaddad@apple.com [Mon, 18 Jul 2016 20:16:55 +0000 (20:16 +0000)]
Marking storage/indexeddb/modern/abort-requests-cancelled.html as flaky on mac-wk1
https://bugs.webkit.org/show_bug.cgi?id=156070

Unreviewed test gardening.

* platform/mac-wk1/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203369 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoObject.preventExtensions/seal/freeze makes code much slower
fpizlo@apple.com [Mon, 18 Jul 2016 20:12:45 +0000 (20:12 +0000)]
Object.preventExtensions/seal/freeze makes code much slower
https://bugs.webkit.org/show_bug.cgi?id=143247

Reviewed by Michael Saboff.

Source/JavaScriptCore:

This has been a huge pet peeve of mine for a long time, but I was always afraid of fixing
it because I thought that it would be hard. Well, it looks like it's not hard at all.

The problem is that you cannot mutate a structure that participates in transition caching.
You can only clone the structure and mutate that one. But if you do this, you have to make
a hard choice:

1) Clone the structure without caching the transition. This is what the code did before
   this change. It's the most obvious choice, but it introduces an uncacheable transition
   that leads to an explosion of structures, which then breaks all inline caches.

2) Perform one of the existing cacheable transitions. Cacheable transitions can either add
   properties or they can do one of the NonPropertyTransitions, which until now have been
   restricted to just IndexingType transitions. So, only adding transitions or making
   certain prescribed changes to the indexing type count as cacheable transitions.

This change decouples NonPropertyTransition from IndexingType and adds three new kinds of
transitions: PreventExtensions, Seal, and Freeze. We have to give any cacheable transition
a name that fully disambiguates this transition from any other, so that the transition can
be cached. Since we're already giving them names in an enum, I figured that the most
pragmatic way to implement them is to have Structure::nonPropertyTransition() case on the
NonPropertyTransition and implement all of the mutations associated with that transition.
The alternative would have been to allow callers of nonPropertyTransition() to supply
something like a lambda that describes the mutation, but this seemed awkward since each
set of mutations has to anyway be tied to one of the NonPropertyTransition members.

This is an enormous speed-up on microbenchmarks that use Object.preventExtensions(),
Object.seal(), or Object.freeze(). I don't know if "real" benchmarks use these features
and I don't really care. This should be fast.

* runtime/JSObject.cpp:
(JSC::JSObject::notifyPresenceOfIndexedAccessors):
(JSC::JSObject::createInitialUndecided):
(JSC::JSObject::createInitialInt32):
(JSC::JSObject::createInitialDouble):
(JSC::JSObject::createInitialContiguous):
(JSC::JSObject::convertUndecidedToInt32):
(JSC::JSObject::convertUndecidedToDouble):
(JSC::JSObject::convertUndecidedToContiguous):
(JSC::JSObject::convertInt32ToDouble):
(JSC::JSObject::convertInt32ToContiguous):
(JSC::JSObject::convertDoubleToContiguous):
(JSC::JSObject::switchToSlowPutArrayStorage):
* runtime/Structure.cpp:
(JSC::Structure::suggestedArrayStorageTransition):
(JSC::Structure::addPropertyTransition):
(JSC::Structure::toUncacheableDictionaryTransition):
(JSC::Structure::sealTransition):
(JSC::Structure::freezeTransition):
(JSC::Structure::preventExtensionsTransition):
(JSC::Structure::takePropertyTableOrCloneIfPinned):
(JSC::Structure::nonPropertyTransition):
(JSC::Structure::pin):
(JSC::Structure::pinForCaching):
(JSC::Structure::allocateRareData):
* runtime/Structure.h:
* runtime/StructureTransitionTable.h:
(JSC::toAttributes):
(JSC::changesIndexingType):
(JSC::newIndexingType):
(JSC::preventsExtensions):
(JSC::setsDontDeleteOnAllProperties):
(JSC::setsReadOnlyOnAllProperties):

LayoutTests:

These tests now run ~25x faster.

* js/regress/freeze-and-do-work-expected.txt: Added.
* js/regress/freeze-and-do-work.html: Added.
* js/regress/prevent-extensions-and-do-work-expected.txt: Added.
* js/regress/prevent-extensions-and-do-work.html: Added.
* js/regress/script-tests/freeze-and-do-work.js: Added.
(Foo):
* js/regress/script-tests/prevent-extensions-and-do-work.js: Added.
(Foo):
* js/regress/script-tests/seal-and-do-work.js: Added.
(Foo):
* js/regress/seal-and-do-work-expected.txt: Added.
* js/regress/seal-and-do-work.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203368 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMarking imported/w3c/web-platform-tests/XMLHttpRequest/event-readystatechange-loaded...
ryanhaddad@apple.com [Mon, 18 Jul 2016 20:12:00 +0000 (20:12 +0000)]
Marking imported/w3c/web-platform-tests/XMLHttpRequest/event-readystatechange-loaded.htm as flaky on mac-debug WK1
https://bugs.webkit.org/show_bug.cgi?id=159893

Unreviewed test gardening.

* platform/mac-wk1/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203367 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMarking media/video-load-preload-metadata.html as flaky on Mac.
ryanhaddad@apple.com [Mon, 18 Jul 2016 20:03:18 +0000 (20:03 +0000)]
Marking media/video-load-preload-metadata.html as flaky on Mac.
https://bugs.webkit.org/show_bug.cgi?id=128312

Unreviewed test gardening.

* platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203366 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoRegisterSet should use a Bitmap instead of a BitVector so that it never allocates...
fpizlo@apple.com [Mon, 18 Jul 2016 19:51:45 +0000 (19:51 +0000)]
RegisterSet should use a Bitmap instead of a BitVector so that it never allocates memory and is trivial to copy
https://bugs.webkit.org/show_bug.cgi?id=159863

Reviewed by Saam Barati.

Source/JavaScriptCore:

Switch RegisterSet set to Bitmap because Bitmap doesn't ever allocate memory and can be
assigned by memcpy. This should be a performance improvement for compiler code that does a
lot of things with RegisterSet. For example, it's one of the fundamental data structures in
Air. The previous use of BitVector meant that almost every operation on RegisterSet would
have a slow path call. On ARM64, it would mean memory allocation for any RegisterSet that
used all available registers.

This meant adding even more GPR/FPR reflection to the MacroAssembler API: we now have consts
called numGPRs and numFPRs. This is necessary to statically size the Bitmap in RegisterSet.

Here's the breakdown of sizes of RegisterSet on different CPUs:

x86-32: 8 bits (GPRs) + 8 bits (FPRs) + 1 bit (is deleted) = 1x uint32_t.
x86-64: 16 bits + 16 bits + 1 bit = 2x uint32_t.
ARMv7: 16 bits + 16 bits + 1 bit = 2x uint32_t.
ARM64: 32 bits + 32 bits + 1 bit = 3x uint32_t.

* assembler/MacroAssemblerARM.h:
* assembler/MacroAssemblerARM64.h:
* assembler/MacroAssemblerARMv7.h:
* assembler/MacroAssemblerX86.h:
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::scratchRegister):
* assembler/MacroAssemblerX86_64.h:
* jit/RegisterSet.h:
(JSC::RegisterSet::set):
(JSC::RegisterSet::get):
(JSC::RegisterSet::setAll):
(JSC::RegisterSet::merge):
(JSC::RegisterSet::filter):
(JSC::RegisterSet::exclude):
(JSC::RegisterSet::numberOfSetRegisters):
(JSC::RegisterSet::RegisterSet):
(JSC::RegisterSet::isEmptyValue):
(JSC::RegisterSet::isDeletedValue):
(JSC::RegisterSet::operator==):
(JSC::RegisterSet::operator!=):
(JSC::RegisterSet::hash):
(JSC::RegisterSet::forEach):
(JSC::RegisterSet::setMany):

Source/WTF:

Give Bitmap all of the power of BitVector (except for automatic resizing). This means a
variant of set() that takes a bool, and a bunch of helper methods (merge, filter, exclude,
forEachSetBit, ==, !=, and hash).

* wtf/Bitmap.h:
(WTF::WordType>::set):
(WTF::WordType>::testAndSet):
(WTF::WordType>::isFull):
(WTF::WordType>::merge):
(WTF::WordType>::filter):
(WTF::WordType>::exclude):
(WTF::WordType>::forEachSetBit):
(WTF::=):
(WTF::WordType>::hash):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203365 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoDFG and FTL should support op_call_eval
fpizlo@apple.com [Mon, 18 Jul 2016 19:32:34 +0000 (19:32 +0000)]
DFG and FTL should support op_call_eval
https://bugs.webkit.org/show_bug.cgi?id=159786

Reviewed by Saam Barati.
Source/JavaScriptCore:

This adds support for op_call_eval in DFG and FTL by brute force:

- There is now a CallEval() node type, which compiles exactly the same way that we do in
  baseline.

- We teach the DFG and bytecode liveness that the scope register and 'this' are read by
  CallEval()/op_call_eval.

We can compile eval quite well, except that right now we cannot inline functions that use
eval. It would be nice to do that, but the payoff is probably smaller. "Don't inline users
of eval" may even be an OK inlining heuristic. Not inlining users of eval allows me to
reuse the baseline implementation, which is really great. Otherwise, I'd have to get rid
of things like the rogue reads of scope register and 'this'.

The goal here is to produce speed-ups for code that has functions that do both eval and
some computational stuff. Obviously, we're not producing any benefit for the eval itself.
But now the other stuff in a function that uses eval will get to participate in
optimization.

This is a huge speed-up on microbenchmarks.

* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::printCallOp):
(JSC::CodeBlock::dumpBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::setLocal):
(JSC::DFG::ByteCodeParser::setArgument):
(JSC::DFG::ByteCodeParser::flush):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::needsScopeRegister):
(JSC::DFG::Graph::needsFlushedThis):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGMayExit.cpp:
* dfg/DFGNode.h:
(JSC::DFG::Node::hasHeapPrediction):
* dfg/DFGNodeType.h:
* dfg/DFGOSRExitCompiler.cpp:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStackLayoutPhase.cpp:
(JSC::DFG::StackLayoutPhase::run):
* dfg/DFGWatchpointCollectionPhase.cpp:
(JSC::DFG::WatchpointCollectionPhase::handle):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLCompile.cpp:
(JSC::FTL::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
(JSC::FTL::DFG::LowerDFGToB3::compileCallEval):
(JSC::FTL::DFG::LowerDFGToB3::compileLoadVarargs):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::restoreCalleeSavesFromVMEntryFrameCalleeSavesBuffer):
(JSC::AssemblyHelpers::emitDumbVirtualCall):
* jit/AssemblyHelpers.h:
(JSC::AssemblyHelpers::emitTypeOf):
* jit/JITCall.cpp:
(JSC::JIT::compileCallEvalSlowCase):
* jit/JITCall32_64.cpp:
(JSC::JIT::compileCallEvalSlowCase):
* jit/JITOperations.cpp:
* tests/stress/exit-then-eval.js: Added.
(foo):
* tests/stress/force-exit-then-eval-dfg.js: Added.
(foo):
* tests/stress/force-exit-then-eval.js: Added.
(foo):

LayoutTests:

* js/regress/eval-compute-expected.txt: Added.
* js/regress/eval-compute.html: Added.
* js/regress/eval-not-eval-compute-args-expected.txt: Added.
* js/regress/eval-not-eval-compute-args.html: Added.
* js/regress/eval-not-eval-compute-expected.txt: Added.
* js/regress/eval-not-eval-compute.html: Added.
* js/regress/script-tests/eval-compute.js: Added.
(foo):
* js/regress/script-tests/eval-not-eval-compute-args.js: Added.
(foo):
(i.result.foo):
* js/regress/script-tests/eval-not-eval-compute.js: Added.
(foo):
(i.result.foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203364 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMove MediaSampleAVFObjC into its own file
commit-queue@webkit.org [Mon, 18 Jul 2016 19:23:41 +0000 (19:23 +0000)]
Move MediaSampleAVFObjC into its own file
https://bugs.webkit.org/show_bug.cgi?id=159796
<rdar://problem/27362488>

In preparation for a feature that uses MediaSampleAVFObjC, but does
not need SourceBufferPrivateAVFObjC, it is beneficial to move
MediaSampleAVFObjC to its own file.

Patch by George Ruan <gruan@apple.com> on 2016-07-18
Reviewed by Eric Carlson.

* WebCore.xcodeproj/project.pbxproj:
* platform/MediaSample.h: Allow setting trackID to associate
MediaSample id with MediaStreamTrackPrivate id.
* platform/graphics/avfoundation/MediaSampleAVFObjC.h: Added.
* platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm: Moved
from MediaSampleAVFObjC
(WebCore::MediaSampleAVFObjC::presentationTime):
(WebCore::MediaSampleAVFObjC::decodeTime):
(WebCore::MediaSampleAVFObjC::duration):
(WebCore::MediaSampleAVFObjC::sizeInBytes):
(WebCore::MediaSampleAVFObjC::platformSample):
(WebCore::CMSampleBufferIsRandomAccess):
(WebCore::MediaSampleAVFObjC::flags):
(WebCore::MediaSampleAVFObjC::presentationSize):
(WebCore::MediaSampleAVFObjC::dump):
(WebCore::MediaSampleAVFObjC::offsetTimestampsBy):
(WebCore::MediaSampleAVFObjC::setTimestamps):
* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
Moved MediaSampleAVFObjC to its own file.
(WebCore::MediaSampleAVFObjC::platformSample): Deleted.
(WebCore::CMSampleBufferIsRandomAccess): Deleted.
(WebCore::MediaSampleAVFObjC::flags): Deleted.
(WebCore::MediaSampleAVFObjC::presentationSize): Deleted.
(WebCore::MediaSampleAVFObjC::dump): Deleted.
(WebCore::MediaSampleAVFObjC::offsetTimestampsBy): Deleted.
(WebCore::MediaSampleAVFObjC::setTimestamps): Deleted.
* platform/mock/mediasource/MockSourceBufferPrivate.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203363 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[MSE][Mac] Pass AVSampleBufferDisplayLayer HDCP status to a newly created key session
eric.carlson@apple.com [Mon, 18 Jul 2016 19:18:23 +0000 (19:18 +0000)]
[MSE][Mac] Pass AVSampleBufferDisplayLayer HDCP status to a newly created key session
https://bugs.webkit.org/show_bug.cgi?id=159812
<rdar://problem/27371624>

Reviewed by Jon Lee.

No new tests, it isn't possible to test this with our current testing infrastructure.

* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
(WebCore::SourceBufferPrivateAVFObjC::setCDMSession): Call layerDidReceiveError if there has
been an HDCP error.
(WebCore::SourceBufferPrivateAVFObjC::rendererDidReceiveError): Remember an HDCP error.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203362 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoDFG should really support jneq_ptr
fpizlo@apple.com [Mon, 18 Jul 2016 19:12:57 +0000 (19:12 +0000)]
DFG should really support jneq_ptr
https://bugs.webkit.org/show_bug.cgi?id=159700

Reviewed by Keith Miller.

Source/JavaScriptCore:

Prior to this change, DFG statically speculated that jneq_ptr would always fall through. This
meant that programs that called o.apply() or o.call() where apply or call weren't the
expected ones (i.e. the function.prototype.apply/call) would rage-recompile forever.

This adds profiling to jneq_ptr. We now know if it always falls through or sometimes doesn't.
If it sometimes doesn't, we now emit an actual control flow diamond. I decided to add a new
NodeType for "equal pointer", since none of the existing ones really captured that. For
example, there was no way to express "equal pointer" for strings or symbols. We don't use it
for that right now, but we might, and if we did, then it would be hugely surprising that the
DFG interpreted this as value equality. So, the DFG now has CompareEqPtr, which means exactly
what jneq_ptr means by "equal pointer".

This is an enormous speed-up on microbenchmarks. I would assume that it's a speed-up on some
real things, too, but I don't know that for a fact.

* bytecode/BytecodeList.json:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
(JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
(JSC::BytecodeGenerator::emitExpectedFunctionSnippet):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasCellOperand):
* dfg/DFGNodeType.h:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileRecordRegExpCachedResult):
(JSC::DFG::SpeculativeJIT::compileCompareEqPtr):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGValidate.cpp:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareEqPtr):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareLess):
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEqConstant): Deleted.
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_eq):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_jneq_ptr):
(JSC::JIT::emit_op_eq):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:

LayoutTests:

These tests now run super fast.

* js/regress/apply-not-apply-expected.txt: Added.
* js/regress/apply-not-apply.html: Added.
* js/regress/call-or-not-call-expected.txt: Added.
* js/regress/call-or-not-call.html: Added.
* js/regress/script-tests/apply-not-apply.js: Added.
(let.o.apply):
(foo):
* js/regress/script-tests/call-or-not-call.js: Added.
(let.o.call):
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203361 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMarking fast/shapes/shape-outside-floats/shape-outside-big-box-border-radius-002...
ryanhaddad@apple.com [Mon, 18 Jul 2016 18:57:47 +0000 (18:57 +0000)]
Marking fast/shapes/shape-outside-floats/shape-outside-big-box-border-radius-002.html as flaky on ios-sim
https://bugs.webkit.org/show_bug.cgi?id=159881

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203358 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMarking http/tests/loading/basic-auth-resend-wrong-credentials.html as flaky on Mac...
ryanhaddad@apple.com [Mon, 18 Jul 2016 18:57:43 +0000 (18:57 +0000)]
Marking http/tests/loading/basic-auth-resend-wrong-credentials.html as flaky on Mac and iOS WK2
https://bugs.webkit.org/show_bug.cgi?id=159884

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations:
* platform/mac-wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203357 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoOSR entry into DFG has problems with lexical scoping
fpizlo@apple.com [Mon, 18 Jul 2016 18:55:31 +0000 (18:55 +0000)]
OSR entry into DFG has problems with lexical scoping
https://bugs.webkit.org/show_bug.cgi?id=159687

Reviewed by Saam Barati.
Source/JavaScriptCore:

What a fun bug! It turns out that uses of lexical scoping, like "let", may sometimes cause us
to not be able to OSR enter into a loop from baseline to DFG. The bug is in a mitigation for
a different bug, which in turn had a mitigation for yet another bug, so the story here is a
long one.

DFG OSR entry has long had a mitigation for the following bug: the DFG bytecode parser may
choose to make us always OSR exit at some instruction if it thinks that it doesn't have
enough profiling for that instruction. We will do this if some kinds of put_by_id only
execute once, for example. This causes problems for loopy benchmarks like this:

    put_by_id(something crazy);
    for (var i = 0; i < bigNumber; ++i) simpleMath;

In this case, the put_by_id will have only executed once, and since it did something crazy
that one time, the bytecode parser will replace it with ForceOSRExit.

This creates an OSR entry bug: DFG CFA will then prove that the loop is unreachable, and will
tell OSR entry that it's impossible to enter into that loop.

We mitigated this bug a long time ago by recording mustHandleValues for loops at which we
want to enter. We inject these values into DFG CFA and we force CFA to recognize that the
loop is reachable even if CFA wanted to prove that it wasn't.

But this leads to another bug: we need to scrape the values from the stack inside
operationOptimize() and then we need to reason about them in the compiler. Some of those
values may be garbage, which would cause pandemonium inside the compiler. We also mitigated
this bug, by only recording the "vars", since those are guaranteed to be reset by op_enter.

