Speculative fix for null pointer dereference.
rdar://problem/25964854

Reviewed by Michael Saboff.

* platform/mac/Language.mm:
(WebCore::isValidICUCountryCode):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200151 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Clean up Font::removeFromSystemFallbackCache()
https://bugs.webkit.org/show_bug.cgi?id=157093

Reviewed by Darin Adler.

Fonts have a bit which represents whether or not the system fallback cache references them.
This bit gets set to 1 when they are inserted into the system fallback cache, but was not
being reset back to 0 when it was removed.

This is benign, since the old codepath has no effect. However, we can speed up the function
by properly updating this bit.

No new tests because there is no behavior change.

* platform/graphics/Font.cpp:
(WebCore::Font::removeFromSystemFallbackCache):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200150 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, Revert r199397 due to PLT regressions

Source/JavaScriptCore:

* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/ArrayPrototype.js:
(concatSlowPath): Deleted.
(concat): Deleted.
* bytecode/BytecodeIntrinsicRegistry.cpp:
(JSC::BytecodeIntrinsicRegistry::BytecodeIntrinsicRegistry): Deleted.
* bytecode/BytecodeIntrinsicRegistry.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleConstantInternalFunction):
(JSC::DFG::ByteCodeParser::handleIntrinsicCall): Deleted.
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC): Deleted.
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute): Deleted.
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
(JSC::DFG::SpeculativeJIT::compileIsJSArray): Deleted.
(JSC::DFG::SpeculativeJIT::compileIsArrayObject): Deleted.
(JSC::DFG::SpeculativeJIT::compileIsArrayConstructor): Deleted.
(JSC::DFG::SpeculativeJIT::compileCallObjectConstructor): Deleted.
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation): Deleted.
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile): Deleted.
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile): Deleted.
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileCallObjectConstructor): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileIsArrayObject): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileIsJSArray): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::compileIsArrayConstructor): Deleted.
(JSC::FTL::DFG::LowerDFGToB3::isArray): Deleted.
* jit/JITOperations.h:
* jsc.cpp:
(GlobalObject::finishCreation):
(functionDataLogValue): Deleted.
* runtime/ArrayConstructor.cpp:
(JSC::ArrayConstructor::finishCreation):
(JSC::arrayConstructorPrivateFuncIsArrayConstructor):
* runtime/ArrayConstructor.h:
(JSC::isArrayConstructor): Deleted.
* runtime/ArrayPrototype.cpp:
(JSC::ArrayPrototype::finishCreation):
(JSC::arrayProtoFuncConcat):
(JSC::arrayProtoPrivateFuncIsJSArray): Deleted.
(JSC::moveElements): Deleted.
(JSC::arrayProtoPrivateFuncConcatMemcpy): Deleted.
(JSC::arrayProtoPrivateFuncAppendMemcpy): Deleted.
* runtime/ArrayPrototype.h:
* runtime/CommonIdentifiers.h:
* runtime/Intrinsic.h:
* runtime/JSArray.cpp:
(JSC::JSArray::fastConcatWith):
(JSC::JSArray::appendMemcpy): Deleted.
* runtime/JSArray.h:
(JSC::JSArray::fastConcatType):
(JSC::JSArray::createStructure):
(JSC::isJSArray):
* runtime/JSArrayInlines.h: Removed.
(JSC::JSArray::memCopyWithIndexingType): Deleted.
(JSC::JSArray::canFastCopy): Deleted.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/JSType.h:
* runtime/ObjectConstructor.h:
(JSC::constructObject): Deleted.
* tests/es6.yaml:
* tests/stress/array-concat-spread-object.js: Removed.
(arrayEq): Deleted.
* tests/stress/array-concat-spread-proxy-exception-check.js: Removed.
(arrayEq): Deleted.
* tests/stress/array-concat-spread-proxy.js: Removed.
(arrayEq): Deleted.
* tests/stress/array-concat-with-slow-indexingtypes.js: Removed.
(arrayEq): Deleted.
* tests/stress/array-species-config-array-constructor.js:

LayoutTests:

* js/Object-getOwnPropertyNames-expected.txt:
* js/dom/array-prototype-properties-expected.txt:
* js/script-tests/Object-getOwnPropertyNames.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200149 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix client certificate authentication with NSURLSession on iOS
https://bugs.webkit.org/show_bug.cgi?id=157094
<rdar://problem/25946859>

Patch by Alex Christensen <achristensen@webkit.org> on 2016-04-27
Reviewed by Darin Adler.

* NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):
We only want to create a non-persistent credential with the given user and password
and store the user and password in the CredentialStorage if there is a user and password.
We previously only skipped this if we were doing server trust evaluation, in which case
we will have a credential from serverTrustCredential which has no user or password.
When doing client certificate authentication on iOS, this completion handler is called with
a credential with session persistence and also no user or password, so we need to do the same thing.
The reason this was never hit on Mac was because the credential came from tryUseCertificateInfoForChallenge,
which always had persistence none.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200148 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r200117): Crash in lowerDFGToB3::compileStringReplace()
https://bugs.webkit.org/show_bug.cgi?id=157099

Reviewed by Saam Barati.

Given that the DFGFixupPhase could mark the edge of child2 as StringUse,
we need to lower that edge appropriately.

* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileStringReplace):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200147 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove failure expectation for tests that now pass on ios-simulator.

Unreviewed test gardening.

I evaluated all of the unexpected passes from ios-simulator-wk2 and removed failure
expectations where appropriate. Some of the tests only pass on wk2, so some expectations
were moved to the ios-simulator-wk1 file.

* platform/ios-simulator-wk1/TestExpectations:
* platform/ios-simulator-wk2/TestExpectations:
* platform/ios-simulator/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200146 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add layout tests for legacy HTTP headers in WebSockets
https://bugs.webkit.org/show_bug.cgi?id=157095

Patch by John Wilander <wilander@apple.com> on 2016-04-27
Reviewed by Alexey Proskuryakov.

* http/tests/websocket/tests/hybi/handshake-ok-with-legacy-sec-websocket-response-headers-expected.txt: Added.
* http/tests/websocket/tests/hybi/handshake-ok-with-legacy-sec-websocket-response-headers.html: Added.
* http/tests/websocket/tests/hybi/handshake-ok-with-legacy-sec-websocket-response-headers_wsh.py: Added.
(web_socket_do_extra_handshake):
(web_socket_transfer_data):
    Test for legacy response headers 'Sec-WebSocket-Location' and 'Sec-WebSocket-Origin'.
* http/tests/websocket/tests/hybi/handshake-ok-with-legacy-websocket-response-headers-expected.txt: Added.
* http/tests/websocket/tests/hybi/handshake-ok-with-legacy-websocket-response-headers.html: Added.
* http/tests/websocket/tests/hybi/handshake-ok-with-legacy-websocket-response-headers_wsh.py: Added.
(web_socket_do_extra_handshake):
(web_socket_transfer_data):
    Test for legacy response headers 'WebSocket-Location' and 'WebSocket-Origin'.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200145 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebRTC: RTCIceCandidate don't need a custom bindings
https://bugs.webkit.org/show_bug.cgi?id=157074

Reviewed by Eric Carlson.

Source/WebCore:

Removed custom constructor and replaced custom attribute getters with
nullable types. Removed custom binding from builds.

Testing: Updated existing test.

* CMakeLists.txt:
* Modules/mediastream/RTCIceCandidate.idl:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/JSRTCIceCandidateCustom.cpp: Removed.
(WebCore::constructJSRTCIceCandidate): Deleted.
(WebCore::JSRTCIceCandidate::sdpMid): Deleted.
(WebCore::JSRTCIceCandidate::sdpMLineIndex): Deleted.

LayoutTests:

* fast/mediastream/RTCIceCandidate-expected.txt:
Updated with error messages from generated constructor binding.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200144 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK][EFL] Move WK2 platform code to a common place
https://bugs.webkit.org/show_bug.cgi?id=157069

Reviewed by Carlos Garcia Campos.

Logging implementation can be shared between EFL and GTK, so move it to unix.
The GTK Module implementation doesn't depend on GTK anyhow so move it to glib.

* Platform/efl/LoggingEfl.cpp: Removed.
(WebKit::logLevelString): Deleted.
* Platform/glib/ModuleGlib.cpp: Renamed from Source/WebKit2/Platform/gtk/ModuleGtk.cpp.
(WebKit::Module::load):
(WebKit::Module::unload):
(WebKit::Module::platformFunctionPointer):
* Platform/gtk/LoggingGtk.cpp:
(WebKit::logLevelString): Deleted.
* Platform/gtk/ModuleGtk.cpp:
(WebKit::Module::load): Deleted.
(WebKit::Module::unload): Deleted.
(WebKit::Module::platformFunctionPointer): Deleted.
* Platform/unix/LoggingUnix.cpp: Renamed from Source/WebKit2/Platform/gtk/LoggingGtk.cpp.
(WebKit::logLevelString):
* PlatformEfl.cmake: Update.
* PlatformGTK.cmake: Update

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200143 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix assertion when downloading with NSURLSession after r198955
https://bugs.webkit.org/show_bug.cgi?id=157051

Patch by Alex Christensen <achristensen@webkit.org> on 2016-04-27
Reviewed by Brady Eidson.

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::continueDecidePendingDownloadDestination):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200142 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r199383.

Seems to have caused a 0.5% PLT regression on iOS

Reverted changeset:

"[iOS] do not exit AirPlay when the screen locks"
https://bugs.webkit.org/show_bug.cgi?id=156502
http://trac.webkit.org/changeset/199383

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200141 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove unnecessary HashMap from Font
https://bugs.webkit.org/show_bug.cgi?id=157090

Reviewed by Darin Adler.

There were only ever a maximum of 2 keys in the hashmap.

No new tests because there is no behavior change.

* platform/graphics/Font.h:
* platform/graphics/mac/SimpleFontDataCoreText.cpp:
(WebCore::Font::getCFStringAttributes):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200140 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Address feedback from https://bugs.webkit.org/show_bug.cgi?id=157048#c5.
https://bugs.webkit.org/show_bug.cgi?id=157096

Reviewed by Geoffrey Garen.

1. Check for USE(APPLE_INTERNAL_SDK) instead of __has_include(<mach-o/dyld_priv.h>).
2. Rename webkitFirstSDKVersionWithInitConstructorSupport to
   firstSDKVersionWithInitConstructorSupport.

* API/JSWrapperMap.mm:
(supportsInitMethodConstructors):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200139 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Rename DerivedFontData to DerivedFonts
https://bugs.webkit.org/show_bug.cgi?id=157092

Reviewed by Darin Adler.

This is a follow-up to r178510 where we named SimpleFontData to Font.
This patch didn't include renaming DerivedFontData to DerivedFonts.

No new tests because there is no behavior change.

* platform/graphics/Font.cpp:
(WebCore::Font::verticalRightOrientationFont):
(WebCore::Font::uprightOrientationFont):
(WebCore::Font::smallCapsFont):
(WebCore::Font::noSynthesizableFeaturesFont):
(WebCore::Font::emphasisMarkFont):
(WebCore::Font::brokenIdeographFont):
(WebCore::Font::nonSyntheticItalicFont):
(WebCore::Font::DerivedFonts::~DerivedFonts):
(WebCore::Font::DerivedFontData::~DerivedFontData): Deleted.
* platform/graphics/Font.h:
(WebCore::Font::DerivedFonts::DerivedFonts):
(WebCore::Font::DerivedFontData::DerivedFontData): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200138 268f45cc-cd09-0410-ab3c-d52691b4dbfc

media/video-fullscreen-restriction-removed.html is flaky on Mac
https://bugs.webkit.org/show_bug.cgi?id=156983

Reviewed by Darin Adler.

* media/video-fullscreen-restriction-removed-expected.txt:
* media/video-fullscreen-restriction-removed.html: Start the test on 'canplaythrough' instead
  of 'loadedmetadata' so playback can begin immediately.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200137 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Restrict the availability of some JSC options to local debug builds only.
https://bugs.webkit.org/show_bug.cgi?id=157058

Reviewed by Geoffrey Garen.

1. Each option will be given an availability flag.
2. The functionOverrides and useDollarVM (along with its alias, enableDollarVM)
   will have "Restricted" availability.
3. All other options will have “Normal” availability.
4. Any options with "Restricted" availability will only be accessible if function
   allowRestrictedOptions() returns true.
5. For now, allowRestrictedOptions() always returns false for release builds, and
   true for debug builds.

If an option is "Restricted" and restricted options are not allowed, the VM will
behave semantically as if that option does not exist at all:
1. Option dumps will not show the option.
2. Attempts to set the option will fail as if the option does not exist.

Behind the scene, the option does exist, and is set to its default value
(whatever that may be) once and only once on options initialization.

* runtime/Options.cpp:
(JSC::allowRestrictedOptions):
(JSC::parse):
(JSC::overrideOptionWithHeuristic):
(JSC::Options::initialize):
(JSC::Options::setOptionWithoutAlias):
(JSC::Options::dumpOption):
* runtime/Options.h:
(JSC::Option::type):
(JSC::Option::availability):
(JSC::Option::isOverridden):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200136 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add ios-simulator baseline for LayoutTest fast/text/hyphenate-avoid-orphaned-word.html

Unreviewed test gardening.

* platform/ios-simulator/fast/text/hyphenate-avoid-orphaned-word-expected.txt: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200135 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Enable separated heap by default on ios
https://bugs.webkit.org/show_bug.cgi?id=156720
<rdar://problem/25841790>

Unreviewed rollout - caused memory regression.

* runtime/Options.cpp:
(JSC::recomputeDependentOptions):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200134 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Follow up for r200113 on 32bit

I forgot to do the 32bit counterpart of r200113.
The test fails on the bots.

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-27

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200133 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add Caitlin Potter (:caitp) as a committer.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200132 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Web IDL] Clean up support for [Clamp] IDL extended attribute
https://bugs.webkit.org/show_bug.cgi?id=157060

Reviewed by Darin Adler.

Clean up support for [Clamp] IDL extended attribute:
1.  Move [Clamp] handling in the bindings generator from the parameter
    conversion to JSValueToNative(). This has the benefit of
    simplifying the parameter conversion code, adding support for [Clamp]
    on non-readonly attributes, and improving consistency by handling
    this in the same place as [EnforceRange].
2.  Add 'Clamp' to the IntegerConversionConfiguration enumeration in
    JSDOMbindings.h and add support for it to the various toInt*() /
    toUInt*() functions, similary to [EnforceRange]. Call these from
    the generated bindings.

* bindings/js/JSDOMBinding.cpp:
(WebCore::toSmallerInt):
(WebCore::toSmallerUInt):
(WebCore::toInt32EnforceRange):
(WebCore::toInt32Clamp):
(WebCore::toUInt32Clamp):
(WebCore::toUInt32EnforceRange):
(WebCore::toInt64):
(WebCore::toUInt64):
(WebCore::toUInt8): Deleted.
(WebCore::toUInt16): Deleted.
* bindings/js/JSDOMBinding.h:
(WebCore::toInt32):
(WebCore::toUInt32):
* bindings/scripts/CodeGeneratorJS.pm:
(JSValueToNative):
(GenerateParametersCheck): Deleted.
* bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
(webkit_dom_test_obj_set_property):
(webkit_dom_test_obj_get_property):
(webkit_dom_test_obj_class_init):
(webkit_dom_test_obj_class_method_with_enforce_range):
(webkit_dom_test_obj_get_clamped_short_attr):
(webkit_dom_test_obj_set_clamped_short_attr):
(webkit_dom_test_obj_get_enforce_range_short_attr):
(webkit_dom_test_obj_set_enforce_range_short_attr):
* bindings/scripts/test/GObject/WebKitDOMTestObj.h:
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjClampedShortAttr):
(WebCore::jsTestObjEnforceRangeShortAttr):
(WebCore::setJSTestObjClampedShortAttr):
(WebCore::setJSTestObjEnforceRangeShortAttr):
(WebCore::jsTestObjPrototypeFunctionClassMethodWithClamp):
(WebCore::jsTestObjPrototypeFunctionClassMethodWithEnforceRange):
(WebCore::jsTestObjConstructorFunctionClassMethodWithOptional): Deleted.
(WebCore::jsTestObjConstructorFunctionClassMethod2): Deleted.
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::jsTestTypedefsPrototypeFunctionFuncWithClamp):
(WebCore::jsTestTypedefsPrototypeFunctionImmutablePointFunction): Deleted.
* bindings/scripts/test/ObjC/DOMTestObj.h:
* bindings/scripts/test/ObjC/DOMTestObj.mm:
(-[DOMTestObj clampedShortAttr]):
(-[DOMTestObj setClampedShortAttr:]):
(-[DOMTestObj enforceRangeShortAttr]):
(-[DOMTestObj setEnforceRangeShortAttr:]):
(-[DOMTestObj classMethodWithEnforceRange:objArgsLong:]):
* bindings/scripts/test/TestObj.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200131 268f45cc-cd09-0410-ab3c-d52691b4dbfc

CSP: Add app-specific workaround for Ecobee and Quora
https://bugs.webkit.org/show_bug.cgi?id=157005
<rdar://problem/25560776>

Reviewed by Brent Fulgham.

Source/WebCore:

* page/Settings.in: Add setting allowContentSecurityPolicySourceStarToMatchAnyProtocol (disabled by default).
* page/csp/ContentSecurityPolicy.cpp:
(WebCore::ContentSecurityPolicy::allowContentSecurityPolicySourceStarToMatchAnyProtocol): Added.
* page/csp/ContentSecurityPolicy.h:
* page/csp/ContentSecurityPolicySourceList.cpp:
(WebCore::ContentSecurityPolicySourceList::isProtocolAllowedByStar): Modified to return true
if ContentSecurityPolicy::allowContentSecurityPolicySourceStarToMatchAnyProtocol() evaluates to true.
* platform/RuntimeApplicationChecks.h:
* platform/RuntimeApplicationChecks.mm:
(WebCore::IOSApplication::isEcobee): Added.
(WebCore::IOSApplication::isQuora): Added.

