WebKit-https.git
4 months ago[JSC] makeBoundFunction should not assume incoming "length" value is Int32 because...
ysuzuki@apple.com [Fri, 5 Apr 2019 04:17:44 +0000 (04:17 +0000)]
[JSC] makeBoundFunction should not assume incoming "length" value is Int32 because it performs some calculation in bytecode
https://bugs.webkit.org/show_bug.cgi?id=196631

Reviewed by Saam Barati.

JSTests:

* stress/make-bound-function-should-not-assume-int32-length.js: Added.
(assert):
(test):
(foo):

Source/JavaScriptCore:

makeBoundFunction assumes that "length" argument is always Int32. But this should not be done since this "length" value is calculated in builtin JS code.
DFG may store this value in Double format so that we should not rely on that this value is Int32. This patch fixes makeBoundFunction function to perform
toInt32 operation. We also insert a missing exception check for `JSString::value(ExecState*)` in makeBoundFunction.

* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* interpreter/CallFrameInlines.h:
* runtime/DoublePredictionFuzzerAgent.cpp: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
(JSC::DoublePredictionFuzzerAgent::DoublePredictionFuzzerAgent):
(JSC::DoublePredictionFuzzerAgent::getPrediction):
* runtime/DoublePredictionFuzzerAgent.h: Copied from Source/JavaScriptCore/interpreter/CallFrameInlines.h.
* runtime/JSGlobalObject.cpp:
(JSC::makeBoundFunction):
* runtime/Options.h:
* runtime/VM.cpp:
(JSC::VM::VM):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243925 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, speculative fix for build failure
ysuzuki@apple.com [Fri, 5 Apr 2019 01:45:12 +0000 (01:45 +0000)]
Unreviewed, speculative fix for build failure
https://bugs.webkit.org/show_bug.cgi?id=196475

* Modules/webgpu/WHLSL/Metal/WHLSLNativeFunctionWriter.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243924 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoElement::isFocusable() debug asserts too frequently
rniwa@webkit.org [Fri, 5 Apr 2019 01:09:44 +0000 (01:09 +0000)]
Element::isFocusable() debug asserts too frequently
https://bugs.webkit.org/show_bug.cgi?id=196634

Reviewed by Geoffrey Garen.

Remove the debug assertion for now.

* dom/Element.cpp:
(WebCore::Element::isFocusable const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243923 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUse a correct LC_RPATH when building with ASan
ap@apple.com [Fri, 5 Apr 2019 00:49:40 +0000 (00:49 +0000)]
Use a correct LC_RPATH when building with ASan
https://bugs.webkit.org/show_bug.cgi?id=196576

Reviewed by David Kilzer.

* asan/asan.xcconfig: As a temporary hack, just force LC_RPATH on all binaries,
so that ../Frameworks is checked. This is simpler and more reliable than updating
each SPC service xcconfig.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243922 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoAdd another status-bubble iframe to display results from new EWS
aakash_jain@apple.com [Fri, 5 Apr 2019 00:31:41 +0000 (00:31 +0000)]
Add another status-bubble iframe to display results from new EWS
https://bugs.webkit.org/show_bug.cgi?id=196308

Reviewed by Lucas Forschler.

* js/status-bubble.js:
(handleStatusBubbleMessage): Added URL for new EWS.
(handleStatusBubbleLoadNewEWS): Method to post message to new EWS.
* code-review.js: Added another iframe to display results from new EWS.
* template/en/default/attachment/edit.html.tmpl: Ditto.
* template/en/default/attachment/list.html.tmpl: Ditto.
* template/en/default/attachment/reviewform.html.tmpl: Ditto.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243921 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed. Make the test from r243906 catch the thrown exceptions.
sbarati@apple.com [Fri, 5 Apr 2019 00:28:21 +0000 (00:28 +0000)]
Unreviewed. Make the test from r243906 catch the thrown exceptions.

* stress/inferred-types-regex-matches-array.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243920 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoHave ScrollableArea store a ScrollType for the current scroll
simon.fraser@apple.com [Fri, 5 Apr 2019 00:11:08 +0000 (00:11 +0000)]
Have ScrollableArea store a ScrollType for the current scroll
https://bugs.webkit.org/show_bug.cgi?id=196627

Reviewed by Zalan Bujtas.

Source/WebCore:

RenderLayer had isInUserScroll() which is the opposite of ScrollableArea::inProgrammaticScroll(),
so just have ScrollableArea store a ScrollType.

RenderLayer's scrolling bottleneck, scrollToOffset(), now takes a ScrollType, and pushes
it onto the base class.

AsyncScrollingCoordinator::requestScrollPositionUpdate() can use the incoming scrollType (currently
incorrect for iOS WK2 overflow) rather than deducing a user scroll from ScrollingLayerPositionAction.

No behavior change.

* page/FrameView.cpp:
(WebCore::FrameView::setFrameRect):
(WebCore::FrameView::topContentInsetDidChange):
(WebCore::FrameView::updateLayoutViewport):
(WebCore::FrameView::setScrollPosition):
(WebCore::FrameView::shouldUpdateCompositingLayersAfterScrolling const):
(WebCore::FrameView::setWasScrolledByUser):
* page/FrameViewLayoutContext.cpp:
(WebCore::LayoutScope::LayoutScope):
(WebCore::LayoutScope::~LayoutScope):
* page/ios/FrameIOS.mm:
(WebCore::Frame::overflowScrollPositionChangedForNode):
* page/scrolling/AsyncScrollingCoordinator.cpp:
(WebCore::AsyncScrollingCoordinator::requestScrollPositionUpdate):
(WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
(WebCore::AsyncScrollingCoordinator::reconcileScrollingState):
* platform/ScrollView.cpp:
(WebCore::ScrollView::setScrollPosition):
* platform/ScrollableArea.cpp:
(WebCore::ScrollableArea::ScrollableArea):
* platform/ScrollableArea.h:
(WebCore::ScrollableArea::currentScrollType const):
(WebCore::ScrollableArea::setCurrentScrollType):
(WebCore::ScrollableArea::setIsUserScroll): Deleted.
(WebCore::ScrollableArea::inProgrammaticScroll const): Deleted.
(WebCore::ScrollableArea::setInProgrammaticScroll): Deleted.
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::RenderLayer):
(WebCore::RenderLayer::scrollToXPosition):
(WebCore::RenderLayer::scrollToYPosition):
(WebCore::RenderLayer::scrollToOffset):
(WebCore::RenderLayer::scrollTo):
* rendering/RenderLayer.h:
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateScrollOffset):
* rendering/RenderMarquee.cpp:
(WebCore::RenderMarquee::start):

Source/WebKitLegacy/mac:

Send the programmatic scroll type.

* DOM/DOMHTML.mm:
(-[DOMHTMLElement setScrollXOffset:scrollYOffset:adjustForIOSCaret:]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243919 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoB3ReduceStrength should know that Mul distributes over Add and Sub
rmorisset@apple.com [Fri, 5 Apr 2019 00:08:31 +0000 (00:08 +0000)]
B3ReduceStrength should know that Mul distributes over Add and Sub
https://bugs.webkit.org/show_bug.cgi?id=196325
<rdar://problem/49441650>

Reviewed by Saam Barati.

Fix some obviously wrong code that was due to an accidental copy-paste.
It made the entire optimization dead code that never ran.

* b3/B3ReduceStrength.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243918 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, rolling out r243868.
sroberts@apple.com [Thu, 4 Apr 2019 23:14:50 +0000 (23:14 +0000)]
Unreviewed, rolling out r243868.

Causing timeouts failures on several queues

Reverted changeset:

"[Web Animations] JS wrapper may be deleted while animation is
yet to dispatch its finish event"
https://bugs.webkit.org/show_bug.cgi?id=196118
https://trac.webkit.org/changeset/243868

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243917 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, rolling out r243888.
ryanhaddad@apple.com [Thu, 4 Apr 2019 22:51:24 +0000 (22:51 +0000)]
Unreviewed, rolling out r243888.

Introduced layout test crashes.

Reverted changeset:

"[macOS][iOS] Add filter to syscall sandbox rule"
https://bugs.webkit.org/show_bug.cgi?id=196613
https://trac.webkit.org/changeset/243888

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243916 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoDisable Flaky API Test TestWebKitAPI.WebKit.FocusTextInputContext
aakash_jain@apple.com [Thu, 4 Apr 2019 22:47:15 +0000 (22:47 +0000)]
Disable Flaky API Test TestWebKitAPI.WebKit.FocusTextInputContext
https://bugs.webkit.org/show_bug.cgi?id=196629

Reviewed by Lucas Forschler.

* TestWebKitAPI/Tests/WebKitCocoa/RequestTextInputContext.mm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243915 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ews-app] while waiting in queue status-bubble for testers queues should display...
aakash_jain@apple.com [Thu, 4 Apr 2019 22:44:38 +0000 (22:44 +0000)]
[ews-app] while waiting in queue status-bubble for testers queues should display build information from builder queue
https://bugs.webkit.org/show_bug.cgi?id=196618

Reviewed by Lucas Forschler.

* BuildSlaveSupport/ews-app/ews/views/statusbubble.py:
(StatusBubble): Added QUEUE_TRIGGERS.
(StatusBubble._build_bubble): Get the build from builder if tester has not started the build yet.
(StatusBubble._get_parent_queue): Get the name of the parent (builder) queue.
(StatusBubble.get_latest_build_for_queue): If the queue doesn't have any build yet, return build information from
its parent(builder).

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243914 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ews-app] Status-bubble steps are sometimes displayed in reverse order
aakash_jain@apple.com [Thu, 4 Apr 2019 22:42:43 +0000 (22:42 +0000)]
[ews-app] Status-bubble steps are sometimes displayed in reverse order
https://bugs.webkit.org/show_bug.cgi?id=196625

Reviewed by Lucas Forschler.

* BuildSlaveSupport/ews-app/ews/views/statusbubble.py:
(StatusBubble._steps_messages): Explicitly specify order_by('uid').

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243913 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoDisable Flaky API Test TestWebKitAPI.KeyboardInputTests.KeyboardTypeForInput
aakash_jain@apple.com [Thu, 4 Apr 2019 22:11:46 +0000 (22:11 +0000)]
Disable Flaky API Test TestWebKitAPI.KeyboardInputTests.KeyboardTypeForInput
https://bugs.webkit.org/show_bug.cgi?id=196630

Reviewed by Wenson Hsieh.

* TestWebKitAPI/Tests/ios/KeyboardInputTestsIOS.mm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243912 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoPass storage quota parameters from UIProcess to NetworkProcess as part of WebsiteData...
youenn@apple.com [Thu, 4 Apr 2019 22:07:09 +0000 (22:07 +0000)]
Pass storage quota parameters from UIProcess to NetworkProcess as part of WebsiteDataStore parameters
https://bugs.webkit.org/show_bug.cgi?id=196543

Reviewed by Alex Christensen.

Source/WebCore:

Add a default routine to compute a third party quota from a per origin quota.
No change of behavior.

* storage/StorageQuotaManager.h:
(WebCore::StorageQuotaManager::defaultThirdPartyQuotaFromPerOriginQuota):
(WebCore::StorageQuotaManager::defaultThirdPartyQuota):

Source/WebKit:

Renamed methods used to set cache storage quota to be storage generic
since they will apply to all storage.

Pass quota parameters as part of WebsiteDataStoreParameters from UIProcess
to NetworkProcess (start-up time and new WebsiteDataStore time).

Compute on UIProcess the quota for third party origins using the default rule of dividing by 10.

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::initializeNetworkProcess):
(WebKit::NetworkProcess::addWebsiteDataStore):
(WebKit::NetworkProcess::initializeStorageQuota):
(WebKit::NetworkProcess::setCacheStorageParameters):
* NetworkProcess/NetworkProcess.h:
* NetworkProcess/NetworkProcess.messages.in:
* Shared/WebsiteDataStoreParameters.cpp:
(WebKit::WebsiteDataStoreParameters::encode const):
(WebKit::WebsiteDataStoreParameters::decode):
* Shared/WebsiteDataStoreParameters.h:
* UIProcess/API/C/WKWebsiteDataStoreRef.cpp:
(WKWebsiteDataStoreSetPerOriginStorageQuota):
(WKWebsiteDataStoreSetCacheStoragePerOriginQuota): Deleted.
* UIProcess/API/C/WKWebsiteDataStoreRef.h:
* UIProcess/API/Cocoa/WKWebsiteDataStore.mm:
(-[WKWebsiteDataStore _perOriginStorageQuota]):
(-[WKWebsiteDataStore _setPerOriginStorageQuota:]):
(-[WKWebsiteDataStore _cacheStoragePerOriginQuota]): Deleted.
(-[WKWebsiteDataStore _setCacheStoragePerOriginQuota:]): Deleted.
* UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::retrieveCacheStorageParameters):
* UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::parameters):
* UIProcess/WebsiteData/WebsiteDataStore.h:
(WebKit::WebsiteDataStore::perOriginStorageQuota const):
(WebKit::WebsiteDataStore::setPerOriginStorageQuota):
(WebKit::WebsiteDataStore::cacheStoragePerOriginQuota const): Deleted.
(WebKit::WebsiteDataStore::setCacheStoragePerOriginQuota): Deleted.
* UIProcess/WebsiteData/WebsiteDataStoreConfiguration.cpp:
(WebKit::WebsiteDataStoreConfiguration::copy):
* UIProcess/WebsiteData/WebsiteDataStoreConfiguration.h:
(WebKit::WebsiteDataStoreConfiguration::perOriginStorageQuota):
(WebKit::WebsiteDataStoreConfiguration::setPerOriginStorageQuota):
(WebKit::WebsiteDataStoreConfiguration::cacheStoragePerOriginQuota): Deleted.
(WebKit::WebsiteDataStoreConfiguration::setCacheStoragePerOriginQuota): Deleted.

Tools:

* WebKitTestRunner/TestController.cpp:
(WTR::TestController::generatePageConfiguration):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243911 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, rolling out r243807 and r243824.
commit-queue@webkit.org [Thu, 4 Apr 2019 21:59:02 +0000 (21:59 +0000)]
Unreviewed, rolling out r243807 and r243824.
https://bugs.webkit.org/show_bug.cgi?id=196611

Test added is a flaky timeout on iOS Simulator, 3 tests
unskipped are flaky failures (Requested by ShawnRoberts on
#webkit).

Reverted changesets:

"Blob type cannot be stored correctly in IDB when
IDBObjectStore has autoIncrement and keyPath options"
https://bugs.webkit.org/show_bug.cgi?id=196128
https://trac.webkit.org/changeset/243807

"Follow up fix for r243807: Use MarkedArgumentBuffer instead
of Vector for JSValue"
https://bugs.webkit.org/show_bug.cgi?id=196547
https://trac.webkit.org/changeset/243824

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243910 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoChanging default website policies shouldn't change default website policies in subseq...
wenson_hsieh@apple.com [Thu, 4 Apr 2019 21:56:38 +0000 (21:56 +0000)]
Changing default website policies shouldn't change default website policies in subsequent navigations
https://bugs.webkit.org/show_bug.cgi?id=196562
<rdar://problem/49573377>

Reviewed by Tim Horton.

Currently, changing the default WKWebpagePreferences object when deciding navigation policy causes the set of
default policies to change in subsequent navigations. Among other things, this prevents clients from passing
a modified version of the default website policies into the decision handler without impacting future
navigations. To fix this, teach API::WebsitePolicies to make a copy of itself, and then use this to pass a copy
of the default website policies to the navigation delegate when deciding navigation policies.

Test: DoNotAllowChangingDefaultWebpagePreferencesInDelegateMethod

* UIProcess/API/APIWebsitePolicies.cpp:
(API::WebsitePolicies::copy const):

Add a helper method to copy a set of website policies.

* UIProcess/API/APIWebsitePolicies.h:
* UIProcess/Cocoa/NavigationState.mm:
(WebKit::NavigationState::NavigationClient::decidePolicyForNavigationAction):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243909 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoFix rare crash under collectRelatedCoordinatedScrollingNodes()
simon.fraser@apple.com [Thu, 4 Apr 2019 21:47:29 +0000 (21:47 +0000)]
Fix rare crash under collectRelatedCoordinatedScrollingNodes()
https://bugs.webkit.org/show_bug.cgi?id=196610
rdar://problem/49595426

Reviewed by Zalan Bujtas.

hasCompositedScrollableOverflow() doesn't check whether a layer is composited (it has
to report the right status before layers have been created), so collectRelatedCoordinatedScrollingNodes()
needs to check whether there's backing.

* rendering/RenderLayerCompositor.cpp:
(WebCore::collectRelatedCoordinatedScrollingNodes):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243908 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, build fix for CLoop after r243886
sbarati@apple.com [Thu, 4 Apr 2019 21:39:16 +0000 (21:39 +0000)]
Unreviewed, build fix for CLoop after r243886

* interpreter/Interpreter.cpp:
(JSC::UnwindFunctor::copyCalleeSavesToEntryFrameCalleeSavesBuffer const):
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::Frame::calleeSaveRegistersForUnwinding):
* interpreter/StackVisitor.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243907 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agocreateRegExpMatchesArray does not respect inferred types
sbarati@apple.com [Thu, 4 Apr 2019 21:13:26 +0000 (21:13 +0000)]
createRegExpMatchesArray does not respect inferred types
https://bugs.webkit.org/show_bug.cgi?id=193287

Reviewed by Yusuke Suzuki.