And that's where the lexical scoping bug happens: "let" bound variables aren't part of the
"vars". DFG will see that they are live, but mustHandleValues will not have anything for
those variables, so CFA will prove that the values are Bottom. Then OSR entry will always
fail because no value is ever a subset of Bottom.

The first part of the fix is to ensure that mustHandleValues record all of the values on the
stack (i.e. within m_numCalleeLocals, rather than just m_numVars). But this creates a second
problem: we may record garbage. This patch includes a better fix for the garbage: before
touching mustHandleValues we run the bytecode liveness analysis and clear any values that are
not live. This ensures that we clear the garbage.

This is an enormous speed-up on microbenchmarks that use lexical scoping and have some crazy
put_by_id in the lead-up to the hot loop.

* dfg/DFGCFAPhase.cpp:
(JSC::DFG::CFAPhase::run):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::prepareOSREntry):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::checkLivenessAndVisitChildren):
(JSC::DFG::Plan::cancel):
(JSC::DFG::Plan::cleanMustHandleValuesIfNecessary):
* dfg/DFGPlan.h:
(JSC::DFG::Plan::canTierUpAndOSREnter):
* jit/JITOperations.cpp:

LayoutTests:

* js/regress/script-tests/strict-osr-entry.js: Added.
(let.o.apply_):
* js/regress/strict-osr-entry-expected.txt: Added.
* js/regress/strict-osr-entry.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203356 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoVersioning.
bshafiei@apple.com [Mon, 18 Jul 2016 18:48:23 +0000 (18:48 +0000)]
Versioning.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203354 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoREGRESSION(r202975): --minimal build is broken
commit-queue@webkit.org [Mon, 18 Jul 2016 18:47:02 +0000 (18:47 +0000)]
REGRESSION(r202975): --minimal build is broken
https://bugs.webkit.org/show_bug.cgi?id=159765

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-18
Reviewed by Chris Dumez.

Covered partially by builtin generated test code.

Updating generator to add a global compilation guard around the code that generates all global internal properties.
Split the generate_methods function in two, one dedicated to the visit method and the second one dedicated to
the initialize method.

* Scripts/builtins/builtins_generate_internals_wrapper_implementation.py:
(BuiltinsInternalsWrapperImplementationGenerator.generate_section_for_object): Use splitted generation functions.
(BuiltinsInternalsWrapperImplementationGenerator.generate_visit_method): Response to generate the visit method.
(BuiltinsInternalsWrapperImplementationGenerator._generate_initialize_static_globals): Responsible to generate
the code to initialize the internal globals. This code is put in a global compilation guard in case all
internals are compiled out by specific builds.
(BuiltinsInternalsWrapperImplementationGenerator):
(BuiltinsInternalsWrapperImplementationGenerator.generate_initialize_method): Responsible to generate the
initialize method.
(BuiltinsInternalsWrapperImplementationGenerator.generate_methods): Deleted.
* Scripts/tests/builtins/expected/WebCore-ArbitraryConditionalGuard-Separate.js-result: Copyright change.
* Scripts/tests/builtins/expected/WebCore-GuardedBuiltin-Separate.js-result: Ditto.
* Scripts/tests/builtins/expected/WebCore-GuardedInternalBuiltin-Separate.js-result: Ditto.
* Scripts/tests/builtins/expected/WebCore-UnguardedBuiltin-Separate.js-result: Ditto.
* Scripts/tests/builtins/expected/WebCore-xmlCasingTest-Separate.js-result: Reflects partially the built-in
generator change.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203353 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoFix bad assertions in genericTypedArrayViewPrivateFuncSubarrayCreate
keith_miller@apple.com [Mon, 18 Jul 2016 18:38:42 +0000 (18:38 +0000)]
Fix bad assertions in genericTypedArrayViewPrivateFuncSubarrayCreate
https://bugs.webkit.org/show_bug.cgi?id=159882
<rdar://problem/27327111>

Reviewed by Mark Lam.

According the spec toInteger can return values we don't consider ints.
Such as, -0 and +/-Infinity. This broke some assertions in
genericTypedArrayViewPrivateFuncSubarrayCreate.

* runtime/JSGenericTypedArrayViewPrototypeFunctions.h:
(JSC::genericTypedArrayViewPrivateFuncSubarrayCreate):
* tests/stress/typedarray-subarray.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203351 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoWTF::Lock should be fair eventually
fpizlo@apple.com [Mon, 18 Jul 2016 18:32:52 +0000 (18:32 +0000)]
WTF::Lock should be fair eventually
https://bugs.webkit.org/show_bug.cgi?id=159384

Reviewed by Geoffrey Garen.
Source/WTF:

In https://webkit.org/blog/6161/locking-in-webkit/ we showed how relaxing the fairness of
locks makes them fast. That post presented lock fairness as a trade-off between two
extremes:

- Barging. A barging lock, like WTF::Lock, releases the lock in unlock() even if there was a
  thread on the queue. If there was a thread on the queue, the lock is released and that
  thread is made runnable. That thread may then grab the lock, or some other thread may grab
  the lock first (it may barge). Usually, the barging thread is the thread that released the
  lock in the first place. This maximizes throughput but hurts fairness. There is no good
  theoretical bound on how unfair the lock may become, but empirical data suggests that it's
  fair enough for the cases we previously measured.

- FIFO. A FIFO lock, like HandoffLock in ToyLocks.h, does not release the lock in unlock()
  if there is a thread waiting. If there is a thread waiting, unlock() will make that thread
  runnable and inform it that it now holds the lock. This ensures perfect round-robin
  fairness and allows us to reason theoretically about how long it may take for a thread to
  grab the lock. For example, if we know that only N threads are running and each one may
  contend on a critical section, and each one may hold the lock for at most S seconds, then
  the time it takes to grab the lock is N * S. Unfortunately, FIFO locks perform very badly
  in most cases. This is because for the common case of short critical sections, they force
  a context switch after each critical section if the lock is contended.

This change makes WTF::Lock almost as fair as FIFO while still being as fast as barging.
Thanks to this new algorithm, you can now have both of these things at the same time.

This change makes WTF::Lock eventually fair. We can almost (more on the caveats below)
guarantee that the time it takes to grab a lock is N * max(1ms, S). In other words, critical
sections that are longer than 1ms are always fair. For shorter critical sections, the amount
of time that any thread waits is 1ms times the number of threads. There are some caveats
that arise from our use of randomness, but even then, in the limit as the critical section
length goes to infinity, the lock becomes fair. The corner cases are unlikely to happen; our
experiments show that the lock becomes exactly as fair as a FIFO lock for any critical
section that is 1ms or longer.

The fairness mechanism is broken into two parts. WTF::Lock can now choose to unlock a lock
fairly or unfairly thanks to the new ParkingLot token mechanism. WTF::Lock knows when to use
fair unlocking based on a timeout mechanism in ParkingLot called timeToBeFair.

ParkingLot::unparkOne() and ParkingLot::parkConditionally() can now communicate with each
other via a token. unparkOne() can pass a token, which parkConditionally() will return. This
change also makes parkConditionally() a lot more precise about when it was unparked due to a
call to unparkOne(). If unparkOne() is told that a thread was unparked then this thread is
guaranteed to report that it was unparked rather than timing out, and that thread is
guaranteed to get the token that unparkOne() passed. The token is an intptr_t. We use it as
a boolean variable in WTF::Lock, but you could use it to pass arbitrary data structures. By
default, the token is zero. WTF::Lock's unlock() will pass 1 as the token if it is doing
fair unlocking. In that case, unlock() will not release the lock, and lock() will know that
it holds the lock as soon as parkConditionally() returns. Note that this algorithm relies
on unparkOne() invoking WTF::Lock's callback while the queue lock is held, so that WTF::Lock
can make a decision about unlock strategy and inject a token while it has complete knowledge
over the state of the queue. As such, it's not immediately obvious how to implement this
algorithm on top of futexes. You really need ParkingLot!

WTF::Lock does not use fair unlocking every time. We expose a new API, Lock::unlockFairly(),
which forces the fair unlocking behavior. Additionally, ParkingLot now maintains a
per-bucket stochastic fairness timeout. When the timeout fires, the unparkOne() callback
sees UnparkResult::timeToBeFair = true. This timeout is set to be anywhere from 0ms to 1ms
at random. When a dequeue happens and there are threads that actually get dequeued, we check
if the time since the last unfair unlock (the last time timeToBeFair was set to true) is
more than the timeout amount. If so, then we set timeToBeFair to true and reset the timeout.
This means that in the absence of ParkingLot collisions, unfair unlocking is guaranteed to
happen at least once per millisecond. It will happen at 2 KHz on average. If there are
collisions, then each collision adds one millisecond to the worst case (and 0.5 ms to the
average case). The reason why we don't just use a fixed 1ms timeout is that we want to avoid
resonance. Imagine a program in which some thread acquires a lock at 1 KHz in-phase with the
timeToBeFair timeout. Then this thread would be the benefactor of fairness to the detriment
of everyone else. Randomness ensures that we aren't too fair to any one thread.

Empirically, this is neutral on our major benchmarks like JetStream but it's an enormous
improvement in LockFairnessTest. It's common for an unfair lock (either our BargingLock, the
old WTF::Lock, any of the other futex-based locks that barge, or new os_unfair_lock) to
allow only one thread to hold the lock during a whole second in which each thread is holding
the lock for 1ms at a time. This is because in a barging lock, releasing a lock after
holding it for 1ms and then reacquiring it immediately virtually ensures that none of the
other threads can wake up in time to grab it before it's relocked. But the new WTF::Lock
handles this case like a champ: each thread gets equal turns.

Here's some data. If we launch 10 threads and have each of them run for 1 second while
repeatedly holding a critical section for 1ms, then here's how many times each thread gets
to hold the lock using the old WTF::Lock algorithm:

799, 6, 1, 1, 1, 1, 1, 1, 1, 1

One thread hogged the lock for almost the whole time! With the new WTF::Lock, the lock
becomes totally fair:

80, 79, 79, 79, 79, 79, 79, 80, 80, 79

I don't know of anyone creating such an automatically-fair adaptive lock before, so I think
that this is a pretty awesome advancement to the state of the art!

This change is good for three reasons:

- We do have long critical sections in WebKit and we don't want to have to worry about
  starvation. This reduces the likelihood that we will see starvation due to our lock
  strategy.

- I was talking to ggaren about bmalloc's locking needs, and he wanted unlockFairly() or
  lockFairly() or some moral equivalent for the scavenger thread.

- If we use a WTF::Lock to manage heap access in a multithreaded GC, we'll need the ability
  to unlock and relock without barging.

* benchmarks/LockFairnessTest.cpp:
(main):
* benchmarks/ToyLocks.h:
* wtf/Condition.h:
(WTF::ConditionBase::waitUntil):
(WTF::ConditionBase::notifyOne):
* wtf/Lock.cpp:
(WTF::LockBase::lockSlow):
(WTF::LockBase::unlockSlow):
(WTF::LockBase::unlockFairlySlow):
(WTF::LockBase::unlockSlowImpl):
* wtf/Lock.h:
(WTF::LockBase::try_lock):
(WTF::LockBase::unlock):
(WTF::LockBase::unlockFairly):
(WTF::LockBase::isHeld):
(WTF::LockBase::isFullyReset):
* wtf/ParkingLot.cpp:
(WTF::ParkingLot::parkConditionallyImpl):
(WTF::ParkingLot::unparkOne):
(WTF::ParkingLot::unparkOneImpl):
(WTF::ParkingLot::unparkAll):
* wtf/ParkingLot.h:
(WTF::ParkingLot::parkConditionally):
(WTF::ParkingLot::compareAndPark):
(WTF::ParkingLot::unparkOne):

Tools:

* TestWebKitAPI/Tests/WTF/ParkingLot.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203350 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoAdd preload to features.json
yoav@yoav.ws [Mon, 18 Jul 2016 17:43:26 +0000 (17:43 +0000)]
Add preload to features.json
https://bugs.webkit.org/show_bug.cgi?id=159872

Reviewed by Darin Adler.

No new tests but no functional change.

* features.json:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203349 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago"make ARCHS=x86_64" fails to build
ap@apple.com [Mon, 18 Jul 2016 16:17:52 +0000 (16:17 +0000)]
"make ARCHS=x86_64" fails to build
https://bugs.webkit.org/show_bug.cgi?id=159867

Reviewed by Dan Bernstein.

* Makefile.shared: Override VALID_ARCHS when ARCHS is set, so that even projects
that normally customize VALID_ARCHS wouldn't fail to build.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203348 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[Streams API] ReadableStream should throw a RangeError in case of NaN highWaterMark
commit-queue@webkit.org [Mon, 18 Jul 2016 13:41:07 +0000 (13:41 +0000)]
[Streams API] ReadableStream should throw a RangeError in case of NaN highWaterMark
https://bugs.webkit.org/show_bug.cgi?id=159870

Patch by Youenn Fablet <youenn@apple.com> on 2016-07-18
Reviewed by Xabier Rodriguez-Calvar.

LayoutTests/imported/w3c:

* web-platform-tests/streams/readable-streams/bad-strategies.https-expected.txt:

Source/WebCore:

Covered by rebased test.

* Modules/streams/StreamInternals.js:
(validateAndNormalizeQueuingStrategy): Throwing a RangeError in lieu of a TypeError in case of NaN highWaterMark.

LayoutTests:

* streams/reference-implementation/bad-strategies.html: Reflecting isNaN change in WritableStream test.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203347 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoWindows buildfix after r203338
ossy@webkit.org [Mon, 18 Jul 2016 12:41:44 +0000 (12:41 +0000)]
Windows buildfix after r203338
https://bugs.webkit.org/show_bug.cgi?id=159875

Unreviewed buildfix.

* dom/UserGestureIndicator.h:
(WebCore::UserGestureToken::addDestructionObserver):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203346 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUnreviewed. Update OptionsGTK.cmake and NEWS for 2.13.3 release.
carlosgc@webkit.org [Mon, 18 Jul 2016 10:35:12 +0000 (10:35 +0000)]
Unreviewed. Update OptionsGTK.cmake and NEWS for 2.13.3 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit2:

* gtk/NEWS: Add release notes for 2.13.3.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203344 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[Mac][cmake] Unreviewed buildfix after r203338. Just for fun.
ossy@webkit.org [Mon, 18 Jul 2016 09:24:19 +0000 (09:24 +0000)]
[Mac][cmake] Unreviewed buildfix after r203338. Just for fun.

* PlatformMac.cmake:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203343 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMemoryPressureHandler doesn't work if cgroups aren't present in Linux
carlosgc@webkit.org [Mon, 18 Jul 2016 09:04:10 +0000 (09:04 +0000)]
MemoryPressureHandler doesn't work if cgroups aren't present in Linux
https://bugs.webkit.org/show_bug.cgi?id=155255

Reviewed by Sergio Villar Senin.

Source/WebCore:

Allow to pass an eventFD file descriptor to the MemoryPressureHandler to be monitorized in case cgroups are not
available.

* platform/MemoryPressureHandler.h:
* platform/linux/MemoryPressureHandlerLinux.cpp:

Source/WebKit2:

There's no way to get notifications about memory pressure in Linux without using cgroups that doesn't require a
manual polling. We can get that information from /proc/meminfo, but that's not pollable so it requires to
manually check its contents in a loop sleeping for a while between checks. This means we would be waking up the
process on every poll iteration, most of the times for nothing. That's specially problematic on devices running
on battery. And taking into account that there's a memory pressure handler in every secondary process (Web,
Network and Plugin), we would be waking up all those process all the time. However, not having a memory pressure
handler is even more problematic than the manual polling.
This patch adds a class MemoryPressureMonitor to the manual polling of /proc/meminfo, but runs in the UI
process, to avoid the weakups in all other secondary processes, and uses an eventFD to notify all other
processes. It's only used in case cgroups is not available. The eventFD descriptor is sent to all other
processes at startup, and passed to the MemoryPressureHandler before install() is called for the first
time. To minimize the wakeups even in the UI process, the poll interval is calculated from 1 to 5 seconds
depending on the current memory used, so in case of low memory level we sleep for a longer time.
It's also important to make the memory calculations as accurate as possible to avoid cleaning resources in the
secondary processes unnecessarily.

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::initializeNetworkProcess): Pass the memory pressure monitor file descriptor to the MemoryPressureHandler.
* NetworkProcess/NetworkProcess.h:
* NetworkProcess/NetworkProcessCreationParameters.cpp:
(WebKit::NetworkProcessCreationParameters::encode): Encode memory pressure monitor handle.
(WebKit::NetworkProcessCreationParameters::decode): Decode memory pressure monitor handle.
* NetworkProcess/NetworkProcessCreationParameters.h:
* PlatformEfl.cmake: Add new file to compilation, and update include dirs.
* PlatformGTK.cmake: Ditto.
* PluginProcess/PluginProcess.cpp:
(WebKit::PluginProcess::initializePluginProcess): Pass the memory pressure monitor file descriptor to the MemoryPressureHandler.
* Shared/Plugins/PluginProcessCreationParameters.cpp:
(WebKit::PluginProcessCreationParameters::encode): Encode memory pressure monitor handle.
(WebKit::PluginProcessCreationParameters::decode): Decode memory pressure monitor handle.
* Shared/Plugins/PluginProcessCreationParameters.h:
* Shared/WebProcessCreationParameters.cpp:
(WebKit::WebProcessCreationParameters::encode): Encode memory pressure monitor handle.
(WebKit::WebProcessCreationParameters::decode): Decode memory pressure monitor handle.
* Shared/WebProcessCreationParameters.h:
* UIProcess/Plugins/PluginProcessProxy.cpp:
(WebKit::PluginProcessProxy::didFinishLaunching): Create the memory pressure monitor handle for the plugin
process if needed.
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::ensureNetworkProcess): Create the memory pressure monitor handle for the network
process if needed.
(WebKit::WebProcessPool::createNewWebProcess): Create the memory pressure monitor handle for the web process if
needed.
* UIProcess/linux/MemoryPressureMonitor.cpp: Added.
(WebKit::lowWatermarkPages):
(WebKit::systemPageSize):
(WebKit::calculateMemoryAvailable):
(WebKit::systemMemoryUsedAsPercentage):
(WebKit::pollIntervalForUsedMemoryPercentage):
(WebKit::isSystemdMemoryPressureMonitorAvailable):
(WebKit::MemoryPressureMonitor::isEnabled):
(WebKit::MemoryPressureMonitor::singleton):
(WebKit::MemoryPressureMonitor::MemoryPressureMonitor):
(WebKit::MemoryPressureMonitor::createHandle):
* UIProcess/linux/MemoryPressureMonitor.h:
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::initializeWebProcess): Pass the memory pressure monitor file descriptor to the MemoryPressureHandler.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203342 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoREGRESSION(r202855): [GTK] ASSERTION FAILED: m_webPage.bounds().contains(bounds)
carlosgc@webkit.org [Mon, 18 Jul 2016 06:53:52 +0000 (06:53 +0000)]
REGRESSION(r202855): [GTK] ASSERTION FAILED: m_webPage.bounds().contains(bounds)
https://bugs.webkit.org/show_bug.cgi?id=159806

Reviewed by Žan Doberšek.