Source/WebKit/mac:

* Misc/WebKitVersionChecks.h:
* WebView/WebView.mm:
(shouldAllowContentSecurityPolicySourceStarToMatchAnyProtocol): Added.
(-[WebView _preferencesChanged:]): Enable setting allowContentSecurityPolicySourceStarToMatchAnyProtocol
if applicable.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200130 268f45cc-cd09-0410-ab3c-d52691b4dbfc

REGRESSION(r200094): [FreeType] Vertical text is broken after r200094
https://bugs.webkit.org/show_bug.cgi?id=157066

Reviewed by Martin Robinson.

Source/WebCore:

The problem is that Freetype implementation needs to call buildScaledFont() when orientation, SyntheticOblique
or size change, but the new static clone methods don't do that. I think it's the time to stop using our own
header for FontPlatformData for the FreeType implementation to make cross-platform changes easier and prevent
regressions like this in the future.

* CMakeLists.txt: Compile FontPlatformData.cpp for all ports.
* PlatformMac.cmake: Remove FontPlatformData.cpp.
* PlatformWin.cmake: Ditto.
* platform/graphics/FontPlatformData.cpp: We need our own clone methods in the FreeType backend.
* platform/graphics/FontPlatformData.h: Move FreeType specific methods and members from the old header file.
* platform/graphics/cairo/CairoUtilities.cpp:
(WebCore::CairoFtFaceLocker::CairoFtFaceLocker): Move CairoFtFaceLocker implementation here from
HarfBuzzFaceCairo.cpp to make it available to other classes, and make it handle the case of
cairo_ft_scaled_font_lock_face() returning nullptr.
(WebCore::CairoFtFaceLocker::~CairoFtFaceLocker):
* platform/graphics/cairo/CairoUtilities.h:
(WebCore::CairoFtFaceLocker::ftFace):
* platform/graphics/freetype/FontCacheFreeType.cpp:
(WebCore::findBestFontGivenFallbacks): Move the fallbacks implementation to FontPlatformData where it belongs
and here simply use FontPlatformData::fallbacks().
* platform/graphics/freetype/FontPlatformData.h: Removed.
* platform/graphics/freetype/FontPlatformDataFreeType.cpp:
(WebCore::FontPlatformData::FontPlatformData): Remove members already initialized in the header.
(WebCore::FontPlatformData::operator=): Add missing members to be copied.
(WebCore::FontPlatformData::~FontPlatformData): Do not free m_scaledFont manually since we are now using a smart pointer.
(WebCore::FontPlatformData::cloneWithOrientation): Call buildScaledFont() like setOrientation() did.
(WebCore::FontPlatformData::cloneWithSyntheticOblique): Call buildScaledFont() like setSyntheticOblique() did.
(WebCore::FontPlatformData::cloneWithSize): Call buildScaledFont().
(WebCore::FontPlatformData::fallbacks): Lazily initialize fallbacks if needed and return it.
(WebCore::FontPlatformData::platformIsEqual): Only compare FreeType specific members.
(WebCore::FontPlatformData::buildScaledFont): Use RefPtr for m_scaledFont.
(WebCore::FontPlatformData::hasCompatibleCharmap): Use CairoFtFaceLocker.
(WebCore::FontPlatformData::openTypeTable): Update to return RefPtr instead of PassRefPtr and use CairoFtFaceLocker.
(WebCore::FontPlatformData::operator==): Deleted.
(WebCore::FontPlatformData::setOrientation): Deleted.
(WebCore::FontPlatformData::setSyntheticOblique): Deleted.
* platform/graphics/freetype/GlyphPageTreeNodeFreeType.cpp:
(WebCore::GlyphPage::fill): Use CairoFtFaceLocker.
* platform/graphics/freetype/SimpleFontDataFreeType.cpp:
(WebCore::Font::platformInit): Ditto.
(WebCore::Font::canRenderCombiningCharacterSequence): Ditto.
* platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:
(WebCore::harfBuzzCairoGetTable): Ditto.
(WebCore::CairoFtFaceLocker::CairoFtFaceLocker): Deleted.
(WebCore::CairoFtFaceLocker::lock): Deleted.
(WebCore::CairoFtFaceLocker::~CairoFtFaceLocker): Deleted.

Source/WebKit2:

Add Source/WebCore/platform/graphics/freetype to the list of include dirs, because now FontPlatformData.h
includes FcUniquePtr.h.

* PlatformEfl.cmake:
* PlatformGTK.cmake:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200129 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Versioning.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200128 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL][GTK] Volume slider only changes volume when thumb is released, not while dragging
https://bugs.webkit.org/show_bug.cgi?id=156970

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

Volume slider have to change the volume while dragging the thumb.

Test: media/video-volume-slider-drag.html

* Modules/mediacontrols/mediaControlsBase.js:
(Controller.prototype.createControls): Use the 'input' event instead of the 'change' to
check the changed value correctly.
(Controller.prototype.handleMaxButtonClicked):
(Controller.prototype.handleVolumeSliderInput): Renamed from handleVolumeSliderChange.
(Controller.prototype.handleVolumeSliderChange): Deleted.

LayoutTests:

Removed the passed test.

* platform/efl/TestExpectations:
* platform/gtk/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200126 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[GTK] Fails to build randomly when generating LLIntDesiredOffsets.h
https://bugs.webkit.org/show_bug.cgi?id=155427

Reviewed by Carlos Garcia Campos.

If the build directory contains the -I string, the script that
generates LLIntDesiredOffsets.h will confuse it with an option to
declare an include directory.

In order to avoid that we should only use the arguments that start
with -I when extracting the list of include directories, instead
of using the ones that simply contain that string.

* offlineasm/parser.rb:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200125 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Fetch API] Remove FetchResponse::redirect overload
https://bugs.webkit.org/show_bug.cgi?id=157034

Reviewed by Darin Adler.

No change of behavior.

* Modules/fetch/FetchResponse.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200123 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Mac][cmake] Unreviewed speculative buildfix after r200116, just for fun.

* PlatformMac.cmake:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200122 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSC should have an option to allow global const redeclarations
https://bugs.webkit.org/show_bug.cgi?id=157006

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This patch implements an option that dictates whether
const redeclarations at the program level will throw.
This option defaults to true but allows users of JSC
to set it to false. This option is per VM. This is needed
for backwards compatibility with our old const implementation.

* jsc.cpp:
(GlobalObject::finishCreation):
(functionShadowChickenFunctionsOnStack):
(functionSetGlobalConstRedeclarationShouldNotThrow):
(functionReadline):
* runtime/Executable.cpp:
(JSC::ProgramExecutable::initializeGlobalProperties):
* runtime/JSGlobalLexicalEnvironment.cpp:
(JSC::JSGlobalLexicalEnvironment::put):
(JSC::JSGlobalLexicalEnvironment::isConstVariable):
* runtime/JSGlobalLexicalEnvironment.h:
(JSC::JSGlobalLexicalEnvironment::isEmpty):
* runtime/VM.h:
(JSC::VM::setGlobalConstRedeclarationShouldThrow):
(JSC::VM::globalConstRedeclarationShouldThrow):
* tests/stress/global-const-redeclaration-setting: Added.
* tests/stress/global-const-redeclaration-setting-2.js: Added.
(assert):
* tests/stress/global-const-redeclaration-setting-3.js: Added.
(assert):
(catch):
* tests/stress/global-const-redeclaration-setting-4.js: Added.
(assert):
(catch):
* tests/stress/global-const-redeclaration-setting-5.js: Added.
(assert):
(catch):
* tests/stress/global-const-redeclaration-setting.js: Added.
(assert):
* tests/stress/global-const-redeclaration-setting/first.js: Added.
* tests/stress/global-const-redeclaration-setting/let.js: Added.
* tests/stress/global-const-redeclaration-setting/second.js: Added.
* tests/stress/global-const-redeclaration-setting/strict.js: Added.

Source/WebCore:

This patch makes the JS VM not throw global const redeclaration
errors when the application is iBooks.

* bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::commonVM):
* page/Settings.h:
(WebCore::Settings::shouldUseHighResolutionTimers):
(WebCore::Settings::globalConstRedeclarationShouldThrow):
(WebCore::Settings::backgroundShouldExtendBeyondPage):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200121 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Support legacy HTTP headers in WebSockets
https://bugs.webkit.org/show_bug.cgi?id=157057

Patch by John Wilander <wilander@apple.com> on 2016-04-26
Reviewed by Brent Fulgham.

No new tests since these headers are not officially supported and should not be used.

* platform/network/HTTPHeaderNames.in:
    Added four legacy headers needed to support older WebSockets servers.
    Two of them are in the draft from August 2010: https://whatwg.org/specs/web-socket-protocol/

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200120 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Uncaught Exception: SecurityError: DOM Exception 18: An attempt was made to break through the security policy of the user agent.
https://bugs.webkit.org/show_bug.cgi?id=156991
<rdar://problem/25913475>

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2016-04-26
Reviewed by Timothy Hatcher.

Source/WebKit/mac:

* WebCoreSupport/WebInspectorClient.mm:
(-[WebInspectorWindowController init]):
Apply the same universal file access to WebKit1 Web Inspector views that
we apply to WebKit2 views. Explicitly always allow access to storage
for Web Inspector content just in case as we already allow universal
file access.

Source/WebKit2:

* UIProcess/mac/WebInspectorProxyMac.mm:
(WebKit::WebInspectorProxy::platformCreateInspectorPage):
Explicitly always allow access to storage for Web Inspector content just
in case, as we already allow universal file access.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200119 268f45cc-cd09-0410-ab3c-d52691b4dbfc

RTL native <select> buttons should have arrows on left
https://bugs.webkit.org/show_bug.cgi?id=157055
<rdar://problem/25894428>

Source/WebCore:

Reviewed by Myles Maxfield.

If the text direction is right-to-left, the select popup
buttons should have the arrows on the left side.

Test: fast/forms/select-writing-direction-natural.html

* rendering/RenderThemeMac.h:
* rendering/RenderThemeMac.mm:
(WebCore::RenderThemeMac::popupButtonPadding): Takes a direction parameter.
(WebCore::RenderThemeMac::popupInternalPaddingBox): Checks the direction for the padding.
(WebCore::RenderThemeMac::setPopupButtonCellState): Tell the button to put the
arrows on the correct side.
(WebCore::RenderThemeMac::popupButton): Deleted an unnecessary comment.

LayoutTests:

Reviewed by Myles Maxfield.

* fast/forms/select-writing-direction-natural.html: Removed some incorrect
text in the test.
* platform/ios-simulator/fast/forms/select-writing-direction-natural-expected.txt:
* platform/mac/fast/forms/select-writing-direction-natural-expected.png:
* platform/mac/fast/forms/select-writing-direction-natural-expected.txt:
* platform/mac/fast/text/international/bidi-menulist-expected.png:
* platform/mac/fast/text/international/bidi-menulist-expected.txt:
* platform/mac/fast/text/international/pop-up-button-text-alignment-and-direction-expected.png:
* platform/mac/fast/text/international/pop-up-button-text-alignment-and-direction-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200118 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[ES] Implement RegExp.prototype.@@replace and use it for String.prototype.replace
https://bugs.webkit.org/show_bug.cgi?id=156562

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Added builtins for String.prototype.replace as well as RegExp.prototype[Symbol.replace].

The String.prototype.replace also has an intrinsic, StringPrototypeReplaceIntrinsic.
This original intrinsic was copied to make StringPrototypeReplaceRegExpIntrinsic.
The difference between the two intrinsics is that StringPrototypeReplaceIntrinsic has
the same checks found in the new builtin hasObservableSideEffectsForStringReplace.
We implement these primordial checks for StringPrototypeReplaceIntrinsic in two places.
First, we do a trial check during ByteCode parsing time to see if the current
RegExp.prototype properties have changed from the original.  If they have, we don't
inline the intrinsic.  Later, in the fixup phase, we add nodes to the IR to emit the
checks at runtime.

The new intrinsic StringPrototypeReplaceRegExpIntrinsic is only available via the
private @replaceUsingRegExp, which is called in the String.prototype.replace builtin.
It is only called after hasObservableSideEffectsForStringReplace has been called

Both of these intrinsics are needed, because the JS code containing String.replace() calls
runs initially in the LLint and then the baseline JIT.  Even after the function tiers up
to the DFG JIT, the inlining budget may not allow StringPrototypeReplaceIntrinsic to be inlined.
Having StringPrototypeReplaceRegExpIntrinsic allows for the String.prototype.replace builtin to
get reasonable performance before the other intrinsic is inlined or when it can't.

* builtins/RegExpPrototype.js:
(match):
(getSubstitution):
(replace):
(search):
(split):
* builtins/StringPrototype.js:
(repeat):
(hasObservableSideEffectsForStringReplace):
(intrinsic.StringPrototypeReplaceIntrinsic.replace):
(localeCompare):
New builtins for String.prototype.replace and RegExp.prototype[Symbol.replace].

* bytecode/BytecodeIntrinsicRegistry.cpp:
* bytecode/BytecodeIntrinsicRegistry.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupGetAndSetLocalsInBlock):
(JSC::DFG::FixupPhase::tryAddStringReplacePrimordialChecks):
(JSC::DFG::FixupPhase::checkArray):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::getRegExpPrototypeProperty):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::getRegExpPrototypeProperty):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasHeapPrediction):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
* runtime/CommonIdentifiers.h:
* runtime/Intrinsic.h:
* runtime/RegExpPrototype.cpp:
(JSC::RegExpPrototype::finishCreation):
* runtime/StringPrototype.cpp:
(JSC::StringPrototype::finishCreation):
(JSC::replace):
(JSC::stringProtoFuncReplaceUsingRegExp):
(JSC::stringProtoFuncReplaceUsingStringSearch):
(JSC::operationStringProtoFuncReplaceGeneric):
(JSC::stringProtoFuncReplace): Deleted.
Added StringReplaceRegExp intrinsic.  Added checks for RegExp profiled arguments to StringReplace
that mirror what is in hasObservableSideEffectsForStringReplace().  If we aren't able to add the
checks, we OSR exit.  Add Graph::getPrimordialRegExpPrototypeProperty() as a helper to get the
primordial values from RegExp.prototype.

* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init): Added @regExpPrototypeSymbolReplace and
@hasObservableSideEffectsForStringReplace here instead og String.prototype so that we reduce the
number of objects we have to traverse.

* tests/es6.yaml: Changed expectations for the various replace related tests to passing.

* tests/stress/regexp-replace-proxy.js:
(assert):
(let.getProxyNullExec.new.Proxy):
(let.getSetProxyNullExec.new.Proxy):
(get resetTracking):
(let.getSetProxyMatches_comma.new.Proxy):
(set get getSetProxyNullExec):
(let.getSetProxyReplace_phoneNumber.new.Proxy):
(set get getSetProxyMatches_comma):
(let.getSetProxyReplaceUnicode_digit_nonGreedy.new.Proxy):
(set get resetTracking):
* tests/stress/string-replace-proxy.js:
(assert):
(let.getSetProxyReplace.new.Proxy.replace):
New tests.

LayoutTests:

Updated tests.  Needed to update js/regress-141098.js test, because builtins are
only compilied when called.  This test checks behavior at or near running out of
stack space.  It turns out that String.replace is used by the -pre.js test harness
and I was running out of stack space when compiling the String.prototype.replace
builting.  Therefore, I added a call to testPassed() to precompile String.replace.

* js/Object-getOwnPropertyNames-expected.txt:
* js/regress-141098-expected.txt:
* js/script-tests/Object-getOwnPropertyNames.js:
* js/script-tests/regress-141098.js:
(probeAndRecurse):
* fast/profiler/nested-start-and-stop-profiler-expected.txt:
* js/Object-getOwnPropertyNames-expected.txt:
* js/dom/string-prototype-properties-expected.txt:
* js/regress-141098-expected.txt:
* js/script-tests/Object-getOwnPropertyNames.js:
* js/script-tests/regress-141098.js:
(probeAndRecurse):
* sputnik/Conformance/15_Native_Objects/15.5_String/15.5.4/15.5.4.11_String.prototype.replace/S15.5.4.11_A1_T3-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200117 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WK2] [OS X] Create API for switching RTL scrollbar policy
https://bugs.webkit.org/show_bug.cgi?id=156948
<rdar://problem/25707757>

Reviewed by Darin Adler.

Source/WebCore:

There are two schools of thought for where to put scrollbars in RTL environments.
The first is that we should obey the content's "dir" attribute, specified on each
element. The second is that we should be consistent with the platform (AppKit's)
behavior.

There are some situations where the placement should be done according to the
content. For example, this policy would be used in web browsers.

However, there are also places where web content is designed to fit seamlessly
amongst native content. In this situation, the placement of the scrollbars should
be done according to the view.

Because WebKit doesn't know which of these situations it is operating within, this
patch adds a new API property, userInterfaceDirectionPolicy, to
WKWebViewConfigurationPolicy. This allows clients to instruct us which policy to
abide by. It is plumbed to the web process inside the WebPreferencesStore and is
ultimately held inside the Page's Settings object.

This Setting is consulted by RenderLayerModelObject, which serves as a good
centralized place for this policy implementation. This is the class which decides
if we should be consulting its RenderStyle or the platform itself when we decide
where to put the scrollbars.

Putting this decision inside the renderer is important because ScrollableArea
often needs to know if scrollbars should be put on the left, but ScrollableArea
doesn't know anything about RenderStyles. Therefore, the renderer must be the
intermediary between ScrollableArea and the RenderStyle. (ScrollableArea also
doesn't directly know anything about renderers either; however, each of the
subclasses knows about an appropriate renderer.) Therefore, ScrollableArea gets
a new virtual method which is implemented by the RenderLayerModelObject.