This checks in the test case for 193287. This issue was discovered by
Samuel Groß of Google Project Zero.

* stress/inferred-types-regex-matches-array.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243906 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoMove "inProgrammaticScroll" down to ScrollableArea
simon.fraser@apple.com [Thu, 4 Apr 2019 21:10:29 +0000 (21:10 +0000)]
Move "inProgrammaticScroll" down to ScrollableArea
https://bugs.webkit.org/show_bug.cgi?id=196614

Reviewed by Zalan Bujtas.

A future patch will need to update "inProgrammaticScroll" on RenderLayers, so push
inProgrammaticScroll() down to ScrollableArea.

ScrollableArea already has "isScrolledProgrammatically", which I rename to "scrollShouldClearLatchedState"
to reduce confusion. It might be possible to remove this in future with some refactoring.

Sadly we can no longer use SetForScope<> in FrameView after this change so add some manual save/restore code.

* dom/Element.cpp:
(WebCore::Element::setScrollLeft):
(WebCore::Element::setScrollTop):
* page/EventHandler.cpp:
(WebCore::EventHandler::completeWidgetWheelEvent):
(WebCore::EventHandler::handleWheelEvent):
* page/FrameView.cpp:
(WebCore::FrameView::setFrameRect):
(WebCore::FrameView::topContentInsetDidChange):
(WebCore::FrameView::updateLayoutViewport):
(WebCore::FrameView::setScrollPosition):
(WebCore::FrameView::setWasScrolledByUser):
* page/FrameView.h:
* platform/ScrollView.h:
(WebCore::ScrollView::inProgrammaticScroll const): Deleted.
* platform/ScrollableArea.cpp:
(WebCore::ScrollableArea::ScrollableArea):
* platform/ScrollableArea.h:
(WebCore::ScrollableArea::inProgrammaticScroll const):
(WebCore::ScrollableArea::setInProgrammaticScroll):
(WebCore::ScrollableArea::scrollShouldClearLatchedState const):
(WebCore::ScrollableArea::setScrollShouldClearLatchedState):
(WebCore::ScrollableArea::isScrolledProgrammatically const): Deleted.
(WebCore::ScrollableArea::setScrolledProgrammatically): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243905 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, rolling out r243898.
commit-queue@webkit.org [Thu, 4 Apr 2019 20:54:02 +0000 (20:54 +0000)]
Unreviewed, rolling out r243898.
https://bugs.webkit.org/show_bug.cgi?id=196624

`#if !ENABLE(C_LOOP) && NUMBER_OF_CALLEE_SAVES_REGISTERS > 0`
does not work well (Requested by yusukesuzuki on #webkit).

Reverted changeset:

"Unreviewed, build fix for CLoop and Windows after r243886"
https://bugs.webkit.org/show_bug.cgi?id=196387
https://trac.webkit.org/changeset/243898

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243904 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoLeak of UniqueIDBDatabase in network process running layout tests
sihui_liu@apple.com [Thu, 4 Apr 2019 20:53:22 +0000 (20:53 +0000)]
Leak of UniqueIDBDatabase in network process running layout tests
https://bugs.webkit.org/show_bug.cgi?id=196565
<rdar://problem/49346139>

Reviewed by Geoffrey Garen.

UniqueIDBDatabase will null itself after it receives confirmation about connecton close from its clients, but it
is possible that the web process to network process connection closes before servers gets the
confirmDidCloseFromServer. Therefore, we should let UniqueIDBDatabase forget connection when it receives a
conenctionClosedFromClient.

No new test because this bug is caused by race between network receiving conenctionClosedFromClient and
receiving confirmDidCloseFromServer. This is testable by running some existing layout tests in a row with leak
option.

* Modules/indexeddb/server/UniqueIDBDatabase.cpp:
(WebCore::IDBServer::UniqueIDBDatabase::connectionClosedFromClient):
(WebCore::IDBServer::UniqueIDBDatabase::confirmDidCloseFromServer):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243903 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, fix -Wreturn-type warning
mcatanzaro@igalia.com [Thu, 4 Apr 2019 20:51:45 +0000 (20:51 +0000)]
Unreviewed, fix -Wreturn-type warning

* Shared/WebsiteData/WebsiteData.cpp:
(WebKit::WebsiteData::ownerProcess):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243902 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, fix iOS build with recent SDKs.
cdumez@apple.com [Thu, 4 Apr 2019 20:47:45 +0000 (20:47 +0000)]
Unreviewed, fix iOS build with recent SDKs.

* platform/gamepad/cocoa/GameControllerGamepad.mm:
(WebCore::GameControllerGamepad::GameControllerGamepad):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243901 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[macOS] Fix sandbox violations
pvollan@apple.com [Thu, 4 Apr 2019 20:44:50 +0000 (20:44 +0000)]
[macOS] Fix sandbox violations
https://bugs.webkit.org/show_bug.cgi?id=196616
<rdar://problem/49498040>

Reviewed by Brent Fulgham.

Fix some observed sandbox violations in the WebContent process on macOS.

* WebProcess/com.apple.WebProcess.sb.in:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243900 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[MediaStream] Host should be able to mute screen capture and camera/microphone indepe...
eric.carlson@apple.com [Thu, 4 Apr 2019 20:44:29 +0000 (20:44 +0000)]
[MediaStream] Host should be able to mute screen capture and camera/microphone independently
https://bugs.webkit.org/show_bug.cgi?id=196555
<rdar://problem/47303865>

Reviewed by Youenn Fablet.

Source/WebCore:

Test: fast/mediastream/media-stream-page-muted.html

* Modules/mediastream/MediaStream.cpp:
(WebCore::MediaStream::MediaStream): Call setCaptureTracksMuted to pass page muted
state to tracks.
(WebCore::MediaStream::startProducingData): Ditto.
(WebCore::MediaStream::setCaptureTracksMuted): New.
* Modules/mediastream/MediaStream.h:

* Modules/mediastream/MediaStreamTrack.cpp:
(WebCore::MediaStreamTrack::MediaStreamTrack): Call setMuted with page muted state.
(WebCore::MediaStreamTrack::setMuted): Set muted according to page state and source type.
(WebCore::MediaStreamTrack::pageMutedStateDidChange): Call setMuted.
(WebCore::MediaStreamTrack::mediaState const): Update for new page state.
* Modules/mediastream/MediaStreamTrack.h:

* page/MediaProducer.h: Split capture muted state into two: camera/microphone and screen.

* page/Page.h:
(WebCore::Page::isMediaCaptureMuted const): Update for state changes.

* platform/mediastream/MediaStreamPrivate.cpp:
(WebCore::MediaStreamPrivate::setCaptureTracksMuted): Deleted.
(WebCore::MediaStreamPrivate::hasCaptureVideoSource const): Deleted.
* platform/mediastream/MediaStreamPrivate.h:

* platform/mediastream/RealtimeMediaSource.cpp:
(WebCore::RealtimeMediaSource::setMuted): Log state.
(WebCore::RealtimeMediaSource::notifyMutedChange): Call notifyMutedObservers on the
next runloop so events aren't dispatched synchronously.

* testing/Internals.cpp:
(WebCore::Internals::setPageMuted): Add new state.

Source/WebKit:

* UIProcess/API/C/WKPagePrivate.h: Add kWKMediaScreenCaptureMuted.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _setPageMuted:]):
(-[WKWebView _setMediaCaptureMuted:]): Deleted, it was unused.
(-[WKWebView _muteMediaCapture]): Deleted, it was unused.
* UIProcess/API/Cocoa/WKWebViewPrivate.h:

* UIProcess/UserMediaPermissionRequestManagerProxy.cpp:
(WebKit::UserMediaPermissionRequestManagerProxy::processUserMediaPermissionValidRequest): Fix
a log comment typo.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::setMediaStreamCaptureMuted): Use the new flag.
(WebKit::WebPageProxy::activateMediaStreamCaptureInPage): Ditto.
(WebKit::WebPageProxy::setMuted): Ditto.
* UIProcess/WebPageProxy.h:
(WebKit::WebPageProxy::isMediaStreamCaptureMuted const): Ditto.

LayoutTests:

* fast/mediastream/media-stream-page-muted-expected.txt: Added.
* fast/mediastream/media-stream-page-muted.html: Added.
* fast/mediastream/media-stream-track-interrupted.html: Read page muted state before
interrupting capture track because the page state now changes immediately.
* fast/mediastream/media-stream-track-muted.html: Ditto, for muting.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243899 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, build fix for CLoop and Windows after r243886
ysuzuki@apple.com [Thu, 4 Apr 2019 20:41:57 +0000 (20:41 +0000)]
Unreviewed, build fix for CLoop and Windows after r243886
https://bugs.webkit.org/show_bug.cgi?id=196387

RegisterAtOffsetList does not exist if ENABLE(ASSEMBLER) is false.

* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::Frame::calleeSaveRegistersForUnwinding):
* interpreter/StackVisitor.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243898 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ews-app] Status bubble should not display skipped buildbot steps
aakash_jain@apple.com [Thu, 4 Apr 2019 20:38:50 +0000 (20:38 +0000)]
[ews-app] Status bubble should not display skipped buildbot steps
https://bugs.webkit.org/show_bug.cgi?id=196584

Reviewed by Lucas Forschler.

* BuildSlaveSupport/ews-app/ews/views/statusbubble.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243897 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ews-app] configure localhost as BUILDBOT_SERVER_HOST in testing mode
aakash_jain@apple.com [Thu, 4 Apr 2019 20:34:11 +0000 (20:34 +0000)]
[ews-app] configure localhost as BUILDBOT_SERVER_HOST in testing mode
https://bugs.webkit.org/show_bug.cgi?id=196620

Reviewed by Lucas Forschler.

* BuildSlaveSupport/ews-app/ews/config.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243896 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, update r243884 to use macros in Compiler.h instead.
cdumez@apple.com [Thu, 4 Apr 2019 20:34:08 +0000 (20:34 +0000)]
Unreviewed, update r243884 to use macros in Compiler.h instead.

* platform/ios/LegacyTileGrid.mm:
(WebCore::LegacyTileGrid::dropDistantTiles):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243895 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoAX: Crash under WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored()
cfleizach@apple.com [Thu, 4 Apr 2019 20:31:34 +0000 (20:31 +0000)]
AX: Crash under WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored()
https://bugs.webkit.org/show_bug.cgi?id=196600
<rdar://problem/49572996>

Reviewed by Joanmarie Diggs.

Audit AX code to not dereference renderer before checking if it's null.
Not clear how to reproduce at this time.

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::webAreaIsPresentational):
(WebCore::AccessibilityRenderObject::layoutCount const):
(WebCore::AccessibilityRenderObject::widget const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243894 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoCompute accurate regions for touch-action
antti@apple.com [Thu, 4 Apr 2019 20:28:46 +0000 (20:28 +0000)]
Compute accurate regions for touch-action
https://bugs.webkit.org/show_bug.cgi?id=196536
<rdar://problem/49516022>

Reviewed by Simon Fraser.

Source/WebCore:

Tests: pointerevents/ios/touch-action-region-basic.html
       pointerevents/ios/touch-action-region-layers.html
       pointerevents/ios/touch-action-region-pan-x-y.html

- Use style system to compute effective touch-action without additional tree walks.
- Compute touch-action region in a fake paint, at the same time with the event region.

This patch doesn't yet use the computed region for anything except test output.

* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* css/StyleResolver.cpp:
(WebCore::computeEffectiveTouchActions):
(WebCore::StyleResolver::adjustRenderStyle):

Update RenderStyle::effectiveTouchAction.

* dom/Element.cpp:
(WebCore::Element::computedTouchActions const):

Just get it from the style.

* platform/graphics/GraphicsLayer.cpp:
(WebCore::GraphicsLayer::setEventRegion):
(WebCore::GraphicsLayer::setTouchActionRegion):
(WebCore::GraphicsLayer::dumpProperties const):
* platform/graphics/GraphicsLayer.h:
(WebCore::GraphicsLayer::touchActionRegion const):
* platform/graphics/ca/GraphicsLayerCA.cpp:
(WebCore::GraphicsLayerCA::setTouchActionRegion):
* platform/graphics/ca/GraphicsLayerCA.h:
* rendering/PaintInfo.h:
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::paintObject):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::collectEventRegionForFragments):
* rendering/RenderLayer.h:
* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::updateConfiguration):

Need to do this for the top compositing layer too.

(WebCore::RenderLayerBacking::updateEventRegion):

Compute touch-action region too.
As a basic optimization avoid doing any extra work if there are no elements with non-default touch-action property.

* rendering/TouchActionRegion.cpp: Added.
(WebCore::toIndex):
(WebCore::toTouchAction):
(WebCore::toString):
(WebCore::TouchActionRegion::unite):
(WebCore::TouchActionRegion::actionsForPoint const):
(WebCore::TouchActionRegion::translate):
(WebCore::operator<<):
* rendering/TouchActionRegion.h: Added.

Class for collecting and maintaining touch-action region.

(WebCore::TouchActionRegion::isEmpty const):
(WebCore::TouchActionRegion::operator== const):
* rendering/style/RenderStyle.h:
(WebCore::RenderStyle::effectiveTouchActions const):
(WebCore::RenderStyle::setEffectiveTouchActions):

Implement as inherited property for efficiency (touch-action itself is non-inherited).

* rendering/style/StyleRareInheritedData.cpp:
(WebCore::StyleRareInheritedData::StyleRareInheritedData):
(WebCore::StyleRareInheritedData::operator== const):
* rendering/style/StyleRareInheritedData.h:

LayoutTests:

* pointerevents/ios/touch-action-region-basic-expected.txt: Added.
* pointerevents/ios/touch-action-region-basic.html: Added.
* pointerevents/ios/touch-action-region-layers-expected.txt: Added.
* pointerevents/ios/touch-action-region-layers.html: Added.
* pointerevents/ios/touch-action-region-pan-x-y-expected.txt: Added.
* pointerevents/ios/touch-action-region-pan-x-y.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243893 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, fix linking error because the build of RTCIceTransport.cpp is handled...
ysuzuki@apple.com [Thu, 4 Apr 2019 20:08:37 +0000 (20:08 +0000)]
Unreviewed, fix linking error because the build of RTCIceTransport.cpp is handled in Xcode project side accidentally
https://bugs.webkit.org/show_bug.cgi?id=196475

We did not have RTCIceTransport.cpp in Sources.txt.

* WebCore.xcodeproj/project.pbxproj:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243890 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoVersioning.
alancoon@apple.com [Thu, 4 Apr 2019 20:08:02 +0000 (20:08 +0000)]
Versioning.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243889 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[macOS][iOS] Add filter to syscall sandbox rule
pvollan@apple.com [Thu, 4 Apr 2019 19:13:38 +0000 (19:13 +0000)]
[macOS][iOS] Add filter to syscall sandbox rule
https://bugs.webkit.org/show_bug.cgi?id=196613
<rdar://problem/49531420>

Reviewed by Brent Fulgham.

This will restrict the existing sandbox rule for the syscall.

* Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb:
* WebProcess/com.apple.WebProcess.sb.in:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243888 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[WebCore] Put most of derived classes of ScriptWrappable into IsoHeap
ysuzuki@apple.com [Thu, 4 Apr 2019 19:07:53 +0000 (19:07 +0000)]
[WebCore] Put most of derived classes of ScriptWrappable into IsoHeap
https://bugs.webkit.org/show_bug.cgi?id=196475

Reviewed by Saam Barati.

Source/bmalloc:

Add MAKE_BISO_MALLOCED_IMPL_TEMPLATE, which can be used for explicit specialization for template classes.

* bmalloc/IsoHeap.h:
* bmalloc/IsoHeapInlines.h:

Source/WebCore:

This patch puts most of derived classes of ScriptWrappable into IsoHeap. We do not include derived classes of Event simply
because Internal repository code also inherits it. After watching the result of this patch, we will try Event and its derived
classes into IsoHeap too.

This patch makes the following things IsoHeap-allocated. These classes are listed by using lldb python script.

