WebKit-https.git
3 years agoUnreviewed, rolling out r194135.
commit-queue@webkit.org [Wed, 16 Dec 2015 12:47:55 +0000 (12:47 +0000)]
Unreviewed, rolling out r194135.
https://bugs.webkit.org/show_bug.cgi?id=152333

due to missing OSR exit materialization support in FTL
(Requested by yusukesuzuki on #webkit).

Reverted changeset:

"[ES6] Handle new_generator_func / new_generator_func_exp in
DFG / FTL"
https://bugs.webkit.org/show_bug.cgi?id=152227
http://trac.webkit.org/changeset/194135

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194141 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[Fetch API] Add fetch API compile time flag
youenn.fablet@crf.canon.fr [Wed, 16 Dec 2015 11:13:07 +0000 (11:13 +0000)]
[Fetch API] Add fetch API compile time flag
https://bugs.webkit.org/show_bug.cgi?id=152254

Reviewed by Darin Adler.

.:

* Source/cmake/OptionsWin.cmake:
* Source/cmake/WebKitFeatures.cmake:

Source/JavaScriptCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit/mac:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

* Configurations/FeatureDefines.xcconfig:

Source/WTF:

* wtf/FeatureDefines.h:

Tools:

* Scripts/webkitperl/FeatureList.pm:

WebKitLibraries:

* win/tools/vsprops/FeatureDefines.props:
* win/tools/vsprops/FeatureDefinesCairo.props:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194140 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUnreviewed.
calvaris@igalia.com [Wed, 16 Dec 2015 10:05:26 +0000 (10:05 +0000)]
Unreviewed.

Added files that have impact in building Streams API to the watchlist.

* Scripts/webkitpy/common/config/watchlist:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194139 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUnreviewed.
calvaris@igalia.com [Wed, 16 Dec 2015 09:32:22 +0000 (09:32 +0000)]
Unreviewed.

Added imported tests to Streams API watchlist.

* Scripts/webkitpy/common/config/watchlist:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194138 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRemove default copy of wpt testharness.js when launching wpt server
youenn.fablet@crf.canon.fr [Wed, 16 Dec 2015 09:18:00 +0000 (09:18 +0000)]
Remove default copy of wpt testharness.js when launching wpt server
https://bugs.webkit.org/show_bug.cgi?id=152298

Reviewed by Darin Adler.

* Scripts/webkitpy/layout_tests/servers/web_platform_test_server.py:
(WebPlatformTestServer._copy_webkit_test_files): Deleted default copy of WebKit testharness.js to WPT.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194137 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoAlign WebKit testharness.js with WPT testharness.js
youenn.fablet@crf.canon.fr [Wed, 16 Dec 2015 09:16:29 +0000 (09:16 +0000)]
Align WebKit testharness.js with WPT testharness.js
https://bugs.webkit.org/show_bug.cgi?id=152297

Reviewed by Darin Adler.

Cosmetic changes (output:true is overriden by WK testharnessreport.js)
To remove the warning "WPT tests are not using the same testharness.js file as other WebKit Layout tests."

* media/track/getCueAsHTMLCrash.html: Adding testharnessreport.js and removing call to dumpAsText.
* media/track/getCueAsHTMLCrash-expected.txt: Rebasing as tests are now outputting results.
* resources/testharness.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194136 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[ES6] Handle new_generator_func / new_generator_func_exp in DFG / FTL
utatane.tea@gmail.com [Wed, 16 Dec 2015 09:10:09 +0000 (09:10 +0000)]
[ES6] Handle new_generator_func / new_generator_func_exp in DFG / FTL
https://bugs.webkit.org/show_bug.cgi?id=152227

Reviewed by Saam Barati.

Source/JavaScriptCore:

This patch introduces new_generator_func / new_generator_func_exp into DFG and FTL.
We add a new DFG Node, NewGeneratorFunction. It will construct a function with GeneratorFunction's structure.
The structure of GeneratorFunction is different from one of Function because GeneratorFunction has the different __proto__.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGClobbersExitState.cpp:
(JSC::DFG::clobbersExitState):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGMayExit.cpp:
(JSC::DFG::mayExit):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToPhantomNewFunction):
(JSC::DFG::Node::hasCellOperand):
(JSC::DFG::Node::isFunctionAllocation):
* dfg/DFGNodeType.h:
* dfg/DFGObjectAllocationSinkingPhase.cpp:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewFunction):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStoreBarrierInsertionPhase.cpp:
* dfg/DFGStructureRegistrationPhase.cpp:
(JSC::DFG::StructureRegistrationPhase::run):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
(JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
* tests/stress/generator-function-create-optimized.js: Added.
(shouldBe):
(g):
(test.return.gen):
(test):
(test2.gen):
(test2):
* tests/stress/generator-function-declaration-sinking-no-double-allocate.js: Added.
(shouldBe):
(GeneratorFunctionPrototype):
(call):
(f):
(sink):
* tests/stress/generator-function-declaration-sinking-osrexit.js: Added.
(shouldBe):
(GeneratorFunctionPrototype):
(g):
(f):
(sink):
* tests/stress/generator-function-declaration-sinking-put.js: Added.
(shouldBe):
(GeneratorFunctionPrototype):
(g):
(f):
(sink):
* tests/stress/generator-function-expression-sinking-no-double-allocate.js: Added.
(shouldBe):
(GeneratorFunctionPrototype):
(call):
(f):
(sink):
* tests/stress/generator-function-expression-sinking-osrexit.js: Added.
(shouldBe):
(GeneratorFunctionPrototype):
(g):
(sink):
* tests/stress/generator-function-expression-sinking-put.js: Added.
(shouldBe):
(GeneratorFunctionPrototype):
(g):
(sink):

LayoutTests:

Make the test taking longer time.

* js/regress/script-tests/generator-function-create.js:
(test):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194135 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[GTK] Correct the wrong expectation introduced in r194106
commit-queue@webkit.org [Wed, 16 Dec 2015 08:57:05 +0000 (08:57 +0000)]
[GTK] Correct the wrong expectation introduced in r194106
https://bugs.webkit.org/show_bug.cgi?id=152325

Unreviewed GTK gardening

Patch by Tomas Popela <tpopela@redhat.com> on 2015-12-16

* platform/gtk/http/tests/plugins/plugin-javascript-access-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194134 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoPerf dashboard's cycler page should use v3 UI
rniwa@webkit.org [Wed, 16 Dec 2015 07:15:21 +0000 (07:15 +0000)]
Perf dashboard's cycler page should use v3 UI
https://bugs.webkit.org/show_bug.cgi?id=152324

Reviewed by Chris Dumez.

Use the v3 UI in cycler.html after r194130.

* public/cycler.html:
* public/v3/index.html: Removed the reference to a non-existent platform-selector.js.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194133 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoFontCascade cleanup: Remove ::drawSimpleText and ::drawComplexText.
zalan@apple.com [Wed, 16 Dec 2015 06:28:13 +0000 (06:28 +0000)]
FontCascade cleanup: Remove ::drawSimpleText and ::drawComplexText.
https://bugs.webkit.org/show_bug.cgi?id=152323

Reviewed by Myles C. Maxfield.

Platform code for ::drawComplexText() is redundant and has
no platform dependent logic. Move it all to ::drawText()

No change in functionality.

* platform/graphics/FontCascade.cpp:
(WebCore::FontCascade::glyphBufferForTextRun):
(WebCore::FontCascade::drawText):
(WebCore::FontCascade::drawSimpleText): Deleted.
* platform/graphics/FontCascade.h:
* platform/graphics/cairo/FontCairoHarfbuzzNG.cpp:
(WebCore::FontCascade::drawComplexText): Deleted.
* platform/graphics/cocoa/FontCascadeCocoa.mm:
(WebCore::FontCascade::drawComplexText): Deleted.
* platform/graphics/win/FontWin.cpp:
(WebCore::FontCascade::drawComplexText): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194132 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoGardening: fix broken 32-bit JSC tests. Just need to assign a scratch register.
mark.lam@apple.com [Wed, 16 Dec 2015 05:54:20 +0000 (05:54 +0000)]
Gardening: fix broken 32-bit JSC tests.  Just need to assign a scratch register.
https://bugs.webkit.org/show_bug.cgi?id=152191

Not reviewed.

* jit/JITArithmetic.cpp:
(JSC::JIT::emitBitBinaryOpFastPath):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194131 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoAdd v3 UI to perf dashboard
rniwa@webkit.org [Wed, 16 Dec 2015 05:19:08 +0000 (05:19 +0000)]
Add v3 UI to perf dashboard
https://bugs.webkit.org/show_bug.cgi?id=152311

Reviewed by Chris Dumez.

Add the third iteration of the perf dashboard UI. UI for viewing and modifying analysis tasks is coming soon.
The v3 UI is focused on speed, and removes all third-party script dependencies including jQuery, d3, and Ember.
Both the DOM-based UI and graphing are implemented manually.

The entire app is structured using new component library implemented in components/base.js. Each component is
an instance of a subclass of ComponentBase which owns a single DOM element. Each subclass may supply static
methods named htmlTemplate and cssTemplate as the template for a component instance. ComponentBase automatically
clones the templates inside the associated element (or its shadow root on the supported browsers). Each subclass
must supply a method called "render()" which constructs and updates the DOM as needed.

There is a special component called Page, which represents an entire page. Each Page is opened by PageRouter's
"route()" function. Each subclass of Page supplies "open()" for initialization and "updateFromSerializedState()"
for a hash URL transition.

The key feature of the v3 UI is the split of time series into chunks called clusters (see r194120). On an internal
instance of the dashboard, the v2 UI downloads 27MB of data whereas the same page loads only 3MB of data in the v3.
The key logic for fetching time series in chunks is implemented by MeasurementSet in /v3/models/measurement-set.js.
We first fetch the cached primary cluster (the cluster that contains the newest data) at:
/data/measurement-set-<platform-id>-<metric-id>.json

If that's outdated according to lastModified in manifest.json, then we immediately re-fetch the primary cluster at:
/api/measurement-set/?platform=<platform-id>&metric=<metric-id>

Once the up-to-date primary cluster is fetched, we fetch all "secondary" clusters. For each cluster being fetched,
including the primary, we invoke registered callbacks.

In addition, the v3 UI reduces the initial page load time by loading a single bundled JS file generated by
tools/bundle-v3-scripts.py. index.html has a fallback to load all 44 JS files individually during development.

* public/api/analysis-tasks.php:
(fetch_and_push_bugs_to_tasks): Added the code to fetch start and end run times. This is necessary in V3 UI
because no longer fetch the entire time series. See r194120 for the new measurement set JSON API.
(format_task): Compute the category of an analysis task based on "result" value. This will be re-vamped once
I add the UI for the analysis task page in v3.

* public/include/json-header.php:
(require_format): CamelCase the name.
(require_match_one_of_values): Ditto.
(validate_arguments): Renamed from require_existence_of and used in measurement-set.php landed in r194120.

* public/v3: Added.
* public/v3/components: Added.

* public/v3/components/base.js: Added.
(ComponentBase): The base component class.
(ComponentBase.prototype.element): Returns the DOM element associated with the DOM element.
(ComponentBase.prototype.content): Returns the shadow root if one exists and the associated element otherwise.
(ComponentBase.prototype.render): To be implemented by a subclass.
(ComponentBase.prototype.renderReplace): A helper function to "render" DOM contents.
(ComponentBase.prototype._constructShadowTree): Called inside the constructor to instantiate the templates.
(ComponentBase.prototype._recursivelyReplaceUnknownElementsByComponents): Instantiates components referred by
its element name inside the instantiated content.
(ComponentBase.isElementInViewport): A helper function. Returns true if the element is in the viewport and it has
non-zero width and height.
(ComponentBase.defineElement): Defines a custom element that can be automatically instantiated from htmlTemplate.
(ComponentBase.createElement): A helper function to create DOM tree to be used in "render()" method.
(ComponentBase._addContentToElement): A helper for "createElement".
(ComponentBase.createLink): A helper function to create a hyperlink or another clickable element (via callback).
(ComponentBase.createActionHandler): A helper function to create an event listener that prevents the default action
and stops the event propagation.

* public/v3/components/button-base.js: Added.

* public/v3/components/chart-status-view.js: Added.
(ChartStatusView): A component that reports the current status of time-series-chart. It's subclasses by
ChartPaneStatusView to provide additional information in the charts page's panes.

* public/v3/components/close-button.js: Added.
(CloseButton):
* public/v3/components/commit-log-viewer.js: Added.
(CommitLogViewer): A component that lists commit revisions along with commit messages for a range of data points.

* public/v3/components/interactive-time-series-chart.js: Added.
(InteractiveTimeSeriesChart): A subclass of InteractiveTimeSeriesChart with interactivity (selection & indicator).
Selection and indicator are mutually exclusive.

* public/v3/components/pane-selector.js: Added.
(PaneSelector): A component for selecting (platform, metric) pair to add in the charts page.

* public/v3/components/spinner-icon.js: Added.

* public/v3/components/time-series-chart.js: Added.
(TimeSeriesChart): A canvas-based chart component without interactivity. It takes a source list and options as
the constructor arguments. A source list is a list of measurement sets (measurement-set.js) with drawing options.
This component fetches data via MeasurementSet.fetchBetween inside TimeSeriesChart.prototype.setDomain and
progressively updates the charts as more data arrives. The canvas is updated on animation frame via rAF and all
layout and rendering metrics are lazily computed in _layout. In addition, this component samples data before
rendering the chart when there are more data points per pixel in _ensureSampledTimeSeries.

* public/v3/index.html: Added. Loads bundled-scripts.js if it exists, or individual script files otherwise.

* public/v3/instrumentation.js: Added. This class is used to gather runtime statistics of v3 UI. (It measures
the performance of the perf dashboard UI).

* public/v3/main.js: Added. Bootstraps the app.
(main):
(fetchManifest):

* public/v3/models: Added.
* public/v3/models/analysis-task.js: Added.
* public/v3/models/bug-tracker.js: Added.
* public/v3/models/bug.js: Added.
* public/v3/models/builder.js: Added.
* public/v3/models/commit-log.js: Added.
* public/v3/models/data-model.js: Added.
(DataModelObject): The base class for various data objects that correspond to database tables. It supplies static
hash map to find entries by id as well as other keys.
(LabeledObject): A subclass of DataModelObject with the capability to find an object via its name.

* public/v3/models/measurement-cluster.js: Added.
(MeasurementCluster): Represents a single cluster or a chunk of data in a measurement set.

* public/v3/models/measurement-set.js: Added.
(MeasurementSet): Represents a measurement set.
(MeasurementSet.findSet): Returns the singleton set given (metric, platform). We use singleton to avoid issuing
multiple HTTP requests for the same JSON when there are multiple TimeSeriesChart that show the same graph (e.g. on
charts page with overview and main charts).
(MeasurementSet.prototype.findClusters): Finds the list of clusters to fetch in a given time range.
(MeasurementSet.prototype.fetchBetween): Fetch clusters for a given time range and calls callback whenever new data
arrives. The number of callbacks depends on the how many clusters need to be newly fetched.
(MeasurementSet.prototype._fetchSecondaryClusters): Fetches non-primary (non-latest) clusters.
(MeasurementSet.prototype._fetch): Issues a HTTP request to fetch a cluster.
(MeasurementSet.prototype._didFetchJSON): Called when a cluster is fetched.
(MeasurementSet.prototype._failedToFetchJSON): Called when the fetching of a cluster has failed.
(MeasurementSet.prototype._invokeCallbacks): Invokes callbacks upon an approval of a new cluster.
(MeasurementSet.prototype._addFetchedCluster): Adds the newly fetched cluster in the order.
(MeasurementSet.prototype.fetchedTimeSeries): Returns a time series that contains data from all clusters that have
been fetched.
(TimeSeries.prototype.findById): Additions to TimeSeries defined in /v2/data.js.
(TimeSeries.prototype.dataBetweenPoints): Ditto.
(TimeSeries.prototype.firstPoint): Ditto.

* public/v3/models/metric.js: Added.
* public/v3/models/platform.js: Added.
* public/v3/models/repository.js: Added.
* public/v3/models/test.js: Added.