Tests: fast/scrolling/rtl-scrollbars*.html

* WebCore.xcodeproj/project.pbxproj: ScrollableAreaMac.mm is no longer necessary.
* page/FrameView.cpp:
(WebCore::FrameView::shouldPlaceBlockDirectionScrollbarOnLeft): Overridden
ScrollableArea function.
* page/FrameView.h:
* page/Settings.h:
* page/Settings.in:
* platform/ScrollView.cpp: Adding two new settings: One to know if we should
consult with the RenderStyle or the platform, and the other is whether or not
the platform considers itself to be RTL.
(WebCore::ScrollView::documentScrollPositionRelativeToViewOrigin): Update to
use new mechanism.
(WebCore::ScrollView::updateScrollbars): Ditto.
(WebCore::ScrollView::scrollCornerRect): Ditto.
(WebCore::ScrollView::locationOfContents): Ditto.
* platform/ScrollableArea.cpp:
(WebCore::ScrollableArea::verticalScrollbarIsOnLeft): Deleted. This was the old
mechanism.
(WebCore::ScrollableArea::systemLanguageIsRTL): Deleted. Ditto.
* platform/ScrollableArea.h:
* platform/mac/ScrollableAreaMac.mm: Removed.
(WebCore::ScrollableArea::verticalScrollbarIsOnLeft): Deleted.
(WebCore::ScrollableArea::systemLanguageIsRTL): Deleted.
* platform/mac/ScrollbarThemeMac.mm:
(WebCore::ScrollbarThemeMac::didCreateScrollerImp): Update to use new
mechanism.
* platform/text/WritingMode.h: These enums should match what's in WebKit2.
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::logicalLeftOffsetForContent): Update to use new mechanism.
(WebCore::RenderBlock::logicalRightOffsetForContent): Ditto.
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::determineLogicalLeftPositionForChild): Ditto.
* rendering/RenderBox.cpp: Ditto.
(WebCore::RenderBox::contentBoxRect):
(WebCore::RenderBox::overflowClipRect):
(WebCore::RenderBox::computePositionedLogicalWidth):
(WebCore::RenderBox::layoutOverflowRectForPropagation):
* rendering/RenderBoxModelObject.cpp: Ditto.
(WebCore::RenderBoxModelObject::constrainingRectForStickyPosition):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::resize): Ditto.
(WebCore::cornerStart): Migrate to use references.
(WebCore::cornerRect): Ditto.
(WebCore::RenderLayer::scrollCornerRect): Ditto.
(WebCore::resizerCornerRect): Ditto.
(WebCore::RenderLayer::scrollCornerAndResizerRect): Ditto.
(WebCore::RenderLayer::verticalScrollbarStart): Update to use new mechanism.
(WebCore::RenderLayer::horizontalScrollbarStart): Ditto.
(WebCore::RenderLayer::offsetFromResizeCorner): Ditto.
(WebCore::RenderLayer::positionOverflowControls): Migrate to use references.
(WebCore::RenderLayer::computeScrollDimensions): Ditto.
(WebCore::RenderLayer::overflowControlsIntersectRect): Ditto.
(WebCore::RenderLayer::drawPlatformResizerImage): Update to use new mechanism.
(WebCore::RenderLayer::paintResizer): Migrate to use references.
(WebCore::RenderLayer::isPointInResizeControl): Ditto.
(WebCore::RenderLayer::hitTestOverflowControls): Ditto.
(WebCore::RenderLayer::hitTestResizerInFragments): Ditto.
* rendering/RenderLayer.h: ScrollableArea override
* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::positionForClipLayer): Update to use new
mechanism.
* rendering/RenderLayerModelObject.cpp:
(WebCore::RenderLayerModelObject::shouldPlaceBlockDirectionScrollbarOnLeft):
This is the meat of this patch. This is where we decide if we should be
interrogating the RenderStyle or the underlying platform.
* rendering/RenderLayerModelObject.h:
* rendering/RenderListBox.cpp: Update to use new mechanism.
(WebCore::RenderListBox::itemBoundingBoxRect):
(WebCore::RenderListBox::paintScrollbar):
(WebCore::RenderListBox::isPointInOverflowControl):
(WebCore::RenderListBox::listIndexAtOffset):
(WebCore::RenderListBox::controlClipRect):
(WebCore::RenderListBox::invalidateScrollbarRect):
(WebCore::RenderListBox::convertFromScrollbarToContainingView):
(WebCore::RenderListBox::convertFromContainingViewToScrollbar):
* rendering/RenderListBox.h:
* rendering/RenderView.cpp: Ditto.
(WebCore::RenderView::repaintViewRectangle):
* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::shouldPlaceBlockDirectionScrollbarOnLeft): This
function is now much dumber. It just inspects its own style.
* testing/InternalSettings.cpp: Allow mocking.
(WebCore::InternalSettings::Backup::Backup):
(WebCore::InternalSettings::Backup::restoreTo):
(WebCore::InternalSettings::verticalScrollbarLocationPolicy):
(WebCore::InternalSettings::setVerticalScrollbarLocationPolicy):
(WebCore::InternalSettings::systemLayoutDirection):
(WebCore::InternalSettings::setSystemLayoutDirection):
* testing/InternalSettings.h:
* testing/InternalSettings.idl:

Source/WebKit2:

Add the new API.

* Shared/WebPreferencesDefinitions.h:
* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _initializeWithConfiguration:]):
* UIProcess/API/Cocoa/WKWebViewConfiguration.h:
* UIProcess/API/Cocoa/WKWebViewConfiguration.mm:
(-[WKWebViewConfiguration init]):
(-[WKWebViewConfiguration encodeWithCoder:]):
(-[WKWebViewConfiguration initWithCoder:]):
(-[WKWebViewConfiguration copyWithZone:]):
* UIProcess/WebPageProxy.cpp:
* WebProcess/Plugins/PDF/DeprecatedPDFPlugin.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updatePreferences):

LayoutTests:

Update tests to use new RTL scrollbar mechanism.

* fast/scrolling/rtl-scrollbars-animation-property.html:
* fast/scrolling/rtl-scrollbars-elementFromPoint-static.html:
* fast/scrolling/rtl-scrollbars-elementFromPoint.html:
* fast/scrolling/rtl-scrollbars-expected.html:
* fast/scrolling/rtl-scrollbars-iframe-offset-expected.html:
* fast/scrolling/rtl-scrollbars-iframe-offset.html:
* fast/scrolling/rtl-scrollbars-iframe-position-absolute.html:
* fast/scrolling/rtl-scrollbars-iframe-scrolled-expected.html:
* fast/scrolling/rtl-scrollbars-iframe-scrolled.html:
* fast/scrolling/rtl-scrollbars-iframe.html:
* fast/scrolling/rtl-scrollbars-listbox-expected.html:
* fast/scrolling/rtl-scrollbars-listbox-scroll-expected.html:
* fast/scrolling/rtl-scrollbars-listbox-scroll.html:
* fast/scrolling/rtl-scrollbars-listbox-select-left-expected.html:
* fast/scrolling/rtl-scrollbars-listbox-select-left.html:
* fast/scrolling/rtl-scrollbars-listbox-select-right-expected.html:
* fast/scrolling/rtl-scrollbars-listbox-select-right.html:
* fast/scrolling/rtl-scrollbars-listbox-simple-expected-mismatch.html:
* fast/scrolling/rtl-scrollbars-listbox-simple.html:
* fast/scrolling/rtl-scrollbars-listbox.html:
* fast/scrolling/rtl-scrollbars-overflow-contents-expected.html:
* fast/scrolling/rtl-scrollbars-overflow-contents.html:
* fast/scrolling/rtl-scrollbars-overflow-dir-rtl-expected.html:
* fast/scrolling/rtl-scrollbars-overflow-dir-rtl.html:
* fast/scrolling/rtl-scrollbars-overflow-elementFromPoint.html:
* fast/scrolling/rtl-scrollbars-overflow-expected.html:
* fast/scrolling/rtl-scrollbars-overflow-padding-expected.html:
* fast/scrolling/rtl-scrollbars-overflow-padding.html:
* fast/scrolling/rtl-scrollbars-overflow-position-absolute-expected.html:
* fast/scrolling/rtl-scrollbars-overflow-position-absolute.html:
* fast/scrolling/rtl-scrollbars-overflow-simple-expected-mismatch.html:
* fast/scrolling/rtl-scrollbars-overflow-simple.html:
* fast/scrolling/rtl-scrollbars-overflow-text-selection-scrolled-expected.html:
* fast/scrolling/rtl-scrollbars-overflow-text-selection-scrolled.html:
* fast/scrolling/rtl-scrollbars-overflow.html:
* fast/scrolling/rtl-scrollbars-overlay-no-push-contents-expected.html:
* fast/scrolling/rtl-scrollbars-overlay-no-push-contents.html:
* fast/scrolling/rtl-scrollbars-position-absolute-expected.html:
* fast/scrolling/rtl-scrollbars-position-absolute.html:
* fast/scrolling/rtl-scrollbars-position-fixed-expected.html:
* fast/scrolling/rtl-scrollbars-position-fixed.html:
* fast/scrolling/rtl-scrollbars-positioning-expected.html:
* fast/scrolling/rtl-scrollbars-positioning.html:
* fast/scrolling/rtl-scrollbars-simple-expected-mismatch.html:
* fast/scrolling/rtl-scrollbars-simple.html:
* fast/scrolling/rtl-scrollbars-sticky-document-2-expected.html:
* fast/scrolling/rtl-scrollbars-sticky-document-2.html:
* fast/scrolling/rtl-scrollbars-sticky-document-expected.html:
* fast/scrolling/rtl-scrollbars-sticky-document.html:
* fast/scrolling/rtl-scrollbars-sticky-iframe-2-expected.html:
* fast/scrolling/rtl-scrollbars-sticky-iframe-2.html:
* fast/scrolling/rtl-scrollbars-sticky-iframe-expected.html:
* fast/scrolling/rtl-scrollbars-sticky-iframe.html:
* fast/scrolling/rtl-scrollbars-sticky-overflow-scroll-2-expected.html:
* fast/scrolling/rtl-scrollbars-sticky-overflow-scroll-2.html:
* fast/scrolling/rtl-scrollbars-sticky-overflow-scroll-expected.html:
* fast/scrolling/rtl-scrollbars-sticky-overflow-scroll.html:
* fast/scrolling/rtl-scrollbars-text-selection-expected.html:
* fast/scrolling/rtl-scrollbars-text-selection-scrolled-expected.html:
* fast/scrolling/rtl-scrollbars-text-selection-scrolled.html:
* fast/scrolling/rtl-scrollbars-text-selection.html:
* fast/scrolling/rtl-scrollbars.html:
* platform/mac/fast/scrolling/rtl-scrollbars-animation-property-expected.png: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200116 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Gardening: speculative build fix.

Not reviewed.

* API/JSWrapperMap.mm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200115 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Update the compatibility version check for the ObjC API's InitConstructorSupport to use dyld_get_program_sdk_version().
https://bugs.webkit.org/show_bug.cgi?id=157048

Reviewed by Geoffrey Garen.

* API/JSWrapperMap.mm:
(supportsInitMethodConstructors):
(getJSExportProtocol):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200114 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[JSC] GetByVal on Undecided use its children before its OSR Exit
https://bugs.webkit.org/show_bug.cgi?id=157046

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-26
Reviewed by Mark Lam.

Very silly bug: GetByVal on Undecided uses its children before
the speculationCheck(). If we fail the speculation, we have already
lost how to recover the values.

The existing tests did not catch this because we tier up to B3
before such Exits happen. B3 has explicit liveness and did not suffer
from this bug.
The new test has a smaller warmup to exercise the OSR Exit in DFG
instead of FTL.

* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* tests/stress/get-by-val-on-undecided-out-of-bounds.js: Added.
(string_appeared_here.opaqueGetByValKnownArray):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200113 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed: add myself to the committers list.

* Scripts/webkitpy/common/config/contributors.json:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200112 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Update tests in web-platform-tests/html/semantics/scripting-1/
https://bugs.webkit.org/show_bug.cgi?id=157026

Reviewed by Darin Adler.

Reimported tests under web-platform-tests/html/semantics/scripting-1/ as of d5a4c5bdf8a1837b4fcf50bbd2efd4150ddafa99.

* web-platform-tests/html/semantics/scripting-1/the-script-element/async_001-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_001.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_002-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_002.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_003-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_003.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_004-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_004.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_005-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_005.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_006-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_006.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_007-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_007.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_008-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_008.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_009-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_009.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_010-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_010.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_011-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/async_011.htm: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/external-script-utf8.js: Added.
(window.getSomeString):
* web-platform-tests/html/semantics/scripting-1/the-script-element/external-script-windows1250.js: Added.
(window.getSomeString):
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha/base-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha/base.html: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha/test.js: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/alpha/w3c-import.log: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/beta: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/beta/test.js: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/beta/w3c-import.log: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/empty-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/empty-with-base-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/empty-with-base.html: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/empty.html: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/failure-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/failure.html: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/unreachable.js: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/fetch-src/w3c-import.log: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-02-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-02.html: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/script-not-found-not-executed-2.py: Added.
(main):
* web-platform-tests/html/semantics/scripting-1/the-script-element/script-not-found-not-executed-expected.txt: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/script-not-found-not-executed.html: Added.
* web-platform-tests/html/semantics/scripting-1/the-script-element/script-not-found-not-executed.py: Added.
(main):
* web-platform-tests/html/semantics/scripting-1/the-script-element/serve-with-content-type.py: Added.
(main):
* web-platform-tests/html/semantics/scripting-1/the-script-element/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/node-document-expected.txt:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/node-document.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/template-child-nodes.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-parsing-xhtml-documents/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-serializing-xhtml-documents/outerhtml.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-serializing-xhtml-documents/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-the-css-user-agent-style-sheet/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-the-steps-to-clone-a-node/template-clone-children.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-the-steps-to-clone-a-node/templates-copy-document-owner.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/additions-to-the-steps-to-clone-a-node/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents-owner-document-type.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents-owner-test-001.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents-owner-test-002.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/template-contents.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/definitions/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/innerhtml-on-templates/innerhtml.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/innerhtml-on-templates/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/resources/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/serializing-html-templates/outerhtml.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/serializing-html-templates/w3c-import.log:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/content-attribute.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/node-document-changes.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-content-node-document.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-content.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-body.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-head.html:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/w3c-import.log:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200111 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Web IDL] Specify default values for optional parameters of type 'unsigned long'
https://bugs.webkit.org/show_bug.cgi?id=157043

Reviewed by Alex Christensen.

Specify default values for optional parameters of type 'unsigned long' and let
the bindings generator use WTF::Optional<> for the parameters that do not have
such default value.

* Modules/webaudio/AudioContext.cpp:
(WebCore::AudioContext::createScriptProcessor): Deleted.
(WebCore::AudioContext::createChannelSplitter): Deleted.
(WebCore::AudioContext::createChannelMerger): Deleted.
* Modules/webaudio/AudioContext.h:
* Modules/webaudio/AudioContext.idl:
* bindings/scripts/CodeGeneratorJS.pm:
(CanUseWTFOptionalForParameter): Deleted.
* css/CSSStyleSheet.cpp:
(WebCore::CSSStyleSheet::addRule):
* css/CSSStyleSheet.h:
* inspector/InspectorStyleSheet.cpp:
(WebCore::InspectorStyleSheet::addRule):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200110 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix text in log files autogenerated by import-w3c-tests
https://bugs.webkit.org/show_bug.cgi?id=157021

Unreviewed. Fixing the second typo.

* Scripts/webkitpy/w3c/test_importer.py:
(TestImporter.write_import_log):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200109 268f45cc-cd09-0410-ab3c-d52691b4dbfc

ASSERTION FAILED: m_templateInsertionModes.isEmpty() in WebCore::HTMLTreeBuilder::finished
https://bugs.webkit.org/show_bug.cgi?id=143519

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaselined the tests.

* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant-expected.txt:
* web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset-expected.txt:
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt:

Source/WebCore:

The assertion failure was caused by our parser inconsistently following the spec. Fixed it by making our HTML parser
match the latest HTML5 specification. See inline comments below.

Tests: fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html
       html5lib/generated/run-template-data.html
       html5lib/generated/run-template-write.html
       imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-as-a-descendant.html
       imported/w3c/web-platform-tests/html/semantics/scripting-1/the-template-element/template-element/template-descendant-frameset.html
       imported/w3c/web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html

* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::processStartTagForInBody): When parsing a template element for 'in body' insertion mode,
we process the token using the rules for 'in head' insertion mode, which sets the frameset-ok flag to "not ok".
In addition, 'in template' insertion mode should not special case a start tag whose tag name is "frame". Instead,
fallback to using 'in body' insertion mode.
https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inbody
(WebCore::HTMLTreeBuilder::processStartTag): 'in frameset' insertion mode should not special case a start tag whose
tag name is "template": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inframeset
(WebCore::HTMLTreeBuilder::processEndTag): Ditto for an end tag whose name is "template".
(WebCore::HTMLTreeBuilder::processStartTagForInHead): When parsing a template element in 'in head' inserting mode,
we set the frameset-ok flag to "not ok": https://html.spec.whatwg.org/multipage/syntax.html#parsing-main-inhead

LayoutTests:

Rebaselined the html5lib tests (now passes all the test cases!) and added a regression test for an assertion.

* fast/dom/HTMLTemplateElement/parsing-template-with-frameset-expected.txt: Added.
* fast/dom/HTMLTemplateElement/parsing-template-with-frameset.html: Added.
* html5lib/generated/run-template-data-expected.txt:
* html5lib/generated/run-template-write-expected.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200108 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WinCairo][ANGLE] Display object is not created.
https://bugs.webkit.org/show_bug.cgi?id=157042

Reviewed by Alex Christensen.