The problem is that since r202855, in case of non accelerated mode, the dirty region is updated too late when
updating backing store state.

* WebProcess/WebPage/DrawingAreaImpl.cpp:
(WebKit::DrawingAreaImpl::updateBackingStoreState): Update the dirty region to the new size when not in
accelerated compositing mode.
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::setSize): Update the WebPage size before resizing the frame and calling setNeedsDisplay() to
ensure that any call to setNeedsDisplay() uses the new web page bounds. This is actually a regression introduced
in r143472, where setNeedsDisplay was changed to use the web page bounds as directy rectangle. Before r143472
the dirty rectangle was passed to setNeedsDisplay and it passed the right one.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203341 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoClean up PassRefPtr uses in Modules/encryptedmedia, Modules/speech, and Modules/quota
gyuyoung.kim@webkit.org [Mon, 18 Jul 2016 06:13:28 +0000 (06:13 +0000)]
Clean up PassRefPtr uses in Modules/encryptedmedia, Modules/speech, and Modules/quota
https://bugs.webkit.org/show_bug.cgi?id=159701

Reviewed by Alex Christensen.

No new tests, no behavior changes.

* Modules/encryptedmedia/CDM.h:
* Modules/encryptedmedia/MediaKeySession.h:
* Modules/encryptedmedia/MediaKeys.h:
* Modules/quota/DOMWindowQuota.cpp:
* Modules/quota/StorageErrorCallback.cpp:
(WebCore::StorageErrorCallback::CallbackTask::CallbackTask):
* Modules/quota/StorageErrorCallback.h:
* Modules/quota/StorageInfo.h:
* Modules/quota/StorageQuota.h:
* Modules/speech/DOMWindowSpeechSynthesis.cpp:
* Modules/speech/SpeechSynthesis.cpp:
(WebCore::SpeechSynthesis::getVoices):
(WebCore::SpeechSynthesis::startSpeakingImmediately):
(WebCore::SpeechSynthesis::speak):
(WebCore::SpeechSynthesis::cancel):
(WebCore::SpeechSynthesis::handleSpeakingCompleted):
(WebCore::SpeechSynthesis::boundaryEventOccurred):
(WebCore::SpeechSynthesis::didStartSpeaking):
(WebCore::SpeechSynthesis::didPauseSpeaking):
(WebCore::SpeechSynthesis::didResumeSpeaking):
(WebCore::SpeechSynthesis::didFinishSpeaking):
(WebCore::SpeechSynthesis::speakingErrorOccurred):
* Modules/speech/SpeechSynthesis.h:
* Modules/speech/SpeechSynthesisEvent.h:
* Modules/speech/SpeechSynthesisUtterance.h:
* Modules/speech/SpeechSynthesisVoice.cpp:
(WebCore::SpeechSynthesisVoice::create):
(WebCore::SpeechSynthesisVoice::SpeechSynthesisVoice):
* Modules/speech/SpeechSynthesisVoice.h:
* platform/PlatformSpeechSynthesizer.h:
* platform/efl/PlatformSpeechSynthesisProviderEfl.cpp:
(WebCore::PlatformSpeechSynthesisProviderEfl::fireSpeechEvent):
* platform/mock/PlatformSpeechSynthesizerMock.cpp:
(WebCore::PlatformSpeechSynthesizerMock::speakingFinished):
(WebCore::PlatformSpeechSynthesizerMock::speak):
(WebCore::PlatformSpeechSynthesizerMock::cancel):
(WebCore::PlatformSpeechSynthesizerMock::pause):
(WebCore::PlatformSpeechSynthesizerMock::resume):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203340 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoRebaseline Windows and EFL MathML pixel tests after r203289.
fred.wang@free.fr [Mon, 18 Jul 2016 06:08:04 +0000 (06:08 +0000)]
Rebaseline Windows and EFL MathML pixel tests after r203289.
https://bugs.webkit.org/show_bug.cgi?id=158866

Unreviewed test gardening.

Patch by Frederic Wang <fwang@igalia.com> on 2016-07-17

* platform/efl/mathml/opentype/vertical-expected.txt:
* platform/efl/mathml/presentation/mo-stretch-expected.txt:
* platform/win/mathml/opentype/opentype-stretchy-expected.txt:
* platform/win/mathml/opentype/vertical-expected.txt:
* platform/win/mathml/presentation/mo-stretch-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203339 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[WebKit API] Add SPI to track multiple navigations caused by a single user gesture
weinig@apple.com [Mon, 18 Jul 2016 01:07:11 +0000 (01:07 +0000)]
[WebKit API] Add SPI to track multiple navigations caused by a single user gesture
<rdar://problem/26554137>
https://bugs.webkit.org/show_bug.cgi?id=159856

Reviewed by Dan Bernstein.

Source/WebCore:

- Adds a new RefCounted object to represent a unique user gesture, called UserGestureToken.
- Makes UserGestureIndicator track UserGestureToken.
- Refines UserGestureIndicator's interface to use Optional and a smaller enum set
  to represent the different initial states.
- Stores UserGestureTokens on objects that want to forward user gesture state (DOMTimer,
  postMessage, and ScheduledNavigation) rather than just a boolean.

* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::increment):
(WebCore::AccessibilityNodeObject::decrement):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::press):
* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::executeScriptInWorld):
(WebCore::ScriptController::executeScript):
Update for new UserGestureIndicator interface.

* dom/UserGestureIndicator.cpp:
(WebCore::currentToken):
(WebCore::UserGestureToken::~UserGestureToken):
(WebCore::UserGestureIndicator::UserGestureIndicator):
(WebCore::UserGestureIndicator::~UserGestureIndicator):
(WebCore::UserGestureIndicator::currentUserGesture):
(WebCore::UserGestureIndicator::processingUserGesture):
(WebCore::UserGestureIndicator::processingUserGestureForMedia):
(WebCore::isDefinite): Deleted.
* dom/UserGestureIndicator.h:
(WebCore::UserGestureToken::create):
(WebCore::UserGestureToken::state):
(WebCore::UserGestureToken::processingUserGesture):
(WebCore::UserGestureToken::processingUserGestureForMedia):
(WebCore::UserGestureToken::addDestructionObserver):
(WebCore::UserGestureToken::UserGestureToken):
Add UserGestureToken and track the current one explicitly.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::didReceiveRemoteControlCommand):
* inspector/InspectorFrontendClientLocal.cpp:
(WebCore::InspectorFrontendClientLocal::openInNewTab):
* inspector/InspectorFrontendHost.cpp:
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::navigate):
Update for new UserGestureIndicator interface.

* loader/NavigationAction.cpp:
(WebCore::NavigationAction::NavigationAction):
* loader/NavigationAction.h:
(WebCore::NavigationAction::userGestureToken):
(WebCore::NavigationAction::processingUserGesture):
* loader/NavigationScheduler.cpp:
(WebCore::ScheduledNavigation::ScheduledNavigation):
(WebCore::ScheduledNavigation::~ScheduledNavigation):
(WebCore::ScheduledNavigation::lockBackForwardList):
(WebCore::ScheduledNavigation::wasDuringLoad):
(WebCore::ScheduledNavigation::isLocationChange):
(WebCore::ScheduledNavigation::userGestureToForward):
(WebCore::ScheduledNavigation::clearUserGesture):
(WebCore::NavigationScheduler::mustLockBackForwardList):
(WebCore::NavigationScheduler::scheduleFormSubmission):
(WebCore::ScheduledNavigation::wasUserGesture): Deleted.
* page/DOMTimer.cpp:
(WebCore::shouldForwardUserGesture):
(WebCore::userGestureTokenToForward):
(WebCore::DOMTimer::DOMTimer):
(WebCore::DOMTimer::fired):
* page/DOMTimer.h:
* page/DOMWindow.cpp:
(WebCore::PostMessageTimer::PostMessageTimer):
Store the active UserGestureToken rather than just a bit.

* page/EventHandler.cpp:
(WebCore::EventHandler::handleMousePressEvent):
(WebCore::EventHandler::handleMouseDoubleClickEvent):
(WebCore::EventHandler::handleMouseReleaseEvent):
(WebCore::EventHandler::keyEvent):
(WebCore::EventHandler::handleTouchEvent):
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::toggleMediaFullscreenState):
(WebCore::HitTestResult::enterFullscreenForVideo):
(WebCore::HitTestResult::toggleEnhancedFullscreenForVideo):
Update for new UserGestureIndicator interface.

Source/WebKit/mac:

* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
(WebKit::NetscapePluginInstanceProxy::evaluate):
* Plugins/WebNetscapePluginView.mm:
(-[WebNetscapePluginView sendEvent:isDrawRect:]):
Update for new UserGestureIndicator interface.

Source/WebKit/win:

* Plugins/PluginView.cpp:
(WebCore::PluginView::performRequest):
* WebCoreSupport/WebContextMenuClient.cpp:
(WebContextMenuClient::searchWithGoogle):
Update for new UserGestureIndicator interface.

Source/WebKit2:

* Shared/API/APIObject.h:
* Shared/Cocoa/APIObject.mm:
(API::Object::newObject):
* UIProcess/API/APIUserInitiatedAction.h: Added.
Add new APIObject type, UserInitiatedAction.

* UIProcess/API/Cocoa/WKNavigationAction.mm:
* UIProcess/API/Cocoa/WKNavigationActionPrivate.h:
Expose a _WKUserInitiatedAction on the WKNavigationAction.

* UIProcess/API/Cocoa/_WKUserInitiatedAction.h: Added.
* UIProcess/API/Cocoa/_WKUserInitiatedAction.mm: Added.
(-[_WKUserInitiatedAction consume]):
(-[_WKUserInitiatedAction isConsumed]):
(-[_WKUserInitiatedAction _apiObject]):
* UIProcess/API/Cocoa/_WKUserInitiatedActionInternal.h: Added.
Add new _WKUserInitiatedAction type wrapping API::UserInitiatedAction.

* Shared/NavigationActionData.cpp:
(WebKit::NavigationActionData::encode):
(WebKit::NavigationActionData::decode):
* Shared/NavigationActionData.h:
Store the userGestureTokenIdentifier (as determined from the WebProcess's map) rather
than just a single bit. This allows us to track if a user gesture is used for multiple navigations.

* UIProcess/API/APINavigationAction.h:
Add UserInitiatedAction member and re-implement isProcessingUserGesture in terms of it.

* UIProcess/API/C/WKPage.cpp:
(WKPageSetPageUIClient):
* UIProcess/Cocoa/UIDelegate.mm:
(WebKit::UIDelegate::UIClient::createNewPage):
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):
Get the API::UserInitiatedAction from the WebProcessProxy (if it exists), and pass
it along to the API::NavigationAction.

* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::shutDown):
(WebKit::WebProcessProxy::userInitiatedActivity):
(WebKit::WebProcessProxy::didDestroyUserGestureToken):
* UIProcess/WebProcessProxy.h:
Keep a map of active userInitiatedActivity objects.

* UIProcess/WebProcessProxy.messages.in:
Add DidDestroyUserGestureToken message to manager API::UserInitiatedActivity lifetimes.

* WebKit2.xcodeproj/project.pbxproj:
Add new files.

* WebProcess/Notifications/WebNotificationManager.cpp:
(WebKit::WebNotificationManager::didClickNotification):
* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::performFrameLoadURLRequest):
(WebKit::PluginView::evaluate):
* WebProcess/WebCoreSupport/WebContextMenuClient.cpp:
(WebKit::WebContextMenuClient::searchWithGoogle):
* WebProcess/cocoa/WebPlaybackSessionManager.mm:
(WebKit::WebPlaybackSessionManager::play):
(WebKit::WebPlaybackSessionManager::pause):
(WebKit::WebPlaybackSessionManager::togglePlayState):
(WebKit::WebPlaybackSessionManager::beginScrubbing):
(WebKit::WebPlaybackSessionManager::endScrubbing):
(WebKit::WebPlaybackSessionManager::seekToTime):
(WebKit::WebPlaybackSessionManager::fastSeek):
(WebKit::WebPlaybackSessionManager::beginScanningForward):
(WebKit::WebPlaybackSessionManager::beginScanningBackward):
(WebKit::WebPlaybackSessionManager::endScanning):
(WebKit::WebPlaybackSessionManager::selectAudioMediaOption):
(WebKit::WebPlaybackSessionManager::selectLegibleMediaOption):
Update for new UserGestureIndicator interface.

* WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::createWindow):
* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNewWindowAction):
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction):
Get an identifier for the UserGestureToken from the WebProcess singleton
to pass to the WebProcess.

* WebProcess/WebProcess.cpp:
(WebKit::nextUserGestureTokenIdentifier):
(WebKit::WebProcess::userGestureTokenIdentifier):
(WebKit::WebProcess::userGestureTokenDestroyed):
* WebProcess/WebProcess.h:
Track UserGestureToken lifetimes utilizing the destructionObserver mechanism
off the tokens to indicate destruction. When destroyed, notify the UIProcess
to avoid leaks.

Tools:

* MiniBrowser/mac/WK2BrowserWindowController.m:
(-[WK2BrowserWindowController webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:]):
Add basic window.open implementation.

(-[WK2BrowserWindowController webView:decidePolicyForNavigationAction:decisionHandler:]):
Add basic navigation policy implementation which implements a rule where a user gesture is only allowed
to open a single non-web URL, all others are dropped.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKit2Cocoa/UserInitiatedActionInNavigationAction.mm: Added.
* TestWebKitAPI/Tests/WebKit2Cocoa/open-multiple-external-url.html: Added.
Add API for the new SPI.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203338 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoRename fastHasAttribute to hasAttributeWithoutSynchronization
rniwa@webkit.org [Mon, 18 Jul 2016 00:39:37 +0000 (00:39 +0000)]
Rename fastHasAttribute to hasAttributeWithoutSynchronization
https://bugs.webkit.org/show_bug.cgi?id=159864

Reviewed by Chris Dumez.

Source/WebCore:

Renamed Rename fastHasAttribute to hasAttributeWithoutSynchronization for clarity.

* accessibility/AccessibilityListBoxOption.cpp:
(WebCore::AccessibilityListBoxOption::isEnabled):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::hasAttribute):
(WebCore::AccessibilityObject::getAttribute):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::determineAccessibilityRole):
* bindings/scripts/CodeGenerator.pm:
(GetterExpression):
* bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjReflectedBooleanAttr):
(WebCore::jsTestObjReflectedCustomBooleanAttr):
* bindings/scripts/test/ObjC/DOMTestObj.mm:
(-[DOMTestObj reflectedBooleanAttr]):
(-[DOMTestObj setReflectedBooleanAttr:]):
(-[DOMTestObj reflectedCustomBooleanAttr]):
(-[DOMTestObj setReflectedCustomBooleanAttr:]):
* dom/Document.cpp:
(WebCore::Document::hasManifest):
(WebCore::Document::doctype):
* dom/Element.h:
(WebCore::Node::parentElement):
(WebCore::Element::hasAttributeWithoutSynchronization):
(WebCore::Element::fastHasAttribute): Deleted.
* editing/ApplyStyleCommand.cpp:
(WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
* editing/markup.cpp:
(WebCore::createMarkupInternal):
* html/ColorInputType.cpp:
(WebCore::ColorInputType::shouldShowSuggestions):
* html/FileInputType.cpp:
(WebCore::FileInputType::handleDOMActivateEvent):
(WebCore::FileInputType::receiveDroppedFiles):
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::didMoveToNewDocument):
(WebCore::FormAssociatedElement::insertedInto):
(WebCore::FormAssociatedElement::removedFrom):
(WebCore::FormAssociatedElement::formAttributeChanged):
* html/FormController.cpp:
(WebCore::ownerFormForState):
* html/GenericCachedHTMLCollection.cpp:
(WebCore::GenericCachedHTMLCollection<traversalType>::elementMatches):
* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::draggable):
(WebCore::HTMLAnchorElement::href):
(WebCore::HTMLAnchorElement::sendPings):
* html/HTMLAppletElement.cpp:
(WebCore::HTMLAppletElement::rendererIsNeeded):
* html/HTMLElement.cpp:
(WebCore::HTMLElement::collectStyleForPresentationAttribute):
(WebCore::elementAffectsDirectionality):
(WebCore::setHasDirAutoFlagRecursively):
* html/HTMLEmbedElement.cpp:
(WebCore::HTMLEmbedElement::rendererIsNeeded):
* html/HTMLFieldSetElement.cpp:
(WebCore::updateFromControlElementsAncestorDisabledStateUnder):
(WebCore::HTMLFieldSetElement::disabledAttributeChanged):
(WebCore::HTMLFieldSetElement::disabledStateChanged):
(WebCore::HTMLFieldSetElement::childrenChanged):
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::formNoValidate):
(WebCore::HTMLFormControlElement::formAction):
(WebCore::HTMLFormControlElement::computeIsDisabledByFieldsetAncestor):
(WebCore::shouldAutofocus):
* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::formElementIndex):
(WebCore::HTMLFormElement::noValidate):
* html/HTMLFrameElement.cpp:
(WebCore::HTMLFrameElement::noResize):
(WebCore::HTMLFrameElement::didAttachRenderers):
* html/HTMLFrameElementBase.cpp:
(WebCore::HTMLFrameElementBase::parseAttribute):
(WebCore::HTMLFrameElementBase::location):
* html/HTMLHRElement.cpp:
(WebCore::HTMLHRElement::collectStyleForPresentationAttribute):
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::isServerMap):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::finishParsingChildren):
(WebCore::HTMLInputElement::matchesDefaultPseudoClass):
(WebCore::HTMLInputElement::isActivatedSubmit):
(WebCore::HTMLInputElement::reset):
(WebCore::HTMLInputElement::multiple):
(WebCore::HTMLInputElement::setSize):
(WebCore::HTMLInputElement::shouldUseMediaCapture):
* html/HTMLMarqueeElement.cpp:
(WebCore::HTMLMarqueeElement::minimumDelay):
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::insertedInto):
(WebCore::HTMLMediaElement::selectMediaResource):
(WebCore::HTMLMediaElement::loadResource):
(WebCore::HTMLMediaElement::autoplay):
(WebCore::HTMLMediaElement::preload):
(WebCore::HTMLMediaElement::loop):
(WebCore::HTMLMediaElement::setLoop):
(WebCore::HTMLMediaElement::controls):
(WebCore::HTMLMediaElement::setControls):
(WebCore::HTMLMediaElement::muted):
(WebCore::HTMLMediaElement::setMuted):
(WebCore::HTMLMediaElement::selectNextSourceChild):
(WebCore::HTMLMediaElement::sourceWasAdded):
(WebCore::HTMLMediaElement::mediaSessionTitle):
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::parseAttribute):
* html/HTMLOptGroupElement.cpp:
(WebCore::HTMLOptGroupElement::isDisabledFormControl):
(WebCore::HTMLOptGroupElement::isFocusable):
* html/HTMLOptionElement.cpp:
(WebCore::HTMLOptionElement::matchesDefaultPseudoClass):
(WebCore::HTMLOptionElement::text):
* html/HTMLProgressElement.cpp:
(WebCore::HTMLProgressElement::isDeterminate):
(WebCore::HTMLProgressElement::didElementStateChange):
* html/HTMLScriptElement.cpp:
(WebCore::HTMLScriptElement::async):
(WebCore::HTMLScriptElement::setCrossOrigin):
(WebCore::HTMLScriptElement::asyncAttributeValue):
(WebCore::HTMLScriptElement::deferAttributeValue):
(WebCore::HTMLScriptElement::hasSourceAttribute):
(WebCore::HTMLScriptElement::dispatchLoadEvent):
* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::reset):
* html/HTMLTrackElement.cpp:
(WebCore::HTMLTrackElement::isDefault):
(WebCore::HTMLTrackElement::ensureTrack):
(WebCore::HTMLTrackElement::loadTimerFired):
* html/MediaElementSession.cpp:
(WebCore::MediaElementSession::wirelessVideoPlaybackDisabled):
(WebCore::MediaElementSession::requiresFullscreenForVideoPlayback):
(WebCore::MediaElementSession::allowsAutomaticMediaDataLoading):
* html/SearchInputType.cpp:
(WebCore::SearchInputType::searchEventsShouldBeDispatched):
(WebCore::SearchInputType::didSetValueByUserEdit):
* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::buildObjectForNode):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::shouldTreatURLAsSrcdocDocument):
(WebCore::FrameLoader::findFrameForNavigation):
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::notifyFinished):
* mathml/MathMLSelectElement.cpp:
(WebCore::MathMLSelectElement::getSelectedSemanticsChild):
* rendering/RenderTableCell.cpp:
(WebCore::RenderTableCell::computePreferredLogicalWidths):
* rendering/RenderThemeIOS.mm:
(WebCore::RenderThemeIOS::adjustMenuListButtonStyle):
* rendering/SimpleLineLayout.cpp:
(WebCore::SimpleLineLayout::canUseForWithReason):
* rendering/svg/RenderSVGResourceClipper.cpp:
(WebCore::RenderSVGResourceClipper::drawContentIntoMaskImage):
* svg/SVGAnimateMotionElement.cpp:
(WebCore::SVGAnimateMotionElement::updateAnimationPath):
* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::startedActiveInterval):
(WebCore::SVGAnimationElement::updateAnimation):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::insertedInto):

Source/WebKit2:

* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::getAssistedNodeInformation):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203337 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoDFG CSE is broken for MultiGetByOffset
fpizlo@apple.com [Sun, 17 Jul 2016 22:00:42 +0000 (22:00 +0000)]
DFG CSE is broken for MultiGetByOffset
https://bugs.webkit.org/show_bug.cgi?id=159858

Reviewed by Saam Barati.