* public/v3/pages: Added.
* public/v3/pages/analysis-category-page.js: Added. The "Analysis" page that lists the analysis tasks.
* public/v3/pages/analysis-category-toolbar.js: Added. The toolbar to filter analysis tasks based on its category
(unconfirmed, bisecting, identified, closed) and a keyword.

* public/v3/pages/analysis-task-page.js: Added. Not implemented yet. It just has the hyperlink to the v2  UI.

* public/v3/pages/chart-pane-status-view.js: Added.
(ChartPaneStatusView): A subclass of ChartStatusView used in the charts page. In addition to the current value,
comparison to baseline/target, it shows the list of repository revisions (e.g. WebKit revision, OS version).

* public/v3/pages/chart-pane.js: Added.
(ChartPane): A component a pane in the charts page. Each pane has the overview chart and the main chart. The zooming
is synced across all panes in the charts page.

* public/v3/pages/charts-page.js: Added. Charts page.
* public/v3/pages/charts-toolbar.js: Added. The toolbar to set the number of days to show. This affects the overview
chart's domain in each pane.

* public/v3/pages/create-analysis-task-page.js: Added.
(CreateAnalysisTaskPage): A page that gets shown momentarily while creating a new analysis task.

* public/v3/pages/dashboard-page.js: Added. A dashboard page.
* public/v3/pages/dashboard-toolbar.js: Added. Its toolbar with buttons to select the number of days to show.
* public/v3/pages/domain-control-toolbar.js: Added. An abstract superclass of charts and dashboard toolbars.

* public/v3/pages/heading.js: Added. A component for displaying the header and toolbar, if exists, on each page.
* public/v3/pages/page-router.js: Added. This class is responsible for updating the URL hashes as well as opening
and updating each page when the hash changes (via back/forward navigation).
* public/v3/pages/page-with-charts.js: Added. An abstract subclass of page used by dashboards and charts page.
Supplies helper functions for creating TimeSeriesChart options.
* public/v3/pages/page-with-heading.js: Added. An abstract subclass of page that uses the heading component.
* public/v3/pages/page.js: Added. The Page component.
* public/v3/pages/toolbar.js: Added. An abstract toolbar component.

* public/v3/remote.js: Added.
(getJSON): Fetches JSON from the remote server.
(getJSONWithStatus): Ditto. Rejects the response if the status is not "OK".
(PrivilegedAPI.sendRequest): Posts a HTTP request to a privileged API in /privileged-api/.
(PrivilegedAPI.requestCSRFToken): Creates a new CSRF token to request a privileged API post.

* tools/bundle-v3-scripts.py: Added.
(main): Bundles js files together and minifies them by jsmin.py for the v3 UI. Without this script, we're forced to
download 44 JS files or making each JS file contain multiple classes.

* tools/jsmin.py: Copied from WebInspector / JavaScriptCore code.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194130 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRebaseline fast/viewport/ios tests for ios-simulator, remove failure expectation...
ryanhaddad@apple.com [Wed, 16 Dec 2015 03:09:51 +0000 (03:09 +0000)]
Rebaseline fast/viewport/ios tests for ios-simulator, remove failure expectation and re-enable test directory.
https://bugs.webkit.org/show_bug.cgi?id=152135

Reviewed by Simon Fraser.

* platform/ios-simulator-wk2/TestExpectations:
* platform/ios-simulator/TestExpectations:
* platform/ios-simulator/fast/viewport/ios/width-is-device-width-overflowing-body-overflow-hidden-expected.txt:
* platform/ios-simulator/fast/viewport/ios/width-is-device-width-overflowing-body-overflow-hidden-tall-expected.txt:
* platform/ios-simulator/fast/viewport/ios/width-is-device-width-overflowing-expected.txt:
* platform/ios-simulator/fast/viewport/ios/width-is-device-width-overflowing-no-shrink-to-fit-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194129 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoVerify that Referer Policy within Content-Disposition:attachment sandbox is always...
jiewen_tan@apple.com [Wed, 16 Dec 2015 01:11:45 +0000 (01:11 +0000)]
Verify that Referer Policy within Content-Disposition:attachment sandbox is always ReferrerPolicyNever
https://bugs.webkit.org/show_bug.cgi?id=152260
<rdar://problem/23884579>

Reviewed by Andy Estes.

* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-expected.txt: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-always-expected.txt: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-always.html: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-default-expected.txt: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-default.html: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-never-expected.txt: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-never.html: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-no-referrer-expected.txt: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-no-referrer-when-downgrade-expected.txt: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-no-referrer-when-downgrade.html: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-no-referrer.html: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-origin-expected.txt: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-origin.html: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-unsafe-url-expected.txt: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped-with-meta-referer-unsafe-url.html: Added.
* http/tests/contentdispositionattachmentsandbox/referer-header-stripped.html: Added.
* http/tests/contentdispositionattachmentsandbox/resources/referer-header-stripped-frame.php: Added.
* http/tests/contentdispositionattachmentsandbox/resources/referer-header-stripped.js: Added.
* http/tests/contentdispositionattachmentsandbox/resources/subresource-request-not-include-referer-header-frame.php: Removed.
* http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header-expected.txt: Removed.
* http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194128 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRebaseline some page overlay tests for WK1
timothy_horton@apple.com [Wed, 16 Dec 2015 01:05:15 +0000 (01:05 +0000)]
Rebaseline some page overlay tests for WK1

* platform/mac-wk1/pageoverlay/overlay-installation-expected.txt:
* platform/mac-wk1/pageoverlay/overlay-large-document-expected.txt:
* platform/mac-wk1/pageoverlay/overlay-large-document-scrolled-expected.txt:
* platform/mac-wk1/pageoverlay/overlay-small-frame-mouse-events-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194127 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoIntroducing ScratchRegisterAllocator::PreservedState.
mark.lam@apple.com [Wed, 16 Dec 2015 01:05:00 +0000 (01:05 +0000)]
Introducing ScratchRegisterAllocator::PreservedState.
https://bugs.webkit.org/show_bug.cgi?id=152315

Reviewed by Geoffrey Garen.

restoreReusedRegistersByPopping() should always be called with 2 values that
matches the expectation of preserveReusedRegistersByPushing().  Those 2 values
are the number of bytes preserved and the ExtraStackSpace requirement.  By
encapsulating them in a ScratchRegisterAllocator::PreservedState, we can make
it less error prone when calling restoreReusedRegistersByPopping().  Now, we only
need to pass it the appropriate PreservedState that its matching
preserveReusedRegistersByPushing() returned.

* bytecode/PolymorphicAccess.cpp:
(JSC::AccessGenerationState::restoreScratch):
(JSC::AccessCase::generate):
(JSC::PolymorphicAccess::regenerate):
* bytecode/PolymorphicAccess.h:
(JSC::AccessGenerationState::AccessGenerationState):
* ftl/FTLCompileBinaryOp.cpp:
(JSC::FTL::generateBinaryBitOpFastPath):
(JSC::FTL::generateRightShiftFastPath):
(JSC::FTL::generateBinaryArithOpFastPath):
* ftl/FTLLazySlowPath.cpp:
(JSC::FTL::LazySlowPath::generate):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::emitStoreBarrier):
* jit/ScratchRegisterAllocator.cpp:
(JSC::ScratchRegisterAllocator::allocateScratchGPR):
(JSC::ScratchRegisterAllocator::allocateScratchFPR):
(JSC::ScratchRegisterAllocator::preserveReusedRegistersByPushing):
(JSC::ScratchRegisterAllocator::restoreReusedRegistersByPopping):
* jit/ScratchRegisterAllocator.h:
(JSC::ScratchRegisterAllocator::usedRegisters):
(JSC::ScratchRegisterAllocator::PreservedState::PreservedState):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194126 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[Mac] Gesture Events should not have negative scale
timothy_horton@apple.com [Wed, 16 Dec 2015 00:55:49 +0000 (00:55 +0000)]
[Mac] Gesture Events should not have negative scale
https://bugs.webkit.org/show_bug.cgi?id=151065
<rdar://problem/23474123>

Reviewed by Anders Carlsson.

* Shared/NativeWebGestureEvent.h:
* Shared/mac/NativeWebGestureEventMac.mm:
(WebKit::distanceForTouches):
(WebKit::NativeWebGestureEvent::NativeWebGestureEvent):
Compute the distance between the two oldest touches, and use that as
the scale (really the gesture diameter) on the event, instead of
passing through AppKit's magnification (which is computed differently).
This matches the documented behavior of the existing gesture events on iOS.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView touchesBeganWithEvent:]):
(-[WKWebView touchesMovedWithEvent:]):
(-[WKWebView touchesEndedWithEvent:]):
(-[WKWebView touchesCancelledWithEvent:]):
* UIProcess/API/mac/WKView.mm:
(-[WKView touchesBeganWithEvent:]):
(-[WKView touchesMovedWithEvent:]):
(-[WKView touchesEndedWithEvent:]):
(-[WKView touchesCancelledWithEvent:]):
Plumb touch events through to WebViewImpl.

* UIProcess/Cocoa/WebViewImpl.h:
* UIProcess/Cocoa/WebViewImpl.mm:
(WebKit::WebViewImpl::WebViewImpl):
(WebKit::WebViewImpl::magnifyWithEvent):
(WebKit::WebViewImpl::touchesOrderedByAge):
(WebKit::WebViewImpl::touchesBeganWithEvent):
(WebKit::WebViewImpl::touchesMovedWithEvent):
(WebKit::WebViewImpl::touchesEndedWithEvent):
(WebKit::WebViewImpl::touchesCancelledWithEvent):
(WebKit::WebViewImpl::rotateWithEvent):
Keep track of the most recent incoming touches, by identifier, in age order.
Pass them through to NativeWebGestureEvent so it can determine the gesture diameter.

* page/EventHandler.cpp:
(WebCore::EventHandler::clear):
* page/EventHandler.h:
Make it possible to use m_gestureInitialDiameter for Mac gesture events too.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194125 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoCall DatabaseManager directly from WKBundle.cpp
andersca@apple.com [Wed, 16 Dec 2015 00:52:55 +0000 (00:52 +0000)]
Call DatabaseManager directly from WKBundle.cpp
https://bugs.webkit.org/show_bug.cgi?id=152317

Reviewed by Tim Horton.

This is in preparation for getting rid of some old database manager code.

* WebProcess/InjectedBundle/API/c/WKBundle.cpp:
(WKBundleClearAllDatabases):
(WKBundleSetDatabaseQuota):
* WebProcess/InjectedBundle/InjectedBundle.cpp:
(WebKit::InjectedBundle::clearAllDatabases): Deleted.
(WebKit::InjectedBundle::setDatabaseQuota): Deleted.
* WebProcess/InjectedBundle/InjectedBundle.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194124 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoWeb Inspector: Localize "global code" and "eval code" strings
joepeck@webkit.org [Wed, 16 Dec 2015 00:23:49 +0000 (00:23 +0000)]
Web Inspector: Localize "global code" and "eval code" strings
https://bugs.webkit.org/show_bug.cgi?id=152313

Reviewed by Timothy Hatcher.

Source/WebInspectorUI:

* Localizations/en.lproj/localizedStrings.js:
* UserInterface/Models/CallFrame.js:
(WebInspector.CallFrame.fromPayload):
Localize the strings given to use from the backend.

LayoutTests:

* inspector/debugger/js-stacktrace-expected.txt:
* inspector/debugger/js-stacktrace.html:
* inspector/model/stack-trace-expected.txt: Added.
* inspector/model/stack-trace.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194123 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoTry to fix the CMake build
timothy_horton@apple.com [Wed, 16 Dec 2015 00:06:02 +0000 (00:06 +0000)]
Try to fix the CMake build

* CMakeLists.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194122 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoFix v2 UI after r194093.
rniwa@webkit.org [Wed, 16 Dec 2015 00:00:02 +0000 (00:00 +0000)]
Fix v2 UI after r194093.

* public/v2/data.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194121 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoAdd /api/measurement-set for v3 UI
rniwa@webkit.org [Tue, 15 Dec 2015 23:57:25 +0000 (23:57 +0000)]
Add /api/measurement-set for v3 UI
https://bugs.webkit.org/show_bug.cgi?id=152312

Rubber-stamped by Chris Dumez.

The new API JSON allows the front end to fetch measured data in chunks called a "cluster" as specified
in config.json for each measurement set specified by the pair of a platform and a metric.

When the front end needs measured data in a given time range (t_0, t_1) for a measurement set, it first
fetches the primary cluster by /api/measurement-set/?platform=<platform-id>&metric=<metric-id>.
The primary cluster is the last cluster in the set (returning the first cluster here is not useful
since we don't typically show very old data), and provides the information needed to fetch other clusters.

Fetching the primary cluster also creates JSON files at:
/data/measurement-set-<platform-id>-<metric-id>-<cluster-end-time>.json
to allow latency free access for secondary clusters. The front end code can also fetch the cache of
the primary cluster at: /data/measurement-set-<platform-id>-<metric-id>.json.

Because the front end code has to behave as if all data is fetched, each cluster contains one data point
immediately before the first data point and one immediately after the last data point. This avoids having
to fetch multiple empty clusters for manually specified baseline data. To support this behavior, we generate
all clusters for a given measurement set at once when the primary cluster is requested.

Furthermore, all measurement sets are divided at the same time into clusters so that the boundary of clusters
won't shift as more data are reported to the server.

* config.json: Added clusterStart and clusterSize as options.
* public/api/measurement-set.php: Added.
(main):
(MeasurementSetFetcher::__construct):
(MeasurementSetFetcher::fetch_config_list): Finds configurations that belongs to this (platform, metric) pair.
(MeasurementSetFetcher::at_end): Returns true if we've reached the end of all clusters for this set.
(MeasurementSetFetcher::fetch_next_cluster): Generates the JSON data for the next cluster. We generate clusters
in increasing chronological order (the oldest first and the newest last).
(MeasurementSetFetcher::execute_query): Executes the main query.
(MeasurementSetFetcher::format_map): Returns the mapping of a measurement field to an array index. This removes
the need to have key names for each measurement and reduces the JSON size by ~10%.
(MeasurementSetFetcher::format_run): Creates an array that contains data for a single measurement. The order
matches that of keys in format_map.
(MeasurementSetFetcher::parse_revisions_array): Added. Copied from runs.php.
* tests/api-measurement-set.js: Added. Added tests for /api/measurement-set.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194120 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoTry to fix the CMake build
timothy_horton@apple.com [Tue, 15 Dec 2015 22:50:43 +0000 (22:50 +0000)]
Try to fix the CMake build

* CMakeLists.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194118 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoREGRESSION (r191849): There's no yellow bouncy highlight when using Find on Page...
timothy_horton@apple.com [Tue, 15 Dec 2015 22:46:02 +0000 (22:46 +0000)]
REGRESSION (r191849): There's no yellow bouncy highlight when using Find on Page on iOS
https://bugs.webkit.org/show_bug.cgi?id=152241
<rdar://problem/23642574>

Reviewed by Simon Fraser.

Tests: pageoverlay/overlay-small-frame-mouse-events.html
       pageoverlay/overlay-small-frame-paints.html

* page/PageOverlay.cpp:
(WebCore::PageOverlay::bounds):
Revert r191849's change that made bounds() actually return the frame()
if we frame is manually overriden.

(WebCore::PageOverlay::mouseEvent):
Convert the mouse event the rest of the way into overlay coordinates (by
applying the overlay's frame origin) before deciding whether to handle
the event.

* page/PageOverlay.h:

* DerivedSources.make:
* WebCore.xcodeproj/project.pbxproj:
* testing/Internals.cpp:
(WebCore::Internals::installMockPageOverlay):
* testing/Internals.h:
* testing/Internals.idl:
* testing/MockPageOverlay.cpp: Added.
(WebCore::MockPageOverlay::create):
(WebCore::MockPageOverlay::MockPageOverlay):
(WebCore::MockPageOverlay::setFrame):
* testing/MockPageOverlay.h: Added.
(WebCore::MockPageOverlay::overlay):
* testing/MockPageOverlay.idl: Added.
* testing/MockPageOverlayClient.cpp:
(WebCore::MockPageOverlayClient::installOverlay):
(WebCore::MockPageOverlayClient::uninstallAllOverlays):
(WebCore::MockPageOverlayClient::pageOverlayDestroyed):
(WebCore::MockPageOverlayClient::drawRect):
(WebCore::MockPageOverlayClient::mouseEvent):
* testing/MockPageOverlayClient.h:
Make internals.installMockPageOverlay return a MockPageOverlay object so
tests can manipulate their overlay. For now, expose setFrame.
Also, log when MockPageOverlayClient gets asked to paint or receives a mouse event,
which will show up in test output. Slightly unconventional, but very convenient.