    1. DOM collections (HTMLCollection etc.)
    2. WebAudio nodes
    3. IDB classes
    4. FileSystem API classes
    5. Canvas contexts
    6. WebRTC classses
    7. XMLHttpRequest related classes
    8. WebSocket related classes
    9. Worker and Worklet related classes
    10. Other misc classes

* Modules/applepay/ApplePaySession.cpp:
* Modules/applepay/ApplePaySession.h:
* Modules/encryptedmedia/MediaKeySession.cpp:
* Modules/encryptedmedia/MediaKeySession.h:
* Modules/encryptedmedia/legacy/WebKitMediaKeySession.cpp:
* Modules/encryptedmedia/legacy/WebKitMediaKeySession.h:
* Modules/entriesapi/DOMFileSystem.cpp:
* Modules/entriesapi/DOMFileSystem.h:
(WebCore::DOMFileSystem::createEntryForFile): Deleted.
(WebCore::DOMFileSystem::name const): Deleted.
* Modules/entriesapi/FileSystemDirectoryEntry.h:
* Modules/entriesapi/FileSystemDirectoryReader.cpp:
* Modules/entriesapi/FileSystemDirectoryReader.h:
* Modules/entriesapi/FileSystemEntry.cpp:
* Modules/entriesapi/FileSystemEntry.h:
* Modules/entriesapi/FileSystemFileEntry.h:
* Modules/geolocation/Geolocation.cpp:
* Modules/geolocation/Geolocation.h:
(WebCore::Geolocation::document const): Deleted.
(WebCore::Geolocation::frame const): Deleted.
(WebCore::Geolocation::resetIsAllowed): Deleted.
(WebCore::Geolocation::isAllowed const): Deleted.
(WebCore::Geolocation::isDenied const): Deleted.
(WebCore::Geolocation::hasListeners const): Deleted.
* Modules/indexeddb/IDBCursor.cpp:
* Modules/indexeddb/IDBCursor.h:
* Modules/indexeddb/IDBCursorWithValue.cpp:
* Modules/indexeddb/IDBCursorWithValue.h:
* Modules/indexeddb/IDBDatabase.cpp:
* Modules/indexeddb/IDBDatabase.h:
(WebCore::IDBDatabase::info const): Deleted.
(WebCore::IDBDatabase::databaseConnectionIdentifier const): Deleted.
(WebCore::IDBDatabase::connectionProxy): Deleted.
(WebCore::IDBDatabase::isClosingOrClosed const): Deleted.
* Modules/indexeddb/IDBKeyRange.cpp:
* Modules/indexeddb/IDBKeyRange.h:
(WebCore::IDBKeyRange::lower const): Deleted.
(WebCore::IDBKeyRange::upper const): Deleted.
(WebCore::IDBKeyRange::lowerOpen const): Deleted.
(WebCore::IDBKeyRange::upperOpen const): Deleted.
* Modules/indexeddb/IDBOpenDBRequest.cpp:
* Modules/indexeddb/IDBOpenDBRequest.h:
* Modules/indexeddb/IDBRequest.cpp:
* Modules/indexeddb/IDBRequest.h:
* Modules/indexeddb/IDBTransaction.cpp:
* Modules/indexeddb/IDBTransaction.h:
(WebCore::IDBTransaction::mode const): Deleted.
(WebCore::IDBTransaction::info const): Deleted.
(WebCore::IDBTransaction::database): Deleted.
(WebCore::IDBTransaction::database const): Deleted.
(WebCore::IDBTransaction::originalDatabaseInfo const): Deleted.
(WebCore::IDBTransaction::isVersionChange const): Deleted.
(WebCore::IDBTransaction::isReadOnly const): Deleted.
(WebCore::IDBTransaction::isFinished const): Deleted.
* Modules/mediarecorder/MediaRecorder.cpp:
* Modules/mediarecorder/MediaRecorder.h:
* Modules/mediasession/MediaRemoteControls.cpp:
* Modules/mediasession/MediaRemoteControls.h:
(WebCore::MediaRemoteControls::create): Deleted.
(WebCore::MediaRemoteControls::previousTrackEnabled const): Deleted.
(WebCore::MediaRemoteControls::nextTrackEnabled const): Deleted.
* Modules/mediasource/MediaSource.cpp:
* Modules/mediasource/MediaSource.h:
* Modules/mediasource/SourceBuffer.cpp:
* Modules/mediasource/SourceBuffer.h:
* Modules/mediasource/SourceBufferList.cpp:
* Modules/mediasource/SourceBufferList.h:
* Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp:
* Modules/mediastream/CanvasCaptureMediaStreamTrack.h:
* Modules/mediastream/MediaDeviceInfo.cpp:
* Modules/mediastream/MediaDeviceInfo.h:
(WebCore::MediaDeviceInfo::label const): Deleted.
(WebCore::MediaDeviceInfo::deviceId const): Deleted.
(WebCore::MediaDeviceInfo::groupId const): Deleted.
(WebCore::MediaDeviceInfo::kind const): Deleted.
* Modules/mediastream/MediaDevices.cpp:
* Modules/mediastream/MediaDevices.h:
* Modules/mediastream/MediaStream.cpp:
* Modules/mediastream/MediaStream.h:
* Modules/mediastream/MediaStreamTrack.cpp:
* Modules/mediastream/MediaStreamTrack.h:
* Modules/mediastream/RTCDTMFSender.cpp:
* Modules/mediastream/RTCDTMFSender.h:
* Modules/mediastream/RTCDataChannel.cpp:
* Modules/mediastream/RTCDataChannel.h:
* Modules/mediastream/RTCIceCandidate.cpp:
* Modules/mediastream/RTCIceCandidate.h:
(WebCore::RTCIceCandidate::candidate const): Deleted.
(WebCore::RTCIceCandidate::sdpMid const): Deleted.
(WebCore::RTCIceCandidate::sdpMLineIndex const): Deleted.
(WebCore::RTCIceCandidate::setCandidate): Deleted.
* Modules/mediastream/RTCIceTransport.cpp:
* Modules/mediastream/RTCIceTransport.h:
(WebCore::RTCIceTransport::create): Deleted.
(WebCore::RTCIceTransport::state const): Deleted.
(WebCore::RTCIceTransport::setState): Deleted.
(WebCore::RTCIceTransport::gatheringState const): Deleted.
(WebCore::RTCIceTransport::setGatheringState): Deleted.
(WebCore::RTCIceTransport::RTCIceTransport): Deleted.
* Modules/mediastream/RTCPeerConnection.cpp:
* Modules/mediastream/RTCPeerConnection.h:
* Modules/mediastream/RTCRtpReceiver.cpp:
* Modules/mediastream/RTCRtpReceiver.h:
(WebCore::RTCRtpReceiver::create): Deleted.
(WebCore::RTCRtpReceiver::setBackend): Deleted.
(WebCore::RTCRtpReceiver::getParameters): Deleted.
(WebCore::RTCRtpReceiver::getContributingSources const): Deleted.
(WebCore::RTCRtpReceiver::getSynchronizationSources const): Deleted.
(WebCore::RTCRtpReceiver::track): Deleted.
(WebCore::RTCRtpReceiver::backend): Deleted.
* Modules/mediastream/RTCRtpSender.cpp:
* Modules/mediastream/RTCRtpSender.h:
(WebCore::RTCRtpSender::track): Deleted.
(WebCore::RTCRtpSender::trackId const): Deleted.
(WebCore::RTCRtpSender::trackKind const): Deleted.
(WebCore::RTCRtpSender::mediaStreamIds const): Deleted.
(WebCore::RTCRtpSender::setMediaStreamIds): Deleted.
(WebCore::RTCRtpSender::isStopped const): Deleted.
(WebCore::RTCRtpSender::backend): Deleted.
* Modules/mediastream/RTCRtpTransceiver.cpp:
* Modules/mediastream/RTCRtpTransceiver.h:
(WebCore::RTCRtpTransceiver::create): Deleted.
(WebCore::RTCRtpTransceiver::sender): Deleted.
(WebCore::RTCRtpTransceiver::receiver): Deleted.
(WebCore::RTCRtpTransceiver::iceTransport): Deleted.
(WebCore::RTCRtpTransceiver::backend): Deleted.
* Modules/mediastream/RTCSessionDescription.cpp:
* Modules/mediastream/RTCSessionDescription.h:
(WebCore::RTCSessionDescription::type const): Deleted.
(WebCore::RTCSessionDescription::sdp const): Deleted.
(WebCore::RTCSessionDescription::setSdp): Deleted.
* Modules/notifications/Notification.cpp:
* Modules/notifications/Notification.h:
* Modules/paymentrequest/PaymentRequest.cpp:
* Modules/paymentrequest/PaymentRequest.h:
* Modules/paymentrequest/PaymentResponse.cpp:
* Modules/paymentrequest/PaymentResponse.h:
* Modules/speech/SpeechSynthesisUtterance.cpp:
* Modules/speech/SpeechSynthesisUtterance.h:
* Modules/webaudio/AnalyserNode.cpp:
* Modules/webaudio/AnalyserNode.h:
* Modules/webaudio/AudioBasicInspectorNode.cpp:
* Modules/webaudio/AudioBasicInspectorNode.h:
* Modules/webaudio/AudioBasicProcessorNode.cpp:
* Modules/webaudio/AudioBasicProcessorNode.h:
* Modules/webaudio/AudioBufferSourceNode.cpp:
* Modules/webaudio/AudioBufferSourceNode.h:
* Modules/webaudio/AudioContext.cpp:
* Modules/webaudio/AudioContext.h:
* Modules/webaudio/AudioDestinationNode.cpp:
* Modules/webaudio/AudioDestinationNode.h:
* Modules/webaudio/AudioNode.cpp:
* Modules/webaudio/AudioNode.h:
* Modules/webaudio/AudioScheduledSourceNode.cpp:
* Modules/webaudio/AudioScheduledSourceNode.h:
* Modules/webaudio/BiquadFilterNode.cpp:
* Modules/webaudio/BiquadFilterNode.h:
* Modules/webaudio/ChannelMergerNode.cpp:
* Modules/webaudio/ChannelMergerNode.h:
* Modules/webaudio/ChannelSplitterNode.cpp:
* Modules/webaudio/ChannelSplitterNode.h:
* Modules/webaudio/ConvolverNode.cpp:
* Modules/webaudio/ConvolverNode.h:
* Modules/webaudio/DefaultAudioDestinationNode.cpp:
* Modules/webaudio/DefaultAudioDestinationNode.h:
* Modules/webaudio/DelayNode.cpp:
* Modules/webaudio/DelayNode.h:
* Modules/webaudio/DynamicsCompressorNode.cpp:
* Modules/webaudio/DynamicsCompressorNode.h:
* Modules/webaudio/GainNode.cpp:
* Modules/webaudio/GainNode.h:
* Modules/webaudio/MediaElementAudioSourceNode.cpp:
* Modules/webaudio/MediaElementAudioSourceNode.h:
* Modules/webaudio/MediaStreamAudioDestinationNode.cpp:
* Modules/webaudio/MediaStreamAudioDestinationNode.h:
* Modules/webaudio/MediaStreamAudioSourceNode.cpp:
* Modules/webaudio/MediaStreamAudioSourceNode.h:
* Modules/webaudio/OfflineAudioContext.cpp:
* Modules/webaudio/OfflineAudioContext.h:
* Modules/webaudio/OfflineAudioDestinationNode.cpp:
* Modules/webaudio/OfflineAudioDestinationNode.h:
* Modules/webaudio/OscillatorNode.cpp:
* Modules/webaudio/OscillatorNode.h:
* Modules/webaudio/PannerNode.cpp:
* Modules/webaudio/PannerNode.h:
* Modules/webaudio/ScriptProcessorNode.cpp:
* Modules/webaudio/ScriptProcessorNode.h:
* Modules/webaudio/WaveShaperNode.cpp:
* Modules/webaudio/WaveShaperNode.h:
* Modules/webgpu/GPUCanvasContext.cpp:
* Modules/webgpu/GPUCanvasContext.h:
* Modules/websockets/WebSocket.cpp:
* Modules/websockets/WebSocket.h:
* Modules/webvr/VRDisplay.cpp:
* Modules/webvr/VRDisplay.h:
(WebCore::VRDisplay::isPresenting const): Deleted.
(WebCore::VRDisplay::displayName const): Deleted.
(WebCore::VRDisplay::displayId const): Deleted.
(WebCore::VRDisplay::depthNear const): Deleted.
(WebCore::VRDisplay::setDepthNear): Deleted.
(WebCore::VRDisplay::depthFar const): Deleted.
(WebCore::VRDisplay::setDepthFar): Deleted.
(WebCore::VRDisplay::document): Deleted.
* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* animation/CSSAnimation.cpp:
* animation/CSSAnimation.h:
* animation/CSSTransition.cpp:
* animation/CSSTransition.h:
* animation/DeclarativeAnimation.cpp:
* animation/DeclarativeAnimation.h:
* animation/WebAnimation.cpp:
* animation/WebAnimation.h:
* bindings/js/ScriptWrappable.h:
* css/CSSComputedStyleDeclaration.cpp:
* css/CSSComputedStyleDeclaration.h:
* css/CSSStyleDeclaration.cpp:
(): Deleted.
* css/CSSStyleDeclaration.h:
* css/DOMMatrix.h:
* css/DOMMatrixReadOnly.cpp:
* css/DOMMatrixReadOnly.h:
* css/FontFaceSet.cpp:
* css/FontFaceSet.h:
* css/PropertySetCSSStyleDeclaration.cpp:
* css/PropertySetCSSStyleDeclaration.h:
* css/WebKitCSSMatrix.cpp:
* css/WebKitCSSMatrix.h:
* css/typedom/TypedOMCSSImageValue.cpp: Added.
* css/typedom/TypedOMCSSImageValue.h:
* css/typedom/TypedOMCSSNumericValue.cpp: Added.
* css/typedom/TypedOMCSSNumericValue.h:
* css/typedom/TypedOMCSSStyleValue.cpp: Added.
* css/typedom/TypedOMCSSStyleValue.h:
* css/typedom/TypedOMCSSUnitValue.cpp: Added.
* css/typedom/TypedOMCSSUnitValue.h:
* css/typedom/TypedOMCSSUnparsedValue.cpp: Added.
* css/typedom/TypedOMCSSUnparsedValue.h:
* dom/AbortController.cpp:
* dom/AbortController.h:
* dom/AbortSignal.cpp:
* dom/AbortSignal.h:
* dom/AllDescendantsCollection.cpp: Copied from Source/WebCore/xml/XMLHttpRequestEventTarget.h.
* dom/AllDescendantsCollection.h:
* dom/ChildNodeList.cpp:
* dom/ChildNodeList.h:
* dom/ClassCollection.cpp:
* dom/ClassCollection.h:
* dom/DOMImplementation.cpp:
* dom/DOMImplementation.h:
(WebCore::DOMImplementation::ref): Deleted.
(WebCore::DOMImplementation::deref): Deleted.
(WebCore::DOMImplementation::document): Deleted.
(WebCore::DOMImplementation::hasFeature): Deleted.
* dom/DOMPoint.h:
* dom/DOMPointReadOnly.cpp:
* dom/DOMPointReadOnly.h:
* dom/DOMQuad.cpp:
* dom/DOMQuad.h:
* dom/DOMRect.h:
* dom/DOMRectReadOnly.cpp: Copied from Source/WebCore/dom/DOMPointReadOnly.cpp.
* dom/DOMRectReadOnly.h:
* dom/DataTransferItemList.cpp:
* dom/DataTransferItemList.h:
(WebCore::DataTransferItemList::ref): Deleted.
(WebCore::DataTransferItemList::deref): Deleted.
(WebCore::DataTransferItemList::dataTransfer): Deleted.
(WebCore::DataTransferItemList::hasItems const): Deleted.
(WebCore::DataTransferItemList::items const): Deleted.
* dom/DatasetDOMStringMap.cpp:
* dom/DatasetDOMStringMap.h:
* dom/DocumentParser.h:
* dom/EventTarget.cpp:
* dom/EventTarget.h:
* dom/LiveNodeList.cpp:
* dom/LiveNodeList.h:
* dom/MessageChannel.cpp:
* dom/MessagePort.cpp:
* dom/MessagePort.h:
* dom/NameNodeList.cpp:
* dom/NameNodeList.h:
* dom/NamedNodeMap.cpp:
* dom/NamedNodeMap.h:
(WebCore::NamedNodeMap::NamedNodeMap): Deleted.
(WebCore::NamedNodeMap::element): Deleted.
* dom/NodeIterator.cpp:
* dom/NodeIterator.h:
(WebCore::NodeIterator::detach): Deleted.
(WebCore::NodeIterator::referenceNode const): Deleted.
(WebCore::NodeIterator::pointerBeforeReferenceNode const): Deleted.
* dom/NodeList.cpp: Copied from Source/WebCore/xml/XMLHttpRequestEventTarget.h.
* dom/NodeList.h:
* dom/NodeRareData.cpp:
* dom/ScriptExecutionContext.cpp:
* dom/SimulatedClick.cpp:
* dom/StaticNodeList.cpp:
* dom/StaticNodeList.h:
* dom/TagCollection.cpp:
* dom/TagCollection.h:
* dom/TreeWalker.cpp:
* dom/TreeWalker.h:
(WebCore::TreeWalker::create): Deleted.
(WebCore::TreeWalker::currentNode): Deleted.
(WebCore::TreeWalker::currentNode const): Deleted.
* fileapi/Blob.cpp:
* fileapi/Blob.h:
* fileapi/File.cpp:
* fileapi/File.h:
* fileapi/FileList.cpp:
* fileapi/FileList.h:
(WebCore::FileList::create): Deleted.
(WebCore::FileList::length const): Deleted.
(WebCore::FileList::isEmpty const): Deleted.
(WebCore::FileList::files const): Deleted.
(WebCore::FileList::file const): Deleted.
(WebCore::FileList::FileList): Deleted.
(WebCore::FileList::append): Deleted.
(WebCore::FileList::clear): Deleted.
* fileapi/FileReader.cpp:
* fileapi/FileReader.h:
* html/CachedHTMLCollection.h:
* html/GenericCachedHTMLCollection.cpp:
* html/GenericCachedHTMLCollection.h:
* html/HTMLAllCollection.cpp:
* html/HTMLAllCollection.h:
* html/HTMLCollection.cpp:
* html/HTMLCollection.h:
* html/HTMLFormControlsCollection.cpp:
* html/HTMLFormControlsCollection.h:
* html/HTMLNameCollection.cpp:
* html/HTMLNameCollection.h:
* html/HTMLOptionsCollection.cpp:
* html/HTMLOptionsCollection.h:
* html/HTMLTableRowsCollection.cpp:
* html/HTMLTableRowsCollection.h:
* html/ImageBitmap.cpp:
* html/ImageBitmap.h:
(WebCore::ImageBitmap::isDetached const): Deleted.
(WebCore::ImageBitmap::buffer): Deleted.
(WebCore::ImageBitmap::originClean const): Deleted.
* html/LabelsNodeList.cpp:
* html/LabelsNodeList.h:
* html/MediaController.cpp:
* html/MediaController.h:
* html/OffscreenCanvas.cpp:
* html/OffscreenCanvas.h:
* html/RadioNodeList.cpp:
* html/RadioNodeList.h:
* html/canvas/CanvasRenderingContext.cpp:
* html/canvas/CanvasRenderingContext.h:
* html/canvas/CanvasRenderingContext2D.cpp:
* html/canvas/CanvasRenderingContext2D.h:
* html/canvas/CanvasRenderingContext2DBase.cpp:
* html/canvas/CanvasRenderingContext2DBase.h:
* html/canvas/GPUBasedCanvasRenderingContext.h:
* html/canvas/ImageBitmapRenderingContext.cpp:
* html/canvas/ImageBitmapRenderingContext.h:
* html/canvas/OffscreenCanvasRenderingContext2D.cpp:
* html/canvas/OffscreenCanvasRenderingContext2D.h:
* html/canvas/PaintRenderingContext2D.cpp:
* html/canvas/PaintRenderingContext2D.h:
* html/canvas/PlaceholderRenderingContext.cpp:
* html/canvas/PlaceholderRenderingContext.h:
* html/canvas/WebGL2RenderingContext.cpp:
* html/canvas/WebGL2RenderingContext.h:
* html/canvas/WebGLRenderingContext.cpp:
* html/canvas/WebGLRenderingContext.h:
* html/canvas/WebGLRenderingContextBase.cpp:
* html/canvas/WebGLRenderingContextBase.h:
* html/track/AudioTrackList.h:
* html/track/DataCue.cpp:
* html/track/DataCue.h:
* html/track/InbandDataTextTrack.cpp:
* html/track/InbandDataTextTrack.h:
* html/track/InbandGenericTextTrack.cpp:
* html/track/InbandGenericTextTrack.h:
* html/track/InbandTextTrack.cpp:
* html/track/InbandTextTrack.h:
* html/track/InbandWebVTTTextTrack.cpp:
* html/track/InbandWebVTTTextTrack.h:
* html/track/LoadableTextTrack.cpp:
* html/track/LoadableTextTrack.h:
* html/track/TextTrack.cpp:
* html/track/TextTrack.h:
* html/track/TextTrackCue.cpp:
* html/track/TextTrackCue.h:
* html/track/TextTrackCueGeneric.cpp:
* html/track/TextTrackCueGeneric.h:
* html/track/TextTrackList.cpp:
* html/track/TextTrackList.h:
* html/track/TrackListBase.cpp:
* html/track/TrackListBase.h:
* html/track/VTTCue.cpp:
* html/track/VTTCue.h:
* html/track/VideoTrackList.h:
* loader/appcache/DOMApplicationCache.cpp:
* loader/appcache/DOMApplicationCache.h:
* page/AbstractDOMWindow.cpp:
* page/AbstractDOMWindow.h:
* page/BarProp.cpp:
* page/BarProp.h:
(WebCore::BarProp::create): Deleted.
* page/DOMWindow.cpp:
* page/DOMWindow.h:
* page/EventSource.cpp:
* page/EventSource.h:
* page/History.cpp:
* page/History.h:
* page/Location.cpp:
* page/Location.h:
(WebCore::Location::create): Deleted.
(WebCore::Location::toString const): Deleted.
* page/Navigator.cpp:
* page/Navigator.h:
* page/Performance.cpp:
* page/Performance.h:
* page/RemoteDOMWindow.cpp:
* page/RemoteDOMWindow.h:
* page/Screen.cpp:
* page/Screen.h:
* page/VisualViewport.cpp:
* page/VisualViewport.h:
* plugins/DOMMimeTypeArray.cpp:
* plugins/DOMMimeTypeArray.h:
(WebCore::DOMMimeTypeArray::create): Deleted.
* plugins/DOMPlugin.cpp:
* plugins/DOMPlugin.h:
(WebCore::DOMPlugin::create): Deleted.
* plugins/DOMPluginArray.cpp:
* plugins/DOMPluginArray.h:
(WebCore::DOMPluginArray::create): Deleted.
* storage/Storage.cpp:
* storage/Storage.h:
(WebCore::Storage::area const): Deleted.
* workers/AbstractWorker.cpp:
* workers/AbstractWorker.h:
* workers/DedicatedWorkerGlobalScope.cpp:
* workers/DedicatedWorkerGlobalScope.h:
* workers/Worker.cpp:
* workers/Worker.h:
* workers/WorkerGlobalScope.cpp:
* workers/WorkerGlobalScope.h:
* workers/service/ServiceWorker.cpp:
* workers/service/ServiceWorker.h:
* workers/service/ServiceWorkerContainer.cpp:
* workers/service/ServiceWorkerContainer.h:
* workers/service/ServiceWorkerGlobalScope.cpp:
* workers/service/ServiceWorkerGlobalScope.h:
* workers/service/ServiceWorkerRegistration.cpp:
* workers/service/ServiceWorkerRegistration.h:
* worklets/PaintWorkletGlobalScope.cpp:
* worklets/PaintWorkletGlobalScope.h:
* worklets/Worklet.cpp:
* worklets/Worklet.h:
* worklets/WorkletGlobalScope.cpp:
* worklets/WorkletGlobalScope.h:
* xml/XMLHttpRequest.cpp:
* xml/XMLHttpRequest.h:
* xml/XMLHttpRequestEventTarget.h:
* xml/XMLHttpRequestUpload.cpp:
* xml/XMLHttpRequestUpload.h:
* xml/XPathParser.cpp:

Source/WTF:

* wtf/ForbidHeapAllocation.h:
* wtf/IsoMalloc.h:
* wtf/IsoMallocInlines.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243887 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoTeach Call ICs how to call Wasm
sbarati@apple.com [Thu, 4 Apr 2019 18:54:16 +0000 (18:54 +0000)]
Teach Call ICs how to call Wasm
https://bugs.webkit.org/show_bug.cgi?id=196387

Reviewed by Filip Pizlo.

JSTests:

* wasm/function-tests/stack-trace.js:

Source/JavaScriptCore:

This patch teaches JS to call Wasm without going through the native thunk.
Currently, we emit a JIT "JS" callee stub which marshals arguments from
JS to Wasm. Like the native version of this, this thunk is responsible
for saving and restoring the VM's current Wasm context. Instead of emitting
an exception handler, we also teach the unwinder how to read the previous
wasm context to restore it as it unwindws past this frame.

This patch is straight forward, and leaves some areas for perf improvement:
- We can teach the DFG/FTL to directly use the Wasm calling convention when
  it knows it's calling a single Wasm function. This way we don't shuffle
  registers to the stack and then back into registers.
- We bail out to the slow path for mismatched arity. I opened a bug to fix
  optimize arity check failures: https://bugs.webkit.org/show_bug.cgi?id=196564
- We bail out to the slow path Double JSValues flowing into i32 arguments.
  We should teach this thunk how to do that conversion directly.

This patch also refactors the code to explicitly have a single pinned size register.
We used pretend in some places that we could have more than one pinned size register.
However, there was other code that just asserted the size was one. This patch just rips
out this code since we never moved to having more than one pinned size register. Doing
this refactoring cleans up the various places where we set up the size register.

This patch is a 50-60% progression on JetStream 2's richards-wasm.

* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* assembler/MacroAssemblerCodeRef.h:
(JSC::MacroAssemblerCodeRef::operator=):
(JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
* interpreter/Interpreter.cpp:
(JSC::UnwindFunctor::operator() const):
(JSC::UnwindFunctor::copyCalleeSavesToEntryFrameCalleeSavesBuffer const):
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::Frame::calleeSaveRegistersForUnwinding):
(JSC::StackVisitor::Frame::calleeSaveRegisters): Deleted.
* interpreter/StackVisitor.h:
* jit/JITOperations.cpp:
* jit/RegisterSet.cpp:
(JSC::RegisterSet::runtimeTagRegisters):
(JSC::RegisterSet::specialRegisters):
(JSC::RegisterSet::runtimeRegisters): Deleted.
* jit/RegisterSet.h:
* jit/Repatch.cpp:
(JSC::linkPolymorphicCall):
* runtime/JSFunction.cpp:
(JSC::getCalculatedDisplayName):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::jsToWasmICCalleeStructure const):
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
* wasm/WasmAirIRGenerator.cpp:
(JSC::Wasm::AirIRGenerator::AirIRGenerator):
(JSC::Wasm::AirIRGenerator::restoreWebAssemblyGlobalState):
(JSC::Wasm::AirIRGenerator::addCallIndirect):
* wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::B3IRGenerator::B3IRGenerator):
(JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
(JSC::Wasm::B3IRGenerator::addCallIndirect):
* wasm/WasmBinding.cpp:
(JSC::Wasm::wasmToWasm):
* wasm/WasmContext.h:
(JSC::Wasm::Context::pointerToInstance):
* wasm/WasmContextInlines.h:
(JSC::Wasm::Context::store):
* wasm/WasmMemoryInformation.cpp:
(JSC::Wasm::getPinnedRegisters):
(JSC::Wasm::PinnedRegisterInfo::get):
(JSC::Wasm::PinnedRegisterInfo::PinnedRegisterInfo):
* wasm/WasmMemoryInformation.h:
(JSC::Wasm::PinnedRegisterInfo::toSave const):
* wasm/WasmOMGPlan.cpp:
(JSC::Wasm::OMGPlan::work):
* wasm/js/JSToWasm.cpp:
(JSC::Wasm::createJSToWasmWrapper):
* wasm/js/JSToWasmICCallee.cpp: Added.
(JSC::JSToWasmICCallee::create):
(JSC::JSToWasmICCallee::createStructure):
(JSC::JSToWasmICCallee::visitChildren):
* wasm/js/JSToWasmICCallee.h: Added.
(JSC::JSToWasmICCallee::function):
(JSC::JSToWasmICCallee::JSToWasmICCallee):
* wasm/js/WebAssemblyFunction.cpp:
(JSC::WebAssemblyFunction::useTagRegisters const):
(JSC::WebAssemblyFunction::calleeSaves const):
(JSC::WebAssemblyFunction::usedCalleeSaveRegisters const):
(JSC::WebAssemblyFunction::previousInstanceOffset const):
(JSC::WebAssemblyFunction::previousInstance):
(JSC::WebAssemblyFunction::jsCallEntrypointSlow):
(JSC::WebAssemblyFunction::visitChildren):
(JSC::WebAssemblyFunction::destroy):
* wasm/js/WebAssemblyFunction.h:
* wasm/js/WebAssemblyFunctionHeapCellType.cpp: Added.
(JSC::WebAssemblyFunctionDestroyFunc::operator() const):
(JSC::WebAssemblyFunctionHeapCellType::WebAssemblyFunctionHeapCellType):
(JSC::WebAssemblyFunctionHeapCellType::~WebAssemblyFunctionHeapCellType):
(JSC::WebAssemblyFunctionHeapCellType::finishSweep):
(JSC::WebAssemblyFunctionHeapCellType::destroy):
* wasm/js/WebAssemblyFunctionHeapCellType.h: Added.
* wasm/js/WebAssemblyPrototype.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243886 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[JSC] Pass CodeOrigin to FuzzerAgent
ysuzuki@apple.com [Thu, 4 Apr 2019 18:53:08 +0000 (18:53 +0000)]
[JSC] Pass CodeOrigin to FuzzerAgent
https://bugs.webkit.org/show_bug.cgi?id=196590

Reviewed by Saam Barati.

Pass CodeOrigin instead of bytecodeIndex. CodeOrigin includes richer information (InlineCallFrame*).
We also mask prediction with SpecBytecodeTop in DFGByteCodeParser. The fuzzer can produce any SpeculatedTypes,
but DFGByteCodeParser should only see predictions that can be actually produced from the bytecode execution.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
* runtime/FuzzerAgent.cpp:
(JSC::FuzzerAgent::getPrediction):
* runtime/FuzzerAgent.h:
* runtime/RandomizingFuzzerAgent.cpp:
(JSC::RandomizingFuzzerAgent::getPrediction):
* runtime/RandomizingFuzzerAgent.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243885 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, fix iOS build with recent SDKs.
cdumez@apple.com [Thu, 4 Apr 2019 18:45:10 +0000 (18:45 +0000)]
Unreviewed, fix iOS build with recent SDKs.

std::ptr_fun() is deprecated.

* platform/ios/LegacyTileGrid.mm:
(WebCore::LegacyTileGrid::dropDistantTiles):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243884 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[css-grid] Scroll reset position when updating inner html on content
rego@igalia.com [Thu, 4 Apr 2019 17:55:22 +0000 (17:55 +0000)]
[css-grid] Scroll reset position when updating inner html on content
https://bugs.webkit.org/show_bug.cgi?id=191506

Unreviewed gardening.

The problem described in this bug was fixed in r243687 (webkit.org/b/191506).
This test was still marked as Failure but it has been passing since then.

* TestExpectations: Remove fast/css-grid-layout/grid-item-scroll-position.html
as it's passing now.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243883 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoscrollingcoordinator/ios/ui-scroll-fixed.html is a flakky failure
sroberts@apple.com [Thu, 4 Apr 2019 17:49:51 +0000 (17:49 +0000)]
scrollingcoordinator/ios/ui-scroll-fixed.html is a flakky failure
https://bugs.webkit.org/show_bug.cgi?id=196612

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations: Changing expectations for flaky image failure

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243881 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoService Worker Process does not have the right domain name
youenn@apple.com [Thu, 4 Apr 2019 17:44:16 +0000 (17:44 +0000)]
Service Worker Process does not have the right domain name
https://bugs.webkit.org/show_bug.cgi?id=196585

Reviewed by Chris Dumez.

* Shared/EntryPointUtilities/Cocoa/XPCService/XPCServiceEntryPoint.mm:
(WebKit::XPCServiceInitializerDelegate::getExtraInitializationData):
Updated extraInitializationData to go from "security-origin" to "registrable-domain".

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243880 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[Win] DumpRenderTreeWatchDog.py is not checked into source
pvollan@apple.com [Thu, 4 Apr 2019 17:39:48 +0000 (17:39 +0000)]
[Win] DumpRenderTreeWatchDog.py is not checked into source
https://bugs.webkit.org/show_bug.cgi?id=196567
<rdar://problem/49525901>

Reviewed by Lucas Forschler.

This script is used on Win EWS bots to terminate hanging DRT processes.

* EWSTools/dumprendertreewatchdog.py: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243879 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[macOS WK1] Layout Test webanimations/accelerated-transition-interrupted-on-composite...
commit-queue@webkit.org [Thu, 4 Apr 2019 17:39:32 +0000 (17:39 +0000)]
[macOS WK1] Layout Test webanimations/accelerated-transition-interrupted-on-composited-element.html is a flaky image failure
https://bugs.webkit.org/show_bug.cgi?id=189678
<rdar://problem/44621674>

Patch by Antoine Quint <graouts@apple.com> on 2019-04-04
Reviewed by Dean Jackson.

We make the test sturdier by waiting for two rAFs instead of just one to wait until animations have been updated (one rAF)
and accelerated animations have been committed (two rAFs).

We also use the "transitioncancel" event to determine the transition has been interrupted rather than using a rAF callback.

* webanimations/accelerated-transition-interrupted-on-composited-element.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243878 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoTemporarily disable delayed WebProcess launch on iOS to address PLT regression
cdumez@apple.com [Thu, 4 Apr 2019 17:36:20 +0000 (17:36 +0000)]
Temporarily disable delayed WebProcess launch on iOS to address PLT regression
https://bugs.webkit.org/show_bug.cgi?id=196604
<rdar://problem/49074131>

Reviewed by Geoffrey Garen.

Temporarily disable delayed WebProcess launch on iOS to address PLT regression. This
is while I figure out how to enable this on iOS without regressed PLT.

* UIProcess/WebProcessPool.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243877 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[JSC] We should consider moving UnlinkedFunctionExecutable::m_parentScopeTDZVariables...
ticaiolima@gmail.com [Thu, 4 Apr 2019 17:21:15 +0000 (17:21 +0000)]
[JSC] We should consider moving UnlinkedFunctionExecutable::m_parentScopeTDZVariables to RareData
https://bugs.webkit.org/show_bug.cgi?id=194944

Reviewed by Keith Miller.

JSTests:

* stress/verify-bytecode-generator-cached-variables-under-tdz.js: Added.

Source/JavaScriptCore:

Based on profile data collected on JetStream2, Speedometer 2 and
other benchmarks, it is very rare having non-empty
UnlinkedFunctionExecutable::m_parentScopeTDZVariables.

- Data collected from Speedometer2
    Total number of UnlinkedFunctionExecutable: 39463
    Total number of non-empty parentScopeTDZVars: 428 (~1%)

- Data collected from JetStream2
    Total number of UnlinkedFunctionExecutable: 83715
    Total number of non-empty parentScopeTDZVars: 5285 (~6%)

We also collected numbers on 6 of top 10 Alexia sites.