This disabled CSE for MultiGetByOffset. I opened bug 159859 for the long-term fix, which
would teach CSE (and other passes also) how to decay a removed MultiGetByOffset to a
CheckStructure. Since we currently just decay MultiGetByOffset to Check, we forget the
structure checks. So, if we CSE a MultiGetByOffset that checks for one set of structures with
a heap access on the same property and base that checks for different structures, then we
will forget some structure checks that we had previously. It's unsound to forget checks in
DFG IR.

This bug mostly manifested as a high-volume crash at Unreachable in FTL, because we'd prove
that the code after the MultiGetByOffset was unreachable due to the structure checks and then
CSE would remove everything but the Unreachable.

* dfg/DFGClobberize.h:
(JSC::DFG::clobberize): Remove the def() for MultiGetByOffset to disable CSE for this node for now.
* tests/stress/cse-multi-get-by-offset-remove-checks.js: Added. This used to fail with FTL eanbled.
(Cons1):
(Cons2):
(Cons3):
(foo):
(bar):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203336 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoREGRESSION (r191907): Maxthon Browser -After exit full screen video playback the...
commit-queue@webkit.org [Sun, 17 Jul 2016 20:35:20 +0000 (20:35 +0000)]
REGRESSION (r191907): Maxthon Browser -After exit full screen video playback the browser window is blank with audio running
https://bugs.webkit.org/show_bug.cgi?id=159731
<rdar://problem/26674003>

Patch by Jeremy Jones <jeremyj@apple.com> on 2016-07-17
Reviewed by Tim Horton.

Primarily written by Jer Noble  <jer.noble@apple.com>.

When a view is removed from it's superview, and that superview's constraints property references
the removed superview, those constraints are removed as well. Make sure to save off a copy of
the superview's constraints before swapping in the placeholder view, and reapply those constraints
when swapping the web view back into its original superview.

* UIProcess/mac/WKFullScreenWindowController.h:
* UIProcess/mac/WKFullScreenWindowController.mm:
(-[WKFullScreenWindowController setSavedConstraints:]):
(-[WKFullScreenWindowController savedConstraints]):
(-[WKFullScreenWindowController enterFullScreen:]):
(-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]):
(-[WKFullScreenWindowController finishedExitFullScreenAnimation:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203335 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoExceptions logged to the JS console should use toString().
beidson@apple.com [Sun, 17 Jul 2016 19:12:49 +0000 (19:12 +0000)]
Exceptions logged to the JS console should use toString().
https://bugs.webkit.org/show_bug.cgi?id=159855

Reviewed by Darin Adler.

No new tests (No change in behavior).

* bindings/js/JSDOMBinding.cpp:
(WebCore::reportException):

* dom/DOMCoreException.h:
(WebCore::DOMCoreException::DOMCoreException):

* dom/ExceptionBase.cpp:
(WebCore::ExceptionBase::ExceptionBase):
(WebCore::ExceptionBase::toString):
(WebCore::ExceptionBase::consoleErrorMessage): Deleted.
* dom/ExceptionBase.h:
(WebCore::ExceptionBase::description): Deleted.

* svg/SVGException.h:

* xml/XPathException.h:
(WebCore::XPathException::XPathException):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203334 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUpdate DOMCoreException to use the description in toString().
beidson@apple.com [Sun, 17 Jul 2016 16:47:55 +0000 (16:47 +0000)]
Update DOMCoreException to use the description in toString().
https://bugs.webkit.org/show_bug.cgi?id=159857

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

* web-platform-tests/XMLHttpRequest/send-authentication-basic-setrequestheader-and-arguments-expected.txt:
* web-platform-tests/XMLHttpRequest/send-non-same-origin.sub-expected.txt:
* web-platform-tests/XMLHttpRequest/setrequestheader-bogus-name-expected.txt:
* web-platform-tests/XMLHttpRequest/setrequestheader-bogus-value-expected.txt:
* web-platform-tests/XMLHttpRequest/xmlhttprequest-sync-block-defer-scripts-expected.txt:
* web-platform-tests/XMLHttpRequest/xmlhttprequest-sync-block-scripts-expected.txt:
* web-platform-tests/XMLHttpRequest/xmlhttprequest-sync-not-hang-scriptloader-expected.txt:
* web-platform-tests/XMLHttpRequest/xmlhttprequest-timeout-worker-synconworker-expected.txt:
* web-platform-tests/dom/events/ProgressEvent-expected.txt:
* web-platform-tests/dom/interfaces-expected.txt:
* web-platform-tests/dom/nodes/Document-createElementNS-expected.txt:
* web-platform-tests/dom/nodes/Document-createEvent-expected.txt:
* web-platform-tests/dom/nodes/Element-closest-expected.txt:
* web-platform-tests/dom/nodes/Element-matches-expected.txt:
* web-platform-tests/dom/nodes/ParentNode-querySelector-All-expected.txt:
* web-platform-tests/dom/nodes/ParentNode-querySelector-All-xht-expected.txt:
* web-platform-tests/dom/nodes/insert-adjacent-expected.txt:
* web-platform-tests/domparsing/createContextualFragment-expected.txt:
* web-platform-tests/html/dom/interfaces-expected.txt:
* web-platform-tests/html/semantics/embedded-content/media-elements/volume_nonfinite-expected.txt:
* web-platform-tests/html/semantics/forms/the-input-element/month-expected.txt:
* web-platform-tests/html/semantics/forms/the-input-element/range-expected.txt:
* web-platform-tests/html/semantics/forms/the-input-element/time-expected.txt:
* web-platform-tests/html/semantics/forms/the-meter-element/meter-expected.txt:

Source/WebCore:

No new tests (Covered by changes to existing tests).

* bindings/js/JSDOMBinding.cpp:
(WebCore::createDOMException):

* dom/DOMCoreException.h:
(WebCore::DOMCoreException::DOMCoreException):
(WebCore::DOMCoreException::createWithDescriptionAsMessage): Deleted.

LayoutTests:

* canvas/philip/tests/2d.missingargs.html:
* crypto/crypto-random-values-limits-expected.txt:
* crypto/crypto-random-values-types-expected.txt:
* crypto/subtle/aes-cbc-wrong-key-class-expected.txt:
* crypto/subtle/aes-kw-key-manipulation-expected.txt:
* crypto/subtle/argument-conversion-expected.txt:
* crypto/subtle/hmac-check-algorithm-expected.txt:
* crypto/subtle/hmac-generate-key-expected.txt:
* crypto/subtle/rsa-oaep-key-manipulation-expected.txt:
* crypto/subtle/sha-1-expected.txt:
* crypto/subtle/unwrapKey-check-usage-expected.txt:
* crypto/subtle/wrapKey-check-usage-expected.txt:
* css3/supports-cssom-expected.txt:
* editing/pasteboard/data-transfer-items-expected.txt:
* editing/selection/extend-expected.txt:
* fast/canvas/canvas-createImageData-expected.txt:
* fast/canvas/canvas-ellipse-negative-radius-expected.txt:
* fast/canvas/canvas-getImageData-invalid-expected.txt:
* fast/canvas/canvas-getImageData-invalid-result-buffer-crash-expected.txt:
* fast/canvas/canvas-gradient-addStop-error-expected.txt:
* fast/canvas/canvas-imageData-expected.txt:
* fast/canvas/canvas-overloads-drawImage-expected.txt:
* fast/canvas/canvas-pattern-behaviour-expected.txt:
* fast/canvas/gradient-addColorStop-with-invalid-color-expected.txt:
* fast/canvas/script-tests/canvas-createImageData.js:
* fast/canvas/script-tests/canvas-getImageData-invalid.js:
* fast/canvas/script-tests/canvas-imageData.js:
* fast/canvas/script-tests/canvas-overloads-drawImage.js:
* fast/canvas/script-tests/gradient-addColorStop-with-invalid-color.js:
* fast/css/CSSPrimitiveValue-exceptions-expected.txt:
* fast/css/css3-nth-tokens-script-expected.txt:
* fast/css/css3-nth-tokens-script.html:
* fast/css/getFloatValueForUnit-expected.txt:
* fast/css/getFloatValueForUnit.html:
* fast/css/insert-rule-overflow-rule-data-expected.txt:
* fast/css/parsing-css-attribute-case-insensitive-value-1-expected.txt:
* fast/css/parsing-css-attribute-case-insensitive-value-2-expected.txt:
* fast/css/parsing-css-attribute-case-insensitive-value-3-expected.txt:
* fast/css/parsing-css-attribute-case-insensitive-value-3.html:
* fast/css/parsing-css-descendant-combinator-doubled-child-syntax-expected.txt:
* fast/css/parsing-css-descendant-combinator-doubled-child-syntax.html:
* fast/css/parsing-css-matches-5-expected.txt:
* fast/css/parsing-css-matches-5.html:
* fast/css/parsing-css-matches-6-expected.txt:
* fast/css/parsing-css-matches-6.html:
* fast/css/parsing-css-matches-7-expected.txt:
* fast/css/parsing-css-matches-7.html:
* fast/css/parsing-css-matches-8-expected.txt:
* fast/css/parsing-css-matches-8.html:
* fast/css/parsing-css-not-5-expected.txt:
* fast/css/parsing-css-not-5.html:
* fast/css/parsing-css-not-6-expected.txt:
* fast/css/parsing-css-not-6.html:
* fast/css/parsing-css-not-7-expected.txt:
* fast/css/parsing-css-not-7.html:
* fast/css/parsing-css-not-8-expected.txt:
* fast/css/parsing-css-not-8.html:
* fast/css/parsing-css-not-9-expected.txt:
* fast/css/parsing-css-not-9.html:
* fast/css/parsing-css-nth-child-of-3-expected.txt:
* fast/css/parsing-css-nth-child-of-3.html:
* fast/css/parsing-css-nth-child-of-4-expected.txt:
* fast/css/parsing-css-nth-child-of-4.html:
* fast/css/parsing-css-nth-last-child-of-3-expected.txt:
* fast/css/parsing-css-nth-last-child-of-3.html:
* fast/css/parsing-css-nth-last-child-of-4-expected.txt:
* fast/css/parsing-css-nth-last-child-of-4.html:
* fast/css/resources/CSSPrimitiveValue-exceptions.js:
* fast/dom/DOMException/prototype-object-expected.txt:
* fast/dom/DOMException/prototype-object.html:
* fast/dom/DOMException/stack-trace-expected.txt:
* fast/dom/DOMException/stack-trace.html:
* fast/dom/Document/createElement-invalid-names-expected.txt:
* fast/dom/Document/createElement-invalid-names.html:
* fast/dom/Document/invalid-domain-change-throws-exception-expected.txt:
* fast/dom/Document/replace-child-expected.txt:
* fast/dom/Document/script-tests/invalid-domain-change-throws-exception.js:
* fast/dom/Element/class-list-toggle-expected.txt:
* fast/dom/Element/class-list-toggle.html:
* fast/dom/Element/prefix-setter-exception-expected.txt:
* fast/dom/Geolocation/argument-types-expected.txt:
* fast/dom/Geolocation/not-enough-arguments-expected.txt:
* fast/dom/Geolocation/script-tests/argument-types.js:
(test):
* fast/dom/HTMLElement/insertAdjacentHTML-errors-expected.txt:
* fast/dom/HTMLElement/script-tests/insertAdjacentHTML-errors.js:
* fast/dom/HTMLElement/set-invalid-value-expected.txt:
* fast/dom/HTMLElement/set-invalid-value.html:
* fast/dom/HTMLInputElement/input-size-attribute-expected.txt:
* fast/dom/HTMLInputElement/input-size-attribute.html:
* fast/dom/HTMLMeterElement/script-tests/set-meter-properties.js:
* fast/dom/HTMLMeterElement/set-meter-properties-expected.txt:
* fast/dom/HTMLProgressElement/script-tests/set-progress-properties.js:
* fast/dom/HTMLProgressElement/set-progress-properties-expected.txt:
* fast/dom/HTMLSelectElement/options-collection-add-expected.txt:
* fast/dom/HTMLSelectElement/select-add-optgroup-expected.txt:
* fast/dom/HTMLSelectElement/select-selectedIndex-expected.txt:
* fast/dom/HTMLSelectElement/select-selectedIndex-multiple-expected.txt:
* fast/dom/HTMLTableElement/nullable-attributes-expected.txt:
* fast/dom/HTMLTableElement/nullable-attributes.html:
* fast/dom/HTMLTemplateElement/cycles-expected.txt:
* fast/dom/HTMLTemplateElement/cycles-in-shadow-expected.txt:
* fast/dom/Node/initial-values-expected.txt:
* fast/dom/ParentNode-append-expected.txt:
* fast/dom/ParentNode-prepend-expected.txt:
* fast/dom/Range/31684-expected.txt:
* fast/dom/Range/clone-contents-document-type-expected.txt:
* fast/dom/Range/clone-contents-document-type.html:
* fast/dom/Range/compareBoundaryPoints-1.html:
* fast/dom/Range/compareBoundaryPoints-compareHow-exception-expected.txt:
* fast/dom/Range/compareBoundaryPoints-compareHow-exception.html:
* fast/dom/Range/extract-contents-document-type-expected.txt:
* fast/dom/Range/extract-contents-document-type.html:
* fast/dom/Range/range-comparePoint-detached-nodes-expected.txt:
* fast/dom/Range/range-comparePoint-detached-nodes.html:
* fast/dom/Range/range-exceptions-expected.txt:
* fast/dom/Range/range-intersectsNode-expected.txt:
* fast/dom/Range/script-tests/31684.js:
* fast/dom/Range/script-tests/range-exceptions.js:
* fast/dom/Range/surroundContents-1.html:
* fast/dom/Selection/collapseToX-empty-selection-expected.txt:
* fast/dom/Selection/script-tests/collapseToX-empty-selection.js:
* fast/dom/SelectorAPI/dumpNodeList-almost-strict-expected.txt:
* fast/dom/SelectorAPI/dumpNodeList-expected.txt:
* fast/dom/SelectorAPI/not-supported-namespace-in-selector-expected.txt:
* fast/dom/Text/splitText-expected.txt:
* fast/dom/Text/splitText.html:
* fast/dom/Window/anonymous-slot-with-changes-expected.txt:
* fast/dom/Window/atob-btoa-expected.txt:
* fast/dom/Window/custom-constructors-expected.txt:
* fast/dom/Window/dispatchEvent-expected.txt:
* fast/dom/Window/invalid-protocol-expected.txt:
* fast/dom/Window/window-postmessage-clone-expected.txt:
* fast/dom/computed-style-set-property-expected.txt:
* fast/dom/createElementNS-namespace-errors-expected.txt:
* fast/dom/createElementNS-namespace-errors.html:
* fast/dom/css-mediarule-functions-expected.txt:
* fast/dom/css-mediarule-functions.html:
* fast/dom/custom/document-register-basic-expected.txt:
* fast/dom/custom/document-register-basic.html:
* fast/dom/custom/document-register-type-extensions-expected.txt:
* fast/dom/custom/document-register-type-extensions.html:
* fast/dom/dataset-expected.txt:
* fast/dom/dataset-xhtml-expected.txt:
* fast/dom/document-set-body-null-expected.txt:
* fast/dom/document-set-body-null.html:
* fast/dom/element-attribute-js-null-expected.txt:
* fast/dom/insertAdjacentHTML-DocumentFragment-crash-expected.txt:
* fast/dom/node-prefix-setter-namespace-exception-expected.txt:
* fast/dom/outerText-no-element-expected.txt:
* fast/dom/processing-instruction-appendChild-exceptions-expected.txt:
* fast/dom/processing-instruction-appendChild-exceptions.xhtml:
* fast/dom/rel-list-expected.txt:
* fast/dom/script-tests/dataset-xhtml.js:
* fast/dom/script-tests/dataset.js:
* fast/dom/setAttributeNS-namespace-errors-expected.txt:
* fast/dom/setAttributeNS-namespace-errors.html:
* fast/dom/setPrimitiveValue-exceptions-expected.txt:
* fast/dom/setPrimitiveValue-expected.txt:
* fast/dynamic/insertAdjacentElement-expected.txt:
* fast/dynamic/insertAdjacentHTML-expected.txt:
* fast/dynamic/insertAdjacentText-expected.txt:
* fast/dynamic/outerHTML-no-element-expected.txt:
* fast/events/dispatch-event-being-dispatched-expected.txt:
* fast/events/dispatch-event-being-dispatched.html:
* fast/events/message-port-clone-expected.txt:
* fast/events/message-port-multi-expected.txt:
* fast/events/mutation-during-append-child-expected.txt:
* fast/events/mutation-during-append-child.html:
* fast/events/mutation-during-insert-before-expected.txt:
* fast/events/mutation-during-insert-before.html:
* fast/events/mutation-during-replace-child-2-expected.txt:
* fast/events/mutation-during-replace-child-2.html:
* fast/events/mutation-during-replace-child-expected.txt:
* fast/events/mutation-during-replace-child.html:
* fast/eventsource/eventsource-constructor-expected.txt:
* fast/forms/color/color-setrangetext-expected.txt:
* fast/forms/date/date-setrangetext-expected.txt:
* fast/forms/date/date-stepup-stepdown-expected.txt:
* fast/forms/date/date-stepup-stepdown.html:
* fast/forms/date/input-valueasnumber-date-expected.txt:
* fast/forms/date/input-valueasnumber-date.html:
* fast/forms/datetime/datetime-setrangetext-expected.txt:
* fast/forms/datetime/datetime-stepup-stepdown-expected.txt:
* fast/forms/datetime/datetime-stepup-stepdown.html:
* fast/forms/datetime/input-valueasnumber-datetime-expected.txt:
* fast/forms/datetime/input-valueasnumber-datetime.html:
* fast/forms/datetimelocal/datetimelocal-setrangetext-expected.txt:
* fast/forms/datetimelocal/datetimelocal-stepup-stepdown-expected.txt:
* fast/forms/datetimelocal/datetimelocal-stepup-stepdown.html:
* fast/forms/datetimelocal/input-valueasnumber-datetimelocal-expected.txt:
* fast/forms/datetimelocal/input-valueasnumber-datetimelocal.html:
* fast/forms/file/file-setrangetext-expected.txt:
* fast/forms/file/input-file-value-expected.txt:
* fast/forms/hidden/hidden-setrangetext-expected.txt:
* fast/forms/image/image-setrangetext-expected.txt:
* fast/forms/input-maxlength-expected.txt:
* fast/forms/input-maxlength.html:
* fast/forms/input-stepup-stepdown-expected.txt:
* fast/forms/input-stepup-stepdown.html:
* fast/forms/input-valueasnumber-unsupported-expected.txt:
* fast/forms/input-valueasnumber-unsupported.html:
* fast/forms/month/input-valueasdate-expected.txt:
* fast/forms/month/input-valueasdate.html:
* fast/forms/month/input-valueasnumber-month-expected.txt:
* fast/forms/month/input-valueasnumber-month.html:
* fast/forms/month/month-setrangetext-expected.txt:
* fast/forms/month/month-stepup-stepdown-expected.txt:
* fast/forms/month/month-stepup-stepdown.html:
* fast/forms/number/number-setrangetext-expected.txt:
* fast/forms/number/number-size-expected.txt:
* fast/forms/number/number-size.html:
* fast/forms/number/number-stepup-stepdown-expected.txt:
* fast/forms/number/number-stepup-stepdown-from-renderer.html:
* fast/forms/number/number-stepup-stepdown.html:
* fast/forms/number/number-valueasnumber-expected.txt:
* fast/forms/number/number-valueasnumber.html:
* fast/forms/range/input-valueasnumber-range-expected.txt:
* fast/forms/range/input-valueasnumber-range.html:
* fast/forms/range/range-setrangetext-expected.txt:
* fast/forms/range/range-stepup-stepdown-expected.txt:
* fast/forms/range/range-stepup-stepdown-from-renderer.html:
* fast/forms/range/range-stepup-stepdown.html:
* fast/forms/search/search-setrangetext-expected.txt:
* fast/forms/setrangetext-expected.txt:
* fast/forms/textarea-maxlength-expected.txt:
* fast/forms/textarea-maxlength.html:
* fast/forms/textarea/textarea-setrangetext-expected.txt:
* fast/forms/time/time-setrangetext-expected.txt:
* fast/forms/time/time-stepup-stepdown-expected.txt:
* fast/forms/time/time-stepup-stepdown.html:
* fast/forms/time/time-valueasnumber-expected.txt:
* fast/forms/time/time-valueasnumber.html:
* fast/forms/week/input-valueasnumber-week-expected.txt:
* fast/forms/week/input-valueasnumber-week.html:
* fast/forms/week/week-setrangetext-expected.txt:
* fast/forms/week/week-stepup-stepdown-expected.txt:
* fast/forms/week/week-stepup-stepdown.html:
* fast/frames/adopt-iframe-into-itself-expected.txt:
* fast/frames/adopt-object-into-itself-expected.txt:
* fast/frames/resources/sandboxed-iframe-storage-disallowed.html:
* fast/frames/sandboxed-iframe-storage-expected.txt:
* fast/html/marquee-element-expected.txt:
* fast/innerHTML/innerHTML-changing-document-properties-expected.txt:
* fast/inspector-support/uncaught-dom1-exception-expected.txt:
* fast/inspector-support/uncaught-dom3-exception-expected.txt:
* fast/inspector-support/uncaught-dom8-exception-expected.txt:
* fast/loader/stateobjects/pushstate-frequency-expected.txt:
* fast/loader/stateobjects/pushstate-frequency-iframe-expected.txt:
* fast/loader/stateobjects/replacestate-frequency-expected.txt:
* fast/loader/stateobjects/replacestate-frequency-iframe-expected.txt:
* fast/media/mq-js-media-except-01-expected.html:
* fast/media/mq-js-media-except-02-expected.html:
* fast/media/mq-js-media-except-03-expected.html:
* fast/mediastream/MediaDevices-getUserMedia-expected.txt:
* fast/mediastream/RTCPeerConnection-addIceCandidate-expected.txt:
* fast/mediastream/RTCPeerConnection-closed-state-expected.txt:
* fast/mediastream/RTCPeerConnection-createAnswer-expected.txt:
* fast/mediastream/RTCPeerConnection-createOffer-expected.txt:
* fast/mediastream/RTCPeerConnection-datachannel-expected.txt:
* fast/mediastream/RTCPeerConnection-dtmf-expected.txt:
* fast/mediastream/RTCPeerConnection-have-local-offer-expected.txt:
* fast/mediastream/RTCPeerConnection-have-remote-offer-expected.txt:
* fast/mediastream/RTCPeerConnection-setLocalDescription-offer-expected.txt:
* fast/mediastream/RTCPeerConnection-setRemoteDescription-offer-expected.txt:
* fast/mediastream/RTCPeerConnection-stable-expected.txt:
* fast/mediastream/RTCRtpSender-replaceTrack-expected.txt:
* fast/notifications/notifications-document-close-crash-expected.txt:
* fast/regions/selection/crash-deselect-expected.txt:
* fast/selectors/closest-general-expected.txt:
* fast/selectors/invalid-functional-pseudo-class-expected.txt:
* fast/selectors/lang-empty-expected.txt:
* fast/selectors/lang-extended-filtering-expected.txt:
* fast/selectors/lang-extended-filtering-with-string-arguments-expected.txt:
* fast/selectors/lang-invalid-expected.txt:
* fast/selectors/lang-multiple-expected.txt:
* fast/selectors/querySelector-pseudo-element-inside-functional-pseudo-class-not-expected.txt:
* fast/text/font-face-empty-string-expected.txt:
* fast/text/font-face-javascript-expected.txt:
* fast/text/font-face-set-javascript-expected.txt:
* fast/text/text-combine-crash-expected.txt:
* fast/workers/atob-btoa-expected.txt:
* fast/workers/worker-constructor-expected.txt:
* fast/workers/worker-context-multi-port-expected.txt:
* fast/workers/worker-multi-port-expected.txt:
* fast/xmlhttprequest/xmlhttprequest-responseXML-xml-text-responsetype-expected.txt:
* fast/xmlhttprequest/xmlhttprequest-responsetype-arraybuffer-expected.txt:
* fast/xmlhttprequest/xmlhttprequest-responsetype-before-open-sync-request-expected.txt:
* fast/xmlhttprequest/xmlhttprequest-responsetype-document-expected.txt:
* fast/xmlhttprequest/xmlhttprequest-responsetype-set-at-headers-received-expected.txt:
* fast/xmlhttprequest/xmlhttprequest-responsetype-sync-request-expected.txt:
* fast/xmlhttprequest/xmlhttprequest-responsetype-text-expected.txt:
* fast/xmlhttprequest/xmlhttprequest-sync-disabled-expected.txt:
* fast/xpath/attr-namespace-expected.txt:
* fast/xpath/detached-subtree-invalidate-iterator-expected.txt:
* fast/xpath/py-dom-xpath/nodetests-expected.txt:
* http/tests/contentextensions/sync-xhr-blocked-expected.txt:
* http/tests/loading/state-object-security-exception-expected.txt:
* http/tests/local/fileapi/send-sliced-dragged-file-expected.txt:
* http/tests/notifications/legacy/show-expected.txt:
* http/tests/security/canvas-remote-read-data-url-image-redirect-expected.txt:
* http/tests/security/canvas-remote-read-remote-image-blocked-no-crossorigin-expected.txt:
* http/tests/security/canvas-remote-read-remote-image-expected.txt:
* http/tests/security/canvas-remote-read-remote-image-redirect-expected.txt:
* http/tests/security/canvas-remote-read-remote-video-blocked-no-crossorigin-expected.txt:
* http/tests/security/canvas-remote-read-remote-video-localhost-expected.txt:
* http/tests/security/canvas-remote-read-remote-video-redirect-expected.txt:
* http/tests/security/contentSecurityPolicy/1.1/child-src/worker-blocked-expected.txt:
* http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked-expected.txt:
* http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html:
* http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-block-aborts-all-subsequent-imports-expected.txt:
* http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
* http/tests/security/contentSecurityPolicy/worker-csp-blocks-xhr-redirect-cross-origin-expected.txt:
* http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
* http/tests/security/contentSecurityPolicy/worker-importscripts-blocked-expected.txt:
* http/tests/security/contentSecurityPolicy/worker-importscripts-blocked.html:
* http/tests/security/history-username-password-expected.txt:
* http/tests/security/postMessage/invalid-origin-throws-exception-expected.txt:
* http/tests/security/postMessage/target-origin-expected.txt:
* http/tests/security/resources/canvas-video-crossorigin.js:
(testDataRetrievalAllowed):
(testDataRetrievalForbidden):
* http/tests/security/setDomainRelaxationForbiddenForURLScheme-expected.txt:
* http/tests/security/webgl-remote-read-remote-image-blocked-no-crossorigin-expected.txt:
* http/tests/websocket/tests/hybi/bad-sub-protocol-control-chars-expected.txt:
* http/tests/websocket/tests/hybi/bad-sub-protocol-empty-expected.txt:
* http/tests/websocket/tests/hybi/bad-sub-protocol-non-ascii-expected.txt:
* http/tests/websocket/tests/hybi/binary-type-expected.txt:
* http/tests/websocket/tests/hybi/binary-type.html:
* http/tests/websocket/tests/hybi/invalid-subprotocol-characters-expected.txt:
* http/tests/websocket/tests/hybi/invalid-subprotocol-characters.html:
* http/tests/websocket/tests/hybi/invalid-subprotocols-expected.txt:
* http/tests/websocket/tests/hybi/invalid-subprotocols.html:
* http/tests/websocket/tests/hybi/url-parsing-expected.txt:
* http/tests/workers/worker-importScripts-expected.txt:
* http/tests/workers/worker-redirect-expected.txt:
* http/tests/xmlhttprequest/XMLHttpRequestException-expected.txt:
* http/tests/xmlhttprequest/XMLHttpRequestException.html:
* http/tests/xmlhttprequest/access-control-and-redirects-expected.txt:
* http/tests/xmlhttprequest/access-control-basic-denied-expected.txt:
* http/tests/xmlhttprequest/access-control-basic-get-fail-non-simple-expected.txt:
* http/tests/xmlhttprequest/access-control-basic-non-simple-deny-cached-expected.txt:
* http/tests/xmlhttprequest/access-control-basic-post-fail-non-simple-content-type-expected.txt:
* http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-expected.txt:
* http/tests/xmlhttprequest/access-control-sandboxed-iframe-denied-without-wildcard-expected.txt:
* http/tests/xmlhttprequest/connection-error-sync-expected.txt:
* http/tests/xmlhttprequest/cross-origin-no-authorization-expected.txt:
* http/tests/xmlhttprequest/exceptions-expected.txt:
* http/tests/xmlhttprequest/inject-header-expected.txt:
* http/tests/xmlhttprequest/origin-exact-matching-expected.txt:
* http/tests/xmlhttprequest/origin-whitelisting-https-expected.txt:
* http/tests/xmlhttprequest/origin-whitelisting-ip-addresses-with-subdomains-expected.txt:
* http/tests/xmlhttprequest/origin-whitelisting-removal-expected.txt:
* http/tests/xmlhttprequest/workers/access-control-basic-get-fail-non-simple-expected.txt:
* http/tests/xmlhttprequest/xmlhttprequest-open-empty-method-expected.txt:
* http/tests/xmlhttprequest/xmlhttprequest-overridemimetype-invalidstaterror-expected.txt:
* http/tests/xmlhttprequest/xmlhttprequest-setrequestheader-no-name-expected.txt:
* http/tests/xmlhttprequest/xmlhttprequest-sync-no-progress-events-expected.txt:
* http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect-expected.txt:
* inspector/debugger/command-line-api-exception-expected.txt:
* inspector/debugger/regress-133182-expected.txt:
* inspector/debugger/resources/exceptions.js:
(triggerUncaughtDOMException):
* inspector/debugger/setPauseOnExceptions-all-expected.txt:
* inspector/debugger/setPauseOnExceptions-none-expected.txt:
* inspector/debugger/setPauseOnExceptions-uncaught-expected.txt:
* inspector/model/remote-object-expected.txt:
* js/dom/dfg-custom-getter-throw-expected.txt:
* js/dom/reflect-set-onto-dom-expected.txt:
* js/dom/script-tests/dfg-custom-getter-throw-inlined.js:
(i.dfgIncrement):
* js/dom/script-tests/dfg-custom-getter-throw.js:
* loader/stateobjects/pushstate-size-expected.txt:
* loader/stateobjects/pushstate-size-iframe-expected.txt:
* loader/stateobjects/replacestate-size-expected.txt:
* loader/stateobjects/replacestate-size-iframe-expected.txt:
* media/track/regions-webvtt/vtt-region-constructor-expected.txt:
* media/track/regions-webvtt/vtt-region-list-expected.txt:
* platform/efl/fast/dynamic/015-expected.txt:
* platform/gtk/fast/dynamic/015-expected.txt:
* platform/ios-simulator-wk2/editing/selection/caret-ltr-2-expected.txt:
* platform/ios-simulator-wk2/editing/selection/caret-ltr-2-left-expected.txt:
* platform/ios-simulator-wk2/editing/selection/caret-ltr-expected.txt:
* platform/ios-simulator-wk2/editing/selection/caret-ltr-right-expected.txt:
* platform/ios-simulator-wk2/editing/selection/caret-rtl-2-expected.txt:
* platform/ios-simulator-wk2/editing/selection/caret-rtl-2-left-expected.txt:
* platform/ios-simulator-wk2/editing/selection/caret-rtl-expected.txt:
* platform/ios-simulator-wk2/editing/selection/caret-rtl-right-expected.txt:
* platform/ios-simulator/fast/attachment/attachment-select-on-click-expected.txt:
* platform/ios-simulator/fast/dynamic/015-expected.txt:
* platform/ios-simulator/imported/w3c/web-platform-tests/html/dom/interfaces-expected.txt:
* platform/ios-simulator/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/time-expected.txt:
* platform/ios-simulator/imported/w3c/web-platform-tests/html/semantics/interfaces-expected.txt:
* platform/ios-simulator/webaudio/analyser-exception-expected.txt:
* platform/ios-simulator/webaudio/audiobuffersource-exception-expected.txt:
* platform/ios-simulator/webaudio/delaynode-maxdelaylimit-expected.txt:
* platform/mac/TestExpectations:
* platform/mac/canvas/philip/tests/2d.missingargs-expected.txt:
* platform/mac/fast/dynamic/015-expected.txt:
* platform/mac/inspector/model/remote-object-expected.txt:
* platform/win/fast/dynamic/015-expected.txt:
* security/contentSecurityPolicy/worker-inherits-blocks-xhr-expected.txt:
* storage/domstorage/localstorage/blocked-file-access-expected.txt:
* storage/domstorage/localstorage/private-browsing-affects-storage-expected.txt:
* storage/domstorage/sessionstorage/private-browsing-affects-storage-expected.txt:
* storage/indexeddb/removed-expected.txt:
* storage/indexeddb/removed-private-expected.txt:
* storage/websql/open-database-set-empty-version-expected.txt:
* svg/animations/animate-gradient-transform-expected.txt:
* svg/as-image/svg-canvas-pattern-with-link-tainted-expected.txt:
* svg/as-image/svg-canvas-svg-with-feimage-with-link-tainted-expected.txt:
* svg/as-image/svg-canvas-svg-with-image-with-link-tainted-expected.txt:
* svg/as-image/svg-canvas-xhtml-tainted-expected.txt:
* svg/custom/acid3-test-77-expected.txt:
* svg/custom/baseval-animval-equality-expected.txt:
* svg/custom/getSubStringLength-expected.txt:
* svg/custom/selectSubString-expected.txt:
* svg/dom/SVGAngle-expected.txt:
* svg/dom/SVGColor-expected.txt:
* svg/dom/SVGLength-expected.txt:
* svg/dom/SVGLength-px-expected.txt:
* svg/dom/SVGLengthList-appendItem-expected.txt:
* svg/dom/SVGLengthList-basics-expected.txt:
* svg/dom/SVGLengthList-getItem-expected.txt:
* svg/dom/SVGLengthList-initialize-expected.txt:
* svg/dom/SVGLengthList-insertItemBefore-expected.txt:
* svg/dom/SVGLengthList-removeItem-expected.txt:
* svg/dom/SVGLengthList-replaceItem-expected.txt:
* svg/dom/SVGNumberList-basics-expected.txt:
* svg/dom/SVGPaint-expected.txt:
* svg/dom/SVGPathSegList-clear-and-initialize-expected.txt:
* svg/dom/SVGPointList-basics-expected.txt:
* svg/dom/SVGPreserveAspectRatio-expected.txt:
* svg/dom/SVGStringList-basics-expected.txt:
* svg/dom/SVGTransformList-basics-expected.txt:
* svg/dom/SVGTransformList-expected.txt:
* svg/dom/SVGViewSpec-defaults-expected.txt:
* svg/dom/altGlyph-dom-expected.txt:
* svg/dom/svglist-exception-on-out-bounds-error-expected.txt:
* transforms/cssmatrix-2d-interface-expected.txt:
* transforms/cssmatrix-3d-interface-expected.txt:
* webaudio/analyser-exception-expected.txt:
* webaudio/analyser-exception.html:
* webaudio/audiobuffersource-channels-expected.txt:
* webaudio/audiobuffersource-exception-expected.txt:
* webaudio/audiobuffersource-exception.html:
* webaudio/convolver-channels-expected.txt:
* webaudio/convolver-channels.html:
* webaudio/convolver-setBuffer-different-samplerate-expected.txt:
* webaudio/convolver-setBuffer-different-samplerate.html:
* webaudio/delaynode-maxdelaylimit-expected.txt:
* webaudio/offlineaudiocontext-constructor-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203333 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[JSC] Enable test262 module tests
utatane.tea@gmail.com [Sun, 17 Jul 2016 14:39:12 +0000 (14:39 +0000)]
[JSC] Enable test262 module tests
https://bugs.webkit.org/show_bug.cgi?id=159854

Reviewed by Saam Barati.