* pageoverlay/overlay-small-frame-mouse-events-expected.txt: Added.
* pageoverlay/overlay-small-frame-mouse-events.html: Added.
Add a test ensuring that small-frame overlays get mouse events.

* pageoverlay/overlay-small-frame-paints-expected.txt: Added.
* pageoverlay/overlay-small-frame-paints.html: Added.
Add a test ensuring that small-frame overlays get paint callbacks.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194117 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoWeb Inspector: Convert Sidebar classes to use View
mattbaker@apple.com [Tue, 15 Dec 2015 22:33:55 +0000 (22:33 +0000)]
Web Inspector: Convert Sidebar classes to use View
https://bugs.webkit.org/show_bug.cgi?id=152274

Reviewed by Brian Burg.

Updated Sidebar and SidebarPanel to inherit from View. Mostly mechanical changes.
Once the DetailsSection class family inherits from View (https://webkit.org/b/152269),
directly modifying a sidebar's 'contentView' element will rarely be necessary.

* UserInterface/Views/ApplicationCacheDetailsSidebarPanel.js:
(WebInspector.ApplicationCacheDetailsSidebarPanel):

* UserInterface/Views/CSSStyleDetailsSidebarPanel.js:
(WebInspector.CSSStyleDetailsSidebarPanel):
(WebInspector.CSSStyleDetailsSidebarPanel.prototype.refresh):
(WebInspector.CSSStyleDetailsSidebarPanel.prototype._switchPanels):
Add/remove panels as subviews of the sidebar.
(WebInspector.CSSStyleDetailsSidebarPanel.prototype._filterDidChange):

* UserInterface/Views/DOMNodeDetailsSidebarPanel.js:
(WebInspector.DOMNodeDetailsSidebarPanel):

* UserInterface/Views/DebuggerSidebarPanel.js:
(WebInspector.DebuggerSidebarPanel):
(WebInspector.DebuggerSidebarPanel.prototype._debuggerDidPause):

* UserInterface/Views/LayerTreeDetailsSidebarPanel.js:
(WebInspector.LayerTreeDetailsSidebarPanel.prototype._buildLayerInfoSection):
(WebInspector.LayerTreeDetailsSidebarPanel.prototype._buildDataGridSection):

* UserInterface/Views/NavigationSidebarPanel.js:
(WebInspector.NavigationSidebarPanel):
(WebInspector.NavigationSidebarPanel.prototype.createContentTreeOutline):
(WebInspector.NavigationSidebarPanel.prototype._updateContentOverflowShadowVisibility):

* UserInterface/Views/ProbeDetailsSidebarPanel.js:
(WebInspector.ProbeDetailsSidebarPanel.prototype.set inspectedProbeSets):

* UserInterface/Views/ResourceDetailsSidebarPanel.js:
(WebInspector.ResourceDetailsSidebarPanel):
(WebInspector.ResourceDetailsSidebarPanel.prototype._refreshURL):
(WebInspector.ResourceDetailsSidebarPanel.prototype._refreshImageSizeSection):
(WebInspector.ResourceDetailsSidebarPanel.prototype._refreshRequestDataSection):

* UserInterface/Views/ScopeChainDetailsSidebarPanel.js:
(WebInspector.ScopeChainDetailsSidebarPanel):
(WebInspector.ScopeChainDetailsSidebarPanel.prototype.refresh.):
(WebInspector.ScopeChainDetailsSidebarPanel.prototype.refresh):

* UserInterface/Views/SidebarPanel.js:
Inherit from View.
(WebInspector.SidebarPanel):
Replace the content element (the portion of the view excluding navigation
bars, filter bars, etc.) with a View object. A sidebar's content can be a mixture
of unwrapped DOM elements and View objects. For now, the content view's element
will be mutated directly, but once the DetailsSection class family inherits from
the View class the handling of details sections will be simplified.
(WebInspector.SidebarPanel.prototype.get contentView):
(WebInspector.SidebarPanel.prototype.shown):
(WebInspector.SidebarPanel.prototype.hidden):
(WebInspector.SidebarPanel.prototype.get contentElement): Deleted.
Replaced by WebInspector.SidebarPanel.prototype.get contentView.

* UserInterface/Views/StyleDetailsPanel.js:
Inherit from View.
(WebInspector.StyleDetailsPanel):
(WebInspector.StyleDetailsPanel.prototype.get element): Deleted.
Defer to View.element getter.

* UserInterface/Views/TimelineSidebarPanel.js:
(WebInspector.TimelineSidebarPanel.prototype._updateTimelineOverviewHeight):

* UserInterface/Views/VisualStyleDetailsPanel.js:
(WebInspector.VisualStyleDetailsPanel):
(WebInspector.VisualStyleDetailsPanel.prototype._updateSections):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194116 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoREGRESSION (r192375): DumpRenderTree.app exits immediately with no error
ddkilzer@apple.com [Tue, 15 Dec 2015 22:10:20 +0000 (22:10 +0000)]
REGRESSION (r192375): DumpRenderTree.app exits immediately with no error
<http://webkit.org/b/152314>

Reviewed by Daniel Bates.

The change to DumpRenderTreeMain.mm in r192375 caused the iOS
code path to exit immediately when calling main().
Unfortunately, DumpRenderTreeMain.mm was used for both
DumpRenderTree command-line binary and DumpRenderTree.app, which
meant that the app would exit immediately with no error code
when run!

The workaround is to introduce a separate source file called
DumpRenderTreeAppMain.mm, similar to what WebKitTestRunner
already does.

* DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj: Add
DumpRenderTreeAppMain.mm to the project.  Make it the only
compiled source for the DumpRenderTree.app target.
* DumpRenderTree/ios/DumpRenderTreeAppMain.mm: Copied from Tools/DumpRenderTree/mac/DumpRenderTreeMain.mm.
(main): Call DumpRenderTreeMain() on iOS.  Assert on OS X in
case someone tries mistakenly to use the app.
* DumpRenderTree/mac/Configurations/DumpRenderTree.xcconfig:
Link to JavaScriptCore.framework on iOS for the assert.
* DumpRenderTree/mac/Configurations/DumpRenderTreeApp.xcconfig:
Link to JavaScriptCore.framework on OS X for the assert.  Remove
unneeded EXCLUDED_SOURCE_FILE_NAMES setting.
* DumpRenderTree/mac/DumpRenderTreeMain.mm:
(main): Add assert for iOS so that a crash occurs if someone
tries to run the wrong command.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194115 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[Font Features] TrueType fonts trigger real features even when synthesis is applied
mmaxfield@apple.com [Tue, 15 Dec 2015 21:55:34 +0000 (21:55 +0000)]
[Font Features] TrueType fonts trigger real features even when synthesis is applied
https://bugs.webkit.org/show_bug.cgi?id=152287

Reviewed by Darin Adler.

Source/WebCore:

When using a font feature that is synthesizable, and synthesis is triggered,
we should make sure to turn off the original font feature. Otherwise, the
feature will be applied twice on top of itself.

This worked for OpenType fonts, but not for TrueType fonts.

Tests: css3/font-variant-petite-caps-synthesis.html
       css3/font-variant-small-caps-synthesis.html
       css3/font-variant-petite-caps-synthesis-coverage.html
       css3/font-variant-small-caps-synthesis-coverage.html

* platform/graphics/cocoa/FontCocoa.mm:
(WebCore::defaultSelectorForTrueTypeFeature):
(WebCore::removedFeature):
(WebCore::createCTFontWithoutSynthesizableFeatures):

LayoutTests:

Adding tests.

* css3/font-variant-petite-caps-synthesis-expected.html:
* css3/font-variant-petite-caps-synthesis.html:
* css3/font-variant-small-caps-synthesis-expected.html:
* css3/font-variant-small-caps-synthesis.html:
* css3/font-variant-petite-caps-synthesis-coverage-expected.html:
* css3/font-variant-petite-caps-synthesis-coverage.html:
* css3/font-variant-small-caps-synthesis-coverage-expected.html:
* css3/font-variant-small-caps-synthesis-coverage.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194114 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoPolymorphic operand types for DFG and FTL bit operators.
mark.lam@apple.com [Tue, 15 Dec 2015 21:19:31 +0000 (21:19 +0000)]
Polymorphic operand types for DFG and FTL bit operators.
https://bugs.webkit.org/show_bug.cgi?id=152191

Reviewed by Saam Barati.

Source/JavaScriptCore:

* bytecode/SpeculatedType.h:
(JSC::isUntypedSpeculationForBitOps):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGNode.h:
(JSC::DFG::Node::shouldSpeculateUntypedForBitOps):
- Added check for types not supported by ValueToInt32, and therefore should be
  treated as untyped for bitops.

* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
- Handled untyped operands.

* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
- Added DFG slow path functions for bitops.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitUntypedBitOp):
(JSC::DFG::SpeculativeJIT::compileBitwiseOp):
(JSC::DFG::SpeculativeJIT::emitUntypedRightShiftBitOp):
(JSC::DFG::SpeculativeJIT::compileShiftOp):
* dfg/DFGSpeculativeJIT.h:
- Added DFG backend support untyped operands for bitops.

* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
- Limit bitops strength reduction only to when we don't have untyped operands.
  This is because values that are not int32s need to be converted to int32.
  Without untyped operands, the ValueToInt32 node takes care of this.
  With untyped operands, we cannot use ValueToInt32, and need to do the conversion
  in the code emitted for the bitop node itself.  For example:

      5.5 | 0; // yields 5 because ValueToInt32 converts the 5.5 to a 5.
      "abc" | 0; // would yield "abc" instead of the expected 0 if we let
                 // strength reduction do its thing.

* ftl/FTLCompileBinaryOp.cpp:
(JSC::FTL::generateBinaryBitOpFastPath):
(JSC::FTL::generateRightShiftFastPath):
(JSC::FTL::generateBinaryOpFastPath):

* ftl/FTLInlineCacheDescriptor.h:
(JSC::FTL::BitAndDescriptor::BitAndDescriptor):
(JSC::FTL::BitAndDescriptor::icSize):
(JSC::FTL::BitAndDescriptor::nodeType):
(JSC::FTL::BitAndDescriptor::opName):
(JSC::FTL::BitAndDescriptor::slowPathFunction):
(JSC::FTL::BitAndDescriptor::nonNumberSlowPathFunction):
(JSC::FTL::BitOrDescriptor::BitOrDescriptor):
(JSC::FTL::BitOrDescriptor::icSize):
(JSC::FTL::BitOrDescriptor::nodeType):
(JSC::FTL::BitOrDescriptor::opName):
(JSC::FTL::BitOrDescriptor::slowPathFunction):
(JSC::FTL::BitOrDescriptor::nonNumberSlowPathFunction):
(JSC::FTL::BitXorDescriptor::BitXorDescriptor):
(JSC::FTL::BitXorDescriptor::icSize):
(JSC::FTL::BitXorDescriptor::nodeType):
(JSC::FTL::BitXorDescriptor::opName):
(JSC::FTL::BitXorDescriptor::slowPathFunction):
(JSC::FTL::BitXorDescriptor::nonNumberSlowPathFunction):
(JSC::FTL::BitLShiftDescriptor::BitLShiftDescriptor):
(JSC::FTL::BitLShiftDescriptor::icSize):
(JSC::FTL::BitLShiftDescriptor::nodeType):
(JSC::FTL::BitLShiftDescriptor::opName):
(JSC::FTL::BitLShiftDescriptor::slowPathFunction):
(JSC::FTL::BitLShiftDescriptor::nonNumberSlowPathFunction):
(JSC::FTL::BitRShiftDescriptor::BitRShiftDescriptor):
(JSC::FTL::BitRShiftDescriptor::icSize):
(JSC::FTL::BitRShiftDescriptor::nodeType):
(JSC::FTL::BitRShiftDescriptor::opName):
(JSC::FTL::BitRShiftDescriptor::slowPathFunction):
(JSC::FTL::BitRShiftDescriptor::nonNumberSlowPathFunction):
(JSC::FTL::BitURShiftDescriptor::BitURShiftDescriptor):
(JSC::FTL::BitURShiftDescriptor::icSize):
(JSC::FTL::BitURShiftDescriptor::nodeType):
(JSC::FTL::BitURShiftDescriptor::opName):
(JSC::FTL::BitURShiftDescriptor::slowPathFunction):
(JSC::FTL::BitURShiftDescriptor::nonNumberSlowPathFunction):
- Added support for bitop ICs.

* ftl/FTLInlineCacheSize.cpp:
(JSC::FTL::sizeOfBitAnd):
(JSC::FTL::sizeOfBitOr):
(JSC::FTL::sizeOfBitXor):
(JSC::FTL::sizeOfBitLShift):
(JSC::FTL::sizeOfBitRShift):
(JSC::FTL::sizeOfBitURShift):
* ftl/FTLInlineCacheSize.h:
- Added new bitop IC sizes.  These are just estimates for now that work adequately,
  and are shown to not impact performance on benchmarks.  We will re-tune these
  sizes values later in another patch once all snippet ICs have been added.

* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitAnd):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitOr):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitXor):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitRShift):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitLShift):
(JSC::FTL::DFG::LowerDFGToLLVM::compileBitURShift):
- Added support for bitop ICs.

* jit/JITLeftShiftGenerator.cpp:
(JSC::JITLeftShiftGenerator::generateFastPath):
* jit/JITLeftShiftGenerator.h:
(JSC::JITLeftShiftGenerator::JITLeftShiftGenerator):
* jit/JITRightShiftGenerator.cpp:
(JSC::JITRightShiftGenerator::generateFastPath):
- The shift MASM operatons need to ensure that the shiftAmount is not in the same
  register as the destination register.  With the baselineJIT and DFG, this is
  ensured in how we allocate these registers, and hence, the bug does not manifest.
  With the FTL, these registers are not guaranteed to be unique.  Hence, we need
  to fix the shift op snippet code to compensate for this.

LayoutTests:

* js/regress/ftl-polymorphic-bitand-expected.txt: Added.
* js/regress/ftl-polymorphic-bitand.html: Added.
* js/regress/ftl-polymorphic-bitor-expected.txt: Added.
* js/regress/ftl-polymorphic-bitor.html: Added.
* js/regress/ftl-polymorphic-bitxor-expected.txt: Added.
* js/regress/ftl-polymorphic-bitxor.html: Added.
* js/regress/ftl-polymorphic-lshift-expected.txt: Added.
* js/regress/ftl-polymorphic-lshift.html: Added.
* js/regress/ftl-polymorphic-rshift-expected.txt: Added.
* js/regress/ftl-polymorphic-rshift.html: Added.
* js/regress/ftl-polymorphic-urshift-expected.txt: Added.
* js/regress/ftl-polymorphic-urshift.html: Added.
* js/regress/script-tests/ftl-polymorphic-bitand.js: Added.
(o1.valueOf):
(foo):
* js/regress/script-tests/ftl-polymorphic-bitor.js: Added.
(o1.valueOf):
(foo):
* js/regress/script-tests/ftl-polymorphic-bitxor.js: Added.
(o1.valueOf):
(foo):
* js/regress/script-tests/ftl-polymorphic-lshift.js: Added.
(o1.valueOf):
(foo):
* js/regress/script-tests/ftl-polymorphic-rshift.js: Added.
(o1.valueOf):
(foo):
* js/regress/script-tests/ftl-polymorphic-urshift.js: Added.
(o1.valueOf):
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194113 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoWebRTC: Test that RTCPeerConnection promise functions reject on closed state
adam.bergkvist@ericsson.com [Tue, 15 Dec 2015 20:36:15 +0000 (20:36 +0000)]
WebRTC: Test that RTCPeerConnection promise functions reject on closed state
https://bugs.webkit.org/show_bug.cgi?id=152295

Reviewed by Eric Carlson.

Add test that verifies RTCPeerConnection's behavior in the closed state
(signalingState). Promise functions should reject, and (some) others
should throw. Remove old test that tests incorrect behavior.