- Data collected from youtube.com
    Total number of UnlinkedFunctionExecutable: 29599
    Total number of non-empty parentScopeTDZVars: 97 (~0.3%)

- Data collected from twitter.com
    Total number of UnlinkedFunctionExecutable: 23774
    Total number of non-empty parentScopeTDZVars: 172 (~0.7%)

- Data collected from google.com
    Total number of UnlinkedFunctionExecutable: 33209
    Total number of non-empty parentScopeTDZVars: 174 (~0.5%)

- Data collected from amazon.com:
    Total number of UnlinkedFunctionExecutable: 15182
    Total number of non-empty parentScopeTDZVars: 166 (~1%)

- Data collected from facebook.com:
    Total number of UnlinkedFunctionExecutable: 54443
    Total number of non-empty parentScopeTDZVars: 269 (~0.4%)

- Data collected from netflix.com:
    Total number of UnlinkedFunctionExecutable: 39266
    Total number of non-empty parentScopeTDZVars: 97 (~0.2%)

Considering such numbers, this patch is moving `m_parentScopeTDZVariables`
to RareData. This decreases sizeof(UnlinkedFunctionExecutable) by
16 bytes. With this change, now UnlinkedFunctionExecutable constructors
receives an `Optional<VariableEnvironmentMap::Handle>` and only stores
it when `value != WTF::nullopt`. We also changed
UnlinkedFunctionExecutable::parentScopeTDZVariables() and it returns
`VariableEnvironment()` whenever the Executable doesn't have RareData,
or VariableEnvironmentMap::Handle is unitialized. This is required
because RareData is instantiated when any of its field is stored and
we can have an unitialized `Handle` even on cases when parentScopeTDZVariables
is `WTF::nullopt`.

Results on memory usage on JetStrem2 is neutral.

    Mean of memory peak on ToT: 4258633728 bytes (confidence interval: 249720072.95)
    Mean of memory peak on Changes: 4367325184 bytes (confidence interval: 321285583.61)

* builtins/BuiltinExecutables.cpp:
(JSC::BuiltinExecutables::createExecutable):
* bytecode/UnlinkedFunctionExecutable.cpp:
(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
* bytecode/UnlinkedFunctionExecutable.h:
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::getVariablesUnderTDZ):

BytecodeGenerator::getVariablesUnderTDZ now also caches if m_cachedVariablesUnderTDZ
is empty, so we can properly return `WTF::nullopt` without the
reconstruction of a VariableEnvironment to check if it is empty.

* bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::makeFunction):
* parser/VariableEnvironment.h:
(JSC::VariableEnvironment::isEmpty const):
* runtime/CachedTypes.cpp:
(JSC::CachedCompactVariableMapHandle::decode const):

It returns an unitialized Handle when there is no
CompactVariableEnvironment. This can happen when RareData is ensured
because of another field.

(JSC::CachedFunctionExecutableRareData::encode):
(JSC::CachedFunctionExecutableRareData::decode const):
(JSC::CachedFunctionExecutable::encode):
(JSC::CachedFunctionExecutable::decode const):
(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
* runtime/CodeCache.cpp:

Instead of creating a dummyVariablesUnderTDZ, we simply pass
WTF::nullopt.

(JSC::CodeCache::getUnlinkedGlobalFunctionExecutable):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243875 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoLog the error if VideoProcessing library cannot be dlopen
youenn@apple.com [Thu, 4 Apr 2019 16:52:02 +0000 (16:52 +0000)]
Log the error if VideoProcessing library cannot be dlopen
https://bugs.webkit.org/show_bug.cgi?id=196609

Reviewed by Eric Carlson.

* Source/webrtc/sdk/WebKit/VideoProcessingSoftLink.cpp:
(webrtc::initVideoProcessingVPModuleInitialize):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243873 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[WPE] Unreviewed gardening
dpino@igalia.com [Thu, 4 Apr 2019 16:51:31 +0000 (16:51 +0000)]
[WPE] Unreviewed gardening

Remove tests that are expected to fail but pass.

* platform/wpe/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243872 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoREGRESSION (r236501?): Layout Test compositing/geometry/limit-layer-bounds-opacity...
commit-queue@webkit.org [Thu, 4 Apr 2019 16:38:50 +0000 (16:38 +0000)]
REGRESSION (r236501?): Layout Test compositing/geometry/limit-layer-bounds-opacity-transition.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=190210
<rdar://problem/45045989>

Unreviewed.

The flakiness dashboard shows that this test hasn't been flaky for a few weeks, reverting the flaky expectation.

Patch by Antoine Quint <graouts@apple.com> on 2019-04-04

* platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243871 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, roll out r243858 which made tests time out.
cdumez@apple.com [Thu, 4 Apr 2019 15:44:37 +0000 (15:44 +0000)]
Unreviewed, roll out r243858 which made tests time out.

Disable new API tests on Windows instead.

* TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp:
(TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243870 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoCache bytecode for jsc.cpp helpers and fix CachedStringImpl
tzagallo@apple.com [Thu, 4 Apr 2019 15:41:07 +0000 (15:41 +0000)]
Cache bytecode for jsc.cpp helpers and fix CachedStringImpl
https://bugs.webkit.org/show_bug.cgi?id=196409

Reviewed by Saam Barati.

JSTests:

* stress/bytecode-cache-cached-string-impl.js: Added.
(f):
(g):
* stress/bytecode-cache-run-string.js: Added.

Source/JavaScriptCore:

Some of the helpers in jsc.cpp, such as `functionRunString`, were stll using
using `makeSource` instead of `jscSource`, which does not use the ShellSourceProvider
and therefore does not write the bytecode cache to disk.

Changing that revealed a bug in bytecode cache. The Encoder keeps a mapping
of pointers to offsets of already cached objects, in order to avoid caching
the same object twice. Similarly, the Decoder keeps a mapping from offsets
to pointers, in order to avoid creating multiple objects in memory for the
same cached object. The following was happening:
1) A StringImpl* S was cached as CachedPtr<CachedStringImpl> at offset O. We add
an entry in the Encoder mapping that S has already been encoded at O.
2) We cache StringImpl* S again, but now as CachedPtr<CachedUniquedStringImpl>.
We find an entry in the Encoder mapping for S, and return the offset O. However,
the object cached at O is a CachedPtr<CachedStringImpl> (i.e. not Uniqued).

3) When decoding, there are 2 possibilities:
3.1) We find S for the first time through a CachedPtr<CachedStringImpl>. In
this case, everything works as expected since we add an entry in the decoder
mapping from the offset O to the decoded StringImpl* S. The next time we find
S through the uniqued version, we'll return the already decoded S.
3.2) We find S through a CachedPtr<CachedUniquedStringImpl>. Now we have a
problem, since the CachedPtr has the offset of a CachedStringImpl (not uniqued),
which has a different shape and we crash.

We fix this by making CachedStringImpl and CachedUniquedStringImpl share the
same implementation. Since it doesn't matter whether a string is uniqued for
encoding, and we always decode strings as uniqued either way, they can be used
interchangeably.

* jsc.cpp:
(functionRunString):
(functionLoadString):
(functionDollarAgentStart):
(functionCheckModuleSyntax):
(runInteractive):
* runtime/CachedTypes.cpp:
(JSC::CachedUniquedStringImplBase::decode const):
(JSC::CachedFunctionExecutable::rareData const):
(JSC::CachedCodeBlock::rareData const):
(JSC::CachedFunctionExecutable::encode):
(JSC::CachedCodeBlock<CodeBlockType>::encode):
(JSC::CachedUniquedStringImpl::encode): Deleted.
(JSC::CachedUniquedStringImpl::decode const): Deleted.
(JSC::CachedStringImpl::encode): Deleted.
(JSC::CachedStringImpl::decode const): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243869 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[Web Animations] JS wrapper may be deleted while animation is yet to dispatch its...
commit-queue@webkit.org [Thu, 4 Apr 2019 14:16:05 +0000 (14:16 +0000)]
[Web Animations] JS wrapper may be deleted while animation is yet to dispatch its finish event
https://bugs.webkit.org/show_bug.cgi?id=196118
<rdar://problem/46614137>

Patch by Antoine Quint <graouts@apple.com> on 2019-04-04
Reviewed by Ryosuke Niwa.

Source/WebCore:

Test: webanimations/js-wrapper-kept-alive.html

We need to teach WebAnimation to keep its JS wrapper alive if it's relevant or could become relevant again by virtue of having a timeline.

* animation/WebAnimation.cpp:
(WebCore::WebAnimation::stop): Drive-by fix for the missing superclass method call.
(WebCore::WebAnimation::hasPendingActivity const):
* animation/WebAnimation.h:

LayoutTests:

Add a test that starts a short animation, sets a custom property on it, registers a "finish" event listener on it and deletes
the sole reference to it in the JS world before triggering garbage collection. Prior to this fix, this test would time out
because the JS wrapper would be garbage-collected prior to the animation completing and thus the event listener would not
be called. To complete successfully, this test checks that it receives the event and its target is the same animation object
that was originally created by checking the custom property is still set.

* legacy-animation-engine/animations/resume-after-page-cache.html:
* webanimations/js-wrapper-kept-alive-expected.txt: Added.
* webanimations/js-wrapper-kept-alive.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243868 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnlinkedCodeBlock constructor from cache should initialize m_didOptimize
tzagallo@apple.com [Thu, 4 Apr 2019 14:15:20 +0000 (14:15 +0000)]
UnlinkedCodeBlock constructor from cache should initialize m_didOptimize
https://bugs.webkit.org/show_bug.cgi?id=196396

Reviewed by Saam Barati.

The UnlinkedCodeBlock constructor in CachedTypes was missing the initialization
for m_didOptimize, which leads to crashes in CodeBlock::thresholdForJIT.

* runtime/CachedTypes.cpp:
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243867 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[GTK][WPE] Use a timer to request the creation of pending tiles
magomez@igalia.com [Thu, 4 Apr 2019 12:51:43 +0000 (12:51 +0000)]
[GTK][WPE] Use a timer to request the creation of pending tiles
https://bugs.webkit.org/show_bug.cgi?id=196594

Reviewed by Žan Doberšek.

Use a timer to request pending tile creation, as calls to notifyFlushRequired() are discarded
while inside a layer flush.

* platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
(WebCore::CoordinatedGraphicsLayer::CoordinatedGraphicsLayer):
(WebCore::CoordinatedGraphicsLayer::flushCompositingStateForThisLayerOnly):
(WebCore::CoordinatedGraphicsLayer::updateContentBuffers):
(WebCore::CoordinatedGraphicsLayer::requestPendingTileCreationTimerFired):
* platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243866 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[CoordGraphics] Revalidate need for 'coordinated update completion' in ThreadedCompositor
magomez@igalia.com [Thu, 4 Apr 2019 08:53:36 +0000 (08:53 +0000)]
[CoordGraphics] Revalidate need for 'coordinated update completion' in ThreadedCompositor
https://bugs.webkit.org/show_bug.cgi?id=188839

Reviewed by Žan Doberšek.

Even if a platform layer has changed, don't wait for a main thread callback to finish the
CompositingRunLoop update. It can be finished as soon as we receive the frameComplete signal.

* Shared/CoordinatedGraphics/threadedcompositor/CompositingRunLoop.cpp:
(WebKit::CompositingRunLoop::scheduleUpdate):
(WebKit::CompositingRunLoop::stopUpdates):
(WebKit::CompositingRunLoop::updateCompleted):
(WebKit::CompositingRunLoop::updateTimerFired):
(WebKit::CompositingRunLoop::compositionCompleted): Deleted.
* Shared/CoordinatedGraphics/threadedcompositor/CompositingRunLoop.h:
* Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:
(WebKit::ThreadedCompositor::renderLayerTree):
(WebKit::ThreadedCompositor::sceneUpdateFinished):
(WebKit::ThreadedCompositor::displayRefreshMonitor):
(WebKit::ThreadedCompositor::handleDisplayRefreshMonitorUpdate): Deleted.
* Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.h:
* WebProcess/WebPage/CoordinatedGraphics/LayerTreeHost.cpp:
(WebKit::LayerTreeHost::handleDisplayRefreshMonitorUpdate):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243865 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ATK] Wrong index passed to AtkObject::children-changed::add signal in AXObjectCache...
carlosgc@webkit.org [Thu, 4 Apr 2019 05:53:30 +0000 (05:53 +0000)]
[ATK] Wrong index passed to AtkObject::children-changed::add signal in AXObjectCache::attachWrapper()
https://bugs.webkit.org/show_bug.cgi?id=196538

Reviewed by Michael Catanzaro.

In most of the cases the parent is not found, probably because the child is not a direct descendant of the
parent returned by parentObjectUnignored(). We need to handle the case of find() returning notFound.

* accessibility/atk/AXObjectCacheAtk.cpp:
(WebCore::AXObjectCache::attachWrapper): Use -1 as the index when find() returns notFound.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243864 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ATK] Cleanup WebPageAccessibilityObjectAtk
carlosgc@webkit.org [Thu, 4 Apr 2019 05:52:44 +0000 (05:52 +0000)]
[ATK] Cleanup WebPageAccessibilityObjectAtk
https://bugs.webkit.org/show_bug.cgi?id=196537

Reviewed by Michael Catanzaro.

Source/WebKit:

Several changes and cleanups:

 - Add WebKit prefix so that style checker doesn't complain about GObject conventions.
 - Rename the header to remove the Atk prefix to match the cpp file and class name.
 - Use pragma once.
 - Use nullptr instead of 0.
 - Use WEBKIT_DEFINE_TYPE instead of G_DEFINE_TYPE.
 - Return generic AtkObject* from constructor.

* SourcesGTK.txt:
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/atk/WebKitWebPageAccessibilityObject.cpp: Renamed from Source/WebKit/WebProcess/WebPage/atk/WebPageAccessibilityObjectAtk.cpp.
(accessibilityRootObjectWrapper):
(webkitWebPageAccessibilityObjectInitialize):
(webkitWebPageAccessibilityObjectGetIndexInParent):
(webkitWebPageAccessibilityObjectGetNChildren):
(webkitWebPageAccessibilityObjectRefChild):
(webkit_web_page_accessibility_object_class_init):
(webkitWebPageAccessibilityObjectNew):
(webkitWebPageAccessibilityObjectRefresh):
* WebProcess/WebPage/atk/WebKitWebPageAccessibilityObject.h: Added.
* WebProcess/WebPage/atk/WebPageAccessibilityObject.h: Removed.
* WebProcess/WebPage/gtk/WebPageGtk.cpp:
(WebKit::WebPage::platformInitialize):
(WebKit::WebPage::updateAccessibilityTree):

Tools:

Also consider files under atk directories as exceptions for GObject conventions.

* Scripts/webkitpy/style/checkers/cpp.py:
(check_identifier_name_in_declaration):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243863 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ATK] Set ATK_STATE_TRANSIENT on the atk socket until it's embedded
carlosgc@webkit.org [Thu, 4 Apr 2019 05:51:37 +0000 (05:51 +0000)]
[ATK] Set ATK_STATE_TRANSIENT on the atk socket until it's embedded
https://bugs.webkit.org/show_bug.cgi?id=196535

Reviewed by Michael Catanzaro.

This way the properties are not cached. Right now, if number of children is queried before the socket is
embedded, 0 is returned and cached, so ATs don't see the child even after the socket has been embedded.

* UIProcess/API/gtk/WebKitWebViewBaseAccessible.cpp:
(webkitWebViewBaseAccessibleRefStateSet): Set ATK_STATE_TRANSIENT is the socket is not occupied.
* UIProcess/gtk/WebPageProxyGtk.cpp:
(WebKit::WebPageProxy::bindAccessibilityTree): Unset ATK_STATE_TRANSIENT.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243862 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ATK] Embed the AtkSocket as soon as we receive the plug ID
carlosgc@webkit.org [Thu, 4 Apr 2019 05:50:22 +0000 (05:50 +0000)]
[ATK] Embed the AtkSocket as soon as we receive the plug ID
https://bugs.webkit.org/show_bug.cgi?id=196534

Reviewed by Michael Catanzaro.

We are currently storing the ID and waiting for the next time get_accessible is called to embed the socket. We
can simply embed the socket when the plug ID is received.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseGetAccessible):
* UIProcess/WebPageProxy.h:
* UIProcess/gtk/WebPageProxyGtk.cpp:
(WebKit::WebPageProxy::bindAccessibilityTree):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243861 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ATK] Don't touch accessibility tree in WebFrameLoaderClient::dispatchDidClearWindowO...
carlosgc@webkit.org [Thu, 4 Apr 2019 05:48:20 +0000 (05:48 +0000)]
[ATK] Don't touch accessibility tree in WebFrameLoaderClient::dispatchDidClearWindowObjectInWorld
https://bugs.webkit.org/show_bug.cgi?id=193914

Reviewed by Michael Catanzaro.

Move it to dispatchDidFinishDocumentLoad, since we know we have the document at that point and we can create the
root accessibility object wrapper.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchDidFinishDocumentLoad):
(WebKit::WebFrameLoaderClient::dispatchDidClearWindowObjectInWorld):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243860 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUpdate AutoFill field icons to be SVG instead of PNG images.
timothy@apple.com [Thu, 4 Apr 2019 05:47:44 +0000 (05:47 +0000)]
Update AutoFill field icons to be SVG instead of PNG images.
https://bugs.webkit.org/show_bug.cgi?id=196557
rdar://problem/48292514

Reviewed by Tim Horton.

