[webkit-changes] [WebKit/WebKit] 8428e0: Branch WebKitGTK+ for 2.20

Carlos Garcia Campos noreply at github.com
Thu Dec 1 08:55:38 PST 2022


  Branch: refs/heads/webkitgtk/2.20
  Home:   https://github.com/WebKit/WebKit
  Commit: 8428e032601bad82fdb0cfa8b0461f6bd17f3b5e
      https://github.com/WebKit/WebKit/commit/8428e032601bad82fdb0cfa8b0461f6bd17f3b5e
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-02-05 (Mon, 05 Feb 2018)

  Changed paths:

  Log Message:
  -----------
  Branch WebKitGTK+ for 2.20


  Commit: 32ab185a5d42d9e72cc323bafd003db0882add1b
      https://github.com/WebKit/WebKit/commit/32ab185a5d42d9e72cc323bafd003db0882add1b
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-02-05 (Mon, 05 Feb 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.19.90 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.19.90.


  Commit: b158202331d910936242bdf556ea82b1ea0ee379
      https://github.com/WebKit/WebKit/commit/b158202331d910936242bdf556ea82b1ea0ee379
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp

  Log Message:
  -----------
  Merge r228091 - Unreviewed, rolling out r228085.

Pixel data stride is imposed by OpenGL and shouldn't be
adjusted for Cairo

Reverted changeset:

"[Cairo] Correctly calculate stride in
GraphicsContext3D::paintToCanvas()"
https://bugs.webkit.org/show_bug.cgi?id=182466
https://trac.webkit.org/changeset/228085


  Commit: 8b3050750271d45c88f26cbbef12599a778837bb
      https://github.com/WebKit/WebKit/commit/8b3050750271d45c88f26cbbef12599a778837bb
  Author: Manuel Rego Casasnovas <rego at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    R LayoutTests/fast/css-grid-layout/grid-gutters-get-set.html
    M LayoutTests/fast/css-grid-layout/grid-shorthand-get-set-expected.txt
    M LayoutTests/fast/css-grid-layout/grid-shorthand-get-set.html
    M LayoutTests/imported/w3c/ChangeLog
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/column-gap-animation-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/column-gap-animation-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/column-gap-animation-002-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/column-gap-animation-002.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/column-gap-animation-003-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/column-gap-animation-003.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/column-gap-parsing-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/column-gap-parsing-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-animation-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-animation-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-animation-002-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-animation-002.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-animation-003-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-animation-003.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-animation-004-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-animation-004.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-parsing-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/gap-parsing-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/grid-column-gap-parsing-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/grid-column-gap-parsing-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/grid-gap-parsing-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/grid-gap-parsing-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/grid-row-gap-parsing-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/grid-row-gap-parsing-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/row-gap-animation-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/row-gap-animation-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/row-gap-animation-002-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/row-gap-animation-002.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/row-gap-animation-003-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/row-gap-animation-003.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/row-gap-parsing-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/row-gap-parsing-001.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/gaps/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-001-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-002-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-003-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-004-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-005-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-006-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-007-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-008-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-009-expected.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/alignment/grid-gutters-010-expected.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSComputedStyleDeclaration.cpp
    M Source/WebCore/css/CSSProperties.json
    M Source/WebCore/css/StyleProperties.cpp
    M Source/WebCore/css/parser/CSSParserFastPaths.cpp
    M Source/WebCore/css/parser/CSSPropertyParser.cpp
    M Source/WebCore/page/animation/CSSPropertyAnimation.cpp
    M Source/WebCore/rendering/RenderGrid.cpp
    M Source/WebCore/rendering/style/RenderStyle.h
    M Source/WebCore/rendering/style/StyleGridData.cpp
    M Source/WebCore/rendering/style/StyleGridData.h
    M Source/WebCore/rendering/style/StyleMultiColData.cpp
    M Source/WebCore/rendering/style/StyleMultiColData.h
    M Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
    M Source/WebCore/rendering/style/StyleRareNonInheritedData.h

  Log Message:
  -----------
  Merge r228095 - [css-grid] Rename gutter properties to remove "grid-" prefix
https://bugs.webkit.org/show_bug.cgi?id=180290

Reviewed by Javier Fernandez.

LayoutTests/imported/w3c:

Imported WPT tests from css/css-align/gaps/.
And also update the tests on css/css-grid/alignment/ gutter tests.

* web-platform-tests/css/css-align/gaps/column-gap-animation-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/column-gap-animation-001.html: Added.
* web-platform-tests/css/css-align/gaps/column-gap-animation-002-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/column-gap-animation-002.html: Added.
* web-platform-tests/css/css-align/gaps/column-gap-animation-003-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/column-gap-animation-003.html: Added.
* web-platform-tests/css/css-align/gaps/column-gap-parsing-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/column-gap-parsing-001.html: Added.
* web-platform-tests/css/css-align/gaps/gap-animation-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/gap-animation-001.html: Added.
* web-platform-tests/css/css-align/gaps/gap-animation-002-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/gap-animation-002.html: Added.
* web-platform-tests/css/css-align/gaps/gap-animation-003-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/gap-animation-003.html: Added.
* web-platform-tests/css/css-align/gaps/gap-animation-004-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/gap-animation-004.html: Added.
* web-platform-tests/css/css-align/gaps/gap-parsing-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/gap-parsing-001.html: Added.
* web-platform-tests/css/css-align/gaps/grid-column-gap-parsing-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/grid-column-gap-parsing-001.html: Added.
* web-platform-tests/css/css-align/gaps/grid-gap-parsing-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/grid-gap-parsing-001.html: Added.
* web-platform-tests/css/css-align/gaps/grid-row-gap-parsing-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/grid-row-gap-parsing-001.html: Added.
* web-platform-tests/css/css-align/gaps/row-gap-animation-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/row-gap-animation-001.html: Added.
* web-platform-tests/css/css-align/gaps/row-gap-animation-002-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/row-gap-animation-002.html: Added.
* web-platform-tests/css/css-align/gaps/row-gap-animation-003-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/row-gap-animation-003.html: Added.
* web-platform-tests/css/css-align/gaps/row-gap-parsing-001-expected.txt: Added.
* web-platform-tests/css/css-align/gaps/row-gap-parsing-001.html: Added.
* web-platform-tests/css/css-align/gaps/w3c-import.log: Added.
* web-platform-tests/css/css-grid/alignment/grid-gutters-001-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-002-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-003-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-004-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-005-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-006-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-007-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-008-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-009-expected.html:
* web-platform-tests/css/css-grid/alignment/grid-gutters-010-expected.html:

Source/WebCore:

This patch applies the resoultion of the CSS WG to unprefix
the CSS Grid Layout gutter properties:
https://github.com/w3c/csswg-drafts/issues/1696

column-gap already existed before, as it's part of Multicol.
The patch adds the new properties row-gap and gap, and keep the legacy ones
as aliases:
- grid-column-gap => column-gap
- grid-row-gap => row-gap
- grid-gap => gap

As column-gap was already animatable, this change takes advantage
to make animatable row-gap too.

Tests: imported/w3c/web-platform-tests/css/css-align/gaps/

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::ComputedStyleExtractor::valueForPropertyinStyle):
* css/CSSProperties.json:
* css/StyleProperties.cpp:
* css/parser/CSSParserFastPaths.cpp:
(WebCore::isSimpleLengthPropertyID):
* css/parser/CSSPropertyParser.cpp:
(WebCore::CSSPropertyParser::parseSingleValue):
(WebCore::CSSPropertyParser::parseShorthand):
* page/animation/CSSPropertyAnimation.cpp:
(WebCore::CSSPropertyAnimationWrapperMap::CSSPropertyAnimationWrapperMap):
* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::availableSpaceForGutters const):
(WebCore::RenderGrid::gridGap const):
* rendering/style/RenderStyle.h:
(WebCore::RenderStyle::gridAutoRows const):
(WebCore::RenderStyle::columnGap const):
(WebCore::RenderStyle::rowGap const):
(WebCore::RenderStyle::setGridItemRowEnd):
(WebCore::RenderStyle::setColumnGap):
(WebCore::RenderStyle::setRowGap):
(WebCore::RenderStyle::initialRowGap):
* rendering/style/StyleGridData.cpp:
(WebCore::StyleGridData::StyleGridData):
* rendering/style/StyleGridData.h:
(WebCore::StyleGridData::operator== const):
* rendering/style/StyleMultiColData.cpp:
(WebCore::StyleMultiColData::StyleMultiColData):
(WebCore::StyleMultiColData::operator== const):
* rendering/style/StyleMultiColData.h:
* rendering/style/StyleRareNonInheritedData.cpp:
(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
(WebCore::StyleRareNonInheritedData::operator== const):
* rendering/style/StyleRareNonInheritedData.h:

LayoutTests:

* TestExpectations: We're now passing some gutters tests,
so removing them from TestExpectations.
* fast/css-grid-layout/grid-gutters-get-set.html: Removed. This is now covered by WPT tests.
* fast/css-grid-layout/grid-shorthand-get-set-expected.txt: Update results for gutter properties
as default value is now "normal".
* fast/css-grid-layout/grid-shorthand-get-set.html: Update checks for gutter properties
as default value is now "normal".


  Commit: b3e0236bfc75e44eefd9b3c487782bccdb5a2fb5
      https://github.com/WebKit/WebKit/commit/b3e0236bfc75e44eefd9b3c487782bccdb5a2fb5
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/preload/link-preload-type-mismatch-expected.txt
    A LayoutTests/http/tests/preload/link-preload-type-mismatch.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/LinkLoader.cpp

  Log Message:
  -----------
  Merge r228096 - Crash on sfgate.com because mismatching link preload types
https://bugs.webkit.org/show_bug.cgi?id=182483
<rdar://problem/37065331>

Reviewed by Daniel Bates.

Source/WebCore:

Preloading the same URL with different 'as' types causes some confusion.

Test: http/tests/preload/link-preload-type-mismatch.html

* loader/LinkLoader.cpp:
(WebCore::createLinkPreloadResourceClient):

    Ensure we use the actual resource type when creating the client.

(WebCore::LinkLoader::preloadIfNeeded):

    Don't construct client if the types don't match. This can happen if there is an existing
    preload for the same resource with different type.

LayoutTests:

* http/tests/preload/link-preload-type-mismatch-expected.txt: Added.
* http/tests/preload/link-preload-type-mismatch.html: Added.


  Commit: 844f72cc463f7136b2eff5582f9c267201d7dad4
      https://github.com/WebKit/WebKit/commit/844f72cc463f7136b2eff5582f9c267201d7dad4
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/mac/TestExpectations
    M LayoutTests/platform/wk2/TestExpectations
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/Plugins/NPObjectMessageReceiver.cpp
    M Source/WebKit/WebProcess/Plugins/Plugin.cpp
    M Source/WebKit/WebProcess/Plugins/Plugin.h
    M Source/WebKit/WebProcess/Plugins/PluginView.cpp
    M Source/WebKit/WebProcess/Plugins/PluginView.h

  Log Message:
  -----------
  Merge r228100 - Disallow evaluating JavaScript from NPP_Destroy() in WebKit
https://bugs.webkit.org/show_bug.cgi?id=181889
<rdar://problem/36674701>

Reviewed by Brent Fulgham.

Source/WebKit:

Make the behavior of WebKit match the behavior of WebKitLegacy on Mac.

* Shared/Plugins/NPObjectMessageReceiver.cpp:
(WebKit::NPObjectMessageReceiver::hasMethod):
(WebKit::NPObjectMessageReceiver::invoke):
(WebKit::NPObjectMessageReceiver::invokeDefault):
(WebKit::NPObjectMessageReceiver::hasProperty):
(WebKit::NPObjectMessageReceiver::getProperty):
(WebKit::NPObjectMessageReceiver::setProperty):
(WebKit::NPObjectMessageReceiver::removeProperty):
(WebKit::NPObjectMessageReceiver::enumerate):
(WebKit::NPObjectMessageReceiver::construct):
Bail out if the plugin is executing NPP_Destroy().

* WebProcess/Plugins/Plugin.cpp:
(WebKit::Plugin::destroyPlugin):
* WebProcess/Plugins/Plugin.h:
(WebKit::Plugin::isBeingDestroyed const):
Move bookkeeping of whether the plugin is being destroyed from PluginView
to here. This makes it straightforward for NPObjectMessageReceiver to query
this information.

* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::~PluginView):
(WebKit::PluginView::destroyPluginAndReset):
(WebKit::PluginView::recreateAndInitialize):
(WebKit::PluginView::protectPluginFromDestruction):
(WebKit::PluginView::unprotectPluginFromDestruction):
Move bookkeeping of whether the plugin is being destroyed from here
to Plugin.

* WebProcess/Plugins/PluginView.h:
(WebKit::PluginView::isBeingDestroyed const): Turn around and ask the plugin if it
is being destroyed, if we have one.

LayoutTests:

Consolidate all the plugin tests that evaluate JavaScript from NPP_Destroy()
and mark them as Wont Fix. In a subsequent change we will look to replace
these tests with tests that ensure that we do not evaluate JavaScript from
NPP_Destroy().

* platform/mac/TestExpectations:
* platform/wk2/TestExpectations:


  Commit: cf240d95a699a1636fa9079944dd567c80da39c5
      https://github.com/WebKit/WebKit/commit/cf240d95a699a1636fa9079944dd567c80da39c5
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/mac-wk2/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/workers/service/ServiceWorkerContainer.cpp
    M Source/WebCore/workers/service/ServiceWorkerJobData.cpp
    M Source/WebCore/workers/service/ServiceWorkerJobData.h
    M Source/WebCore/workers/service/server/SWServer.cpp
    M Source/WebCore/workers/service/server/SWServer.h
    M Source/WebCore/workers/service/server/SWServerJobQueue.cpp
    M Source/WebCore/workers/service/server/SWServerJobQueue.h
    M Source/WebCore/workers/service/server/SWServerRegistration.cpp

  Log Message:
  -----------
  Merge r228101 - Layout Test imported/w3c/web-platform-tests/service-workers/service-worker/register-same-scope-different-script-url.https.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=181166
<rdar://problem/37169508>

Reviewed by Youenn Fablet.

Source/WebCore:

I found out that this test was flakily timing out because our jobQueues would sometimes get stuck
when their current job's connection or service worker (when scheduled by a service worker) would
go away before the job is complete.

This patch makes our job queues operation more robust by:
1. Cancelling all jobs from a given connection when a SWServerConnection goes away
2. Cancelling all jobs from a given service worker when a service worker gets terminated

We also make sure service workers created by a job get properly terminated when a job
is canceled to avoid leaving service workers in limbo.

No new tests, unskipped existing flaky test.

* workers/service/ServiceWorkerContainer.cpp:
(WebCore::ServiceWorkerContainer::addRegistration):
(WebCore::ServiceWorkerContainer::removeRegistration):
(WebCore::ServiceWorkerContainer::updateRegistration):
* workers/service/ServiceWorkerJobData.cpp:
(WebCore::ServiceWorkerJobData::ServiceWorkerJobData):
(WebCore::ServiceWorkerJobData::isolatedCopy const):
* workers/service/ServiceWorkerJobData.h:
(WebCore::ServiceWorkerJobData::encode const):
(WebCore::ServiceWorkerJobData::decode):
* workers/service/server/SWServer.cpp:
(WebCore::SWServer::startScriptFetch):
(WebCore::SWServer::scriptContextFailedToStart):
(WebCore::SWServer::scriptContextStarted):
(WebCore::SWServer::terminatePreinstallationWorker):
(WebCore::SWServer::installContextData):
(WebCore::SWServer::workerContextTerminated):
(WebCore::SWServer::unregisterConnection):
* workers/service/server/SWServer.h:
* workers/service/server/SWServerJobQueue.cpp:
(WebCore::SWServerJobQueue::removeAllJobsMatching):
(WebCore::SWServerJobQueue::cancelJobsFromConnection):
(WebCore::SWServerJobQueue::cancelJobsFromServiceWorker):
* workers/service/server/SWServerJobQueue.h:
* workers/service/server/SWServerRegistration.cpp:
(WebCore::SWServerRegistration::setPreInstallationWorker):

LayoutTests:

Unskip test that is no longer flaky.

* platform/mac-wk2/TestExpectations:


  Commit: 5cc013a62bdb311704b3ca01b12b8363b50ad9da
      https://github.com/WebKit/WebKit/commit/5cc013a62bdb311704b3ca01b12b8363b50ad9da
  Author: Commit Queue <commit-queue at webkit.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/builtins/ArrayPrototype.js

  Log Message:
  -----------
  Merge r228102 - Unreviewed, rolling out r228012.
https://bugs.webkit.org/show_bug.cgi?id=182493

"It regressed ARES-6 by 2-4%" (Requested by saamyjoon on

Reverted changeset:

"[JSC] Clean up ArraySpeciesCreate"
https://bugs.webkit.org/show_bug.cgi?id=182434
https://trac.webkit.org/changeset/228012


  Commit: 204640e8a52c5b358b2c6cfe928d90459a3e1608
      https://github.com/WebKit/WebKit/commit/204640e8a52c5b358b2c6cfe928d90459a3e1608
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/API/JSCallbackConstructor.h
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/disassembler/ARM64Disassembler.cpp
    M Source/JavaScriptCore/disassembler/ARMv7Disassembler.cpp
    M Source/JavaScriptCore/heap/LockDuringMarking.h
    M Source/JavaScriptCore/inspector/InjectedScriptBase.h
    M Source/JavaScriptCore/inspector/InjectedScriptHost.h
    M Source/JavaScriptCore/inspector/JavaScriptCallFrame.h
    M Source/JavaScriptCore/inspector/ScriptArguments.h
    M Source/JavaScriptCore/inspector/ScriptDebugListener.h
    M Source/JavaScriptCore/inspector/ScriptDebugServer.h
    M Source/JavaScriptCore/inspector/agents/InspectorAgent.h
    M Source/JavaScriptCore/inspector/agents/InspectorConsoleAgent.h
    M Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.h
    M Source/JavaScriptCore/inspector/agents/InspectorHeapAgent.h
    M Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.h
    M Source/JavaScriptCore/inspector/agents/InspectorScriptProfilerAgent.h
    M Source/JavaScriptCore/runtime/RegExp.h

  Log Message:
  -----------
  Merge r228105 - JavaScriptCore files should not be included relatively
https://bugs.webkit.org/show_bug.cgi?id=182452

Reviewed by Keith Miller.

* API/JSCallbackConstructor.h:
* CMakeLists.txt:
* disassembler/ARM64Disassembler.cpp:
* disassembler/ARMv7Disassembler.cpp:
* heap/LockDuringMarking.h:
* inspector/InjectedScriptBase.h:
* inspector/InjectedScriptHost.h:
* inspector/JavaScriptCallFrame.h:
* inspector/ScriptArguments.h:
* inspector/ScriptDebugListener.h:
* inspector/ScriptDebugServer.h:
* inspector/agents/InspectorAgent.h:
* inspector/agents/InspectorConsoleAgent.h:
* inspector/agents/InspectorDebuggerAgent.h:
* inspector/agents/InspectorHeapAgent.h:
* inspector/agents/InspectorRuntimeAgent.h:
* inspector/agents/InspectorScriptProfilerAgent.h:
* runtime/RegExp.h:


  Commit: cc4cb212b39b40e80b4553a053b7ad5d5beca118
      https://github.com/WebKit/WebKit/commit/cc4cb212b39b40e80b4553a053b7ad5d5beca118
  Author: Joseph Pecoraro <pecoraro at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/Heap.cpp
    M Source/bmalloc/bmalloc/IsoDirectoryInlines.h
    M Source/bmalloc/bmalloc/PerProcess.h
    M Source/bmalloc/bmalloc/Scavenger.cpp
    M Source/bmalloc/bmalloc/Scavenger.h
    M Source/bmalloc/bmalloc/bmalloc.cpp

  Log Message:
  -----------
  Merge r228107 - Multiple bmalloc scavenger threads is unexpected
https://bugs.webkit.org/show_bug.cgi?id=182474
<rdar://problem/37175526>

Patch by Joseph Pecoraro <pecoraro at apple.com> on 2018-02-05
Reviewed by Filip Pizlo.

* bmalloc/Heap.cpp:
(bmalloc::Heap::Heap):
* bmalloc/IsoDirectoryInlines.h:
(bmalloc::passedNumPages>::takeFirstEligible):
(bmalloc::passedNumPages>::didBecome):
* bmalloc/bmalloc.cpp:
(bmalloc::api::scavenge):
(bmalloc::api::setScavengerThreadQOSClass):
Switch to SafePerProcess for Scavenger to ensure one instance
for the entire process.

* bmalloc/PerProcess.h:
(bmalloc::PerProcess::get):
(bmalloc::PerProcess::getFastCase):
(bmalloc::PerProcess::getSlowCase):
(bmalloc::SafePerProcess::get):
(bmalloc::SafePerProcess::getFastCase):
(bmalloc::SafePerProcess::getSlowCase):
Duplicate the class with a version that can ensure
single instances by requiring exporting symbols that
can be created with macros.

* bmalloc/Scavenger.cpp:
* bmalloc/Scavenger.h:
Export symbols to ensure all images get the same instance.


  Commit: 49c224a372f73d3c47efd3336c5b135a7e1600dd
      https://github.com/WebKit/WebKit/commit/49c224a372f73d3c47efd3336c5b135a7e1600dd
  Author: JF Bastien <jfbastien at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/bmalloc/CMakeLists.txt
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc.xcodeproj/project.pbxproj
    M Source/bmalloc/bmalloc/BPlatform.h
    M Source/bmalloc/bmalloc/Gigacage.cpp
    A Source/bmalloc/bmalloc/ProcessCheck.h
    A Source/bmalloc/bmalloc/ProcessCheck.mm

  Log Message:
  -----------
  Merge r228108 - Gigacage: enable only for WebContent process and token executables
https://bugs.webkit.org/show_bug.cgi?id=182457
<rdar://problem/35875011>

Reviewed by Keith Miller.

Gigacage is a solid security improvement, but it's probably best
to roll it out incrementally to the most valuable targets first
and progressively try out more and more over time rather than
outright enabling it everywhere. We've gotten some reports that it
has some side-effects that weren't expected, so for now let's
enable it for the WebContent process, JSC, and other executables
we know, and then later we'll enable more gigacage uses.

For now I've chosen the following bundles:

  - com.apple.WebKit.WebContent.Development
  - com.apple.WebKit.WebContent
  - com.apple.WebProcess

And the following processes:

  - jsc
  - wasm
  - anything starting with "test", to match the JSC tests

I tried a different approach first, where I add a function to turn
gigacage on or off and crash if gigacage is initialized without
having been told what to do. Doing this in ChildProcess and a
bunch of the process initialization methods isn't sufficient. I
got MiniBrowser working, but some other builds use static globals
which themselves use hash and string which are allocate with
bmalloc and therefore which initialize gigacage before main is
called and before the process gets a chance to opt in our out. It
gets tricky with API calls too, because we have to do the right
thing in any entry an API user could plausibly use, even the
private ones, so I endend up having to initialize gigacage in e.g.
WebPreferencesExperimentalFeatures.cpp.erb.

Another approach could be to create a free-for-all gigacage
entitlement, and opt-in the processes we want..

As a follow-up we can also check that gigacage allocation always
succeeds if it was allowed for that process. With my change I
expect it to always succeed.

* CMakeLists.txt:
* bmalloc.xcodeproj/project.pbxproj:
* bmalloc/BPlatform.h:
* bmalloc/Gigacage.cpp:
(Gigacage::shouldBeEnabled):
* bmalloc/ProcessCheck.h: Added.
(bmalloc::gigacageEnabledForProcess):
* bmalloc/ProcessCheck.mm: Added.
(bmalloc::gigacageEnabledForProcess):


  Commit: 3d2a827ff591b7f50e228a73a0764aa35fcd925f
      https://github.com/WebKit/WebKit/commit/3d2a827ff591b7f50e228a73a0764aa35fcd925f
  Author: John Wilander <wilander at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access-expected.txt
    M LayoutTests/http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access.html
    M LayoutTests/platform/mac-wk2/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/NetworkStorageSession.h
    M Source/WebCore/platform/network/cf/NetworkStorageSessionCFNet.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/NetworkProcess.cpp
    M Source/WebKit/NetworkProcess/NetworkProcess.h
    M Source/WebKit/NetworkProcess/NetworkProcess.messages.in
    M Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm
    M Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in
    M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp
    M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.h
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
    M Tools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.h
    M Tools/WebKitTestRunner/TestController.cpp
    M Tools/WebKitTestRunner/TestController.h
    M Tools/WebKitTestRunner/TestInvocation.cpp
    M Tools/WebKitTestRunner/TestInvocation.h
    M Tools/WebKitTestRunner/cocoa/TestControllerCocoa.mm

  Log Message:
  -----------
  Merge r228109 - Storage Access API: Add testRunner.getAllStorageAccessEntries() to make testing easier and more explicit
https://bugs.webkit.org/show_bug.cgi?id=181601
<rdar://problem/36475837>

Reviewed by Alex Christensen.

Source/WebCore:

No new tests. Existing test updated.

http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access.html
was found to be flaky. With the testRunner.hasStorageAccessEntry() getter
it's possible to check access even if a frame doesn't respond timely to
postMessage after detach and attach.

* platform/network/NetworkStorageSession.h:
* platform/network/cf/NetworkStorageSessionCFNet.cpp:
(WebCore::NetworkStorageSession::getAllStorageAccessEntries const):

Source/WebKit:

http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access.html
was found to be flaky. With the testRunner.hasStorageAccessEntry() getter
it's possible to check access even if a frame doesn't respond timely to
postMessage after detach and attach.

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::getAllStorageAccessEntries):
* NetworkProcess/NetworkProcess.h:
* NetworkProcess/NetworkProcess.messages.in:
* UIProcess/API/Cocoa/WKWebsiteDataStore.mm:
(-[WKWebsiteDataStore _getAllStorageAccessEntries:]):
* UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:
* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::getAllStorageAccessEntries):
(WebKit::NetworkProcessProxy::allStorageAccessEntriesResult):
* UIProcess/Network/NetworkProcessProxy.h:
* UIProcess/Network/NetworkProcessProxy.messages.in:
* UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::getAllStorageAccessEntries):
* UIProcess/WebsiteData/WebsiteDataStore.h:

Tools:

http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access.html
was found to be flaky. With the testRunner.hasStorageAccessEntry() getter
it's possible to check access even if a frame doesn't respond timely to
postMessage after detach and attach.

* WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
* WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
(WTR::InjectedBundle::didReceiveMessageToPage):
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::setStorageAccessAPIEnabled):
    Just moved for source file grouping.
(WTR::TestRunner::getAllStorageAccessEntries):
(WTR::TestRunner::callDidReceiveAllStorageAccessEntriesCallback):
* WebKitTestRunner/InjectedBundle/TestRunner.h:
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::getAllStorageAccessEntries):
    Note that this is just stubbed out, i.e. not implemented.
* WebKitTestRunner/TestController.h:
* WebKitTestRunner/TestInvocation.cpp:
(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):
(WTR::TestInvocation::didReceiveAllStorageAccessEntries):
* WebKitTestRunner/TestInvocation.h:
* WebKitTestRunner/cocoa/TestControllerCocoa.mm:
(WTR::TestController::getAllStorageAccessEntries):
    This is the Cocoa-specific version of this test infrastructure.

LayoutTests:

http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access.html
was found to be flaky. With the testRunner.hasStorageAccessEntry() getter
it's possible to check access even if a frame doesn't respond timely to
postMessage after detach and attach.

* http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access-expected.txt:
* http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access.html:
* platform/mac-wk2/TestExpectations:
    http/tests/storageAccess/request-and-grant-access-then-navigate-should-not-have-access.html
    no longer marked as flaky. Note that the wrong test was marked flaky. It should have been
    http/tests/storageAccess/request-and-grant-access-then-detach-should-not-have-access.html.


  Commit: a16d1e6c790a856693b5b05d37fdc9749790a529
      https://github.com/WebKit/WebKit/commit/a16d1e6c790a856693b5b05d37fdc9749790a529
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/cache/CachedResourceClientWalker.h

  Log Message:
  -----------
  Merge r228110 - Make ASSERT_WITH_SECURITY_IMPLICATION in CachedResourceClientWalker::next a release assert
https://bugs.webkit.org/show_bug.cgi?id=182492

Reviewed by Youenn Fablet.

* loader/cache/CachedResourceClientWalker.h:
(WebCore::CachedResourceClientWalker::next):


  Commit: 8e4ef1af2f5993f167cc0fe9e65eea6d15ac21a7
      https://github.com/WebKit/WebKit/commit/8e4ef1af2f5993f167cc0fe9e65eea6d15ac21a7
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations

  Log Message:
  -----------
  Merge r228112 - Unreviewed GTK+ gardening.

* platform/gtk/TestExpectations: Re-skip the modern media controls tests
on the GTK+ port after they were unskipped in r228097. They're timing
out in large enough numbers to cause early exits. They should be
examined in more detail and unskipped once fixed.


  Commit: 7d4939963fdd979ca5846ecdb4c6cd037bde3a67
      https://github.com/WebKit/WebKit/commit/7d4939963fdd979ca5846ecdb4c6cd037bde3a67
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/domjit/generate-abstract-heap.rb

  Log Message:
  -----------
  Merge r228124 - Abstract heap generator should include JavaScriptCore headers directly
https://bugs.webkit.org/show_bug.cgi?id=182501

Reviewed by Alex Christensen.

No new tests. No change in behavior.

* domjit/generate-abstract-heap.rb:


  Commit: 7769cf4f09e07a614d3ec642e1f846ae2e07ca80
      https://github.com/WebKit/WebKit/commit/7769cf4f09e07a614d3ec642e1f846ae2e07ca80
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/Plugins/WebPluginInfoProvider.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp

  Log Message:
  -----------
  Merge r228125 - Add DoNotProcessIncomingMessagesWhenWaitingForSyncReply to GetPlugins and RootViewToScreen
https://bugs.webkit.org/show_bug.cgi?id=182458

Reviewed by Chris Dumez.

Added DoNotProcessIncomingMessagesWhenWaitingForSyncReply to GetPlugins and RootViewToScreen
which are found to get sent from WebContent process while ScriptDisallowedScope is present
by a work-in-progress patch on webkit.org/b/182449.

* WebProcess/Plugins/WebPluginInfoProvider.cpp:
(WebKit::WebPluginInfoProvider::populatePluginCache):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::rootViewToScreen):


  Commit: 962983d24c5ceb19d7922b141fb6ed67082c5220
      https://github.com/WebKit/WebKit/commit/962983d24c5ceb19d7922b141fb6ed67082c5220
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/Scripts/prepare-ChangeLog
    M Tools/Scripts/webkitperl/prepare-ChangeLog_unittest/resources/python_unittests-expected.txt
    M Tools/Scripts/webkitperl/prepare-ChangeLog_unittest/resources/python_unittests.py

  Log Message:
  -----------
  Merge r228131 - prepare-ChangeLog gets confused about Python docstrings that contain the word "class" or "def"
https://bugs.webkit.org/show_bug.cgi?id=182405

Reviewed by David Kilzer.

String literal statements, including docstrings, do not demarcate a new scope in Python.
So, do not treat them like they do when building up the list of modified functions.

* Scripts/prepare-ChangeLog:
(get_function_line_ranges_for_python):
* Scripts/webkitperl/prepare-ChangeLog_unittest/resources/python_unittests-expected.txt:
The expected ending line number for the last "pass" statement inside the scope of Class5 changed
from 97 to 98 because empty lines do not effect scope. This is consistent with the parsing
of the second "pass" statement in the scope of class Class5. A "pass" is a null operation that
is used as a syntactic placeholder when a statement is required. Ideally we would make
the parsing code smarter so as to avoid emitting ranges for "pass" statements that serve
not syntactic purpose.
* Scripts/webkitperl/prepare-ChangeLog_unittest/resources/python_unittests.py:
(Class5):
(Class6):
(Class6.__init__):
(Class7):
(Class7.__init__):
(Class8):
(Class8.__init__):
Add some more tests.


  Commit: b690e186d6b29da5b17e75e7a93284467c05e5d6
      https://github.com/WebKit/WebKit/commit/b690e186d6b29da5b17e75e7a93284467c05e5d6
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py
    M Tools/Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py
    M Tools/Scripts/webkitpy/layout_tests/servers/websocket_server.py
    M Tools/Scripts/webkitpy/port/base.py

  Log Message:
  -----------
  Merge r228133 - REGRESSION (r217572): run-webkit-tests exits without emitting newline character
https://bugs.webkit.org/show_bug.cgi?id=182360

Rubber-stamped by Aakash Jain.

Fixes an annoyance where run-webkit-tests always exits without printing a newline character.
In the terminal this looks like:

    $ Tools/Scripts/run-webkit-tests
    Expected to fail, but passed: (7)
    ...
    Stopping WebSocket server ...$

This bug was caused by code added in r217572 to stop all run-webkit-tests started servers (e.g. an HTTP
server) from an at-exit handler. When run-webkit-tests runs successfully (i.e. without error or
control-C interruption) we would stop all such servers twice: once as part of ending the test
run and once from the at-exit handler. The latter never prints a trailing newline character hence
the state of the terminal (as depicted above). Instead LayoutTestRunner.stop_servers() should only
stop servers that it started in LayoutTestRunner.start_servers().

* Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
(LayoutTestRunner.__init__):
(LayoutTestRunner.start_servers):
(LayoutTestRunner.stop_servers):
Only start servers that run-webkit-tests has not already started and only stop servers that
run-webkit-tests started.

* Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py:
(LayoutTestRunnerTests.test_servers_started.is_websocket_server_running):
(LayoutTestRunnerTests.test_servers_started):
(LayoutTestRunnerTests.test_servers_started.is_websocket_servers_running): Deleted.
Update due to rename below.

* Scripts/webkitpy/layout_tests/servers/websocket_server.py:
(is_web_socket_server_running): Added.
(PyWebSocket.is_running): Deleted.