* fast/mediastream/RTCPeerConnection-closed-state-expected.txt: Added.
* fast/mediastream/RTCPeerConnection-closed-state.html: Added.
* fast/mediastream/RTCPeerConnection-state-expected.txt: Removed.
* fast/mediastream/RTCPeerConnection-state.html: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194112 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[WinCairo][MediaFoundation] Full screen mode is not supported.
peavo@outlook.com [Tue, 15 Dec 2015 19:11:45 +0000 (19:11 +0000)]
[WinCairo][MediaFoundation] Full screen mode is not supported.
https://bugs.webkit.org/show_bug.cgi?id=152300

Reviewed by Darin Adler.

We need to let WebCore know MediaFoundation supports full screen mode.

* platform/graphics/win/MediaPlayerPrivateMediaFoundation.cpp:
(WebCore::MediaPlayerPrivateMediaFoundation::pause):
(WebCore::MediaPlayerPrivateMediaFoundation::supportsFullscreen):
(WebCore::MediaPlayerPrivateMediaFoundation::naturalSize):
* platform/graphics/win/MediaPlayerPrivateMediaFoundation.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194111 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoGuard code that uses class LayerTreeHost with USE(COORDINATED_GRAPHICS) or USE(TEXTUR...
dbates@webkit.org [Tue, 15 Dec 2015 18:40:30 +0000 (18:40 +0000)]
Guard code that uses class LayerTreeHost with USE(COORDINATED_GRAPHICS) or USE(TEXTURE_MAPPER)
https://bugs.webkit.org/show_bug.cgi?id=152265

Reviewed by Tim Horton.

We neither make use of LayerTreeHost on Mac nor on iOS. We should guard code that makes
use of this class as applicable. This also fixes the iOS Simulator build when using
Apple Internal software.

* WebProcess/WebCoreSupport/WebChromeClient.cpp: Guard code that used LayerTreeHost.
* WebProcess/WebPage/LayerTreeHost.cpp: Guard contents of file with USE(COORDINATED_GRAPHICS) || USE(TEXTURE_MAPPER).
* WebProcess/WebPage/LayerTreeHost.h: Ditto.
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::scalePage): Ditto.
(WebKit::WebPage::setDeviceScaleFactor): Ditto.
* WebProcess/WebPage/WebPage.h: Substitute header LayerTreeContext.h for LayerTreeHost.h since we make use
of the enum class LayerHostingMode.
* WebProcess/WebPage/ios/WebPageIOS.mm:
(WebKit::WebPage::updateVisibleContentRects): Remove unnecessary code; DrawingArea::layerTreeHost() always
returns nullptr on iOS.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194108 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[JSC] SyntaxError if AssignmentElement is `eval` or `arguments` in strict code
commit-queue@webkit.org [Tue, 15 Dec 2015 17:58:04 +0000 (17:58 +0000)]
[JSC] SyntaxError if AssignmentElement is `eval` or `arguments` in strict code
https://bugs.webkit.org/show_bug.cgi?id=152302

Patch by Caitlin Potter <caitp@igalia.com> on 2015-12-15
Reviewed by Mark Lam.

`eval` and `arguments` must not be assigned to in strict code. This
change fixes `language/expressions/assignment/destructuring/obj-id-simple-strict.js`
in Test262, as well as a variety of other similar tests.

* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseAssignmentElement):
(JSC::Parser<LexerType>::parseDestructuringPattern):
* tests/stress/destructuring-assignment-syntax.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194107 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[GTK] Gardening: Rebaseline tests
commit-queue@webkit.org [Tue, 15 Dec 2015 17:40:09 +0000 (17:40 +0000)]
[GTK] Gardening: Rebaseline tests
https://bugs.webkit.org/show_bug.cgi?id=152301

Unreviewed GTK gardening

Patch by Tomas Popela <tpopela@redhat.com> on 2015-12-15

* platform/gtk/fast/dom/Window/window-lookup-precedence-expected.txt:
Correct the expectations after r189202 when RangeException was
removed.
* platform/gtk/fast/dom/adopt-attribute-crash-expected.txt: Added.
Add a new test expectations after r187148.
* platform/gtk/http/tests/plugins/plugin-javascript-access-expected.txt: Added.
Add a new test expectations after r193363.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194106 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoChanging expectation for storage/indexeddb/deleted-objects.html to [ Failure Crash ]
ryanhaddad@apple.com [Tue, 15 Dec 2015 16:36:51 +0000 (16:36 +0000)]
Changing expectation for storage/indexeddb/deleted-objects.html to [ Failure Crash ]
https://bugs.webkit.org/show_bug.cgi?id=152264

Unreviewed test gardening.

* platform/mac-wk1/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194105 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[css-align][css-grid] Overflow alignment value 'true' renamed to 'unsafe'
jfernandez@igalia.com [Tue, 15 Dec 2015 12:11:56 +0000 (12:11 +0000)]
[css-align][css-grid] Overflow alignment value 'true' renamed to 'unsafe'
https://bugs.webkit.org/show_bug.cgi?id=152251

Source/WebCore:

Reviewed by Darin Adler.

The 'True' Overflow Alignment keyword is now defined in the Box Alignment
specification as 'Unsafe'.

This patch applies the required changes in the CSS parsing logic, as well
Grid Layout specific codebase, so it complies with the last version of the
spec.

No new tests, no change in functionality.

* css/CSSParser.cpp:
(WebCore::isAlignmentOverflowKeyword):
(WebCore::CSSParser::parseItemPositionOverflowPosition):
* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator OverflowAlignment):
* css/CSSValueKeywords.in:
* rendering/RenderGrid.cpp:
(WebCore::computeOverflowAlignmentOffset):
* rendering/style/RenderStyleConstants.h:

LayoutTests:

The 'True' Overflow Alignment keyword is known now as 'Unsafe', so adapting
layout tests using such keyword.

Reviewed by Darin Adler.

* css3/overwrite-content-alignment-expected.txt:
* css3/overwrite-content-alignment.html:
* css3/overwrite-self-alignment-expected.txt:
* css3/overwrite-self-alignment.html:
* css3/parse-align-content-expected.txt:
* css3/parse-align-content.html:
* css3/parse-align-items-expected.txt:
* css3/parse-align-items.html:
* css3/parse-align-self-expected.txt:
* css3/parse-align-self.html:
* css3/parse-justify-content-expected.txt:
* css3/parse-justify-content.html:
* fast/css-grid-layout/grid-align-justify-overflow.html:
* fast/css-grid-layout/grid-content-alignment-overflow.html:
* fast/css/parse-justify-items-expected.txt:
* fast/css/parse-justify-items.html:
* fast/css/parse-justify-self-expected.txt:
* fast/css/parse-justify-self.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194104 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[TexMap] Operate with a reference to the TextureMapper wherever possible
zandobersek@gmail.com [Tue, 15 Dec 2015 11:54:13 +0000 (11:54 +0000)]
[TexMap] Operate with a reference to the TextureMapper wherever possible
https://bugs.webkit.org/show_bug.cgi?id=152118

Reviewed by Martin Robinson.

Source/WebCore:

In most cases where used, the pointer to the TextureMapper is non-null, so it
should really be a reference. The pointer is still used for the
TextureMapperLayer member variable which is null until the TextureMapper object
is created and set on the root layer.

* platform/graphics/GraphicsContext3DPrivate.cpp:
(WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
* platform/graphics/GraphicsContext3DPrivate.h:
* platform/graphics/cairo/ImageBufferCairo.cpp:
(WebCore::ImageBufferData::paintToTextureMapper):
* platform/graphics/cairo/ImageBufferDataCairo.h:
* platform/graphics/efl/GraphicsContext3DPrivate.cpp:
(WebCore::GraphicsContext3DPrivate::paintToTextureMapper):
* platform/graphics/efl/GraphicsContext3DPrivate.h:
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::paintToTextureMapper):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:
* platform/graphics/surfaces/GraphicsSurface.cpp:
(WebCore::GraphicsSurface::paintToTextureMapper):
* platform/graphics/surfaces/GraphicsSurface.h:
* platform/graphics/surfaces/efl/GraphicsSurfaceCommon.cpp:
(WebCore::GraphicsSurface::platformPaintToTextureMapper):
* platform/graphics/texmap/BitmapTexture.cpp:
(WebCore::BitmapTexture::updateContents):
* platform/graphics/texmap/BitmapTexture.h:
(WebCore::BitmapTexture::applyFilters):
* platform/graphics/texmap/BitmapTextureGL.cpp:
(WebCore::BitmapTextureGL::applyFilters):
* platform/graphics/texmap/BitmapTextureGL.h:
* platform/graphics/texmap/GraphicsLayerTextureMapper.cpp:
(WebCore::GraphicsLayerTextureMapper::updateBackingStoreIfNeeded):
* platform/graphics/texmap/TextureMapperBackingStore.h:
(WebCore::TextureMapperBackingStore::drawRepaintCounter):
* platform/graphics/texmap/TextureMapperFPSCounter.cpp:
(WebCore::TextureMapperFPSCounter::updateFPSAndDisplay):
* platform/graphics/texmap/TextureMapperFPSCounter.h:
* platform/graphics/texmap/TextureMapperLayer.cpp:
(WebCore::TextureMapperPaintOptions::TextureMapperPaintOptions):
(WebCore::TextureMapperLayer::paint):
(WebCore::TextureMapperLayer::paintSelf):
(WebCore::TextureMapperLayer::paintSelfAndChildren):
(WebCore::TextureMapperLayer::paintUsingOverlapRegions):
(WebCore::TextureMapperLayer::applyMask):
(WebCore::TextureMapperLayer::paintIntoSurface):
(WebCore::commitSurface):
(WebCore::TextureMapperLayer::paintWithIntermediateSurface):
* platform/graphics/texmap/TextureMapperPlatformLayer.h:
(WebCore::TextureMapperPlatformLayer::drawBorder):
* platform/graphics/texmap/TextureMapperPlatformLayerBuffer.cpp:
(WebCore::TextureMapperPlatformLayerBuffer::paintToTextureMapper):
* platform/graphics/texmap/TextureMapperPlatformLayerBuffer.h:
* platform/graphics/texmap/TextureMapperSurfaceBackingStore.cpp:
(WebCore::TextureMapperSurfaceBackingStore::paintToTextureMapper):
* platform/graphics/texmap/TextureMapperSurfaceBackingStore.h:
* platform/graphics/texmap/TextureMapperTile.cpp:
(WebCore::TextureMapperTile::updateContents):
(WebCore::TextureMapperTile::paint):
* platform/graphics/texmap/TextureMapperTile.h:
* platform/graphics/texmap/TextureMapperTiledBackingStore.cpp:
(WebCore::TextureMapperTiledBackingStore::updateContentsFromImageIfNeeded):
(WebCore::TextureMapperTiledBackingStore::paintToTextureMapper):
(WebCore::TextureMapperTiledBackingStore::drawBorder):
(WebCore::TextureMapperTiledBackingStore::drawRepaintCounter):
(WebCore::TextureMapperTiledBackingStore::updateContents):
* platform/graphics/texmap/TextureMapperTiledBackingStore.h:

Source/WebKit/win:

* WebCoreSupport/AcceleratedCompositingContext.cpp:
(AcceleratedCompositingContext::compositeLayersToContext): TextureMapper object
is now operated with through a reference.

Source/WebKit2:

Replace pointers to the TextureMapper object with references.

* Shared/CoordinatedGraphics/CoordinatedBackingStore.cpp:
(WebKit::CoordinatedBackingStoreTile::swapBuffers):
(WebKit::CoordinatedBackingStore::paintTilesToTextureMapper):
(WebKit::CoordinatedBackingStore::paintToTextureMapper):
(WebKit::CoordinatedBackingStore::drawBorder):
(WebKit::CoordinatedBackingStore::drawRepaintCounter):
(WebKit::CoordinatedBackingStore::commitTileOperations):
* Shared/CoordinatedGraphics/CoordinatedBackingStore.h:
* Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:
(WebKit::CoordinatedGraphicsScene::paintToCurrentGLContext):
(WebKit::CoordinatedGraphicsScene::paintToGraphicsContext):
(WebKit::CoordinatedGraphicsScene::commitPendingBackingStoreOperations):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194103 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUnreviewed, rename ExecState* exec to ExecState* state in Intl code
sukolsak@gmail.com [Tue, 15 Dec 2015 10:33:09 +0000 (10:33 +0000)]
Unreviewed, rename ExecState* exec to ExecState* state in Intl code
as reviewed in https://bugs.webkit.org/show_bug.cgi?id=151491

* runtime/IntlCollatorPrototype.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194102 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoURTBF after 194062.
ossy@webkit.org [Tue, 15 Dec 2015 09:07:16 +0000 (09:07 +0000)]
URTBF after 194062.

* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::supportsFloatingPointCeil): Added.
(JSC::MacroAssemblerARM::ceilDouble): Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194101 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoWebIDL generator should support the possibility for C++ classes to have a JS Builtin...
youenn.fablet@crf.canon.fr [Tue, 15 Dec 2015 08:55:23 +0000 (08:55 +0000)]
WebIDL generator should support the possibility for C++ classes to have a JS Builtin constructor
https://bugs.webkit.org/show_bug.cgi?id=152171

Reviewed by Darin Adler.

Reintroducing JSBuiltinConstructor keyword as a way to run automatically a JS builtin initialization function
to process the arguments passed to the DOM C++ constructor.

Specialized createJSObject for those classes.

Fixing typo in TestCustomConstructor.idl.

Covered by binding tests.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateConstructorDefinition):
(IsConstructable):
(IsJSBuiltinConstructor):
(AddJSBuiltinIncludesIfNeeded):
* bindings/scripts/test/GObject/WebKitDOMTestClassWithJSBuiltinConstructor.cpp: Added.
* bindings/scripts/test/GObject/WebKitDOMTestClassWithJSBuiltinConstructor.h: Added.
* bindings/scripts/test/GObject/WebKitDOMTestClassWithJSBuiltinConstructorPrivate.h: Added.
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp: Added.
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h: Added.
* bindings/scripts/test/ObjC/DOMTestClassWithJSBuiltinConstructor.h: Added.
* bindings/scripts/test/ObjC/DOMTestClassWithJSBuiltinConstructor.mm: Added.
* bindings/scripts/test/ObjC/DOMTestClassWithJSBuiltinConstructorInternal.h: Added.
* bindings/scripts/test/TestClassWithJSBuiltinConstructor.idl: Copied from Source/WebCore/bindings/scripts/test/TestCustomConstructor.idl.
* bindings/scripts/test/TestCustomConstructor.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194100 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[Coordinated Graphics] CSS transition effect is not shown when transformed with ...
commit-queue@webkit.org [Tue, 15 Dec 2015 06:49:03 +0000 (06:49 +0000)]
[Coordinated Graphics] CSS transition effect is not shown when transformed with "%" unit.
https://bugs.webkit.org/show_bug.cgi?id=152278

Patch by YongGeol Jung <yg48.jung@samsung.com> on 2015-12-14
Reviewed by Darin Adler.

boxSize is encoded as FloatSize type but decoded as IntSize type.
So boxSize gets invalid value after decoding.
Due to this layer goes to out of screen during animation.

* Shared/CoordinatedGraphics/CoordinatedGraphicsArgumentCoders.cpp:
(IPC::ArgumentCoder<TextureMapperAnimation>::decode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194095 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago<rdar://problem/23886216> REGRESSION (r194022): Production builds of PluginProcess...
mitz@apple.com [Tue, 15 Dec 2015 06:08:19 +0000 (06:08 +0000)]
<rdar://problem/23886216> REGRESSION (r194022): Production builds of PluginProcess crash on launch when not installed in /System
https://bugs.webkit.org/show_bug.cgi?id=152291

Reviewed by Darin Adler.

* Configurations/PluginProcess.xcconfig: Added a FIXME.
* UIProcess/Launcher/mac/ProcessLauncherMac.mm:
(WebKit::addDYLDEnvironmentAdditions): Set DYLD_LIBRARY_PATH to point to where the shims
are. This is needed because starting in El Capitan, the processes’ main executables link
directly against the shims, so the dynamic linker needs to be able to find them in the
non-/System location. Also added a FIXME about not having to set DYLD_INSERT_LIBRARIES when
the main executables link the them directly.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194094 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUsing fake timestamp in OS version make some results invisible
rniwa@webkit.org [Tue, 15 Dec 2015 05:15:52 +0000 (05:15 +0000)]
Using fake timestamp in OS version make some results invisible
https://bugs.webkit.org/show_bug.cgi?id=152289

Reviewed by Stephanie Lewis.