Source/JavaScriptCore:

This patch enables test262 module tests. Before this patch, the modules tests in test262 do not work fine.
This patch fixes the following 2 things.

1. Test harness

    Before this patch, there is only one global switch "-m" in jsc shell. So we cannot load the test262 test harness before evaluating the module tests.
    This patch adds a new option, "--module-file=". It is similar to "--strict-file=". When we specify the file with "--module-file=", it is evaluated as
    a module, while the other files are evaluated by following the JSC's default manner. This option allows us to load the test harness files into the
    global context before loading the module tests.

2. Module's asynchronous errors

    Before this patch, the errors caused in the module evaluation are not handled as the same to the usual sync files. In synchronous execution, we have
    "--exception=" option to pass the expected exception to the JSC shell. But this option does not work in the module evaluation.
    This patch correctly handles this expected exception in the module evaluation promise's fulfill and reject handlers.

And we fix the YAML file. Now the recorded :fail and :normal are the correct test results for the module tests.

* jsc.cpp:
(Script::Script):
(checkUncaughtException):
(runWithScripts):
(printUsageStatement):
(CommandLine::parseArguments):
(dumpException): Deleted.
* tests/test262.yaml:

Tools:

Use --module-file instead.

* Scripts/run-jsc-stress-tests:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203332 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[JSC] Mask TrustedImm32 to 8bit in MacroAssembler for 8bit operations
utatane.tea@gmail.com [Sun, 17 Jul 2016 14:33:26 +0000 (14:33 +0000)]
[JSC] Mask TrustedImm32 to 8bit in MacroAssembler for 8bit operations
https://bugs.webkit.org/show_bug.cgi?id=159334

Reviewed by Filip Pizlo.

Previously, in 8bit operations (like add8, compare8, test8, branch8, branchTest8 etc.),
we require that the given TrustedImm32 is in range of 8bit. While achieving this in
the manual MacroAssembler calling is easy, in Air, we don't guarantee that the higher bit
of the 8bit argument is cleared. So the current assertions are invalid.

This patch relaxes the above restriction. By removing this assertion,
8bit operations can take arbitrary 32bit imms. And only lower 8bit are effective when
emitting the code in these methods.

* assembler/MacroAssembler.h:
(JSC::MacroAssembler::branchTest8):
* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::store8):
(JSC::MacroAssemblerARM::branch8):
(JSC::MacroAssemblerARM::branchTest8):
(JSC::MacroAssemblerARM::compare8):
(JSC::MacroAssemblerARM::test8):
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::store8):
(JSC::MacroAssemblerARM64::branch8):
(JSC::MacroAssemblerARM64::branchTest8):
(JSC::MacroAssemblerARM64::compare8):
(JSC::MacroAssemblerARM64::test8):
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::store8):
(JSC::MacroAssemblerARMv7::branch8):
(JSC::MacroAssemblerARMv7::branchTest8):
(JSC::MacroAssemblerARMv7::compare8):
(JSC::MacroAssemblerARMv7::test8):
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::store8):
(JSC::MacroAssemblerMIPS::branch8):
(JSC::MacroAssemblerMIPS::compare8):
(JSC::MacroAssemblerMIPS::branchTest8):
(JSC::MacroAssemblerMIPS::test8):
* assembler/MacroAssemblerSH4.h:
(JSC::MacroAssemblerSH4::store8):
(JSC::MacroAssemblerSH4::branchTest8):
(JSC::MacroAssemblerSH4::branch8):
(JSC::MacroAssemblerSH4::compare8):
(JSC::MacroAssemblerSH4::test8):
* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::store8):
(JSC::MacroAssemblerX86::branch8):
(JSC::MacroAssemblerX86::branchTest8):
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::add8):
(JSC::MacroAssemblerX86Common::store8):
(JSC::MacroAssemblerX86Common::branch8):
(JSC::MacroAssemblerX86Common::branchTest8):
(JSC::MacroAssemblerX86Common::compare8):
(JSC::MacroAssemblerX86Common::test8):
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::store8):
(JSC::MacroAssemblerX86_64::branch8):
(JSC::MacroAssemblerX86_64::branchTest8):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203331 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoSupport new emoji group candidates
mmaxfield@apple.com [Sun, 17 Jul 2016 07:16:03 +0000 (07:16 +0000)]
Support new emoji group candidates
https://bugs.webkit.org/show_bug.cgi?id=159755
<rdar://problem/27325521>

Reviewed by Dean Jackson.

Source/WebCore:

There are a few code points which should be able to be joined (with ZWJ) to
either U+2640 or U+2642 to change the gender of the emoji. These patterns
should also work with an additional 0xFE0F variation selector. This patch
adds these new patterns to our existing emoji group candidate infrastructure.

Tests: fast/text/emoji-gender-2-3.html
       fast/text/emoji-gender-2-4.html
       fast/text/emoji-gender-2-5.html
       fast/text/emoji-gender-2-6.html
       fast/text/emoji-gender-2-7.html
       fast/text/emoji-gender-2-8.html
       fast/text/emoji-gender-2-9.html
       fast/text/emoji-gender-2.html
       fast/text/emoji-gender-3.html
       fast/text/emoji-gender-4.html
       fast/text/emoji-gender-5.html
       fast/text/emoji-gender-6.html
       fast/text/emoji-gender-7.html
       fast/text/emoji-gender-8.html
       fast/text/emoji-gender-9.html
       fast/text/emoji-gender-fe0f-3.html
       fast/text/emoji-gender-fe0f-4.html
       fast/text/emoji-gender-fe0f-5.html
       fast/text/emoji-gender-fe0f-6.html
       fast/text/emoji-gender-fe0f-7.html
       fast/text/emoji-gender-fe0f-8.html
       fast/text/emoji-gender-fe0f-9.html
       fast/text/emoji-gender.html
       fast/text/emoji-num-glyphs.html
       fast/text/emoji-single-parent-family-2.html
       fast/text/emoji-single-parent-family.html

* platform/graphics/mac/ComplexTextControllerCoreText.mm:
(WebCore::ComplexTextController::ComplexTextRun::ComplexTextRun): Removed incorrect ASSERT()s.
* platform/graphics/FontCascade.cpp:
(WebCore::FontCascade::characterRangeCodePath):
* platform/text/CharacterProperties.h:
(WebCore::isEmojiGroupCandidate):

Source/WTF:

This patch doesn't update the rules for our cursor movement iterator, because
I don't know the language used for implementing these rules. These rules will
be updated in the near future. When they do,
editing/deleting/delete-emoji-expected.txt will need to be updated.

* wtf/text/TextBreakIterator.cpp:
(WTF::cursorMovementIterator):

LayoutTests:

Because this patch doesn't update the rules for our cursor movement
iterator, the new expected result for editing/deleting/delete-emoji.html
expects incorrect results. In the patch where we update these rules,
the expected result should also be updated.

Because these new emoji require system support, TestExpectations has
been updated to mark the tests as failing until the system support has
been added.

* TestExpectations:
* editing/deleting/delete-emoji-expected.txt:
* fast/text/emoji-gender-2-3-expected.html: Added.
* fast/text/emoji-gender-2-3.html: Added.
* fast/text/emoji-gender-2-4-expected.html: Added.
* fast/text/emoji-gender-2-4.html: Added.
* fast/text/emoji-gender-2-5-expected.html: Added.
* fast/text/emoji-gender-2-5.html: Added.
* fast/text/emoji-gender-2-6-expected.html: Added.
* fast/text/emoji-gender-2-6.html: Added.
* fast/text/emoji-gender-2-7-expected.html: Added.
* fast/text/emoji-gender-2-7.html: Added.
* fast/text/emoji-gender-2-8-expected.html: Added.
* fast/text/emoji-gender-2-8.html: Added.
* fast/text/emoji-gender-2-9-expected.html: Added.
* fast/text/emoji-gender-2-9.html: Added.
* fast/text/emoji-gender-2-expected-mismatch.html: Added.
* fast/text/emoji-gender-2.html: Added.
* fast/text/emoji-gender-3-expected.html: Added.
* fast/text/emoji-gender-3.html: Added.
* fast/text/emoji-gender-4-expected.html: Added.
* fast/text/emoji-gender-4.html: Added.
* fast/text/emoji-gender-5-expected.html: Added.
* fast/text/emoji-gender-5.html: Added.
* fast/text/emoji-gender-6-expected.html: Added.
* fast/text/emoji-gender-6.html: Added.
* fast/text/emoji-gender-7-expected.html: Added.
* fast/text/emoji-gender-7.html: Added.
* fast/text/emoji-gender-8-expected.html: Added.
* fast/text/emoji-gender-8.html: Added.
* fast/text/emoji-gender-9-expected.html: Added.
* fast/text/emoji-gender-9.html: Added.
* fast/text/emoji-gender-expected-mismatch.html: Added.
* fast/text/emoji-gender-fe0f-3-expected.html: Added.
* fast/text/emoji-gender-fe0f-3.html: Added.
* fast/text/emoji-gender-fe0f-4-expected.html: Added.
* fast/text/emoji-gender-fe0f-4.html: Added.
* fast/text/emoji-gender-fe0f-5-expected.html: Added.
* fast/text/emoji-gender-fe0f-5.html: Added.
* fast/text/emoji-gender-fe0f-6-expected.html: Added.
* fast/text/emoji-gender-fe0f-6.html: Added.
* fast/text/emoji-gender-fe0f-7-expected.html: Added.
* fast/text/emoji-gender-fe0f-7.html: Added.
* fast/text/emoji-gender-fe0f-8-expected.html: Added.
* fast/text/emoji-gender-fe0f-8.html: Added.
* fast/text/emoji-gender-fe0f-9-expected.html: Added.
* fast/text/emoji-gender-fe0f-9.html: Added.
* fast/text/emoji-gender.html: Added.
* fast/text/emoji-num-glyphs-expected.txt: Added.
* fast/text/emoji-num-glyphs.html: Added.
* fast/text/emoji-single-parent-family-2-expected-mismatch.html: Added.
* fast/text/emoji-single-parent-family-2.html: Added.
* fast/text/emoji-single-parent-family-expected-mismatch.html: Added.
* fast/text/emoji-single-parent-family.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203330 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUnreviewed, rolling out r203318.
cdumez@apple.com [Sun, 17 Jul 2016 00:19:41 +0000 (00:19 +0000)]
Unreviewed, rolling out r203318.

Regressed most JS Benchmarks on MacBook Air by ~2% (7% on
SunSpider)

Reverted changeset:

"[JSC] Change some parameters based on a random search"
https://bugs.webkit.org/show_bug.cgi?id=158514
http://trac.webkit.org/changeset/203318

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203329 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUpdate SVGException to use the description in toString().
beidson@apple.com [Sat, 16 Jul 2016 21:33:01 +0000 (21:33 +0000)]
Update SVGException to use the description in toString().
https://bugs.webkit.org/show_bug.cgi?id=159847

Reviewed by Darin Adler.

Source/WebCore:

No new tests (Covered by changes to existing tests).

* bindings/js/JSDOMBinding.cpp:
(WebCore::reportException): use consoleErrorMessage for now.

* dom/ExceptionBase.cpp:
(WebCore::ExceptionBase::consoleErrorMessage):
* dom/ExceptionBase.h:

* svg/SVGException.h:

LayoutTests:

* svg/animations/animate-marker-orient-from-angle-to-autostartreverse-expected.txt:
* svg/custom/SVGException-expected.txt:
* svg/custom/polyline-points-crash-expected.txt:
* svg/custom/script-tests/SVGException.js:
* svg/dom/SVGAnimatedEnumeration-SVGClipPathElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGComponentTransferFunctionElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGFEBlendElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGFEColorMatrixElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGFECompositeElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGFEConvolveMatrixElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGFEDisplacementMapElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGFEMorphologyElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGFETurbulenceElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGFilterElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGGradientElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGMarkerElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGMaskElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGPatternElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGTextContentElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-SVGTextPathElement-expected.txt:
* svg/dom/SVGAnimatedEnumeration-expected.txt:
* svg/dom/SVGLengthList-basics-expected.txt:
* svg/dom/SVGMatrix-interface-expected.txt:
* svg/dom/SVGNumberList-basics-expected.txt:
* svg/dom/SVGPointList-basics-expected.txt:
* svg/dom/SVGTransformList-basics-expected.txt:
* svg/dom/svglist-exception-on-out-bounds-error-expected.txt:
* svg/filters/feBlend-invalid-mode-expected.txt:
* svg/filters/feComponentTransfer-style-crash-expected.txt:
* svg/filters/feDisplacementMap-crash-test-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203328 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUse secure (https) links on enter_bug.cgi
ddkilzer@apple.com [Sat, 16 Jul 2016 18:31:19 +0000 (18:31 +0000)]
Use secure (https) links on enter_bug.cgi
<https://webkit.org/b/159853>

Reviewed by Alexey Proskuryakov.

* template/en/default/global/choose-product.html.tmpl:
Use https instead of http for links to webkit.org.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203327 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUse fastHasAttribute() when possible
cdumez@apple.com [Sat, 16 Jul 2016 17:21:07 +0000 (17:21 +0000)]
Use fastHasAttribute() when possible
https://bugs.webkit.org/show_bug.cgi?id=159838

Reviewed by Ryosuke Niwa.

Use fastHasAttribute() when possible, for performance.

* editing/DeleteSelectionCommand.cpp:
(WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
* editing/markup.cpp:
(WebCore::createMarkupInternal):
* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::draggable):
* html/HTMLFrameElementBase.cpp:
(WebCore::HTMLFrameElementBase::parseAttribute):
* mathml/MathMLSelectElement.cpp:
(WebCore::MathMLSelectElement::getSelectedSemanticsChild):
* rendering/RenderThemeIOS.mm:
(WebCore::RenderThemeIOS::adjustMenuListButtonStyle):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203326 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoAdd move constructor / assignment operator to ListHashSet
cdumez@apple.com [Sat, 16 Jul 2016 16:33:11 +0000 (16:33 +0000)]
Add move constructor / assignment operator to ListHashSet
https://bugs.webkit.org/show_bug.cgi?id=159837

Reviewed by Darin Adler.

Source/WTF:

Add move constructor / assignment operator to ListHashSet.

* wtf/ListHashSet.h:
(WTF::ListHashSetConstIterator::operator++):
(WTF::U>::ListHashSet):
(WTF::=):
(WTF::U>::clear):
(WTF::U>::appendNode):
(WTF::U>::prependNode):
(WTF::U>::deleteAllNodes):
(WTF::ListHashSetNode::ListHashSetNode): Deleted.

Tools:

Add API tests.

* TestWebKitAPI/Tests/WTF/ListHashSet.cpp:
(TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203325 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoRename fastGetAttribute to attributeWithoutSynchronization
rniwa@webkit.org [Sat, 16 Jul 2016 15:21:55 +0000 (15:21 +0000)]
Rename fastGetAttribute to attributeWithoutSynchronization
https://bugs.webkit.org/show_bug.cgi?id=159852

Reviewed by Darin Adler.

Source/WebCore:

Renamed fastGetAttribute to attributeWithoutSynchronization for clarity.