* Scripts/webkitpy/port/base.py:
(Port.is_http_server_running): Check if we already started the server ourself.
(Port.is_websocket_server_running): Formerly named is_websocket_servers_running. Modified
to check if we already started the server ourself. Take a similar approach as the other
Port.is_*_running methods and only check if an existing WebSocket server is running on the
non-secure server port. This is a simple heuristic and should be sufficient in practice.
(Port.is_wpt_server_running): Check if we already started the server ourself.
(Port.is_websocket_servers_running): Deleted; renamed to is_websocket_server_running().


  Commit: 3667cfc4adf1cfc97be147451444e45ce4d9c232
      https://github.com/WebKit/WebKit/commit/3667cfc4adf1cfc97be147451444e45ce4d9c232
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsGTK.cmake
    M Source/cmake/WebKitCompilerFlags.cmake

  Log Message:
  -----------
  Merge r228134 - [CMake] Add ENABLE_ADDRESS_SANITIZER to make it easier to build with asan support
https://bugs.webkit.org/show_bug.cgi?id=182400

Reviewed by Konstantin Tokarev.

* Source/cmake/OptionsGTK.cmake:
* Source/cmake/WebKitCompilerFlags.cmake:


  Commit: 2e6ba1c69ee334a8c8e362ccdcca9b096baa6abf
      https://github.com/WebKit/WebKit/commit/2e6ba1c69ee334a8c8e362ccdcca9b096baa6abf
  Author: Konstantin Tokarev <annulen at yandex.ru>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/CMakeLists.txt

  Log Message:
  -----------
  Merge r228136 - [cmake] Fix build with ICU configured without collation support
https://bugs.webkit.org/show_bug.cgi?id=182498

Reviewed by Alex Christensen.

WebKit has CollatorDefault.cpp providing necessary stubs when
UCONFIG_NO_COLLATION is defined, however it is not included in cmake
file list.

* wtf/CMakeLists.txt:


  Commit: e036b79ec2288e39a3ad1e30a70ff6da422e7362
      https://github.com/WebKit/WebKit/commit/e036b79ec2288e39a3ad1e30a70ff6da422e7362
  Author: Youenn Fablet <youenn at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp

  Log Message:
  -----------
  Merge r228137 - WebsiteDataStore::resolveDirectoriesIfNecessary() should not overwrite its resolved serviceWorkerRegistrationDirectory  if already set
https://bugs.webkit.org/show_bug.cgi?id=182514

Patch by Youenn Fablet <youenn at apple.com> on 2018-02-05
Reviewed by Chris Dumez.

* UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::resolveDirectoriesIfNecessary):


  Commit: d5e5918e8918b242dcb53c353f625a9eb149ccb0
      https://github.com/WebKit/WebKit/commit/d5e5918e8918b242dcb53c353f625a9eb149ccb0
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/WebKitCompilerFlags.cmake

  Log Message:
  -----------
  Merge r228144 - Unreviewed, fix build using the new ENABLE_ADDRESS_SANITIZER option
https://bugs.webkit.org/show_bug.cgi?id=182400
<rdar://problem/37252242>

I failed to properly test a last-minute change.

* Source/cmake/WebKitCompilerFlags.cmake:


  Commit: c3031d541cd09d729b02f7dd75b1d1dd4dfbbdd2
      https://github.com/WebKit/WebKit/commit/c3031d541cd09d729b02f7dd75b1d1dd4dfbbdd2
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/JavaScriptCore/Sources.txt
    M Source/JavaScriptCore/heap/BlockDirectory.cpp
    M Source/JavaScriptCore/heap/BlockDirectory.h
    M Source/JavaScriptCore/heap/LocalAllocator.cpp
    M Source/JavaScriptCore/heap/LocalAllocator.h
    M Source/JavaScriptCore/heap/MarkStackMergingConstraint.cpp
    M Source/JavaScriptCore/heap/MarkStackMergingConstraint.h
    M Source/JavaScriptCore/heap/MarkedBlock.cpp
    M Source/JavaScriptCore/heap/MarkedBlock.h
    A Source/JavaScriptCore/heap/SecurityOriginToken.cpp
    A Source/JavaScriptCore/heap/SecurityOriginToken.h
    M Source/JavaScriptCore/heap/ThreadLocalCache.cpp
    M Source/JavaScriptCore/heap/ThreadLocalCache.h
    M Source/JavaScriptCore/heap/ThreadLocalCacheInlines.h
    M Source/JavaScriptCore/runtime/JSGlobalObject.h
    M Source/JavaScriptCore/runtime/VMEntryScope.cpp
    M Source/JavaScriptCore/runtime/VMEntryScope.h
    M Source/WebCore/ChangeLog
    A Source/WebCore/ForwardingHeaders/heap/ThreadLocalCache.h
    M Source/WebCore/Sources.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
    M Source/WebCore/bindings/js/JSDOMGlobalObject.h
    M Source/WebCore/bindings/js/JSDOMWindowBase.cpp
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    A Source/WebCore/page/OriginThreadLocalCache.cpp
    A Source/WebCore/page/OriginThreadLocalCache.h
    M Source/WebCore/page/SecurityOrigin.cpp
    M Source/WebCore/page/SecurityOrigin.h

  Log Message:
  -----------
  Merge r228149 - Global objects should be able to use TLCs to allocate from different blocks from each other
https://bugs.webkit.org/show_bug.cgi?id=182227

Source/JavaScriptCore:

Reviewed by JF Bastien.

This uses TLCs to create at least `minimumDistanceBetweenCellsFromDifferenOrigins` bytes of
distance between objects from different origins, using the following combination of things. For
short lets refer to that constant as K.

- Since r227721, LargeAllocation puts K bytes padding at the end of each allocation.

- Since r227718, MarkedBlock puts at least K bytes in its footer.

- Since r227617, global objects can have their own TLCs, which make them allocate from a
  different set of blocks than other global objects. The TLC of a global object comes into
  effect when you enter the VM via that global object.

- With this change, TLCs and blocks both have security origins. A TLC will only use blocks that
  share the same security origin or empty blocks (in which case we zero the block and change
  its security origin).

WebCore determines the TLC-GlobalObject mapping. By default, global objects would simply use
the VM's default TLC. WebCore makes it so that DOM windows (but not worker global objects) get
a TLC based on their document's SecurityOrigin.

* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* heap/BlockDirectory.cpp:
(JSC::BlockDirectory::findBlockForAllocation):
(JSC::BlockDirectory::prepareForAllocation):
* heap/BlockDirectory.h:
* heap/LocalAllocator.cpp:
(JSC::LocalAllocator::LocalAllocator):
(JSC::LocalAllocator::reset):
(JSC::LocalAllocator::~LocalAllocator):
(JSC::LocalAllocator::allocateSlowCase):
(JSC::LocalAllocator::tryAllocateWithoutCollecting):
* heap/LocalAllocator.h:
(JSC::LocalAllocator::tlc const):
* heap/MarkStackMergingConstraint.cpp:
* heap/MarkStackMergingConstraint.h:
* heap/MarkedBlock.cpp:
(JSC::MarkedBlock::Handle::associateWithOrigin):
* heap/MarkedBlock.h:
(JSC::MarkedBlock::Handle::securityOriginToken const):
* heap/SecurityOriginToken.cpp: Added.
(JSC::uniqueSecurityOriginToken):
* heap/SecurityOriginToken.h: Added.
* heap/ThreadLocalCache.cpp:
(JSC::ThreadLocalCache::create):
(JSC::ThreadLocalCache::ThreadLocalCache):
(JSC::ThreadLocalCache::allocateData):
(JSC::ThreadLocalCache::installSlow):
* heap/ThreadLocalCache.h:
(JSC::ThreadLocalCache::securityOriginToken const):
* heap/ThreadLocalCacheInlines.h:
(JSC::ThreadLocalCache::install):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
(JSC::JSGlobalObject::createThreadLocalCache):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::threadLocalCache):
(JSC::JSGlobalObject::threadLocalCache const): Deleted.
* runtime/VMEntryScope.cpp:
(JSC::VMEntryScope::VMEntryScope):
(JSC::VMEntryScope::~VMEntryScope):
* runtime/VMEntryScope.h:

Source/WebCore:

Reviewed by Daniel Bates and Chris Dumez.

No new tests because no change in behavior.

Adopt JSC TLC API to put distance between objects from different security origins. WebCore has
a subclass of ThreadLocalCache that supports hash-consing based on the relevant origin data
using the existing SecurityOriginHash. It's Document's job to initiate this, but all of the
logic is in WebCore::OriginThreadLocalCache.

Workers don't opt into this. They just get the VM's default TLC all the time.

* ForwardingHeaders/heap/ThreadLocalCache.h: Added.
* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* bindings/js/JSDOMGlobalObject.cpp:
(WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
* bindings/js/JSDOMGlobalObject.h:
* bindings/js/JSDOMWindowBase.cpp:
(WebCore::JSDOMWindowBase::JSDOMWindowBase):
* dom/Document.cpp:
(WebCore::Document::initSecurityContext):
(WebCore::Document::threadLocalCache):
* dom/Document.h:
* page/OriginThreadLocalCache.cpp: Added.
(WebCore::threadLocalCacheMap):
(WebCore::OriginThreadLocalCache::create):
(WebCore::OriginThreadLocalCache::~OriginThreadLocalCache):
(WebCore::OriginThreadLocalCache::OriginThreadLocalCache):
* page/OriginThreadLocalCache.h: Added.
* page/SecurityOrigin.cpp:
(WebCore::SecurityOrigin::passesFileCheck const):
(WebCore::SecurityOrigin::setEnforcesFilePathSeparation):
(WebCore::SecurityOrigin::toString const):
(WebCore::SecurityOrigin::enforceFilePathSeparation): Deleted.
* page/SecurityOrigin.h:
(WebCore::SecurityOrigin::enforcesFilePathSeparation const):


  Commit: 41efc3f6e1b1c7ef548a3b256f27e59cf027405a
      https://github.com/WebKit/WebKit/commit/41efc3f6e1b1c7ef548a3b256f27e59cf027405a
  Author: Guillaume Emont <guijemont at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Merge r228370 - [MIPS] JSC needs to be built with -latomic
https://bugs.webkit.org/show_bug.cgi?id=182610

Reviewed by Žan Doberšek.

Since r228149, on MIPS we need to link with -latomic, because
__atomic_fetch_add_8 is not available as a compiler intrinsic.

* CMakeLists.txt:


  Commit: a0d90cb8c5e05792a236cec3bb4a513f3b6c2416
      https://github.com/WebKit/WebKit/commit/a0d90cb8c5e05792a236cec3bb4a513f3b6c2416
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/html/MediaElementSession.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/cocoa/VideoFullscreenManager.mm

  Log Message:
  -----------
  Merge r228151 - Release assertion in inlineVideoFrame
https://bugs.webkit.org/show_bug.cgi?id=182513
<rdar://problem/37159363>

Reviewed by Zalan Bujtas.

Source/WebCore:

The bug was caused by the fact it's not always safe to invoke updateLayout even when isSafeToUpdateStyleOrLayout
on a document of a flattened frame on iOS. isSafeToUpdateStyleOrLayout returns true when the frame view is in
the frame-flattening mode to avoid hitting a release asssertion in updateLayout of the frame. However, it's still
not safe to invoke updateLayout on a parent frame in this case.

As a result, inlineVideoFrame (in Source/WebKit/WebProcess/cocoa/VideoFullscreenManager.mm) invokes updateLayout
even when the top-level document is not safe to update when the video element is in a frame-flattened document.

Fixed this bug by explicitly checking that we still have a live render tree and document hasn't been stopped.
Also replaced other uses of isSafeToUpdateStyleOrLayout by more explicit checks.

* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::updateBackingStore): Made the early exit condition added in r227006 more explicit.
Namely, InspectorDOMAgent::pseudoElementCreated is invoked during style recalc.
* dom/Document.cpp:
(WebCore::isSafeToUpdateStyleOrLayout): Made this local to the file.
(WebCore::Document::updateStyleIfNeeded):
(WebCore::Document::updateLayout):
* dom/Document.h:
* html/MediaElementSession.cpp:
(WebCore::isMainContentForPurposesOfAutoplay): Made the early exit condition added in r227529 more explicit. Don't
update the layout when the render tree had been destroyed or the active DOM objects had been stopped.

Source/WebKit:

Fixed the bug. Don't try to update the layout when there is no live render tree or active DOM objects
had been stopped: i.e. during a document destruction.

* WebProcess/cocoa/VideoFullscreenManager.mm:
(WebKit::inlineVideoFrame):


  Commit: 8918eb3471e3553e26a037f94d939e7db04169c1
      https://github.com/WebKit/WebKit/commit/8918eb3471e3553e26a037f94d939e7db04169c1
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/Connection.cpp

  Log Message:
  -----------
  Merge r228152 - Avoid unnecessarily constructing RunLoops for GC AutomaticThreads in Connection::sendMessage() after r228001
https://bugs.webkit.org/show_bug.cgi?id=182494
<rdar://problem/37147632>

Reviewed by Ryosuke Niwa.

Somebody fixed a GC crash in r228001 by allowing RunLoop::current() to be called from a
GC thread. However, this is still unnecessarily inefficient. Calling RunLoop::current()
will construct RunLoops for background GC threads (WTF::AutomaticThreads). This patches
updates the IPC code to call isMainThread() instead of RunLoop::isMain() in
Connection::sendMessage(). This should mean the same thing since this code runs in
WebKit2 and should be more efficient as it ends up simply calling pthread_main_np(),
without constructing a RunLoop.

* Platform/IPC/Connection.cpp:
(IPC::Connection::sendMessage):


  Commit: 646385008169cf332711374a48f59bd24f27e92e
      https://github.com/WebKit/WebKit/commit/646385008169cf332711374a48f59bd24f27e92e
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/RunLoop.cpp

  Log Message:
  -----------
  Merge r228154 - [GTK] fast/events/message-channel-gc-4.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=182104

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-06
Reviewed by Carlos Garcia Campos.

Revert r228001 because RunLoop::current isn't called in GC thread
anymore since r228152.

* wtf/RunLoop.cpp:
(WTF::RunLoop::current): Removed a template argument
CanBeGCThread::True of ThreadSpecific.


  Commit: 37d2ccef93cd66e339a2210491dde99209597367
      https://github.com/WebKit/WebKit/commit/37d2ccef93cd66e339a2210491dde99209597367
  Author: Andy Estes <aestes at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
    M Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
    M Source/WebCore/bindings/scripts/test/TestObj.idl

  Log Message:
  -----------
  Merge r228189 - [WebIDL] Support optional Promise arguments
https://bugs.webkit.org/show_bug.cgi?id=182399
<rdar://problem/36754552>

Reviewed by Sam Weinig and Chris Dumez.

Previously, declaring a Promise argument as optional would result in a native type of
std::optional<RefPtr<DOMPromise>>. This is wasteful, since RefPtr can represent an optional
argument by storing nullptr. Further, PassArgumentExpression() assumed Promises were never
optional and tried to pass the argument as a Ref by calling RefPtr::releaseNonNull().

This patch removes the std::optional wrapper around optional Promises and simply passes the
promise as a RefPtr to native code.

* bindings/scripts/CodeGeneratorJS.pm:
(PassArgumentExpression):
(GenerateParametersCheck):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalPromiseBody):
(WebCore::jsTestObjPrototypeFunctionMethodWithOptionalPromise):
* bindings/scripts/test/TestObj.idl:


  Commit: 79c9811394f86a1024fdd2b19725953b68907afb
      https://github.com/WebKit/WebKit/commit/79c9811394f86a1024fdd2b19725953b68907afb
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/var-injection-cache-invalidation.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssembler.cpp
    M Source/JavaScriptCore/assembler/MacroAssembler.h
    M Source/JavaScriptCore/jit/JITPropertyAccess.cpp
    M Source/JavaScriptCore/runtime/CommonSlowPaths.h
    M Source/JavaScriptCore/runtime/Options.h

  Log Message:
  -----------
  Merge r228193 - put_to_scope/get_from_scope should not cache lexical scopes when expecting a global object
https://bugs.webkit.org/show_bug.cgi?id=182549
<rdar://problem/36189995>

Reviewed by Saam Barati.

JSTests:

* stress/var-injection-cache-invalidation.js: Added.
(allocateLotsOfThings):
(test):

Source/JavaScriptCore:

Previously, the llint/baseline caching for put_to_scope and
get_from_scope would cache lexical environments when the
varInjectionWatchpoint had been fired for global properties. Code
in the DFG does not follow this same assumption so we could
potentially return the wrong result. Additionally, the baseline
would write barrier the global object rather than the lexical
enviroment object. This patch makes it so that we do not cache
anything other than the global object for when the resolve type is
GlobalPropertyWithVarInjectionChecks or GlobalProperty.

* assembler/MacroAssembler.cpp:
(JSC::MacroAssembler::jitAssert):
* assembler/MacroAssembler.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_from_scope):
(JSC::JIT::emit_op_put_to_scope):
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):
* runtime/Options.h:


  Commit: 7871337b65de0ee4381ef38360e1d9414618199e
      https://github.com/WebKit/WebKit/commit/7871337b65de0ee4381ef38360e1d9414618199e
  Author: BJ Burg <bburg at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_cpp_protocol_types_header.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py
    M Source/JavaScriptCore/inspector/scripts/codegen/generator.py
    M Source/JavaScriptCore/inspector/scripts/tests/all/expected/definitions-with-mac-platform.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/commands-with-async-attribute.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/commands-with-optional-call-return-parameters.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/definitions-with-mac-platform.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/domain-availability.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/domains-with-varying-command-sizes.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/enum-values.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/events-with-optional-parameters.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/generate-domains-with-feature-guards.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/same-type-id-different-domain.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/shadowed-optional-type-setters.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/type-declaration-aliased-primitive-type.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/type-declaration-array-type.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/type-declaration-enum-type.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/type-declaration-object-type.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/type-requiring-runtime-casts.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/type-with-open-parameters.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/generic/expected/worker-supported-domains.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/ios/expected/definitions-with-mac-platform.json-result
    M Source/JavaScriptCore/inspector/scripts/tests/mac/expected/definitions-with-mac-platform.json-result

  Log Message:
  -----------
  Merge r228196 - Web Inspector: protocol generator should automatically deduce the correct include style to use
https://bugs.webkit.org/show_bug.cgi?id=182505

Reviewed by Timothy Hatcher.

Currently the generated imports use a mix of system header imports (powered by forwarding headers)
and framework-style includes. Since forwarding headers are going away, this patch stops
using system header includes for headers that are JavaScriptCore private headers. Instead,
use either a relative include or a framework include.

* inspector/scripts/codegen/generate_cpp_alternate_backend_dispatcher_header.py:
(CppAlternateBackendDispatcherHeaderGenerator.generate_output):
(CppAlternateBackendDispatcherHeaderGenerator):
(CppAlternateBackendDispatcherHeaderGenerator._generate_secondary_header_includes):
* inspector/scripts/codegen/generate_cpp_backend_dispatcher_header.py:
(CppBackendDispatcherHeaderGenerator.generate_output):
(CppBackendDispatcherHeaderGenerator._generate_secondary_header_includes):
* inspector/scripts/codegen/generate_cpp_backend_dispatcher_implementation.py:
(CppBackendDispatcherImplementationGenerator.generate_output):
(CppBackendDispatcherImplementationGenerator._generate_secondary_header_includes):
* inspector/scripts/codegen/generate_cpp_frontend_dispatcher_header.py:
(CppFrontendDispatcherHeaderGenerator.generate_output):
(CppFrontendDispatcherHeaderGenerator._generate_secondary_header_includes):
* inspector/scripts/codegen/generate_cpp_frontend_dispatcher_implementation.py:
(CppFrontendDispatcherImplementationGenerator.generate_output):
(CppFrontendDispatcherImplementationGenerator._generate_secondary_header_includes):
* inspector/scripts/codegen/generate_cpp_protocol_types_header.py:
(CppProtocolTypesHeaderGenerator.generate_output):
(CppProtocolTypesHeaderGenerator._generate_secondary_header_includes):
* inspector/scripts/codegen/generate_cpp_protocol_types_implementation.py:
(CppProtocolTypesImplementationGenerator.generate_output):
(CppProtocolTypesImplementationGenerator._generate_secondary_header_includes):
* inspector/scripts/codegen/generate_objc_backend_dispatcher_header.py:
(ObjCBackendDispatcherHeaderGenerator):
Convert existing header lists to the new entries format, which includes the
allowable target frameworks and the relative path to the header.

* inspector/scripts/codegen/generator.py:
(Generator.generate_includes_from_entries):
Copied from the same in the builtins code generator. It still works great.

* inspector/scripts/tests/all/expected/definitions-with-mac-platform.json-result:
* inspector/scripts/tests/generic/expected/commands-with-async-attribute.json-result:
* inspector/scripts/tests/generic/expected/commands-with-optional-call-return-parameters.json-result:
* inspector/scripts/tests/generic/expected/definitions-with-mac-platform.json-result:
* inspector/scripts/tests/generic/expected/domain-availability.json-result:
* inspector/scripts/tests/generic/expected/domains-with-varying-command-sizes.json-result:
* inspector/scripts/tests/generic/expected/enum-values.json-result:
* inspector/scripts/tests/generic/expected/events-with-optional-parameters.json-result:
* inspector/scripts/tests/generic/expected/generate-domains-with-feature-guards.json-result:
* inspector/scripts/tests/generic/expected/same-type-id-different-domain.json-result:
* inspector/scripts/tests/generic/expected/shadowed-optional-type-setters.json-result:
* inspector/scripts/tests/generic/expected/type-declaration-aliased-primitive-type.json-result:
* inspector/scripts/tests/generic/expected/type-declaration-array-type.json-result:
* inspector/scripts/tests/generic/expected/type-declaration-enum-type.json-result:
* inspector/scripts/tests/generic/expected/type-declaration-object-type.json-result:
* inspector/scripts/tests/generic/expected/type-requiring-runtime-casts.json-result:
* inspector/scripts/tests/generic/expected/type-with-open-parameters.json-result:
* inspector/scripts/tests/generic/expected/worker-supported-domains.json-result:
* inspector/scripts/tests/ios/expected/definitions-with-mac-platform.json-result:
* inspector/scripts/tests/mac/expected/definitions-with-mac-platform.json-result:
Rebaseline.


  Commit: 54c8779dd819a3214fcc978554db8af3528e5c26
      https://github.com/WebKit/WebKit/commit/54c8779dd819a3214fcc978554db8af3528e5c26
  Author: Youenn Fablet <youenn at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/LinkLoader.cpp
    M Source/WebCore/loader/LinkPreloadResourceClients.h

  Log Message:
  -----------
  Merge r228201 - Use downcast in createLinkPreloadResourceClient
https://bugs.webkit.org/show_bug.cgi?id=182488

Patch by Youenn Fablet <youenn at apple.com> on 2018-02-06
Reviewed by Antti Koivisto.

No observable change of behavior.
Add a new link preloader client for text track.

* loader/LinkLoader.cpp:
(WebCore::createLinkPreloadResourceClient):
* loader/LinkPreloadResourceClients.h:


  Commit: cba0363e92efe1710fd902840c61c673b101f221
      https://github.com/WebKit/WebKit/commit/cba0363e92efe1710fd902840c61c673b101f221
  Author: Ross Kirsling <ross.kirsling at sony.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/LinkPreloadResourceClients.h

  Log Message:
  -----------
  Merge r228248 - Add missing #if ENABLE(VIDEO_TRACK) after r228201.
https://bugs.webkit.org/show_bug.cgi?id=182585

Reviewed by Chris Dumez.

* loader/LinkPreloadResourceClients.h:


  Commit: 64ff09fd9f80cbc51d06356f9d4b96bab61fc92c
      https://github.com/WebKit/WebKit/commit/64ff09fd9f80cbc51d06356f9d4b96bab61fc92c
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/webgl/webgl-texture-image-buffer-reuse-expected.html
    A LayoutTests/webgl/webgl-texture-image-buffer-reuse.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp

  Log Message:
  -----------
  Merge r228213 - Rendering SVG images with same size as WebGL texture doesn't work correctly
https://bugs.webkit.org/show_bug.cgi?id=182367

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2018-02-06
Reviewed by Dean Jackson.

Source/WebCore:

If am image buffer is created for a webgl texture and then it is reused
for another texture, it has to be cleared before drawing.

Test: webgl/webgl-texture-image-buffer-reuse.html

* html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::LRUImageBufferCache::imageBuffer):

LayoutTests:

* webgl/webgl-texture-image-buffer-reuse-expected.html: Added.
* webgl/webgl-texture-image-buffer-reuse.html: Added.


  Commit: 76e4c0b52ec3ec91e60ae9aa4beda09f6d506fec
      https://github.com/WebKit/WebKit/commit/76e4c0b52ec3ec91e60ae9aa4beda09f6d506fec
  Author: Nikita Vasilyev <nvasilyev at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/inspector/unit-tests/string-utilities-expected.txt
    M LayoutTests/inspector/unit-tests/string-utilities.html
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Base/Utilities.js
    M Source/WebInspectorUI/UserInterface/Views/DOMTreeElement.js
    M Source/WebInspectorUI/UserInterface/Views/DOMTreeElementPathComponent.js
    M Source/WebInspectorUI/UserInterface/Views/SearchResultTreeElement.js
    M Source/WebInspectorUI/UserInterface/Views/SpreadsheetStyleProperty.js

  Log Message:
  -----------
  Merge r228214 - Web Inspector: Rename String.prototype.trimEnd to avoid conflicts with native trimEnd
https://bugs.webkit.org/show_bug.cgi?id=182545

Reviewed by Brian Burg.

Source/WebInspectorUI:

Rename:
- trimEnd to truncateEnd
- trimMiddle to truncateMiddle

* UserInterface/Base/Utilities.js:
(String.prototype.trimMiddle): Deleted.
(String.prototype.trimEnd): Deleted.
(String.prototype.truncateMiddle): Added.
(String.prototype.truncateEnd): Added.
Use strict mode. Scrict mode allows `this` to be a primitive (a string, in our case).
In non-strict mode, `this` is always an object. Without the strict mode,
"a".truncateEnd(42) !== "a", because truncateEnd returns a string object.

* UserInterface/Views/DOMTreeElement.js:
(WI.DOMTreeElement.prototype._buildAttributeDOM):
* UserInterface/Views/DOMTreeElementPathComponent.js:
(WI.DOMTreeElementPathComponent):
* UserInterface/Views/SearchResultTreeElement.js:
Remove an obvious comment.

(WI.SearchResultTreeElement.truncateAndHighlightTitle):
* UserInterface/Views/SpreadsheetStyleProperty.js:
(WI.SpreadsheetStyleProperty.prototype._renderValue):

LayoutTests:

* inspector/unit-tests/string-utilities-expected.txt:
* inspector/unit-tests/string-utilities.html:


  Commit: 918f881f7c2dd0eed8786c5d76872c836a28cba9
      https://github.com/WebKit/WebKit/commit/918f881f7c2dd0eed8786c5d76872c836a28cba9
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/ThirdParty/ChangeLog
    M Source/ThirdParty/gtest/CMakeLists.txt
    M Source/ThirdParty/gtest/include/gtest/internal/gtest-port.h
    M Source/WebCore/CMakeLists.txt
    M Source/WebCore/ChangeLog
    R Source/WebCore/ForwardingHeaders/bindings/ScriptFunctionCall.h
    R Source/WebCore/ForwardingHeaders/bindings/ScriptObject.h
    R Source/WebCore/ForwardingHeaders/bindings/ScriptValue.h
    R Source/WebCore/ForwardingHeaders/builtins/BuiltinNames.h
    R Source/WebCore/ForwardingHeaders/builtins/BuiltinUtils.h
    R Source/WebCore/ForwardingHeaders/builtins/JSCBuiltins.h
    R Source/WebCore/ForwardingHeaders/bytecode/CodeBlock.h
    R Source/WebCore/ForwardingHeaders/bytecode/SpeculatedType.h
    R Source/WebCore/ForwardingHeaders/bytecode/UnlinkedFunctionExecutable.h
    R Source/WebCore/ForwardingHeaders/debugger/Debugger.h
    R Source/WebCore/ForwardingHeaders/domjit/DOMJITAbstractHeap.h
    R Source/WebCore/ForwardingHeaders/domjit/DOMJITEffect.h
    R Source/WebCore/ForwardingHeaders/domjit/DOMJITGetterSetter.h
    R Source/WebCore/ForwardingHeaders/domjit/DOMJITHeapRange.h
    R Source/WebCore/ForwardingHeaders/domjit/DOMJITSignature.h
    R Source/WebCore/ForwardingHeaders/heap/BlockDirectoryInlines.h
    R Source/WebCore/ForwardingHeaders/heap/DeleteAllCodeEffort.h
    R Source/WebCore/ForwardingHeaders/heap/FastMallocAlignedMemoryAllocator.h
    R Source/WebCore/ForwardingHeaders/heap/GCActivityCallback.h
    R Source/WebCore/ForwardingHeaders/heap/GCFinalizationCallback.h
    R Source/WebCore/ForwardingHeaders/heap/HandleTypes.h
    R Source/WebCore/ForwardingHeaders/heap/Heap.h
    R Source/WebCore/ForwardingHeaders/heap/HeapInlines.h
    R Source/WebCore/ForwardingHeaders/heap/HeapObserver.h
    R Source/WebCore/ForwardingHeaders/heap/IncrementalSweeper.h
    R Source/WebCore/ForwardingHeaders/heap/LockDuringMarking.h
    R Source/WebCore/ForwardingHeaders/heap/MachineStackMarker.h
    R Source/WebCore/ForwardingHeaders/heap/MarkedBlockInlines.h
    R Source/WebCore/ForwardingHeaders/heap/MarkingConstraint.h
    R Source/WebCore/ForwardingHeaders/heap/RunningScope.h
    R Source/WebCore/ForwardingHeaders/heap/SimpleMarkingConstraint.h
    R Source/WebCore/ForwardingHeaders/heap/SlotVisitor.h
    R Source/WebCore/ForwardingHeaders/heap/SlotVisitorInlines.h
    R Source/WebCore/ForwardingHeaders/heap/Strong.h
    R Source/WebCore/ForwardingHeaders/heap/StrongInlines.h
    R Source/WebCore/ForwardingHeaders/heap/SubspaceInlines.h
    R Source/WebCore/ForwardingHeaders/heap/ThreadLocalCache.h
    R Source/WebCore/ForwardingHeaders/heap/Weak.h
    R Source/WebCore/ForwardingHeaders/heap/WeakInlines.h
    R Source/WebCore/ForwardingHeaders/inspector/ConsoleMessage.h
    R Source/WebCore/ForwardingHeaders/inspector/ContentSearchUtilities.h
    R Source/WebCore/ForwardingHeaders/inspector/IdentifiersFactory.h
    R Source/WebCore/ForwardingHeaders/inspector/InjectedScript.h
    R Source/WebCore/ForwardingHeaders/inspector/InjectedScriptBase.h
    R Source/WebCore/ForwardingHeaders/inspector/InjectedScriptHost.h
    R Source/WebCore/ForwardingHeaders/inspector/InjectedScriptManager.h
    R Source/WebCore/ForwardingHeaders/inspector/InjectedScriptModule.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorAgentBase.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorAgentRegistry.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorBackendDispatcher.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorBackendDispatchers.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorEnvironment.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorFrontendChannel.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorFrontendDispatchers.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorFrontendRouter.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorProtocolObjects.h
    R Source/WebCore/ForwardingHeaders/inspector/InspectorProtocolTypes.h
    R Source/WebCore/ForwardingHeaders/inspector/PerGlobalObjectWrapperWorld.h
    R Source/WebCore/ForwardingHeaders/inspector/ScriptArguments.h
    R Source/WebCore/ForwardingHeaders/inspector/ScriptBreakpoint.h
    R Source/WebCore/ForwardingHeaders/inspector/ScriptCallFrame.h
    R Source/WebCore/ForwardingHeaders/inspector/ScriptCallStack.h
    R Source/WebCore/ForwardingHeaders/inspector/ScriptCallStackFactory.h
    R Source/WebCore/ForwardingHeaders/inspector/ScriptDebugListener.h
    R Source/WebCore/ForwardingHeaders/inspector/ScriptDebugServer.h
    R Source/WebCore/ForwardingHeaders/inspector/agents/InspectorAgent.h
    R Source/WebCore/ForwardingHeaders/inspector/agents/InspectorConsoleAgent.h
    R Source/WebCore/ForwardingHeaders/inspector/agents/InspectorDebuggerAgent.h
    R Source/WebCore/ForwardingHeaders/inspector/agents/InspectorHeapAgent.h
    R Source/WebCore/ForwardingHeaders/inspector/agents/InspectorRuntimeAgent.h
    R Source/WebCore/ForwardingHeaders/inspector/agents/InspectorScriptProfilerAgent.h
    R Source/WebCore/ForwardingHeaders/interpreter/CallFrame.h
    R Source/WebCore/ForwardingHeaders/interpreter/FrameTracers.h
    R Source/WebCore/ForwardingHeaders/interpreter/ShadowChicken.h
    R Source/WebCore/ForwardingHeaders/interpreter/StackVisitor.h
    R Source/WebCore/ForwardingHeaders/jit/JITCode.h
    R Source/WebCore/ForwardingHeaders/jit/JITMathICForwards.h
    R Source/WebCore/ForwardingHeaders/jit/Snippet.h
    R Source/WebCore/ForwardingHeaders/jit/SnippetParams.h
    R Source/WebCore/ForwardingHeaders/jit/SpillRegistersMode.h
    R Source/WebCore/ForwardingHeaders/masm/X86Assembler.h
    R Source/WebCore/ForwardingHeaders/parser/ParserError.h
    R Source/WebCore/ForwardingHeaders/parser/SourceCode.h
    R Source/WebCore/ForwardingHeaders/parser/SourceProvider.h
    R Source/WebCore/ForwardingHeaders/parser/SourceProviderCache.h
    R Source/WebCore/ForwardingHeaders/profiler/ProfilerDatabase.h
    R Source/WebCore/ForwardingHeaders/runtime/ArgList.h
    R Source/WebCore/ForwardingHeaders/runtime/ArrayBuffer.h
    R Source/WebCore/ForwardingHeaders/runtime/ArrayBufferView.h
    R Source/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
    R Source/WebCore/ForwardingHeaders/runtime/AuxiliaryBarrierInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/BooleanObject.h
    R Source/WebCore/ForwardingHeaders/runtime/CallData.h
    R Source/WebCore/ForwardingHeaders/runtime/CatchScope.h
    R Source/WebCore/ForwardingHeaders/runtime/CommonIdentifiers.h
    R Source/WebCore/ForwardingHeaders/runtime/Completion.h
    R Source/WebCore/ForwardingHeaders/runtime/ConfigFile.h
    R Source/WebCore/ForwardingHeaders/runtime/ConsoleClient.h
    R Source/WebCore/ForwardingHeaders/runtime/ConsoleTypes.h
    R Source/WebCore/ForwardingHeaders/runtime/ConstructAbility.h
    R Source/WebCore/ForwardingHeaders/runtime/ConstructData.h
    R Source/WebCore/ForwardingHeaders/runtime/DataView.h
    R Source/WebCore/ForwardingHeaders/runtime/DateInstance.h
    R Source/WebCore/ForwardingHeaders/runtime/Error.h
    R Source/WebCore/ForwardingHeaders/runtime/ErrorHandlingScope.h
    R Source/WebCore/ForwardingHeaders/runtime/ErrorInstance.h
    R Source/WebCore/ForwardingHeaders/runtime/ErrorPrototype.h
    R Source/WebCore/ForwardingHeaders/runtime/Exception.h
    R Source/WebCore/ForwardingHeaders/runtime/ExceptionHelpers.h
    R Source/WebCore/ForwardingHeaders/runtime/Float32Array.h
    R Source/WebCore/ForwardingHeaders/runtime/Float64Array.h
    R Source/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
    R Source/WebCore/ForwardingHeaders/runtime/FunctionExecutable.h
    R Source/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
    R Source/WebCore/ForwardingHeaders/runtime/HashMapImpl.h
    R Source/WebCore/ForwardingHeaders/runtime/Identifier.h
    R Source/WebCore/ForwardingHeaders/runtime/IdentifierInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
    R Source/WebCore/ForwardingHeaders/runtime/Int16Array.h
    R Source/WebCore/ForwardingHeaders/runtime/Int32Array.h
    R Source/WebCore/ForwardingHeaders/runtime/Int8Array.h
    R Source/WebCore/ForwardingHeaders/runtime/InternalFunction.h
    R Source/WebCore/ForwardingHeaders/runtime/Intrinsic.h
    R Source/WebCore/ForwardingHeaders/runtime/IterationKind.h
    R Source/WebCore/ForwardingHeaders/runtime/IteratorOperations.h
    R Source/WebCore/ForwardingHeaders/runtime/IteratorPrototype.h
    R Source/WebCore/ForwardingHeaders/runtime/JSAPIValueWrapper.h
    R Source/WebCore/ForwardingHeaders/runtime/JSArray.h
    R Source/WebCore/ForwardingHeaders/runtime/JSArrayBuffer.h
    R Source/WebCore/ForwardingHeaders/runtime/JSArrayBufferView.h
    R Source/WebCore/ForwardingHeaders/runtime/JSCInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/JSCJSValue.h
    R Source/WebCore/ForwardingHeaders/runtime/JSCJSValueInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/JSCallee.h
    R Source/WebCore/ForwardingHeaders/runtime/JSCell.h
    R Source/WebCore/ForwardingHeaders/runtime/JSCellInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/JSDataView.h
    R Source/WebCore/ForwardingHeaders/runtime/JSDestructibleObject.h
    R Source/WebCore/ForwardingHeaders/runtime/JSDestructibleObjectHeapCellType.h
    R Source/WebCore/ForwardingHeaders/runtime/JSExportMacros.h
    R Source/WebCore/ForwardingHeaders/runtime/JSFunction.h
    R Source/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
    R Source/WebCore/ForwardingHeaders/runtime/JSGlobalObjectInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/JSInternalPromise.h
    R Source/WebCore/ForwardingHeaders/runtime/JSInternalPromiseDeferred.h
    R Source/WebCore/ForwardingHeaders/runtime/JSLock.h
    R Source/WebCore/ForwardingHeaders/runtime/JSMap.h
    R Source/WebCore/ForwardingHeaders/runtime/JSMapIterator.h
    R Source/WebCore/ForwardingHeaders/runtime/JSModuleLoader.h
    R Source/WebCore/ForwardingHeaders/runtime/JSModuleRecord.h
    R Source/WebCore/ForwardingHeaders/runtime/JSNativeStdFunction.h
    R Source/WebCore/ForwardingHeaders/runtime/JSONObject.h
    R Source/WebCore/ForwardingHeaders/runtime/JSObject.h
    R Source/WebCore/ForwardingHeaders/runtime/JSObjectInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/JSPromise.h
    R Source/WebCore/ForwardingHeaders/runtime/JSPromiseConstructor.h
    R Source/WebCore/ForwardingHeaders/runtime/JSPromiseDeferred.h
    R Source/WebCore/ForwardingHeaders/runtime/JSProxy.h
    R Source/WebCore/ForwardingHeaders/runtime/JSRunLoopTimer.h
    R Source/WebCore/ForwardingHeaders/runtime/JSScriptFetchParameters.h
    R Source/WebCore/ForwardingHeaders/runtime/JSScriptFetcher.h
    R Source/WebCore/ForwardingHeaders/runtime/JSSegmentedVariableObjectHeapCellType.h
    R Source/WebCore/ForwardingHeaders/runtime/JSSet.h
    R Source/WebCore/ForwardingHeaders/runtime/JSSetIterator.h
    R Source/WebCore/ForwardingHeaders/runtime/JSSourceCode.h
    R Source/WebCore/ForwardingHeaders/runtime/JSString.h
    R Source/WebCore/ForwardingHeaders/runtime/JSTypedArrays.h
    R Source/WebCore/ForwardingHeaders/runtime/JSWithScope.h
    R Source/WebCore/ForwardingHeaders/runtime/Lookup.h
    R Source/WebCore/ForwardingHeaders/runtime/MapBase.h
    R Source/WebCore/ForwardingHeaders/runtime/MapData.h
    R Source/WebCore/ForwardingHeaders/runtime/MapDataInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/MatchResult.h
    R Source/WebCore/ForwardingHeaders/runtime/Microtask.h
    R Source/WebCore/ForwardingHeaders/runtime/ObjectConstructor.h
    R Source/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
    R Source/WebCore/ForwardingHeaders/runtime/Operations.h
    R Source/WebCore/ForwardingHeaders/runtime/PrivateName.h
    R Source/WebCore/ForwardingHeaders/runtime/PromiseDeferredTimer.h
    R Source/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
    R Source/WebCore/ForwardingHeaders/runtime/Protect.h
    R Source/WebCore/ForwardingHeaders/runtime/RegExp.h
    R Source/WebCore/ForwardingHeaders/runtime/RegExpObject.h
    R Source/WebCore/ForwardingHeaders/runtime/RuntimeFlags.h
    R Source/WebCore/ForwardingHeaders/runtime/SamplingProfiler.h
    R Source/WebCore/ForwardingHeaders/runtime/ScriptFetchParameters.h
    R Source/WebCore/ForwardingHeaders/runtime/ScriptFetcher.h
    R Source/WebCore/ForwardingHeaders/runtime/StringObject.h
    R Source/WebCore/ForwardingHeaders/runtime/StringPrototype.h
    R Source/WebCore/ForwardingHeaders/runtime/Structure.h
    R Source/WebCore/ForwardingHeaders/runtime/StructureChain.h
    R Source/WebCore/ForwardingHeaders/runtime/StructureInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/Symbol.h
    R Source/WebCore/ForwardingHeaders/runtime/SymbolTable.h
    R Source/WebCore/ForwardingHeaders/runtime/ThrowScope.h
    R Source/WebCore/ForwardingHeaders/runtime/TypedArrayController.h
    R Source/WebCore/ForwardingHeaders/runtime/TypedArrayInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/TypedArrays.h
    R Source/WebCore/ForwardingHeaders/runtime/Uint16Array.h
    R Source/WebCore/ForwardingHeaders/runtime/Uint32Array.h
    R Source/WebCore/ForwardingHeaders/runtime/Uint8Array.h
    R Source/WebCore/ForwardingHeaders/runtime/Uint8ClampedArray.h
    R Source/WebCore/ForwardingHeaders/runtime/VM.h
    R Source/WebCore/ForwardingHeaders/runtime/VMEntryScope.h
    R Source/WebCore/ForwardingHeaders/runtime/Watchdog.h
    R Source/WebCore/ForwardingHeaders/runtime/WeakGCMap.h
    R Source/WebCore/ForwardingHeaders/runtime/WeakGCMapInlines.h
    R Source/WebCore/ForwardingHeaders/runtime/WriteBarrier.h
    R Source/WebCore/ForwardingHeaders/wasm/WasmModule.h
    R Source/WebCore/ForwardingHeaders/wasm/js/JSWebAssemblyModule.h
    R Source/WebCore/ForwardingHeaders/yarr/RegularExpression.h
    R Source/WebCore/ForwardingHeaders/yarr/Yarr.h
    R Source/WebCore/ForwardingHeaders/yarr/YarrInterpreter.h
    R Source/WebCore/ForwardingHeaders/yarr/YarrJIT.h
    R Source/WebCore/ForwardingHeaders/yarr/YarrPattern.h
    M Source/WebCore/Modules/applepay/cocoa/PaymentMerchantSessionCocoa.mm
    M Source/WebCore/Modules/encryptedmedia/MediaKeyMessageEvent.h
    M Source/WebCore/Modules/encryptedmedia/MediaKeyMessageEventInit.h
    M Source/WebCore/Modules/encryptedmedia/MediaKeyStatusMap.h
    M Source/WebCore/Modules/encryptedmedia/legacy/LegacyCDM.h
    M Source/WebCore/Modules/encryptedmedia/legacy/LegacyCDMSessionClearKey.cpp
    M Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeyMessageEvent.cpp
    M Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeyNeededEvent.cpp
    M Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeySession.h
    M Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeys.h
    M Source/WebCore/Modules/fetch/FetchBody.cpp
    M Source/WebCore/Modules/fetch/FetchRequestInit.h
    M Source/WebCore/Modules/fetch/FetchResponse.h
    M Source/WebCore/Modules/indexeddb/IDBCursor.cpp
    M Source/WebCore/Modules/indexeddb/IDBCursor.h
    M Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
    M Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
    M Source/WebCore/Modules/indexeddb/IDBIndex.cpp
    M Source/WebCore/Modules/indexeddb/IDBKey.cpp
    M Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp
    M Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequest.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequest.h
    M Source/WebCore/Modules/indexeddb/client/TransactionOperation.cpp
    M Source/WebCore/Modules/indexeddb/server/MemoryObjectStore.cpp
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp
    M Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp
    M Source/WebCore/Modules/mediacontrols/MediaControlsHost.cpp
    M Source/WebCore/Modules/mediasource/SourceBuffer.cpp
    M Source/WebCore/Modules/mediastream/RTCDataChannel.cpp
    M Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm
    M Source/WebCore/Modules/webaudio/AsyncAudioDecoder.cpp
    M Source/WebCore/Modules/webaudio/AudioBuffer.cpp
    M Source/WebCore/Modules/webaudio/AudioBuffer.h
    M Source/WebCore/Modules/webaudio/AudioContext.cpp
    M Source/WebCore/Modules/webaudio/AudioContext.h
    M Source/WebCore/Modules/webaudio/AudioParam.h
    M Source/WebCore/Modules/webaudio/AudioParamTimeline.h
    M Source/WebCore/Modules/webaudio/PeriodicWave.h
    M Source/WebCore/Modules/webaudio/RealtimeAnalyser.cpp
    M Source/WebCore/Modules/webaudio/RealtimeAnalyser.h
    M Source/WebCore/Modules/webaudio/ScriptProcessorNode.cpp
    M Source/WebCore/Modules/webaudio/WaveShaperProcessor.h
    M Source/WebCore/Modules/webauthn/AuthenticatorResponse.h
    M Source/WebCore/Modules/webauthn/PublicKeyCredential.h
    M Source/WebCore/Modules/websockets/WebSocket.cpp
    M Source/WebCore/Modules/websockets/WebSocketChannel.cpp
    M Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
    M Source/WebCore/Modules/webvr/VREyeParameters.h
    M Source/WebCore/Modules/webvr/VRFrameData.h
    M Source/WebCore/Modules/webvr/VRPose.h
    M Source/WebCore/Modules/webvr/VRStageParameters.h
    M Source/WebCore/PlatformWin.cmake
    M Source/WebCore/bindings/IDLTypes.h
    M Source/WebCore/bindings/js/BufferSource.h
    M Source/WebCore/bindings/js/CachedScriptFetcher.h
    M Source/WebCore/bindings/js/CachedScriptSourceProvider.h
    M Source/WebCore/bindings/js/CallTracerTypes.h
    M Source/WebCore/bindings/js/CommonVM.cpp
    M Source/WebCore/bindings/js/DOMGCOutputConstraint.cpp
    M Source/WebCore/bindings/js/DOMGCOutputConstraint.h
    M Source/WebCore/bindings/js/GCController.cpp
    M Source/WebCore/bindings/js/GCController.h
    M Source/WebCore/bindings/js/IDBBindingUtilities.cpp
    M Source/WebCore/bindings/js/JSCallbackData.cpp
    M Source/WebCore/bindings/js/JSCallbackData.h
    M Source/WebCore/bindings/js/JSCustomElementInterface.cpp
    M Source/WebCore/bindings/js/JSCustomElementInterface.h
    M Source/WebCore/bindings/js/JSCustomEventCustom.cpp
    M Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
    M Source/WebCore/bindings/js/JSCustomXPathNSResolver.h
    M Source/WebCore/bindings/js/JSDOMBinding.h
    M Source/WebCore/bindings/js/JSDOMBuiltinConstructorBase.cpp
    M Source/WebCore/bindings/js/JSDOMConstructorBase.cpp
    M Source/WebCore/bindings/js/JSDOMConvertBase.h
    M Source/WebCore/bindings/js/JSDOMConvertBufferSource.h
    M Source/WebCore/bindings/js/JSDOMConvertDate.cpp
    M Source/WebCore/bindings/js/JSDOMConvertInterface.h
    M Source/WebCore/bindings/js/JSDOMConvertJSON.h
    M Source/WebCore/bindings/js/JSDOMConvertNumbers.cpp
    M Source/WebCore/bindings/js/JSDOMConvertNumbers.h
    M Source/WebCore/bindings/js/JSDOMConvertObject.h
    M Source/WebCore/bindings/js/JSDOMConvertRecord.h
    M Source/WebCore/bindings/js/JSDOMConvertSequences.h
    M Source/WebCore/bindings/js/JSDOMConvertStrings.cpp
    M Source/WebCore/bindings/js/JSDOMConvertUnion.h
    M Source/WebCore/bindings/js/JSDOMExceptionHandling.cpp
    M Source/WebCore/bindings/js/JSDOMExceptionHandling.h
    M Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
    M Source/WebCore/bindings/js/JSDOMGlobalObject.h
    M Source/WebCore/bindings/js/JSDOMGlobalObjectTask.cpp
    M Source/WebCore/bindings/js/JSDOMGuardedObject.h
    M Source/WebCore/bindings/js/JSDOMIterator.cpp
    M Source/WebCore/bindings/js/JSDOMIterator.h
    M Source/WebCore/bindings/js/JSDOMMapLike.cpp
    M Source/WebCore/bindings/js/JSDOMMapLike.h
    M Source/WebCore/bindings/js/JSDOMPromise.cpp
    M Source/WebCore/bindings/js/JSDOMPromise.h
    M Source/WebCore/bindings/js/JSDOMPromiseDeferred.cpp
    M Source/WebCore/bindings/js/JSDOMPromiseDeferred.h
    M Source/WebCore/bindings/js/JSDOMWindowBase.cpp
    M Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
    M Source/WebCore/bindings/js/JSDOMWindowProxy.cpp
    M Source/WebCore/bindings/js/JSDOMWindowProxy.h
    M Source/WebCore/bindings/js/JSDOMWrapper.cpp
    M Source/WebCore/bindings/js/JSDOMWrapper.h
    M Source/WebCore/bindings/js/JSDOMWrapperCache.cpp
    M Source/WebCore/bindings/js/JSDOMWrapperCache.h
    M Source/WebCore/bindings/js/JSDynamicDowncast.h
    M Source/WebCore/bindings/js/JSErrorHandler.cpp
    M Source/WebCore/bindings/js/JSEventCustom.cpp
    M Source/WebCore/bindings/js/JSEventListener.cpp
    M Source/WebCore/bindings/js/JSEventListener.h
    M Source/WebCore/bindings/js/JSHTMLElementCustom.cpp
    M Source/WebCore/bindings/js/JSHistoryCustom.cpp
    M Source/WebCore/bindings/js/JSIDBCursorWithValueCustom.cpp
    M Source/WebCore/bindings/js/JSIDBIndexCustom.cpp
    M Source/WebCore/bindings/js/JSImageDataCustom.cpp
    M Source/WebCore/bindings/js/JSLazyEventListener.cpp
    M Source/WebCore/bindings/js/JSLocationCustom.cpp
    M Source/WebCore/bindings/js/JSMainThreadExecState.h
    M Source/WebCore/bindings/js/JSMainThreadExecStateInstrumentation.h
    M Source/WebCore/bindings/js/JSMessageChannelCustom.cpp
    M Source/WebCore/bindings/js/JSMessageEventCustom.cpp
    M Source/WebCore/bindings/js/JSNodeIteratorCustom.cpp
    M Source/WebCore/bindings/js/JSPopStateEventCustom.cpp
    M Source/WebCore/bindings/js/JSReadableStreamPrivateConstructors.cpp
    M Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp
    M Source/WebCore/bindings/js/JSWebGL2RenderingContextCustom.cpp
    M Source/WebCore/bindings/js/JSWorkerGlobalScopeBase.cpp
    M Source/WebCore/bindings/js/ReadableStreamDefaultController.cpp
    M Source/WebCore/bindings/js/ReadableStreamDefaultController.h
    M Source/WebCore/bindings/js/ScheduledAction.cpp
    M Source/WebCore/bindings/js/ScheduledAction.h
    M Source/WebCore/bindings/js/ScriptCachedFrameData.cpp
    M Source/WebCore/bindings/js/ScriptCachedFrameData.h
    M Source/WebCore/bindings/js/ScriptController.cpp
    M Source/WebCore/bindings/js/ScriptController.h
    M Source/WebCore/bindings/js/ScriptControllerMac.mm
    M Source/WebCore/bindings/js/ScriptModuleLoader.cpp
    M Source/WebCore/bindings/js/ScriptModuleLoader.h
    M Source/WebCore/bindings/js/ScriptSourceCode.h
    M Source/WebCore/bindings/js/ScriptState.cpp
    M Source/WebCore/bindings/js/ScriptWrappable.h
    M Source/WebCore/bindings/js/ScriptWrappableInlines.h
    M Source/WebCore/bindings/js/SerializedScriptValue.cpp
    M Source/WebCore/bindings/js/SerializedScriptValue.h
    M Source/WebCore/bindings/js/StructuredClone.cpp
    M Source/WebCore/bindings/js/WebCoreBuiltinNames.h
    M Source/WebCore/bindings/js/WebCoreJSClientData.cpp
    M Source/WebCore/bindings/js/WebCoreTypedArrayController.cpp
    M Source/WebCore/bindings/js/WebCoreTypedArrayController.h
    M Source/WebCore/bindings/js/WorkerScriptController.cpp
    M Source/WebCore/bindings/js/WorkerScriptController.h
    M Source/WebCore/bridge/NP_jsobject.cpp
    M Source/WebCore/bridge/c/CRuntimeObject.cpp
    M Source/WebCore/bridge/c/c_class.cpp
    M Source/WebCore/bridge/c/c_instance.cpp
    M Source/WebCore/bridge/c/c_runtime.cpp
    M Source/WebCore/bridge/c/c_utility.cpp
    M Source/WebCore/bridge/c/c_utility.h
    M Source/WebCore/bridge/jsc/BridgeJSC.cpp
    M Source/WebCore/bridge/jsc/BridgeJSC.h
    M Source/WebCore/bridge/npruntime.cpp
    M Source/WebCore/bridge/objc/ObjCRuntimeObject.mm
    M Source/WebCore/bridge/objc/WebScriptObject.mm
    M Source/WebCore/bridge/objc/WebScriptObjectPrivate.h
    M Source/WebCore/bridge/objc/objc_instance.mm
    M Source/WebCore/bridge/objc/objc_runtime.h
    M Source/WebCore/bridge/objc/objc_runtime.mm
    M Source/WebCore/bridge/objc/objc_utility.h
    M Source/WebCore/bridge/objc/objc_utility.mm
    M Source/WebCore/bridge/runtime_array.cpp
    M Source/WebCore/bridge/runtime_array.h
    M Source/WebCore/bridge/runtime_method.cpp
    M Source/WebCore/bridge/runtime_method.h
    M Source/WebCore/bridge/runtime_object.cpp
    M Source/WebCore/bridge/runtime_object.h
    M Source/WebCore/bridge/runtime_root.cpp
    M Source/WebCore/bridge/runtime_root.h
    M Source/WebCore/crypto/SubtleCrypto.cpp
    M Source/WebCore/crypto/SubtleCrypto.h
    M Source/WebCore/crypto/gcrypt/CryptoKeyRSAGCrypt.cpp
    M Source/WebCore/crypto/keys/CryptoRsaKeyAlgorithm.h
    M Source/WebCore/crypto/mac/CryptoKeyRSAMac.cpp
    M Source/WebCore/crypto/parameters/CryptoAlgorithmEcdsaParams.h
    M Source/WebCore/crypto/parameters/CryptoAlgorithmHkdfParams.h
    M Source/WebCore/crypto/parameters/CryptoAlgorithmHmacKeyParams.h
    M Source/WebCore/crypto/parameters/CryptoAlgorithmPbkdf2Params.h
    M Source/WebCore/crypto/parameters/CryptoAlgorithmRsaHashedImportParams.h
    M Source/WebCore/crypto/parameters/CryptoAlgorithmRsaHashedKeyGenParams.h
    M Source/WebCore/crypto/parameters/CryptoAlgorithmRsaKeyGenParams.h
    M Source/WebCore/css/CSSFontFaceSource.h
    M Source/WebCore/css/DOMMatrixReadOnly.cpp
    M Source/WebCore/css/DOMMatrixReadOnly.h
    M Source/WebCore/css/FontFace.cpp
    M Source/WebCore/dom/CustomElementReactionQueue.cpp
    M Source/WebCore/dom/CustomElementRegistry.cpp
    M Source/WebCore/dom/CustomEvent.cpp
    M Source/WebCore/dom/CustomEvent.h
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/ErrorEvent.cpp
    M Source/WebCore/dom/ErrorEvent.h
    M Source/WebCore/dom/LoadableScript.h
    M Source/WebCore/dom/MessageEvent.cpp
    M Source/WebCore/dom/MessageEvent.h
    M Source/WebCore/dom/ModuleFetchParameters.h
    M Source/WebCore/dom/PopStateEvent.cpp
    M Source/WebCore/dom/PopStateEvent.h
    M Source/WebCore/dom/PromiseRejectionEvent.cpp
    M Source/WebCore/dom/PromiseRejectionEvent.h
    M Source/WebCore/dom/RejectedPromiseTracker.cpp
    M Source/WebCore/dom/RejectedPromiseTracker.h
    M Source/WebCore/dom/ScriptExecutionContext.cpp
    M Source/WebCore/dom/ScriptExecutionContext.h
    M Source/WebCore/dom/TextEncoder.cpp
    M Source/WebCore/dom/TextEncoder.h
    M Source/WebCore/domjit/DOMJITHelpers.h
    M Source/WebCore/domjit/DOMJITIDLTypeFilter.h
    M Source/WebCore/domjit/JSDocumentDOMJIT.cpp
    M Source/WebCore/domjit/JSNodeDOMJIT.cpp
    M Source/WebCore/fileapi/BlobBuilder.cpp
    M Source/WebCore/fileapi/FileReader.cpp
    M Source/WebCore/fileapi/FileReaderLoader.cpp
    M Source/WebCore/fileapi/FileReaderSync.cpp
    M Source/WebCore/html/BaseTextInputType.cpp
    M Source/WebCore/html/EmailInputType.cpp
    M Source/WebCore/html/HTMLAllCollection.cpp
    M Source/WebCore/html/HTMLCanvasElement.cpp
    M Source/WebCore/html/HTMLImageLoader.cpp
    M Source/WebCore/html/HTMLMediaElement.cpp
    M Source/WebCore/html/HTMLPlugInImageElement.cpp
    M Source/WebCore/html/ImageData.cpp
    M Source/WebCore/html/ImageData.h
    M Source/WebCore/html/MediaEncryptedEventInit.h
    M Source/WebCore/html/WebKitMediaKeyError.h
    M Source/WebCore/html/canvas/WebGLAny.h
    M Source/WebCore/html/canvas/WebGLRenderingContext.cpp
    M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
    M Source/WebCore/html/canvas/WebGLRenderingContextBase.h
    M Source/WebCore/html/canvas/WebGPUBuffer.cpp
    M Source/WebCore/html/canvas/WebGPURenderingContext.cpp
    M Source/WebCore/html/canvas/WebGPURenderingContext.h
    M Source/WebCore/html/track/DataCue.cpp
    M Source/WebCore/html/track/DataCue.h
    M Source/WebCore/inspector/CommandLineAPIHost.cpp
    M Source/WebCore/inspector/CommandLineAPIHost.h
    M Source/WebCore/inspector/CommandLineAPIModule.cpp
    M Source/WebCore/inspector/CommandLineAPIModule.h
    M Source/WebCore/inspector/InspectorCanvas.cpp
    M Source/WebCore/inspector/InspectorCanvas.h
    M Source/WebCore/inspector/InspectorClient.cpp
    M Source/WebCore/inspector/InspectorController.cpp
    M Source/WebCore/inspector/InspectorController.h
    M Source/WebCore/inspector/InspectorDatabaseResource.h
    M Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
    M Source/WebCore/inspector/InspectorFrontendHost.cpp
    M Source/WebCore/inspector/InspectorInstrumentation.cpp
    M Source/WebCore/inspector/InspectorInstrumentation.h
    M Source/WebCore/inspector/InspectorOverlay.cpp
    M Source/WebCore/inspector/InspectorOverlay.h
    M Source/WebCore/inspector/InspectorShaderProgram.cpp
    M Source/WebCore/inspector/InspectorShaderProgram.h
    M Source/WebCore/inspector/InspectorStyleSheet.cpp
    M Source/WebCore/inspector/InspectorStyleSheet.h
    M Source/WebCore/inspector/InspectorWebAgentBase.h
    M Source/WebCore/inspector/InstrumentingAgents.h
    M Source/WebCore/inspector/PageScriptDebugServer.cpp
    M Source/WebCore/inspector/PageScriptDebugServer.h
    M Source/WebCore/inspector/TimelineRecordFactory.cpp
    M Source/WebCore/inspector/WebInjectedScriptHost.h
    M Source/WebCore/inspector/WebInjectedScriptManager.h
    M Source/WebCore/inspector/WorkerInspectorController.cpp
    M Source/WebCore/inspector/WorkerInspectorController.h
    M Source/WebCore/inspector/WorkerScriptDebugServer.cpp
    M Source/WebCore/inspector/WorkerScriptDebugServer.h
    M Source/WebCore/inspector/WorkerToPageFrontendChannel.h
    M Source/WebCore/inspector/agents/InspectorApplicationCacheAgent.h
    M Source/WebCore/inspector/agents/InspectorCSSAgent.cpp
    M Source/WebCore/inspector/agents/InspectorCSSAgent.h
    M Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp
    M Source/WebCore/inspector/agents/InspectorCanvasAgent.h
    M Source/WebCore/inspector/agents/InspectorDOMAgent.cpp
    M Source/WebCore/inspector/agents/InspectorDOMAgent.h
    M Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.cpp
    M Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.h
    M Source/WebCore/inspector/agents/InspectorDOMStorageAgent.cpp
    M Source/WebCore/inspector/agents/InspectorDOMStorageAgent.h
    M Source/WebCore/inspector/agents/InspectorDatabaseAgent.cpp
    M Source/WebCore/inspector/agents/InspectorDatabaseAgent.h
    M Source/WebCore/inspector/agents/InspectorIndexedDBAgent.cpp
    M Source/WebCore/inspector/agents/InspectorIndexedDBAgent.h
    M Source/WebCore/inspector/agents/InspectorLayerTreeAgent.cpp
    M Source/WebCore/inspector/agents/InspectorLayerTreeAgent.h
    M Source/WebCore/inspector/agents/InspectorMemoryAgent.cpp
    M Source/WebCore/inspector/agents/InspectorMemoryAgent.h
    M Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
    M Source/WebCore/inspector/agents/InspectorNetworkAgent.h
    M Source/WebCore/inspector/agents/InspectorPageAgent.cpp
    M Source/WebCore/inspector/agents/InspectorPageAgent.h
    M Source/WebCore/inspector/agents/InspectorTimelineAgent.cpp
    M Source/WebCore/inspector/agents/InspectorTimelineAgent.h
    M Source/WebCore/inspector/agents/InspectorWorkerAgent.h
    M Source/WebCore/inspector/agents/WebConsoleAgent.cpp
    M Source/WebCore/inspector/agents/WebConsoleAgent.h
    M Source/WebCore/inspector/agents/WebDebuggerAgent.h
    M Source/WebCore/inspector/agents/WebHeapAgent.h
    M Source/WebCore/inspector/agents/page/PageDebuggerAgent.cpp
    M Source/WebCore/inspector/agents/page/PageRuntimeAgent.cpp
    M Source/WebCore/inspector/agents/page/PageRuntimeAgent.h
    M Source/WebCore/inspector/agents/worker/ServiceWorkerAgent.h
    M Source/WebCore/inspector/agents/worker/WorkerDebuggerAgent.cpp
    M Source/WebCore/inspector/agents/worker/WorkerRuntimeAgent.cpp
    M Source/WebCore/inspector/agents/worker/WorkerRuntimeAgent.h
    M Source/WebCore/loader/EmptyClients.cpp
    M Source/WebCore/page/CaptionUserPreferences.cpp
    M Source/WebCore/page/Chrome.cpp
    M Source/WebCore/page/ChromeClient.h
    M Source/WebCore/page/Crypto.cpp
    M Source/WebCore/page/DOMWindow.cpp
    M Source/WebCore/page/DOMWindow.h
    M Source/WebCore/page/Frame.cpp
    M Source/WebCore/page/OriginThreadLocalCache.h
    M Source/WebCore/page/PageConsoleClient.cpp
    M Source/WebCore/page/PageConsoleClient.h
    M Source/WebCore/page/PageDebuggable.cpp
    M Source/WebCore/page/PageGroup.cpp
    M Source/WebCore/page/SettingsBase.h
    M Source/WebCore/page/UserContentController.cpp
    M Source/WebCore/page/cocoa/ResourceUsageThreadCocoa.mm
    M Source/WebCore/page/csp/ContentSecurityPolicy.cpp
    M Source/WebCore/page/ios/FrameIOS.mm
    M Source/WebCore/page/linux/ResourceUsageOverlayLinux.cpp
    M Source/WebCore/page/linux/ResourceUsageThreadLinux.cpp
    M Source/WebCore/platform/MediaSample.h
    M Source/WebCore/platform/SerializedPlatformRepresentation.h
    M Source/WebCore/platform/SharedBuffer.h
    M Source/WebCore/platform/audio/mac/CARingBuffer.h
    M Source/WebCore/platform/cocoa/SharedBufferCocoa.mm
    M Source/WebCore/platform/graphics/ImageBuffer.h
    M Source/WebCore/platform/graphics/LegacyCDMSession.h
    M Source/WebCore/platform/graphics/MediaPlayer.h
    M Source/WebCore/platform/graphics/avfoundation/CDMFairPlayStreaming.cpp
    M Source/WebCore/platform/graphics/avfoundation/CDMPrivateMediaSourceAVFObjC.mm
    M Source/WebCore/platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp
    M Source/WebCore/platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp
    M Source/WebCore/platform/graphics/avfoundation/MediaSampleAVFObjC.h
    M Source/WebCore/platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp
    M Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm
    M Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm
    M Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm
    M Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
    M Source/WebCore/platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm
    M Source/WebCore/platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm
    M Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
    M Source/WebCore/platform/graphics/cg/ImageBufferDataCG.cpp
    M Source/WebCore/platform/graphics/cg/ImageBufferDataCG.h
    M Source/WebCore/platform/graphics/cocoa/GPUDeviceMetal.mm
    M Source/WebCore/platform/graphics/filters/FEBlend.cpp
    M Source/WebCore/platform/graphics/filters/FEColorMatrix.cpp
    M Source/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
    M Source/WebCore/platform/graphics/filters/FEComposite.cpp
    M Source/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp
    M Source/WebCore/platform/graphics/filters/FEDisplacementMap.cpp
    M Source/WebCore/platform/graphics/filters/FEDropShadow.cpp
    M Source/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
    M Source/WebCore/platform/graphics/filters/FELighting.h
    M Source/WebCore/platform/graphics/filters/FEMorphology.cpp
    M Source/WebCore/platform/graphics/filters/FETurbulence.cpp
    M Source/WebCore/platform/graphics/filters/FilterEffect.cpp
    M Source/WebCore/platform/graphics/filters/FilterEffect.h
    M Source/WebCore/platform/graphics/gpu/GPUBuffer.h
    M Source/WebCore/platform/graphics/gpu/GPUDevice.h
    M Source/WebCore/platform/graphics/iso/ISOBox.cpp
    M Source/WebCore/platform/graphics/iso/ISOOriginalFormatBox.cpp
    M Source/WebCore/platform/graphics/iso/ISOProtectionSchemeInfoBox.cpp
    M Source/WebCore/platform/graphics/iso/ISOSchemeInformationBox.cpp
    M Source/WebCore/platform/graphics/iso/ISOSchemeTypeBox.cpp
    M Source/WebCore/platform/graphics/iso/ISOTrackEncryptionBox.cpp
    M Source/WebCore/platform/graphics/iso/ISOVTTCue.cpp
    M Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
    M Source/WebCore/platform/graphics/win/ImageBufferDataDirect2D.cpp
    M Source/WebCore/platform/graphics/win/ImageBufferDataDirect2D.h
    M Source/WebCore/platform/ios/wak/WebCoreThread.mm
    M Source/WebCore/platform/mac/SerializedPlatformRepresentationMac.mm
    M Source/WebCore/platform/mac/StringUtilities.mm
    M Source/WebCore/platform/mock/mediasource/MockBox.cpp
    M Source/WebCore/platform/mock/mediasource/MockSourceBufferPrivate.cpp
    M Source/WebCore/svg/graphics/SVGImage.cpp
    M Source/WebCore/testing/GCObservation.cpp
    M Source/WebCore/testing/GCObservation.h
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/LegacyMockCDM.cpp
    M Source/WebCore/testing/MockCDMFactory.cpp
    M Source/WebCore/testing/js/WebCoreTestSupport.cpp
    M Source/WebCore/workers/Worker.cpp
    M Source/WebCore/workers/Worker.h
    M Source/WebCore/workers/WorkerConsoleClient.cpp
    M Source/WebCore/workers/WorkerConsoleClient.h
    M Source/WebCore/workers/WorkerGlobalScope.cpp
    M Source/WebCore/workers/WorkerGlobalScope.h
    M Source/WebCore/workers/WorkerGlobalScopeProxy.h
    M Source/WebCore/workers/WorkerInspectorProxy.cpp
    M Source/WebCore/workers/WorkerMessagingProxy.cpp
    M Source/WebCore/workers/WorkerThread.h
    M Source/WebCore/workers/service/ExtendableEvent.cpp
    M Source/WebCore/workers/service/ServiceWorker.cpp
    M Source/WebCore/workers/service/ServiceWorker.h
    M Source/WebCore/workers/service/ServiceWorkerClient.h
    M Source/WebCore/workers/service/context/ServiceWorkerInspectorProxy.cpp
    M Source/WebCore/workers/service/context/ServiceWorkerThread.cpp
    M Source/WebCore/xml/XMLHttpRequest.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/mac/StringUtilities.mm
    M Source/WebKit/Shared/Cocoa/WebKit2InitializeCocoa.mm
    M Source/WebKit/Shared/WebKit2Initialize.cpp
    M Source/WebKit/Shared/linux/WebMemorySamplerLinux.cpp
    M Source/WebKit/Shared/mac/WebMemorySampler.mac.mm
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/APIInjectedBundlePageUIClient.h
    M Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitConsoleMessagePrivate.h
    M Source/WebKit/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h
    M Source/WebKit/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
    M Source/WebKit/WebProcess/Plugins/PluginProcessConnection.cpp
    M Source/WebKit/WebProcess/Plugins/PluginView.cpp
    M Source/WebKit/WebProcess/WebPage/WebInspector.h
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm
    M Source/WebKitLegacy/ios/ChangeLog
    M Source/WebKitLegacy/ios/Misc/WebUIKitSupport.mm
    M Source/WebKitLegacy/mac/Carbon/CarbonWindowAdapter.mm
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/DOM/WebDOMOperations.mm
    M Source/WebKitLegacy/mac/History/WebBackForwardList.mm
    M Source/WebKitLegacy/mac/History/WebHistoryItem.mm
    M Source/WebKitLegacy/mac/Misc/WebCache.mm
    M Source/WebKitLegacy/mac/Misc/WebElementDictionary.mm
    M Source/WebKitLegacy/mac/Misc/WebIconDatabase.mm
    M Source/WebKitLegacy/mac/Misc/WebStringTruncator.mm
    M Source/WebKitLegacy/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
    M Source/WebKitLegacy/mac/Plugins/Hosted/ProxyInstance.mm
    M Source/WebKitLegacy/mac/Plugins/Hosted/ProxyRuntimeObject.mm
    M Source/WebKitLegacy/mac/Plugins/Hosted/WebHostedNetscapePluginView.mm
    M Source/WebKitLegacy/mac/Plugins/WebBaseNetscapePluginView.mm
    M Source/WebKitLegacy/mac/Plugins/WebBasePluginPackage.mm
    M Source/WebKitLegacy/mac/Plugins/WebNetscapePluginStream.mm
    M Source/WebKitLegacy/mac/Plugins/WebNetscapePluginView.mm
    M Source/WebKitLegacy/mac/Plugins/WebPluginController.mm
    M Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.mm
    M Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.mm
    M Source/WebKitLegacy/mac/WebCoreSupport/WebInspectorClient.h
    M Source/WebKitLegacy/mac/WebCoreSupport/WebInspectorClient.mm
    M Source/WebKitLegacy/mac/WebView/WebDataSource.mm
    M Source/WebKitLegacy/mac/WebView/WebFrame.mm
    M Source/WebKitLegacy/mac/WebView/WebHTMLRepresentation.mm
    M Source/WebKitLegacy/mac/WebView/WebHTMLView.mm
    M Source/WebKitLegacy/mac/WebView/WebPreferences.mm
    M Source/WebKitLegacy/mac/WebView/WebScriptDebugDelegate.mm
    M Source/WebKitLegacy/mac/WebView/WebScriptDebugger.h
    M Source/WebKitLegacy/mac/WebView/WebTextIterator.mm
    M Source/WebKitLegacy/mac/WebView/WebView.mm
    M Source/WebKitLegacy/mac/WebView/WebViewData.mm
    M Source/WebKitLegacy/win/ChangeLog
    M Source/WebKitLegacy/win/Plugins/PluginView.cpp
    M Source/WebKitLegacy/win/Plugins/PluginViewWin.cpp
    M Source/WebKitLegacy/win/WebCoreSupport/WebInspectorClient.cpp
    M Source/WebKitLegacy/win/WebCoreSupport/WebInspectorClient.h
    M Source/WebKitLegacy/win/WebFrame.cpp
    M Source/WebKitLegacy/win/WebJavaScriptCollector.cpp
    M Source/WebKitLegacy/win/WebView.cpp
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/TestController.cpp