Source/WebCore:

* css/html.css:
(input::-webkit-credentials-auto-fill-button):
(input::-webkit-contacts-auto-fill-button):
(input::-webkit-credit-card-auto-fill-button):

LayoutTests:

* platform/ios/fast/forms/auto-fill-button/input-auto-fill-button-expected.txt:
* platform/mac/fast/forms/auto-fill-button/input-contacts-auto-fill-button-expected.txt:
* platform/win/fast/forms/auto-fill-button/input-auto-fill-button-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243859 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoThe page's focusedFrame / frameSetLargestFrame do not get cleared on process swap...
Hironori.Fujii@sony.com [Thu, 4 Apr 2019 05:44:01 +0000 (05:44 +0000)]
The page's focusedFrame / frameSetLargestFrame do not get cleared on process swap or crash
https://bugs.webkit.org/show_bug.cgi?id=196588
<rdar://problem/49365787>

Unreviewed build fix for Windows port.

error C3861: 'kill': identifier not found

* TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp:
(TestWebKitAPI::TEST): Replaced kill with WKPageTerminate.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243858 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, rolling in r243843 with the build fix
ysuzuki@apple.com [Thu, 4 Apr 2019 05:27:25 +0000 (05:27 +0000)]
Unreviewed, rolling in r243843 with the build fix
https://bugs.webkit.org/show_bug.cgi?id=196586

* runtime/Options.cpp:
(JSC::recomputeDependentOptions):
* runtime/Options.h:
* runtime/RandomizingFuzzerAgent.cpp:
(JSC::RandomizingFuzzerAgent::getPrediction):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243857 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoSimplify some "programmaticScroll" code paths
simon.fraser@apple.com [Thu, 4 Apr 2019 03:57:22 +0000 (03:57 +0000)]
Simplify some "programmaticScroll" code paths
https://bugs.webkit.org/show_bug.cgi?id=196589

Reviewed by Zalan Bujtas.

Source/WebCore:

AsyncScrollingCoordinator::scheduleUpdateScrollPositionAfterAsyncScroll() just returned early if programmaticScroll
was true, so instead, just never call it. This means we can remove the "programmaticScroll" argument from
scheduleUpdateScrollPositionAfterAsyncScroll(). Also change some callers to use the ScrollType enum
instead of a bool.

Now, ThreadedScrollingTree::scrollingTreeNodeDidScroll() just returns early. Programmatic scrolls
update state on the main thread before updating the scrolling tree, so this makes sense.

* page/scrolling/AsyncScrollingCoordinator.cpp:
(WebCore::AsyncScrollingCoordinator::requestScrollPositionUpdate):
(WebCore::AsyncScrollingCoordinator::scheduleUpdateScrollPositionAfterAsyncScroll):
(WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScrollTimerFired):
(WebCore::AsyncScrollingCoordinator::updateScrollPositionAfterAsyncScroll):
(WebCore::AsyncScrollingCoordinator::reconcileScrollingState):
* page/scrolling/AsyncScrollingCoordinator.h:
(WebCore::AsyncScrollingCoordinator::ScheduledScrollUpdate::ScheduledScrollUpdate):
(WebCore::AsyncScrollingCoordinator::ScheduledScrollUpdate::matchesUpdateType const):
* page/scrolling/ScrollingCoordinator.cpp:
(WebCore::operator<<):
* page/scrolling/ScrollingCoordinator.h:
(WebCore::ScrollingCoordinator::reconcileScrollingState):
* page/scrolling/ThreadedScrollingTree.cpp:
(WebCore::ThreadedScrollingTree::scrollingTreeNodeDidScroll):

Source/WebKit:

* WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.mm: Remove the parameter.
(WebKit::RemoteScrollingCoordinator::scrollPositionChangedForNode): Use the enum type.
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::updateVisibleContentRects):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243855 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ews-build] Cancel build and similar operations should have authentication
aakash_jain@apple.com [Thu, 4 Apr 2019 03:57:11 +0000 (03:57 +0000)]
[ews-build] Cancel build and similar operations should have authentication
https://bugs.webkit.org/show_bug.cgi?id=196520

Reviewed by Dewei Zhu.

* BuildSlaveSupport/ews-build/master.cfg: Configure authentication using admin's username and password from
environment variables.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243854 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, rolling out r243843.
ryanhaddad@apple.com [Thu, 4 Apr 2019 03:44:18 +0000 (03:44 +0000)]
Unreviewed, rolling out r243843.

Broke CLoop and Windows builds.

Reverted changeset:

"[JSC] Add dump feature for RandomizingFuzzerAgent"
https://bugs.webkit.org/show_bug.cgi?id=196586
https://trac.webkit.org/changeset/243843

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243853 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ews-build] Do not trigger queues which are not in production yet
aakash_jain@apple.com [Thu, 4 Apr 2019 03:38:01 +0000 (03:38 +0000)]
[ews-build] Do not trigger queues which are not in production yet
https://bugs.webkit.org/show_bug.cgi?id=196581

Reviewed by Dewei Zhu.

* BuildSlaveSupport/ews-build/config.json:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243852 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoB3 should use associativity to optimize expression trees
rmorisset@apple.com [Thu, 4 Apr 2019 03:37:23 +0000 (03:37 +0000)]
B3 should use associativity to optimize expression trees
https://bugs.webkit.org/show_bug.cgi?id=194081

Reviewed by Filip Pizlo.

JSTests:

Added three microbenchmarks:
- add-tree should be the ideal case, but there is no speedup because we are currently unable to prove that the CheckAdd won't overflow
- bit-xor-tree most closely matches the situation where the optimization triggers on the JetStream2 subtests where it triggers:
  an unbalanced expression tree of size 8 that can be balanced, with no other optimizations being unlocked. 16% speedup
- bit-or-tree is an ideal case, where the reassociation also enables a ton of further simplifications. 42% speedup

* microbenchmarks/add-tree.js: Added.
* microbenchmarks/bit-or-tree.js: Added.
* microbenchmarks/bit-xor-tree.js: Added.

Source/JavaScriptCore:

This patch adds a new B3 pass, that tries to find and optimize expression trees made purely of any one associative and commutative operator (Add/Mul/BitOr/BitAnd/BitXor).
The pass only runs in O2, and runs once, after lowerMacros and just before a run of B3ReduceStrength (which helps clean up the dead code it tends to leave behind).
I had to separate killDeadCode out of B3ReduceStrength (as a new B3EliminateDeadCode pass) to run it before B3OptimizeAssociativeExpressionTrees, as otherwise it is stopped by high use counts
inherited from CSE.
This extra run of DCE is by itself a win, most notably on microbenchmarks/instanceof-always-hit-two (1.5x faster), and on microbenchmarks/licm-dragons(-out-of-bounds) (both get 1.16x speedup).
I suspect it is because it runs between CSE and tail-dedup, and as a result allows a lot more tail-dedup to occur.

The pass is currently extremely conservative, not trying anything if it would cause _any_ code duplication.
For this purpose, it starts by computing use counts for the potentially interesting nodes (those with the right opcodes), and segregate them into expression trees.
The root of an expression tree is a node that is either used in multiple places, or is used by a value with a different opcode.
The leaves of an expression tree are nodes that are either used in multiple places, or have a different opcode.
All constant leaves of a tree are combined, as well as all leaves that are identical. What remains is then laid out into a balanced binary tree, hopefully maximizing ILP.

This optimization was implemented as a stand-alone pass and not as part of B3ReduceStrength mostly because it needs use counts to avoid code duplication.
It also benefits from finding all tree roots first, and not trying to repeatedly optimize subtrees.

I added several tests to testB3 with varying patterns of trees. It is also tested in a less focused way by lots of older tests.

In the future this pass could be expanded to allow some bounded amount of code duplication, and merging more leaves (e.g. Mul(a, 3) and a in an Add tree, into Mul(a, 4))
The latter will need exposing the peephole optimizations out of B3ReduceStrength to avoid duplicating code.

* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* b3/B3Common.cpp:
(JSC::B3::shouldDumpIR):
(JSC::B3::shouldDumpIRAtEachPhase):
* b3/B3Common.h:
* b3/B3EliminateDeadCode.cpp: Added.
(JSC::B3::EliminateDeadCode::run):
(JSC::B3::eliminateDeadCode):
* b3/B3EliminateDeadCode.h: Added.
(JSC::B3::EliminateDeadCode::EliminateDeadCode):
* b3/B3Generate.cpp:
(JSC::B3::generateToAir):
* b3/B3OptimizeAssociativeExpressionTrees.cpp: Added.
(JSC::B3::OptimizeAssociativeExpressionTrees::OptimizeAssociativeExpressionTrees):
(JSC::B3::OptimizeAssociativeExpressionTrees::neutralElement):
(JSC::B3::OptimizeAssociativeExpressionTrees::isAbsorbingElement):
(JSC::B3::OptimizeAssociativeExpressionTrees::combineConstants):
(JSC::B3::OptimizeAssociativeExpressionTrees::emitValue):
(JSC::B3::OptimizeAssociativeExpressionTrees::optimizeRootedTree):
(JSC::B3::OptimizeAssociativeExpressionTrees::run):
(JSC::B3::optimizeAssociativeExpressionTrees):
* b3/B3OptimizeAssociativeExpressionTrees.h: Added.
* b3/B3ReduceStrength.cpp:
* b3/B3Value.cpp:
(JSC::B3::Value::replaceWithIdentity):
* b3/testb3.cpp:
(JSC::B3::testBitXorTreeArgs):
(JSC::B3::testBitXorTreeArgsEven):
(JSC::B3::testBitXorTreeArgImm):
(JSC::B3::testAddTreeArg32):
(JSC::B3::testMulTreeArg32):
(JSC::B3::testBitAndTreeArg32):
(JSC::B3::testBitOrTreeArg32):
(JSC::B3::run):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243851 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoAdd logging and ASSERTs to investigate issue with VPModuleInitialize
youenn@apple.com [Thu, 4 Apr 2019 03:34:53 +0000 (03:34 +0000)]
Add logging and ASSERTs to investigate issue with VPModuleInitialize
https://bugs.webkit.org/show_bug.cgi?id=196573

Reviewed by Eric Carlson.

Source/ThirdParty/libwebrtc:

Expand macros directly to add some logging.
Removed the dispatch_once since VPModuleInitialize is already called in one.

* Source/webrtc/sdk/WebKit/VideoProcessingSoftLink.cpp:
(webrtc::initVideoProcessingVPModuleInitialize):

Source/WebCore:

Add some ASSERTs.
No change of behavior.

* platform/mediastream/libwebrtc/LibWebRTCProviderCocoa.cpp:
(WebCore::LibWebRTCProviderCocoa::createDecoderFactory):
(WebCore::LibWebRTCProviderCocoa::createEncoderFactory):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243850 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoUnreviewed, fix typo in the name of API test added in r243848.
cdumez@apple.com [Thu, 4 Apr 2019 03:23:11 +0000 (03:23 +0000)]
Unreviewed, fix typo in the name of API test added in r243848.

* TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp:
(TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243849 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoThe page's focusedFrame / frameSetLargestFrame do not get cleared on process swap...
cdumez@apple.com [Thu, 4 Apr 2019 03:09:48 +0000 (03:09 +0000)]
The page's focusedFrame / frameSetLargestFrame do not get cleared on process swap or crash
https://bugs.webkit.org/show_bug.cgi?id=196588
<rdar://problem/49365787>

Reviewed by Ryosuke Niwa.

Source/WebKit:

The page's focusedFrame / frameSetLargestFrame do not get cleared on process swap or crash.
This can lead to returning stale frames to the client if it asks for those.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::resetState):

Tools:

Add API test coverage.

* TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp:
(TestWebKitAPI::nullJavaScriptCallback):
(TestWebKitAPI::didCrashCheckFrames):
(TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243848 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoRemove the isProgrammaticScroll argument to requestScroll() because no-one uses it
simon.fraser@apple.com [Thu, 4 Apr 2019 02:53:02 +0000 (02:53 +0000)]
Remove the isProgrammaticScroll argument to requestScroll() because no-one uses it
https://bugs.webkit.org/show_bug.cgi?id=196587

Reviewed by Zalan Bujtas.

This argument was unused.

* UIProcess/API/gtk/PageClientImpl.cpp:
(WebKit::PageClientImpl::requestScroll):
* UIProcess/API/gtk/PageClientImpl.h:
* UIProcess/API/wpe/PageClientImpl.cpp:
(WebKit::PageClientImpl::requestScroll):
* UIProcess/API/wpe/PageClientImpl.h:
* UIProcess/PageClient.h:
* UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:
(WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree):
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::requestScroll):
* UIProcess/WebPageProxy.h:
* UIProcess/ios/PageClientImplIOS.h:
* UIProcess/ios/PageClientImplIOS.mm:
(WebKit::PageClientImpl::requestScroll):
* UIProcess/mac/PageClientImplMac.h:
* UIProcess/mac/PageClientImplMac.mm:
(WebKit::PageClientImpl::requestScroll):
* UIProcess/win/PageClientImpl.cpp:
(WebKit::PageClientImpl::requestScroll):
* UIProcess/win/PageClientImpl.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243847 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoRemove some redundant memebers from ScrollingStateFrameScrollingNode
simon.fraser@apple.com [Thu, 4 Apr 2019 02:52:58 +0000 (02:52 +0000)]
Remove some redundant memebers from ScrollingStateFrameScrollingNode
https://bugs.webkit.org/show_bug.cgi?id=196571

Reviewed by Zalan Bujtas.

m_requestedScrollPosition and m_requestedScrollPositionRepresentsProgrammaticScroll were
duplicated on ScrollingStateFrameScrollingNode and ScrollingStateScrollingNode, so
remove them from the derived class.

* page/scrolling/ScrollingStateFrameScrollingNode.cpp:
(WebCore::ScrollingStateFrameScrollingNode::ScrollingStateFrameScrollingNode):
(WebCore::ScrollingStateFrameScrollingNode::dumpProperties const):
* page/scrolling/ScrollingStateFrameScrollingNode.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243846 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoREGRESSION (r220717): Assertion fires when animating an SVG rounded corner rect till...
commit-queue@webkit.org [Thu, 4 Apr 2019 02:09:50 +0000 (02:09 +0000)]
REGRESSION (r220717): Assertion fires when animating an SVG rounded corner rect till it collapses
https://bugs.webkit.org/show_bug.cgi?id=196518

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2019-04-03
Reviewed by Simon Fraser.

Source/WebCore:

r220717 made RenderSVGRect clear its m_path in updateShapeFromElement().

RenderSVGRect tries to optimize its layout and drawing if the rectangle
is not rounded. So it uses the flag m_usePathFallback to know whether to
use m_path or m_innerStrokeRect and m_outerStrokeRect. If the rectangle
is rounded but its boundingSize is empty, m_path will be cleared,
m_innerStrokeRect and m_outerStrokeRect will be recalculated but
m_usePathFallback will not be reset to false. Therefore when calling
RenderSVGRect::isEmpty(), it will call RenderSVGShape::isEmpty() which
will assert since m_path is null.

Test: svg/animations/animate-rounded-corner-rect-zero-height.svg

* rendering/svg/RenderSVGRect.cpp:
(WebCore::RenderSVGRect::updateShapeFromElement):
Reset m_usePathFallback to false once clearPath() is called.

LayoutTests:

* svg/animations/animate-rounded-corner-rect-zero-height-expected.txt: Added.
* svg/animations/animate-rounded-corner-rect-zero-height.svg: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243845 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoNullptr crash in InlineTextBox::selectionState via TextIndicator::createWithRange
rniwa@webkit.org [Thu, 4 Apr 2019 02:01:07 +0000 (02:01 +0000)]
Nullptr crash in InlineTextBox::selectionState via TextIndicator::createWithRange
https://bugs.webkit.org/show_bug.cgi?id=196579

Reviewed by Simon Fraser.

Avoid crashing accessing the unengated optional's value in relese builds for now.

Unfortunately, fixing the underlying cause of the selection states of RenderView & RenderObject
getting out out of sync would require a significant re-architecturing of the whole selection
repainting / state managing mechanism.

* rendering/SelectionRangeData.h:
(WebCore::SelectionRangeData::startPosition const):
(WebCore::SelectionRangeData::endPosition const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243844 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[JSC] Add dump feature for RandomizingFuzzerAgent
ysuzuki@apple.com [Thu, 4 Apr 2019 01:28:49 +0000 (01:28 +0000)]
[JSC] Add dump feature for RandomizingFuzzerAgent
https://bugs.webkit.org/show_bug.cgi?id=196586

Reviewed by Saam Barati.

Towards deterministic tests for the results from randomizing fuzzer agent, this patch adds Options::dumpRandomizingFuzzerAgentPredictions, which dumps the generated types.
The results is like this.

    getPrediction name:(#C2q9xD),bytecodeIndex:(22),original:(Array),generated:(OtherObj|Array|Float64Array|BigInt|NonIntAsDouble)
    getPrediction name:(makeUnwriteableUnconfigurableObject#AiEJv1),bytecodeIndex:(14),original:(OtherObj),generated:(Final|Uint8Array|Float64Array|SetObject|WeakSetObject|BigInt|NonIntAsDouble)

* runtime/Options.cpp:
(JSC::recomputeDependentOptions):
* runtime/Options.h:
* runtime/RandomizingFuzzerAgent.cpp:
(JSC::RandomizingFuzzerAgent::getPrediction):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243843 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agorun-webkit-tests: Upload test results (new results database)
jbedard@apple.com [Thu, 4 Apr 2019 00:43:05 +0000 (00:43 +0000)]
run-webkit-tests: Upload test results (new results database)
https://bugs.webkit.org/show_bug.cgi?id=196577
<rdar://problem/34841155>

Reviewed by Lucas Forschler.