Fix various bugs after r194088.

* public/api/commits.php:
(format_commit): Include the commit order.
* public/v2/data.js:
(CommitLogs._cacheConsecutiveCommits): Sort by commit order when commit time is missing.
* tools/pull-os-versions.py:
(OSBuildFetcher._assign_order): Use integer instead of fake time for commit order.
(available_builds_from_command): Exit early when an exception is thrown.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194093 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoFTL B3 should account for localsOffset
fpizlo@apple.com [Tue, 15 Dec 2015 04:52:55 +0000 (04:52 +0000)]
FTL B3 should account for localsOffset
https://bugs.webkit.org/show_bug.cgi?id=152288

Reviewed by Saam Barati.

The DFG will build up some data structures that expect to know about offsets from FP. Those data
structures may slide by some offset when the low-level compiler (either LLVM or B3) does stack
allocation. So, the LLVM FTL modifies those data structures based on the real offset that it gets
from LLVM's stackmaps. The B3 code needs to do the same.

I had previously vowed to never put more stuff into FTLB3Compile.cpp, because I didn't want it to
look like FTLCompile.cpp. Up until now, I was successful because I used lambdas installed by
FTLLower. But in this case, I actually think that having code that just does this explicitly in
FTLB3Compile.cpp is least confusing. There is no particular place in FTLLower that would want to
care about this, and we need to ensure that we do this fixup before we run any of the stackmap
generators. In other words, it needs to happen before we call B3::generate(). The ordering
constraints seem like a good reason to have this done explicitly rather than through lambdas.

I wrote a test. The test was failing in trunk because the B3 meaning of anchor().value() is
different from the LLVM meaning. This caused breakage when we used this idiom:

    ValueFromBlock foo = m_out.anchor(things);
    ...(foo.value()) // we were expecting that foo.value() == things

I never liked this idiom to begin with, so instead of trying to change B3's anchor(), I changed
the idiom to:

    LValue fooValue = things;
    ValueFromBlock foo = m_out.anchor(fooValue);
    ...(fooValue)

This is probably a good idea, since eventually we want B3's anchor() to just return the
UpsilonValue*. To get there, we want to eliminate any situations where code assumes that
ValueFromBlock is an actual object and not just a typedef for a pointer.

* ftl/FTLB3Compile.cpp:
(JSC::FTL::compile):
* ftl/FTLB3Output.cpp:
(JSC::FTL::Output::appendTo):
(JSC::FTL::Output::lockedStackSlot):
* ftl/FTLB3Output.h:
(JSC::FTL::Output::framePointer):
(JSC::FTL::Output::constBool):
(JSC::FTL::Output::constInt32):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::lower):
(JSC::FTL::DFG::LowerDFGToLLVM::compileGetIndexedPropertyStorage):
(JSC::FTL::DFG::LowerDFGToLLVM::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToLLVM::compileCreateDirectArguments):
(JSC::FTL::DFG::LowerDFGToLLVM::compileStringCharAt):
(JSC::FTL::DFG::LowerDFGToLLVM::compileForwardVarargs):
(JSC::FTL::DFG::LowerDFGToLLVM::compileHasIndexedProperty):
(JSC::FTL::DFG::LowerDFGToLLVM::allocateJSArray):
(JSC::FTL::DFG::LowerDFGToLLVM::sensibleDoubleToInt32):
* ftl/FTLState.h:
(JSC::FTL::verboseCompilationEnabled):
* tests/stress/ftl-function-dot-arguments-with-callee-saves.js: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194092 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRe-enabling passing test fast/viewport/ios/width-is-device-width.html, which was...
ryanhaddad@apple.com [Tue, 15 Dec 2015 04:43:03 +0000 (04:43 +0000)]
Re-enabling passing test fast/viewport/ios/width-is-device-width.html, which was accidentally skipped with r194058.
https://bugs.webkit.org/show_bug.cgi?id=152135

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194091 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoFix a typo in the previous commit.
rniwa@webkit.org [Tue, 15 Dec 2015 04:32:31 +0000 (04:32 +0000)]
Fix a typo in the previous commit.

* public/include/report-processor.php:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194090 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoBuild fix after r192965. Suppress a warning about log being referred to as a closure...
rniwa@webkit.org [Tue, 15 Dec 2015 04:31:30 +0000 (04:31 +0000)]
Build fix after r192965. Suppress a warning about log being referred to as a closure variable.

* public/include/report-processor.php:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194089 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUsing fake timestamp in OS version make some results invisible
rniwa@webkit.org [Tue, 15 Dec 2015 04:06:44 +0000 (04:06 +0000)]
Using fake timestamp in OS version make some results invisible
https://bugs.webkit.org/show_bug.cgi?id=152289

Reviewed by Stephanie Lewis.

Added commit_order column to explicitly order OS versions. This fixes the bug whereby which
baseline results reported with only OS versions are shown with x coordinate set to 10 years ago.

To migrate the existing database, run:
    ALTER TABLE commits ADD COLUMN commit_order integer;
    CREATE INDEX commit_order_index ON commits(commit_order);

Then for each repository $1,
    UPDATE commits SET (commit_time, commit_order) = (NULL, CAST(EXTRACT(epoch from commit_time) as integer))
    WHERE commit_repository = $1;

* init-database.sql: Added the column.
* public/api/commits.php:
(fetch_commits_between): Use commit_order to order commits when commit_time is missing.
* public/api/report-commits.php:
(main): Set commit_order.
* tools/pull-os-versions.py:
(OSBuildFetcher.fetch_and_report_new_builds):
(OSBuildFetcher._assign_order): Renamed from _assign_fake_timestamps. Set the order instead of a fake timestmap.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194088 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMath.random should have an intrinsic thunk and it should be later handled as a DFG...
utatane.tea@gmail.com [Tue, 15 Dec 2015 03:51:42 +0000 (03:51 +0000)]
Math.random should have an intrinsic thunk and it should be later handled as a DFG Node
https://bugs.webkit.org/show_bug.cgi?id=152133

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

In this patch, we implement new RandomIntrinsic. It emits a machine code to generate random numbers efficiently.
And later it will be recognized by DFG and converted to ArithRandom node.
It provides type information SpecDoubleReal since Math.random only generates a number within [0, 1.0).

Currently, only 64bit version is supported. On 32bit environment, ArithRandom will be converted to callOperation.
While it emits a function call, ArithRandom node on 32bit still represents SpecDoubleReal as a result type.

* dfg/DFGAbstractHeap.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileArithRandom):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileArithRandom):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithRandom):
* jit/AssemblyHelpers.cpp:
(JSC::emitRandomThunkImpl):
(JSC::AssemblyHelpers::emitRandomThunk):
* jit/AssemblyHelpers.h:
* jit/JITOperations.h:
* jit/ThunkGenerators.cpp:
(JSC::randomThunkGenerator):
* jit/ThunkGenerators.h:
* runtime/Intrinsic.h:
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::weakRandomOffset):
* runtime/MathObject.cpp:
(JSC::MathObject::finishCreation):
* runtime/VM.cpp:
(JSC::thunkGeneratorForIntrinsic):
* tests/stress/random-53bit.js: Added.
(test):
* tests/stress/random-in-range.js: Added.
(test):

Source/WTF:

Change 64bit random to double logic to convert efficiently.

* wtf/WeakRandom.h:
(WTF::WeakRandom::get):
(WTF::WeakRandom::lowOffset):
(WTF::WeakRandom::highOffset):

LayoutTests:

Add new regression test.

* js/regress/math-random-expected.txt: Added.
* js/regress/math-random.html: Added.
* js/regress/script-tests/math-random.js: Added.
(test):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194087 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoDump some more data in the RemoteLayerTreeTransaction
simon.fraser@apple.com [Tue, 15 Dec 2015 03:06:13 +0000 (03:06 +0000)]
Dump some more data in the RemoteLayerTreeTransaction
https://bugs.webkit.org/show_bug.cgi?id=152283

Reviewed by Dean Jackson.

Dump some scale factors, viewport meta tag width and render tree size.

* Shared/mac/RemoteLayerTreeTransaction.mm:
(WebKit::RemoteLayerTreeTransaction::description):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194086 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoPerf dashboard can't merge when the destination platform is missing baseline/target
rniwa@webkit.org [Tue, 15 Dec 2015 02:59:36 +0000 (02:59 +0000)]
Perf dashboard can't merge when the destination platform is missing baseline/target
https://bugs.webkit.org/show_bug.cgi?id=152286

Reviewed by Stephanie Lewis.

The bug was caused by the query to migrate test configurations to new platform checking
configuration type and metric separately; that is, it assumes the configuration exists
only if either the same type or the same metric exists in the destination.

Fixed the bug by checking both conditions simultaneously for each configuration.

* public/admin/platforms.php:
* tests/admin-platforms.js: Added a test.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194085 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoWeb Inspector: Stack traces in console incorrectly show "(anonymous function)" for...
commit-queue@webkit.org [Tue, 15 Dec 2015 01:14:34 +0000 (01:14 +0000)]
Web Inspector: Stack traces in console incorrectly show "(anonymous function)" for global code
https://bugs.webkit.org/show_bug.cgi?id=152280

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-12-14
Reviewed by Brian Burg.

Source/WebInspectorUI:

* UserInterface/Images/Program.svg: Added.
* UserInterface/Images/gtk/Program.svg: Added.
Copied from TimelineRecordScriptEvaluated.svg.

* UserInterface/Models/CallFrame.js:
(WebInspector.CallFrame):
(WebInspector.CallFrame.prototype.get programCode):
Add a new property to check if this call frame is in program code.

(WebInspector.CallFrame.fromPayload):
Detect different sources of program code (global, eval, module).

* UserInterface/Views/CallFrameIcons.css:
(.program-icon .icon):
* UserInterface/Views/CallFrameView.js:
(WebInspector.CallFrameView.iconClassNameForCallFrame):
Give program code the [S] global script icon like in profiles.

LayoutTests:

* inspector/debugger/js-stacktrace-expected.txt:
* inspector/debugger/js-stacktrace.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194083 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMarking storage/indexeddb/deleted-objects.html as a flaky crash on mac-wk1
ryanhaddad@apple.com [Tue, 15 Dec 2015 01:11:44 +0000 (01:11 +0000)]
Marking storage/indexeddb/deleted-objects.html as a flaky crash on mac-wk1
https://bugs.webkit.org/show_bug.cgi?id=152264

Unreviewed test gardening.

* platform/mac-wk1/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194082 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMarking platform/ios-simulator/ios/scrolling tests as failing on ios-simulator
ryanhaddad@apple.com [Tue, 15 Dec 2015 01:03:35 +0000 (01:03 +0000)]
Marking platform/ios-simulator/ios/scrolling tests as failing on ios-simulator
https://bugs.webkit.org/show_bug.cgi?id=152276

Unreviewed test gardening.

* platform/ios-simulator/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194081 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRename FTL::Output's ceil64() to doubleCeil()
benjamin@webkit.org [Tue, 15 Dec 2015 00:34:37 +0000 (00:34 +0000)]
Rename FTL::Output's ceil64() to doubleCeil()

Rubber-stamped by Filip Pizlo.

ceil64() was a bad name, that's the name convention we use for integers.

* ftl/FTLB3Output.h:
(JSC::FTL::Output::doubleCeil):
(JSC::FTL::Output::ceil64): Deleted.
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileArithRound):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194073 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoFTL B3 should be able to run n-body.js
fpizlo@apple.com [Tue, 15 Dec 2015 00:30:53 +0000 (00:30 +0000)]
FTL B3 should be able to run n-body.js
https://bugs.webkit.org/show_bug.cgi?id=152281

Reviewed by Benjamin Poulain.

Fix a bug where m_captured was pointing to the start of the captured vars slot rather than the
end, like the rest of the FTL expected.

* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::lower):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194072 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoFix bad copy-paste in r194062
benjamin@webkit.org [Tue, 15 Dec 2015 00:11:45 +0000 (00:11 +0000)]
Fix bad copy-paste in r194062

Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-12-14

* ftl/FTLB3Output.h:
(JSC::FTL::Output::ceil64):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194071 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUpdating ios-simulator expectation for crashing tests http/tests/misc/large-js-progra...
ryanhaddad@apple.com [Mon, 14 Dec 2015 23:48:34 +0000 (23:48 +0000)]
Updating ios-simulator expectation for crashing tests http/tests/misc/large-js-program.php and js/dom/line-column-numbers.html
https://bugs.webkit.org/show_bug.cgi?id=152279

Unreviewed test gardening.

* platform/ios-simulator/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194070 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRemoving ios-simulator TestExpectations for deleted tests: streams/reference-implemen...
ryanhaddad@apple.com [Mon, 14 Dec 2015 23:42:02 +0000 (23:42 +0000)]
Removing ios-simulator TestExpectations for deleted tests: streams/reference-implementation/readable-stream-cancel.html (r192186)
and http/tests/inspector/console/access-inspected-object.html (r192186).
https://bugs.webkit.org/show_bug.cgi?id=152131

Unreviewed test gardening.

* platform/ios-simulator-wk1/TestExpectations:
* platform/ios-simulator-wk2/TestExpectations:
* platform/ios-simulator/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194069 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUnreviewed, fix cloop build.
fpizlo@apple.com [Mon, 14 Dec 2015 23:27:15 +0000 (23:27 +0000)]
Unreviewed, fix cloop build.

* jit/GPRInfo.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194068 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoFTL B3 should do PutById
fpizlo@apple.com [Mon, 14 Dec 2015 23:18:36 +0000 (23:18 +0000)]
FTL B3 should do PutById
https://bugs.webkit.org/show_bug.cgi?id=152268

Reviewed by Saam Barati.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::createGenericCompare): I realized that we were missing some useful matching rules.
* b3/testb3.cpp: Added a bunch of tests.
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compilePutById): Do the things.
* jit/GPRInfo.cpp: Added. I had to do this yucky thing because clang was having issues compiling references to this from deeply nested lambdas.
* jit/GPRInfo.h: Added a comment about how patchpointScratchRegister is bizarre and should probably die.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194067 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoWeb Inspector: Copy message from console with a stack trace does not include source...
commit-queue@webkit.org [Mon, 14 Dec 2015 23:10:22 +0000 (23:10 +0000)]
Web Inspector: Copy message from console with a stack trace does not include source code locations
https://bugs.webkit.org/show_bug.cgi?id=152270

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2015-12-14
Reviewed by Timothy Hatcher.

* UserInterface/Views/ConsoleMessageView.js:
(WebInspector.ConsoleMessageView.prototype.toClipboardString):
When the the StackTrace was upgraded to a real collection of CallFrame
object's the CallFrame's got real SourceCodeLocation properties.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194066 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoAdding a second newline to the iOS simulator expected result for compositing/iframes...
ryanhaddad@apple.com [Mon, 14 Dec 2015 23:01:04 +0000 (23:01 +0000)]
Adding a second newline to the iOS simulator expected result for compositing/iframes/page-cache-layer-tree.html
https://bugs.webkit.org/show_bug.cgi?id=152132

Unreviewed test gardening.

* platform/ios-simulator-wk2/compositing/iframes/page-cache-layer-tree-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194063 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[JSC] Add ceil() support for x86 and expose it to B3
commit-queue@webkit.org [Mon, 14 Dec 2015 22:44:22 +0000 (22:44 +0000)]
[JSC] Add ceil() support for x86 and expose it to B3
https://bugs.webkit.org/show_bug.cgi?id=152231

Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-12-14
Reviewed by Geoffrey Garen.

Most x86 CPUs we care about support ceil() natively
with the round instruction.

This patch expose that behind a runtime flag, use it
in the Math.ceil() thunk and expose it to B3.

* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::supportsFloatingPointCeil):
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::supportsFloatingPointCeil):
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::supportsFloatingPointCeil):
* assembler/MacroAssemblerSH4.h:
(JSC::MacroAssemblerSH4::supportsFloatingPointCeil):
* assembler/MacroAssemblerX86Common.cpp:
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::ceilDouble):
(JSC::MacroAssemblerX86Common::ceilFloat):
(JSC::MacroAssemblerX86Common::supportsFloatingPointCeil):
(JSC::MacroAssemblerX86Common::supportsLZCNT):
* assembler/X86Assembler.h:
(JSC::X86Assembler::roundss_rr):
(JSC::X86Assembler::roundss_mr):
(JSC::X86Assembler::roundsd_rr):
(JSC::X86Assembler::roundsd_mr):
(JSC::X86Assembler::mfence):
(JSC::X86Assembler::X86InstructionFormatter::threeByteOp):
* b3/B3ConstDoubleValue.cpp:
(JSC::B3::ConstDoubleValue::ceilConstant):
* b3/B3ConstDoubleValue.h:
* b3/B3ConstFloatValue.cpp:
(JSC::B3::ConstFloatValue::ceilConstant):
* b3/B3ConstFloatValue.h:
* b3/B3LowerMacrosAfterOptimizations.cpp:
* b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::lower):
* b3/B3Opcode.cpp:
(WTF::printInternal):
* b3/B3Opcode.h:
* b3/B3ReduceDoubleToFloat.cpp:
* b3/B3ReduceStrength.cpp:
* b3/B3Validate.cpp:
* b3/B3Value.cpp:
(JSC::B3::Value::ceilConstant):
(JSC::B3::Value::effects):
(JSC::B3::Value::key):
(JSC::B3::Value::typeFor):
* b3/B3Value.h:
* b3/air/AirOpcode.opcodes:
* b3/testb3.cpp:
(JSC::B3::testCeilArg):
(JSC::B3::testCeilImm):
(JSC::B3::testCeilMem):
(JSC::B3::testCeilCeilArg):
(JSC::B3::testCeilIToD64):
(JSC::B3::testCeilIToD32):
(JSC::B3::testCeilArgWithUselessDoubleConversion):
(JSC::B3::testCeilArgWithEffectfulDoubleConversion):
(JSC::B3::populateWithInterestingValues):
(JSC::B3::run):
* ftl/FTLB3Output.h:
(JSC::FTL::Output::ceil64):
* jit/ThunkGenerators.cpp:
(JSC::ceilThunkGenerator):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194062 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMarking js/regress/generator-with-several-types.html as a flaky timeout on mac-wk1...
ryanhaddad@apple.com [Mon, 14 Dec 2015 22:26:40 +0000 (22:26 +0000)]
Marking js/regress/generator-with-several-types.html as a flaky timeout on mac-wk1 debug.
https://bugs.webkit.org/show_bug.cgi?id=152272

Unreviewed test gardening.

* platform/mac-wk1/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194061 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoFrequent crash under -[WKPDFView web_setMinimumSize:]_block_invoke
timothy_horton@apple.com [Mon, 14 Dec 2015 22:12:02 +0000 (22:12 +0000)]
Frequent crash under -[WKPDFView web_setMinimumSize:]_block_invoke
https://bugs.webkit.org/show_bug.cgi?id=152266
<rdar://problem/22092676>

Reviewed by Simon Fraser.

Source/WebKit2:

* UIProcess/ios/WKPDFView.mm:
(-[WKPDFView web_setMinimumSize:]):
We weren't retaining the UIScrollView, but depending on it surviving
into this block's invocation.

We don't need to do this asynchronously anymore because the referenced
bug is fixed, so make it happen synchronously. This also fixes the crash
because there's no opportunity for the scroll view to be released.

Tools:

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKit2Cocoa/WKPDFViewResizeCrash.mm: Added.
Add a test that crashed before this change, and doesn't crash after.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194060 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoTake 2 of updating expectations for fast/events/ios tests by removing the directory...
ryanhaddad@apple.com [Mon, 14 Dec 2015 22:10:37 +0000 (22:10 +0000)]
Take 2 of updating expectations for fast/events/ios tests by removing the directory's [ Pass ] expectation.
https://bugs.webkit.org/show_bug.cgi?id=152134

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194059 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoTake 2 of updating expectations for fast/viewport/ios tests by removing the directory...
ryanhaddad@apple.com [Mon, 14 Dec 2015 22:08:25 +0000 (22:08 +0000)]
Take 2 of updating expectations for fast/viewport/ios tests by removing the directory's [ Pass ] expectation.
https://bugs.webkit.org/show_bug.cgi?id=152135

Unreviewed test gardening.

* platform/ios-simulator-wk2/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194058 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoResourceUsageOverlay should show GC timers.
akling@apple.com [Mon, 14 Dec 2015 21:36:27 +0000 (21:36 +0000)]
ResourceUsageOverlay should show GC timers.
<https://webkit.org/b/152151>

Reviewed by Darin Adler.

Source/JavaScriptCore:

Expose the next fire time (in WTF timestamp style) of a GCActivityCallback.

* heap/GCActivityCallback.cpp:
(JSC::GCActivityCallback::scheduleTimer):
(JSC::GCActivityCallback::cancelTimer):
* heap/GCActivityCallback.h:

Source/WebCore:

Add countdowns until next Eden and Full GC to the overlay. It also shows if there
is no garbage collection scheduled. This will be helpful in understanding why GC
sometimes takes a very long time to happen.

* page/ResourceUsageOverlay.h:
* page/cocoa/ResourceUsageOverlayCocoa.mm:
(WebCore::formatByteNumber): Drive-by silly math fix. :|
(WebCore::gcTimerString):
(WebCore::ResourceUsageOverlay::platformDraw):
(WebCore::nextFireTimeForGCTimer):
(WebCore::runSamplerThread):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194057 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRebaseline compositing/iframes/page-cache-layer-tree.html for iOS Simulator
ryanhaddad@apple.com [Mon, 14 Dec 2015 21:30:31 +0000 (21:30 +0000)]
Rebaseline compositing/iframes/page-cache-layer-tree.html for iOS Simulator
https://bugs.webkit.org/show_bug.cgi?id=152267

Unreviewed test gardening.

* platform/ios-simulator-wk2/compositing/iframes/page-cache-layer-tree-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194056 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMarking fast/viewport/ios/width-is-device-width-overflowing* tests as failing on...
ryanhaddad@apple.com [Mon, 14 Dec 2015 21:30:28 +0000 (21:30 +0000)]
Marking fast/viewport/ios/width-is-device-width-overflowing* tests as failing on iOS simulator
https://bugs.webkit.org/show_bug.cgi?id=152135

Unreviewed test gardening.

* platform/ios-simulator/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194055 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoAX: iOS: Text field variations do not have the correct traits
cfleizach@apple.com [Mon, 14 Dec 2015 21:12:22 +0000 (21:12 +0000)]
AX: iOS: Text field variations do not have the correct traits
https://bugs.webkit.org/show_bug.cgi?id=152237

Reviewed by Mario Sanchez Prada.

Source/WebCore:

Make search fields and text areas use the appropriate iOS traits to
distinguish them.

Test: accessibility/ios-simulator/textentry-traits.html

* accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
(-[WebAccessibilityObjectWrapper _accessibilityTraitsFromAncestors]):
(-[WebAccessibilityObjectWrapper _accessibilityTextEntryTraits]):
(-[WebAccessibilityObjectWrapper accessibilityTraits]):

Tools:

Add iOS calls for determing if an object is a search field or a text area.

* DumpRenderTree/AccessibilityUIElement.cpp:
(getIsSearchFieldCallback):
(getIsTextAreaCallback):
(stringForSelectionCallback):
(AccessibilityUIElement::getJSClass):
* DumpRenderTree/AccessibilityUIElement.h:
* DumpRenderTree/ios/AccessibilityUIElementIOS.mm:
(AccessibilityUIElement::identifier):
(AccessibilityUIElement::isTextArea):
(AccessibilityUIElement::isSearchField):
(AccessibilityUIElement::traits):
* WebKitTestRunner/InjectedBundle/AccessibilityUIElement.cpp:
(WTR::AccessibilityUIElement::scrollPageRight):
(WTR::AccessibilityUIElement::hasContainedByFieldsetTrait):
(WTR::AccessibilityUIElement::fieldsetAncestorElement):
(WTR::AccessibilityUIElement::isSearchField):
(WTR::AccessibilityUIElement::isTextArea):
* WebKitTestRunner/InjectedBundle/AccessibilityUIElement.h:
* WebKitTestRunner/InjectedBundle/Bindings/AccessibilityUIElement.idl:
* WebKitTestRunner/InjectedBundle/ios/AccessibilityUIElementIOS.mm:
(WTR::AccessibilityUIElement::fieldsetAncestorElement):
(WTR::AccessibilityUIElement::isTextArea):
(WTR::AccessibilityUIElement::isSearchField):
(WTR::AccessibilityUIElement::rowCount):

LayoutTests:

* accessibility/ios-simulator/textentry-traits-expected.txt: Added.
* accessibility/ios-simulator/textentry-traits.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194054 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMarking fast/viewport/ios/width-is-device-width-overflowing* tests as failing on...
ryanhaddad@apple.com [Mon, 14 Dec 2015 21:03:29 +0000 (21:03 +0000)]
Marking fast/viewport/ios/width-is-device-width-overflowing* tests as failing on iOS simulator
https://bugs.webkit.org/show_bug.cgi?id=152135

Unreviewed test gardening.

* platform/ios-simulator/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194053 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMarking fast/picture/image-picture-* as failing on iOS simulator
ryanhaddad@apple.com [Mon, 14 Dec 2015 21:00:20 +0000 (21:00 +0000)]
Marking fast/picture/image-picture-* as failing on iOS simulator
https://bugs.webkit.org/show_bug.cgi?id=152141

Unreviewed test gardening.

* platform/ios-simulator/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194052 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRemoving failure expectation for css3/blending tests that are now passing on iOS...
ryanhaddad@apple.com [Mon, 14 Dec 2015 20:43:45 +0000 (20:43 +0000)]
Removing failure expectation for css3/blending tests that are now passing on iOS simulator
https://bugs.webkit.org/show_bug.cgi?id=152131

Unreviewed test gardening.

* platform/ios-simulator/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194051 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUnreviewed, fix merge issue in a test.
fpizlo@apple.com [Mon, 14 Dec 2015 20:28:23 +0000 (20:28 +0000)]
Unreviewed, fix merge issue in a test.

* b3/testb3.cpp:
(JSC::B3::testCheckTwoMegaCombos):
(JSC::B3::testCheckTwoNonRedundantMegaCombos):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194050 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoB3 should not give ValueReps for the non-stackmap children of a CheckValue to the...
fpizlo@apple.com [Mon, 14 Dec 2015 20:25:30 +0000 (20:25 +0000)]
B3 should not give ValueReps for the non-stackmap children of a CheckValue to the generator callback
https://bugs.webkit.org/show_bug.cgi?id=152224

Reviewed by Geoffrey Garen.

Previously, a stackmap generator for a Check had to know how many children the B3 value for the
Check had at the time of code generation. That meant that B3 could not change the kind of Check
that it was - for example it cannot turn a Check into a Patchpoint and it cannot turn a CheckAdd
into a Check. But just changing the contract so that the stackmap generation params only get the
stackmap children of the check means that B3 can transform Checks as it likes.

This is meant to aid sinking values into checks.

Also, I found that the effects of a Check did not include HeapRange::top(). I think it's best if
exitsSideways does not imply reading top, the way that it does in DFG. In the DFG, that makes
sense because the exit analysis is orthogonal, so the clobber analysis tells you about the reads
not counting OSR exit - if you need to you can conditionally merge that with World based on a
separate exit analysis. But in B3, the Effects object tells you about both exiting and reading,
and it's computed by one analysis. Prior to this change, Check was not setting reads to top() so
we were effectively saying that Effects::reads is meaningless when exitsSideways is true. It
seems more sensible to instead force the analysis to set reads to top() when setting
exitsSideways to true, not least because we only have one such analysis and many users. But it
also makes sense for another reason: it allows us to bound the set of things that the program
will read after it exits. That might not be useful to us now, but it's a nice feature to get for
free. I've seen language features that have behave like exitsSideways that don't also read top,
like an array bounds check that causes sudden termination without making any promises about how
pretty the crash dump will look.

* b3/B3CheckSpecial.cpp:
(JSC::B3::CheckSpecial::generate):
* b3/B3Opcode.h:
* b3/B3Value.cpp:
(JSC::B3::Value::effects):
* b3/testb3.cpp:
(JSC::B3::testSimpleCheck):
(JSC::B3::testCheckLessThan):
(JSC::B3::testCheckMegaCombo):
(JSC::B3::testCheckAddImm):
(JSC::B3::testCheckAddImmCommute):
(JSC::B3::testCheckAddImmSomeRegister):
(JSC::B3::testCheckAdd):
(JSC::B3::testCheckAdd64):
(JSC::B3::testCheckSubImm):
(JSC::B3::testCheckSubBadImm):
(JSC::B3::testCheckSub):
(JSC::B3::testCheckSub64):
(JSC::B3::testCheckNeg):
(JSC::B3::testCheckNeg64):
(JSC::B3::testCheckMul):
(JSC::B3::testCheckMulMemory):
(JSC::B3::testCheckMul2):
(JSC::B3::testCheckMul64):
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::blessSpeculation):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194048 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRemove some Mavericks guards in ServicesOverlayController
timothy_horton@apple.com [Mon, 14 Dec 2015 19:58:14 +0000 (19:58 +0000)]
Remove some Mavericks guards in ServicesOverlayController
https://bugs.webkit.org/show_bug.cgi?id=152238

Reviewed by Darin Adler.

* page/mac/ServicesOverlayController.mm:
(WebCore::ServicesOverlayController::selectionRectsDidChange): Deleted.
(WebCore::ServicesOverlayController::selectedTelephoneNumberRangesChanged): Deleted.
The whole file is already PLATFORM(MAC) guarded, and the 10.9 guards
are no longer necessary.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194047 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoTiledCoreAnimationDrawingAreaProxy::createFenceForGeometryUpdate() sets fence port...
timothy_horton@apple.com [Mon, 14 Dec 2015 19:55:46 +0000 (19:55 +0000)]
TiledCoreAnimationDrawingAreaProxy::createFenceForGeometryUpdate() sets fence port on context twice
https://bugs.webkit.org/show_bug.cgi?id=152239
<rdar://problem/22893289>

Reviewed by Darin Adler.

* UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm:
(WebKit::TiledCoreAnimationDrawingAreaProxy::createFenceForGeometryUpdate):
No need to setFencePort; createFencePort also installs it on the creating context.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194046 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoAir: Support Architecture-specific forms and Opcodes
fpizlo@apple.com [Mon, 14 Dec 2015 19:54:15 +0000 (19:54 +0000)]
Air: Support Architecture-specific forms and Opcodes
https://bugs.webkit.org/show_bug.cgi?id=151736

Reviewed by Benjamin Poulain.

This adds really awesome architecture selection to the AirOpcode.opcodes file. If an opcode or
opcode form is unavailable on some architecture, you can still mention its name in C++ code (it'll
still be a member of the enum) but isValidForm() and all other reflective queries will tell you
that it doesn't exist. This will make the instruction selector steer clear of it, and it will
also ensure that the spiller doesn't try to use any unavailable architecture-specific address
forms.

The new capability is documented extensively in a comment in AirOpcode.opcodes.

* b3/air/AirOpcode.opcodes:
* b3/air/opcode_generator.rb:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194045 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRebaselining fast/text/emoji.html for iOS simulator
ryanhaddad@apple.com [Mon, 14 Dec 2015 19:53:04 +0000 (19:53 +0000)]
Rebaselining fast/text/emoji.html for iOS simulator
https://bugs.webkit.org/show_bug.cgi?id=152261

Unreviewed test gardening.

* platform/ios-simulator/fast/text/emoji-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194044 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoUse existing code for redirects when using NETWORK_SESSION
achristensen@apple.com [Mon, 14 Dec 2015 19:45:07 +0000 (19:45 +0000)]
Use existing code for redirects when using NETWORK_SESSION
https://bugs.webkit.org/show_bug.cgi?id=152207
rdar://problem/23860624

Reviewed by Darin Adler.

This fixes http/tests/cookies/set-cookie-on-redirect.html when using NETWORK_SESSION.