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::findAriaModalNodes):
(WebCore::nodeHasRole):
(WebCore::AXObjectCache::handleLiveRegionCreated):
(WebCore::AXObjectCache::handleMenuItemSelected):
(WebCore::AXObjectCache::handleAriaModalChange):
(WebCore::isNodeAriaVisible):
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::siblingWithAriaRole):
(WebCore::AccessibilityNodeObject::titleElementText):
(WebCore::AccessibilityNodeObject::alternativeTextForWebArea):
(WebCore::AccessibilityNodeObject::hierarchicalLevel):
(WebCore::AccessibilityNodeObject::stringValue):
(WebCore::accessibleNameForNode):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::contentEditableAttributeIsEnabled):
(WebCore::AccessibilityObject::getAttribute):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::stringValue):
(WebCore::AccessibilityRenderObject::exposesTitleUIElement):
* accessibility/AccessibilitySVGElement.cpp:
(WebCore::AccessibilitySVGElement::childElementWithMatchingLanguage):
(WebCore::AccessibilitySVGElement::accessibilityDescription):
* bindings/objc/DOM.mm:
(-[DOMHTMLLinkElement _mediaQueryMatches]):
* bindings/scripts/CodeGenerator.pm:
(GetterExpression):
* bindings/scripts/CodeGeneratorObjC.pm:
(GenerateImplementation):
* bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjReflectedStringAttr):
* dom/AuthorStyleSheets.cpp:
(WebCore::AuthorStyleSheets::collectActiveStyleSheets):
* dom/Document.cpp:
(WebCore::Document::buildAccessKeyMap):
(WebCore::Document::processBaseElement):
* dom/DocumentOrderedMap.cpp:
(WebCore::DocumentOrderedMap::getElementByLabelForAttribute):
* dom/Element.cpp:
(WebCore::Element::imageSourceURL):
(WebCore::Element::rendererIsNeeded):
(WebCore::Element::insertedInto):
(WebCore::Element::removedFrom):
(WebCore::Element::pseudo):
(WebCore::Element::setPseudo):
(WebCore::Element::spellcheckAttributeState):
(WebCore::Element::canContainRangeEndPoint):
(WebCore::Element::completeURLsInAttributeValue):
* dom/Element.h:
(WebCore::Element::fastHasAttribute):
(WebCore::Element::attributeWithoutSynchronization):
(WebCore::Element::fastGetAttribute): Deleted.
* dom/InlineStyleSheetOwner.cpp:
(WebCore::InlineStyleSheetOwner::createSheet):
* dom/ScriptElement.cpp:
(WebCore::ScriptElement::requestScript):
(WebCore::ScriptElement::executeScript):
* dom/SlotAssignment.cpp:
(WebCore::slotNameFromSlotAttribute):
(WebCore::SlotAssignment::SlotAssignment):
(WebCore::recursivelyFireSlotChangeEvent):
(WebCore::SlotAssignment::didChangeSlot):
(WebCore::SlotAssignment::hostChildElementDidChange):
(WebCore::SlotAssignment::assignedNodesForSlot):
(WebCore::SlotAssignment::resolveAllSlotElements):
* dom/TreeScope.cpp:
(WebCore::TreeScope::labelElementForId):
* dom/VisitedLinkState.cpp:
(WebCore::linkAttribute):
* editing/ApplyStyleCommand.cpp:
(WebCore::isLegacyAppleStyleSpan):
(WebCore::hasNoAttributeOrOnlyStyleAttribute):
* editing/EditingStyle.cpp:
(WebCore::EditingStyle::elementIsStyledSpanOrHTMLEquivalent):
* editing/ReplaceSelectionCommand.cpp:
(WebCore::isInterchangeNewlineNode):
(WebCore::isInterchangeConvertedSpaceSpan):
(WebCore::positionAvoidingPrecedingNodes):
(WebCore::isMailPasteAsQuotationNode):
(WebCore::isHeaderElement):
(WebCore::isInlineNodeWithStyle):
* editing/TextIterator.cpp:
(WebCore::isRendererReplacedElement):
* editing/cocoa/DataDetection.mm:
(WebCore::DataDetection::isDataDetectorLink):
(WebCore::DataDetection::requiresExtendedContext):
(WebCore::DataDetection::dataDetectorIdentifier):
(WebCore::DataDetection::shouldCancelDefaultAction):
(WebCore::removeResultLinksFromAnchor):
(WebCore::searchForLinkRemovingExistingDDLinks):
* editing/gtk/EditorGtk.cpp:
(WebCore::elementURL):
* editing/htmlediting.cpp:
(WebCore::isTabSpanNode):
(WebCore::isTabSpanTextNode):
(WebCore::isMailBlockquote):
(WebCore::caretMinOffset):
* editing/markup.cpp:
(WebCore::createFragmentFromMarkup):
* html/Autofill.cpp:
(WebCore::AutofillData::createFromHTMLFormControlElement):
* html/BaseTextInputType.cpp:
(WebCore::BaseTextInputType::patternMismatch):
* html/DateInputType.cpp:
(WebCore::DateInputType::createStepRange):
* html/DateTimeInputType.cpp:
(WebCore::DateTimeInputType::createStepRange):
* html/DateTimeLocalInputType.cpp:
(WebCore::DateTimeLocalInputType::createStepRange):
* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::findAssociatedForm):
(WebCore::FormAssociatedElement::resetFormAttributeTargetObserver):
(WebCore::FormAssociatedElement::formAttributeTargetChanged):
* html/HTMLAnchorElement.cpp:
(WebCore::HTMLAnchorElement::draggable):
(WebCore::HTMLAnchorElement::href):
(WebCore::HTMLAnchorElement::setHref):
(WebCore::HTMLAnchorElement::target):
(WebCore::HTMLAnchorElement::origin):
(WebCore::HTMLAnchorElement::sendPings):
(WebCore::HTMLAnchorElement::handleClick):
* html/HTMLAnchorElement.h:
(WebCore::HTMLAnchorElement::visitedLinkHash):
* html/HTMLAppletElement.cpp:
(WebCore::HTMLAppletElement::updateWidget):
* html/HTMLAreaElement.cpp:
(WebCore::HTMLAreaElement::target):
* html/HTMLAttachmentElement.cpp:
(WebCore::HTMLAttachmentElement::attachmentTitle):
(WebCore::HTMLAttachmentElement::attachmentType):
* html/HTMLBaseElement.cpp:
(WebCore::HTMLBaseElement::target):
(WebCore::HTMLBaseElement::href):
* html/HTMLBodyElement.cpp:
(WebCore::HTMLBodyElement::addSubresourceAttributeURLs):
* html/HTMLButtonElement.cpp:
(WebCore::HTMLButtonElement::value):
(WebCore::HTMLButtonElement::computeWillValidate):
* html/HTMLCanvasElement.cpp:
(WebCore::HTMLCanvasElement::reset):
* html/HTMLDocument.cpp:
(WebCore::HTMLDocument::bgColor):
(WebCore::HTMLDocument::setBgColor):
(WebCore::HTMLDocument::fgColor):
(WebCore::HTMLDocument::setFgColor):
(WebCore::HTMLDocument::alinkColor):
(WebCore::HTMLDocument::setAlinkColor):
(WebCore::HTMLDocument::linkColor):
(WebCore::HTMLDocument::setLinkColor):
(WebCore::HTMLDocument::vlinkColor):
(WebCore::HTMLDocument::setVlinkColor):
* html/HTMLElement.cpp:
(WebCore::contentEditableType):
(WebCore::HTMLElement::collectStyleForPresentationAttribute):
(WebCore::HTMLElement::dir):
(WebCore::HTMLElement::setDir):
(WebCore::HTMLElement::draggable):
(WebCore::HTMLElement::setDraggable):
(WebCore::HTMLElement::title):
(WebCore::HTMLElement::tabIndex):
(WebCore::HTMLElement::translateAttributeMode):
(WebCore::HTMLElement::hasDirectionAuto):
(WebCore::HTMLElement::directionality):
* html/HTMLEmbedElement.cpp:
(WebCore::HTMLEmbedElement::imageSourceURL):
(WebCore::HTMLEmbedElement::addSubresourceAttributeURLs):
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::formEnctype):
(WebCore::HTMLFormControlElement::formMethod):
(WebCore::HTMLFormControlElement::formAction):
(WebCore::HTMLFormControlElement::autocorrect):
(WebCore::HTMLFormControlElement::autocapitalizeType):
* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::autocorrect):
(WebCore::HTMLFormElement::autocapitalizeType):
(WebCore::HTMLFormElement::autocapitalize):
(WebCore::HTMLFormElement::action):
(WebCore::HTMLFormElement::setAction):
(WebCore::HTMLFormElement::target):
(WebCore::HTMLFormElement::wasUserSubmitted):
(WebCore::HTMLFormElement::shouldAutocomplete):
(WebCore::HTMLFormElement::finishParsingChildren):
(WebCore::HTMLFormElement::autocomplete):
* html/HTMLFrameElementBase.cpp:
(WebCore::HTMLFrameElementBase::location):
(WebCore::HTMLFrameElementBase::setLocation):
* html/HTMLHtmlElement.cpp:
(WebCore::HTMLHtmlElement::insertedByParser):
* html/HTMLImageElement.cpp:
(WebCore::HTMLImageElement::imageSourceURL):
(WebCore::HTMLImageElement::setBestFitURLAndDPRFromImageCandidate):
(WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
(WebCore::HTMLImageElement::selectImageSource):
(WebCore::HTMLImageElement::altText):
(WebCore::HTMLImageElement::createElementRenderer):
(WebCore::HTMLImageElement::width):
(WebCore::HTMLImageElement::height):
(WebCore::HTMLImageElement::alt):
(WebCore::HTMLImageElement::draggable):
(WebCore::HTMLImageElement::setHeight):
(WebCore::HTMLImageElement::src):
(WebCore::HTMLImageElement::setSrc):
(WebCore::HTMLImageElement::addSubresourceAttributeURLs):
(WebCore::HTMLImageElement::didMoveToNewDocument):
(WebCore::HTMLImageElement::isServerMap):
(WebCore::HTMLImageElement::crossOrigin):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::updateType):
(WebCore::HTMLInputElement::initializeInputType):
(WebCore::HTMLInputElement::altText):
(WebCore::HTMLInputElement::value):
(WebCore::HTMLInputElement::defaultValue):
(WebCore::HTMLInputElement::setDefaultValue):
(WebCore::HTMLInputElement::acceptMIMETypes):
(WebCore::HTMLInputElement::acceptFileExtensions):
(WebCore::HTMLInputElement::accept):
(WebCore::HTMLInputElement::alt):
(WebCore::HTMLInputElement::effectiveMaxLength):
(WebCore::HTMLInputElement::src):
(WebCore::HTMLInputElement::setAutoFilled):
(WebCore::HTMLInputElement::dataList):
(WebCore::HTMLInputElement::resetListAttributeTargetObserver):
* html/HTMLKeygenElement.cpp:
(WebCore::HTMLKeygenElement::isKeytypeRSA):
(WebCore::HTMLKeygenElement::appendFormData):
* html/HTMLLIElement.cpp:
(WebCore::HTMLLIElement::didAttachRenderers):
(WebCore::HTMLLIElement::parseValue):
* html/HTMLLabelElement.cpp:
(WebCore::HTMLLabelElement::control):
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::crossOrigin):
(WebCore::HTMLLinkElement::process):
(WebCore::HTMLLinkElement::href):
(WebCore::HTMLLinkElement::rel):
(WebCore::HTMLLinkElement::target):
(WebCore::HTMLLinkElement::type):
(WebCore::HTMLLinkElement::iconType):
* html/HTMLMarqueeElement.cpp:
(WebCore::HTMLMarqueeElement::scrollAmount):
(WebCore::HTMLMarqueeElement::setScrollAmount):
(WebCore::HTMLMarqueeElement::scrollDelay):
(WebCore::HTMLMarqueeElement::setScrollDelay):
(WebCore::HTMLMarqueeElement::loop):
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::insertedInto):
(WebCore::HTMLMediaElement::crossOrigin):
(WebCore::HTMLMediaElement::networkState):
(WebCore::HTMLMediaElement::mediaSessionTitle):
(WebCore::HTMLMediaElement::doesHaveAttribute):
* html/HTMLMetaElement.cpp:
(WebCore::HTMLMetaElement::process):
(WebCore::HTMLMetaElement::content):
(WebCore::HTMLMetaElement::httpEquiv):
(WebCore::HTMLMetaElement::name):
* html/HTMLMeterElement.cpp:
(WebCore::HTMLMeterElement::min):
(WebCore::HTMLMeterElement::setMin):
(WebCore::HTMLMeterElement::max):
(WebCore::HTMLMeterElement::setMax):
(WebCore::HTMLMeterElement::value):
(WebCore::HTMLMeterElement::low):
(WebCore::HTMLMeterElement::high):
(WebCore::HTMLMeterElement::optimum):
* html/HTMLObjectElement.cpp:
(WebCore::HTMLObjectElement::shouldAllowQuickTimeClassIdQuirk):
(WebCore::HTMLObjectElement::hasValidClassId):
(WebCore::HTMLObjectElement::imageSourceURL):
(WebCore::HTMLObjectElement::renderFallbackContent):
(WebCore::HTMLObjectElement::containsJavaApplet):
(WebCore::HTMLObjectElement::addSubresourceAttributeURLs):
* html/HTMLOptGroupElement.cpp:
(WebCore::HTMLOptGroupElement::groupLabelText):
* html/HTMLOptionElement.cpp:
(WebCore::HTMLOptionElement::value):
(WebCore::HTMLOptionElement::label):
* html/HTMLParamElement.cpp:
(WebCore::HTMLParamElement::value):
(WebCore::HTMLParamElement::isURLParameter):
* html/HTMLProgressElement.cpp:
(WebCore::HTMLProgressElement::value):
(WebCore::HTMLProgressElement::max):
* html/HTMLScriptElement.cpp:
(WebCore::HTMLScriptElement::crossOrigin):
(WebCore::HTMLScriptElement::src):
(WebCore::HTMLScriptElement::sourceAttributeValue):
(WebCore::HTMLScriptElement::charsetAttributeValue):
(WebCore::HTMLScriptElement::typeAttributeValue):
(WebCore::HTMLScriptElement::languageAttributeValue):
(WebCore::HTMLScriptElement::forAttributeValue):
(WebCore::HTMLScriptElement::eventAttributeValue):
(WebCore::HTMLScriptElement::asyncAttributeValue):
* html/HTMLSlotElement.cpp:
(WebCore::HTMLSlotElement::insertedInto):
(WebCore::HTMLSlotElement::removedFrom):
* html/HTMLSourceElement.cpp:
(WebCore::HTMLSourceElement::media):
(WebCore::HTMLSourceElement::setMedia):
(WebCore::HTMLSourceElement::type):
(WebCore::HTMLSourceElement::setType):
* html/HTMLTableCellElement.cpp:
(WebCore::HTMLTableCellElement::colSpanForBindings):
(WebCore::HTMLTableCellElement::rowSpan):
(WebCore::HTMLTableCellElement::rowSpanForBindings):
(WebCore::HTMLTableCellElement::cellIndex):
(WebCore::HTMLTableCellElement::abbr):
(WebCore::HTMLTableCellElement::axis):
(WebCore::HTMLTableCellElement::setColSpanForBindings):
(WebCore::HTMLTableCellElement::headers):
(WebCore::HTMLTableCellElement::setRowSpanForBindings):
(WebCore::HTMLTableCellElement::scope):
(WebCore::HTMLTableCellElement::addSubresourceAttributeURLs):
(WebCore::HTMLTableCellElement::cellAbove):
* html/HTMLTableColElement.cpp:
(WebCore::HTMLTableColElement::width):
* html/HTMLTableElement.cpp:
(WebCore::HTMLTableElement::rules):
(WebCore::HTMLTableElement::summary):
(WebCore::HTMLTableElement::addSubresourceAttributeURLs):
* html/HTMLTableSectionElement.cpp:
(WebCore::HTMLTableSectionElement::align):
(WebCore::HTMLTableSectionElement::setAlign):
(WebCore::HTMLTableSectionElement::ch):
(WebCore::HTMLTableSectionElement::setCh):
(WebCore::HTMLTableSectionElement::chOff):
(WebCore::HTMLTableSectionElement::setChOff):
(WebCore::HTMLTableSectionElement::vAlign):
(WebCore::HTMLTableSectionElement::setVAlign):
* html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::appendFormData):
* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::strippedPlaceholder):
(WebCore::HTMLTextFormControlElement::isPlaceholderEmpty):
(WebCore::HTMLTextFormControlElement::directionForFormData):
* html/HTMLTrackElement.cpp:
(WebCore::HTMLTrackElement::srclang):
(WebCore::HTMLTrackElement::label):
(WebCore::HTMLTrackElement::isDefault):
(WebCore::HTMLTrackElement::ensureTrack):
(WebCore::HTMLTrackElement::mediaElementCrossOriginAttribute):
* html/HTMLVideoElement.cpp:
(WebCore::HTMLVideoElement::parseAttribute):
(WebCore::HTMLVideoElement::imageSourceURL):
* html/ImageInputType.cpp:
(WebCore::ImageInputType::height):
(WebCore::ImageInputType::width):
* html/InputType.cpp:
(WebCore::InputType::applyStep):
* html/MediaElementSession.cpp:
(WebCore::MediaElementSession::wirelessVideoPlaybackDisabled):
* html/MonthInputType.cpp:
(WebCore::MonthInputType::createStepRange):
* html/NumberInputType.cpp:
(WebCore::NumberInputType::createStepRange):
(WebCore::NumberInputType::sizeShouldIncludeDecoration):
* html/RangeInputType.cpp:
(WebCore::RangeInputType::createStepRange):
(WebCore::RangeInputType::handleKeydownEvent):
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::appendFormData):
(WebCore::TextFieldInputType::updateAutoFillButton):
* html/TimeInputType.cpp:
(WebCore::TimeInputType::createStepRange):
* html/ValidationMessage.cpp:
(WebCore::ValidationMessage::updateValidationMessage):
* html/WeekInputType.cpp:
(WebCore::WeekInputType::createStepRange):
* html/track/WebVTTElement.cpp:
(WebCore::WebVTTElement::createEquivalentHTMLElement):
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::buildObjectForFrame):
* loader/FormSubmission.cpp:
(WebCore::FormSubmission::create):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::defaultSubstituteDataForURL):
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::updateFromElement):
* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::isPluginContentAllowedByContentSecurityPolicy):
* mathml/MathMLElement.cpp:
(WebCore::MathMLElement::colSpan):
(WebCore::MathMLElement::rowSpan):
(WebCore::MathMLElement::childShouldCreateRenderer):
(WebCore::MathMLElement::defaultEventHandler):
(WebCore::MathMLElement::cachedMathMLLength):
* mathml/MathMLFractionElement.cpp:
(WebCore::MathMLFractionElement::lineThickness):
(WebCore::MathMLFractionElement::cachedFractionAlignment):
* mathml/MathMLSelectElement.cpp:
(WebCore::MathMLSelectElement::getSelectedActionChildAndIndex):
(WebCore::MathMLSelectElement::getSelectedActionChild):
(WebCore::MathMLSelectElement::getSelectedSemanticsChild):
(WebCore::MathMLSelectElement::defaultEventHandler):
(WebCore::MathMLSelectElement::willRespondToMouseClickEvents):
(WebCore::MathMLSelectElement::toggle):
* page/EventHandler.cpp:
(WebCore::findDropZone):
* page/Frame.cpp:
(WebCore::Frame::matchLabelsAgainstElement):
* page/PageSerializer.cpp:
(WebCore::PageSerializer::serializeFrame):
* platform/win/PasteboardWin.cpp:
(WebCore::Pasteboard::writeImageToDataObject):
* rendering/HitTestResult.cpp:
(WebCore::HitTestResult::altDisplayString):
* rendering/RenderDetailsMarker.cpp:
(WebCore::RenderDetailsMarker::isOpen):
* rendering/RenderImage.cpp:
(WebCore::RenderImage::imageMap):
(WebCore::RenderImage::nodeAtPoint):
* rendering/RenderMenuList.cpp:
(RenderMenuList::itemAccessibilityText):
(RenderMenuList::itemToolTip):
* rendering/RenderSearchField.cpp:
(WebCore::RenderSearchField::autosaveName):
* rendering/RenderThemeIOS.mm:
(WebCore::getAttachmentProgress):
(WebCore::AttachmentInfo::AttachmentInfo):
* rendering/RenderThemeMac.mm:
(WebCore::AttachmentLayout::layOutSubtitle):
(WebCore::RenderThemeMac::paintAttachment):
* rendering/mathml/MathMLStyle.cpp:
(WebCore::MathMLStyle::resolveMathMLStyle):
* rendering/mathml/RenderMathMLFenced.cpp:
(WebCore::RenderMathMLFenced::updateFromElement):
* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::setOperatorFlagFromAttribute):
(WebCore::RenderMathMLOperator::setOperatorFlagFromAttributeValue):
(WebCore::RenderMathMLOperator::setOperatorProperties):
* rendering/mathml/RenderMathMLScripts.cpp:
(WebCore::RenderMathMLScripts::getScriptMetricsAndLayoutIfNeeded):
* rendering/mathml/RenderMathMLUnderOver.cpp:
(WebCore::RenderMathMLUnderOver::hasAccent):
* style/StyleSharingResolver.cpp:
(WebCore::Style::SharingResolver::canShareStyleWithElement):
(WebCore::Style::SharingResolver::sharingCandidateHasIdenticalStyleAffectingAttributes):
* svg/SVGAElement.cpp:
(WebCore::SVGAElement::title):
(WebCore::SVGAElement::defaultEventHandler):
* svg/SVGAltGlyphElement.cpp:
(WebCore::SVGAltGlyphElement::glyphRef):
(WebCore::SVGAltGlyphElement::setFormat):
(WebCore::SVGAltGlyphElement::format):
(WebCore::SVGAltGlyphElement::childShouldCreateRenderer):
* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::toValue):
(WebCore::SVGAnimationElement::byValue):
(WebCore::SVGAnimationElement::fromValue):
(WebCore::SVGAnimationElement::isAdditive):
(WebCore::SVGAnimationElement::isAccumulated):
* svg/SVGElement.cpp:
(WebCore::SVGElement::xmlbase):
(WebCore::SVGElement::setXmlbase):
* svg/SVGFontFaceElement.cpp:
(WebCore::SVGFontFaceElement::unitsPerEm):
(WebCore::SVGFontFaceElement::xHeight):
(WebCore::SVGFontFaceElement::capHeight):
(WebCore::SVGFontFaceElement::horizontalOriginX):
(WebCore::SVGFontFaceElement::horizontalOriginY):
(WebCore::SVGFontFaceElement::horizontalAdvanceX):
(WebCore::SVGFontFaceElement::verticalOriginX):
(WebCore::SVGFontFaceElement::verticalOriginY):
(WebCore::SVGFontFaceElement::verticalAdvanceY):
(WebCore::SVGFontFaceElement::ascent):
(WebCore::SVGFontFaceElement::descent):
* svg/SVGFontFaceNameElement.cpp:
(WebCore::SVGFontFaceNameElement::srcValue):
* svg/SVGFontFaceUriElement.cpp:
(WebCore::SVGFontFaceUriElement::srcValue):
* svg/SVGGlyphRefElement.cpp:
(WebCore::SVGGlyphRefElement::glyphRef):
(WebCore::SVGGlyphRefElement::setGlyphRef):
* svg/SVGHKernElement.cpp:
(WebCore::SVGHKernElement::buildHorizontalKerningPair):
* svg/SVGSVGElement.cpp:
(WebCore::SVGSVGElement::contentScriptType):
(WebCore::SVGSVGElement::contentStyleType):
* svg/SVGStyleElement.cpp:
(WebCore::SVGStyleElement::media):
(WebCore::SVGStyleElement::title):
(WebCore::SVGStyleElement::setTitle):
* svg/SVGToOTFFontConversion.cpp:
(WebCore::SVGToOTFFontConverter::appendOS2Table):
(WebCore::SVGToOTFFontConverter::appendCFFTable):
(WebCore::SVGToOTFFontConverter::appendArabicReplacementSubtable):
(WebCore::SVGToOTFFontConverter::appendVORGTable):
(WebCore::SVGToOTFFontConverter::transcodeGlyphPaths):
(WebCore::SVGToOTFFontConverter::processGlyphElement):
(WebCore::SVGToOTFFontConverter::compareCodepointsLexicographically):
(WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter):
* svg/SVGVKernElement.cpp:
(WebCore::SVGVKernElement::buildVerticalKerningPair):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::insertedInto):
(WebCore::SVGSMILElement::parseAttribute):
(WebCore::SVGSMILElement::svgAttributeChanged):
(WebCore::SVGSMILElement::restart):
(WebCore::SVGSMILElement::fill):
(WebCore::SVGSMILElement::dur):
(WebCore::SVGSMILElement::repeatDur):
(WebCore::SVGSMILElement::repeatCount):
(WebCore::SVGSMILElement::maxValue):
(WebCore::SVGSMILElement::minValue):

Source/WebKit/mac:

* WebView/WebHTMLRepresentation.mm:
(matchLabelsAgainstElement):

Source/WebKit/win:

* DOMHTMLClasses.cpp:
(DOMHTMLElement::idName):

Source/WebKit2:

* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::getPositionInformation):
(WebKit::WebPage::performActionOnElement):
(WebKit::WebPage::getAssistedNodeInformation):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203324 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoASSERTION FAILED: isMainThread() in ~UniqueIDBDatabase() since r201997
commit-queue@webkit.org [Sat, 16 Jul 2016 11:33:52 +0000 (11:33 +0000)]
ASSERTION FAILED: isMainThread() in ~UniqueIDBDatabase() since r201997
https://bugs.webkit.org/show_bug.cgi?id=159809

Patch by Carlos Garcia Campos <cgarcia@igalia.com> on 2016-07-16
Reviewed by Brady Eidson.