* Scripts/webkitpy/layout_tests/controllers/manager.py:
(Manager.run): Upload results after each device shard, since the configuration will be
different for each device.
(Manager._results_to_upload_json_trie): Convert a TestRunResults object to a trie to be
uploaded to a results database.
* Scripts/webkitpy/layout_tests/run_webkit_tests.py:
(parse_args): Add new 'Upload Options' and prepare 'Results JSON Options' for deprecation.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243842 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago-apple-trailing-word is needed for browser detection
mmaxfield@apple.com [Thu, 4 Apr 2019 00:16:24 +0000 (00:16 +0000)]
-apple-trailing-word is needed for browser detection
https://bugs.webkit.org/show_bug.cgi?id=196575

Unreviewed.

PerformanceTests:

* MotionMark/resources/debug-runner/motionmark.css:
(#intro .start-benchmark p):

Source/JavaScriptCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebCore:

This is an unreviewed partial revert of r243819. Turns out there are some websites
which use this property to do browser detection. So, we need to continue to parse
the property, but we don't need the property to do anything.

Test: fast/text/trailing-word-detection.html

* Configurations/FeatureDefines.xcconfig:
* css/CSSComputedStyleDeclaration.cpp:
(WebCore::ComputedStyleExtractor::valueForPropertyinStyle):
* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator TrailingWord const):
* css/CSSProperties.json:
* css/CSSValueKeywords.in:
* css/parser/CSSParserFastPaths.cpp:
(WebCore::CSSParserFastPaths::isValidKeywordPropertyAndValue):
(WebCore::CSSParserFastPaths::isKeywordPropertyID):
* rendering/style/RenderStyle.h:
(WebCore::RenderStyle::trailingWord const):
(WebCore::RenderStyle::setTrailingWord):
(WebCore::RenderStyle::initialTrailingWord):
* rendering/style/RenderStyleConstants.h:

Source/WebCore/PAL:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit:

* Configurations/FeatureDefines.xcconfig:

Source/WebKitLegacy/mac:

* Configurations/FeatureDefines.xcconfig:

Tools:

* TestWebKitAPI/Configurations/FeatureDefines.xcconfig:

LayoutTests:

* fast/text/trailing-word-detection-expected.txt: Added.
* fast/text/trailing-word-detection.html: Added.
* platform/gtk/TestExpectations:
* platform/win/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243841 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agotiled-drawing/scrolling/scroll-snap/scroll-snap-proximity-mainframe.html is a flaky...
sroberts@apple.com [Wed, 3 Apr 2019 23:57:51 +0000 (23:57 +0000)]
tiled-drawing/scrolling/scroll-snap/scroll-snap-proximity-mainframe.html is a flaky failure and timeout
https://bugs.webkit.org/show_bug.cgi?id=196115

Unreviewed test gardening.

* platform/mac-wk2/TestExpectations: Updating test expectations for flaky test

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243840 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoREGRESSION (r243642): com.apple.JavaScriptCore crash in JSC::RegExpObject::execInline
msaboff@apple.com [Wed, 3 Apr 2019 23:51:12 +0000 (23:51 +0000)]
REGRESSION (r243642): com.apple.JavaScriptCore crash in JSC::RegExpObject::execInline
https://bugs.webkit.org/show_bug.cgi?id=196477

Reviewed by Keith Miller.

Source/JavaScriptCore:

The problem here is that when we advance the index by 2 for a character class that only
has non-BMP characters, we might go past the end of the string.  This can happen for
greedy counted character classes that are part of a alternative where there is one
character to match after the greedy non-BMP character class.

The "do we have string left to match" check at the top of the JIT loop for the counted
character class checks to see if index is not equal to the string length.  For non-BMP
character classes, we need to check to see if there are at least 2 characters left.
Therefore we now temporarily add 1 to the current index before comparing.  This checks
to see if there are iat least 2 characters left to match, instead of 1.

* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
(JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):

LayoutTests:

Updated the test with a couple more test cases to test a few variants of this bug.
Also added a couple of non-greedy counted non-BMP character class tests that don't have
the bug just to be sure.

* js/regexp-unicode-expected.txt:
* js/script-tests/regexp-unicode.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243839 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoRemove unneeded libwebrtc files, this time all the files
youenn@apple.com [Wed, 3 Apr 2019 23:39:12 +0000 (23:39 +0000)]
Remove unneeded libwebrtc files, this time all the files
https://bugs.webkit.org/show_bug.cgi?id=196553

Reviewed by Eric Carlson.

* Source/third_party/boringssl/src/fuzz: Removed.
* Source/third_party/protobuf/csharp/keys: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243838 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoRemove unneeded libwebrtc files
youenn@apple.com [Wed, 3 Apr 2019 23:35:05 +0000 (23:35 +0000)]
Remove unneeded libwebrtc files
https://bugs.webkit.org/show_bug.cgi?id=196553

Reviewed by Eric Carlson.

* Source/third_party/boringssl/src/fuzz: Removed.
* Source/third_party/protobuf/csharp/keys: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243837 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoAdd a WebKit internal feature flag to always enable modern compatibility mode by...
wenson_hsieh@apple.com [Wed, 3 Apr 2019 23:30:15 +0000 (23:30 +0000)]
Add a WebKit internal feature flag to always enable modern compatibility mode by default
https://bugs.webkit.org/show_bug.cgi?id=196526
<rdar://problem/49532923>

Reviewed by Tim Horton.

Change UseModernCompatibilityModeByDefault from an internal preference to a debug preference, so that it may be
enabled for all apps on the system.

* Shared/WebPreferences.yaml:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243836 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[JSC] Exception verification crash on operationArrayIndexOfValueInt32OrContiguous
ysuzuki@apple.com [Wed, 3 Apr 2019 23:29:48 +0000 (23:29 +0000)]
[JSC] Exception verification crash on operationArrayIndexOfValueInt32OrContiguous
https://bugs.webkit.org/show_bug.cgi?id=196574

Reviewed by Saam Barati.

JSTests:

* stress/string-index-of-exception-check.js: Added.
(blurType):
(1.forEach):

Source/JavaScriptCore:

This patch adds missing exception check in operationArrayIndexOfValueInt32OrContiguous.

* dfg/DFGOperations.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243835 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoFix internal build after r243829
achristensen@apple.com [Wed, 3 Apr 2019 23:21:04 +0000 (23:21 +0000)]
Fix internal build after r243829
https://bugs.webkit.org/show_bug.cgi?id=196549

* NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(WebKit::NetworkSessionCocoa::NetworkSessionCocoa):
Some SDK's don't include this selector in the header.
Use NSSelectorFromString.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243834 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[CMake][WTF] Mirror XCode header directories
don.olmstead@sony.com [Wed, 3 Apr 2019 23:08:44 +0000 (23:08 +0000)]
[CMake][WTF] Mirror XCode header directories
https://bugs.webkit.org/show_bug.cgi?id=191662

Reviewed by Konstantin Tokarev.

.:

Add WTF_FRAMEWORK_HEADERS_DIR to place WTF headers into. Add frameworks/WTF.cmake
which creates an interface target which will populate dependencies for consumers.
This file is added here to support AppleWin internal builds which invoke CMake on
each directory.

* Source/cmake/WebKitFS.cmake:
* Source/cmake/frameworks/WTF.cmake: Added.

Source/JavaScriptCore:

Use WTFFramework as a dependency and include frameworks/WTF.cmake for AppleWin internal
builds.

* CMakeLists.txt:
* shell/CMakeLists.txt:

Source/WebCore:

Use WTFFramework as a dependency and include frameworks/WTF.cmake for AppleWin internal
builds.

* CMakeLists.txt:
* PlatformWin.cmake:

Source/WebDriver:

Use WTFFramework as a dependency.

* CMakeLists.txt:

Source/WebKit:

Use WTFFramework as a dependency and include frameworks/WTF.cmake for AppleWin internal
builds.

* CMakeLists.txt:

Source/WebKitLegacy:

Use WTFFramework as a dependency and include frameworks/WTF.cmake for AppleWin internal
builds.

* CMakeLists.txt:
* PlatformWin.cmake:

Source/WebKitLegacy/win:

* WebKitQuartzCoreAdditions/CMakeLists.txt:

Source/WTF:

Rename WTF forwarding header target to WTFFramework and update the install location
to WTF_FRAMEWORK_HEADERS_DIR.

* wtf/CMakeLists.txt:

Tools:

Use WTFFramework as a dependency and include frameworks/WTF.cmake for AppleWin internal
builds.

* CMakeLists.txt:
* DumpRenderTree/CMakeLists.txt:
* DumpRenderTree/PlatformWin.cmake:
* MiniBrowser/win/CMakeLists.txt:
* TestWebKitAPI/CMakeLists.txt:
* TestWebKitAPI/PlatformWin.cmake:
* WebKitTestRunner/PlatformGTK.cmake:
* WebKitTestRunner/PlatformWin.cmake:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243833 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[JSC] Add FuzzerAgent, which has a hooks to get feedback & inject fuzz data into JSC
ysuzuki@apple.com [Wed, 3 Apr 2019 22:24:47 +0000 (22:24 +0000)]
[JSC] Add FuzzerAgent, which has a hooks to get feedback & inject fuzz data into JSC
https://bugs.webkit.org/show_bug.cgi?id=196530

Reviewed by Saam Barati.

This patch adds FuzzerAgent interface and simple RandomizingFuzzerAgent to JSC.
This RandomizingFuzzerAgent returns random SpeculatedType for value profiling to find
the issues in JSC. The seed for randomization can be specified by seedOfRandomizingFuzzerAgent.

I ran this with seedOfRandomizingFuzzerAgent=1 last night and it finds 3 failures in the current JSC tests,
they should be fixed in subsequent patches.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::getPredictionWithoutOSRExit):
* runtime/FuzzerAgent.cpp: Added.
(JSC::FuzzerAgent::~FuzzerAgent):
(JSC::FuzzerAgent::getPrediction):
* runtime/FuzzerAgent.h: Added.
* runtime/JSGlobalObjectFunctions.cpp:
* runtime/Options.h:
* runtime/RandomizingFuzzerAgent.cpp: Added.
(JSC::RandomizingFuzzerAgent::RandomizingFuzzerAgent):
(JSC::RandomizingFuzzerAgent::getPrediction):
* runtime/RandomizingFuzzerAgent.h: Added.
* runtime/RegExpCachedResult.h:
* runtime/RegExpGlobalData.cpp:
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
(JSC::VM::fuzzerAgent const):
(JSC::VM::setFuzzerAgent):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243832 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoAvoid the use of WTF_EXTERN_C_BEGIN in NSMenuSPI.h
rniwa@webkit.org [Wed, 3 Apr 2019 22:16:57 +0000 (22:16 +0000)]
Avoid the use of WTF_EXTERN_C_BEGIN in NSMenuSPI.h
https://bugs.webkit.org/show_bug.cgi?id=196566

Reviewed by Timothy Hatcher.

* pal/spi/mac/NSMenuSPI.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243831 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoRemove SVG properties tear-off objects
commit-queue@webkit.org [Wed, 3 Apr 2019 22:07:59 +0000 (22:07 +0000)]
Remove SVG properties tear-off objects
https://bugs.webkit.org/show_bug.cgi?id=191237

Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2019-04-03
Reviewed by Simon Fraser.

This patch cleans the code from unused SVG sources and get rid off the
remaining SVG properties tear-off objects. Here are more details:

-- Remove the SVGAttributeAnimationController and move its code to the
   SVGAnimateElementBase. SVGAttributeAnimationController was introduced
   to allow animating the SVG properties whether they are backed by tear
   off objects or not. Since there will be no tear off objects anymore,
   one animation controller will be needed. But in this case, it will be
   better if we make SVGAnimateElementBase is the animation controller
   and make it manage the animator directly.

-- Remove SVGAttributeRegistry, SVGAttributeOwnerProxy and the virtual
   function SVGElement::attributeOwnerProxy(). Remove also all the
   overriding functions attributeOwnerProxy() from all the SVGElements.

-- Remove isKnownAttribute() from all the SVG header files except from
   four classes: SVGURIReference, SVGFitToViewBox, SVGLangSpace
   and SVGExternalResourcesRequired.

-- Remove all the SVG animated properties classifying functions from
   SVGElement. This is now handled by SVGPropertyRegistry.

-- There is no need for the enum AnimatedPropertyType anymore. The SVG
   property accessor knows its type, knows how to access it and know what
   animator it should be created for it.

* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* dom/Element.cpp:
(WebCore::Element::synchronizeAllAttributes const):
(WebCore::Element::synchronizeAttribute const):
(WebCore::Element::fastAttributeLookupAllowed const):
These functions are surprisingly marked 'const'. They were calling 'const'
functions in SVGElement and SVGElement was casting 'this' as non 'const'
before calling the non 'const' functions through the non 'const' 'this'
pointer. Change this by moving the casting to the Element functions.

* rendering/svg/RenderSVGResourceGradient.cpp:
(WebCore::RenderSVGResourceGradient::applyResource):
* rendering/svg/RenderSVGResourcePattern.cpp:
(WebCore::RenderSVGResourcePattern::applyResource):
* svg/SVGAElement.h:
* svg/SVGAltGlyphElement.h:
* svg/SVGAnimateElementBase.cpp:
(WebCore::SVGAnimateElementBase::SVGAnimateElementBase):
(WebCore::SVGAnimateElementBase::animator const):
(WebCore::SVGAnimateElementBase::hasInvalidCSSAttributeType const):
(WebCore::SVGAnimateElementBase::isDiscreteAnimator const):
(WebCore::SVGAnimateElementBase::setTargetElement):
(WebCore::SVGAnimateElementBase::setAttributeName):
(WebCore::SVGAnimateElementBase::resetAnimation):
(WebCore::SVGAnimateElementBase::calculateFromAndToValues):
(WebCore::SVGAnimateElementBase::calculateFromAndByValues):
(WebCore::SVGAnimateElementBase::calculateToAtEndOfDurationValue):
(WebCore::SVGAnimateElementBase::resetAnimatedType):
(WebCore::SVGAnimateElementBase::calculateAnimatedValue):
(WebCore::SVGAnimateElementBase::applyResultsToTarget):
(WebCore::SVGAnimateElementBase::clearAnimatedType):
(WebCore::SVGAnimateElementBase::calculateDistance):
(WebCore::SVGAnimateElementBase::attributeAnimationController): Deleted.
(WebCore::SVGAnimateElementBase::determineAnimatedPropertyType const): Deleted.
(WebCore::SVGAnimateElementBase::isAdditive const): Deleted.
* svg/SVGAnimateElementBase.h:
(WebCore::SVGAnimateElementBase::animatorIfExists const):
(WebCore::SVGAnimateElementBase::attributeAnimationControllerIfExists const): Deleted.
The order of the functions was changed to resemble the order of running
the animation:
  -- Setting the animation range
  -- Starting the animation
  -- Progressing the animation
  -- Applying the the progressed animaVal() to the target element
  -- Stopping the animation