The CreateDisplayFromAttribs function will not create a DisplayD3D object when the requested
type is EGL_PLATFORM_ANGLE_TYPE_DEFAULT_ANGLE, because ANGLE_ENABLE_OPENGL is not defined.
We should be able to create a DisplayD3D object without defining ANGLE_ENABLE_OPENGL.

* src/libANGLE/Display.cpp:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200107 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Check to make sure shouldRequestCandidates() before requesting candidates
https://bugs.webkit.org/show_bug.cgi?id=157038
-and corresponding-
rdar://problem/25910418

Reviewed by Tim Horton.

This patch limits requesting and showing candidates to cases where
shouldRequestCandidates() is true. This patch also caches the sequence number
returned by [NSSpellChecker requestCandidatesForSelectedRange:] to make sure
it is equal to the sequence number sent to the callback handler so that we do
not show candidates for old requests.

Source/WebKit/mac:

* WebCoreSupport/WebEditorClient.h:
* WebCoreSupport/WebEditorClient.mm:
(WebEditorClient::requestCandidatesForSelection):
(WebEditorClient::handleRequestedCandidates):
* WebView/WebView.mm:
(-[WebView showCandidates:forString:inRect:forSelectedRange:view:completionHandler:]):
(-[WebView shouldRequestCandidates]):
* WebView/WebViewInternal.h:

Source/WebKit2:

* UIProcess/Cocoa/WebViewImpl.h:
* UIProcess/Cocoa/WebViewImpl.mm:
(WebKit::WebViewImpl::updateWebViewImplAdditions):
(WebKit::WebViewImpl::shouldRequestCandidates):
(WebKit::WebViewImpl::showCandidates):
(WebKit::WebViewImpl::requestCandidatesForSelectionIfNeeded):
(WebKit::WebViewImpl::handleRequestedCandidates):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200106 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore on Mac ignores the user's preferred region (country) while getting the language
https://bugs.webkit.org/show_bug.cgi?id=156993

Reviewed by Geoffrey Garen.

Source/WebCore:

This is tested by the NavigatorLanguage API test.

WebCore was previously getting the list of preferred languages, and for each one, deducing
the default region. That's wrong, since for example it doesn't respect the user's choice (in
System Preferences) to display dates/calenders/etc according to a different region (like how
I have my machine set to en-pl right now).

It might be possible for the country code we get via kCFLocaleCountryCode to be something
that our ICU doesn't handle. To defend against this, we search for the resulting country
code in ICU's ISO countries list. If it doesn't appear in that list, we fall back on old
behavior.

* platform/mac/Language.mm:
(WebCore::httpStyleLanguageCode):
(WebCore::isValidICUCountryCode):
(WebCore::platformUserPreferredLanguages):

Tools:

Change the test expectations for this test. If the variant is not explicitly specified in
the AppleLanguage, then we use the locale's country code, which this test assumes is US.

* TestWebKitAPI/Tests/mac/NavigatorLanguage.mm:
(TestWebKitAPI::languageForSystemLanguage):
(TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200105 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Use auto-generated operators in FontPlatformData
https://bugs.webkit.org/show_bug.cgi?id=157037

Reviewed by Geoffrey Garen.

The only reason why they weren't used before is because Cairo was
using a raw pointer. However, RefPtr supports Cairo types, so this
patch migrates that pointer to a RefPtr. Therefore, we can remove
our custom operators (because they work the same way as auto-
generated ones do).

No new tests because there is no behavior change.

* platform/graphics/FontPlatformData.cpp:
(WebCore::FontPlatformData::FontPlatformData): Deleted.
(WebCore::FontPlatformData::operator=): Deleted.
* platform/graphics/FontPlatformData.h:
(WebCore::FontPlatformData::scaledFont):
(WebCore::FontPlatformData::hash):
* platform/graphics/cocoa/FontPlatformDataCocoa.mm:
(WebCore::FontPlatformData::~FontPlatformData): Deleted.
(WebCore::FontPlatformData::platformDataInit): Deleted.
(WebCore::FontPlatformData::platformDataAssign): Deleted.
* platform/graphics/win/FontPlatformDataCGWin.cpp:
(WebCore::FontPlatformData::~FontPlatformData): Deleted.
(WebCore::FontPlatformData::platformDataInit): Deleted.
(WebCore::FontPlatformData::platformDataAssign): Deleted.
* platform/graphics/win/FontPlatformDataCairoWin.cpp:
(WebCore::FontPlatformData::platformDataInit):
(WebCore::FontPlatformData::FontPlatformData):
(WebCore::FontPlatformData::~FontPlatformData): Deleted.
(WebCore::FontPlatformData::platformDataAssign): Deleted.
* platform/graphics/win/FontPlatformDataWin.cpp:
(WebCore::FontPlatformData::FontPlatformData): Deleted.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200104 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add renderer address and needslayout state to inlineboxtree dump.
https://bugs.webkit.org/show_bug.cgi?id=157035

Reviewed by Simon Fraser.

* rendering/InlineBox.cpp:
(WebCore::InlineBox::showLineBox):
* rendering/InlineTextBox.cpp:
(WebCore::InlineTextBox::showLineBox):
* rendering/SimpleLineLayoutFunctions.cpp:
(WebCore::SimpleLineLayout::printPrefix):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200103 268f45cc-cd09-0410-ab3c-d52691b4dbfc

calling super() a second time in a constructor should throw
https://bugs.webkit.org/show_bug.cgi?id=151113

Reviewed by Saam Barati and Keith Miller.

Source/JavaScriptCore:

Currently, our implementation checks if 'super()' was called in a constructor more
than once and raises a RuntimeError before the second call. According to the spec
we need to raise an error just after the second super() is finished and before
the new 'this' is assigned https://esdiscuss.org/topic/duplicate-super-call-behaviour.
To implement this behavior this patch adds a new op code, op_is_empty, that is used
to check if 'this' is empty.

* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitIsEmpty):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::FunctionCallValueNode::emitBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileIsEmpty):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JIT.h:
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_is_empty):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_is_empty):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* tests/stress/class-syntax-double-constructor.js: Added.

LayoutTests:

* js/class-syntax-super-expected.txt:
* js/script-tests/class-syntax-super.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200102 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Changed jsc options title to be more descriptive.
https://bugs.webkit.org/show_bug.cgi?id=157036

Reviewed by Joseph Pecoraro.

Let the title for --dumpOptions be "Modified JSC runtime options:" since it only
dumps overridden options.  The title for --options will remain "All JSC runtime
options:" since it dumps all all options with verbose detail.

* jsc.cpp:
(CommandLine::parseArguments):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200101 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[curl] Requests interrupted when using https via proxy
https://bugs.webkit.org/show_bug.cgi?id=157028

Patch by Fujii Hironori <Hironori.Fujii@sony.com> on 2016-04-26
Reviewed by Alex Christensen.

A proxy responds "200 Connection Established" to a CONNECT
method.  This response doesn't have Content-Type, then the
request is canceled due to a unsupported MIME type. This is not
a real response from the recipient server. It should not be
processed normally. Just ignore the response.

* platform/network/curl/ResourceHandleManager.cpp:
(WebCore::headerCallback):
Do nothing if httpCode is 0. This is the case of "200 Connection Established".

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200100 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Drop Dictionary from CanUseWTFOptionalForParameter()
https://bugs.webkit.org/show_bug.cgi?id=157023

Reviewed by Darin Adler.

As per Web IDL, optional dictionary parameters are always considered to have
a default value of an empty dictionary, unless otherwise specified. There is
therefore never any need to use Optional<> for it. Just implement this
behavior in the bindings generator and drop blacklisting of Dictionary from
CanUseWTFOptionalForParameter().

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateParametersCheck):
(CanUseWTFOptionalForParameter): Deleted.
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjPrototypeFunctionOptionsObject):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200099 268f45cc-cd09-0410-ab3c-d52691b4dbfc

RenderElement::style() should return const RenderStyle
https://bugs.webkit.org/show_bug.cgi?id=157016

Reviewed by Geoff Garen.

Style should be changed via setStyle, not by mutating it directly.

Pulling this string turns RenderStyle const in many places.