  Log Message:
  -----------
  Merge r228218 - Remove WebCore/ForwardingHeaders directory
https://bugs.webkit.org/show_bug.cgi?id=182347

Reviewed by Keith Miller.

Source/ThirdParty:

* gtest/CMakeLists.txt:
* gtest/include/gtest/internal/gtest-port.h:

Source/WebCore:

No new tests. No change in behavior.

* CMakeLists.txt:
* ForwardingHeaders/bindings/ScriptFunctionCall.h: Removed.
* ForwardingHeaders/bindings/ScriptObject.h: Removed.
* ForwardingHeaders/bindings/ScriptValue.h: Removed.
* ForwardingHeaders/builtins/BuiltinNames.h: Removed.
* ForwardingHeaders/builtins/BuiltinUtils.h: Removed.
* ForwardingHeaders/builtins/JSCBuiltins.h: Removed.
* ForwardingHeaders/bytecode/CodeBlock.h: Removed.
* ForwardingHeaders/bytecode/SpeculatedType.h: Removed.
* ForwardingHeaders/bytecode/UnlinkedFunctionExecutable.h: Removed.
* ForwardingHeaders/debugger/Debugger.h: Removed.
* ForwardingHeaders/domjit/DOMJITAbstractHeap.h: Removed.
* ForwardingHeaders/domjit/DOMJITEffect.h: Removed.
* ForwardingHeaders/domjit/DOMJITGetterSetter.h: Removed.
* ForwardingHeaders/domjit/DOMJITHeapRange.h: Removed.
* ForwardingHeaders/domjit/DOMJITSignature.h: Removed.
* ForwardingHeaders/heap/BlockDirectoryInlines.h: Removed.
* ForwardingHeaders/heap/DeleteAllCodeEffort.h: Removed.
* ForwardingHeaders/heap/FastMallocAlignedMemoryAllocator.h: Removed.
* ForwardingHeaders/heap/GCActivityCallback.h: Removed.
* ForwardingHeaders/heap/GCFinalizationCallback.h: Removed.
* ForwardingHeaders/heap/HandleTypes.h: Removed.
* ForwardingHeaders/heap/Heap.h: Removed.
* ForwardingHeaders/heap/HeapInlines.h: Removed.
* ForwardingHeaders/heap/HeapObserver.h: Removed.
* ForwardingHeaders/heap/IncrementalSweeper.h: Removed.
* ForwardingHeaders/heap/LockDuringMarking.h: Removed.
* ForwardingHeaders/heap/MachineStackMarker.h: Removed.
* ForwardingHeaders/heap/MarkedBlockInlines.h: Removed.
* ForwardingHeaders/heap/MarkingConstraint.h: Removed.
* ForwardingHeaders/heap/RunningScope.h: Removed.
* ForwardingHeaders/heap/SimpleMarkingConstraint.h: Removed.
* ForwardingHeaders/heap/SlotVisitor.h: Removed.
* ForwardingHeaders/heap/SlotVisitorInlines.h: Removed.
* ForwardingHeaders/heap/Strong.h: Removed.
* ForwardingHeaders/heap/StrongInlines.h: Removed.
* ForwardingHeaders/heap/SubspaceInlines.h: Removed.
* ForwardingHeaders/heap/ThreadLocalCache.h: Removed.
* ForwardingHeaders/heap/Weak.h: Removed.
* ForwardingHeaders/heap/WeakInlines.h: Removed.
* ForwardingHeaders/inspector/ConsoleMessage.h: Removed.
* ForwardingHeaders/inspector/ContentSearchUtilities.h: Removed.
* ForwardingHeaders/inspector/IdentifiersFactory.h: Removed.
* ForwardingHeaders/inspector/InjectedScript.h: Removed.
* ForwardingHeaders/inspector/InjectedScriptBase.h: Removed.
* ForwardingHeaders/inspector/InjectedScriptHost.h: Removed.
* ForwardingHeaders/inspector/InjectedScriptManager.h: Removed.
* ForwardingHeaders/inspector/InjectedScriptModule.h: Removed.
* ForwardingHeaders/inspector/InspectorAgentBase.h: Removed.
* ForwardingHeaders/inspector/InspectorAgentRegistry.h: Removed.
* ForwardingHeaders/inspector/InspectorBackendDispatcher.h: Removed.
* ForwardingHeaders/inspector/InspectorBackendDispatchers.h: Removed.
* ForwardingHeaders/inspector/InspectorEnvironment.h: Removed.
* ForwardingHeaders/inspector/InspectorFrontendChannel.h: Removed.
* ForwardingHeaders/inspector/InspectorFrontendDispatchers.h: Removed.
* ForwardingHeaders/inspector/InspectorFrontendRouter.h: Removed.
* ForwardingHeaders/inspector/InspectorProtocolObjects.h: Removed.
* ForwardingHeaders/inspector/InspectorProtocolTypes.h: Removed.
* ForwardingHeaders/inspector/PerGlobalObjectWrapperWorld.h: Removed.
* ForwardingHeaders/inspector/ScriptArguments.h: Removed.
* ForwardingHeaders/inspector/ScriptBreakpoint.h: Removed.
* ForwardingHeaders/inspector/ScriptCallFrame.h: Removed.
* ForwardingHeaders/inspector/ScriptCallStack.h: Removed.
* ForwardingHeaders/inspector/ScriptCallStackFactory.h: Removed.
* ForwardingHeaders/inspector/ScriptDebugListener.h: Removed.
* ForwardingHeaders/inspector/ScriptDebugServer.h: Removed.
* ForwardingHeaders/inspector/agents/InspectorAgent.h: Removed.
* ForwardingHeaders/inspector/agents/InspectorConsoleAgent.h: Removed.
* ForwardingHeaders/inspector/agents/InspectorDebuggerAgent.h: Removed.
* ForwardingHeaders/inspector/agents/InspectorHeapAgent.h: Removed.
* ForwardingHeaders/inspector/agents/InspectorRuntimeAgent.h: Removed.
* ForwardingHeaders/inspector/agents/InspectorScriptProfilerAgent.h: Removed.
* ForwardingHeaders/interpreter/CallFrame.h: Removed.
* ForwardingHeaders/interpreter/FrameTracers.h: Removed.
* ForwardingHeaders/interpreter/ShadowChicken.h: Removed.
* ForwardingHeaders/interpreter/StackVisitor.h: Removed.
* ForwardingHeaders/jit/JITCode.h: Removed.
* ForwardingHeaders/jit/JITMathICForwards.h: Removed.
* ForwardingHeaders/jit/Snippet.h: Removed.
* ForwardingHeaders/jit/SnippetParams.h: Removed.
* ForwardingHeaders/jit/SpillRegistersMode.h: Removed.
* ForwardingHeaders/masm/X86Assembler.h: Removed.
* ForwardingHeaders/parser/ParserError.h: Removed.
* ForwardingHeaders/parser/SourceCode.h: Removed.
* ForwardingHeaders/parser/SourceProvider.h: Removed.
* ForwardingHeaders/parser/SourceProviderCache.h: Removed.
* ForwardingHeaders/profiler/ProfilerDatabase.h: Removed.
* ForwardingHeaders/runtime/ArgList.h: Removed.
* ForwardingHeaders/runtime/ArrayBuffer.h: Removed.
* ForwardingHeaders/runtime/ArrayBufferView.h: Removed.
* ForwardingHeaders/runtime/ArrayPrototype.h: Removed.
* ForwardingHeaders/runtime/AuxiliaryBarrierInlines.h: Removed.
* ForwardingHeaders/runtime/BooleanObject.h: Removed.
* ForwardingHeaders/runtime/CallData.h: Removed.
* ForwardingHeaders/runtime/CatchScope.h: Removed.
* ForwardingHeaders/runtime/CommonIdentifiers.h: Removed.
* ForwardingHeaders/runtime/Completion.h: Removed.
* ForwardingHeaders/runtime/ConfigFile.h: Removed.
* ForwardingHeaders/runtime/ConsoleClient.h: Removed.
* ForwardingHeaders/runtime/ConsoleTypes.h: Removed.
* ForwardingHeaders/runtime/ConstructAbility.h: Removed.
* ForwardingHeaders/runtime/ConstructData.h: Removed.
* ForwardingHeaders/runtime/DataView.h: Removed.
* ForwardingHeaders/runtime/DateInstance.h: Removed.
* ForwardingHeaders/runtime/Error.h: Removed.
* ForwardingHeaders/runtime/ErrorHandlingScope.h: Removed.
* ForwardingHeaders/runtime/ErrorInstance.h: Removed.
* ForwardingHeaders/runtime/ErrorPrototype.h: Removed.
* ForwardingHeaders/runtime/Exception.h: Removed.
* ForwardingHeaders/runtime/ExceptionHelpers.h: Removed.
* ForwardingHeaders/runtime/Float32Array.h: Removed.
* ForwardingHeaders/runtime/Float64Array.h: Removed.
* ForwardingHeaders/runtime/FunctionConstructor.h: Removed.
* ForwardingHeaders/runtime/FunctionExecutable.h: Removed.
* ForwardingHeaders/runtime/FunctionPrototype.h: Removed.
* ForwardingHeaders/runtime/HashMapImpl.h: Removed.
* ForwardingHeaders/runtime/Identifier.h: Removed.
* ForwardingHeaders/runtime/IdentifierInlines.h: Removed.
* ForwardingHeaders/runtime/InitializeThreading.h: Removed.
* ForwardingHeaders/runtime/Int16Array.h: Removed.
* ForwardingHeaders/runtime/Int32Array.h: Removed.
* ForwardingHeaders/runtime/Int8Array.h: Removed.
* ForwardingHeaders/runtime/InternalFunction.h: Removed.
* ForwardingHeaders/runtime/Intrinsic.h: Removed.
* ForwardingHeaders/runtime/IterationKind.h: Removed.
* ForwardingHeaders/runtime/IteratorOperations.h: Removed.
* ForwardingHeaders/runtime/IteratorPrototype.h: Removed.
* ForwardingHeaders/runtime/JSAPIValueWrapper.h: Removed.
* ForwardingHeaders/runtime/JSArray.h: Removed.
* ForwardingHeaders/runtime/JSArrayBuffer.h: Removed.
* ForwardingHeaders/runtime/JSArrayBufferView.h: Removed.
* ForwardingHeaders/runtime/JSCInlines.h: Removed.
* ForwardingHeaders/runtime/JSCJSValue.h: Removed.
* ForwardingHeaders/runtime/JSCJSValueInlines.h: Removed.
* ForwardingHeaders/runtime/JSCallee.h: Removed.
* ForwardingHeaders/runtime/JSCell.h: Removed.
* ForwardingHeaders/runtime/JSCellInlines.h: Removed.
* ForwardingHeaders/runtime/JSDataView.h: Removed.
* ForwardingHeaders/runtime/JSDestructibleObject.h: Removed.
* ForwardingHeaders/runtime/JSDestructibleObjectHeapCellType.h: Removed.
* ForwardingHeaders/runtime/JSExportMacros.h: Removed.
* ForwardingHeaders/runtime/JSFunction.h: Removed.
* ForwardingHeaders/runtime/JSGlobalObject.h: Removed.
* ForwardingHeaders/runtime/JSGlobalObjectInlines.h: Removed.
* ForwardingHeaders/runtime/JSInternalPromise.h: Removed.
* ForwardingHeaders/runtime/JSInternalPromiseDeferred.h: Removed.
* ForwardingHeaders/runtime/JSLock.h: Removed.
* ForwardingHeaders/runtime/JSMap.h: Removed.
* ForwardingHeaders/runtime/JSMapIterator.h: Removed.
* ForwardingHeaders/runtime/JSModuleLoader.h: Removed.
* ForwardingHeaders/runtime/JSModuleRecord.h: Removed.
* ForwardingHeaders/runtime/JSNativeStdFunction.h: Removed.
* ForwardingHeaders/runtime/JSONObject.h: Removed.
* ForwardingHeaders/runtime/JSObject.h: Removed.
* ForwardingHeaders/runtime/JSObjectInlines.h: Removed.
* ForwardingHeaders/runtime/JSPromise.h: Removed.
* ForwardingHeaders/runtime/JSPromiseConstructor.h: Removed.
* ForwardingHeaders/runtime/JSPromiseDeferred.h: Removed.
* ForwardingHeaders/runtime/JSProxy.h: Removed.
* ForwardingHeaders/runtime/JSRunLoopTimer.h: Removed.
* ForwardingHeaders/runtime/JSScriptFetchParameters.h: Removed.
* ForwardingHeaders/runtime/JSScriptFetcher.h: Removed.
* ForwardingHeaders/runtime/JSSegmentedVariableObjectHeapCellType.h: Removed.
* ForwardingHeaders/runtime/JSSet.h: Removed.
* ForwardingHeaders/runtime/JSSetIterator.h: Removed.
* ForwardingHeaders/runtime/JSSourceCode.h: Removed.
* ForwardingHeaders/runtime/JSString.h: Removed.
* ForwardingHeaders/runtime/JSTypedArrays.h: Removed.
* ForwardingHeaders/runtime/JSWithScope.h: Removed.
* ForwardingHeaders/runtime/Lookup.h: Removed.
* ForwardingHeaders/runtime/MapBase.h: Removed.
* ForwardingHeaders/runtime/MapData.h: Removed.
* ForwardingHeaders/runtime/MapDataInlines.h: Removed.
* ForwardingHeaders/runtime/MatchResult.h: Removed.
* ForwardingHeaders/runtime/Microtask.h: Removed.
* ForwardingHeaders/runtime/ObjectConstructor.h: Removed.
* ForwardingHeaders/runtime/ObjectPrototype.h: Removed.
* ForwardingHeaders/runtime/Operations.h: Removed.
* ForwardingHeaders/runtime/PrivateName.h: Removed.
* ForwardingHeaders/runtime/PromiseDeferredTimer.h: Removed.
* ForwardingHeaders/runtime/PropertyNameArray.h: Removed.
* ForwardingHeaders/runtime/Protect.h: Removed.
* ForwardingHeaders/runtime/RegExp.h: Removed.
* ForwardingHeaders/runtime/RegExpObject.h: Removed.
* ForwardingHeaders/runtime/RuntimeFlags.h: Removed.
* ForwardingHeaders/runtime/SamplingProfiler.h: Removed.
* ForwardingHeaders/runtime/ScriptFetchParameters.h: Removed.
* ForwardingHeaders/runtime/ScriptFetcher.h: Removed.
* ForwardingHeaders/runtime/StringObject.h: Removed.
* ForwardingHeaders/runtime/StringPrototype.h: Removed.
* ForwardingHeaders/runtime/Structure.h: Removed.
* ForwardingHeaders/runtime/StructureChain.h: Removed.
* ForwardingHeaders/runtime/StructureInlines.h: Removed.
* ForwardingHeaders/runtime/Symbol.h: Removed.
* ForwardingHeaders/runtime/SymbolTable.h: Removed.
* ForwardingHeaders/runtime/ThrowScope.h: Removed.
* ForwardingHeaders/runtime/TypedArrayController.h: Removed.
* ForwardingHeaders/runtime/TypedArrayInlines.h: Removed.
* ForwardingHeaders/runtime/TypedArrays.h: Removed.
* ForwardingHeaders/runtime/Uint16Array.h: Removed.
* ForwardingHeaders/runtime/Uint32Array.h: Removed.
* ForwardingHeaders/runtime/Uint8Array.h: Removed.
* ForwardingHeaders/runtime/Uint8ClampedArray.h: Removed.
* ForwardingHeaders/runtime/VM.h: Removed.
* ForwardingHeaders/runtime/VMEntryScope.h: Removed.
* ForwardingHeaders/runtime/Watchdog.h: Removed.
* ForwardingHeaders/runtime/WeakGCMap.h: Removed.
* ForwardingHeaders/runtime/WeakGCMapInlines.h: Removed.
* ForwardingHeaders/runtime/WriteBarrier.h: Removed.
* ForwardingHeaders/wasm/WasmModule.h: Removed.
* ForwardingHeaders/wasm/js/JSWebAssemblyModule.h: Removed.
* ForwardingHeaders/yarr/RegularExpression.h: Removed.
* ForwardingHeaders/yarr/Yarr.h: Removed.
* ForwardingHeaders/yarr/YarrInterpreter.h: Removed.
* ForwardingHeaders/yarr/YarrJIT.h: Removed.
* ForwardingHeaders/yarr/YarrPattern.h: Removed.
* Modules/applepay/cocoa/PaymentMerchantSessionCocoa.mm:
* Modules/encryptedmedia/MediaKeyMessageEvent.h:
* Modules/encryptedmedia/MediaKeyMessageEventInit.h:
* Modules/encryptedmedia/MediaKeyStatusMap.h:
* Modules/encryptedmedia/legacy/LegacyCDM.h:
* Modules/encryptedmedia/legacy/LegacyCDMSessionClearKey.cpp:
* Modules/encryptedmedia/legacy/WebKitMediaKeyMessageEvent.cpp:
* Modules/encryptedmedia/legacy/WebKitMediaKeyNeededEvent.cpp:
* Modules/encryptedmedia/legacy/WebKitMediaKeySession.h:
* Modules/encryptedmedia/legacy/WebKitMediaKeys.h:
* Modules/fetch/FetchBody.cpp:
* Modules/fetch/FetchRequestInit.h:
* Modules/fetch/FetchResponse.h:
* Modules/indexeddb/IDBCursor.cpp:
* Modules/indexeddb/IDBCursor.h:
* Modules/indexeddb/IDBCursorWithValue.cpp:
* Modules/indexeddb/IDBDatabase.cpp:
* Modules/indexeddb/IDBIndex.cpp:
* Modules/indexeddb/IDBKey.cpp:
* Modules/indexeddb/IDBKeyRange.cpp:
* Modules/indexeddb/IDBObjectStore.cpp:
* Modules/indexeddb/IDBRequest.cpp:
* Modules/indexeddb/IDBRequest.h:
* Modules/indexeddb/client/TransactionOperation.cpp:
* Modules/indexeddb/server/MemoryObjectStore.cpp:
* Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
* Modules/indexeddb/server/UniqueIDBDatabase.cpp:
* Modules/mediacontrols/MediaControlsHost.cpp:
* Modules/mediasource/SourceBuffer.cpp:
* Modules/mediastream/RTCDataChannel.cpp:
* Modules/plugins/QuickTimePluginReplacement.mm:
* Modules/webaudio/AsyncAudioDecoder.cpp:
* Modules/webaudio/AudioBuffer.cpp:
* Modules/webaudio/AudioBuffer.h:
* Modules/webaudio/AudioContext.cpp:
* Modules/webaudio/AudioContext.h:
* Modules/webaudio/AudioParam.h:
* Modules/webaudio/AudioParamTimeline.h:
* Modules/webaudio/PeriodicWave.h:
* Modules/webaudio/RealtimeAnalyser.cpp:
* Modules/webaudio/RealtimeAnalyser.h:
* Modules/webaudio/ScriptProcessorNode.cpp:
* Modules/webaudio/WaveShaperProcessor.h:
* Modules/webauthn/AuthenticatorResponse.h:
* Modules/webauthn/PublicKeyCredential.h:
* Modules/websockets/WebSocket.cpp:
* Modules/websockets/WebSocketChannel.cpp:
* Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
* Modules/webvr/VREyeParameters.h:
* Modules/webvr/VRFrameData.h:
* Modules/webvr/VRPose.h:
* Modules/webvr/VRStageParameters.h:
* PlatformWin.cmake:
* bindings/IDLTypes.h:
* bindings/js/BufferSource.h:
* bindings/js/CachedScriptFetcher.h:
* bindings/js/CachedScriptSourceProvider.h:
* bindings/js/CallTracerTypes.h:
* bindings/js/CommonVM.cpp:
* bindings/js/DOMGCOutputConstraint.cpp:
* bindings/js/DOMGCOutputConstraint.h:
* bindings/js/GCController.cpp:
* bindings/js/GCController.h:
* bindings/js/IDBBindingUtilities.cpp:
* bindings/js/JSCallbackData.cpp:
* bindings/js/JSCallbackData.h:
* bindings/js/JSCustomElementInterface.cpp:
* bindings/js/JSCustomElementInterface.h:
* bindings/js/JSCustomEventCustom.cpp:
* bindings/js/JSCustomXPathNSResolver.cpp:
* bindings/js/JSCustomXPathNSResolver.h:
* bindings/js/JSDOMBinding.h:
* bindings/js/JSDOMBuiltinConstructorBase.cpp:
* bindings/js/JSDOMConstructorBase.cpp:
* bindings/js/JSDOMConvertBase.h:
* bindings/js/JSDOMConvertBufferSource.h:
* bindings/js/JSDOMConvertDate.cpp:
* bindings/js/JSDOMConvertInterface.h:
* bindings/js/JSDOMConvertJSON.h:
* bindings/js/JSDOMConvertNumbers.cpp:
* bindings/js/JSDOMConvertNumbers.h:
* bindings/js/JSDOMConvertObject.h:
* bindings/js/JSDOMConvertRecord.h:
* bindings/js/JSDOMConvertSequences.h:
* bindings/js/JSDOMConvertStrings.cpp:
* bindings/js/JSDOMConvertUnion.h:
* bindings/js/JSDOMExceptionHandling.cpp:
* bindings/js/JSDOMExceptionHandling.h:
* bindings/js/JSDOMGlobalObject.cpp:
* bindings/js/JSDOMGlobalObject.h:
* bindings/js/JSDOMGlobalObjectTask.cpp:
* bindings/js/JSDOMGuardedObject.h:
* bindings/js/JSDOMIterator.cpp:
* bindings/js/JSDOMIterator.h:
* bindings/js/JSDOMMapLike.cpp:
* bindings/js/JSDOMMapLike.h:
* bindings/js/JSDOMPromise.cpp:
* bindings/js/JSDOMPromise.h:
* bindings/js/JSDOMPromiseDeferred.cpp:
* bindings/js/JSDOMPromiseDeferred.h:
* bindings/js/JSDOMWindowBase.cpp:
* bindings/js/JSDOMWindowCustom.cpp:
* bindings/js/JSDOMWindowProxy.cpp:
* bindings/js/JSDOMWindowProxy.h:
* bindings/js/JSDOMWrapper.cpp:
* bindings/js/JSDOMWrapper.h:
* bindings/js/JSDOMWrapperCache.cpp:
* bindings/js/JSDOMWrapperCache.h:
* bindings/js/JSDynamicDowncast.h:
* bindings/js/JSErrorHandler.cpp:
* bindings/js/JSEventCustom.cpp:
* bindings/js/JSEventListener.cpp:
* bindings/js/JSEventListener.h:
* bindings/js/JSHTMLElementCustom.cpp:
* bindings/js/JSHistoryCustom.cpp:
* bindings/js/JSIDBCursorWithValueCustom.cpp:
* bindings/js/JSIDBIndexCustom.cpp:
* bindings/js/JSImageDataCustom.cpp:
* bindings/js/JSLazyEventListener.cpp:
* bindings/js/JSLocationCustom.cpp:
* bindings/js/JSMainThreadExecState.h:
* bindings/js/JSMainThreadExecStateInstrumentation.h:
* bindings/js/JSMessageChannelCustom.cpp:
* bindings/js/JSMessageEventCustom.cpp:
* bindings/js/JSNodeIteratorCustom.cpp:
* bindings/js/JSPopStateEventCustom.cpp:
* bindings/js/JSReadableStreamPrivateConstructors.cpp:
* bindings/js/JSTreeWalkerCustom.cpp:
* bindings/js/JSWebGL2RenderingContextCustom.cpp:
* bindings/js/JSWorkerGlobalScopeBase.cpp:
* bindings/js/ReadableStreamDefaultController.cpp:
* bindings/js/ReadableStreamDefaultController.h:
* bindings/js/ScheduledAction.cpp:
* bindings/js/ScheduledAction.h:
* bindings/js/ScriptCachedFrameData.cpp:
* bindings/js/ScriptCachedFrameData.h:
* bindings/js/ScriptController.cpp:
* bindings/js/ScriptController.h:
* bindings/js/ScriptControllerMac.mm:
* bindings/js/ScriptModuleLoader.cpp:
* bindings/js/ScriptModuleLoader.h:
* bindings/js/ScriptSourceCode.h:
* bindings/js/ScriptState.cpp:
* bindings/js/ScriptWrappable.h:
* bindings/js/ScriptWrappableInlines.h:
* bindings/js/SerializedScriptValue.cpp:
* bindings/js/SerializedScriptValue.h:
* bindings/js/StructuredClone.cpp:
* bindings/js/WebCoreBuiltinNames.h:
* bindings/js/WebCoreJSClientData.cpp:
* bindings/js/WebCoreTypedArrayController.cpp:
* bindings/js/WebCoreTypedArrayController.h:
* bindings/js/WorkerScriptController.cpp:
* bindings/js/WorkerScriptController.h:
* bridge/NP_jsobject.cpp:
* bridge/c/CRuntimeObject.cpp:
* bridge/c/c_class.cpp:
* bridge/c/c_instance.cpp:
* bridge/c/c_runtime.cpp:
* bridge/c/c_utility.cpp:
* bridge/c/c_utility.h:
* bridge/jsc/BridgeJSC.cpp:
* bridge/jsc/BridgeJSC.h:
* bridge/npruntime.cpp:
* bridge/objc/ObjCRuntimeObject.mm:
* bridge/objc/WebScriptObject.mm:
* bridge/objc/WebScriptObjectPrivate.h:
* bridge/objc/objc_instance.mm:
* bridge/objc/objc_runtime.h:
* bridge/objc/objc_runtime.mm:
* bridge/objc/objc_utility.h:
* bridge/objc/objc_utility.mm:
* bridge/runtime_array.cpp:
* bridge/runtime_array.h:
* bridge/runtime_method.cpp:
* bridge/runtime_method.h:
* bridge/runtime_object.cpp:
* bridge/runtime_object.h:
* bridge/runtime_root.cpp:
* bridge/runtime_root.h:
* crypto/SubtleCrypto.cpp:
* crypto/SubtleCrypto.h:
* crypto/gcrypt/CryptoKeyRSAGCrypt.cpp:
* crypto/keys/CryptoRsaKeyAlgorithm.h:
* crypto/mac/CryptoKeyRSAMac.cpp:
* crypto/parameters/CryptoAlgorithmEcdsaParams.h:
* crypto/parameters/CryptoAlgorithmHkdfParams.h:
* crypto/parameters/CryptoAlgorithmHmacKeyParams.h:
* crypto/parameters/CryptoAlgorithmPbkdf2Params.h:
* crypto/parameters/CryptoAlgorithmRsaHashedImportParams.h:
* crypto/parameters/CryptoAlgorithmRsaHashedKeyGenParams.h:
* crypto/parameters/CryptoAlgorithmRsaKeyGenParams.h:
* css/CSSFontFaceSource.h:
* css/DOMMatrixReadOnly.cpp:
* css/DOMMatrixReadOnly.h:
* css/FontFace.cpp:
* dom/CustomElementReactionQueue.cpp:
* dom/CustomElementRegistry.cpp:
* dom/CustomEvent.cpp:
* dom/CustomEvent.h:
* dom/Document.cpp:
* dom/Document.h:
* dom/ErrorEvent.cpp:
* dom/ErrorEvent.h:
* dom/LoadableScript.h:
* dom/MessageEvent.cpp:
* dom/MessageEvent.h:
* dom/ModuleFetchParameters.h:
* dom/PopStateEvent.cpp:
* dom/PopStateEvent.h:
* dom/PromiseRejectionEvent.cpp:
* dom/PromiseRejectionEvent.h:
* dom/RejectedPromiseTracker.cpp:
* dom/RejectedPromiseTracker.h:
* dom/ScriptExecutionContext.cpp:
* dom/ScriptExecutionContext.h:
* dom/TextEncoder.cpp:
* dom/TextEncoder.h:
* domjit/DOMJITHelpers.h:
* domjit/DOMJITIDLTypeFilter.h:
* domjit/JSDocumentDOMJIT.cpp:
* domjit/JSNodeDOMJIT.cpp:
* fileapi/BlobBuilder.cpp:
* fileapi/FileReader.cpp:
* fileapi/FileReaderLoader.cpp:
* fileapi/FileReaderSync.cpp:
* html/BaseTextInputType.cpp:
* html/EmailInputType.cpp:
* html/HTMLAllCollection.cpp:
* html/HTMLCanvasElement.cpp:
* html/HTMLImageLoader.cpp:
* html/HTMLMediaElement.cpp:
* html/HTMLPlugInImageElement.cpp:
* html/ImageData.cpp:
* html/ImageData.h:
* html/MediaEncryptedEventInit.h:
* html/WebKitMediaKeyError.h:
* html/canvas/WebGLAny.h:
* html/canvas/WebGLRenderingContext.cpp:
* html/canvas/WebGLRenderingContextBase.cpp:
* html/canvas/WebGLRenderingContextBase.h:
* html/canvas/WebGPUBuffer.cpp:
* html/canvas/WebGPURenderingContext.cpp:
* html/canvas/WebGPURenderingContext.h:
* html/track/DataCue.cpp:
* html/track/DataCue.h:
* inspector/CommandLineAPIHost.cpp:
* inspector/CommandLineAPIHost.h:
* inspector/CommandLineAPIModule.cpp:
* inspector/CommandLineAPIModule.h:
* inspector/InspectorCanvas.cpp:
* inspector/InspectorCanvas.h:
* inspector/InspectorClient.cpp:
* inspector/InspectorController.cpp:
* inspector/InspectorController.h:
* inspector/InspectorDatabaseResource.h:
* inspector/InspectorFrontendClientLocal.cpp:
* inspector/InspectorFrontendHost.cpp:
* inspector/InspectorInstrumentation.cpp:
* inspector/InspectorInstrumentation.h:
* inspector/InspectorOverlay.cpp:
* inspector/InspectorOverlay.h:
* inspector/InspectorShaderProgram.cpp:
* inspector/InspectorShaderProgram.h:
* inspector/InspectorStyleSheet.cpp:
* inspector/InspectorStyleSheet.h:
* inspector/InspectorWebAgentBase.h:
* inspector/InstrumentingAgents.h:
* inspector/PageScriptDebugServer.cpp:
* inspector/PageScriptDebugServer.h:
* inspector/TimelineRecordFactory.cpp:
* inspector/WebInjectedScriptHost.h:
* inspector/WebInjectedScriptManager.h:
* inspector/WorkerInspectorController.cpp:
* inspector/WorkerInspectorController.h:
* inspector/WorkerScriptDebugServer.cpp:
* inspector/WorkerScriptDebugServer.h:
* inspector/WorkerToPageFrontendChannel.h:
* inspector/agents/InspectorApplicationCacheAgent.h:
* inspector/agents/InspectorCSSAgent.cpp:
* inspector/agents/InspectorCSSAgent.h:
* inspector/agents/InspectorCanvasAgent.cpp:
* inspector/agents/InspectorCanvasAgent.h:
* inspector/agents/InspectorDOMAgent.cpp:
* inspector/agents/InspectorDOMAgent.h:
* inspector/agents/InspectorDOMDebuggerAgent.cpp:
* inspector/agents/InspectorDOMDebuggerAgent.h:
* inspector/agents/InspectorDOMStorageAgent.cpp:
* inspector/agents/InspectorDOMStorageAgent.h:
* inspector/agents/InspectorDatabaseAgent.cpp:
* inspector/agents/InspectorDatabaseAgent.h:
* inspector/agents/InspectorIndexedDBAgent.cpp:
* inspector/agents/InspectorIndexedDBAgent.h:
* inspector/agents/InspectorLayerTreeAgent.cpp:
* inspector/agents/InspectorLayerTreeAgent.h:
* inspector/agents/InspectorMemoryAgent.cpp:
* inspector/agents/InspectorMemoryAgent.h:
* inspector/agents/InspectorNetworkAgent.cpp:
* inspector/agents/InspectorNetworkAgent.h:
* inspector/agents/InspectorPageAgent.cpp:
* inspector/agents/InspectorPageAgent.h:
* inspector/agents/InspectorTimelineAgent.cpp:
* inspector/agents/InspectorTimelineAgent.h:
* inspector/agents/InspectorWorkerAgent.h:
* inspector/agents/WebConsoleAgent.cpp:
* inspector/agents/WebConsoleAgent.h:
* inspector/agents/WebDebuggerAgent.h:
* inspector/agents/WebHeapAgent.h:
* inspector/agents/page/PageDebuggerAgent.cpp:
* inspector/agents/page/PageRuntimeAgent.cpp:
* inspector/agents/page/PageRuntimeAgent.h:
* inspector/agents/worker/ServiceWorkerAgent.h:
* inspector/agents/worker/WorkerDebuggerAgent.cpp:
* inspector/agents/worker/WorkerRuntimeAgent.cpp:
* inspector/agents/worker/WorkerRuntimeAgent.h:
* loader/EmptyClients.cpp:
* page/CaptionUserPreferences.cpp:
* page/Chrome.cpp:
* page/ChromeClient.h:
* page/Crypto.cpp:
* page/DOMWindow.cpp:
* page/DOMWindow.h:
* page/Frame.cpp:
* page/OriginThreadLocalCache.h:
* page/PageConsoleClient.cpp:
* page/PageConsoleClient.h:
* page/PageDebuggable.cpp:
* page/PageGroup.cpp:
* page/SettingsBase.h:
* page/UserContentController.cpp:
* page/cocoa/ResourceUsageThreadCocoa.mm:
* page/csp/ContentSecurityPolicy.cpp:
* page/ios/FrameIOS.mm:
* page/linux/ResourceUsageOverlayLinux.cpp:
* page/linux/ResourceUsageThreadLinux.cpp:
* platform/MediaSample.h:
* platform/SerializedPlatformRepresentation.h:
* platform/SharedBuffer.h:
* platform/audio/mac/CARingBuffer.h:
* platform/cocoa/SharedBufferCocoa.mm:
* platform/graphics/ImageBuffer.h:
* platform/graphics/LegacyCDMSession.h:
* platform/graphics/MediaPlayer.h:
* platform/graphics/avfoundation/CDMFairPlayStreaming.cpp:
* platform/graphics/avfoundation/CDMPrivateMediaSourceAVFObjC.mm:
* platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:
* platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
* platform/graphics/avfoundation/MediaSampleAVFObjC.h:
* platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
* platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
* platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
* platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm:
* platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
* platform/graphics/avfoundation/objc/MediaSampleAVFObjC.mm:
* platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
* platform/graphics/cairo/ImageBufferCairo.cpp:
* platform/graphics/cg/ImageBufferDataCG.cpp:
* platform/graphics/cg/ImageBufferDataCG.h:
* platform/graphics/cocoa/GPUDeviceMetal.mm:
* platform/graphics/filters/FEBlend.cpp:
* platform/graphics/filters/FEColorMatrix.cpp:
* platform/graphics/filters/FEComponentTransfer.cpp:
* platform/graphics/filters/FEComposite.cpp:
* platform/graphics/filters/FEConvolveMatrix.cpp:
* platform/graphics/filters/FEDisplacementMap.cpp:
* platform/graphics/filters/FEDropShadow.cpp:
* platform/graphics/filters/FEGaussianBlur.cpp:
* platform/graphics/filters/FELighting.h:
* platform/graphics/filters/FEMorphology.cpp:
* platform/graphics/filters/FETurbulence.cpp:
* platform/graphics/filters/FilterEffect.cpp:
* platform/graphics/filters/FilterEffect.h:
* platform/graphics/gpu/GPUBuffer.h:
* platform/graphics/gpu/GPUDevice.h:
* platform/graphics/iso/ISOBox.cpp:
* platform/graphics/iso/ISOOriginalFormatBox.cpp:
* platform/graphics/iso/ISOProtectionSchemeInfoBox.cpp:
* platform/graphics/iso/ISOSchemeInformationBox.cpp:
* platform/graphics/iso/ISOSchemeTypeBox.cpp:
* platform/graphics/iso/ISOTrackEncryptionBox.cpp:
* platform/graphics/iso/ISOVTTCue.cpp:
* platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
* platform/graphics/win/ImageBufferDataDirect2D.cpp:
* platform/graphics/win/ImageBufferDataDirect2D.h:
* platform/ios/wak/WebCoreThread.mm:
* platform/mac/SerializedPlatformRepresentationMac.mm:
* platform/mac/StringUtilities.mm:
* platform/mock/mediasource/MockBox.cpp:
* platform/mock/mediasource/MockSourceBufferPrivate.cpp:
* svg/graphics/SVGImage.cpp:
* testing/GCObservation.cpp:
* testing/GCObservation.h:
* testing/Internals.cpp:
* testing/Internals.h:
* testing/LegacyMockCDM.cpp:
* testing/MockCDMFactory.cpp:
* testing/js/WebCoreTestSupport.cpp:
* workers/Worker.cpp:
* workers/Worker.h:
* workers/WorkerConsoleClient.cpp:
* workers/WorkerConsoleClient.h:
* workers/WorkerGlobalScope.cpp:
* workers/WorkerGlobalScope.h:
* workers/WorkerGlobalScopeProxy.h:
* workers/WorkerInspectorProxy.cpp:
* workers/WorkerMessagingProxy.cpp:
* workers/WorkerThread.h:
* workers/service/ExtendableEvent.cpp:
* workers/service/ServiceWorker.cpp:
* workers/service/ServiceWorker.h:
* workers/service/ServiceWorkerClient.h:
* workers/service/context/ServiceWorkerInspectorProxy.cpp:
* workers/service/context/ServiceWorkerThread.cpp:
* xml/XMLHttpRequest.cpp:

Source/WebKit:

* Platform/mac/StringUtilities.mm:
* Shared/Cocoa/WebKit2InitializeCocoa.mm:
* Shared/WebKit2Initialize.cpp:
* Shared/linux/WebMemorySamplerLinux.cpp:
* Shared/mac/WebMemorySampler.mac.mm:
* UIProcess/WebProcessPool.cpp:
* WebProcess/InjectedBundle/API/APIInjectedBundlePageUIClient.h:
* WebProcess/InjectedBundle/API/glib/WebKitConsoleMessagePrivate.h:
* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h:
* WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
* WebProcess/Plugins/PluginProcessConnection.cpp:
* WebProcess/Plugins/PluginView.cpp:
* WebProcess/WebPage/WebInspector.h:
* WebProcess/WebPage/WebPage.cpp:
* WebProcess/cocoa/WebProcessCocoa.mm:

Source/WebKitLegacy/ios:

* Misc/WebUIKitSupport.mm:

Source/WebKitLegacy/mac:

* Carbon/CarbonWindowAdapter.mm:
* DOM/WebDOMOperations.mm:
* History/WebBackForwardList.mm:
* History/WebHistoryItem.mm:
* Misc/WebCache.mm:
* Misc/WebElementDictionary.mm:
* Misc/WebIconDatabase.mm:
* Misc/WebStringTruncator.mm:
* Plugins/Hosted/NetscapePluginInstanceProxy.mm:
* Plugins/Hosted/ProxyInstance.mm:
* Plugins/Hosted/ProxyRuntimeObject.mm:
* Plugins/Hosted/WebHostedNetscapePluginView.mm:
* Plugins/WebBaseNetscapePluginView.mm:
* Plugins/WebBasePluginPackage.mm:
* Plugins/WebNetscapePluginStream.mm:
* Plugins/WebNetscapePluginView.mm:
* Plugins/WebPluginController.mm:
* WebCoreSupport/WebEditorClient.mm:
* WebCoreSupport/WebFrameLoaderClient.mm:
* WebCoreSupport/WebInspectorClient.h:
* WebCoreSupport/WebInspectorClient.mm:
* WebView/WebDataSource.mm:
* WebView/WebFrame.mm:
* WebView/WebHTMLRepresentation.mm:
* WebView/WebHTMLView.mm:
* WebView/WebPreferences.mm:
* WebView/WebScriptDebugDelegate.mm:
* WebView/WebScriptDebugger.h:
* WebView/WebTextIterator.mm:
* WebView/WebView.mm:
* WebView/WebViewData.mm:

Source/WebKitLegacy/win:

* Plugins/PluginView.cpp:
* Plugins/PluginViewWin.cpp:
* WebCoreSupport/WebInspectorClient.cpp:
* WebCoreSupport/WebInspectorClient.h:
* WebFrame.cpp:
* WebJavaScriptCollector.cpp:
* WebView.cpp:

Tools:

* WebKitTestRunner/TestController.cpp:


  Commit: 703bb0b8fbb5415175cd566e008c8ccc8902f56c
      https://github.com/WebKit/WebKit/commit/703bb0b8fbb5415175cd566e008c8ccc8902f56c
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/glib/TestExpectations.json

  Log Message:
  -----------
  Merge r228220 - [GTK] Enable WebKit.NewFirstVisuallyNonEmptyLayoutFrames test
https://bugs.webkit.org/show_bug.cgi?id=85037

Unreviewed test gardening.

It does not appear to have failed since we started running it again in r226944.

* TestWebKitAPI/glib/TestExpectations.json:


  Commit: 47753712510901a38e04501137bcbd25a28ef40c
      https://github.com/WebKit/WebKit/commit/47753712510901a38e04501137bcbd25a28ef40c
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/glib/TestExpectations.json

  Log Message:
  -----------
  Merge r228222 - [GTK] Enable WebKit.ForceRepaint test
https://bugs.webkit.org/show_bug.cgi?id=105532

Unreviewed test gardening.

It does not appear to have failed since we started running it again in r226944.

* TestWebKitAPI/glib/TestExpectations.json:


  Commit: 6d4e3ed0d6b81799cbc3f17e0d6ef61aba45d293
      https://github.com/WebKit/WebKit/commit/6d4e3ed0d6b81799cbc3f17e0d6ef61aba45d293
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/glib/TestExpectations.json

  Log Message:
  -----------
  Merge r228223 - [GTK] Enable WebKit.InjectedBundleFrameHitTest test
https://bugs.webkit.org/show_bug.cgi?id=120303

Unreviewed test gardening.

It does not appear to have failed since we started running it again in r226944.

* TestWebKitAPI/glib/TestExpectations.json:


  Commit: f47466119ddc438af7c1d6a091821155fe677468
      https://github.com/WebKit/WebKit/commit/f47466119ddc438af7c1d6a091821155fe677468
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderBoxModelObject.h
    M Source/WebCore/rendering/RenderButton.h
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderRuby.h
    M Source/WebCore/rendering/RenderRubyRun.h
    M Source/WebCore/rendering/RenderTextControl.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h

  Log Message:
  -----------
  Merge r228224 - [RenderTreeBuilder] Move RenderBlock::removeLeftoverAnonymousBlock to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182510
<rdar://problem/37250037>

Reviewed by Antti Koivisto.

Do not reinvent subtree reparenting.

Covered by existing tests.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::removeLeftoverAnonymousBlock): Deleted.
* rendering/RenderBlock.h:
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::moveAllChildrenToInternal):
* rendering/RenderBoxModelObject.h:
* rendering/RenderButton.h:
* rendering/RenderElement.cpp:
(WebCore::RenderElement::detachRendererInternal):
(WebCore::RenderElement::attachRendererInternal):
(WebCore::RenderElement::insertChildInternal):
(WebCore::RenderElement::takeChildInternal):
* rendering/RenderElement.h:
* rendering/RenderRuby.h:
* rendering/RenderRubyRun.h:
* rendering/RenderTextControl.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::insertChildIgnoringContinuation):
(WebCore::RenderTreeBuilder::Block::childBecameNonInline):
(WebCore::RenderTreeBuilder::Block::removeLeftoverAnonymousBlock):
* rendering/updating/RenderTreeBuilderBlock.h:


  Commit: 3d16ea85354efc5147a113b22509f86f57e4aa65
      https://github.com/WebKit/WebKit/commit/3d16ea85354efc5147a113b22509f86f57e4aa65
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/glib/TestExpectations.json

  Log Message:
  -----------
  Merge r228225 - [GTK] Enable WebKit.GeolocationTransitionTo{High,Low}Accuracy tests
https://bugs.webkit.org/show_bug.cgi?id=125068

Unreviewed test gardening.

They do not appear to have failed since we started running them again in r226944.

* TestWebKitAPI/glib/TestExpectations.json:


  Commit: f213db0c81a11b76f206cd9010b5fbbf9e1032e8
      https://github.com/WebKit/WebKit/commit/f213db0c81a11b76f206cd9010b5fbbf9e1032e8
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitWebsiteDataManager.cpp

  Log Message:
  -----------
  Merge r228227 - [GTK] Typo in a translatable string
https://bugs.webkit.org/show_bug.cgi?id=182570

Unreviewed. Fix a typo.

* UIProcess/API/glib/WebKitWebsiteDataManager.cpp:
(webkit_website_data_manager_class_init):


  Commit: 3be826b2f7edb8aada9a6fc572110b2e28335d6e
      https://github.com/WebKit/WebKit/commit/3be826b2f7edb8aada9a6fc572110b2e28335d6e
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/indexeddb.https-expected.txt
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/ServiceWorkerProcessProxy.cpp
    M Source/WebKit/UIProcess/WebProcessPool.h
    M Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp
    M Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.h
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Source/WebKit/WebProcess/WebProcess.h
    M Source/WebKit/WebProcess/WebProcess.messages.in

  Log Message:
  -----------
  Merge r228230 - IndexedDB in service workers is using a memory backed store
https://bugs.webkit.org/show_bug.cgi?id=182574
<rdar://problem/37316205>

Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Rebaseline WPT test that is now passing.

* web-platform-tests/service-workers/service-worker/indexeddb.https-expected.txt:

Source/WebKit:

Make sure we pass a proper WebDatabaseProvider to the ServiceWorkerProcess via
PageConfiguration. Otherwise, we end up using the default EmptyDatabaseProvider
which uses an InProcessIDBServer and a memory-backed store for IndexedDB.

* UIProcess/ServiceWorkerProcessProxy.cpp:
(WebKit::ServiceWorkerProcessProxy::start):
* UIProcess/WebProcessPool.h:
* WebProcess/Storage/WebSWContextManagerConnection.cpp:
(WebKit::WebSWContextManagerConnection::WebSWContextManagerConnection):
(WebKit::WebSWContextManagerConnection::installServiceWorker):
* WebProcess/Storage/WebSWContextManagerConnection.h:
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::establishWorkerContextConnectionToStorageProcess):
* WebProcess/WebProcess.h:
* WebProcess/WebProcess.messages.in:

LayoutTests:

Unskip test that no longer times out.

* TestExpectations:


  Commit: c459f6f71a42bf5cd79340d5084ec7bdc505eab4
      https://github.com/WebKit/WebKit/commit/c459f6f71a42bf5cd79340d5084ec7bdc505eab4
  Author: Nikita Vasilyev <nvasilyev at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/SpreadsheetCSSStyleDeclarationEditor.js
    M Source/WebInspectorUI/UserInterface/Views/SpreadsheetCSSStyleDeclarationSection.js
    M Source/WebInspectorUI/UserInterface/Views/SpreadsheetRulesStyleDetailsPanel.js
    M Source/WebInspectorUI/UserInterface/Views/SpreadsheetStyleProperty.js

  Log Message:
  -----------
  Merge r228232 - Web Inspector: Styles: completion popover doesn't hide when switching panels
https://bugs.webkit.org/show_bug.cgi?id=182464
<rdar://problem/37202763>

Reviewed by Timothy Hatcher.

Hide completion popover by triggering blur event on the focused text field.
Removing text fields from the DOM tree would hide the completion popovers as well,
but switching sidebar panels doesn't remove them from the DOM.

* UserInterface/Views/SpreadsheetCSSStyleDeclarationEditor.js:
(WI.SpreadsheetCSSStyleDeclarationEditor.prototype.hidden):
* UserInterface/Views/SpreadsheetCSSStyleDeclarationSection.js:
(WI.SpreadsheetCSSStyleDeclarationSection.prototype.hidden):
* UserInterface/Views/SpreadsheetRulesStyleDetailsPanel.js:
(WI.SpreadsheetRulesStyleDetailsPanel.prototype.hidden):
* UserInterface/Views/SpreadsheetStyleProperty.js:
(WI.SpreadsheetStyleProperty.prototype.hidden):


  Commit: 74e1ceb8dfe49d98c4548a3df3c1e5ec12cf747f
      https://github.com/WebKit/WebKit/commit/74e1ceb8dfe49d98c4548a3df3c1e5ec12cf747f
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderView.cpp
    M Source/WebCore/rendering/updating/RenderTreeUpdater.cpp
    M Source/WebCore/rendering/updating/RenderTreeUpdater.h

  Log Message:
  -----------
  Merge r228238 - [RenderTreeBuilder] Remove RenderElement::destroyLeftoverChildren.
https://bugs.webkit.org/show_bug.cgi?id=182518
<rdar://problem/37256035>

Reviewed by Antti Koivisto.

Remove leftover children before we call takeChild() on the parent (as opposed to when
we finally call destroy() on the parent).
This patch also explicitly destroys the top level pagination renderers.

Covered by existing tests.

* rendering/RenderElement.cpp:
(WebCore::RenderElement::removeAndDestroyChild):
(WebCore::RenderElement::destroyLeftoverChildren): Deleted.
* rendering/RenderElement.h:
* rendering/RenderObject.cpp:
(WebCore::RenderObject::destroy):
* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::tearDownRenderers):
(WebCore::RenderTreeUpdater::tearDownLeftoverPaginationRenderersIfNeeded):
* rendering/updating/RenderTreeUpdater.h:


  Commit: 07e92c6e18a04690191bc805896e85b2968571b7
      https://github.com/WebKit/WebKit/commit/07e92c6e18a04690191bc805896e85b2968571b7
  Author: Youenn Fablet <youenn at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/wpt/service-workers/cors-preflight-star.any.js
    A LayoutTests/http/wpt/service-workers/cors-preflight-star.any.serviceworker-expected.txt
    A LayoutTests/http/wpt/service-workers/cors-preflight-star.any.serviceworker.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/CrossOriginPreflightChecker.cpp

  Log Message:
  -----------
  Merge r228241 - ASSERTION FAILED: m_timeOrigin in Performance::Performance()
https://bugs.webkit.org/show_bug.cgi?id=182558
<rdar://problem/37297551>

Patch by Youenn Fablet <youenn at apple.com> on 2018-02-07
Reviewed by Chris Dumez.

Source/WebCore:

Test: http/wpt/fetch/cors-preflight-star.any.serviceworker.html

* loader/CrossOriginPreflightChecker.cpp:
(WebCore::CrossOriginPreflightChecker::startPreflight):

LayoutTests:

Make use of WPT cors-preflight-star.any.js test in service worker.
This test should be removed once WPT will run any.js tests in service workers as well as workers and window.

* http/wpt/service-workers/cors-preflight-star.any.js: Added.
* http/wpt/service-workers/cors-preflight-star.any.serviceworker-expected.txt: Added.
* http/wpt/service-workers/cors-preflight-star.any.serviceworker.html: Added.


  Commit: ac6d88be2fcad172c3395d1b45ef6f4393ea087e
      https://github.com/WebKit/WebKit/commit/ac6d88be2fcad172c3395d1b45ef6f4393ea087e
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/parser/CSSParser.cpp
    M Source/WebCore/css/parser/CSSParser.h
    M Source/WebCore/css/parser/CSSParserImpl.cpp
    M Source/WebCore/css/parser/CSSParserImpl.h

  Log Message:
  -----------
  Merge r228249 - Remove unused CSSParserContext in CSSParser::parseInlineStyleDeclaration
https://bugs.webkit.org/show_bug.cgi?id=182587

Reviewed by Simon Fraser.

Removed the code. There is no need to create an unused CSSParserContext in CSSParser.

* css/parser/CSSParser.cpp:
(WebCore::CSSParser::parseInlineStyleDeclaration):
* css/parser/CSSParser.h:
* css/parser/CSSParserImpl.cpp:
(WebCore::CSSParserImpl::parseInlineStyleDeclaration):
* css/parser/CSSParserImpl.h:


  Commit: 82bb515e22a951a184e1ffad945a1eb335b094d0
      https://github.com/WebKit/WebKit/commit/82bb515e22a951a184e1ffad945a1eb335b094d0
  Author: Antti Koivisto <antti at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp

  Log Message:
  -----------
  Merge r228257 - REGRESSION(r227758): Webpage fails to load due to crash in com.apple.WebKit: WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse + 267
https://bugs.webkit.org/show_bug.cgi?id=182532
<rdar://problem/36414017>

Patch by Antti Koivisto  <antti at apple.com> and Youenn Fablet <youenn at apple.com> on 2018-02-07
Reviewed by Chris Dumez.

No test case, don't know how to make one. The repro involves multipart HTTP streaming and details are hazy.
We were calling a function that was WTFMoved away just a few lines above.

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse):


  Commit: 847218ab9fe473d3a56b5691b9f8ae7a16a51209
      https://github.com/WebKit/WebKit/commit/847218ab9fe473d3a56b5691b9f8ae7a16a51209
  Author: Andy Estes <aestes at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/JSDOMPromise.cpp

  Log Message:
  -----------
  Merge r228258 - ASSERTION FAILED: vm->currentThreadIsHoldingAPILock() seen with http/tests/paymentrequest/payment-request-show-method.https.html
https://bugs.webkit.org/show_bug.cgi?id=182591

Reviewed by Youenn Fablet.

Fixes assertion failures in http/tests/paymentrequest/payment-request-show-method.https.html.

DOMPromise::whenSettled() calls the JSC API without first aquiring the API lock, and
r228195 added a call to whenSettled() where the lock is not guaranteed to be already
acquired.

Fix this by creating a JSLockHolder in DOMPromise::whenSettled().

* bindings/js/JSDOMPromise.cpp:
(WebCore::DOMPromise::whenSettled):


  Commit: d38faed40b6279bd0daf38d923fd30a652410bac
      https://github.com/WebKit/WebKit/commit/d38faed40b6279bd0daf38d923fd30a652410bac
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r228265 - [GStreamer][WebAudio] No need for version check in each loop iteration
https://bugs.webkit.org/show_bug.cgi?id=182577

Reviewed by Xabier Rodriguez Calvar.

* platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
(webkit_web_audio_src_init): Detect version once only, when creating the element.
(webKitWebAudioSrcLoop): Use boolean variable instead of checking the version every time.


  Commit: 624c532556c822f2540cf9231948fff0b3e46995
      https://github.com/WebKit/WebKit/commit/624c532556c822f2540cf9231948fff0b3e46995
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp
    M Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.h

  Log Message:
  -----------
  Merge r228271 - [GStreamer] LayoutTest webaudio/silent-audio-interrupted-in-background.html makes its subsequent test flaky crash
https://bugs.webkit.org/show_bug.cgi?id=173916

Reviewed by Xabier Rodriguez Calvar.

Source/WebCore:

This patch fixes two crashes and a runtime warning:

- The provider client configuration should be done from the main
thread but the no-more-pads signal of deinterleave was fired from
a non-main thread.

- The deinterleave pad-removed signal can be fired for a not fully
configured pipeline if the audio context is interrupted. So the
peer quark of the removed pad needs to be checked, it might be a
null pointer.

- The provider connects to the deinterleave signals only when a
client is provided, so the signal disconnection needs to check
that to avoid runtime warnings.

* platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp:
(WebCore::AudioSourceProviderGStreamer::AudioSourceProviderGStreamer):
Create a main thread notifier.
(WebCore::AudioSourceProviderGStreamer::~AudioSourceProviderGStreamer):
Invalidate notifier and check a client was set before
disconnecting from deinterleave signals.
(WebCore::AudioSourceProviderGStreamer::handleRemovedDeinterleavePad):
Check validity of the pad peer.
(WebCore::AudioSourceProviderGStreamer::deinterleavePadsConfigured):
Set client from main thread.
* platform/audio/gstreamer/AudioSourceProviderGStreamer.h:

LayoutTests:

* platform/gtk/TestExpectations: Unskip fixed test.


  Commit: b5c0d2ee21795aba3fcf0e3f0268b70598ec3cd0
      https://github.com/WebKit/WebKit/commit/b5c0d2ee21795aba3fcf0e3f0268b70598ec3cd0
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp

  Log Message:
  -----------
  Merge r228272 - [GTK] WaylandCompositor misusing eglGetProcAddress
https://bugs.webkit.org/show_bug.cgi?id=182490

Reviewed by Michael Catanzaro.

Check that the appropriate extensions are available before calling eglGetProcAddress, as even
getting a non null value from it, the functionality can be disabled at runtime.

* UIProcess/gtk/WaylandCompositor.cpp:
(WebKit::WaylandCompositor::initializeEGL):


  Commit: ac08a7b70fe1120c133af1f733f86d9e3be8848d
      https://github.com/WebKit/WebKit/commit/ac08a7b70fe1120c133af1f733f86d9e3be8848d
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h

  Log Message:
  -----------
  Merge r228274 - [RenderTreeBuilder] Move RenderElement::removeAnonymousWrappersForInlinesIfNecessary to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182582
<rdar://problem/37327890>

Reviewed by Antti Koivisto.

Tree mutation -> RenderTreeBuilder.

No change in functionality

* rendering/RenderElement.cpp:
(WebCore::RenderElement::styleDidChange):
(WebCore::RenderElement::removeAnonymousWrappersForInlinesIfNecessary): Deleted.
* rendering/RenderElement.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::removeAnonymousWrappersForInlinesIfNecessary):
(WebCore::RenderTreeBuilder::childFlowStateChangesAndNoLongerAffectsParentBlock):
(WebCore::RenderTreeBuilder::removeFromParentAndDestroyCleaningUpAnonymousWrappers):
* rendering/updating/RenderTreeBuilder.h:


  Commit: fd8fc25e041ecaf030ad93d040c5d7ebc687d152
      https://github.com/WebKit/WebKit/commit/fd8fc25e041ecaf030ad93d040c5d7ebc687d152
  Author: Chris Fleizach <cfleizach at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/accessibility/canvas-fallback-content.html
    M LayoutTests/accessibility/mac/aria-expanded-notifications.html
    M LayoutTests/accessibility/mac/aria-listbox-selectedchildren-change.html
    M LayoutTests/accessibility/mac/aria-menu-item-selected-notification.html
    M LayoutTests/accessibility/mac/aria-modal-auto-focus.html
    M LayoutTests/accessibility/mac/element-busy-changed.html
    M LayoutTests/accessibility/mac/expanded-notification.html
    M LayoutTests/accessibility/notification-listeners.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/accessibility/AXObjectCache.h
    M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
    M Source/WebCore/accessibility/AccessibleNode.cpp
    M Source/WebCore/dom/Element.cpp

  Log Message:
  -----------
  Merge r228279 - AX: Defer attribute computation until needed.
https://bugs.webkit.org/show_bug.cgi?id=182386
<rdar://problem/37115277>

Reviewed by Zalan Bujtas.

Source/WebCore:

Accessibility is doing too much work when handling attribute changes. Here's how we can improve this:
   1) Defer attribute changes while the tree is dirty (and coalesce them).
   2) Don't create AXObjects when an attribute changes unnecessarily. If no client has requested an ax object, it's likely no work needs to be done
         (with the exception of a few attributes like aria-modal)
   3) Stop calculating the entire accessible ARIA label when trying to decide if an element should be ignored. That's generally wasteful and the
         consequence of including more AX elements in the tree is very minimal.

* accessibility/AXObjectCache.cpp:
(WebCore::rendererNeedsDeferredUpdate):
(WebCore::nodeAndRendererAreValid):
(WebCore::AXObjectCache::remove):
(WebCore::AXObjectCache::handleAriaExpandedChange):
(WebCore::AXObjectCache::handleAriaRoleChanged):
(WebCore::AXObjectCache::deferAttributeChangeIfNeeded):
(WebCore::AXObjectCache::shouldProcessAttributeChange):
(WebCore::AXObjectCache::handleAttributeChange):
(WebCore::AXObjectCache::prepareForDocumentDestruction):
(WebCore::AXObjectCache::performDeferredCacheUpdate):
(WebCore::AXObjectCache::deferRecomputeIsIgnoredIfNeeded):
(WebCore::AXObjectCache::deferRecomputeIsIgnored):
(WebCore::AXObjectCache::deferTextChangedIfNeeded):
(WebCore::AXObjectCache::deferSelectedChildrenChangedIfNeeded):
(WebCore::AXObjectCache::handleAttributeChanged): Deleted.
* accessibility/AXObjectCache.h:
(WebCore::AXObjectCache::deferAttributeChangeIfNeeded):
(WebCore::AXObjectCache::handleAttributeChanged): Deleted.
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::hasAttributesRequiredForInclusion const):
* accessibility/AccessibleNode.cpp:
(WebCore::AccessibleNode::notifyAttributeChanged):
* dom/Element.cpp:
(WebCore::Element::attributeChanged):

LayoutTests:

Update tests to reflect new world of delayed attribute handling for accessibility.

* accessibility/canvas-fallback-content.html:
     Make test async so attributes can be checked after deferred handling.
* accessibility/mac/aria-expanded-notifications.html:
     Access elements through AX tree so attribute changes generate notifications.
* accessibility/mac/aria-listbox-selectedchildren-change.html:
     Make test async so attributes can be checked after deferred handling.
* accessibility/mac/aria-menu-item-selected-notification.html:
     Access menu item through AX tree so attribute changes generate notifications.
* accessibility/mac/aria-modal-auto-focus.html:
     Access buttons after delay so attributes have time to be deferred.
* accessibility/mac/element-busy-changed.html:
     Process second attribute change after delay so we generate two notifications.
* accessibility/mac/expanded-notification.html:
     Set attributes after a delay so they generate individual notifications.
* accessibility/notification-listeners.html:
      Access elements through AX tree so attribute changes generate notifications.