* svg/SVGAnimateMotionElement.cpp:
(WebCore::SVGAnimateMotionElement::calculateDistance):
* svg/SVGAnimateMotionElement.h:
* svg/SVGAnimationElement.cpp:
(WebCore::SVGAnimationElement::calculateKeyTimesForCalcModePaced):
(WebCore::SVGAnimationElement::shouldApplyAnimation): Deleted.
* svg/SVGAnimationElement.h:
(WebCore::SVGAnimationElement::attributeRegistry): Deleted.
(WebCore::SVGAnimationElement::calculateDistance): Deleted.
* svg/SVGAttributeAnimationController.cpp: Removed.
* svg/SVGAttributeAnimationController.h: Removed.
* svg/SVGAttributeAnimationControllerBase.cpp: Removed.
* svg/SVGAttributeAnimationControllerBase.h: Removed.
* svg/SVGCircleElement.h:
* svg/SVGClipPathElement.h:
* svg/SVGComponentTransferFunctionElement.h:
* svg/SVGCursorElement.h:
* svg/SVGDefsElement.h:
* svg/SVGElement.cpp:
(WebCore::SVGElement::synchronizeAttribute):
(WebCore::SVGElement::synchronizeAllAttributes):
(WebCore::SVGElement::synchronizeAllAnimatedSVGAttribute):
(WebCore::createAttributeNameToAnimatedPropertyTypeMap): Deleted.
(WebCore::attributeNameToAnimatedPropertyTypeMap): Deleted.
(WebCore::createCSSPropertyWithSVGDOMNameToAnimatedPropertyTypeMap): Deleted.
(WebCore::cssPropertyWithSVGDOMNameToAnimatedPropertyTypeMap): Deleted.
(WebCore::SVGElement::animatedPropertyTypesForAttribute): Deleted.
(WebCore::SVGElement::synchronizeAnimatedSVGAttribute const): Deleted.
(WebCore::SVGElement::isAnimatableCSSProperty): Deleted.
(WebCore::SVGElement::isPresentationAttributeWithSVGDOM): Deleted.
* svg/SVGElement.h:
(WebCore::SVGElement::attributeOwnerProxy const): Deleted.
(WebCore::SVGElement::attributeRegistry): Deleted.
(WebCore::SVGElement::synchronizeAttribute): Deleted.
(WebCore::SVGElement::synchronizeAttributes): Deleted.
(WebCore::SVGElement::animatedTypes const): Deleted.
(WebCore::SVGElement::lookupAnimatedProperty const): Deleted.
(WebCore::SVGElement::lookupOrCreateAnimatedProperty): Deleted.
(WebCore::SVGElement::lookupOrCreateAnimatedProperties): Deleted.
(WebCore::SVGElement::isKnownAttribute): Deleted.
* svg/SVGEllipseElement.h:
* svg/SVGExternalResourcesRequired.h:
(WebCore::SVGExternalResourcesRequired::attributeRegistry): Deleted.
(WebCore::SVGExternalResourcesRequired::attributeOwnerProxy): Deleted.
* svg/SVGFEBlendElement.h:
* svg/SVGFEColorMatrixElement.h:
* svg/SVGFEComponentTransferElement.h:
* svg/SVGFECompositeElement.h:
* svg/SVGFEConvolveMatrixElement.h:
* svg/SVGFEDiffuseLightingElement.h:
* svg/SVGFEDisplacementMapElement.h:
* svg/SVGFEDropShadowElement.h:
* svg/SVGFEGaussianBlurElement.h:
* svg/SVGFEImageElement.h:
* svg/SVGFELightElement.h:
* svg/SVGFEMergeNodeElement.h:
* svg/SVGFEMorphologyElement.h:
* svg/SVGFEOffsetElement.h:
* svg/SVGFESpecularLightingElement.h:
* svg/SVGFETileElement.h:
* svg/SVGFETurbulenceElement.h:
* svg/SVGFilterElement.h:
* svg/SVGFilterPrimitiveStandardAttributes.h:
(WebCore::SVGFilterPrimitiveStandardAttributes::attributeRegistry): Deleted.
* svg/SVGFitToViewBox.h:
(WebCore::SVGFitToViewBox::attributeRegistry): Deleted.
* svg/SVGFontElement.h:
* svg/SVGForeignObjectElement.h:
* svg/SVGGElement.h:
* svg/SVGGeometryElement.h:
* svg/SVGGlyphRefElement.h:
* svg/SVGGradientElement.cpp:
(WebCore::SVGGradientElement::svgAttributeChanged):
* svg/SVGGradientElement.h:
(WebCore::SVGGradientElement::attributeRegistry): Deleted.
(WebCore::SVGGradientElement::isKnownAttribute): Deleted.
* svg/SVGGraphicsElement.h:
(WebCore::SVGGraphicsElement::attributeRegistry): Deleted.
* svg/SVGImageElement.h:
* svg/SVGLineElement.h:
* svg/SVGLinearGradientElement.h:
* svg/SVGMPathElement.h:
* svg/SVGMarkerElement.cpp:
* svg/SVGMarkerElement.h:
* svg/SVGMaskElement.h:
* svg/SVGPathElement.h:
* svg/SVGPatternElement.h:
* svg/SVGPolyElement.h:
* svg/SVGRadialGradientElement.h:
* svg/SVGRectElement.h:
* svg/SVGSVGElement.h:
* svg/SVGScriptElement.h:
* svg/SVGStopElement.h:
* svg/SVGSwitchElement.h:
* svg/SVGSymbolElement.h:
* svg/SVGTRefElement.h:
* svg/SVGTests.cpp:
(WebCore::SVGTests::svgAttributeChanged):
(WebCore::SVGTests::attributeRegistry): Deleted.
(WebCore::SVGTests::isKnownAttribute): Deleted.
* svg/SVGTests.h:
* svg/SVGTextContentElement.cpp:
* svg/SVGTextContentElement.h:
(WebCore::SVGTextContentElement::attributeRegistry): Deleted.
* svg/SVGTextPathElement.h:
* svg/SVGTextPositioningElement.h:
(WebCore::SVGTextPositioningElement::attributeRegistry): Deleted.
* svg/SVGURIReference.cpp:
(WebCore::SVGURIReference::SVGURIReference):
(WebCore::SVGURIReference::attributeRegistry): Deleted.
* svg/SVGURIReference.h:
* svg/SVGUseElement.h:
* svg/SVGViewElement.h:
* svg/SVGViewSpec.cpp:
(WebCore::SVGViewSpec::SVGViewSpec):
* svg/SVGViewSpec.h:
* svg/SVGZoomAndPanType.h:
* svg/properties/SVGAnimatedListPropertyTearOff.h: Removed.
* svg/properties/SVGAnimatedPropertyAnimator.h:
* svg/properties/SVGAnimatedPropertyAnimatorImpl.h:
* svg/properties/SVGAnimatedPropertyPairAnimator.h:
* svg/properties/SVGAnimatedPropertyPairAnimatorImpl.h:
* svg/properties/SVGAnimatedPropertyTearOff.h: Removed.
* svg/properties/SVGAnimatedPropertyType.h: Removed.

* svg/properties/SVGAnimationAdditiveFunction.h:
(WebCore::SVGAnimationAdditiveFunction::animate):
(WebCore::SVGAnimationAdditiveFunction::progress): Deleted.
* svg/properties/SVGAnimationAdditiveListFunctionImpl.h:
(WebCore::SVGAnimationLengthListFunction::animate):
(WebCore::SVGAnimationNumberListFunction::animate):
(WebCore::SVGAnimationPointListFunction::animate):
(WebCore::SVGAnimationTransformListFunction::animate):
(WebCore::SVGAnimationLengthListFunction::progress): Deleted.
(WebCore::SVGAnimationNumberListFunction::progress): Deleted.
(WebCore::SVGAnimationPointListFunction::progress): Deleted.
(WebCore::SVGAnimationTransformListFunction::progress): Deleted.
* svg/properties/SVGAnimationAdditiveValueFunctionImpl.h:
(WebCore::SVGAnimationAngleFunction::animate):
(WebCore::SVGAnimationColorFunction::animate):
(WebCore::SVGAnimationIntegerFunction::animate):
(WebCore::SVGAnimationLengthFunction::animate):
(WebCore::SVGAnimationNumberFunction::animate):
(WebCore::SVGAnimationPathSegListFunction::animate):
(WebCore::SVGAnimationRectFunction::animate):
(WebCore::SVGAnimationAngleFunction::progress): Deleted.
(WebCore::SVGAnimationColorFunction::progress): Deleted.
(WebCore::SVGAnimationIntegerFunction::progress): Deleted.
(WebCore::SVGAnimationLengthFunction::progress): Deleted.
(WebCore::SVGAnimationNumberFunction::progress): Deleted.
(WebCore::SVGAnimationPathSegListFunction::progress): Deleted.
(WebCore::SVGAnimationRectFunction::progress): Deleted.
* svg/properties/SVGAnimationDiscreteFunction.h:
(WebCore::SVGAnimationDiscreteFunction::animate):
(WebCore::SVGAnimationDiscreteFunction::progress): Deleted.
* svg/properties/SVGAnimationFunction.h:
(WebCore::SVGAnimationFunction::calculateDistance const):
-- Rename the 'progress()' functions of SVGAttributeAnimator and SVGAnimationFunction
   to 'animate()'.
-- Rename the argument 'percentage' of these function to 'progress'
-- Make calculateDistance return Optional<float> so it does not have to
   return -1 in case of error.

* svg/properties/SVGAttribute.h: Removed.
* svg/properties/SVGAttributeAccessor.h: Removed.
* svg/properties/SVGAttributeAnimator.h:
(WebCore::SVGAttributeAnimator::calculateDistance const):
* svg/properties/SVGAttributeOwnerProxy.cpp: Removed.
* svg/properties/SVGAttributeOwnerProxy.h: Removed.
* svg/properties/SVGAttributeOwnerProxyImpl.h: Removed.
* svg/properties/SVGAttributeRegistry.h: Removed.
* svg/properties/SVGLegacyAnimatedProperty.cpp: Removed.
* svg/properties/SVGLegacyAnimatedProperty.h: Removed.
* svg/properties/SVGLegacyProperty.h: Removed.
* svg/properties/SVGListProperty.h: Removed.
* svg/properties/SVGListPropertyTearOff.h: Removed.
* svg/properties/SVGPrimitivePropertyAnimator.h:
* svg/properties/SVGProperty.h:
* svg/properties/SVGPropertyAnimator.h:
* svg/properties/SVGPropertyTearOff.h: Removed.
* svg/properties/SVGValuePropertyAnimator.h:
* svg/properties/SVGValuePropertyListAnimator.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243830 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoAdd SPI to disable legacy TLS fallback
commit-queue@webkit.org [Wed, 3 Apr 2019 22:04:57 +0000 (22:04 +0000)]
Add SPI to disable legacy TLS fallback
https://bugs.webkit.org/show_bug.cgi?id=196549
<rdar://44979744>

Patch by Alex Christensen <achristensen@webkit.org> on 2019-04-03
Reviewed by Geoffrey Garen.

Source/WebCore/PAL:

* pal/spi/cf/CFNetworkSPI.h:

Source/WebKit:

* NetworkProcess/NetworkSessionCreationParameters.cpp:
(WebKit::NetworkSessionCreationParameters::privateSessionParameters):
(WebKit::NetworkSessionCreationParameters::encode const):
(WebKit::NetworkSessionCreationParameters::decode):
* NetworkProcess/NetworkSessionCreationParameters.h:
* NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(WebKit::NetworkSessionCocoa::NetworkSessionCocoa):
* UIProcess/API/Cocoa/WKWebsiteDataStore.mm:
(-[WKWebsiteDataStore _setAllowsTLSFallback:]):
(-[WKWebsiteDataStore _allowsTLSFallback]):
* UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::ensureNetworkProcess):
* UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:
(WebKit::WebsiteDataStore::parameters):
* UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::setSourceApplicationSecondaryIdentifier):
(WebKit::WebsiteDataStore::setAllowsTLSFallback):
(WebKit::WebsiteDataStore::setSourceApplicationBundleIdentifier):
* UIProcess/WebsiteData/WebsiteDataStore.h:
(WebKit::WebsiteDataStore::allowsTLSFallback const):
(WebKit::WebsiteDataStore::networkingHasBegun):
(WebKit::WebsiteDataStore::finalizeApplicationIdentifiers): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243829 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoDocuments can be destroyed before their CSSFontFaceSet is destroyed
mmaxfield@apple.com [Wed, 3 Apr 2019 21:46:55 +0000 (21:46 +0000)]
Documents can be destroyed before their CSSFontFaceSet is destroyed
https://bugs.webkit.org/show_bug.cgi?id=195830

Reviewed by Darin Adler.

Source/WebCore:

CSSFontFaceSet has a raw pointer to its owning document. JS can keep the CSSFontFaceSet alive (by using FontFaceSet)
and can destroy the document at any time. When the document is destroyed, the link between the two objects needs to
be severed.

Test: fast/text/font-face-set-destroy-document.html

* css/CSSFontFace.cpp:
(WebCore::CSSFontFace::CSSFontFace):
* css/CSSFontFace.h:
* css/CSSFontFaceSet.cpp:
(WebCore::CSSFontFaceSet::CSSFontFaceSet):
(WebCore::CSSFontFaceSet::ensureLocalFontFacesForFamilyRegistered):
* css/CSSFontFaceSet.h:
* css/CSSFontSelector.cpp:
(WebCore::CSSFontSelector::CSSFontSelector):
(WebCore::CSSFontSelector::addFontFaceRule):
* css/CSSFontSelector.h:
* css/FontFace.cpp:
(WebCore::FontFace::FontFace):

LayoutTests:

* fast/text/font-face-set-destroy-document-expected.html: Added.
* fast/text/font-face-set-destroy-document.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243828 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agohttp/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from...
sroberts@apple.com [Wed, 3 Apr 2019 21:29:23 +0000 (21:29 +0000)]
http/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from-prevalent-domain-with-user-interaction-but-access-from-wrong-frame.html is a flaky timeout
https://bugs.webkit.org/show_bug.cgi?id=194164

Unreviewed test gardening.

* platform/mac-wk2/TestExpectations: Updating test expectations for flaky timeout

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243827 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoWeb Inspector: Single click on links in non-read-only TextEditors should not follow...
drousso@apple.com [Wed, 3 Apr 2019 21:03:58 +0000 (21:03 +0000)]
Web Inspector: Single click on links in non-read-only TextEditors should not follow links
https://bugs.webkit.org/show_bug.cgi?id=123364
<rdar://problem/15323913>

Reviewed by Timothy Hatcher.

* UserInterface/Base/Main.js:
(WI._updateModifierKeys):
Add classes to the body whenever alt, shift, or ctrl are pressed.

* UserInterface/Views/CodeMirrorEditor.js:
(WI.CodeMirrorEditor.create):
Add a `read-only` class if the `CodeMirror` is readonly.

* UserInterface/Views/SyntaxHighlightingDefaultTheme.css:
(.cm-s-default .cm-link,):
(.read-only.cm-s-default .cm-link:hover,):
(.cm-s-default .cm-link:hover,): Deleted.

* UserInterface/Views/TextEditor.js:
(WI.TextEditor.prototype.set readOnly):
(WI.TextEditor.prototype._openClickedLinks):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243826 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoRebaseline scrollingcoordinator/scrolling-tree/fixed-inside-frame.html
sroberts@apple.com [Wed, 3 Apr 2019 20:49:17 +0000 (20:49 +0000)]
Rebaseline scrollingcoordinator/scrolling-tree/fixed-inside-frame.html
https://bugs.webkit.org/show_bug.cgi?id=195254

Unreviewed test gardening.

* scrollingcoordinator/scrolling-tree/fixed-inside-frame-expected.txt: Rebaselined test

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243825 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoFollow up fix for r243807: Use MarkedArgumentBuffer instead of Vector for JSValue
sihui_liu@apple.com [Wed, 3 Apr 2019 20:37:22 +0000 (20:37 +0000)]
Follow up fix for r243807: Use MarkedArgumentBuffer instead of Vector for JSValue
https://bugs.webkit.org/show_bug.cgi?id=196547

Reviewed by Geoffrey Garen.

JSValue in Vector could be garbage collected because GC doesn't know Vector memory on C++ heap.

* bindings/js/JSIDBRequestCustom.cpp:
(WebCore::JSIDBRequest::result const):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243824 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ews-app] Status bubble should not display certain infrastructure status messages
aakash_jain@apple.com [Wed, 3 Apr 2019 20:27:12 +0000 (20:27 +0000)]
[ews-app] Status bubble should not display certain infrastructure status messages
https://bugs.webkit.org/show_bug.cgi?id=196550

Reviewed by Lucas Forschler.

Do not display the steps which are un-needed for end-user. This information is still avaiable
if the user click on the bubble and look at the Buildbot build.
* BuildSlaveSupport/ews-app/ews/views/statusbubble.py:
(StatusBubble._steps_messages):
(StatusBubble._should_display_step): Method to decide whether to display the step or not.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243823 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months ago[ews-build] Use https for sending data to ews-app
aakash_jain@apple.com [Wed, 3 Apr 2019 20:13:42 +0000 (20:13 +0000)]
[ews-build] Use https for sending data to ews-app
https://bugs.webkit.org/show_bug.cgi?id=196492

Reviewed by Lucas Forschler.

* BuildSlaveSupport/ews-build/events.py:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243822 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoHTML fragment serialization should not strip whitespace from URL attribute values
cdumez@apple.com [Wed, 3 Apr 2019 20:08:34 +0000 (20:08 +0000)]
HTML fragment serialization should not strip whitespace from URL attribute values
https://bugs.webkit.org/show_bug.cgi?id=196551

Reviewed by Ryosuke Niwa.

LayoutTests/imported/w3c:

Rebaseline WPT test now that all checks are passing. This test was already passing
in Gecko and Blink.

* web-platform-tests/domparsing/innerhtml-mxss.sub-expected.txt:

Source/WebCore:

HTML fragment serialization should not strip whitespace from URL attribute values as per:
- https://html.spec.whatwg.org/multipage/parsing.html#html-fragment-serialisation-algorithm

WebKit was stripping such whitespace, Gecko and Blink are not. Align WebKit with other
browser engines and the specification.

No new tests, rebaselined existing test.

* editing/MarkupAccumulator.cpp:
(WebCore::MarkupAccumulator::appendQuotedURLAttributeValue):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243821 268f45cc-cd09-0410-ab3c-d52691b4dbfc

4 months agoCrash in HTMLCanvasElement::createContext2d after the element got adopted to a new...
rniwa@webkit.org [Wed, 3 Apr 2019 20:04:37 +0000 (20:04 +0000)]
Crash in HTMLCanvasElement::createContext2d after the element got adopted to a new document
https://bugs.webkit.org/show_bug.cgi?id=196527

Reviewed by Antti Koivisto.

We need to update CanvasBase::m_scriptExecutionContext when HTMLCanvasElement moves from
one document to another. Fixed the bug by making CanvasBase::scriptExecutionContext make
a virtual function call instead of directly storing a raw pointer. In HTMLCanvasElement,
we use Node::scriptExecutionContext(). Use ContextDestructionObserver in CustomPaintCanvas
and OffscreenCanvas instead of a raw pointer.

Unfortunately, no new tests since there is no reproducible test case.

* html/CanvasBase.cpp:
(WebCore::CanvasBase::CanvasBase):
* html/CanvasBase.h:
(WebCore::CanvasBase::scriptExecutionContext const):
* html/CustomPaintCanvas.cpp:
(WebCore::CustomPaintCanvas::CustomPaintCanvas):
* html/CustomPaintCanvas.h:
* html/HTMLCanvasElement.cpp:
(WebCore::HTMLCanvasElement::HTMLCanvasElement):
* html/HTMLCanvasElement.h:
* html/OffscreenCanvas.cpp:
(WebCore::OffscreenCanvas::OffscreenCanvas):
* html/OffscreenCanvas.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243820 268f45cc-cd09-0410-ab3c-d52691b4dbfc