* accessibility/AccessibilityObject.cpp:
(WebCore::startOfStyleRange):
* accessibility/atk/WebKitAccessibleInterfaceText.cpp:
(getAttributeSetForAccessibilityObject):
* bindings/objc/DOM.mm:
(-[DOMNode innerFrameQuad]):
(-[DOMNode computedFontSize]):
* css/CSSComputedStyleDeclaration.cpp:
(WebCore::createPositionListForLayer):
(WebCore::positionOffsetValue):
(WebCore::ComputedStyleExtractor::currentColorOrValidColor):
(WebCore::getTransitionPropertyValue):
(WebCore::scrollSnapDestination):
(WebCore::scrollSnapPoints):
(WebCore::scrollSnapCoordinates):
(WebCore::logUnimplementedPropertyID):
(WebCore::fontFamilyFromStyle):
(WebCore::lineHeightFromStyle):
(WebCore::fontSizeFromStyle):
(WebCore::fontStyleFromStyle):
(WebCore::fontVariantFromStyle):
(WebCore::fontWeightFromStyle):
(WebCore::fontSynthesisFromStyle):
(WebCore::zoomAdjustedPaddingOrMarginPixelValue):
(WebCore::paddingOrMarginIsRendererDependent):
(WebCore::convertToRegionBreak):
(WebCore::isLayoutDependent):
(WebCore::updateStyleIfNeededForNode):
(WebCore::computeRenderStyleForProperty):
(WebCore::ComputedStyleExtractor::propertyValue):
(WebCore::CSSComputedStyleDeclaration::length):
(WebCore::CSSComputedStyleDeclaration::item):
(WebCore::ComputedStyleExtractor::propertyMatches):
* css/CSSComputedStyleDeclaration.h:
* css/CSSToLengthConversionData.cpp:
(WebCore::CSSToLengthConversionData::viewportWidthFactor):
(WebCore::CSSToLengthConversionData::viewportHeightFactor):
(WebCore::CSSToLengthConversionData::viewportMinFactor):
(WebCore::CSSToLengthConversionData::viewportMaxFactor):
* css/CSSToLengthConversionData.h:
(WebCore::CSSToLengthConversionData::CSSToLengthConversionData):
(WebCore::CSSToLengthConversionData::style):
(WebCore::CSSToLengthConversionData::rootStyle):
(WebCore::CSSToLengthConversionData::computingFontSize):
(WebCore::CSSToLengthConversionData::copyWithAdjustedZoom):
* css/CSSToStyleMap.cpp:
(WebCore::CSSToStyleMap::style):
(WebCore::CSSToStyleMap::rootElementStyle):
* css/CSSToStyleMap.h:
* css/MediaQueryEvaluator.cpp:
(WebCore::MediaQueryEvaluator::MediaQueryEvaluator):
* css/MediaQueryEvaluator.h:
* css/SVGCSSComputedStyleDeclaration.cpp:
(WebCore::strokeDashArrayToCSSValueList):
(WebCore::ComputedStyleExtractor::adjustSVGPaintForCurrentColor):
(WebCore::ComputedStyleExtractor::svgPropertyValue):
* css/SourceSizeList.cpp:
(WebCore::match):
(WebCore::defaultLength):
(WebCore::computeLength):
(WebCore::parseSizesAttribute):
* css/StyleBuilderCustom.h:
(WebCore::ApplyPropertyBorderImageModifier::applyValue):
(WebCore::ApplyPropertyBorderImageModifier::getValue):
(WebCore::StyleBuilderCustom::applyInheritClip):
(WebCore::StyleBuilderCustom::applyInheritCounter):
(WebCore::StyleBuilderCustom::applyValueContent):
(WebCore::StyleBuilderCustom::applyValueAlt):
* css/StyleResolver.cpp:
(WebCore::StyleResolver::sweepMatchedPropertiesCache):
(WebCore::StyleResolver::State::State):
(WebCore::isAtShadowBoundary):
(WebCore::StyleResolver::styleForElement):
(WebCore::StyleResolver::keyframeStylesForAnimation):
(WebCore::StyleResolver::pseudoStyleForElement):
(WebCore::StyleResolver::applyProperty):
(WebCore::StyleResolver::checkForTextSizeAdjust):
(WebCore::StyleResolver::checkForZoomChange):
(WebCore::StyleResolver::checkForGenericFamilyChange):
* css/StyleResolver.h:
(WebCore::StyleResolver::style):
(WebCore::StyleResolver::parentStyle):
(WebCore::StyleResolver::rootElementStyle):
(WebCore::StyleResolver::element):
(WebCore::StyleResolver::document):
(WebCore::StyleResolver::documentSettings):
(WebCore::StyleResolver::State::State):
(WebCore::StyleResolver::State::takeStyle):
(WebCore::StyleResolver::State::parentStyle):
(WebCore::StyleResolver::State::rootElementStyle):
(WebCore::StyleResolver::State::regionForStyling):
(WebCore::StyleResolver::State::elementLinkState):
* dom/Document.cpp:
(WebCore::Document::updateLayoutIgnorePendingStylesheets):
(WebCore::Document::styleForElementIgnoringPendingStylesheets):
(WebCore::Document::setVisuallyOrdered):
(WebCore::Document::createParser):
* dom/Document.h:
* dom/Element.cpp:
(WebCore::Element::styleResolver):
(WebCore::Element::resolveStyle):
(WebCore::checkForEmptyStyleChange):
(WebCore::checkForSiblingStyleChanges):
(WebCore::beforeOrAfterPseudoElement):
(WebCore::Element::existingComputedStyle):
(WebCore::Element::resolveComputedStyle):
(WebCore::Element::computedStyle):
(WebCore::Element::didDetachRenderers):
(WebCore::Element::resolveCustomStyle):
* dom/Element.h:
* dom/Node.cpp:
(WebCore::computeEditabilityFromComputedStyle):
(WebCore::Node::pseudoAwareLastChild):
(WebCore::Node::computedStyle):
* dom/Node.h:
* dom/NodeRenderStyle.h:
(WebCore::Node::renderStyle):
* dom/PseudoElement.cpp:
(WebCore::PseudoElement::clearHostElement):
(WebCore::PseudoElement::resolveCustomStyle):
* dom/PseudoElement.h:
* editing/ApplyBlockElementCommand.cpp:
(WebCore::isNewLineAtPosition):
(WebCore::ApplyBlockElementCommand::renderStyleOfEnclosingTextNode):
(WebCore::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded):
(WebCore::ApplyBlockElementCommand::endOfNextParagraphSplittingTextNodesIfNeeded):
* editing/ApplyBlockElementCommand.h:
* editing/EditingStyle.cpp:
(WebCore::EditingStyle::init):
(WebCore::EditingStyle::removeTextFillAndStrokeColorsIfNeeded):
* editing/EditingStyle.h:
* editing/Editor.h:
* editing/SimplifyMarkupCommand.cpp:
(WebCore::SimplifyMarkupCommand::doApply):
* editing/cocoa/EditorCocoa.mm:
(WebCore::Editor::styleForSelectionStart):
(WebCore::Editor::getTextDecorationAttributesRespectingTypingStyle):
* editing/ios/EditorIOS.mm:
(WebCore::Editor::fontForSelection):
(WebCore::Editor::fontAttributesForSelectionStart):
* editing/mac/EditorMac.mm:
(WebCore::Editor::fontForSelection):
(WebCore::Editor::fontAttributesForSelectionStart):
* html/HTMLTitleElement.cpp:
(WebCore::HTMLTitleElement::computedTextWithDirection):
* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::CanvasRenderingContext2D::FontProxy::fontsNeedUpdate):
(WebCore::CanvasRenderingContext2D::FontProxy::initialize):
(WebCore::CanvasRenderingContext2D::setFont):
(WebCore::CanvasRenderingContext2D::setTextBaseline):
(WebCore::CanvasRenderingContext2D::toTextDirection):
(WebCore::CanvasRenderingContext2D::drawTextInternal):
* html/canvas/CanvasRenderingContext2D.h:
* html/parser/HTMLResourcePreloader.cpp:
(WebCore::HTMLResourcePreloader::preload):
(WebCore::mediaAttributeMatches):
* html/shadow/SliderThumbElement.cpp:
(WebCore::RenderSliderThumb::RenderSliderThumb):
(WebCore::RenderSliderThumb::updateAppearance):
(WebCore::RenderSliderContainer::layout):
(WebCore::SliderThumbElement::hostInput):
(WebCore::SliderThumbElement::resolveCustomStyle):
(WebCore::SliderContainerElement::createElementRenderer):
(WebCore::SliderContainerElement::resolveCustomStyle):
* html/shadow/SliderThumbElement.h:
* html/shadow/TextControlInnerElements.cpp:
(WebCore::TextControlInnerElement::create):
(WebCore::TextControlInnerElement::resolveCustomStyle):
(WebCore::TextControlInnerTextElement::renderer):
(WebCore::TextControlInnerTextElement::resolveCustomStyle):
(WebCore::TextControlPlaceholderElement::TextControlPlaceholderElement):
(WebCore::TextControlPlaceholderElement::resolveCustomStyle):
* html/shadow/TextControlInnerElements.h:
* page/EventHandler.cpp:
(WebCore::EventHandler::selectCursor):
* page/animation/AnimationBase.cpp:
(WebCore::solveStepsFunction):
(WebCore::AnimationBase::AnimationBase):
* page/animation/AnimationBase.h:
(WebCore::AnimationBase::~AnimationBase):
(WebCore::AnimationBase::renderer):
(WebCore::AnimationBase::animation):
(WebCore::AnimationBase::setAnimation):
* page/animation/AnimationController.cpp:
(WebCore::AnimationController::cancelAnimations):
(WebCore::AnimationController::updateAnimations):
* page/animation/AnimationController.h:
* page/animation/CompositeAnimation.cpp:
(WebCore::CompositeAnimation::clearRenderer):
(WebCore::CompositeAnimation::updateTransitions):
(WebCore::CompositeAnimation::updateKeyframeAnimations):
(WebCore::CompositeAnimation::animate):
* page/animation/CompositeAnimation.h:
* page/animation/ImplicitAnimation.cpp:
(WebCore::ImplicitAnimation::ImplicitAnimation):
(WebCore::ImplicitAnimation::shouldSendEventForListener):
(WebCore::ImplicitAnimation::animate):
(WebCore::ImplicitAnimation::sendTransitionEvent):
(WebCore::ImplicitAnimation::reset):
* page/animation/ImplicitAnimation.h:
(WebCore::ImplicitAnimation::create):
* page/animation/KeyframeAnimation.cpp:
(WebCore::KeyframeAnimation::KeyframeAnimation):
(WebCore::KeyframeAnimation::fetchIntervalEndpointsForProperty):
(WebCore::KeyframeAnimation::animate):
* page/animation/KeyframeAnimation.h:
* page/ios/FrameIOS.mm:
(WebCore::ancestorRespondingToScrollWheelEvents):
* rendering/FlowThreadController.cpp:
(WebCore::FlowThreadController::styleDidChange):
* rendering/InlineFlowBox.cpp:
(WebCore::clipRectForNinePieceImageStrip):
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::styleDidChange):
(WebCore::RenderBlock::lineHeight):
(WebCore::RenderBlock::firstLineBlock):
(WebCore::styleForFirstLetter):
(WebCore::RenderBlock::updateFirstLetterStyle):
(WebCore::RenderBlock::createFirstLetterRenderer):
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::adjustBlockChildForPagination):
(WebCore::calculateMinimumPageHeight):
(WebCore::RenderBlockFlow::adjustComputedFontSizes):
* rendering/RenderBox.cpp:
(WebCore::RenderBox::styleDidChange):
(WebCore::RenderBox::borderRadii):
(WebCore::RenderBox::enclosingFloatPaintingLayer):
(WebCore::RenderBox::logicalVisualOverflowRectForPropagation):
(WebCore::RenderBox::visualOverflowRectForPropagation):
(WebCore::RenderBox::logicalLayoutOverflowRectForPropagation):
(WebCore::RenderBox::layoutOverflowRectForPropagation):
* rendering/RenderBox.h:
(WebCore::RenderBox::applyTopLeftLocationOffset):
(WebCore::RenderBox::hasRenderOverflow):
(WebCore::RenderBox::hasVisualOverflow):
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::backgroundRoundedRectAdjustedForBleedAvoidance):
(WebCore::applyBoxShadowForBackground):
* rendering/RenderButton.cpp:
(WebCore::RenderButton::addChild):
(WebCore::RenderButton::styleWillChange):
(WebCore::RenderButton::styleDidChange):
(WebCore::RenderButton::setupInnerStyle):
(WebCore::RenderButton::layout):
* rendering/RenderDeprecatedFlexibleBox.cpp:
(WebCore::RenderDeprecatedFlexibleBox::styleWillChange):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::createFor):
(WebCore::RenderElement::uncachedFirstLineStyle):
(WebCore::RenderElement::cachedFirstLineStyle):
(WebCore::RenderElement::firstLineStyle):
(WebCore::RenderElement::styleWillChange):
(WebCore::RenderElement::addControlStatesForRenderer):
(WebCore::RenderElement::getCachedPseudoStyle):
(WebCore::RenderElement::getMutableCachedPseudoStyle):
(WebCore::RenderElement::getUncachedPseudoStyle):
(WebCore::RenderElement::paintOutline):
* rendering/RenderElement.h:
(WebCore::RenderElement::hasInitializedStyle):
(WebCore::RenderElement::style):
(WebCore::RenderElement::mutableStyle):
(WebCore::RenderElement::element):
(WebCore::RenderObject::isRenderInline):
(WebCore::RenderObject::style):
(WebCore::RenderObject::firstLineStyle):
* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::layout):
* rendering/RenderFlowThread.cpp:
(WebCore::RenderFlowThread::RenderFlowThread):
(WebCore::RenderFlowThread::createFlowThreadStyle):
* rendering/RenderFlowThread.h:
* rendering/RenderImage.cpp:
(WebCore::RenderImage::layoutShadowControls):
* rendering/RenderInline.cpp:
(WebCore::RenderInline::styleDidChange):
(WebCore::RenderInline::updateAlwaysCreateLineBoxes):
(WebCore::RenderInline::paintOutline):
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::setupClipPath):
* rendering/RenderListBox.cpp:
(WebCore::RenderListBox::paintScrollbar):
(WebCore::itemOffsetForAlignment):
(WebCore::RenderListBox::paintItemForeground):
(WebCore::RenderListBox::paintItemBackground):
* rendering/RenderListMarker.cpp:
(WebCore::RenderListMarker::updateMargins):
(WebCore::RenderListMarker::lineHeight):
* rendering/RenderMarquee.cpp:
(WebCore::RenderMarquee::computePosition):
(WebCore::RenderMarquee::updateMarqueeStyle):
* rendering/RenderMenuList.cpp:
(WebCore::RenderMenuList::adjustInnerStyle):
(RenderMenuList::updateOptionsWidth):
(RenderMenuList::itemStyle):
* rendering/RenderMultiColumnFlowThread.cpp:
(WebCore::isValidColumnSpanner):
* rendering/RenderMultiColumnSpannerPlaceholder.cpp:
(WebCore::RenderMultiColumnSpannerPlaceholder::createAnonymous):
* rendering/RenderMultiColumnSpannerPlaceholder.h:
* rendering/RenderNamedFlowFragment.cpp:
(WebCore::RenderNamedFlowFragment::checkRegionStyle):
(WebCore::RenderNamedFlowFragment::computeStyleInRegion):
* rendering/RenderNamedFlowFragment.h:
* rendering/RenderObject.cpp:
(WebCore::RenderObject::innerLineHeight):
(WebCore::decorationColor):
(WebCore::RenderObject::getTextDecorationColorsAndStyles):
* rendering/RenderObject.h:
(WebCore::RenderObject::minPreferredLogicalWidth):
(WebCore::RenderObject::maxPreferredLogicalWidth):
* rendering/RenderTable.cpp:
(WebCore::RenderTable::computePreferredLogicalWidths):
* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::paintRowGroupBorderIfRequired):
(WebCore::physicalBorderForDirection):
* rendering/RenderText.h:
(WebCore::RenderText::characterAt):
(WebCore::RenderText::style):
(WebCore::RenderText::firstLineStyle):
(WebCore::RenderText::getCachedPseudoStyle):
* rendering/RenderTextControl.cpp:
(WebCore::RenderTextControl::styleDidChange):
* rendering/RenderTextControlMultiLine.cpp:
(WebCore::RenderTextControlMultiLine::layoutSpecialExcludedChild):
* rendering/RenderTextControlSingleLine.cpp:
(WebCore::RenderTextControlSingleLine::layout):
(WebCore::RenderTextControlSingleLine::styleDidChange):
* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::styleDidChange):
* rendering/RenderThemeGtk.cpp:
(WebCore::RenderThemeGtk::paintMediaToggleClosedCaptionsButton):
(WebCore::borderRadiiFromStyle):
(WebCore::RenderThemeGtk::paintMediaSliderTrack):
(WebCore::RenderThemeGtk::paintMediaSliderThumb):
(WebCore::RenderThemeGtk::paintMediaVolumeSliderTrack):
* rendering/SimpleLineLayoutFunctions.cpp:
(WebCore::SimpleLineLayout::paintFlow):
(WebCore::SimpleLineLayout::hitTestFlow):
* rendering/TextAutoSizing.cpp:
(WebCore::TextAutoSizingKey::TextAutoSizingKey):
* rendering/TextAutoSizing.h:
(WebCore::TextAutoSizingKey::style):
(WebCore::TextAutoSizingKey::isDeleted):
* rendering/TextPaintStyle.cpp:
(WebCore::computeTextSelectionPaintStyle):
* rendering/line/BreakingContext.h:
* rendering/mathml/RenderMathMLRoot.cpp:
(WebCore::RenderMathMLRoot::layout):
* rendering/style/RenderStyle.h:
(WebCore::RenderStyle::setColumnRuleWidth):
(WebCore::RenderStyle::resetColumnRule):
(WebCore::RenderStyle::setColumnSpan):
(WebCore::RenderStyle::inheritColumnPropertiesFrom):
(WebCore::RenderStyle::setTransform):
(WebCore::RenderStyle::setTransformOriginX):
(WebCore::RenderStyle::setTransformOriginY):
* rendering/svg/SVGInlineTextBox.cpp:
(WebCore::SVGInlineTextBox::positionForOffset):
(WebCore::SVGInlineTextBox::selectionRectForTextFragment):
(WebCore::SVGInlineTextBox::localSelectionRect):
(WebCore::SVGInlineTextBox::paintSelectionBackground):
(WebCore::SVGInlineTextBox::paint):
(WebCore::SVGInlineTextBox::acquirePaintingResource):
(WebCore::SVGInlineTextBox::releasePaintingResource):
(WebCore::SVGInlineTextBox::prepareGraphicsContextForTextPainting):
(WebCore::SVGInlineTextBox::restoreGraphicsContextAfterTextPainting):
(WebCore::SVGInlineTextBox::constructTextRun):
(WebCore::SVGInlineTextBox::paintDecorationWithStyle):
(WebCore::SVGInlineTextBox::paintTextWithShadows):
(WebCore::SVGInlineTextBox::paintText):
* rendering/svg/SVGInlineTextBox.h:
* rendering/svg/SVGPathData.cpp:
(WebCore::updatePathFromCircleElement):
(WebCore::updatePathFromEllipseElement):
(WebCore::updatePathFromRectElement):
* rendering/svg/SVGRenderingContext.cpp:
(WebCore::SVGRenderingContext::prepareToRenderSVGContent):
* style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::Parent::Parent):
(WebCore::Style::TreeResolver::popScope):
(WebCore::Style::TreeResolver::styleForElement):
(WebCore::Style::TreeResolver::pushParent):
(WebCore::Style::TreeResolver::resolveComposedTree):
* style/StyleTreeResolver.h:
(WebCore::Style::TreeResolver::scope):
* style/StyleUpdate.cpp:
(WebCore::Style::Update::textUpdate):
(WebCore::Style::Update::elementStyle):
(WebCore::Style::Update::addElement):
* style/StyleUpdate.h:
(WebCore::Style::Update::document):
* svg/SVGElement.cpp:
(WebCore::SVGElement::synchronizeSystemLanguage):
(WebCore::SVGElement::resolveCustomStyle):
(WebCore::SVGElement::setUseOverrideComputedStyle):
(WebCore::SVGElement::computedStyle):
* svg/SVGElement.h:
* svg/SVGElementRareData.h:
(WebCore::SVGElementRareData::ensureAnimatedSMILStyleProperties):
(WebCore::SVGElementRareData::overrideComputedStyle):
* svg/SVGGraphicsElement.cpp:
(WebCore::SVGGraphicsElement::animatedLocalTransform):
* svg/SVGLengthContext.cpp:
(WebCore::SVGLengthContext::convertValueFromPercentageToUserUnits):
(WebCore::renderStyleForLengthResolving):
(WebCore::SVGLengthContext::convertValueFromUserUnitsToEMS):
(WebCore::SVGLengthContext::convertValueFromEMSToUserUnits):
(WebCore::SVGLengthContext::convertValueFromUserUnitsToEXS):
(WebCore::SVGLengthContext::convertValueFromEXSToUserUnits):
* svg/SVGStopElement.cpp:
(WebCore::SVGStopElement::stopColorIncludingOpacity):
* svg/SVGTextElement.cpp:
(WebCore::SVGTextElement::animatedLocalTransform):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200098 268f45cc-cd09-0410-ab3c-d52691b4dbfc

2016-04-26  Oliver Hunt  <oliver@apple.com>

        Enable separated heap by default on ios
        https://bugs.webkit.org/show_bug.cgi?id=156720

        Unreviewed roll-in of this change. There is only one
        additional allocation involved in this logic, and that
        is a duplicate mapping.

        Either our tools are not report real memory usage
        or this revision is not responsible for the regression.

        * runtime/Options.cpp:
        (JSC::recomputeDependentOptions):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200097 268f45cc-cd09-0410-ab3c-d52691b4dbfc

DFG backends shouldn't emit type checks at KnownBlah edges
https://bugs.webkit.org/show_bug.cgi?id=157025

Reviewed by Michael Saboff.

This fixes a crash I found when browsing Bing maps with forceEagerCompilation. I include a
100% repro test case.

The issue is that our code still doesn't fully appreciate the devious implications of
KnownBlah use kinds. Consider KnownCell for example. It means: "trust me, I know that this
value will be a cell". You aren't required to provide a proof when you use KnownCell. Often,
we use it as a result of a path-sensitive proof. The abstract interpreter is not
path-sensitive, so AI will be absolutely sure that the KnownCell use might see a non-cell.
This can lead to debug assertions (which this change removes) and it can lead to the backends
emitting a type check. That type check can be pure evil if the node that has this edge does
not have an exit origin. Such a node would have passed validation because the validater would
have thought that the node cannot exit (after all, according to the IR semantics, there is no
speculation at KnownCell).

This comprehensively fixes the issue by recognizing that Foo(KnownCell:@x) means: I have
already proved that by the time you start executing Foo, @x will already be a cell. I cannot
tell you how I proved this but you can rely on it anyway. AI now takes advantage of this
meaning and will always do filtering of KnownBlah edges regardless of whether the backend
actually emits any type checks for those edges. Since the filtering runs before the backend,
the backend will not emit any checks because it will know that the edge was already checked
(by whatever mechanism we used when we made the edge KnownBlah).

Note that it's good that we found this bug now. The DFG currently does very few
sparse-conditional or path-sensitive optimizations, but it will probably do more in the
future. The bug happens because GetByOffset and friends can achieve path-sensitive proofs via
watchpoints on the inferred type. Normally, AI can follow along with this proof. But in the
example program, and on Bing maps, we would GCSE one GetByOffset with another that had a
weaker proven type. That turned out to be completely sound - between the two GetByOffset's
there was a Branch to null check it. The inferred type of the second GetByOffset ended up
knowing that it cannot be null because null only occurred in some structures but not others.
If we added more sparse-conditional stuff to Branch, then AI would know how to follow along
with the proof but it would also create more situations where we'd have a path-sensitive
proof. So, it's good that we're now getting this right.

* dfg/DFGAbstractInterpreter.h:
(JSC::DFG::AbstractInterpreter::filterEdgeByUse):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEdges):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeKnownEdgeTypes):
(JSC::DFG::AbstractInterpreter<AbstractStateType>::verifyEdge):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCurrentBlock):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
* tests/stress/path-sensitive-known-cell-crash.js: Added.
(bar):
(foo):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200096 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Enable separated heap by default on ios
https://bugs.webkit.org/show_bug.cgi?id=156720

Unreviewed rollout - caused memory regression.

* runtime/Options.cpp:
(JSC::recomputeDependentOptions):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200095 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Make FontPlatformData immutable
https://bugs.webkit.org/show_bug.cgi?id=157024

Reviewed by Darin Adler.

This patch deletes all functions which modify a FontPlatformData once
it has been created. This makes for a cleaner design.

No new tests because there is no behavior change.

* platform/graphics/Font.cpp:
(WebCore::Font::verticalRightOrientationFont):
(WebCore::Font::nonSyntheticItalicFont):
* platform/graphics/FontPlatformData.cpp:
(WebCore::FontPlatformData::FontPlatformData):
(WebCore::FontPlatformData::cloneWithOrientation):
(WebCore::FontPlatformData::cloneWithSyntheticOblique):
* platform/graphics/FontPlatformData.h:
(WebCore::FontPlatformData::setIsSystemFont): Deleted.
(WebCore::FontPlatformData::setSize): Deleted.
(WebCore::FontPlatformData::setOrientation): Deleted.
(WebCore::FontPlatformData::setSyntheticOblique): Deleted.
* platform/graphics/cocoa/FontCacheCoreText.cpp:
(WebCore::FontCache::systemFallbackForCharacters):
* platform/graphics/cocoa/FontCascadeCocoa.mm:
(WebCore::FontCascade::drawGlyphs):
* platform/graphics/cocoa/FontCocoa.mm:
(WebCore::Font::platformInit):
(WebCore::Font::platformCharWidthInit):
(WebCore::createDerivativeFont):
(WebCore::Font::createFontWithoutSynthesizableFeatures):
(WebCore::Font::platformCreateScaledFont):
(WebCore::Font::platformWidthForGlyph):
* platform/graphics/cocoa/FontPlatformDataCocoa.mm:
(WebCore::FontPlatformData::openTypeTable):
* platform/graphics/win/FontPlatformDataCairoWin.cpp:
(WebCore::FontPlatformData::platformDataInit):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200094 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r200089.

This change causes API test failures

Reverted changeset:

"WebCore on Mac ignores the user's preferred region (country)
while getting the language"
https://bugs.webkit.org/show_bug.cgi?id=156993
http://trac.webkit.org/changeset/200089

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200093 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Improve jsc --help and making sampling options
https://bugs.webkit.org/show_bug.cgi?id=157015

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2016-04-26
Reviewed by Saam Barati.

Simplify sampling options to be easier to remember:

  * --reportSamplingProfilerData => --sample
  * --samplingProfilerTimingInterval => --sampleInterval

Update the --help to mention --sample, and restore the behavior of
--options outputing all possible options so you can discover which
options are available.

* jsc.cpp:
(printUsageStatement):
(CommandLine::parseArguments):
Improve help and modify option dumping.