  Commit: 2722375d1fa9b08e13d3d8d3436265b5a4b3d015
      https://github.com/WebKit/WebKit/commit/2722375d1fa9b08e13d3d8d3436265b5a4b3d015
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r228281 - [GStreamer] WebKit improperly handles missing GStreamer elements
https://bugs.webkit.org/show_bug.cgi?id=171205

Reviewed by Michael Catanzaro.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin): Add a
test checking the videoflip element was correctly created. It
might not be available on some exotic distros such as Gentoo.


  Commit: 9208297f267d4d1fa08d47567cf545db712a9504
      https://github.com/WebKit/WebKit/commit/9208297f267d4d1fa08d47567cf545db712a9504
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderBlockFlow.h
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderBoxModelObject.h
    M Source/WebCore/rendering/RenderRubyRun.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228284 - [RenderTreeBuilder] Introduce RenderTreeBuilder to moveChild(ren)To() functions
https://bugs.webkit.org/show_bug.cgi?id=182596
<rdar://problem/37340553>

Reviewed by Sam Weinig.

This is in preparation for moving mutation code out of moveChildTo/moveChildrenTo.

No change in functionality.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::dropAnonymousBoxChild):
(WebCore::RenderBlock::takeChild):
* rendering/RenderBlock.h:
(WebCore::RenderBlock::moveAllChildrenIncludingFloatsTo):
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::styleDidChange):
(WebCore::RenderBlockFlow::moveAllChildrenIncludingFloatsTo):
* rendering/RenderBlockFlow.h:
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::moveChildTo):
(WebCore::RenderBoxModelObject::moveChildrenTo):
* rendering/RenderBoxModelObject.h:
(WebCore::RenderBoxModelObject::moveChildTo):
(WebCore::RenderBoxModelObject::moveAllChildrenTo):
(WebCore::RenderBoxModelObject::moveChildrenTo):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::styleDidChange):
(WebCore::RenderElement::removeAnonymousWrappersForInlinesIfNecessary): Deleted.
* rendering/RenderElement.h:
* rendering/RenderRubyRun.cpp:
(WebCore::RenderRubyRun::takeChild):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::makeChildrenNonInline):
(WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):
(WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):
(WebCore::RenderTreeBuilder::childFlowStateChangesAndNoLongerAffectsParentBlock):
(WebCore::RenderTreeBuilder::removeFromParentAndDestroyCleaningUpAnonymousWrappers):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::createFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::destroyFragmentedFlow):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::moveInlineChildren):
(WebCore::RenderTreeBuilder::Ruby::moveBlockChildren):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::collapseAndDestroyAnonymousSiblingRows):


  Commit: 2dc2acdec8eac48b072b7340b0140fe664a14821
      https://github.com/WebKit/WebKit/commit/2dc2acdec8eac48b072b7340b0140fe664a14821
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/DocumentRuleSets.cpp
    M Source/WebCore/css/DocumentRuleSets.h
    M Source/WebCore/css/RuleFeature.cpp
    M Source/WebCore/css/RuleFeature.h
    M Source/WebCore/css/StyleBuilderCustom.h
    M Source/WebCore/html/HTMLEmbedElement.cpp
    M Source/WebCore/style/AttributeChangeInvalidation.cpp
    M Source/WebCore/style/AttributeChangeInvalidation.h
    M Source/WebCore/style/ClassChangeInvalidation.cpp

  Log Message:
  -----------
  Merge r228285 - Use invalidation rulesets for attribute selectors
https://bugs.webkit.org/show_bug.cgi?id=182569

Reviewed by Zalan Bujtas.

Attribute change style invalidation should use invalidation rulesets, similarly how class change invalidation already does.
We'll invalidate fewer unnecessary elements immediately and enable more significant future gains.

* css/DocumentRuleSets.cpp:
(WebCore::DocumentRuleSets::collectFeatures const):
(WebCore::DocumentRuleSets::classInvalidationRuleSets const):
(WebCore::DocumentRuleSets::attributeInvalidationRuleSets const):

Make and cache invalidation RuleSets for an attribute.

(WebCore::DocumentRuleSets::ancestorAttributeRulesForHTML const): Deleted.
* css/DocumentRuleSets.h:
* css/RuleFeature.cpp:
(WebCore::RuleFeatureSet::recursivelyCollectFeaturesFromSelector):

Collect attribute selectors along with match elements.

(WebCore::RuleFeatureSet::collectFeatures):
(WebCore::RuleFeatureSet::add):
(WebCore::RuleFeatureSet::registerContentAttribute):

Separate hash to deal with invalidation of content:attr(foo) special case.

(WebCore::RuleFeatureSet::clear):
(WebCore::RuleFeatureSet::shrinkToFit):
(WebCore::makeAttributeSelectorKey): Deleted.
* css/RuleFeature.h:
(WebCore::RuleFeature::RuleFeature):
* css/StyleBuilderCustom.h:
(WebCore::StyleBuilderCustom::applyValueContent):
(WebCore::StyleBuilderCustom::applyValueAlt):

Use registerContentAttribute()

* html/HTMLEmbedElement.cpp:
(WebCore::hasTypeOrSrc):
(WebCore::HTMLEmbedElement::parseAttribute):

    Invalidate style if both type and src attributes go missing as this changes result of rendererIsNeeded().
    This was previously relying on any attribute change invalidating style.

(WebCore::HTMLEmbedElement::rendererIsNeeded):
* style/AttributeChangeInvalidation.cpp:
(WebCore::Style::AttributeChangeInvalidation::invalidateStyle):

Collect the invalidation rulesets for this attribute change.
Also check if any attribute selector actually changes state, unlike with classes attribute changes may
often not lead to a selector becoming non-matching.

(WebCore::Style::AttributeChangeInvalidation::invalidateStyleWithRuleSets):
(WebCore::Style::AttributeChangeInvalidation::invalidateDescendants): Deleted.
* style/AttributeChangeInvalidation.h:
(WebCore::Style::AttributeChangeInvalidation::AttributeChangeInvalidation):
(WebCore::Style::AttributeChangeInvalidation::~AttributeChangeInvalidation):
* style/ClassChangeInvalidation.cpp:
(WebCore::Style::ClassChangeInvalidation::computeInvalidation):

Should not bail on shadow tree invalidation as we may also need to invalidate siblings.


  Commit: 8f3684a5688e9c772a4358e7fc2674e253b5cb7c
      https://github.com/WebKit/WebKit/commit/8f3684a5688e9c772a4358e7fc2674e253b5cb7c
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderRubyRun.cpp

  Log Message:
  -----------
  Merge r228289 - [RenderTreeBuilder] Do not use RenderTreeBuilder::current() in RenderRubyRun::takeChild
https://bugs.webkit.org/show_bug.cgi?id=182607
<rdar://problem/37355944>

Reviewed by Sam Weinig.

No change in functionality.

* rendering/RenderRubyRun.cpp:
(WebCore::RenderRubyRun::takeChild):


  Commit: d9ee9ab0cc9c40f5bf07a20859b10ea7199beb3e
      https://github.com/WebKit/WebKit/commit/d9ee9ab0cc9c40f5bf07a20859b10ea7199beb3e
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/WebKitCompilerFlags.cmake

  Log Message:
  -----------
  Merge r228293 - Unreviewed, switch -pthread to -lpthread per recommendation from Adrian
https://bugs.webkit.org/show_bug.cgi?id=182400
<rdar://problem/37252242>

This is tested and works fine.

* Source/cmake/WebKitCompilerFlags.cmake:


  Commit: bb6b712892c26c2ba5fce28ffc3d75c6c96e1706
      https://github.com/WebKit/WebKit/commit/bb6b712892c26c2ba5fce28ffc3d75c6c96e1706
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/navigation/resources/a.html
    A LayoutTests/http/tests/navigation/resources/b.html
    A LayoutTests/http/tests/navigation/sync-form-submit-iframe-expected.txt
    A LayoutTests/http/tests/navigation/sync-form-submit-iframe.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp

  Log Message:
  -----------
  Merge r228299 - Form submission after navigation fails when decidePolicyForNavigationAction is async
https://bugs.webkit.org/show_bug.cgi?id=182412
<rdar://problem/35181099>

Reviewed by Alex Christensen.

Source/WebCore:

When the form is submitted and schedules the load in an iframe that is already loading,
FrameLoader::stopLoading() is called as expected. However, because policy checks can
now be asynchronous, stopLoading() also needs to stop pending policy checks. Otherwise,
continueLoadAfterNavigationPolicy() gets called for a cancelled load and we're in trouble
because the FrameLoader was reused for another load since then.

Test: http/tests/navigation/sync-form-submit-iframe.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::stopLoading):

LayoutTests:

Import layout test coverage from Alex's earlier patch.

* http/tests/navigation/resources/a.html: Added.
* http/tests/navigation/resources/b.html: Added.
* http/tests/navigation/sync-form-submit-iframe-expected.txt: Added.
* http/tests/navigation/sync-form-submit-iframe.html: Added.


  Commit: 64c638dfded556e2f40dfba939b688f25c8c53b8
      https://github.com/WebKit/WebKit/commit/64c638dfded556e2f40dfba939b688f25c8c53b8
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/loader/NavigationScheduler.cpp
    M Tools/ChangeLog
    A Tools/TestWebKitAPI/Tests/WebKitCocoa/AsyncPolicyForNavigationResponse.mm

  Log Message:
  -----------
  Merge r228430 - REGRESSION (r228299): Broke reader mode in Safari
https://bugs.webkit.org/show_bug.cgi?id=182697
<rdar://problem/37399012>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Rework the fix for r228299 to be more targeted. I moved the policy check
cencelation from FrameLoader::stopLoading() to NavigationScheduler::schedule()
when a pending load is cancelled by another load. I have verified that the
sites fixed by r228299 still work with this more limited change. However,
reader mode is now working again.

The issue seems to be that we tell CFNetwork to continue with the load after
receiving the response, even if the client has not responded to the
decidePolicyForNavigationResponse delegate yet. As a result, CFNetwork sends
us the resource data and we may commit the provisional load before receiving
the policy response from the client. When the provisional load is committed,
we call FrameLoader::stopLoading() which after r228299 cancelled pending
policy checks. Because we did not wait for the policy check response to
commit the load, we would cancel it which would make the load fail.

The real fix here would be to make not tell CFNetwork to continue until after
we've received the policy delegate response. However, this is a larger and
riskier change at this point. I will follow-up on this issue.

Covered by new API test.

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::stopLoading):
* loader/NavigationScheduler.cpp:
(WebCore::NavigationScheduler::schedule):

Tools:

Add API test coverage for responding asynchronously to the decidePolicyForNavigationResponse
delegate.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKitCocoa/AsyncPolicyForNavigationResponse.mm: Added.
(-[TestAsyncNavigationDelegate webView:didFinishNavigation:]):
(-[TestAsyncNavigationDelegate webView:didFailNavigation:withError:]):
(-[TestAsyncNavigationDelegate webView:didFailProvisionalNavigation:withError:]):
(-[TestAsyncNavigationDelegate webView:decidePolicyForNavigationAction:decisionHandler:]):
(-[TestAsyncNavigationDelegate webView:decidePolicyForNavigationResponse:decisionHandler:]):
(TestWebKitAPI::TEST):


  Commit: 909beccaaf989b8f65a6da33368b968109f724a3
      https://github.com/WebKit/WebKit/commit/909beccaaf989b8f65a6da33368b968109f724a3
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/APICast.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSBase.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSContextRef.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSObjectRef.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSObjectRefPrivate.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRef.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSTypedArray.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSValueRef.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScript.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h
    R Source/JavaScriptCore/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r228302 - Remove JavaScriptCore/ForwardingHeaders directory
https://bugs.webkit.org/show_bug.cgi?id=182594

Reviewed by Mark Lam.

Source/JavaScriptCore:

* CMakeLists.txt:
* ForwardingHeaders/JavaScriptCore/APICast.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSBase.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSCTestRunnerUtils.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSContextRef.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSObjectRef.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSObjectRefPrivate.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSRetainPtr.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSStringRef.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSStringRefCF.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSTypedArray.h: Removed.
* ForwardingHeaders/JavaScriptCore/JSValueRef.h: Removed.
* ForwardingHeaders/JavaScriptCore/JavaScript.h: Removed.
* ForwardingHeaders/JavaScriptCore/JavaScriptCore.h: Removed.
* ForwardingHeaders/JavaScriptCore/OpaqueJSString.h: Removed.
* ForwardingHeaders/JavaScriptCore/WebKitAvailability.h: Removed.

Source/WebKit:

* PlatformGTK.cmake:


  Commit: c4fc1c739933bb02cc4b41557d102ce51122da5a
      https://github.com/WebKit/WebKit/commit/c4fc1c739933bb02cc4b41557d102ce51122da5a
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/C/WKWebsiteDataStoreRef.cpp
    M Source/WebKit/UIProcess/API/C/WKWebsiteDataStoreRef.h
    M Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStore.mm
    M Source/WebKit/UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/TestController.cpp
    M Tools/WebKitTestRunner/TestController.h
    M Tools/WebKitTestRunner/cocoa/TestControllerCocoa.mm

  Log Message:
  -----------
  Merge r228304 - TestController should not exercise cocoa-specific resource load statistics APIs
https://bugs.webkit.org/show_bug.cgi?id=182355

Reviewed by Alex Christensen.

Source/WebKit:

Remove the Cocoa testing SPI, since it's redundant with the C API. Also, add a couple
missing cookie partitioning callbacks to the C API.

* UIProcess/API/C/WKWebsiteDataStoreRef.cpp:
(WKWebsiteDataStoreStatisticsUpdateCookiePartitioning):
(WKWebsiteDataStoreSetStatisticsShouldPartitionCookiesForHost):
* UIProcess/API/C/WKWebsiteDataStoreRef.h:
* UIProcess/API/Cocoa/WKWebsiteDataStore.mm:
(-[WKWebsiteDataStore _resourceLoadStatisticsSetLastSeen:forHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetIsPrevalentResource:forHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsIsPrevalentResource:completionHandler:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsIsRegisteredAsSubFrameUnder:topFrameHost:completionHandler:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsIsRegisteredAsRedirectingTo:hostRedirectedTo:completionHandler:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetHadUserInteraction:forHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetHasHadNonRecentUserInteractionForHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsHadUserInteraction:completionHandler:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetIsGrandfathered:forHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsIsGrandfathered:completionHandler:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetSubframeUnderTopFrameOrigin:forHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetSubresourceUnderTopFrameOrigin:forHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetSubresourceUniqueRedirectTo:forHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetTimeToLiveUserInteraction:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetTimeToLiveCookiePartitionFree:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetMinimumTimeBetweenDataRecordsRemoval:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetGrandfatheringTime:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetMaxStatisticsEntries:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetPruneEntriesDownTo:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsProcessStatisticsAndDataRecords]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsUpdateCookiePartitioning]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsUpdateCookiePartitioning:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetShouldPartitionCookies:forHost:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetShouldPartitionCookies:forHost:completionHandler:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSubmitTelemetry]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetNotifyPagesWhenDataRecordsWereScanned:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetShouldClassifyResourcesBeforeDataRecordsRemoval:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsSetNotifyPagesWhenTelemetryWasCaptured:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsClearInMemoryAndPersistentStore]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsClearInMemoryAndPersistentStore:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsClearInMemoryAndPersistentStoreModifiedSinceHours:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsClearInMemoryAndPersistentStoreModifiedSinceHours:completionHandler:]): Deleted.
(-[WKWebsiteDataStore _resourceLoadStatisticsResetToConsistentState]): Deleted.
* UIProcess/API/Cocoa/WKWebsiteDataStorePrivate.h:

Tools:

Remove unnecessary use of platform-specific APIs in the TestController, since there are
cross-platform APIs to do the same thing.

Also, ensure callbacks execute before returning from TestController's functions, since
otherwise the tests are guaranteed to be flaky at best, and also since there's nothing to
prevent the TestController from being destroyed before the callbacks execute.

* WebKitTestRunner/TestController.cpp:
(WTR::resourceStatisticsVoidResultCallback):
(WTR::resourceStatisticsBooleanResultCallback):
(WTR::TestController::isStatisticsPrevalentResource):
(WTR::TestController::isStatisticsRegisteredAsSubFrameUnder):
(WTR::TestController::isStatisticsRegisteredAsRedirectingTo):
(WTR::TestController::isStatisticsHasHadUserInteraction):
(WTR::TestController::isStatisticsGrandfathered):
(WTR::TestController::statisticsUpdateCookiePartitioning):
(WTR::TestController::statisticsSetShouldPartitionCookiesForHost):
(WTR::TestController::statisticsClearInMemoryAndPersistentStore):
(WTR::TestController::statisticsClearInMemoryAndPersistentStoreModifiedSinceHours):
(WTR::TestController::statisticsClearThroughWebsiteDataRemoval):
(WTR::resourceStatisticsCallback): Deleted.
(WTR::TestController::statisticsClearThroughWebsiteDataRemovalCallback): Deleted.
* WebKitTestRunner/TestController.h:
* WebKitTestRunner/cocoa/TestControllerCocoa.mm:
(WTR::toNSString): Deleted.
(WTR::TestController::setStatisticsLastSeen): Deleted.
(WTR::TestController::setStatisticsPrevalentResource): Deleted.
(WTR::TestController::isStatisticsPrevalentResource): Deleted.
(WTR::TestController::isStatisticsRegisteredAsSubFrameUnder): Deleted.
(WTR::TestController::isStatisticsRegisteredAsRedirectingTo): Deleted.
(WTR::TestController::setStatisticsHasHadUserInteraction): Deleted.
(WTR::TestController::setStatisticsHasHadNonRecentUserInteraction): Deleted.
(WTR::TestController::isStatisticsHasHadUserInteraction): Deleted.
(WTR::TestController::setStatisticsGrandfathered): Deleted.
(WTR::TestController::isStatisticsGrandfathered): Deleted.
(WTR::TestController::setStatisticsSubframeUnderTopFrameOrigin): Deleted.
(WTR::TestController::setStatisticsSubresourceUnderTopFrameOrigin): Deleted.
(WTR::TestController::setStatisticsSubresourceUniqueRedirectTo): Deleted.
(WTR::TestController::setStatisticsTimeToLiveUserInteraction): Deleted.
(WTR::TestController::setStatisticsTimeToLiveCookiePartitionFree): Deleted.
(WTR::TestController::statisticsProcessStatisticsAndDataRecords): Deleted.
(WTR::TestController::statisticsUpdateCookiePartitioning): Deleted.
(WTR::TestController::statisticsSetShouldPartitionCookiesForHost): Deleted.
(WTR::TestController::statisticsSubmitTelemetry): Deleted.
(WTR::TestController::setStatisticsNotifyPagesWhenDataRecordsWereScanned): Deleted.
(WTR::TestController::setStatisticsShouldClassifyResourcesBeforeDataRecordsRemoval): Deleted.
(WTR::TestController::setStatisticsNotifyPagesWhenTelemetryWasCaptured): Deleted.
(WTR::TestController::setStatisticsMinimumTimeBetweenDataRecordsRemoval): Deleted.
(WTR::TestController::setStatisticsGrandfatheringTime): Deleted.
(WTR::TestController::setStatisticsMaxStatisticsEntries): Deleted.
(WTR::TestController::setStatisticsPruneEntriesDownTo): Deleted.
(WTR::TestController::statisticsClearInMemoryAndPersistentStore): Deleted.
(WTR::TestController::statisticsClearInMemoryAndPersistentStoreModifiedSinceHours): Deleted.
(WTR::TestController::statisticsClearThroughWebsiteDataRemoval): Deleted.
(WTR::TestController::statisticsResetToConsistentState): Deleted.


  Commit: ad48c36426cf7868cf26ca568996c41db3c45295
      https://github.com/WebKit/WebKit/commit/ad48c36426cf7868cf26ca568996c41db3c45295
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animatable/animate-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/composite-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/setKeyframes-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/KeyframeEffect.cpp
    M Source/WebCore/animation/KeyframeEffect.h
    M Source/WebCore/animation/KeyframeEffect.idl
    M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
    M Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
    M Source/WebCore/bindings/scripts/test/TestObj.idl

  Log Message:
  -----------
  Merge r228312 - [Web Animations] Always expose "composite" in output of getKeyframes()
https://bugs.webkit.org/show_bug.cgi?id=182600

Reviewed by Dean Jackson.

LayoutTests/imported/w3c:

Update expected results to account for a number of progressions.

* web-platform-tests/web-animations/interfaces/Animatable/animate-expected.txt:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/composite-expected.txt:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/setKeyframes-expected.txt:

Source/WebCore:

The Web Animations spec has changed and whereas the output of getKeyframes() would not feature the "composite" property
for "null" values, it now lists "composite" in all cases.

To support this, we needed to fix an issue in the code generator such that a "null" default value for an optional enum
type was supported.

* animation/KeyframeEffect.cpp:
(WebCore::KeyframeEffect::getKeyframes):
* animation/KeyframeEffect.h:
* animation/KeyframeEffect.idl:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateDefaultValue):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::convertDictionary<TestObj::Dictionary>):
(WebCore::convertDictionaryToJS):
* bindings/scripts/test/TestObj.idl:


  Commit: 3c7384ab2afbb5b05dbce9b7dbaea364c31fe15d
      https://github.com/WebKit/WebKit/commit/3c7384ab2afbb5b05dbce9b7dbaea364c31fe15d
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/css/CSSSelectorList.cpp
    M Source/WebCore/css/CSSSelectorList.h
    M Source/WebCore/css/DocumentRuleSets.cpp
    M Source/WebCore/css/ElementRuleCollector.cpp
    M Source/WebCore/css/RuleFeature.cpp
    M Source/WebCore/css/RuleFeature.h
    M Source/WebCore/css/RuleSet.cpp
    M Source/WebCore/css/RuleSet.h
    M Source/WebCore/css/StyleRule.cpp
    M Source/WebCore/css/StyleRule.h
    A Source/WebCore/cssjit/CompiledSelector.h
    M Source/WebCore/cssjit/SelectorCompiler.h

  Log Message:
  -----------
  Merge r228313 - Move compiled selectors to StyleRule
https://bugs.webkit.org/show_bug.cgi?id=182602

Reviewed by Zalan Bujtas.

Currently they are owned by RuleData. Several RuleData objects can refer to the same StyleRule, requiring recompilation.
Compiled selectors are context-independent so they can be shared between all clients.

* WebCore.xcodeproj/project.pbxproj:
* css/CSSSelectorList.cpp:
(WebCore::CSSSelectorList::listSize const):

Compute the number of complex selectors on the list.

* css/CSSSelectorList.h:
* css/DocumentRuleSets.cpp:
(WebCore::makeRuleSet):
(WebCore::DocumentRuleSets::classInvalidationRuleSets const):

Pass around list index along with the selector index (compiled selectors are found by list index).

* css/ElementRuleCollector.cpp:
(WebCore::ElementRuleCollector::ruleMatches):
* css/RuleSet.cpp:
(WebCore::RuleData::RuleData):
* css/RuleSet.h:
(WebCore::RuleData::compilationStatus const): Deleted.
(WebCore::RuleData::compiledSelectorCodeRef const): Deleted.
(WebCore::RuleData::setCompiledSelector const): Deleted.
(WebCore::RuleData::~RuleData): Deleted.
(WebCore::RuleData::compiledSelectorUsed const): Deleted.
* css/StyleRule.cpp:
(WebCore::StyleRule::StyleRule):
* css/StyleRule.h:

    Add CompiledSelector member.

* cssjit/CompiledSelector.h: Added.

    Move to a header of its own to keeps dependencies simple.

(WebCore::SelectorCompilationStatus::SelectorCompilationStatus):
(WebCore::SelectorCompilationStatus::operator Status const):
* cssjit/SelectorCompiler.h:
(): Deleted.
(WebCore::SelectorCompilationStatus::SelectorCompilationStatus): Deleted.
(WebCore::SelectorCompilationStatus::operator Status const): Deleted.


  Commit: a59a975286fc7d4c0ac3aef19dfcddbc797cf235
      https://github.com/WebKit/WebKit/commit/a59a975286fc7d4c0ac3aef19dfcddbc797cf235
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/StyleRule.cpp
    M Source/WebCore/css/StyleRule.h
    M Source/WebCore/css/StyleSheetContents.cpp
    M Source/WebCore/css/StyleSheetContents.h
    M Source/WebCore/page/MemoryRelease.cpp
    M Source/WebCore/style/StyleScope.cpp
    M Source/WebCore/style/StyleScope.h

  Log Message:
  -----------
  Merge r228453 - REGRESSION(r228313): Membuster | macOS | All Devices | 1.5 MB
https://bugs.webkit.org/show_bug.cgi?id=182744
<rdar://problem/37463770>

Reviewed by Zalan Bujtas.

We need to respect low memory notifications explicitly now that the compiled selectors are not part of RuleData.

* css/StyleRule.cpp:
(WebCore::StyleRule::StyleRule):
* css/StyleRule.h:

Switch to std::unique_ptr<[]> from Vector to avoid unnecessary bloat.

* css/StyleSheetContents.cpp:
(WebCore::traverseRulesInVector):
(WebCore::StyleSheetContents::traverseRules const):

Add a rule traversal function, similar to the existing traverseSubresources.

(WebCore::StyleSheetContents::traverseSubresources const):

Use traverseRules to implement traverseSubresources.

(WebCore::traverseSubresourcesInRules): Deleted.
* css/StyleSheetContents.h:
* page/MemoryRelease.cpp:
(WebCore::releaseCriticalMemory):
* style/StyleScope.cpp:
(WebCore::Style::Scope::releaseMemory):

Release memory for compiled selectors on memory notification.

* style/StyleScope.h:


  Commit: 0e285df036d61b9a0162e9a451bc3df43a55e78b
      https://github.com/WebKit/WebKit/commit/0e285df036d61b9a0162e9a451bc3df43a55e78b
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Tools/ChangeLog
    M Tools/gstreamer/jhbuild.modules
    A Tools/gstreamer/patches/gst-plugins-good-0001-gstgdkpixbufdec-stop-pretending-to-decode-gifs.patch

  Log Message:
  -----------
  Merge r228315 - [GStreamer] Layout test fast/replaced/border-radius-clip.html crashes with GStreamer-CRITICAL **: gst_segment_to_stream_time: assertion 'segment->format == format' failed in gst_segment_to_stream_time()
https://bugs.webkit.org/show_bug.cgi?id=176802

Source/WebCore:

Reviewed by Xabier Rodriguez Calvar.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::load): Prevent the player from loading animated gifs.

Tools:

Reviewed by Xabier Rodriguez-Calvar.

* gstreamer/jhbuild.modules:
* gstreamer/patches/gst-plugins-good-0001-gstgdkpixbufdec-stop-pretending-to-decode-gifs.patch: Added.


  Commit: 54c5b382e590ee54c411f39498dbff6fa0df8b1f
      https://github.com/WebKit/WebKit/commit/54c5b382e590ee54c411f39498dbff6fa0df8b1f
  Author: Yacine Bandou <yacine.bandou_ext at softathome.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.cpp
    M Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.h
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/GStreamerMediaDescription.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/GStreamerMediaDescription.h
    M Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/PlaybackPipeline.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/PlaybackPipeline.h
    M Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r228316 - [EME][GStreamer] Add support for encrypted caps in GStreamerUtilities
https://bugs.webkit.org/show_bug.cgi?id=181990

Patch by Yacine Bandou <yacine.bandou_ext at softathome.com> on 2018-02-09
Reviewed by Xabier Rodriguez-Calvar.

Add the support of encrypted caps in GStreamerUtilities.
Refactor the manner that the caps are handled, such as how to extract the resolution
from the video caps or how to check if the caps are encrypted.

The attachTrack function in PlaybackPipeline doesn't need the "structure" parameter,
it is already included in the "caps" parameter.

Replace the "mediaType" parameter by the "caps" parameter in reattachTrack function,
it allows to use the new functions that handle the caps in GStreamerUtilities.

Tests:
    media/encrypted-media/clearKey/clearKey-cenc-audio-playback-mse.html
    media/encrypted-media/clearKey/clearKey-cenc-video-playback-mse.html

* platform/graphics/gstreamer/GStreamerUtilities.cpp:
(WebCore::getVideoSizeAndFormatFromCaps): Add the support of video encrypted caps.
(WebCore::getVideoResolutionFromCaps):
(WebCore::capsMediaType):
(WebCore::doCapsHaveType):
(WebCore::areEncryptedCaps): Add a new functions in order to handle the caps properly.
* platform/graphics/gstreamer/GStreamerUtilities.h:
* platform/graphics/gstreamer/mse/AppendPipeline.cpp:
(WebCore::AppendPipeline::parseDemuxerSrcPadCaps):
* platform/graphics/gstreamer/mse/GStreamerMediaDescription.cpp:
(WebCore::GStreamerMediaDescription::codec const):
(WebCore::GStreamerMediaDescription::isVideo const):
(WebCore::GStreamerMediaDescription::isAudio const):
* platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:
(WebCore::MediaPlayerPrivateGStreamerMSE::trackDetected):
* platform/graphics/gstreamer/mse/PlaybackPipeline.cpp:
(WebCore::PlaybackPipeline::attachTrack):
(WebCore::PlaybackPipeline::reattachTrack):
* platform/graphics/gstreamer/mse/PlaybackPipeline.h:
* platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp:
(webKitMediaSrcUpdatePresentationSize): Refactor some parts by using the new added functions.


  Commit: 187b93c5041a0be564bc38e54fa9c4086e7fe6fa
      https://github.com/WebKit/WebKit/commit/187b93c5041a0be564bc38e54fa9c4086e7fe6fa
  Author: Javier Fernandez <jfernandez at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/css3/parse-alignment-of-root-elements-expected.txt
    M LayoutTests/css3/parse-alignment-of-root-elements.html
    M LayoutTests/css3/parse-place-items-expected.txt
    M LayoutTests/css3/parse-place-items.html
    M LayoutTests/fast/css/parse-justify-items-expected.txt
    M LayoutTests/fast/css/parse-justify-items.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/css/css-align/content-distribution/place-content-shorthand-004-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-align/content-distribution/place-content-shorthand-004.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-align/content-distribution/place-content-shorthand-007-ref.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-align/default-alignment/parse-justify-items-002-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-align/default-alignment/parse-justify-items-002.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-align/default-alignment/parse-justify-items-004-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-align/default-alignment/place-items-shorthand-004-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-align/default-alignment/place-items-shorthand-004.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSComputedStyleDeclaration.cpp
    M Source/WebCore/css/CSSPrimitiveValueMappings.h
    M Source/WebCore/css/CSSProperties.json
    M Source/WebCore/css/StyleResolver.cpp
    M Source/WebCore/css/parser/CSSPropertyParser.cpp
    M Source/WebCore/rendering/RenderFlexibleBox.cpp
    M Source/WebCore/rendering/RenderGrid.cpp
    M Source/WebCore/rendering/style/RenderStyle.cpp
    M Source/WebCore/rendering/style/RenderStyle.h
    M Source/WebCore/rendering/style/RenderStyleConstants.h
    M Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp

  Log Message:
  -----------
  Merge r228319 - [css-align] Implement the new behavior of 'legacy' for justify-items
https://bugs.webkit.org/show_bug.cgi?id=172712

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Rebaselined Default Alignment related tests because of the new 'legacy' value.

* web-platform-tests/css/css-align/content-distribution/place-content-shorthand-004-expected.txt:
* web-platform-tests/css/css-align/content-distribution/place-content-shorthand-004.html:
* web-platform-tests/css/css-align/default-alignment/parse-justify-items-002-expected.txt:
* web-platform-tests/css/css-align/default-alignment/parse-justify-items-002.html:
* web-platform-tests/css/css-align/default-alignment/parse-justify-items-004-expected.txt:
* web-platform-tests/css/css-align/default-alignment/place-items-shorthand-004-expected.txt:
* web-platform-tests/css/css-align/default-alignment/place-items-shorthand-004.html:

Source/WebCore:

The syntax of the 'justify-items' property accepts a new 'legacy' value,
replacing the 'auto' value which is now parsed as invalid.

https://github.com/w3c/csswg-drafts/issues/1318

This change affects also to the 'place-items' shorthand, which doesn't
accept 'auto' and, for the time being, neither 'legacy'.

Since the new value 'legacy' is also the default value, I don't expect
this change to break content of sites currently using the 'justify-items'
property.

No new tests, rebaselined existing test.

* css/CSSComputedStyleDeclaration.cpp:
(WebCore::valueForItemPositionWithOverflowAlignment):
(WebCore::ComputedStyleExtractor::valueForPropertyinStyle):
* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
(WebCore::CSSPrimitiveValue::operator ItemPosition const):
* css/CSSProperties.json:
* css/StyleResolver.cpp:
(WebCore::StyleResolver::adjustRenderStyle):
* css/parser/CSSPropertyParser.cpp:
(WebCore::isAuto):
(WebCore::isNormalOrStretch):
(WebCore::consumeSelfPositionOverflowPosition):
(WebCore::consumeJustifyItems):
(WebCore::consumeSimplifiedDefaultPosition):
(WebCore::consumeSimplifiedSelfPosition):
(WebCore::CSSPropertyParser::consumePlaceItemsShorthand):
(WebCore::CSSPropertyParser::consumePlaceSelfShorthand):
* rendering/RenderFlexibleBox.cpp:
(WebCore::alignmentOffset):
* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::columnAxisPositionForChild const):
(WebCore::RenderGrid::rowAxisPositionForChild const):
* rendering/style/RenderStyle.cpp:
(WebCore::resolvedSelfAlignment):
(WebCore::RenderStyle::resolvedJustifyItems const):
* rendering/style/RenderStyle.h:
(WebCore::RenderStyle::initialJustifyItems):
* rendering/style/RenderStyleConstants.h:
* rendering/style/StyleRareNonInheritedData.cpp:
(WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):

LayoutTests:

Rebaselined Default Alignment related tests because of the new 'legacy' value.