In r201997 the UniqueIDBDatabase was protected in executeNextDatabaseTask() because the last reference could be
removed while the task is performed. However UniqueIDBDatabase is expected to be deleted in the main thread, and
the destructor asserts when not called in the main thread, but executeNextDatabaseTask() is always called on a
secondary thread. So, if the protector contains the last reference, the object is deleted in the secondary thread.

* Modules/indexeddb/server/UniqueIDBDatabase.cpp:
(WebCore::IDBServer::UniqueIDBDatabase::executeNextDatabaseTask): Use callOnMainThread to ensure the object is
deleted in the main thread in case the protector contains the last reference.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203323 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUse emptyString() / nullAtom when possible
cdumez@apple.com [Sat, 16 Jul 2016 04:51:45 +0000 (04:51 +0000)]
Use emptyString() / nullAtom when possible
https://bugs.webkit.org/show_bug.cgi?id=159850

Reviewed by Ryosuke Niwa.

Use emptyString() / nullAtom when possible, for performance.

Source/WebCore:

* Modules/webaudio/AudioNode.cpp:
(WebCore::AudioNode::channelCountMode):
(WebCore::AudioNode::channelInterpretation):
* Modules/webdatabase/DatabaseTracker.cpp:
(WebCore::DatabaseTracker::tracker):
* Modules/websockets/WebSocket.cpp:
(WebCore::WebSocket::WebSocket):
(WebCore::WebSocket::didConnect):
* Modules/websockets/WebSocketChannel.cpp:
(WebCore::WebSocketChannel::subprotocol):
(WebCore::WebSocketChannel::extensions):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::supportsPressAction):
* accessibility/mac/AXObjectCacheMac.mm:
(WebCore::AXObjectCache::postTextStateChangePlatformNotification):
* css/CSSPropertySourceData.cpp:
(WebCore::CSSPropertySourceData::CSSPropertySourceData):
* css/PageRuleCollector.cpp:
(WebCore::PageRuleCollector::pageName):
* css/PropertySetCSSStyleDeclaration.cpp:
(WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
* dom/DocumentMarkerController.cpp:
(WebCore::DocumentMarkerController::addDictationPhraseWithAlternativesMarker):
* dom/Element.cpp:
(WebCore::Element::setPrefix):
* editing/AlternativeTextController.cpp:
(WebCore::AlternativeTextController::respondToMarkerAtEndOfWord):
(WebCore::AlternativeTextController::markerDescriptionForAppliedAlternativeText):
* editing/CompositeEditCommand.cpp:
(WebCore::CompositeEditCommand::removeNodeAttribute):
(WebCore::CompositeEditCommand::moveParagraphs):
* editing/InsertTextCommand.cpp:
(WebCore::InsertTextCommand::positionInsideTextNode):
* editing/TextCheckingHelper.cpp:
(WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
* editing/TypingCommand.cpp:
(WebCore::TypingCommand::deleteSelection):
(WebCore::TypingCommand::deleteKeyPressed):
(WebCore::TypingCommand::forwardDeleteKeyPressed):
(WebCore::TypingCommand::insertLineBreak):
(WebCore::TypingCommand::insertParagraphSeparator):
* editing/cocoa/EditorCocoa.mm:
(WebCore::Editor::styleForSelectionStart):
* editing/mac/EditorMac.mm:
(WebCore::Editor::stringSelectionForPasteboard):
(WebCore::Editor::stringSelectionForPasteboardWithImageAltText):
* fileapi/FileReaderLoader.cpp:
(WebCore::FileReaderLoader::FileReaderLoader):
* html/FileInputType.cpp:
(WebCore::FileInputType::appendFormData):
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::getCurrentMediaControlsStatus):
* html/HTMLOutputElement.cpp:
(WebCore::HTMLOutputElement::HTMLOutputElement):
* html/SearchInputType.cpp:
(WebCore::SearchInputType::handleKeydownEvent):
* html/TextFieldInputType.cpp:
(WebCore::autoFillButtonTypeToAccessibilityLabel):
* html/canvas/WebGLDebugShaders.cpp:
(WebCore::WebGLDebugShaders::getTranslatedShaderSource):
* html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::dispatchContextLostEvent):
(WebCore::WebGLRenderingContextBase::maybeRestoreContext):
* html/canvas/WebGLShader.cpp:
(WebCore::WebGLShader::WebGLShader):
* html/shadow/MediaControlElements.cpp:
(WebCore::MediaControlStatusDisplayElement::update):
* html/track/TextTrack.cpp:
(WebCore::TextTrack::captionMenuOffItem):
(WebCore::TextTrack::captionMenuAutomaticItem):
* html/track/VTTRegion.cpp:
(WebCore::VTTRegion::scroll):
* html/track/VTTRegion.h:
* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::toErrorString):
(WebCore::InspectorDOMAgent::resolveNode):
(WebCore::InspectorDOMAgent::documentURLString):
(WebCore::documentBaseURLString):
* inspector/InspectorDOMDebuggerAgent.cpp:
(WebCore::domTypeName):
* inspector/InspectorFrontendHost.cpp:
(WebCore::InspectorFrontendHost::localizedStringsURL):
* inspector/InspectorHistory.cpp:
(WebCore::InspectorHistory::Action::mergeId):
* inspector/InspectorPageAgent.cpp:
(WebCore::InspectorPageAgent::reload):
(WebCore::InspectorPageAgent::frameId):
(WebCore::InspectorPageAgent::loaderId):
* inspector/InspectorStyleSheet.cpp:
(WebCore::InspectorStyleSheet::ruleSelector):
* loader/EmptyClients.h:
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::referrer):
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::clearFailedLoadURL):
* loader/ResourceLoader.cpp:
(WebCore::ResourceLoader::didReceiveResponse):
* page/ContextMenuController.cpp:
(WebCore::ContextMenuController::contextMenuItemSelected):
* page/FrameTree.cpp:
(WebCore::FrameTree::setName):
(WebCore::FrameTree::clearName):
* page/Location.cpp:
(WebCore::Location::port):
* platform/network/ProtectionSpaceBase.cpp:
(WebCore::ProtectionSpaceBase::ProtectionSpaceBase):
* xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::handleElementAttributes):

Source/WTF:

* wtf/text/AtomicString.cpp:
(WTF::AtomicString::convertASCIICase):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203322 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[mac] LayoutTest fast/css/ancestor-of-hovered-element-detached.html is flaky
benjamin@webkit.org [Sat, 16 Jul 2016 04:17:21 +0000 (04:17 +0000)]
[mac] LayoutTest fast/css/ancestor-of-hovered-element-detached.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=159173

Reviewed by Alexey Proskuryakov.

The test ancestor-of-hovered-element-detached.html is not reliably
covering r202324.

In the case of that test, the first style update is done with
the flag TeardownType::KeepHoverAndActive. This keeps the ":hover" state
set despite the subtree losing their renderer.
This looks like a serious issue that should be tested separately.

* fast/css/ancestor-of-hovered-element-removed.html:
The :hover update timer is actually a zero timer.
It is reasonable to expect a full update after one frame update.

* fast/css/ancestor-of-hovered-element-detached-expected.txt: Removed.
* fast/css/ancestor-of-hovered-element-detached.html: Removed.
* platform/ios-simulator/TestExpectations:
* platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203321 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[JSC] Convert the remaining createOutOfMemoryError()+throwException() into throwOutOf...
commit-queue@webkit.org [Sat, 16 Jul 2016 04:16:30 +0000 (04:16 +0000)]
[JSC] Convert the remaining createOutOfMemoryError()+throwException() into throwOutOfMemoryError()
https://bugs.webkit.org/show_bug.cgi?id=159665

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-07-15
Reviewed by Saam Barati.

* API/JSTypedArray.cpp:
(createTypedArray):
* runtime/Error.cpp:
(JSC::createOutOfMemoryError):
* runtime/Error.h:
* runtime/ExceptionHelpers.cpp:
(JSC::throwOutOfMemoryError):
* runtime/JSArrayBufferConstructor.cpp:
(JSC::constructArrayBuffer):
* runtime/JSArrayBufferPrototype.cpp:
(JSC::arrayBufferProtoFuncSlice):
* runtime/JSGenericTypedArrayViewInlines.h:
(JSC::JSGenericTypedArrayView<Adaptor>::create):
(JSC::JSGenericTypedArrayView<Adaptor>::createUninitialized):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203320 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoTest gardening after r203314
mmaxfield@apple.com [Sat, 16 Jul 2016 02:50:12 +0000 (02:50 +0000)]
Test gardening after r203314
https://bugs.webkit.org/show_bug.cgi?id=159842

Unreviewed.

* TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203319 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[JSC] Change some parameters based on a random search
commit-queue@webkit.org [Sat, 16 Jul 2016 02:12:31 +0000 (02:12 +0000)]
[JSC] Change some parameters based on a random search
https://bugs.webkit.org/show_bug.cgi?id=158514

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-07-15
Reviewed by Saam Barati.

Source/JavaScriptCore:

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::optimizationThresholdScalingFactor):
* runtime/Options.h:

Tools:

* Scripts/run-jsc-stress-tests:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203318 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoRepaints rects drawn incorrectly when inspecting a WebView on a Retina display
simon.fraser@apple.com [Sat, 16 Jul 2016 01:43:53 +0000 (01:43 +0000)]
Repaints rects drawn incorrectly when inspecting a WebView on a Retina display
https://bugs.webkit.org/show_bug.cgi?id=159824
rdar://problem/27376305

Reviewed by Brian Burg.

InspectorOverlayPage.js set up the canvases with a deviceScaleFactor passed into
reset(), which comes from the overlay's m_page.deviceScaleFactor(). However, updatePaintRects()
used window.devicePixelRatio which was always 1.

Fix by setting the deviceScaleFactor on the m_overlayPage.

* inspector/InspectorOverlay.cpp:
(WebCore::InspectorOverlay::overlayPage):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203317 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoWeb Automation: Fix element and event coord space issues
timothy@apple.com [Sat, 16 Jul 2016 01:19:21 +0000 (01:19 +0000)]
Web Automation: Fix element and event coord space issues
https://bugs.webkit.org/show_bug.cgi?id=159851
rdar://problem/27375780

Reviewed by Brian Burg.

* UIProcess/Automation/WebAutomationSession.cpp:
(WebKit::WebAutomationSession::performMouseInteraction): Subtract topContentInset() before
it goes back out to WebDriver.
* WebProcess/Automation/WebAutomationSessionProxy.cpp:
(WebKit::WebAutomationSessionProxy::computeElementLayout): When using useViewportCoordinates,
subtract topContentInset() so it matches expectations.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203316 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoAssertion failures and crashes with missing TDZ checks for catch-node bindings.
mark.lam@apple.com [Sat, 16 Jul 2016 01:14:57 +0000 (01:14 +0000)]
Assertion failures and crashes with missing TDZ checks for catch-node bindings.
https://bugs.webkit.org/show_bug.cgi?id=158797

Reviewed by Saam Barati.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitPushCatchScope):
(JSC::BytecodeGenerator::emitPopCatchScope):
* tests/stress/catch-clause-should-be-under-tdz1.js: Added.
* tests/stress/catch-clause-should-be-under-tdz2.js: Added.
* tests/stress/catch-clause-should-be-under-tdz3.js: Added.
* tests/stress/catch-clause-should-be-under-tdz4.js: Added.
* tests/stress/catch-clause-should-be-under-tdz5.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203315 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years ago[macOS] Work around crash in [NSAttributedString nextWordFromIndex:forward:]
mmaxfield@apple.com [Sat, 16 Jul 2016 00:55:12 +0000 (00:55 +0000)]
[macOS] Work around crash in [NSAttributedString nextWordFromIndex:forward:]
https://bugs.webkit.org/show_bug.cgi?id=159842

Reviewed by Jon Lee.

Source/WebCore:

<rdar://problem/27380532> describes a crash inside [NSAttributedString nextWordFromIndex:forward:].
This must be worked around for https://bugs.webkit.org/show_bug.cgi?id=159755 and
<rdar://problem/27325521>.

* platform/text/mac/TextBoundaries.mm:
(WebCore::findNextWordFromIndex):

LayoutTests:

* editing/deleting/delete-emoji-expected.txt:
* editing/deleting/delete-emoji.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203314 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoUpdate XPathException to use the description in toString().
beidson@apple.com [Sat, 16 Jul 2016 00:46:23 +0000 (00:46 +0000)]
Update XPathException to use the description in toString().
https://bugs.webkit.org/show_bug.cgi?id=159848

Reviewed by Alex Christensen.

Source/WebCore:

No new tests (Covered by changes to existing tests).

* bindings/js/JSDOMBinding.cpp:
(WebCore::createDOMException):
* xml/XPathException.h:
(WebCore::XPathException::XPathException):

LayoutTests:

* fast/dom/DOMException/XPathException-expected.txt:
* fast/dom/DOMException/resources/XPathException.js:
* fast/xpath/4XPath/Core/test_parser-expected.txt:
* fast/xpath/invalid-functions-expected.txt:
* fast/xpath/py-dom-xpath/expressions-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203313 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoMac UI process needs to know about element focus and blur, much like iOS
bdakin@apple.com [Sat, 16 Jul 2016 00:39:50 +0000 (00:39 +0000)]
Mac UI process needs to know about element focus and blur, much like iOS
https://bugs.webkit.org/show_bug.cgi?id=159843
-and corresponding-
rdar://problem/27229504

Reviewed by Tim Horton.

This patch makes the existing iOS machinery to handle focus and blurring of
elements cross-platform. Instead of using the existing iOS messages for
startAssistingNode/stopAssistingNode, this patch adds a new message that
require only a boolean parameter: setEditableElementIsFocused.

Now that more of this code is shared, this patch teases
m_hasFocusedDueToUserInteraction out into two variables. I realized that it
was being used to mean two slightly different things on Mac and iOS, which
was very confusing. Now we have m_isAssistingNodeDueToUserInteraction to
represent the way iOS was using the variable, and we have
m_hasEverFocusedElementDueToUserInteractionSincePageTransition to represent
how Mac was using the variable. There should not be any behavior changes with
this re-name, just added clarity.

WebViewImpl has a new member variable m_editableElementIsFocused.
* UIProcess/Cocoa/WebViewImpl.h:
* UIProcess/Cocoa/WebViewImpl.mm:
(WebKit::WebViewImpl::setEditableElementIsFocused):

Pipe the new setEditableElementIsFocused message to WebViewImpl.
* UIProcess/PageClient.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setEditableElementIsFocused):
* UIProcess/WebPageProxy.h:
* UIProcess/WebPageProxy.messages.in:
* UIProcess/mac/PageClientImpl.h:
* UIProcess/mac/PageClientImpl.mm:
(WebKit::PageClientImpl::setEditableElementIsFocused):

elementDidFocus() and elementDidBlur() are now PLATFORM(COCOA) instead of
PLATFORM(IOS)
* WebProcess/WebCoreSupport/WebChromeClient.cpp:
(WebKit::WebChromeClient::elementDidFocus):
(WebKit::WebChromeClient::elementDidBlur):
* WebProcess/WebCoreSupport/WebChromeClient.h:
* WebProcess/WebCoreSupport/ios/WebChromeClientIOS.mm:
(WebKit::WebChromeClient::elementDidFocus): Deleted.
(WebKit::WebChromeClient::elementDidBlur): Deleted.

m_hasPendingBlurNotification is no longer iOS-only.
* WebProcess/WebPage/WebPage.cpp:

Use our two new bools m_isAssistingNodeDueToUserInteraction and
m_hasEverFocusedElementDueToUserInteractionSincePageTransition
(WebKit::WebPage::didStartPageTransition):
(WebKit::WebPage::didChangeSelection):

These functions are all newly cross-platform. The Messages they send are
still platform-specific, but otherwise the logic is the same. We
dispatch_async the blur messages so that the UI process features won’t be
flashy when the user is tapping, tabbing, or clicking through form fields.
(WebKit::WebPage::resetAssistedNodeForFrame):
(WebKit::WebPage::elementDidFocus):
(WebKit::WebPage::elementDidBlur):

resetAssistedNodeForFrame() is no longer iOS-only.
(WebKit::WebPage::didCommitLoad):

Move variables and functions around so that they are defined for the right
platform, and declare the two new bools in place of the old one.
* WebProcess/WebPage/WebPage.h:

These functions are now defined in WebPage.cpp
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::resetAssistedNodeForFrame): Deleted.
(WebKit::WebPage::elementDidFocus): Deleted.
(WebKit::WebPage::elementDidBlur): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203312 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 years agoRevert double ChangeLog entries
beidson@apple.com [Sat, 16 Jul 2016 00:09:06 +0000 (00:09 +0000)]
Revert double ChangeLog entries

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@203311 268f45cc-cd09-0410-ab3c-d52691b4dbfc