* runtime/Options.h:
* runtime/SamplingProfiler.cpp:
(JSC::SamplingProfiler::SamplingProfiler):
Rename the sampling interval option.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200092 268f45cc-cd09-0410-ab3c-d52691b4dbfc

GuardMalloc crash in WebCore::HTMLFrameElementBase::marginHeight()
https://bugs.webkit.org/show_bug.cgi?id=157020
<rdar://problem/25148315>

Reviewed by Darin Adler.

Calls to setIntegralAttribute triggers event handling code, which can cause
the underlying m_frameOwnerElement member to be deleted. We could clone this
object, but since we only want the width and height we should just read them
while we know the object is in a good state, then execute the potentially
mutating methods.

Tested by imported/blink/fast/dom/HTMLBodyElement/body-inserting-iframe-crash.html.

* html/HTMLBodyElement.cpp:
(WebCore::HTMLBodyElement::insertedInto): Read margin width and height before
calling setIntegralAttribute.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200091 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Chart status should always be computed against prior values
https://bugs.webkit.org/show_bug.cgi?id=157014

Reviewed by Darin Adler.

Compare the current value against the last baseline or target value that appear before the current value in time
so that the comparison stay the same even when new baseline and target values are reported. Also include the compared
baseline or target value in the label for clarity.

* public/v3/components/chart-status-view.js:
(ChartStatusView.prototype._computeChartStatus):
(ChartStatusView.prototype._computeChartStatus.labelForDiff):
(ChartStatusView.prototype._findLastPointPriorToTime): Extracted from _relativeDifferenceToLaterPointInTimeSeries.
Now finds the last point before the current point's time if there is any, or the last point in baseline / target.
(ChartStatusView.prototype._relativeDifferenceToLaterPointInTimeSeries): Deleted.
* public/v3/models/metric.js:
(Metric.prototype.makeFormatter): Don't use SI units for unit-less metrics.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200090 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebCore on Mac ignores the user's preferred region (country) while getting the language
https://bugs.webkit.org/show_bug.cgi?id=156993

Reviewed by Geoffrey Garen.

I don't know how to test this since this depends on user settings.

WebCore was previously getting the list of preferred languages, and for each one, deducing
the default region. That's wrong, since for example it doesn't respect the user's choice (in
System Preferences) to display dates/calenders/etc according to a different region (like how
I have my machine set to en-pl right now).

It might be possible for the country code we get via kCFLocaleCountryCode to be something
that our ICU doesn't handle. To defend against this, we search for the resulting country
code in ICU's ISO countries list. If it doesn't appear in that list, we fall back on old
behavior.

* platform/mac/Language.mm:
(WebCore::httpStyleLanguageCode):
(WebCore::platformUserPreferredLanguages):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200089 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Web IDL] Specify default values for optional parameters of TypedArray types
https://bugs.webkit.org/show_bug.cgi?id=157017

Reviewed by Darin Adler.

Specify default values for optional parameters of TypedArray types and let
the bindings generator use WTF::Optional<> for the ones that do not have a
default value.

* bindings/scripts/CodeGeneratorJS.pm:
(CanUseWTFOptionalForParameter): Deleted.
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::webkitGenerateKeyRequest):
(WebCore::HTMLMediaElement::webkitAddKey):
(WebCore::HTMLMediaElement::webkitCancelKeyRequest): Deleted.
* html/HTMLMediaElement.h:
* html/HTMLMediaElement.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200088 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Web IDL] Specify default values for optional parameters of type 'long' / 'unrestricted double'
https://bugs.webkit.org/show_bug.cgi?id=157012

Reviewed by Darin Adler.

Specify default values for optional parameters of type 'long' / 'unrestricted double'
and let the bindings generator use WTF::Optional<> for the ones that do not have a
default value.

* Modules/mediastream/RTCDTMFSender.cpp:
(WebCore::RTCDTMFSender::insertDTMF):
(WebCore::RTCDTMFSender::didPlayTone): Deleted.
* Modules/mediastream/RTCDTMFSender.h:
* Modules/webaudio/AudioBufferSourceNode.cpp:
(WebCore::AudioBufferSourceNode::start):
(WebCore::AudioBufferSourceNode::startPlaying): Deleted.
* Modules/webaudio/AudioBufferSourceNode.h:
* Modules/webaudio/AudioBufferSourceNode.idl:
* Modules/webaudio/AudioContext.cpp:
(WebCore::AudioContext::createDelay): Deleted.
* Modules/webaudio/AudioContext.h:
* Modules/webaudio/AudioContext.idl:
* Modules/webaudio/AudioScheduledSourceNode.cpp:
(WebCore::AudioScheduledSourceNode::start): Deleted.
(WebCore::AudioScheduledSourceNode::stop): Deleted.
* Modules/webaudio/AudioScheduledSourceNode.h:
* Modules/webaudio/OscillatorNode.idl:
* bindings/scripts/CodeGeneratorJS.pm:
(CanUseWTFOptionalForParameter): Deleted.
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndOptionalArg):
(WebCore::jsTestObjPrototypeFunctionMethodWithNonOptionalArgAndTwoOptionalArgs):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod2):
(WebCore::jsTestObjPrototypeFunctionOverloadedMethodWithOptionalParameter2):
(WebCore::jsTestObjConstructorFunctionClassMethodWithOptional):
(WebCore::jsTestObjPrototypeFunctionTestPromiseFunctionWithOptionalIntArgumentPromise):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalArgAndDefaultValue): Deleted.
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalString): Deleted.
(WebCore::jsTestObjPrototypeFunctionOverloadedMethod4): Deleted.
(WebCore::jsTestObjConstructorFunctionClassMethod2): Deleted.
(WebCore::jsTestObjConstructorFunctionOverloadedMethod1): Deleted.
(WebCore::jsTestObjPrototypeFunctionTestPromiseOverloadedFunction2Promise): Deleted.
* html/HTMLInputElement.idl:
* page/WindowTimers.idl:
* testing/Internals.h:
* testing/Internals.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200087 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Clarify Heap Snapshot instance Retained Size by hiding retained size of non-dominated children
https://bugs.webkit.org/show_bug.cgi?id=157018

Patch by Joseph Pecoraro <pecoraro@apple.com> on 2016-04-26
Reviewed by Timothy Hatcher.

* UserInterface/Proxies/HeapSnapshotNodeProxy.js:
(WebInspector.HeapSnapshotNodeProxy):
(WebInspector.HeapSnapshotNodeProxy.deserialize):
* UserInterface/Workers/HeapSnapshot/HeapSnapshot.js:
(HeapSnapshot.prototype.serializeNode):
Include dominatorNodeIdentifier in the default proxy properties.

* UserInterface/Views/HeapSnapshotInstanceDataGridNode.js:
(WebInspector.HeapSnapshotInstanceDataGridNode):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.get node):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype.createCellContent):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._isDominatedByBase):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._isDominatedByNonBaseParent):
(WebInspector.HeapSnapshotInstanceDataGridNode.prototype._populate):
* UserInterface/Views/HeapSnapshotInstancesContentView.css:
(.heap-snapshot > .data-grid td .sub-retained):
Save the base HeapSnapshotInstanceDataGridNode so that it can be referenced by
children. When expanding an instance, hide the retained size for children
that are not dominated by the base object. Show the retained size for children
for children that are dominated. If dominated directly, show the size in the
normal black. If dominated transitively, show the size in a dimmed gray.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200086 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[WinCairo][WebGL] Enable ESSL and GLSL translators.
https://bugs.webkit.org/show_bug.cgi?id=157002

Reviewed by Darin Adler.

Enable support for ESSL and GLSL translators, and add missing files.

* CMakeLists.txt:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200085 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Unreviewed, rolling out r200083.
https://bugs.webkit.org/show_bug.cgi?id=157033

 It brokes the debug build (Requested by gskachkov on
#webkit).

Reverted changeset:

"calling super() a second time in a constructor should throw"
https://bugs.webkit.org/show_bug.cgi?id=151113
http://trac.webkit.org/changeset/200083

Patch by Commit Queue <commit-queue@webkit.org> on 2016-04-26

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200084 268f45cc-cd09-0410-ab3c-d52691b4dbfc

calling super() a second time in a constructor should throw
https://bugs.webkit.org/show_bug.cgi?id=151113

Reviewed by Saam Barati and Keith Miller.

Source/JavaScriptCore:

Currently, our implementation checks if 'super()' was called in a constructor more
than once and raises a RuntimeError before the second call. According to the spec
we need to raise an error just after the second super() is finished and before
the new 'this' is assigned https://esdiscuss.org/topic/duplicate-super-call-behaviour.
To implement this behavior this patch adds a new op code, op_is_empty, that is used
to check if 'this' is empty.

* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitIsEmpty):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::FunctionCallValueNode::emitBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNodeType.h:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileIsEmpty):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JIT.h:
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_is_empty):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_is_empty):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* tests/stress/class-syntax-double-constructor.js: Added.

LayoutTests:

* js/class-syntax-super-expected.txt:
* js/script-tests/class-syntax-super.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200083 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove hard-wraps from the feature policy markdown so it renders full width on the site.

* feature-policy.md:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200082 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Drop [UsePointersEvenForNonNullableObjectArguments] from SpeechSynthesis
https://bugs.webkit.org/show_bug.cgi?id=156901

Reviewed by Darin Adler.

Source/WebCore:

SpeechSynthesis.speak will now throw in case of bad parameters instead of silently failing.
Started refactoring to use more references where possible.

Covered by updated test.

* Modules/speech/SpeechSynthesis.cpp:
(WebCore::SpeechSynthesis::startSpeakingImmediately): Refactored to get a reference.
(WebCore::SpeechSynthesis::speak):
(WebCore::SpeechSynthesis::fireEvent):
(WebCore::SpeechSynthesis::handleSpeakingCompleted): Removing first item in utteranceQueue unconditionally,
since that would crash in Debug mode otherwise.
(WebCore::SpeechSynthesis::boundaryEventOccurred):
(WebCore::SpeechSynthesis::didStartSpeaking):
(WebCore::SpeechSynthesis::didPauseSpeaking):
(WebCore::SpeechSynthesis::didResumeSpeaking):
(WebCore::SpeechSynthesis::didFinishSpeaking):
(WebCore::SpeechSynthesis::speakingErrorOccurred):
* Modules/speech/SpeechSynthesis.h:
* Modules/speech/SpeechSynthesis.idl:

LayoutTests:

Updated test to handle speak throwing behavior in case of bad parameters.

* fast/speechsynthesis/speech-synthesis-crash-on-bad-utterance-expected.txt:
* fast/speechsynthesis/speech-synthesis-crash-on-bad-utterance.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200080 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Drop [UsePointersEvenForNonNullableObjectArguments] from WebKitNamedFlow
https://bugs.webkit.org/show_bug.cgi?id=156979

Reviewed by Chris Dumez.

No change of behavior.

* dom/WebKitNamedFlow.idl: Marking contentNode parameter as nullable.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200079 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Drop [UsePointersEvenForNonNullableObjectArguments] from EventTarget
https://bugs.webkit.org/show_bug.cgi?id=156977

Reviewed by Chris Dumez.

Source/WebCore:

No change of behavior.

* dom/EventTarget.idl:

LayoutTests:

* fast/events/dispatchEvent-crash-expected.txt:
* fast/events/dispatchEvent-crash.html: Ensuring exceptions are logged.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200078 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[EFL] Update expectation result in ewk_context_preferred_languages API test
https://bugs.webkit.org/show_bug.cgi?id=157027

Reviewed by Carlos Garcia Campos.

platformLanguage() has been returning lower case value since r199815. Thus existing expected result
needs to be updated together.

* UIProcess/API/efl/tests/test_ewk2_context.cpp: Change en-US with en-us.
(TEST_F):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200077 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Mark two methods in the CoordinatedGraphicsScene and the
ThreadedCoordinatedLayerTreeHost classes as overrides, fixing
the compiler warnings.

Rubber-stamped by Carlos Garcia Campos.

* Shared/CoordinatedGraphics/CoordinatedGraphicsScene.h:
* WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200076 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Remove the build flag for template elements
https://bugs.webkit.org/show_bug.cgi?id=157022

Reviewed by Daniel Bates.

.:

* Source/cmake/OptionsEfl.cmake:
* Source/cmake/OptionsMac.cmake:
* Source/cmake/OptionsWin.cmake:
* Source/cmake/WebKitFeatures.cmake:
* Source/cmake/tools/vsprops/FeatureDefines.props:
* Source/cmake/tools/vsprops/FeatureDefinesCairo.props:

Source/JavaScriptCore:

* Configurations/FeatureDefines.xcconfig:

Source/WebCore:

Removed the build flag.

* Configurations/FeatureDefines.xcconfig:
* DerivedSources.cpp:
* bindings/js/JSHTMLTemplateElementCustom.cpp:
(WebCore::JSHTMLTemplateElement::content):
* css/html.css:
(summary::-webkit-details-marker):
(template):
(bdi, output):
* dom/ContainerNode.cpp:
(WebCore::isInTemplateContent):
(WebCore::containsConsideringHostElements):
(WebCore::ContainerNode::parserInsertBefore):
(WebCore::ContainerNode::parserAppendChild):
* dom/Document.cpp:
(WebCore::Document::Document):
(WebCore::Document::~Document):
(WebCore::Document::getCachedLocale):
(WebCore::Document::ensureTemplateDocument):
(WebCore::Document::fonts):
* dom/Document.h:
(WebCore::Document::setTemplateDocumentHost):
(WebCore::Document::templateDocumentHost):
(WebCore::Document::hasDisabledFieldsetElement):
(WebCore::Document::textEncoding):
(WebCore::Document::templateDocument):
* dom/Element.cpp:
(WebCore::Element::setInnerHTML):
* dom/Node.cpp:
(WebCore::Node::containsIncludingHostElements):
(WebCore::Node::pseudoAwarePreviousSibling):
* dom/TemplateContentDocumentFragment.h:
* editing/MarkupAccumulator.cpp:
(WebCore::MarkupAccumulator::serializeNodesWithNamespaces):
* editing/markup.cpp:
(WebCore::createFragmentForInnerOuterHTML):
* html/HTMLTagNames.in:
* html/HTMLTemplateElement.cpp:
(WebCore::HTMLTemplateElement::didMoveToNewDocument):
* html/HTMLTemplateElement.h:
* html/HTMLTemplateElement.idl:
* html/parser/HTMLConstructionSite.cpp:
(WebCore::insert):
(WebCore::HTMLConstructionSite::insertTextNode):
(WebCore::HTMLConstructionSite::ownerDocumentForCurrentNode):
(WebCore::HTMLConstructionSite::findFosterSite):
* html/parser/HTMLElementStack.cpp:
(WebCore::HTMLNames::isScopeMarker):
(WebCore::HTMLNames::isTableScopeMarker):
(WebCore::HTMLNames::isTableBodyScopeMarker):
(WebCore::HTMLNames::isTableRowScopeMarker):
(WebCore::HTMLElementStack::inSelectScope):
(WebCore::HTMLElementStack::hasTemplateInHTMLScope):
(WebCore::HTMLElementStack::htmlElement):
* html/parser/HTMLElementStack.h:
* html/parser/HTMLPreloadScanner.cpp:
(WebCore::TokenPreloadScanner::scan):
* html/parser/HTMLPreloadScanner.h:
* html/parser/HTMLStackItem.h:
(WebCore::isSpecialNode):
* html/parser/HTMLTreeBuilder.cpp:
(WebCore::HTMLTreeBuilder::isParsingTemplateContents):
(WebCore::HTMLTreeBuilder::isParsingFragmentOrTemplateContents):
(WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
(WebCore::HTMLTreeBuilder::processStartTagForInBody):
(WebCore::HTMLTreeBuilder::didCreateCustomOrCallbackElement):
(WebCore::HTMLTreeBuilder::processTemplateStartTag):
(WebCore::HTMLTreeBuilder::processEndOfFileForInTemplateContents):
(WebCore::HTMLTreeBuilder::processColgroupEndTagForInColumnGroup):
(WebCore::HTMLTreeBuilder::processStartTagForInTable):
(WebCore::HTMLTreeBuilder::processStartTag):
(WebCore::HTMLTreeBuilder::processHtmlStartTagForInBody):
(WebCore::HTMLTreeBuilder::resetInsertionModeAppropriately):
(WebCore::HTMLTreeBuilder::processEndTagForInCell):
(WebCore::HTMLTreeBuilder::processEndTagForInBody):
(WebCore::HTMLTreeBuilder::processEndTag):
(WebCore::HTMLTreeBuilder::processCharacterBuffer):
(WebCore::HTMLTreeBuilder::processEndOfFile):
(WebCore::HTMLTreeBuilder::processStartTagForInHead):
(WebCore::HTMLTreeBuilder::finished):
* html/parser/HTMLTreeBuilder.h:
* inspector/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::buildObjectForNode):
* inspector/InspectorInstrumentation.h:
(WebCore::InspectorInstrumentation::instrumentingAgentsForDocument):
* xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::XMLDocumentParser::startElementNs):

Source/WebKit/mac:

* Configurations/FeatureDefines.xcconfig:

Source/WebKit2:

* Configurations/FeatureDefines.xcconfig:

Source/WTF:

* wtf/FeatureDefines.h:

Tools:

Removed the build option.

* Scripts/webkitperl/FeatureList.pm:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200075 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[iOS] ftp links crash @ WebCore::FTPDirectoryDocumentParser::appendEntry
https://bugs.webkit.org/show_bug.cgi?id=157019
<rdar://problem/24292650>

Reviewed by Chris Dumez.

Create separate Ref<Element> object for every row element instead of reusing
one because Ref<>'s operator=() does not allow assignment after a WTFMove().