* css3/parse-alignment-of-root-elements.html:
* css3/parse-place-items.html:
* fast/css/parse-justify-items.html:


  Commit: 1b31cb5c826f27aab060808fe6129e31f8a0dd5b
      https://github.com/WebKit/WebKit/commit/1b31cb5c826f27aab060808fe6129e31f8a0dd5b
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderFragmentedFlow.h
    M Source/WebCore/rendering/RenderMultiColumnFlow.cpp
    M Source/WebCore/rendering/RenderMultiColumnFlow.h
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.h

  Log Message:
  -----------
  Merge r228320 - [RenderTreeBuilder] Move multicolumn spanner mutation logic to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182627
<rdar://problem/37367284>

Reviewed by Antti Koivisto.

Move spanner triggered mutation logic to RenderTreeBuilder.

No change in functionality.

* rendering/RenderFragmentedFlow.h:
* rendering/RenderMultiColumnFlow.cpp:
(WebCore::RenderMultiColumnFlow::isColumnSpanningDescendant const):
(WebCore::findSetRendering): Deleted.
(WebCore::isValidColumnSpanner): Deleted.
(WebCore::spannerPlacehoderCandidate): Deleted.
(WebCore::RenderMultiColumnFlow::processPossibleSpannerDescendant): Deleted.
(WebCore::RenderMultiColumnFlow::fragmentedFlowDescendantInserted): Deleted.
* rendering/RenderMultiColumnFlow.h:
* rendering/RenderObject.cpp:
(WebCore::RenderObject::insertedIntoTree):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::multiColumnDescendantInserted):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::findSetRendering):
(WebCore::spannerPlacehoderCandidate):
(WebCore::isValidColumnSpanner):
(WebCore::RenderTreeBuilder::MultiColumn::multiColumnDescendantInserted):
(WebCore::RenderTreeBuilder::MultiColumn::processPossibleSpannerDescendant):
* rendering/updating/RenderTreeBuilderMultiColumn.h:


  Commit: 4a495e7eb83ac62d93c2d5bbaf79c058280166e2
      https://github.com/WebKit/WebKit/commit/4a495e7eb83ac62d93c2d5bbaf79c058280166e2
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/gtk/webaudio/silence-after-playback-expected.wav
    A LayoutTests/platform/mac/webaudio/silence-after-playback-expected.wav
    A LayoutTests/webaudio/silence-after-playback.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp

  Log Message:
  -----------
  Merge r228321 - [GStreamer][WebAudio] Winamp2-js woes
https://bugs.webkit.org/show_bug.cgi?id=182612

Reviewed by Xabier Rodriguez Calvar and Carlos Alberto Lopez Perez.

Source/WebCore:

Test: webaudio/silence-after-playback.html

* platform/audio/gstreamer/AudioSourceProviderGStreamer.cpp:
(WebCore::copyGStreamerBuffersToAudioChannel): Clear the bus if
the adapter can't provide enough data. This prevents a nasty noise
after playing songs in Winamp.
(WebCore::AudioSourceProviderGStreamer::setClient): No need to set
the client more than once, this fixes runtime warnings.

LayoutTests:

* webaudio/silence-after-playback-expected.wav: Added.
* webaudio/silence-after-playback.html: Added.


  Commit: eff1ca398bc2e3876f52582315029592d3d7d594
      https://github.com/WebKit/WebKit/commit/eff1ca398bc2e3876f52582315029592d3d7d594
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderFragmentedFlow.h
    M Source/WebCore/rendering/RenderMultiColumnFlow.cpp
    M Source/WebCore/rendering/RenderMultiColumnFlow.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.h

  Log Message:
  -----------
  Merge r228327 - [RenderTreeBuilder] Move multicolumn descendant/sibling removal logic to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182628
<rdar://problem/37369528>

Reviewed by Antti Koivisto.

No change in functionality

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::takeChild):
* rendering/RenderFragmentedFlow.h:
* rendering/RenderMultiColumnFlow.cpp:
(WebCore::RenderMultiColumnFlow::handleSpannerRemoval): Deleted.
(WebCore::RenderMultiColumnFlow::fragmentedFlowRelativeWillBeRemoved): Deleted.
* rendering/RenderMultiColumnFlow.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::multiColumnRelativeWillBeRemoved):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::handleSpannerRemoval):
(WebCore::RenderTreeBuilder::MultiColumn::multiColumnRelativeWillBeRemoved):
* rendering/updating/RenderTreeBuilderMultiColumn.h:


  Commit: 3780897b47eab01ae76093f09ade36f9d63dfb42
      https://github.com/WebKit/WebKit/commit/3780897b47eab01ae76093f09ade36f9d63dfb42
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderBlockFlow.h
    M Source/WebCore/rendering/RenderBox.cpp
    M Source/WebCore/rendering/RenderBox.h
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderBoxModelObject.h
    M Source/WebCore/rendering/RenderButton.cpp
    M Source/WebCore/rendering/RenderCounter.cpp
    M Source/WebCore/rendering/RenderCounter.h
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderEmbeddedObject.cpp
    M Source/WebCore/rendering/RenderEmbeddedObject.h
    M Source/WebCore/rendering/RenderFragmentedFlow.cpp
    M Source/WebCore/rendering/RenderFragmentedFlow.h
    M Source/WebCore/rendering/RenderFullScreen.cpp
    M Source/WebCore/rendering/RenderFullScreen.h
    M Source/WebCore/rendering/RenderImage.cpp
    M Source/WebCore/rendering/RenderImage.h
    M Source/WebCore/rendering/RenderInline.cpp
    M Source/WebCore/rendering/RenderInline.h
    M Source/WebCore/rendering/RenderLayerModelObject.cpp
    M Source/WebCore/rendering/RenderLayerModelObject.h
    M Source/WebCore/rendering/RenderListBox.cpp
    M Source/WebCore/rendering/RenderListBox.h
    M Source/WebCore/rendering/RenderListItem.cpp
    M Source/WebCore/rendering/RenderListItem.h
    M Source/WebCore/rendering/RenderListMarker.cpp
    M Source/WebCore/rendering/RenderListMarker.h
    M Source/WebCore/rendering/RenderMenuList.cpp
    M Source/WebCore/rendering/RenderMenuList.h
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderObject.h
    M Source/WebCore/rendering/RenderReplaced.cpp
    M Source/WebCore/rendering/RenderReplaced.h
    M Source/WebCore/rendering/RenderRuby.cpp
    M Source/WebCore/rendering/RenderSearchField.cpp
    M Source/WebCore/rendering/RenderSearchField.h
    M Source/WebCore/rendering/RenderSnapshottedPlugIn.cpp
    M Source/WebCore/rendering/RenderSnapshottedPlugIn.h
    M Source/WebCore/rendering/RenderText.cpp
    M Source/WebCore/rendering/RenderText.h
    M Source/WebCore/rendering/RenderTextControlMultiLine.cpp
    M Source/WebCore/rendering/RenderTextControlMultiLine.h
    M Source/WebCore/rendering/RenderTextFragment.cpp
    M Source/WebCore/rendering/RenderTextFragment.h
    M Source/WebCore/rendering/RenderVideo.cpp
    M Source/WebCore/rendering/RenderVideo.h
    M Source/WebCore/rendering/RenderView.cpp
    M Source/WebCore/rendering/RenderView.h
    M Source/WebCore/rendering/RenderWidget.cpp
    M Source/WebCore/rendering/RenderWidget.h
    M Source/WebCore/rendering/svg/RenderSVGBlock.cpp
    M Source/WebCore/rendering/svg/RenderSVGBlock.h
    M Source/WebCore/rendering/svg/RenderSVGImage.cpp
    M Source/WebCore/rendering/svg/RenderSVGImage.h
    M Source/WebCore/rendering/svg/RenderSVGInline.cpp
    M Source/WebCore/rendering/svg/RenderSVGInline.h
    M Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
    M Source/WebCore/rendering/svg/RenderSVGModelObject.h
    M Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
    M Source/WebCore/rendering/svg/RenderSVGResourceContainer.h
    M Source/WebCore/rendering/svg/RenderSVGRoot.cpp
    M Source/WebCore/rendering/svg/RenderSVGRoot.h
    M Source/WebCore/rendering/svg/RenderSVGText.cpp
    M Source/WebCore/rendering/svg/RenderSVGText.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp

  Log Message:
  -----------
  Merge r228337 - [RenderTreeBuilder] Introduce RenderTreeBuilder to willBeDestoryed/removeFromParentAndDestroy
https://bugs.webkit.org/show_bug.cgi?id=182635
<rdar://problem/37377489>

Reviewed by Antti Koivisto.

This patch helps finding callsites where we don't have a RenderTreeBuilder instance.

No change in functionality.

* dom/Document.cpp:
(WebCore::Document::setFullScreenRenderer):
* dom/Document.h:
* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::willBeDestroyed):
(WebCore::RenderBlock::takeChild):
* rendering/RenderBlock.h:
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::willBeDestroyed):
* rendering/RenderBlockFlow.h:
* rendering/RenderBox.cpp:
(WebCore::RenderBox::willBeDestroyed):
* rendering/RenderBox.h:
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::willBeDestroyed):
(WebCore::RenderBoxModelObject::removeAndDestroyAllContinuations):
* rendering/RenderBoxModelObject.h:
* rendering/RenderButton.cpp:
(WebCore::RenderButton::setText):
* rendering/RenderCounter.cpp:
(WebCore::RenderCounter::willBeDestroyed):
* rendering/RenderCounter.h:
* rendering/RenderElement.cpp:
(WebCore::RenderElement::willBeDestroyed):
* rendering/RenderElement.h:
* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::willBeDestroyed):
* rendering/RenderEmbeddedObject.h:
* rendering/RenderFragmentedFlow.cpp:
(WebCore::RenderFragmentedFlow::willBeDestroyed):
* rendering/RenderFragmentedFlow.h:
* rendering/RenderFullScreen.cpp:
(WebCore::RenderFullScreen::willBeDestroyed):
(WebCore::RenderFullScreen::wrapNewRenderer):
(WebCore::RenderFullScreen::wrapExistingRenderer):
(WebCore::RenderFullScreen::unwrapRenderer):
* rendering/RenderFullScreen.h:
* rendering/RenderImage.cpp:
(WebCore::RenderImage::willBeDestroyed):
* rendering/RenderImage.h:
* rendering/RenderInline.cpp:
(WebCore::RenderInline::willBeDestroyed):
* rendering/RenderInline.h:
* rendering/RenderLayerModelObject.cpp:
(WebCore::RenderLayerModelObject::willBeDestroyed):
* rendering/RenderLayerModelObject.h:
* rendering/RenderListBox.cpp:
(WebCore::RenderListBox::willBeDestroyed):
* rendering/RenderListBox.h:
* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::willBeDestroyed):
* rendering/RenderListItem.h:
* rendering/RenderListMarker.cpp:
(WebCore::RenderListMarker::willBeDestroyed):
* rendering/RenderListMarker.h:
* rendering/RenderMenuList.cpp:
(WebCore::RenderMenuList::willBeDestroyed):
* rendering/RenderMenuList.h:
* rendering/RenderMultiColumnFlow.cpp:
(WebCore::RenderMultiColumnFlow::handleSpannerRemoval):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::removeFromParentAndDestroy):
(WebCore::RenderObject::willBeDestroyed):
(WebCore::RenderObject::destroy):
* rendering/RenderObject.h:
* rendering/RenderReplaced.cpp:
(WebCore::RenderReplaced::willBeDestroyed):
* rendering/RenderReplaced.h:
* rendering/RenderRuby.cpp:
(WebCore::RenderRubyAsInline::takeChild):
(WebCore::RenderRubyAsBlock::takeChild):
* rendering/RenderSearchField.cpp:
(WebCore::RenderSearchField::willBeDestroyed):
* rendering/RenderSearchField.h:
* rendering/RenderSnapshottedPlugIn.cpp:
(WebCore::RenderSnapshottedPlugIn::willBeDestroyed):
* rendering/RenderSnapshottedPlugIn.h:
* rendering/RenderText.cpp:
(WebCore::RenderText::willBeDestroyed):
* rendering/RenderText.h:
* rendering/RenderTextControlMultiLine.cpp:
(WebCore::RenderTextControlMultiLine::willBeDestroyed):
* rendering/RenderTextControlMultiLine.h:
* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::willBeDestroyed):
(WebCore::RenderTextFragment::setText):
* rendering/RenderTextFragment.h:
* rendering/RenderVideo.cpp:
(WebCore::RenderVideo::willBeDestroyed):
* rendering/RenderVideo.h:
* rendering/RenderView.cpp:
(WebCore::RenderView::willBeDestroyed):
* rendering/RenderView.h:
* rendering/RenderWidget.cpp:
(WebCore::RenderWidget::willBeDestroyed):
* rendering/RenderWidget.h:
* rendering/svg/RenderSVGBlock.cpp:
(WebCore::RenderSVGBlock::willBeDestroyed):
* rendering/svg/RenderSVGBlock.h:
* rendering/svg/RenderSVGImage.cpp:
(WebCore::RenderSVGImage::willBeDestroyed):
* rendering/svg/RenderSVGImage.h:
* rendering/svg/RenderSVGInline.cpp:
(WebCore::RenderSVGInline::willBeDestroyed):
* rendering/svg/RenderSVGInline.h:
* rendering/svg/RenderSVGModelObject.cpp:
(WebCore::RenderSVGModelObject::willBeDestroyed):
* rendering/svg/RenderSVGModelObject.h:
* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::willBeDestroyed):
* rendering/svg/RenderSVGResourceContainer.h:
* rendering/svg/RenderSVGRoot.cpp:
(WebCore::RenderSVGRoot::willBeDestroyed):
* rendering/svg/RenderSVGRoot.h:
* rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::willBeDestroyed):
* rendering/svg/RenderSVGText.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::removeFromParentAndDestroyCleaningUpAnonymousWrappers):
* rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::RenderTreeBuilder::List::updateItemMarker):
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::destroyFragmentedFlow):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::moveBlockChildren):


  Commit: 78ebebcb25522a6d8a8e84142c076336e2cf3cd3
      https://github.com/WebKit/WebKit/commit/78ebebcb25522a6d8a8e84142c076336e2cf3cd3
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.h

  Log Message:
  -----------
  Merge r228339 - [RenderTreeBuilder] Move RenderRubyAsInline/AsBlock::takeChild mutation to a RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182651
<rdar://problem/37405042>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderRuby.cpp:
(WebCore::RenderRubyAsInline::takeChild):
(WebCore::RenderRubyAsBlock::takeChild):
(WebCore::isAnonymousRubyInlineBlock): Deleted.
(WebCore::isRubyChildForNormalRemoval): Deleted.
(WebCore::findRubyRunParent): Deleted.
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChildFromRenderRubyAsInline):
(WebCore::RenderTreeBuilder::takeChildFromRenderRubyAsBlock):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::findRubyRunParent):
(WebCore::RenderTreeBuilder::Ruby::takeChild):
* rendering/updating/RenderTreeBuilderRuby.h:


  Commit: d536a979e24a4bacabcf971dbc0a762ddf2f59d8
      https://github.com/WebKit/WebKit/commit/d536a979e24a4bacabcf971dbc0a762ddf2f59d8
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderRubyRun.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.h

  Log Message:
  -----------
  Merge r228345 - [RenderTreeBuilder] Move RenderRubyRun::takeChild mutation to a RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182655
<rdar://problem/37406801>

Reviewed by Simon Fraser.

No change in functionality.

* rendering/RenderRubyRun.cpp:
(WebCore::RenderRubyRun::takeChild):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChildFromRenderRubyRun):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::takeChild):
* rendering/updating/RenderTreeBuilderRuby.h:


  Commit: 28e5c0d517eaea25dc9a492ff7c60ad7a941d8c2
      https://github.com/WebKit/WebKit/commit/28e5c0d517eaea25dc9a492ff7c60ad7a941d8c2
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderBlockFlow.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h

  Log Message:
  -----------
  Merge r228365 - [RenderTreeBuilder] Move RenderBlock::takeChild mutation to a RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182662
<rdar://problem/37408571>

Reviewed by Simon Fraser.

No change in functionality.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::takeChild):
(WebCore::canDropAnonymousBlock): Deleted.
(WebCore::canMergeContiguousAnonymousBlocks): Deleted.
* rendering/RenderBlock.h:
(WebCore::RenderBlock::moveAllChildrenIncludingFloatsTo):
* rendering/RenderBlockFlow.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takenChildFromRenderBlock):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::canDropAnonymousBlock):
(WebCore::canMergeContiguousAnonymousBlocks):
(WebCore::RenderTreeBuilder::Block::takeChild):
* rendering/updating/RenderTreeBuilderBlock.h:


  Commit: dde79e3bf525af5fa473ab9722b267a5112a05c7
      https://github.com/WebKit/WebKit/commit/dde79e3bf525af5fa473ab9722b267a5112a05c7
  Author: Gustavo Noronha Silva <gustavo.noronha at collabora.co.uk>
  Date:   2018-02-19 (Mon, 19 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/gtk/ScrollAnimatorGtk.cpp

  Log Message:
  -----------
  Merge r228368 - [GTK] Scrolling sometimes jumps around
https://bugs.webkit.org/show_bug.cgi?id=178519

Patch by Gustavo Noronha Silva <gustavo.noronha at collabora.co.uk> on 2018-02-11
Reviewed by Michael Catanzaro.

* platform/gtk/ScrollAnimatorGtk.cpp:
(WebCore::ScrollAnimatorGtk::computeVelocity): use -1 as the multiplier for the accumulated deltas,
since all we need is to make them negative. Multiplying by -1000 leads to very high velocities being
returned, causing the viewport to scroll to the end of the page.


  Commit: 2b74251f11395ab405bacbb1ad076a825dc3e2a0
      https://github.com/WebKit/WebKit/commit/2b74251f11395ab405bacbb1ad076a825dc3e2a0
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebKit/CMakeLists.txt
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/CustomProtocols/soup/LegacyCustomProtocolManagerSoup.cpp
    M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp
    M Source/WebKit/NetworkProcess/soup/NetworkProcessSoup.cpp
    M Source/WebKit/NetworkProcess/soup/NetworkSessionSoup.cpp
    M Source/WebKit/NetworkProcess/soup/RemoteNetworkingContextSoup.cpp
    M Source/WebKit/Platform/classifier/ResourceLoadStatisticsClassifier.cpp
    M Source/WebKit/PlatformGTK.cmake
    M Source/WebKit/PluginProcess/unix/PluginControllerProxyUnix.cpp
    M Source/WebKit/Shared/CoordinatedGraphics/CoordinatedBackingStore.cpp
    M Source/WebKit/Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp
    M Source/WebKit/Shared/CoordinatedGraphics/SimpleViewportController.cpp
    M Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp
    M Source/WebKit/Shared/Plugins/Netscape/unix/NetscapePluginModuleUnix.cpp
    M Source/WebKit/Shared/Plugins/unix/PluginSearchPath.cpp
    M Source/WebKit/Shared/cairo/ShareableBitmapCairo.cpp
    M Source/WebKit/Shared/glib/WebContextMenuItemGlib.cpp
    M Source/WebKit/Shared/glib/WebErrorsGlib.cpp
    M Source/WebKit/Shared/gtk/ArgumentCodersGtk.cpp
    M Source/WebKit/Shared/gtk/NativeWebKeyboardEventGtk.cpp
    M Source/WebKit/Shared/gtk/ProcessExecutablePathGtk.cpp
    M Source/WebKit/Shared/gtk/WebErrorsGtk.cpp
    M Source/WebKit/Shared/gtk/WebEventFactory.cpp
    M Source/WebKit/Shared/linux/WebMemorySamplerLinux.cpp
    M Source/WebKit/Shared/soup/WebCoreArgumentCodersSoup.cpp
    M Source/WebKit/Shared/soup/WebErrorsSoup.cpp
    A Source/WebKit/SourcesGTK.txt
    M Source/WebKit/UIProcess/AcceleratedDrawingAreaProxy.cpp
    M Source/WebKit/UIProcess/Automation/cairo/WebAutomationSessionCairo.cpp
    M Source/WebKit/UIProcess/Automation/gtk/WebAutomationSessionGtk.cpp
    M Source/WebKit/UIProcess/BackingStore.cpp
    M Source/WebKit/UIProcess/DrawingAreaProxyImpl.cpp
    M Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp
    M Source/WebKit/UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp
    M Source/WebKit/UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp
    M Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.cpp
    M Source/WebKit/UIProcess/WebResourceLoadStatisticsTelemetry.cpp
    M Source/WebKit/UIProcess/WebStorage/StorageManager.cpp
    M Source/WebKit/UIProcess/cairo/BackingStoreCairo.cpp
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStore.cpp
    M Source/WebKit/UIProcess/gtk/DragAndDropHandler.cpp
    M Source/WebKit/UIProcess/gtk/GestureController.cpp
    M Source/WebKit/UIProcess/gtk/HardwareAccelerationManager.cpp
    M Source/WebKit/UIProcess/gtk/InputMethodFilter.cpp
    M Source/WebKit/UIProcess/gtk/TextCheckerGtk.cpp
    M Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
    M Source/WebKit/UIProcess/gtk/WebColorPickerGtk.cpp
    M Source/WebKit/UIProcess/gtk/WebContextMenuProxyGtk.cpp
    M Source/WebKit/UIProcess/gtk/WebPasteboardProxyGtk.cpp
    M Source/WebKit/UIProcess/gtk/WebPopupMenuProxyGtk.cpp
    M Source/WebKit/WebProcess/Cookies/soup/WebCookieManagerSoup.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMAttr.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCDATASection.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSRule.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSRuleList.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSStyleDeclaration.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSStyleSheet.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSValue.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCharacterData.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMClientRect.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMClientRectList.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMComment.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMSelection.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMTokenList.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMWindow.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDocument.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDocumentFragment.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDocumentType.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMEvent.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMFile.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMFileList.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLAnchorElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLAppletElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLAreaElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLBRElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLBaseElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLBodyElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLButtonElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLCanvasElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLCollection.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLDListElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLDirectoryElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLDivElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLDocument.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLEmbedElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFieldSetElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFontElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFormElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFrameElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFrameSetElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLHRElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLHeadElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLHeadingElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLHtmlElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLIFrameElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLImageElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLInputElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLLIElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLLabelElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLLegendElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLLinkElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLMapElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLMarqueeElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLMenuElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLMetaElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLModElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLOListElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLObjectElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLOptGroupElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLOptionElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLOptionsCollection.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLParagraphElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLParamElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLPreElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLQuoteElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLScriptElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLSelectElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLStyleElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCaptionElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCellElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableColElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableRowElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableSectionElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTextAreaElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTitleElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLUListElement.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMKeyboardEvent.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMMediaList.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMMouseEvent.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMNamedNodeMap.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMNode.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMNodeIterator.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMNodeList.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMObject.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMProcessingInstruction.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMRange.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMStyleSheet.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMStyleSheetList.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMText.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMTreeWalker.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMUIEvent.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMWheelEvent.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMXPathResult.cpp
    M Source/WebKit/WebProcess/InjectedBundle/glib/InjectedBundleGlib.cpp
    M Source/WebKit/WebProcess/MediaCache/WebMediaKeyStorageManager.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/unix/NetscapePluginUnix.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/curl/WebFrameNetworkingContext.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/gtk/WebContextMenuClientGtk.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/gtk/WebDragClientGtk.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/gtk/WebPopupMenuGtk.cpp
    M Source/WebKit/WebProcess/WebPage/AcceleratedDrawingArea.cpp
    M Source/WebKit/WebProcess/WebPage/AcceleratedSurface.cpp
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp
    M Source/WebKit/WebProcess/WebPage/DrawingAreaImpl.cpp
    M Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceWayland.cpp
    M Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceX11.cpp
    M Source/WebKit/WebProcess/WebPage/gtk/WebPageGtk.cpp
    M Source/WebKit/WebProcess/gtk/WaylandCompositorDisplay.cpp
    M Source/WebKit/WebProcess/gtk/WebProcessMainGtk.cpp

  Log Message:
  -----------
  Merge r228373 - [GTK] Unify builds for platform-specific files in WebKit layer
https://bugs.webkit.org/show_bug.cgi?id=182450

Reviewed by Carlos Garcia Campos.

Add most GTK-specific sources to unified build. API files are exempted, except for the DOM
API. Files shared with PluginProcessGTK2 are also exempted. Finally, files with name
conflicts in headers, which appears difficult to fix, are also exempted.