* NetworkProcess/NetworkLoad.cpp:
(WebKit::NetworkLoad::continueWillSendRequest):
(WebKit::NetworkLoad::convertTaskToDownload):
(WebKit::NetworkLoad::willPerformHTTPRedirection):
(WebKit::NetworkLoad::didReceiveChallenge):
* NetworkProcess/NetworkLoad.h:
* NetworkProcess/NetworkSession.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194043 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMisc. small fixes in snippet related code.
mark.lam@apple.com [Mon, 14 Dec 2015 19:44:56 +0000 (19:44 +0000)]
Misc. small fixes in snippet related code.
https://bugs.webkit.org/show_bug.cgi?id=152259

Reviewed by Saam Barati.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArithMul):
- When loading a constant JSValue for a node, use the one that the node already
  provides instead of reconstructing it.  This is not a bug, but the fix makes
  the code cleaner.

* jit/JITBitAndGenerator.cpp:
(JSC::JITBitAndGenerator::generateFastPath):
- No need to do a bitand with a constant int 0xffffffff operand.

* jit/JITBitOrGenerator.cpp:
(JSC::JITBitOrGenerator::generateFastPath):
- Fix comments: bitor is '|', not '&'.
- No need to do a bitor with a constant int 0 operand.

* jit/JITBitXorGenerator.cpp:
(JSC::JITBitXorGenerator::generateFastPath):
- Fix comments: bitxor is '^', not '&'.

* jit/JITRightShiftGenerator.cpp:
(JSC::JITRightShiftGenerator::generateFastPath):
- Renamed a jump target name to be clearer about its purpose.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194042 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMake UCharIterator createIterator(StringView) visible to other classes
sukolsak@gmail.com [Mon, 14 Dec 2015 19:41:45 +0000 (19:41 +0000)]
Make UCharIterator createIterator(StringView) visible to other classes
https://bugs.webkit.org/show_bug.cgi?id=151917

Reviewed by Darin Adler.

Make UCharIterator createIterator(StringView) in CollatorICU.cpp visible
to other classes so that future patches that will ucol_strcollIter
(including Bug 147604) can use it.

* wtf/unicode/Collator.h:
* wtf/unicode/icu/CollatorICU.cpp:
(WTF::createIterator):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194041 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoWe should not employ the snippet code in the DFG if no OSR exit was previously encoun...
mark.lam@apple.com [Mon, 14 Dec 2015 19:39:45 +0000 (19:39 +0000)]
We should not employ the snippet code in the DFG if no OSR exit was previously encountered.
https://bugs.webkit.org/show_bug.cgi?id=152255

Reviewed by Saam Barati.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194040 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoB3->Air compare-branch fusion should fuse even if the result of the comparison is...
fpizlo@apple.com [Mon, 14 Dec 2015 19:13:31 +0000 (19:13 +0000)]
B3->Air compare-branch fusion should fuse even if the result of the comparison is used more than once
https://bugs.webkit.org/show_bug.cgi?id=152198

Reviewed by Benjamin Poulain.

If we have a comparison operation that is branched on from multiple places, then we were
previously executing the comparison to get a boolean result in a register and then we were
testing/branching on that register in multiple places. This is actually less efficient than
just fusing the compare/branch multiple times, even though this means that the comparison
executes multiple times. This would only be bad if the comparison fused loads multiple times,
since duplicating loads is both wrong and inefficient. So, this adds the notion of sharing to
compare/branch fusion. If a compare is shared by multiple branches, then we refuse to fuse
the load.

To write the test, I needed to zero-extend 8 to 32. In the process of thinking about how to
do this, I realized that we needed lowerings for SExt8/SExt16. And I realized that the
lowerings for the other extension operations were not fully fleshed out; for example they
were incapable of load fusion. This patch fixes this and also adds some smart strength
reductions for BitAnd(@x, 0xff/0xffff/0xffffffff) - all of which should be lowered to a zero
extension.

This is a big win on asm.js code. It's not enough to bridge the gap to LLVM, but it's a huge
step in that direction.

* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::load8SignedExtendTo32):
(JSC::MacroAssemblerX86Common::zeroExtend8To32):
(JSC::MacroAssemblerX86Common::signExtend8To32):
(JSC::MacroAssemblerX86Common::load16):
(JSC::MacroAssemblerX86Common::load16SignedExtendTo32):
(JSC::MacroAssemblerX86Common::zeroExtend16To32):
(JSC::MacroAssemblerX86Common::signExtend16To32):
(JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch):
* assembler/X86Assembler.h:
(JSC::X86Assembler::movzbl_rr):
(JSC::X86Assembler::movsbl_rr):
(JSC::X86Assembler::movzwl_rr):
(JSC::X86Assembler::movswl_rr):
(JSC::X86Assembler::cmovl_rr):
* b3/B3LowerToAir.cpp:
(JSC::B3::Air::LowerToAir::createGenericCompare):
(JSC::B3::Air::LowerToAir::lower):
* b3/B3ReduceStrength.cpp:
* b3/air/AirOpcode.opcodes:
* b3/testb3.cpp:
(JSC::B3::testCheckMegaCombo):
(JSC::B3::testCheckTwoMegaCombos):
(JSC::B3::testCheckTwoNonRedundantMegaCombos):
(JSC::B3::testCheckAddImm):
(JSC::B3::testTruncSExt32):
(JSC::B3::testSExt8):
(JSC::B3::testSExt8Fold):
(JSC::B3::testSExt8SExt8):
(JSC::B3::testSExt8SExt16):
(JSC::B3::testSExt8BitAnd):
(JSC::B3::testBitAndSExt8):
(JSC::B3::testSExt16):
(JSC::B3::testSExt16Fold):
(JSC::B3::testSExt16SExt16):
(JSC::B3::testSExt16SExt8):
(JSC::B3::testSExt16BitAnd):
(JSC::B3::testBitAndSExt16):
(JSC::B3::testSExt32BitAnd):
(JSC::B3::testBitAndSExt32):
(JSC::B3::testBasicSelect):
(JSC::B3::run):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194039 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[iOS] DOM click event may not be dispatched when page has :active style and <input...
commit-queue@webkit.org [Mon, 14 Dec 2015 18:07:19 +0000 (18:07 +0000)]
[iOS] DOM click event may not be dispatched when page has :active style and <input type="search">
https://bugs.webkit.org/show_bug.cgi?id=144451
<rdar://problem/23099482>

Patch by Daniel Bates <dabates@apple.com> on 2015-12-14
Reviewed by Simon Fraser.

Source/WebCore:

Fixes an issue where a DOM click event is not dispatched to an element in a subframe on a page
that has a <input type="search"> and defines a CSS :active pseudo-class for the HTML body element.

On iOS we only dispatch a DOM click event if the content of the page does not change as part of
dispatching a DOM mousemove event at the tapped element as a means of providing a good user
experience on web pages that reveal or hide content based on mouse hover. Currently we consider
the content of the page to have changed if the visibility of any element on the page changes.
In particular we consider the content of the page to have changed if the visibility of a user
agent shadow DOM element changes (e.g. the search field cancel button). Instead we should only
consider visibility changes to the actual web page content and ignore visibility changes to
user agent shadow DOM elements.

Tests: fast/events/can-click-element-on-page-with-active-pseudo-class-and-search-field.html
       fast/forms/search/search-cancel-button-visible-when-input-becomes-disabled.html
       fast/forms/search/search-cancel-button-visible-when-input-becomes-readonly.html
       fast/forms/search/search-cancel-in-formerly-invisible-element.html
       fast/forms/search/search-cancel-toggle-visibility-initially-hidden.html
       fast/forms/search/search-cancel-toggle-visibility-initially-visible.html

* style/StyleResolveTree.cpp:
(WebCore::Style::CheckForVisibilityChangeOnRecalcStyle::~CheckForVisibilityChangeOnRecalcStyle):
Ignore visibility changes to user agent shadow DOM elements.

LayoutTests:

Add a test to ensure that a DOM click event is dispatched to an element in a subframe on a page
with a search field and that specifies a CSS :active pseudo-class that changes the tap highlight
color.

Additionally, add tests to ensure we update the cancel button visibility whenever the visibility
of the search field changes.

* fast/events/can-click-element-on-page-with-active-pseudo-class-and-search-field-expected.txt: Added.
* fast/events/can-click-element-on-page-with-active-pseudo-class-and-search-field.html: Added.
* fast/forms/search/search-cancel-button-visible-when-input-becomes-disabled-expected.html: Added.
* fast/forms/search/search-cancel-button-visible-when-input-becomes-disabled.html: Added.
* fast/forms/search/search-cancel-button-visible-when-input-becomes-readonly-expected.html: Added.
* fast/forms/search/search-cancel-button-visible-when-input-becomes-readonly.html: Added.
* fast/forms/search/search-cancel-in-formerly-invisible-element-expected.html: Added.
* fast/forms/search/search-cancel-in-formerly-invisible-element.html: Added.
* fast/forms/search/search-cancel-toggle-visibility-initially-hidden-expected.html: Added.
* fast/forms/search/search-cancel-toggle-visibility-initially-hidden.html: Added.
* fast/forms/search/search-cancel-toggle-visibility-initially-visible-expected.html: Added.
* fast/forms/search/search-cancel-toggle-visibility-initially-visible.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194038 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoREGRESSION (r162777): Remove Boost Software License from WTF
ddkilzer@apple.com [Mon, 14 Dec 2015 17:44:17 +0000 (17:44 +0000)]
REGRESSION (r162777): Remove Boost Software License from WTF
<http://webkit.org/b/152243>

Reviewed by Darin Adler.

The source code that the Boost Software License was referring to
was removed in r162777 by switching to std::atomic.

* wtf/Atomics.cpp:
* wtf/Atomics.h:
* wtf/ThreadSafeRefCounted.h:
- Remove Boost Software License.
- Update Apple Inc. copyright as needed.
- Refresh Apple Inc. license text.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194037 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoRoll out r193974 and follow-up fixes as it caused JSC crashes
cdumez@apple.com [Mon, 14 Dec 2015 17:37:59 +0000 (17:37 +0000)]
Roll out r193974 and follow-up fixes as it caused JSC crashes
https://bugs.webkit.org/show_bug.cgi?id=152256

Source/JavaScriptCore:

Unreviewed, Roll out r193974 and follow-up fixes as it caused JSC crashes.

* API/JSCallbackObject.h:
* builtins/FunctionPrototype.js:
* bytecode/BytecodeBasicBlock.cpp:
(JSC::isBranch):
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecode/ExitKind.cpp:
(JSC::exitKindToString): Deleted.
* bytecode/ExitKind.h:
* bytecode/PreciseJumpTargets.cpp:
(JSC::getJumpTargetsForBytecodeOffset):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitCheckHasInstance):
(JSC::BytecodeGenerator::emitGetById): Deleted.
* bytecompiler/BytecodeGenerator.h:
(JSC::BytecodeGenerator::emitTypeOf): Deleted.
* bytecompiler/NodesCodegen.cpp:
(JSC::InstanceOfNode::emitBytecode):
(JSC::LogicalOpNode::emitBytecode): Deleted.
(JSC::LogicalOpNode::emitBytecodeInConditionContext): Deleted.
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGNode.h:
(JSC::DFG::Node::hasCellOperand): Deleted.
(JSC::DFG::Node::hasTransition): Deleted.
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInstanceOf): Deleted.
(JSC::DFG::SpeculativeJIT::compileArithAdd): Deleted.
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation): Deleted.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLIntrinsicRepository.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
(JSC::FTL::DFG::LowerDFGToLLVM::compileCheckHasInstance):
(JSC::FTL::DFG::LowerDFGToLLVM::compileInstanceOf): Deleted.
(JSC::FTL::DFG::LowerDFGToLLVM::compileHasIndexedProperty): Deleted.
* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArguments): Deleted.
(JSC::CCallHelpers::setupArgumentsWithExecState): Deleted.
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
* jit/JITInlines.h:
(JSC::JIT::callOperationNoExceptionCheck): Deleted.
(JSC::JIT::callOperation): Deleted.
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_check_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_check_has_instance):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_is_undefined): Deleted.
(JSC::JIT::emitSlow_op_to_number): Deleted.
(JSC::JIT::emitSlow_op_to_string): Deleted.
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_check_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_check_has_instance):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emit_op_is_undefined): Deleted.
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* llint/LLIntData.cpp:
(JSC::LLInt::Data::performAssertions): Deleted.
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonIdentifiers.h:
* runtime/ExceptionHelpers.cpp:
(JSC::invalidParameterInstanceofSourceAppender):
(JSC::createInvalidInstanceofParameterError):
(JSC::createError): Deleted.
(JSC::createNotAFunctionError): Deleted.
(JSC::createNotAnObjectError): Deleted.
* runtime/ExceptionHelpers.h:
* runtime/FunctionPrototype.cpp:
(JSC::FunctionPrototype::addFunctionProperties):
* runtime/FunctionPrototype.h:
* runtime/JSBoundFunction.cpp:
(JSC::JSBoundFunction::create): Deleted.
(JSC::JSBoundFunction::customHasInstance): Deleted.
* runtime/JSBoundFunction.h:
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren): Deleted.
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::throwTypeErrorGetterSetter): Deleted.
* runtime/JSObject.cpp:
(JSC::JSObject::hasInstance):
(JSC::JSObject::defaultHasInstance): Deleted.
(JSC::JSObject::getPropertyNames): Deleted.
(JSC::JSObject::getOwnPropertyNames): Deleted.
* runtime/JSObject.h:
(JSC::JSFinalObject::create): Deleted.
* runtime/JSTypeInfo.h:
(JSC::TypeInfo::TypeInfo):
(JSC::TypeInfo::overridesHasInstance):
* runtime/WriteBarrier.h:
(JSC::WriteBarrierBase<Unknown>::slot):
* tests/es6.yaml:
* tests/stress/instanceof-custom-hasinstancesymbol.js: Removed.
* tests/stress/symbol-hasInstance.js: Removed.

LayoutTests:

Unreviewed, roll out r193974 and follow-up fixes as it caused JSC crashes.

* inspector/model/remote-object-get-properties-expected.txt:
* js/Object-getOwnPropertyNames-expected.txt:
* js/exception-for-nonobject-expected.txt:
* js/exception-instanceof-expected.txt:
* js/instance-of-immediates-expected.txt:
* js/regress/instanceof-bound-expected.txt: Removed.
* js/regress/instanceof-bound.html: Removed.
* js/regress/script-tests/instanceof-bound.js: Removed.
* js/script-tests/Object-getOwnPropertyNames.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194036 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[Streams API] Directly use @then as much as possible
youenn.fablet@crf.canon.fr [Mon, 14 Dec 2015 17:27:27 +0000 (17:27 +0000)]
[Streams API] Directly use @then as much as possible
https://bugs.webkit.org/show_bug.cgi?id=151631

Reviewed by Darin Adler.

Moved from @Promise.prototype.@then.@call(promise,...) to promise.@then.(...)
for promise objects that are not exposed to user scripts.

Updated promiseInvokeXX stream utility functions to ensure that returned promise always has a @then.
This allows improving the readability of code calling promiseInvokeXX functions.
Changed invokeOrNoop to promiseInvokeOrNoopNoCatch as invokeOrNoop
result is always wrapped as a promise using Promise.resolve.

No change in behavior.

* Modules/streams/ReadableStream.js:
(initializeReadableStream):
* Modules/streams/ReadableStreamInternals.js:
(teeReadableStream):
(teeReadableStreamBranch2CancelFunction):
(cancelReadableStream):
* Modules/streams/StreamInternals.js:
(shieldingPromiseResolve): introduced this routine to ensure the returned promise has a @then property.
(promiseInvokeOrNoopNoCatch):
(promiseInvokeOrNoop):
(promiseInvokeOrFallbackOrNoop):
* Modules/streams/WritableStream.js:
(initializeWritableStream):
(abort):
* Modules/streams/WritableStreamInternals.js:
(callOrScheduleWritableStreamAdvanceQueue):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194035 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[GTK] [JHBuild] package libtool-bin is now required on Debian systems.
clopez@igalia.com [Mon, 14 Dec 2015 16:27:42 +0000 (16:27 +0000)]
[GTK] [JHBuild] package libtool-bin is now required on Debian systems.
https://bugs.webkit.org/show_bug.cgi?id=152252

Reviewed by Sergio Villar Senin.