* html/FTPDirectoryDocument.cpp:
(WebCore::FTPDirectoryDocumentParser::appendEntry):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200074 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix text in log files autogenerated by import-w3c-tests
https://bugs.webkit.org/show_bug.cgi?id=157021

Reviewed by Chris Dumez.

s/Webkit/WebKit/ and end each sentence with a period.

* Scripts/webkitpy/w3c/test_importer.py:
(TestImporter.write_import_log):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200073 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Update template element tests
https://bugs.webkit.org/show_bug.cgi?id=154996

Reviewed by Daniel Bates.

LayoutTests/imported/w3c:

Reimported W3C tests for template elements as of d5a4c5bdf8a1837b4fcf50bbd2efd4150ddafa99.
Also moved the parser tests from html-templates to web-platform-tests/html/syntax to match the upstream directory structure.

* html-templates: Removed.
* html-templates/parsing-html-templates: Removed.
* html-templates/parsing-html-templates/additions-to-foster-parenting: Removed.
* html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-a-foster-parent-element-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-a-foster-parent-element.html: Removed.
* html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-not-a-foster-parent-element-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-foster-parenting/template-is-not-a-foster-parent-element.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-body-token-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-body-token.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-frameset-token-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-frameset-token.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-head-token-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-head-token.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-html-token-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/ignore-html-token.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-body-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-body.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-html-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/start-tag-html.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one.html: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode/end-tag-table-expected.txt: Removed.
* html-templates/parsing-html-templates/additions-to-the-in-table-insertion-mode/end-tag-table.html: Removed.
* html-templates/parsing-html-templates/appending-to-a-template: Removed.
* html-templates/parsing-html-templates/appending-to-a-template/template-child-nodes-expected.txt: Removed.
* html-templates/parsing-html-templates/appending-to-a-template/template-child-nodes.html: Removed.
* html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context: Removed.
* html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context-expected.txt: Removed.
* html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context.html: Removed.
* html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context-expected.txt: Removed.
* html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context.html: Removed.
* html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context-expected.txt: Removed.
* html-templates/parsing-html-templates/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context.html: Removed.
* html-templates/parsing-html-templates/creating-an-element-for-the-token: Removed.
* html-templates/parsing-html-templates/creating-an-element-for-the-token/template-owner-document-expected.txt: Removed.
* html-templates/parsing-html-templates/creating-an-element-for-the-token/template-owner-document.html: Removed.
* html-templates/resources: Removed.
* html-templates/resources/end-template-tag-in-body.html: Removed.
* html-templates/resources/end-template-tag-in-head.html: Removed.
* html-templates/resources/frameset-end-tag.html: Removed.
* html-templates/resources/head-template-contents-div-no-end-tag.html: Removed.
* html-templates/resources/head-template-contents-table-no-end-tag.html: Removed.
* html-templates/resources/html-start-tag.html: Removed.
* html-templates/resources/template-child-nodes-div.xhtml: Removed.
* html-templates/resources/template-child-nodes-nested.xhtml: Removed.
* html-templates/resources/template-contents-attribute.html: Removed.
* html-templates/resources/template-contents-body.html: Removed.
* html-templates/resources/template-contents-div-no-end-tag.html: Removed.
* html-templates/resources/template-contents-empty.html: Removed.
* html-templates/resources/template-contents-frameset.html: Removed.
* html-templates/resources/template-contents-head.html: Removed.
* html-templates/resources/template-contents-html.html: Removed.
* html-templates/resources/template-contents-nested.html: Removed.
* html-templates/resources/template-contents-table-no-end-tag.html: Removed.
* html-templates/resources/template-contents-text.html: Removed.
* html-templates/resources/template-contents.html: Removed.
* html-templates/resources/template-descendant-body.html: Removed.
* html-templates/resources/template-descendant-frameset.html: Removed.
* html-templates/resources/template-descendant-head.html: Removed.
* html-templates/resources/two-templates.html: Removed.
* html-templates/testcommon.js: Removed.
* web-platform-tests/html/syntax: Added.
* web-platform-tests/html/syntax/parsing: Added.
* web-platform-tests/html/syntax/parsing/template: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-a-foster-parent-element-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-a-foster-parent-element.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-not-a-foster-parent-element-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/template-is-not-a-foster-parent-element.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-foster-parenting/w3c-import.log: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/generating-of-implied-end-tags.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-body-token-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-body-token.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-frameset-token-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-frameset-token.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-head-token-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-head-token.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-html-token-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/ignore-html-token.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-body-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-body.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-html-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/start-tag-html.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/template-end-tag-without-start-one.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-body-insertion-mode/w3c-import.log: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/end-tag-frameset.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-frameset-insertion-mode/w3c-import.log: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/generating-of-implied-end-tags.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/template-end-tag-without-start-one.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-head-insertion-mode/w3c-import.log: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/end-tag-table-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/end-tag-table.html: Added.
* web-platform-tests/html/syntax/parsing/template/additions-to-the-in-table-insertion-mode/w3c-import.log: Added.
* web-platform-tests/html/syntax/parsing/template/appending-to-a-template: Added.
* web-platform-tests/html/syntax/parsing/template/appending-to-a-template/template-child-nodes-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/appending-to-a-template/template-child-nodes.html: Added.
* web-platform-tests/html/syntax/parsing/template/appending-to-a-template/w3c-import.log: Added.
* web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context: Added.
* web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-body-context.html: Added.
* web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-context.html: Added.
* web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/clearing-stack-back-to-a-table-row-context.html: Added.
* web-platform-tests/html/syntax/parsing/template/clearing-the-stack-back-to-a-given-context/w3c-import.log: Added.
* web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token: Added.
* web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/template-owner-document-expected.txt: Added.
* web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/template-owner-document.html: Added.
* web-platform-tests/html/syntax/parsing/template/creating-an-element-for-the-token/w3c-import.log: Added.

LayoutTests:

* platform/mac/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200072 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[JSC] Constant folding of UInt32ToNumber is incorrect
https://bugs.webkit.org/show_bug.cgi?id=157011
rdar://problem/25769641

Patch by Benjamin Poulain <bpoulain@apple.com> on 2016-04-25
Reviewed by Geoffrey Garen.

UInt32ToNumber should return the unsigned 32bit value of
its child. The abstract interpreter fails to do that when handling
Int52.

None of the tests caught that because the bytecode generator already
fold the operation if given a constant. If the constant is not visible
from the bytecode generator (for example because it comes from an inlined call),
then the abstract interpreter folding was producing invalid results.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* tests/stress/uint32-to-number-constant-folding.js: Added.
(uint32ToNumberMinusOne):
(uint32ToNumberMinusOnePlusInteger):
(inlineMinusOne):
(uint32ToNumberOnHiddenMinusOne):
(uint32ToNumberOnHiddenMinusOnePlusInteger):
(inlineLargeNegativeNumber1):
(inlineLargeNegativeNumber2):
(inlineLargeNegativeNumber3):
(uint32ToNumberOnHiddenLargeNegativeNumber1):
(uint32ToNumberOnHiddenLargeNegativeNumber2):
(uint32ToNumberOnHiddenLargeNegativeNumber3):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200071 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Cocoa] Guarantee FontPlatformData's m_cgFont is never nullptr
https://bugs.webkit.org/show_bug.cgi?id=156929

Reviewed by Darin Adler.

Source/WebCore:

After some investigation, it turns out that there is no place where it is meaningful
to pass us a null CoreText font. Therefore, the CoreGraphics font is also never null.

We should simply check for these null values at the ingestion site in order to
make the guarantee internally of having non-null values.

* platform/graphics/FontPlatformData.cpp:
(WebCore::FontPlatformData::FontPlatformData): Because the pointer is never null, we
can delete the code which handles that case.
* platform/graphics/FontPlatformData.h:
* platform/graphics/cocoa/FontPlatformDataCocoa.mm: Ditto.
(WebCore::webFallbackFontFamily): Deleted.
(WebCore::FontPlatformData::setFallbackCGFont): Deleted.
* platform/graphics/mac/ComplexTextControllerCoreText.mm:
(WebCore::ComplexTextController::collectComplexTextRunsForCharacters): Asking the
CTRun for its kCTFontAttributeName will always return non-null.
* platform/graphics/mac/FontCustomPlatformData.cpp:
(WebCore::FontCustomPlatformData::fontPlatformData): Once we have a font descriptor,
CTFontCreateWithFontDescriptor() will always return non-null. We check if the font
descriptor is null elsewhere.
* platform/mac/DragImageMac.mm: The fonts in this file are gotten by asking for the
system font, which will always return non-null.
(WebCore::fontFromNSFont):
(WebCore::widthWithFont):
(WebCore::drawAtPoint):
(WebCore::createDragImageForLink):

Source/WebKit/mac:

* Misc/WebKitNSStringExtras.mm:
(-[NSString _web_drawAtPoint:font:textColor:allowingFontSmoothing:]): Drawing
a string with a null font shouldn't do anything.
* Misc/WebStringTruncator.mm: We can't truncate a string if we don't have a font
to use.
(+[WebStringTruncator centerTruncateString:toWidth:]):
(+[WebStringTruncator centerTruncateString:toWidth:withFont:]):
(+[WebStringTruncator rightTruncateString:toWidth:withFont:]):
(+[WebStringTruncator widthOfString:font:]):

Tools:

* TestWebKitAPI/Tests/mac/StringTruncator.mm:
(TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200070 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Cloning a textarea does not clone the textarea's value
https://bugs.webkit.org/show_bug.cgi?id=156637

Reviewed by Chris Dumez.

https://dom.spec.whatwg.org/#concept-node-clone describes that the value
of a node shouldn't be copied when cloning the node.

* fast/forms/checkValidity-cloneNode-crash-expected.txt:
* fast/forms/checkValidity-cloneNode-crash.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200069 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Heap corruption is detected when destructing JSGlobalObject
https://bugs.webkit.org/show_bug.cgi?id=156831

Patch by Fujii Hironori <Hironori.Fujii@sony.com> on 2016-04-25
Reviewed by Mark Lam.

WebKit uses CRT static library on Windows.  Each copy of the CRT
library has its own heap manager, allocating memory in one CRT
library and passing the pointer across a DLL boundary to be freed
by a different copy of the CRT library is a potential cause for
heap corruption.

  Potential Errors Passing CRT Objects Across DLL Boundaries
  <https://msdn.microsoft.com/en-us/library/ms235460(v=vs.140).aspx>

JSGlobalObject::createRareDataIfNeeded is inlined but
JSGlobalObject::~JSGlobalObject is not.  Then, the heap of
allocating JSGlobalObjectRareData is WebKit.dll, but deallocating
JavaScriptCore.dll.  Adding WTF_MAKE_FAST_ALLOCATED to
JSGlobalObjectRareData ensures heap consistency of it.  WTF::Lock
also needs WTF_MAKE_FAST_ALLOCATED because it is allocated from
the inlined constructor of JSGlobalObjectRareData.

Source/JavaScriptCore:

Test: fast/dom/insertedIntoDocument-iframe.html

* runtime/JSGlobalObject.h:
Add WTF_MAKE_FAST_ALLOCATED to JSGlobalObjectRareData.

Source/WTF:

* wtf/Lock.h: Add WTF_MAKE_FAST_ALLOCATED.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200068 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: hook up grid row filtering in the new Timelines UI
https://bugs.webkit.org/show_bug.cgi?id=154924
<rdar://problem/24934607>

Reviewed by Timothy Hatcher.

Re-implement timeline data grid filtering that previously existed in the
navigation sidebar. This patch adds support for filter text, scope bars,
and filtering based on ruler selection.

Multi-column filter support is now part of DataGrid. The grid checks compares
filter text against cell data of type string. DataGridNode subclasses may
provide custom string data for columns that format complex objects (such
as SourceCodeLocations). Cells containing data of type number are not
considered for filtering at this time.

* UserInterface/Views/DataGrid.js:
(WebInspector.DataGrid):
(WebInspector.DataGrid.prototype.set filterText):
(WebInspector.DataGrid.prototype.get filterDelegate):
(WebInspector.DataGrid.prototype.set filterDelegate):
(WebInspector.DataGrid.prototype.filterDidChange):
Called internally by the grid whenever the filter text or delegate changes.
Also called by clients that implement a filter delegate, to inform the
grid that a custom filter has changed.

(WebInspector.DataGrid.prototype.hasCustomFilters):
(WebInspector.DataGrid.prototype.matchNodeAgainstCustomFilters):
Calls the filter delegate, if it exists, and provides a hook for
subclasses to provide custom filtering.

(WebInspector.DataGrid.prototype._applyFiltersToNode.matchTextFilter):
(WebInspector.DataGrid.prototype._applyFiltersToNode.makeVisible):
(WebInspector.DataGrid.prototype._applyFiltersToNode):
Filters data grid nodes and fires filter events as needed.
(WebInspector.DataGrid.prototype._hasFilterDelegate):
Helper function.
(WebInspector.DataGrid.prototype._updateVisibleRows):
Exclude hidden nodes from revealed rows.
(WebInspector.DataGrid.prototype._updateFilter):
Filtering entry point, called on an animation frame. Updates visible
rows if any node was filtered/unfiltered.

(WebInspector.DataGridNode):
(WebInspector.DataGridNode.prototype.get filterableData):
Gets an array of filterable strings for the node.
(WebInspector.DataGridNode.prototype.refresh):
Resets cached filterable strings.
(WebInspector.DataGridNode.prototype.filterableDataForColumn):
Can be overridden by subclasses to provide filterable text for complex
cell data, like as objects formatted as document fragments.

* UserInterface/Views/LayoutTimelineDataGridNode.js:
(WebInspector.LayoutTimelineDataGridNode.prototype.get data):

* UserInterface/Views/LayoutTimelineView.js:
(WebInspector.LayoutTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.LayoutTimelineView.prototype.filterDidChange):
Update highlight after grid filter change.
(WebInspector.LayoutTimelineView.prototype._dataGridSelectedNodeChanged):
Update highlight when selection changes.
(WebInspector.LayoutTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.LayoutTimelineView.prototype.treeElementDeselected): Deleted.
(WebInspector.LayoutTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.LayoutTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

* UserInterface/Views/NetworkTimelineView.js:
(WebInspector.NetworkTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.NetworkTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.NetworkTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.NetworkTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

* UserInterface/Views/OverviewTimelineView.js:
(WebInspector.OverviewTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.OverviewTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

* UserInterface/Views/RenderingFrameTimelineView.js:
(WebInspector.RenderingFrameTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.RenderingFrameTimelineView.prototype.get filterStartTime):
(WebInspector.RenderingFrameTimelineView.prototype.get filterEndTime):
Convert selection indices into filter start and end times.
(WebInspector.RenderingFrameTimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
Perform custom filtering on rendering frame duration.
(WebInspector.RenderingFrameTimelineView.prototype._scopeBarSelectionDidChange):
Inform grid of custom filter change.
(WebInspector.RenderingFrameTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.RenderingFrameTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

* UserInterface/Views/ResourceTimelineDataGridNode.js:
(WebInspector.ResourceTimelineDataGridNode.prototype.filterableDataForColumn):
Use URL string for filtering "name" column.

* UserInterface/Views/ScriptClusterTimelineView.js:
(WebInspector.ScriptClusterTimelineView.prototype.updateFilter):
Forwarding for TimelineView API.
(WebInspector.ScriptClusterTimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
(WebInspector.ScriptClusterTimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
Renamed to matchDataGridNodeAgainstCustomFilters.
(WebInspector.ScriptClusterTimelineView.prototype._scriptClusterViewCurrentContentViewDidChange): Deleted.
Removed FIXME comment. Updating TimelineView times is sufficient to trigger filtering.

* UserInterface/Views/ScriptDetailsTimelineView.js:
(WebInspector.ScriptDetailsTimelineView):
Register grid and remove logic that has been moved to the base class.
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridFiltersDidChange): Deleted.
(WebInspector.ScriptDetailsTimelineView.prototype._dataGridNodeSelected): Deleted.
No longer needed.

* UserInterface/Views/ScriptTimelineDataGridNode.js:
(WebInspector.ScriptTimelineDataGridNode.prototype.filterableDataForColumn):
Use main title and subtitle strings for filtering "name" column.
(WebInspector.ScriptTimelineDataGridNode.prototype._createNameCellDocumentFragment):
(WebInspector.ScriptTimelineDataGridNode.prototype._subtitle):
Break out for use in filterableDataForColumn.

* UserInterface/Views/TimelineDataGrid.js:
(WebInspector.TimelineDataGrid):
Cleanup variable names.
(WebInspector.TimelineDataGrid.prototype.hasCustomFilters):
Always true because filtering on ruler selection always occurs.
(WebInspector.TimelineDataGrid.prototype.matchNodeAgainstCustomFilters):
Match nodes against scope bar filters.
(WebInspector.TimelineDataGrid.prototype._scopeBarSelectedItemsDidChange):
Inform grid of custom filter change.
(WebInspector.TimelineDataGrid.prototype.treeElementMatchesActiveScopeFilters): Deleted.
Re-implemented as _nodeMatchesActiveScopeFilters.
(WebInspector.TimelineDataGrid.prototype._updateScopeBarForcedVisibility): Deleted.
Old UI. No longer needed.

* UserInterface/Views/TimelineDataGridNode.js:
(WebInspector.TimelineDataGridNode.prototype.filterableDataForColumn):
Filter strings for SourceCodeLocation and CallFrame objects.