* gtk/install-dependencies: Add libtool-bin to the list of packages required
for building the JHBuild on Debian systems.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194034 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[Streams API] Expose ReadableStream and relatives to Worker
youenn.fablet@crf.canon.fr [Mon, 14 Dec 2015 15:57:48 +0000 (15:57 +0000)]
[Streams API] Expose ReadableStream and relatives to Worker
https://bugs.webkit.org/show_bug.cgi?id=152066

LayoutTests/imported/w3c:

Reviewed by Darin Adler.

Rebasing all worker tests from FAIL to PASS.

* web-platform-tests/streams-api/byte-length-queuing-strategy-expected.txt:
* web-platform-tests/streams-api/count-queuing-strategy-expected.txt:
* web-platform-tests/streams-api/readable-streams/bad-strategies-expected.txt:
* web-platform-tests/streams-api/readable-streams/bad-underlying-sources-expected.txt:
* web-platform-tests/streams-api/readable-streams/brand-checks-expected.txt:
* web-platform-tests/streams-api/readable-streams/cancel-expected.txt:
* web-platform-tests/streams-api/readable-streams/count-queuing-strategy-integration-expected.txt:
* web-platform-tests/streams-api/readable-streams/garbage-collection-expected.txt:
* web-platform-tests/streams-api/readable-streams/general-expected.txt:
* web-platform-tests/streams-api/readable-streams/pipe-through-expected.txt:
* web-platform-tests/streams-api/readable-streams/readable-stream-reader-expected.txt:
* web-platform-tests/streams-api/readable-streams/tee-expected.txt:
* web-platform-tests/streams-api/readable-streams/templated-expected.txt:

Source/WebCore:

Reviewed by Darin Adler.

Moving the code that links internal functions to the GlobalObject in WebCoreJSBuiltinInternals.cpp.
This file should be generated by the builtin generator once refactoring is done.
This code is located in JSBuiltinFunctions::initialize.

Moving ReadableStream private constructors and constants code from JSDOMWindowBase to JSDOMGlobalObject.
Calling JSBuiltinInternalFunctions::initialize in JSDOMGlobalObject so that internals are also available in Worker.

Made ReadableStream and relatives exposed in Worker.

Rebased and fixed style by Xabier Rodriguez Calvar.

Covered by rebased tests.

* CMakeLists.txt:
* Modules/streams/ByteLengthQueuingStrategy.idl:
* Modules/streams/CountQueuingStrategy.idl:
* Modules/streams/ReadableStream.idl:
* Modules/streams/ReadableStreamController.idl:
* Modules/streams/ReadableStreamReader.idl:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/JSDOMGlobalObject.cpp:
(WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
(WebCore::JSDOMGlobalObject::addBuiltinGlobals):
(WebCore::JSDOMGlobalObject::finishCreation):
(WebCore::JSDOMGlobalObject::visitChildren):
* bindings/js/JSDOMGlobalObject.h:
* bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::finishCreation): Deleted.
(WebCore::JSDOMWindowBase::visitChildren): Deleted.
* bindings/js/JSDOMWindowBase.h:
* bindings/js/WebCoreJSBuiltinInternals.cpp: Added.
(WebCore::JSBuiltinInternalFunctions::JSBuiltinInternalFunctions):
(WebCore::JSBuiltinInternalFunctions::visit):
(WebCore::JSBuiltinInternalFunctions::initialize):
* bindings/js/WebCoreJSBuiltinInternals.h:
* bindings/js/WebCoreJSBuiltins.h:

LayoutTests:

Reviewed by Darin Adler.

Adding ByteLengthQueuingStrategy, CountQueuingStrategy and ReadableStream as worker constructors.

* js/dom/global-constructors-attributes-dedicated-worker-expected.txt:
* platform/efl/js/dom/global-constructors-attributes-dedicated-worker-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194033 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[GTK] Unreviewed gardening.
clopez@igalia.com [Mon, 14 Dec 2015 13:00:42 +0000 (13:00 +0000)]
[GTK] Unreviewed gardening.

* platform/gtk/TestExpectations: Update TestExpectations with the following changes:
  - Remove expectations for tests removed after r193411 r193426 and r19366.
  - Merge repeated expectations from some tests.
  - Mark tests failing after r188159.
  - Update list of imported/blink tests failing.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194032 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoMove MathMLOperatorDictionary features into a separate module.
fred.wang@free.fr [Mon, 14 Dec 2015 11:48:48 +0000 (11:48 +0000)]
Move MathMLOperatorDictionary features into a separate module.
https://bugs.webkit.org/show_bug.cgi?id=152242

Reviewed by Martin Robinson.

The definitions, properties and search of the MathML operator dictionary are really independent of the renderer object for math operators.
This patch moves them in a separate module/file to make them more manageable and readable.
No new tests. We already have sufficient test coverage.

* CMakeLists.txt:
* WebCore.vcxproj/WebCore.vcxproj:
* WebCore.vcxproj/WebCore.vcxproj.filters:
* WebCore.xcodeproj/project.pbxproj:
* rendering/mathml/MathMLOperatorDictionary.cpp:
(WebCore::ExtractKey):
(WebCore::ExtractChar):
(WebCore::ExtractKeyHorizontal):
(WebCore::MathMLOperatorDictionary::getEntry):
(WebCore::MathMLOperatorDictionary::isVertical):
* rendering/mathml/MathMLOperatorDictionary.h: Added.
* rendering/mathml/RenderMathMLOperator.cpp:
(WebCore::RenderMathMLOperator::setOperatorProperties):
(WebCore::MathMLOperatorDictionary::ExtractKey): Deleted.
(WebCore::MathMLOperatorDictionary::ExtractChar): Deleted.
(WebCore::MathMLOperatorDictionary::ExtractKeyHorizontal): Deleted.
* rendering/mathml/RenderMathMLOperator.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194031 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[css-grid] Fix height computation of grid items with borders
svillar@igalia.com [Mon, 14 Dec 2015 10:06:08 +0000 (10:06 +0000)]
[css-grid] Fix height computation of grid items with borders
https://bugs.webkit.org/show_bug.cgi?id=151800

Reviewed by Darin Adler.

Source/WebCore:

When computing the logical height of grid items for the
default "min-height: auto;" case we were constraning the
min-content size using constrainLogicalHeightByMinMax()
instead of constrainContentLogicalHeightByMinMax(). The
problem of using the former is that we were adding the borders
twice.

Test: fast/css-grid-layout/grid-item-with-border-in-intrinsic.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::computeLogicalHeight):

LayoutTests:

* fast/css-grid-layout/grid-item-with-border-in-intrinsic-expected.txt: Added.
* fast/css-grid-layout/grid-item-with-border-in-intrinsic.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194030 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoWeb Inspector: Make TimelineOverview's graph container a subview
mattbaker@apple.com [Mon, 14 Dec 2015 07:24:01 +0000 (07:24 +0000)]
Web Inspector: Make TimelineOverview's graph container a subview
https://bugs.webkit.org/show_bug.cgi?id=152235

Reviewed by Brian Burg.

* UserInterface/Views/TimelineOverview.js:
(WebInspector.TimelineOverview):
Create graph container subview.
(WebInspector.TimelineOverview.prototype._instrumentAdded):
Add overview to the graph container view.
(WebInspector.TimelineOverview.prototype._instrumentRemoved):
Remove overview from the graph container view.
(WebInspector.TimelineOverview.prototype.layout):
No longer necessary to manually lay out overview graphs.
(WebInspector.TimelineOverview.prototype._needsLayout): Deleted.
Removed dead code.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194029 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoAdopt CGIOSurfaceContextCreateImageReference to avoid unnecessary readback
timothy_horton@apple.com [Mon, 14 Dec 2015 05:27:45 +0000 (05:27 +0000)]
Adopt CGIOSurfaceContextCreateImageReference to avoid unnecessary readback
https://bugs.webkit.org/show_bug.cgi?id=150988
<rdar://problem/18993594>

Reviewed by Darin Adler.

* platform/graphics/GraphicsContext.cpp:
(WebCore::GraphicsContext::drawConsumingImageBuffer):
* platform/graphics/GraphicsContext.h:
* platform/graphics/ImageBuffer.h:
* platform/graphics/cg/ImageBufferCG.cpp:
(WebCore::createBitmapImageAfterScalingIfNeeded):
(WebCore::ImageBuffer::copyImage):
(WebCore::ImageBuffer::sinkIntoImage):
(WebCore::ImageBuffer::sinkIntoNativeImage):
(WebCore::ImageBuffer::drawConsuming):
* platform/graphics/cocoa/IOSurface.h:
* platform/graphics/cocoa/IOSurface.mm:
(IOSurface::createFromImageBuffer):
(IOSurface::sinkIntoImage):
Add sinkIntoImage, sinkIntoNativeImage, and drawConsuming to ImageBuffer,
which all consume the ImageBuffer and allow us to tell the system to
make a CGImage that references the IOSurface, which is in many cases
more efficient than making an image with a "copy" of the IOSurface.
(The copy is done lazily, but we often hit a corner case that causes
it to happen unnecessarily.)

* html/shadow/MediaControlElements.cpp:
(WebCore::MediaControlTextTrackContainerElement::createTextTrackRepresentationImage):
* page/TextIndicator.cpp:
(WebCore::takeSnapshot):
* platform/DragImage.cpp:
(WebCore::createDragImageFromSnapshot):
* platform/graphics/filters/FETile.cpp:
(WebCore::FETile::platformApplySoftware):
* platform/mac/ThemeMac.mm:
(WebCore::ThemeMac::drawCellOrFocusRingWithViewIntoContext):
* platform/mediastream/mac/AVVideoCaptureSource.mm:
(WebCore::AVVideoCaptureSource::currentFrameImage):
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::paintFillLayerExtended):
* rendering/RenderThemeMac.mm:
(WebCore::RenderThemeMac::paintProgressBar):
* rendering/svg/RenderSVGResourcePattern.cpp:
(WebCore::RenderSVGResourcePattern::buildPattern):
* svg/graphics/SVGImage.cpp:
(WebCore::SVGImage::drawPatternForContainer):
Adopt sinkIntoImage and drawConsumingImageBuffer in a few places.

* WebCoreSupport/WebContextMenuClient.mm:
(WebContextMenuClient::imageForCurrentSharingServicePickerItem):
Adopt sinkIntoImage and drawConsumingImageBuffer in a few places.

* WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::createSelectionSnapshot):
Adopt sinkIntoImage and drawConsumingImageBuffer in a few places.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194025 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[JSC] Remove FTL::Output's doubleEqualOrUnordered()
commit-queue@webkit.org [Mon, 14 Dec 2015 04:30:37 +0000 (04:30 +0000)]
[JSC] Remove FTL::Output's doubleEqualOrUnordered()
https://bugs.webkit.org/show_bug.cgi?id=152234

Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-12-13
Reviewed by Sam Weinig.

It is unused, one less thing to worry about.

* ftl/FTLB3Output.h:
(JSC::FTL::Output::doubleEqualOrUnordered): Deleted.
* ftl/FTLOutput.h:
(JSC::FTL::Output::doubleEqualOrUnordered): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194024 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years agoAnother fix after r194018.
mitz@apple.com [Mon, 14 Dec 2015 03:31:46 +0000 (03:31 +0000)]
Another fix after r194018.

* Configurations/BaseTarget.xcconfig:
* Configurations/BaseXPCService.xcconfig:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194023 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[Mac] Shims used by XPC services are installed inside legacy process bundles
mitz@apple.com [Mon, 14 Dec 2015 03:19:47 +0000 (03:19 +0000)]
[Mac] Shims used by XPC services are installed inside legacy process bundles
https://bugs.webkit.org/show_bug.cgi?id=152233

Reviewed by Sam Weinig.

Have the shim dylibs installed in the framework’s Frameworks directory instead.

* Configurations/BaseLegacyProcess.xcconfig: Simplified now that EXCLUDED_SHIM_FILE_NAME is
  no longer defined, because shims aren’t copied into legacy processes.

* Configurations/NetworkProcess.xcconfig: Removed definition of EXCLUDED_SHIM_FILE_NAME.
* Configurations/PluginProcess.xcconfig: Ditto.
* Configurations/WebContentProcess.xcconfig: Ditto.

* Configurations/Shim.xcconfig: Install the shims when building for OS X. Added definitions
  of INSTALL_PATH and DYLIB_INSTALL_NAME_BASE which are now common to all shims.

* Configurations/PluginProcessShim.xcconfig: Removed definitions of INSTALL_PATH and
  DYLIB_INSTALL_NAME_BASE from here, now that they are defined for all shims in
  Shim.xcconfig.
* Configurations/SecItemShim.xcconfig: Ditto.
* Configurations/WebProcessShim.xcconfig:

* Configurations/WebKit.xcconfig: Added the shims to EXCLUDED_SOURCE_FILE_NAMES for iOS.

* NetworkProcess/EntryPoint/mac/XPCService/NetworkService/Info-OSX-10.9-10.10.plist: Changed
  the value of DYLD_INSERT_LIBRARIES to point to the shim’s new location.
* PluginProcess/EntryPoint/mac/XPCService/PluginService.32-64-10.9-10.10.Info.plist: Ditto.
* WebProcess/EntryPoint/mac/XPCService/WebContentService/Info-OSX-10.9-10.10.plist: Ditto.

* UIProcess/Launcher/mac/ProcessLauncherMac.mm:
(WebKit::computeProcessShimPath): Changed to return the new paths, which are all inside the
  framework’s Frameworks directory.

* WebKit2.xcodeproj/project.pbxproj:
- Removed references to WRAPPER_NAME from the “Copy XPC services for engineering builds”
  build phase in the All target, becase WRAPPER_NAME is empty in an aggregate target.
- Removed the PlugInProcess target’s dependency on the PluginProcessShim target and its
  Copy Plug-in Process Shim build phase.
- Removed the NetworkProcess target’s dependency on the SecItemShim target and its Copy
  Sec Item Shim build phase.
- Removed the WebProcess target’s dependency on the WebProcessShim target and its Copy
  WebProcessShim build phase.
- Made the WebKit target depend on the shim targets, and added to it a Copy Shims build
  phase that copies the shims into the framework’s Frameworks directory.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194022 268f45cc-cd09-0410-ab3c-d52691b4dbfc

3 years ago[JSC] Should not emit get_by_id for indexed property access
utatane.tea@gmail.com [Mon, 14 Dec 2015 02:52:51 +0000 (02:52 +0000)]
[JSC] Should not emit get_by_id for indexed property access
https://bugs.webkit.org/show_bug.cgi?id=151354

Reviewed by Darin Adler.

Before this patch, `a["1"]` is converted to `a.1` get_by_id operation in the bytecode compiler.
get_by_id emits IC. IC rely on the fact that Structure transition occur when adding / removing object's properties.
However, it's not true for indexed element properties. They are stored in the element storage and Structure transition does not occur.

For example, in the following case,

     function getOne(a) { return a['1']; }

     for (var i = 0; i < 36; ++i)
         getOne({2: true});

     if (!getOne({1: true}))
         throw new Error("OUT");

In this case, `a['1']` creates get_by_id. `getOne({2: true})` calls makes getOne's get_by_id to create IC says that,
"when comming this structure chain, there is no property in "1", so we should return `undefined`".

After that, we call `getOne({1: true})`. But in this case, `{2: true}` and `{1: true}` have the same structure chain,
because indexed property addition does not occur structure transition.
So previous IC fast path is used and return `undefined`. But the correct answer is returning `true`.

This patch fixes the above issue. When there is string bracket access, we only emits get_by_id if the given string is not an index.
There are bugs in get_by_id, put_by_id, put_by_id (direct). But only get_by_id poses user observable issue.
Because in the put_by_id case, the generic path just says "this put is uncacheable".

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitGetById):
(JSC::BytecodeGenerator::emitPutById):
(JSC::BytecodeGenerator::emitDirectPutById):
* bytecompiler/NodesCodegen.cpp:
(JSC::isNonIndexStringElement):
(JSC::BracketAccessorNode::emitBytecode):
(JSC::FunctionCallBracketNode::emitBytecode):
(JSC::AssignBracketNode::emitBytecode):
(JSC::ObjectPatternNode::bindValue):
* tests/stress/element-property-get-should-not-handled-with-get-by-id.js: Added.
(getOne):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@194021 268f45cc-cd09-0410-ab3c-d52691b4dbfc