* UserInterface/Views/TimelineRecordingContentView.js:
(WebInspector.TimelineRecordingContentView):
Listen for FilterBar changes and TimelineView record filtering.
(WebInspector.TimelineRecordingContentView.prototype._filterDidChange):
Update grid filters when filter bar changes.
(WebInspector.TimelineRecordingContentView.prototype._recordWasFiltered):
Update overview when records are filtered/unfiltered.
(WebInspector.TimelineRecordingContentView.prototype.filterDidChange): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.recordWasFiltered): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.matchTreeElementAgainstCustomFilters.checkTimeBounds): Deleted.
(WebInspector.TimelineRecordingContentView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
Re-implemented in DataGrid.
(WebInspector.TimelineRecordingContentView.prototype._updateTimes): Deleted.
FIXME comment removed. Filtering occurs when TimelineView times are updated.
(WebInspector.TimelineRecordingContentView.prototype._timeRangeSelectionChanged): Deleted.

* UserInterface/Views/TimelineView.js:
(WebInspector.TimelineView):
(WebInspector.TimelineView.prototype.get navigationItems):
Used by TimelineRecordingContentView to add scope bar items to the
lower content browser's navigation bar.

(WebInspector.TimelineView.prototype.set startTime):
(WebInspector.TimelineView.prototype.set endTime):
(WebInspector.TimelineView.prototype.set currentTime):
Update grid filter when recording times change.
(WebInspector.TimelineView.prototype.get filterStartTime):
(WebInspector.TimelineView.prototype.get filterEndTime):
Let subclasses (RenderingFrameTimelineView) provide filter start/end times.
(WebInspector.TimelineView.prototype.setupDataGrid):
Register the grid used by the TimelineView subclass, allowing the base
class to hook into common event listeners and provide boilerplate functionality.

(WebInspector.TimelineView.prototype.updateFilter):
For data grid views, updates grid filters and sets new filter text.
(WebInspector.TimelineView.prototype.matchDataGridNodeAgainstCustomFilters):
(WebInspector.TimelineView.prototype.dataGridMatchNodeAgainstCustomFilters.checkTimeBounds):
(WebInspector.TimelineView.prototype.dataGridMatchNodeAgainstCustomFilters):
DataGrid filter delegate. Lets subclasses apply custom filters first,
then filters based on ruler selection if needed.

(WebInspector.TimelineView.prototype.filterDidChange):
Hook for subclasses to respond to filter changes.
(WebInspector.TimelineView.prototype._filterTimesDidChange.delayedWork):
(WebInspector.TimelineView.prototype._filterTimesDidChange):
Helper function for coalescing ruler selection updates into a single
filter update.

(WebInspector.TimelineView.prototype.matchTreeElementAgainstCustomFilters): Deleted.
(WebInspector.TimelineView.prototype.filterUpdated): Deleted.
No longer needed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200067 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Crash under MemoryCache::remove()
https://bugs.webkit.org/show_bug.cgi?id=157000
<rdar://problem/23344660>

Reviewed by Andreas Kling.

MemoryCache::evictResources() was caching the number of resources ('size')
in the cache for a particular sessionID, and then proceed to call
MemoryCache::remove() 'size' times using the first item in the HashMap
each time. This was unsafe because resources may be ref'ing each other
and therefore removing one may cause other resources to get removed as
well. In such case, we would call remove() too many times and crash because
we dereferenced resources.begin()->value (with the HashMap being empty).

This patch avoids the issue by copying the resources to a Vector and
ref'ing them first, before going on to remove each one from the cache.

* loader/cache/MemoryCache.cpp:
(WebCore::MemoryCache::forEachSessionResource):
(WebCore::MemoryCache::evictResources):
* loader/cache/MemoryCache.h:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200066 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: React.js JSXTransformer produces bogus error locations
https://bugs.webkit.org/show_bug.cgi?id=150010
<rdar://problem/23062233>

Reviewed by Timothy Hatcher.

Source/WebInspectorUI:

Show dynamically added <script> elements added to a frame as resources.
For cases where the scripts had source map resources or error messages
we have a root from which to associate them to.

* Localizations/en.lproj/localizedStrings.js:
"Script Element %d" tree element title.

* UserInterface/Models/Frame.js:
(WebInspector.Frame.prototype.commitProvisionalLoad):
(WebInspector.Frame.prototype.get extraScripts):
(WebInspector.Frame.prototype.addExtraScript):
Have a frame keep a list of its extra scripts.

* UserInterface/Models/Script.js:
(WebInspector.Script):
(WebInspector.Script.prototype.get displayName):
(WebInspector.Script.prototype.get dynamicallyAddedScriptElement):
Identify dynamically added script elements and associate them
with the frame, instead of the frame's main resource.

* UserInterface/Views/FrameTreeElement.js:
(WebInspector.FrameTreeElement.prototype.onpopulate):
(WebInspector.FrameTreeElement.prototype._extraScriptAdded):
Show named / source mapped dynamic script elements under a frame.

* UserInterface/Views/ResourceSidebarPanel.js:
(WebInspector.ResourceSidebarPanel.prototype._scriptWasAdded):
Dynamically added script element Scripts will be added by the frame that
owns them.

* UserInterface/Views/ScriptTreeElement.js:
(WebInspector.ScriptTreeElement):
Don't include a subtitle for dynamicallyAddedScriptElement, details match
the frame that owns them.

LayoutTests:

* inspector/model/frame-extra-scripts-expected.txt: Added.
* inspector/model/frame-extra-scripts.html: Added.
Add a test for a WebInspector.Frame's extraScripts list.

* inspector/model/script-resource-relationship-expected.txt
* inspector/model/script-resource-relationship.html
Add a test for a dynamicallyAddedScriptElement.
Remove debug logging.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200065 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Web Inspector: Line error widget showed in the wrong resource
https://bugs.webkit.org/show_bug.cgi?id=150009
<rdar://problem/23062199>

Reviewed by Timothy Hatcher.

This addresses a few long standing issues:

    - IssueMessage and ConsoleMessage should not fight eachother
    - Displayed issue messages now correctly have format string formatting, e.g. console.error("Foo %s", str)
    - IssueMessage wraps a ConsoleMessage, so we don't duplicate everything
    - Gives ConsoleMessage a sourceCodeLocation (lazy)
        - Since a sourceCodeLocation can have the exact SourceCode, if it was a Script
          without a Resource, we can only show the error in the Script's editor.

* UserInterface/Models/CallFrame.js:
(WebInspector.CallFrame.fromPayload):
Prefer the script identifier lookup first. And from the Script go
to a resource if possible. This allows us to distinguish a location
that should be in a Script that doesn't have a Resource when there
exists a Resource with the same URL. This will soon be the case
for dyanamic <script> elements append to a document.

* UserInterface/Controllers/IssueManager.js:
(WebInspector.IssueManager.issueMatchSourceCode):
Consolidate all the different checks to this one function.

(WebInspector.IssueManager.prototype.issueWasAdded):
Create IssueMessages with ConsoleMessages.

(WebInspector.IssueManager.prototype.issuesForSourceCode):
Simplify now that we have the better check.

* UserInterface/Controllers/LogManager.js:
(WebInspector.LogManager.prototype.messageWasAdded):
Once a ConsoleMessage has been created (and modified `parameters` for us)
create the IssueMessage if it was an issue.

* UserInterface/Models/ConsoleMessage.js:
(WebInspector.ConsoleMessage.prototype.get sourceCodeLocation):
Lazily create a source code from the best possible location. This can
be the top call frame or the url/line/column combination.

* UserInterface/Models/IssueMessage.js:
(WebInspector.IssueMessage):
Creation and most properties just call through to a ConsoleMessage.
The `type` and `text` are Issue specific. Anything that uses location
data should use the sourceCodeLocation.

(WebInspector.IssueMessage.prototype.saveIdentityToCookie):
Fix implementation that didn't account for a null sourceCodeLocation.

(WebInspector.IssueMessage.prototype._formatTextIfNecessary):
Basic text format message formatting.

* UserInterface/Protocol/ConsoleObserver.js:
(WebInspector.ConsoleObserver.prototype.messageAdded):
No longer call IssueMessage from the observer. Let LogManager trigger issues.

* UserInterface/Views/ContentView.js:
(WebInspector.ContentView.createFromRepresentedObject):
(WebInspector.ContentView.resolvedRepresentedObjectForRepresentedObject):
(WebInspector.ContentView.isViewable):
An IssueMessage represented object for an IssueMessageTreeElement should be
restorable by just going to the sourceCodeLocation it references. This is
identical to a Breakpoint.

* UserInterface/Views/IssueTreeElement.js:
(WebInspector.IssueTreeElement.prototype._updateTitles):
(WebInspector.IssueTreeElement):
* UserInterface/Views/ResourceContentView.js:
(WebInspector.ResourceContentView.prototype._issueWasAdded):
* UserInterface/Views/SourceCodeTextEditor.js:
(WebInspector.SourceCodeTextEditor.prototype._issueWasAdded):
(WebInspector.SourceCodeTextEditor.prototype._addIssue):
(WebInspector.SourceCodeTextEditor.prototype._reinsertAllIssues):
(WebInspector.SourceCodeTextEditor.prototype._matchesIssue): Deleted.
Update to use Issue's sourceCodeLocation or IssueManager's new APIs.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200064 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Marking fast/layers/no-clipping-overflow-hidden-added-after-transform.html as flaky on mac-wk1
https://bugs.webkit.org/show_bug.cgi?id=157007

Unreviewed test gardening.

* platform/mac-wk1/TestExpectations:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200063 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Crash under WebCore::MutationObserver::deliverAllMutations()
https://bugs.webkit.org/show_bug.cgi?id=156997
<rdar://problem/16542323>

Reviewed by Ryosuke Niwa.

The crash traces indicate that we may derefence a null pointer when
dereferencing MutationCallback::scriptExecutationContext() in
MutationObserver::canDeliver(). This can happen when the script
execution context gets destroyed as a JSMutationCallback is an
ActiveDOMObject, which is a ContextDestructionObserver.

This patch refactors the code so that MutationObserver::canDeliver()
now simply asks JSMutationCallback if it can invoke its callback.
JSMutationCallback makes this decision using
ActiveDOMCallback::canInvokeCallback() which does a proper null
check of the ScriptExecutationContext. This avoids some code
duplication and fixes the crash.

* bindings/js/JSMutationCallback.h:
* dom/MutationCallback.h:
* dom/MutationObserver.cpp:
(WebCore::MutationObserver::canDeliver):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200062 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix a flaky test after r200032

* fileapi/File.cpp:
(WebCore::File::lastModified): This used to return a date object which did a WTF::timeClip on the double,
  but now that we're returning a raw double we need to WTF::timeClip it ourselves.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200061 268f45cc-cd09-0410-ab3c-d52691b4dbfc

bmalloc: Misc improvements to MallocBench
https://bugs.webkit.org/show_bug.cgi?id=157004

Reviewed by Darin Adler.

* MallocBench/run-malloc-benchmarks: Added --memory and --memory_warning
modes for focused memory testing.

* MallocBench/MallocBench/Benchmark.cpp:
(Benchmark::printReport): Clarified output.

(Benchmark::currentMemoryBytes): Added compressed memory because top
does the same. (It always happens to zero in the benchmarks we run. But
this is good for sanity.)

* MallocBench/MallocBench/CommandLine.cpp: Moved up to 8 runs to reduce
variance.

* MallocBench/MallocBench/alloc_free.cpp:
(benchmark_alloc_free): Cycle a single allocation in order to stress
the effect of merging on calls to madvise.

* MallocBench/MallocBench/big.cpp:
(benchmark_big): Graduated to 8kB-128kB because medium tests up to 8 and
our large allocator doesn't kick in until 64kB.

* MallocBench/MallocBench/medium.cpp:
(benchmark_medium): Test all the way down to 1kB because our large
allocator used to service 1kB allocations and 1kB is an interesting
middle size where memory is unusually large but allocation throughput
still matters.

* MallocBench/MallocBench/stress.cpp:
(benchmark_stress): Reduced the churn count to match stress_aligned
because this test was taking too long to complete.

* MallocBench/MallocBench/stress_aligned.cpp:
(benchmark_stress_aligned): Our new large allocator can handle even
more absurdly large values.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200060 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Tools] whitelist all-uppercase JSTokenType enum in JavaScriptCore
https://bugs.webkit.org/show_bug.cgi?id=156976

Patch by Caitlin Potter <caitp@igalia.com> on 2016-04-25
Reviewed by Darin Adler.

Mitigate style-checker spam on bugs which introduce new JavaScript
token types.

* Scripts/webkitpy/style/checkers/cpp.py:
(_EnumState.__init__):
(_EnumState.process_clean_line):
* Scripts/webkitpy/style/checkers/cpp_unittest.py:
(NoNonVirtualDestructorsTest.test_enum_casing):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200059 268f45cc-cd09-0410-ab3c-d52691b4dbfc

[Web IDL] Specify default values for optional parameters of type 'float' / 'unrestricted float'
https://bugs.webkit.org/show_bug.cgi?id=156995

Reviewed by Darin Adler.

Specify default values for optional parameters of type 'float' / 'unrestricted float'
and let the bindings generator use WTF::Optional<> for the ones that do not have a
default value.

* bindings/scripts/CodeGeneratorJS.pm:
(CanUseWTFOptionalForParameter): Deleted.
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::jsTestTypedefsPrototypeFunctionSetShadow):
* html/canvas/CanvasRenderingContext2D.cpp:
(WebCore::CanvasRenderingContext2D::setStrokeColor):
(WebCore::CanvasRenderingContext2D::setFillColor):
(WebCore::CanvasRenderingContext2D::setShadow):
(WebCore::CanvasRenderingContext2D::fillText):
(WebCore::CanvasRenderingContext2D::strokeText):
(WebCore::CanvasRenderingContext2D::drawTextInternal):
(WebCore::CanvasRenderingContext2D::clearShadow): Deleted.
(WebCore::normalizeSpaces): Deleted.
(WebCore::CanvasRenderingContext2D::measureText): Deleted.
* html/canvas/CanvasRenderingContext2D.h:
* html/canvas/CanvasRenderingContext2D.idl:
* testing/Internals.idl:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200058 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebEditorClient should properly write to m_rangeForCandidates
https://bugs.webkit.org/show_bug.cgi?id=157003
-and corresponding-
rdar://problem/25910418

Reviewed by Tim Horton.

Actually write to m_rangeForCandidates instead of declaring a local variable
of the same name. :-/
* WebCoreSupport/WebEditorClient.mm:
(WebEditorClient::requestCandidatesForSelection):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200057 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add port 4190 (managesieve) to port blacklist
https://bugs.webkit.org/show_bug.cgi?id=156986
<rdar://problem/9119470>

Reviewed by Daniel Bates.

Source/WebCore:

Tested by security/block-test.html.

* platform/URL.cpp:
(WebCore::portAllowed): Add 4190 to the port blacklist.

LayoutTests:

* platform/mac/security/block-test-expected.txt
* security/block-test-expected.txt:
* security/block-test.html:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200056 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Rebaseline editing tests for ios-simulator-wk1

Unreviewed test gardening

* platform/ios-simulator-wk1/editing/deleting/delete-at-paragraph-boundaries-002-expected.txt:
* +71 more

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200055 268f45cc-cd09-0410-ab3c-d52691b4dbfc

AX: Crash at -[WebAccessibilityObjectWrapper accessibilityAttributeValue:] + 4391
https://bugs.webkit.org/show_bug.cgi?id=156987

Reviewed by Chris Fleizach.

Source/WebCore:

When we hit test on a slider indicator asking for the value when the parent slider's
accessibility object is not created or the parent slider has been removed, it will cause
crash. Fixed it by adding a check to see if the object is detached from the parent.

Test: accessibility/mac/slider-thumb-value-crash.html

* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

LayoutTests:

* accessibility/mac/slider-thumb-value-crash-expected.txt: Added.
* accessibility/mac/slider-thumb-value-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200054 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Fix issues with content-animation performance tests
https://bugs.webkit.org/show_bug.cgi?id=157001

Reviewed by Sam Weinig.

Add patch content for svg-animation.html, and fix the paths in the patch so
it applies correctly.

Add the patch file to the .plan file.

* Scripts/webkitpy/benchmark_runner/data/patches/ContentAnimation.patch:
* Scripts/webkitpy/benchmark_runner/data/plans/content-animation.plan:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200053 268f45cc-cd09-0410-ab3c-d52691b4dbfc

WebKitPlaybackSessionModelMediaElement should initialize the interface added by setWebPlaybackSessionInterface() with initial data
https://bugs.webkit.org/show_bug.cgi?id=156996

Reviewed by Beth Dakin.

Notify the interface of the current values in the media element when the model is given an interface.

* platform/cocoa/WebPlaybackSessionModelMediaElement.mm:
(WebPlaybackSessionModelMediaElement::setWebPlaybackSessionInterface):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200052 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Attempt to fix a flaky test after r200032
https://bugs.webkit.org/show_bug.cgi?id=156994

* http/tests/local/fileapi/script-tests/file-last-modified-after-delete.js: Missed renaming this along with all the others.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200051 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Crash under -[WKWebView _mayAutomaticallyShowVideoPictureInPicture] + 32 (WKWebView.mm:309)
https://bugs.webkit.org/show_bug.cgi?id=156990
<rdar://problem/25904376>

Reviewed by Jer Noble.

In case of WebProcess crash, WebPageProxy::processDidCrash() will call resetState() which
will nullify WebPageProxy::m_videoFullscreenManager. In WebPageProxy::reattachToWebProcess(),
we then call updateViewState() before re-initializing m_videoFullscreenManager, and
updateViewState() ends up calling [WKWebView _mayAutomaticallyShowVideoPictureInPicture]
which dereferences WebPageProxy::m_videoFullscreenManager without null check. This patch
adds a null check for m_videoFullscreenManager in _mayAutomaticallyShowVideoPictureInPicture.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _mayAutomaticallyShowVideoPictureInPicture]):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200050 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Add a content animation test that uses SVG animation.
https://bugs.webkit.org/show_bug.cgi?id=156827

* Animation/svg-animation.html: Added.
* Skipped:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@200049 268f45cc-cd09-0410-ab3c-d52691b4dbfc