* CMakeLists.txt:
* NetworkProcess/CustomProtocols/soup/LegacyCustomProtocolManagerSoup.cpp:
* NetworkProcess/soup/NetworkDataTaskSoup.cpp:
* NetworkProcess/soup/NetworkProcessSoup.cpp:
* NetworkProcess/soup/NetworkSessionSoup.cpp:
* NetworkProcess/soup/RemoteNetworkingContextSoup.cpp:
* Platform/classifier/ResourceLoadStatisticsClassifier.cpp:
* PlatformGTK.cmake:
* PluginProcess/unix/PluginControllerProxyUnix.cpp:
* Shared/CoordinatedGraphics/CoordinatedBackingStore.cpp:
* Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:
* Shared/CoordinatedGraphics/SimpleViewportController.cpp:
* Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:
* Shared/Plugins/Netscape/unix/NetscapePluginModuleUnix.cpp:
* Shared/Plugins/unix/PluginSearchPath.cpp:
* Shared/cairo/ShareableBitmapCairo.cpp:
* Shared/glib/WebContextMenuItemGlib.cpp:
* Shared/glib/WebErrorsGlib.cpp:
* Shared/gtk/ArgumentCodersGtk.cpp:
* Shared/gtk/NativeWebKeyboardEventGtk.cpp:
* Shared/gtk/ProcessExecutablePathGtk.cpp:
* Shared/gtk/WebErrorsGtk.cpp:
* Shared/gtk/WebEventFactory.cpp:
* Shared/linux/WebMemorySamplerLinux.cpp:
* Shared/soup/WebCoreArgumentCodersSoup.cpp:
* Shared/soup/WebErrorsSoup.cpp:
* SourcesGTK.txt: Added.
* UIProcess/AcceleratedDrawingAreaProxy.cpp:
* UIProcess/Automation/cairo/WebAutomationSessionCairo.cpp:
* UIProcess/Automation/gtk/WebAutomationSessionGtk.cpp:
* UIProcess/BackingStore.cpp:
* UIProcess/DrawingAreaProxyImpl.cpp:
* UIProcess/Launcher/glib/ProcessLauncherGLib.cpp:
* UIProcess/Plugins/unix/PluginInfoStoreUnix.cpp:
* UIProcess/Plugins/unix/PluginProcessProxyUnix.cpp:
* UIProcess/WebResourceLoadStatisticsStore.cpp:
* UIProcess/WebResourceLoadStatisticsTelemetry.cpp:
* UIProcess/WebStorage/StorageManager.cpp:
* UIProcess/cairo/BackingStoreCairo.cpp:
* UIProcess/gtk/AcceleratedBackingStore.cpp:
* UIProcess/gtk/DragAndDropHandler.cpp:
* UIProcess/gtk/GestureController.cpp:
* UIProcess/gtk/HardwareAccelerationManager.cpp:
* UIProcess/gtk/InputMethodFilter.cpp:
* UIProcess/gtk/TextCheckerGtk.cpp:
* UIProcess/gtk/WaylandCompositor.cpp:
* UIProcess/gtk/WebColorPickerGtk.cpp:
* UIProcess/gtk/WebContextMenuProxyGtk.cpp:
* UIProcess/gtk/WebPasteboardProxyGtk.cpp:
* UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
* WebProcess/Cookies/soup/WebCookieManagerSoup.cpp:
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMAttr.cpp:
(webkit_dom_attr_dom_event_target_init):
(webkit_dom_attr_set_property):
(webkit_dom_attr_get_property):
(webkit_dom_attr_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCDATASection.cpp:
(webkit_dom_cdata_section_dom_event_target_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSRule.cpp:
(webkit_dom_css_rule_set_property):
(webkit_dom_css_rule_get_property):
(webkit_dom_css_rule_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSRuleList.cpp:
(webkit_dom_css_rule_list_get_property):
(webkit_dom_css_rule_list_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSStyleDeclaration.cpp:
(webkit_dom_css_style_declaration_set_property):
(webkit_dom_css_style_declaration_get_property):
(webkit_dom_css_style_declaration_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSStyleSheet.cpp:
(webkit_dom_css_style_sheet_get_property):
(webkit_dom_css_style_sheet_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCSSValue.cpp:
(webkit_dom_css_value_set_property):
(webkit_dom_css_value_get_property):
(webkit_dom_css_value_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMCharacterData.cpp:
(webkit_dom_character_data_dom_event_target_init):
(webkit_dom_character_data_set_property):
(webkit_dom_character_data_get_property):
(webkit_dom_character_data_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMClientRect.cpp:
(webkit_dom_client_rect_get_property):
(webkit_dom_client_rect_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMClientRectList.cpp:
(webkit_dom_client_rect_list_get_property):
(webkit_dom_client_rect_list_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMComment.cpp:
(webkit_dom_comment_dom_event_target_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMSelection.cpp:
(webkit_dom_dom_selection_get_property):
(webkit_dom_dom_selection_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMTokenList.cpp:
(webkit_dom_dom_token_list_set_property):
(webkit_dom_dom_token_list_get_property):
(webkit_dom_dom_token_list_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDOMWindow.cpp:
(webkit_dom_dom_window_dom_event_target_init):
(webkit_dom_dom_window_set_property):
(webkit_dom_dom_window_get_property):
(webkit_dom_dom_window_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDocument.cpp:
(webkit_dom_document_dom_event_target_init):
(webkit_dom_document_set_property):
(webkit_dom_document_get_property):
(webkit_dom_document_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDocumentFragment.cpp:
(webkit_dom_document_fragment_dom_event_target_init):
(webkit_dom_document_fragment_get_property):
(webkit_dom_document_fragment_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMDocumentType.cpp:
(webkit_dom_document_type_dom_event_target_init):
(webkit_dom_document_type_get_property):
(webkit_dom_document_type_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMElement.cpp:
(webkit_dom_element_dom_event_target_init):
(webkit_dom_element_set_property):
(webkit_dom_element_get_property):
(webkit_dom_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMEvent.cpp:
(webkit_dom_event_set_property):
(webkit_dom_event_get_property):
(webkit_dom_event_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMFile.cpp:
(webkit_dom_file_get_property):
(webkit_dom_file_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMFileList.cpp:
(webkit_dom_file_list_get_property):
(webkit_dom_file_list_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLAnchorElement.cpp:
(webkit_dom_html_anchor_element_dom_event_target_init):
(webkit_dom_html_anchor_element_set_property):
(webkit_dom_html_anchor_element_get_property):
(webkit_dom_html_anchor_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLAppletElement.cpp:
(webkit_dom_html_applet_element_dom_event_target_init):
(webkit_dom_html_applet_element_set_property):
(webkit_dom_html_applet_element_get_property):
(webkit_dom_html_applet_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLAreaElement.cpp:
(webkit_dom_html_area_element_dom_event_target_init):
(webkit_dom_html_area_element_set_property):
(webkit_dom_html_area_element_get_property):
(webkit_dom_html_area_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLBRElement.cpp:
(webkit_dom_html_br_element_dom_event_target_init):
(webkit_dom_html_br_element_set_property):
(webkit_dom_html_br_element_get_property):
(webkit_dom_html_br_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLBaseElement.cpp:
(webkit_dom_html_base_element_dom_event_target_init):
(webkit_dom_html_base_element_set_property):
(webkit_dom_html_base_element_get_property):
(webkit_dom_html_base_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLBodyElement.cpp:
(webkit_dom_html_body_element_dom_event_target_init):
(webkit_dom_html_body_element_set_property):
(webkit_dom_html_body_element_get_property):
(webkit_dom_html_body_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLButtonElement.cpp:
(webkit_dom_html_button_element_dom_event_target_init):
(webkit_dom_html_button_element_set_property):
(webkit_dom_html_button_element_get_property):
(webkit_dom_html_button_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLCanvasElement.cpp:
(webkit_dom_html_canvas_element_dom_event_target_init):
(webkit_dom_html_canvas_element_set_property):
(webkit_dom_html_canvas_element_get_property):
(webkit_dom_html_canvas_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLCollection.cpp:
(webkit_dom_html_collection_get_property):
(webkit_dom_html_collection_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLDListElement.cpp:
(webkit_dom_html_d_list_element_dom_event_target_init):
(webkit_dom_html_d_list_element_set_property):
(webkit_dom_html_d_list_element_get_property):
(webkit_dom_html_d_list_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLDirectoryElement.cpp:
(webkit_dom_html_directory_element_dom_event_target_init):
(webkit_dom_html_directory_element_set_property):
(webkit_dom_html_directory_element_get_property):
(webkit_dom_html_directory_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLDivElement.cpp:
(webkit_dom_html_div_element_dom_event_target_init):
(webkit_dom_html_div_element_set_property):
(webkit_dom_html_div_element_get_property):
(webkit_dom_html_div_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLDocument.cpp:
(webkit_dom_html_document_dom_event_target_init):
(webkit_dom_html_document_set_property):
(webkit_dom_html_document_get_property):
(webkit_dom_html_document_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLElement.cpp:
(webkit_dom_html_element_dom_event_target_init):
(webkit_dom_html_element_set_property):
(webkit_dom_html_element_get_property):
(webkit_dom_html_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLEmbedElement.cpp:
(webkit_dom_html_embed_element_dom_event_target_init):
(webkit_dom_html_embed_element_set_property):
(webkit_dom_html_embed_element_get_property):
(webkit_dom_html_embed_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFieldSetElement.cpp:
(webkit_dom_html_field_set_element_dom_event_target_init):
(webkit_dom_html_field_set_element_get_property):
(webkit_dom_html_field_set_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFontElement.cpp:
(webkit_dom_html_font_element_dom_event_target_init):
(webkit_dom_html_font_element_set_property):
(webkit_dom_html_font_element_get_property):
(webkit_dom_html_font_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFormElement.cpp:
(webkit_dom_html_form_element_dom_event_target_init):
(webkit_dom_html_form_element_set_property):
(webkit_dom_html_form_element_get_property):
(webkit_dom_html_form_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFrameElement.cpp:
(webkit_dom_html_frame_element_dom_event_target_init):
(webkit_dom_html_frame_element_set_property):
(webkit_dom_html_frame_element_get_property):
(webkit_dom_html_frame_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLFrameSetElement.cpp:
(webkit_dom_html_frame_set_element_dom_event_target_init):
(webkit_dom_html_frame_set_element_set_property):
(webkit_dom_html_frame_set_element_get_property):
(webkit_dom_html_frame_set_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLHRElement.cpp:
(webkit_dom_html_hr_element_dom_event_target_init):
(webkit_dom_html_hr_element_set_property):
(webkit_dom_html_hr_element_get_property):
(webkit_dom_html_hr_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLHeadElement.cpp:
(webkit_dom_html_head_element_dom_event_target_init):
(webkit_dom_html_head_element_set_property):
(webkit_dom_html_head_element_get_property):
(webkit_dom_html_head_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLHeadingElement.cpp:
(webkit_dom_html_heading_element_dom_event_target_init):
(webkit_dom_html_heading_element_set_property):
(webkit_dom_html_heading_element_get_property):
(webkit_dom_html_heading_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLHtmlElement.cpp:
(webkit_dom_html_html_element_dom_event_target_init):
(webkit_dom_html_html_element_set_property):
(webkit_dom_html_html_element_get_property):
(webkit_dom_html_html_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLIFrameElement.cpp:
(webkit_dom_html_iframe_element_dom_event_target_init):
(webkit_dom_html_iframe_element_set_property):
(webkit_dom_html_iframe_element_get_property):
(webkit_dom_html_iframe_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLImageElement.cpp:
(webkit_dom_html_image_element_dom_event_target_init):
(webkit_dom_html_image_element_set_property):
(webkit_dom_html_image_element_get_property):
(webkit_dom_html_image_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLInputElement.cpp:
(webkit_dom_html_input_element_dom_event_target_init):
(webkit_dom_html_input_element_set_property):
(webkit_dom_html_input_element_get_property):
(webkit_dom_html_input_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLLIElement.cpp:
(webkit_dom_html_li_element_dom_event_target_init):
(webkit_dom_html_li_element_set_property):
(webkit_dom_html_li_element_get_property):
(webkit_dom_html_li_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLLabelElement.cpp:
(webkit_dom_html_label_element_dom_event_target_init):
(webkit_dom_html_label_element_set_property):
(webkit_dom_html_label_element_get_property):
(webkit_dom_html_label_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLLegendElement.cpp:
(webkit_dom_html_legend_element_dom_event_target_init):
(webkit_dom_html_legend_element_set_property):
(webkit_dom_html_legend_element_get_property):
(webkit_dom_html_legend_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLLinkElement.cpp:
(webkit_dom_html_link_element_dom_event_target_init):
(webkit_dom_html_link_element_set_property):
(webkit_dom_html_link_element_get_property):
(webkit_dom_html_link_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLMapElement.cpp:
(webkit_dom_html_map_element_dom_event_target_init):
(webkit_dom_html_map_element_set_property):
(webkit_dom_html_map_element_get_property):
(webkit_dom_html_map_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLMarqueeElement.cpp:
(webkit_dom_html_marquee_element_dom_event_target_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLMenuElement.cpp:
(webkit_dom_html_menu_element_dom_event_target_init):
(webkit_dom_html_menu_element_set_property):
(webkit_dom_html_menu_element_get_property):
(webkit_dom_html_menu_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLMetaElement.cpp:
(webkit_dom_html_meta_element_dom_event_target_init):
(webkit_dom_html_meta_element_set_property):
(webkit_dom_html_meta_element_get_property):
(webkit_dom_html_meta_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLModElement.cpp:
(webkit_dom_html_mod_element_dom_event_target_init):
(webkit_dom_html_mod_element_set_property):
(webkit_dom_html_mod_element_get_property):
(webkit_dom_html_mod_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLOListElement.cpp:
(webkit_dom_html_o_list_element_dom_event_target_init):
(webkit_dom_html_o_list_element_set_property):
(webkit_dom_html_o_list_element_get_property):
(webkit_dom_html_o_list_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLObjectElement.cpp:
(webkit_dom_html_object_element_dom_event_target_init):
(webkit_dom_html_object_element_set_property):
(webkit_dom_html_object_element_get_property):
(webkit_dom_html_object_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLOptGroupElement.cpp:
(webkit_dom_html_opt_group_element_dom_event_target_init):
(webkit_dom_html_opt_group_element_set_property):
(webkit_dom_html_opt_group_element_get_property):
(webkit_dom_html_opt_group_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLOptionElement.cpp:
(webkit_dom_html_option_element_dom_event_target_init):
(webkit_dom_html_option_element_set_property):
(webkit_dom_html_option_element_get_property):
(webkit_dom_html_option_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLOptionsCollection.cpp:
(webkit_dom_html_options_collection_set_property):
(webkit_dom_html_options_collection_get_property):
(webkit_dom_html_options_collection_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLParagraphElement.cpp:
(webkit_dom_html_paragraph_element_dom_event_target_init):
(webkit_dom_html_paragraph_element_set_property):
(webkit_dom_html_paragraph_element_get_property):
(webkit_dom_html_paragraph_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLParamElement.cpp:
(webkit_dom_html_param_element_dom_event_target_init):
(webkit_dom_html_param_element_set_property):
(webkit_dom_html_param_element_get_property):
(webkit_dom_html_param_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLPreElement.cpp:
(webkit_dom_html_pre_element_dom_event_target_init):
(webkit_dom_html_pre_element_set_property):
(webkit_dom_html_pre_element_get_property):
(webkit_dom_html_pre_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLQuoteElement.cpp:
(webkit_dom_html_quote_element_dom_event_target_init):
(webkit_dom_html_quote_element_set_property):
(webkit_dom_html_quote_element_get_property):
(webkit_dom_html_quote_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLScriptElement.cpp:
(webkit_dom_html_script_element_dom_event_target_init):
(webkit_dom_html_script_element_set_property):
(webkit_dom_html_script_element_get_property):
(webkit_dom_html_script_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLSelectElement.cpp:
(webkit_dom_html_select_element_dom_event_target_init):
(webkit_dom_html_select_element_set_property):
(webkit_dom_html_select_element_get_property):
(webkit_dom_html_select_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLStyleElement.cpp:
(webkit_dom_html_style_element_dom_event_target_init):
(webkit_dom_html_style_element_set_property):
(webkit_dom_html_style_element_get_property):
(webkit_dom_html_style_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCaptionElement.cpp:
(webkit_dom_html_table_caption_element_dom_event_target_init):
(webkit_dom_html_table_caption_element_set_property):
(webkit_dom_html_table_caption_element_get_property):
(webkit_dom_html_table_caption_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableCellElement.cpp:
(webkit_dom_html_table_cell_element_dom_event_target_init):
(webkit_dom_html_table_cell_element_set_property):
(webkit_dom_html_table_cell_element_get_property):
(webkit_dom_html_table_cell_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableColElement.cpp:
(webkit_dom_html_table_col_element_dom_event_target_init):
(webkit_dom_html_table_col_element_set_property):
(webkit_dom_html_table_col_element_get_property):
(webkit_dom_html_table_col_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableElement.cpp:
(webkit_dom_html_table_element_dom_event_target_init):
(webkit_dom_html_table_element_set_property):
(webkit_dom_html_table_element_get_property):
(webkit_dom_html_table_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableRowElement.cpp:
(webkit_dom_html_table_row_element_dom_event_target_init):
(webkit_dom_html_table_row_element_set_property):
(webkit_dom_html_table_row_element_get_property):
(webkit_dom_html_table_row_element_class_init):
(webkit_dom_html_table_row_element_insert_cell):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTableSectionElement.cpp:
(webkit_dom_html_table_section_element_dom_event_target_init):
(webkit_dom_html_table_section_element_set_property):
(webkit_dom_html_table_section_element_get_property):
(webkit_dom_html_table_section_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTextAreaElement.cpp:
(webkit_dom_html_text_area_element_dom_event_target_init):
(webkit_dom_html_text_area_element_set_property):
(webkit_dom_html_text_area_element_get_property):
(webkit_dom_html_text_area_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLTitleElement.cpp:
(webkit_dom_html_title_element_dom_event_target_init):
(webkit_dom_html_title_element_set_property):
(webkit_dom_html_title_element_get_property):
(webkit_dom_html_title_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMHTMLUListElement.cpp:
(webkit_dom_html_u_list_element_dom_event_target_init):
(webkit_dom_html_u_list_element_set_property):
(webkit_dom_html_u_list_element_get_property):
(webkit_dom_html_u_list_element_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMKeyboardEvent.cpp:
(webkit_dom_keyboard_event_get_property):
(webkit_dom_keyboard_event_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMMediaList.cpp:
(webkit_dom_media_list_set_property):
(webkit_dom_media_list_get_property):
(webkit_dom_media_list_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMMouseEvent.cpp:
(webkit_dom_mouse_event_get_property):
(webkit_dom_mouse_event_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMNamedNodeMap.cpp:
(webkit_dom_named_node_map_get_property):
(webkit_dom_named_node_map_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMNode.cpp:
(webkit_dom_node_dom_event_target_init):
(webkit_dom_node_set_property):
(webkit_dom_node_get_property):
(webkit_dom_node_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMNodeIterator.cpp:
(webkit_dom_node_iterator_get_property):
(webkit_dom_node_iterator_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMNodeList.cpp:
(webkit_dom_node_list_get_property):
(webkit_dom_node_list_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMObject.cpp:
(webkitDOMObjectSetProperty):
(webkit_dom_object_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMProcessingInstruction.cpp:
(webkit_dom_processing_instruction_dom_event_target_init):
(webkit_dom_processing_instruction_get_property):
(webkit_dom_processing_instruction_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMRange.cpp:
(webkit_dom_range_get_property):
(webkit_dom_range_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMStyleSheet.cpp:
(webkit_dom_style_sheet_set_property):
(webkit_dom_style_sheet_get_property):
(webkit_dom_style_sheet_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMStyleSheetList.cpp:
(webkit_dom_style_sheet_list_get_property):
(webkit_dom_style_sheet_list_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMText.cpp:
(webkit_dom_text_dom_event_target_init):
(webkit_dom_text_get_property):
(webkit_dom_text_class_init):
(webkit_dom_event_target_init): Deleted.
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMTreeWalker.cpp:
(webkit_dom_tree_walker_get_property):
(webkit_dom_tree_walker_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMUIEvent.cpp:
(webkit_dom_ui_event_get_property):
(webkit_dom_ui_event_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMWheelEvent.cpp:
(webkit_dom_wheel_event_get_property):
(webkit_dom_wheel_event_class_init):
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMXPathResult.cpp:
(webkit_dom_xpath_result_get_property):
(webkit_dom_xpath_result_class_init):
* WebProcess/InjectedBundle/glib/InjectedBundleGlib.cpp:
* WebProcess/MediaCache/WebMediaKeyStorageManager.cpp:
* WebProcess/Plugins/Netscape/unix/NetscapePluginUnix.cpp:
* WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp:
* WebProcess/WebCoreSupport/curl/WebFrameNetworkingContext.cpp:
* WebProcess/WebCoreSupport/gtk/WebContextMenuClientGtk.cpp:
* WebProcess/WebCoreSupport/gtk/WebDragClientGtk.cpp:
* WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:
* WebProcess/WebCoreSupport/gtk/WebPopupMenuGtk.cpp:
* WebProcess/WebPage/AcceleratedDrawingArea.cpp:
* WebProcess/WebPage/AcceleratedSurface.cpp:
* WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp:
* WebProcess/WebPage/CoordinatedGraphics/CoordinatedLayerTreeHost.cpp:
* WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp:
* WebProcess/WebPage/DrawingAreaImpl.cpp:
* WebProcess/WebPage/gtk/AcceleratedSurfaceWayland.cpp:
* WebProcess/WebPage/gtk/AcceleratedSurfaceX11.cpp:
* WebProcess/WebPage/gtk/WebPageGtk.cpp:
* WebProcess/gtk/WaylandCompositorDisplay.cpp:
* WebProcess/gtk/WebProcessMainGtk.cpp:


  Commit: f020d9ca7787c9905e6eba17c2750688965875cc
      https://github.com/WebKit/WebKit/commit/f020d9ca7787c9905e6eba17c2750688965875cc
  Author: Piotr Drąg <piotrdrag at gmail.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/pl.po

  Log Message:
  -----------
  Merge r228378 - [l10n] Updated Polish translation of WebKitGTK+ for 2.20
https://bugs.webkit.org/show_bug.cgi?id=182693

Patch by Piotr Drąg <piotrdrag at gmail.com> on 2018-02-12
Rubber-stamped by Michael Catanzaro.

* pl.po:


  Commit: e0fed8ab5ded42429fbde3450cd9ec3d33afed87
      https://github.com/WebKit/WebKit/commit/e0fed8ab5ded42429fbde3450cd9ec3d33afed87
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/rendering/RenderView.cpp

  Log Message:
  -----------
  Merge r228387 - [RenderTreeBuilder] Remove redundant RenderTreeBuilder instance
https://bugs.webkit.org/show_bug.cgi?id=182700
<rdar://problem/37463958>

Reviewed by Antti Koivisto.

* rendering/RenderView.cpp:
(WebCore::RenderView::willBeDestroyed):


  Commit: 6ef465ef39b184c18ab0b604d241b5e9d09d99b5
      https://github.com/WebKit/WebKit/commit/6ef465ef39b184c18ab0b604d241b5e9d09d99b5
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/RegExpObject.cpp

  Log Message:
  -----------
  Merge r228388 - Fix missing exception check in RegExpObject::matchGlobal().
https://bugs.webkit.org/show_bug.cgi?id=182701
<rdar://problem/37465865>

Reviewed by Michael Saboff.

This issue was discovered when running JSC tests on an asm LLInt build with
JSC_useJIT=false.

* runtime/RegExpObject.cpp:
(JSC::RegExpObject::matchGlobal):


  Commit: 3eee377d53ff21273056cd0970103d430ef130a0
      https://github.com/WebKit/WebKit/commit/3eee377d53ff21273056cd0970103d430ef130a0
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h

  Log Message:
  -----------
  Merge r228391 - [RenderTreeBuilder] Move RenderBlock::dropAnonymousBoxChild to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182704
<rdar://problem/37469469>

Reviewed by Antti Koivisto.

All the callsites are now in RenderTreeBuilder.

No change in functionality.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::dropAnonymousBoxChild): Deleted.
* rendering/RenderBlock.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded):
(WebCore::RenderTreeBuilder::dropAnonymousBoxChild):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::takeChild):
(WebCore::RenderTreeBuilder::Block::dropAnonymousBoxChild):
* rendering/updating/RenderTreeBuilderBlock.h:


  Commit: 6c5dd71780265504c82f9a99e208f4101c5c0b49
      https://github.com/WebKit/WebKit/commit/6c5dd71780265504c82f9a99e208f4101c5c0b49
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/llint/LLIntData.h
    M Source/JavaScriptCore/llint/LLIntPCRanges.h
    M Source/JavaScriptCore/runtime/Options.cpp
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/PointerPreparations.h

  Log Message:
  -----------
  Merge r228397 - Add more support for pointer preparations.
https://bugs.webkit.org/show_bug.cgi?id=182703
<rdar://problem/37469451>

Reviewed by Saam Barati.

Source/JavaScriptCore:

* llint/LLIntData.h:
(JSC::LLInt::getCodePtr):
* llint/LLIntPCRanges.h:
(JSC::LLInt::isLLIntPC):
* runtime/Options.cpp:
(JSC::recomputeDependentOptions):

Source/WTF:

* wtf/PointerPreparations.h:


  Commit: c8be3d9ffada125b61e06adebf25393c53abef44
      https://github.com/WebKit/WebKit/commit/c8be3d9ffada125b61e06adebf25393c53abef44
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderButton.cpp
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderFullScreen.cpp
    M Source/WebCore/rendering/RenderMenuList.cpp
    M Source/WebCore/rendering/RenderRuby.cpp
    M Source/WebCore/rendering/RenderRuby.h
    M Source/WebCore/rendering/RenderRubyRun.cpp
    M Source/WebCore/rendering/RenderRubyRun.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228400 - [RenderTreeBuilder] Introduce RenderTreebuilder::takeChild
https://bugs.webkit.org/show_bug.cgi?id=182707
<rdar://problem/37473433>

Reviewed by Antti Koivisto.

All takeChild calls should go through RenderTreeBuilder::takeChild from now on.
This patch also moves the Ruby related takeChild calls to RenderTreeBuilder.

No change in functionality.

* rendering/RenderButton.cpp:
(WebCore::RenderButton::takeChild):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::removeAndDestroyChild):
* rendering/RenderFullScreen.cpp:
(WebCore::RenderFullScreen::wrapExistingRenderer):
(WebCore::RenderFullScreen::unwrapRenderer):
* rendering/RenderMenuList.cpp:
(RenderMenuList::takeChild):
* rendering/RenderRuby.cpp:
(WebCore::RenderRubyAsInline::takeChild): Deleted.
(WebCore::RenderRubyAsBlock::takeChild): Deleted.
* rendering/RenderRuby.h:
* rendering/RenderRubyRun.cpp:
(WebCore::RenderRubyRun::takeChild): Deleted.
* rendering/RenderRubyRun.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
(WebCore::RenderTreeBuilder::takeChildFromRenderRubyAsInline): Deleted.
(WebCore::RenderTreeBuilder::takeChildFromRenderRubyAsBlock): Deleted.
(WebCore::RenderTreeBuilder::takeChildFromRenderRubyRun): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::updateStyle):
* rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::RenderTreeBuilder::List::updateItemMarker):
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::createFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::destroyFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::processPossibleSpannerDescendant):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::takeChild):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::collapseAndDestroyAnonymousSiblingRows):


  Commit: 3c984f5656b7c121d8789bcacbec94320f4012b3
      https://github.com/WebKit/WebKit/commit/3c984f5656b7c121d8789bcacbec94320f4012b3
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/get-array-length-phantom-new-array-buffer.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGArgumentsUtilities.cpp

  Log Message:
  -----------
  Merge r228401 - DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
https://bugs.webkit.org/show_bug.cgi?id=182706
<rdar://problem/36833681>

Reviewed by Filip Pizlo.

JSTests:

* stress/get-array-length-phantom-new-array-buffer.js: Added.
(effects):
(foo):

Source/JavaScriptCore:

When we added support for PhantomNewArrayBuffer, we forgot to update
the emitCodeToGetArgumentsArrayLength function to handle PhantomNewArrayBuffer.
This patch adds that support. It's trivial to generate the length for
a PhantomNewArrayBuffer node since it's a constant buffer, with a constant
length.

* dfg/DFGArgumentsUtilities.cpp:
(JSC::DFG::emitCodeToGetArgumentsArrayLength):


  Commit: a6369b0b400b67da1efb23a3a6222de73862d2c2
      https://github.com/WebKit/WebKit/commit/a6369b0b400b67da1efb23a3a6222de73862d2c2
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/offlineasm/arm.rb
    M Source/JavaScriptCore/offlineasm/arm64.rb
    M Source/JavaScriptCore/offlineasm/ast.rb
    M Source/JavaScriptCore/offlineasm/backends.rb
    M Source/JavaScriptCore/offlineasm/cloop.rb
    M Source/JavaScriptCore/offlineasm/config.rb
    M Source/JavaScriptCore/offlineasm/mips.rb
    M Source/JavaScriptCore/offlineasm/risc.rb
    M Source/JavaScriptCore/offlineasm/x86.rb

  Log Message:
  -----------
  Merge r228402 - Miscellaneous refactoring of offlineasm.
https://bugs.webkit.org/show_bug.cgi?id=182702
<rdar://problem/37467887>

Reviewed by Filip Pizlo.

1. Refactor out the emission of $asm.comment, $asm.codeOrigin, $asm.annotation,
   and $asm.debugAnnotation into a recordMetaData method.  This standardizes how
   we emit this metadata and makes all backends do it the same way.

2. Add the ability to include custom offlineasm scripts from WebKitAdditions in
   the future.

* offlineasm/arm.rb:
* offlineasm/arm64.rb:
* offlineasm/ast.rb:
* offlineasm/backends.rb:
* offlineasm/cloop.rb:
* offlineasm/config.rb:
* offlineasm/mips.rb:
* offlineasm/risc.rb:
* offlineasm/x86.rb:


  Commit: 01390fd05b0ac24fae89a5431b0bc665d4fb222a
      https://github.com/WebKit/WebKit/commit/01390fd05b0ac24fae89a5431b0bc665d4fb222a
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGAdjacencyList.h
    M Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGBackwardsPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGBasicBlock.cpp
    M Source/JavaScriptCore/dfg/DFGBasicBlock.h
    M Source/JavaScriptCore/dfg/DFGBasicBlockInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGCPSRethreadingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
    M Source/JavaScriptCore/dfg/DFGCleanUpPhase.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGDCEPhase.cpp
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGHeapLocation.cpp
    M Source/JavaScriptCore/dfg/DFGHeapLocation.h
    M Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp
    M Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGLICMPhase.cpp
    M Source/JavaScriptCore/dfg/DFGMayExit.cpp
    M Source/JavaScriptCore/dfg/DFGNode.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGObjectAllocationSinkingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGPureValue.cpp
    M Source/JavaScriptCore/dfg/DFGPureValue.h
    M Source/JavaScriptCore/dfg/DFGPutStackSinkingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSSAConversionPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSSALoweringPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/dfg/DFGStoreBarrierClusteringPhase.cpp
    M Source/JavaScriptCore/dfg/DFGValidate.cpp
    M Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r228411 - Add a GetIndexMask node and make it an input to GetByVal for array and typed array accesses in DFG SSA
https://bugs.webkit.org/show_bug.cgi?id=182633
<rdar://problem/37441037>

Reviewed by Keith Miller.

This patch introduces a GetIndexMask node to DFG SSA. This is an input to
GetByVal for the GetByVal variants that do conservative index masking.
The reason I'm adding this node is I realized there were loads of
the butterfly index mask inside loops that B3 couldn't reason about
because B3 can't arbitrarily hoist loads out of loops if those loops
have side exits (because the side exit might be protecting the safety of the
load). However, for these loops I analyzed, the DFG would be able to hoist
these loads out of loops because it knows about JS semantics to correctly
reason about the safety of hoisting the load.

This is a 1% speedup on JetStream on Mac and iOS in my testing.

This patch also adds some infrastructure for eliminating and doing CSE on
varargs nodes. Because this patch makes GetByVal a varargs node, I ran into
issues we never had before. We never had a varargs node that could be CSEd or be
hoisted out of a loop until I made GetByVal varargs. To make it all work,
I added a CheckVarargs node. This is just like Check, but it's varargs.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGAdjacencyList.h:
(JSC::DFG::AdjacencyList::AdjacencyList):
* dfg/DFGArgumentsEliminationPhase.cpp:
* dfg/DFGBackwardsPropagationPhase.cpp:
(JSC::DFG::BackwardsPropagationPhase::propagate):
* dfg/DFGBasicBlock.cpp:
(JSC::DFG::BasicBlock::replaceTerminal):
* dfg/DFGBasicBlock.h:
(JSC::DFG::BasicBlock::findTerminal const):
* dfg/DFGBasicBlockInlines.h:
(JSC::DFG::BasicBlock::replaceTerminal):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::mergeBlocks):
* dfg/DFGCPSRethreadingPhase.cpp:
(JSC::DFG::CPSRethreadingPhase::canonicalizeGetLocalFor):
(JSC::DFG::CPSRethreadingPhase::canonicalizeFlushOrPhantomLocalFor):
* dfg/DFGCSEPhase.cpp:
* dfg/DFGCleanUpPhase.cpp:
(JSC::DFG::CleanUpPhase::run):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
(JSC::DFG::ConstantFoldingPhase::fixUpsilons):
* dfg/DFGDCEPhase.cpp:
(JSC::DFG::DCEPhase::run):
(JSC::DFG::DCEPhase::fixupBlock):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupChecksInBlock):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGIntegerCheckCombiningPhase.cpp:
(JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
* dfg/DFGIntegerRangeOptimizationPhase.cpp:
* dfg/DFGLICMPhase.cpp:
(JSC::DFG::LICMPhase::attemptHoist):
* dfg/DFGMayExit.cpp:
* dfg/DFGNode.cpp:
(JSC::DFG::Node::remove):
(JSC::DFG::Node::convertToIdentityOn):
* dfg/DFGNode.h:
(JSC::DFG::Node::replaceWith):
* dfg/DFGNodeType.h:
* dfg/DFGObjectAllocationSinkingPhase.cpp:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGPureValue.cpp:
(JSC::DFG::PureValue::dump const):
* dfg/DFGPureValue.h:
(JSC::DFG::PureValue::PureValue):
* dfg/DFGPutStackSinkingPhase.cpp:
* dfg/DFGSSAConversionPhase.cpp:
(JSC::DFG::SSAConversionPhase::run):
* dfg/DFGSSALoweringPhase.cpp:
(JSC::DFG::SSALoweringPhase::handleNode):
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::SpeculativeJIT):
(JSC::DFG::SpeculativeJIT::compileGetByValOnString):
(JSC::DFG::SpeculativeJIT::compileGetByValOnIntTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValOnFloatTypedArray):
(JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithString):
(JSC::DFG::SpeculativeJIT::compileGetByValForObjectWithSymbol):
(JSC::DFG::SpeculativeJIT::compileGetByValOnDirectArguments):
(JSC::DFG::SpeculativeJIT::compileGetByValOnScopedArguments):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStoreBarrierClusteringPhase.cpp:
* dfg/DFGValidate.cpp:
* dfg/DFGVarargsForwardingPhase.cpp:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayMask):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByVal):
(JSC::FTL::DFG::LowerDFGToB3::compileStringCharAt):
(JSC::FTL::DFG::LowerDFGToB3::maskedIndex):
(JSC::FTL::DFG::LowerDFGToB3::pointerIntoTypedArray):


  Commit: f454e66eeb30cad55ff5e9e5c51dd95746d297ec
      https://github.com/WebKit/WebKit/commit/f454e66eeb30cad55ff5e9e5c51dd95746d297ec
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

  Log Message:
  -----------
  Merge r228438 - Follup fix to r228411 for 32-bit builds. I missed a place where we used non vararg getter for child2().

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):


  Commit: 1c296497cbe58a04f47052b2184143c6c79c2955
      https://github.com/WebKit/WebKit/commit/1c296497cbe58a04f47052b2184143c6c79c2955
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/constant-folding-phase-insert-check-handle-varargs.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGGraph.h
    M Source/JavaScriptCore/dfg/DFGInsertionSet.h
    M Source/JavaScriptCore/dfg/DFGLICMPhase.cpp
    M Source/JavaScriptCore/dfg/DFGPureValue.cpp
    M Source/JavaScriptCore/dfg/DFGPureValue.h
    M Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp

  Log Message:
  -----------
  Merge r228565 - Fix bugs from r228411
https://bugs.webkit.org/show_bug.cgi?id=182851
<rdar://problem/37577732>

Reviewed by JF Bastien.

JSTests:

* stress/constant-folding-phase-insert-check-handle-varargs.js: Added.

Source/JavaScriptCore:

There was a bug from r228411 where inside the constant folding phase,
we used an insertCheck method that didn't handle varargs. This would
lead to a crash. When thinking about the fix for that function, I realized
a made a couple of mistakes in r228411. One is probably a security bug, and
the other is a performance bug because it'll prevent CSE for certain flavors
of GetByVal nodes. Both blunders are similar in nature.

In r228411, I added code in LICM that inserted a CheckVarargs node with children
of another varargs node. However, to construct this new node's children,
I just copied the AdjacencyList. This does a shallow copy. What we needed
was a deep copy. We needed to create a new vararg AdjacencyList that points
to edges that are deep copies of the original varargs children. This patch
fixes this goof in LICM.

r228411 made it so that PureValue over a varargs node would just compare actual
AdjacencyLists structs. So, if you had two GetByVals that had equal santized
children, their actual AdjacencyList structs are *not* bitwise equal, since they'll
have different firstChild values. Instead, we need to do a deep compare of their
adjacency lists. This patch teaches PureValue how to do that.

* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGGraph.h:
(JSC::DFG::Graph::copyVarargChildren):
* dfg/DFGInsertionSet.h:
(JSC::DFG::InsertionSet::insertCheck):
* dfg/DFGLICMPhase.cpp:
(JSC::DFG::LICMPhase::attemptHoist):
* dfg/DFGPureValue.cpp:
(JSC::DFG::PureValue::dump const):
* dfg/DFGPureValue.h:
(JSC::DFG::PureValue::PureValue):
(JSC::DFG::PureValue::op const):
(JSC::DFG::PureValue::hash const):
(JSC::DFG::PureValue::operator== const):
(JSC::DFG::PureValue::isVarargs const):
(JSC::DFG::PureValue::children const): Deleted.
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):
(JSC::DFG::StrengthReductionPhase::convertToIdentityOverChild):


  Commit: 2fa283a59e13faa6b1283953e829e3488b9d7f98
      https://github.com/WebKit/WebKit/commit/2fa283a59e13faa6b1283953e829e3488b9d7f98
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderMenuList.cpp
    M Source/WebCore/rendering/RenderMenuList.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h

  Log Message:
  -----------
  Merge r228414 - [RenderTreeBuilder] Move RenderMenuList::takeChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182715
<rdar://problem/37477050>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderMenuList.cpp:
(RenderMenuList::takeChild): Deleted.
* rendering/RenderMenuList.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
(WebCore::RenderTreeBuilder::takeChildFromRenderMenuList):
* rendering/updating/RenderTreeBuilder.h:


  Commit: f8e993051b56a7f12b1138b59f2b692fd1ad0259
      https://github.com/WebKit/WebKit/commit/f8e993051b56a7f12b1138b59f2b692fd1ad0259
  Author: John Wilander <wilander at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-subresource-redirect-collusion-expected.txt
    A LayoutTests/http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-subresource-redirect-collusion.html
    A LayoutTests/http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-redirect-collusion-expected.txt
    A LayoutTests/http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-redirect-collusion.html
    A LayoutTests/http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-unique-redirects-to-expected.txt
    A LayoutTests/http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-unique-redirects-to.html
    M LayoutTests/platform/wk2/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/ResourceLoadObserver.cpp
    M Source/WebCore/loader/ResourceLoadStatistics.cpp
    M Source/WebCore/loader/ResourceLoadStatistics.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/classifier/ResourceLoadStatisticsClassifier.cpp
    M Source/WebKit/Shared/WebCoreArgumentCoders.cpp
    M Source/WebKit/UIProcess/API/C/WKWebsiteDataStoreRef.cpp
    M Source/WebKit/UIProcess/API/C/WKWebsiteDataStoreRef.h
    M Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.cpp
    M Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.h
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.h
    M Tools/WebKitTestRunner/TestController.cpp
    M Tools/WebKitTestRunner/TestController.h
    M Tools/WebKitTestRunner/TestInvocation.cpp

  Log Message:
  -----------
  Merge r228416 - Resource Load Statistics: Classify resources as prevalent based on redirects to other prevalent resources
https://bugs.webkit.org/show_bug.cgi?id=182664
<rdar://problem/37372572>

Reviewed by Brent Fulgham.

Source/WebCore:

Tests: http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-subresource-redirect-collusion.html
       http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-redirect-collusion.html
       http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-unique-redirects-to.html

* loader/ResourceLoadObserver.cpp:
(WebCore::ResourceLoadObserver::logFrameNavigation):
    We now collect statistics on top frame navigational redirects too, both to and from.
(WebCore::ResourceLoadObserver::logSubresourceLoading):
    We now collect statistics on redirects from in addition to the existing redirects to.
* loader/ResourceLoadStatistics.cpp:
(WebCore::ResourceLoadStatistics::encode const):
(WebCore::ResourceLoadStatistics::decode):
(WebCore::ResourceLoadStatistics::toString const):
(WebCore::ResourceLoadStatistics::merge):
* loader/ResourceLoadStatistics.h:
    Three new fields:
    - topFrameUniqueRedirectsTo
    - topFrameUniqueRedirectsFrom
    - subresourceUniqueRedirectsFrom

Source/WebKit:

* Platform/classifier/ResourceLoadStatisticsClassifier.cpp:
(WebKit::ResourceLoadStatisticsClassifier::hasPrevalentResourceCharacteristics):
    Unique top frame redirects now counts toward classification as prevalent.
* Shared/WebCoreArgumentCoders.cpp:
(IPC::ArgumentCoder<ResourceLoadStatistics>::encode):
(IPC::ArgumentCoder<ResourceLoadStatistics>::decode):
* UIProcess/API/C/WKWebsiteDataStoreRef.cpp:
(WKWebsiteDataStoreSetStatisticsSubresourceUniqueRedirectFrom):
(WKWebsiteDataStoreSetStatisticsTopFrameUniqueRedirectTo):
(WKWebsiteDataStoreSetStatisticsTopFrameUniqueRedirectFrom):
    Test infrastructure.
* UIProcess/API/C/WKWebsiteDataStoreRef.h:
* UIProcess/WebResourceLoadStatisticsStore.cpp:
    Bumped the statistics model to 11 because of the added fields.
(WebKit::WebResourceLoadStatisticsStore::recursivelyGetAllDomainsThatHaveRedirectedToThisDomain):
    This function back traces redirect chains to classify domains
    that have redirected to a newly classified prevalent resource.
(WebKit::WebResourceLoadStatisticsStore::processStatisticsAndDataRecords):
    Now uses the new convenience function WebResourceLoadStatisticsStore::setPrevalentResource().
(WebKit::WebResourceLoadStatisticsStore::setPrevalentResource):
    New convenience function to make sure we always call
    WebResourceLoadStatisticsStore::recursivelyGetAllDomainsThatHaveRedirectedToThisDomain()
    and capture redirect chains backward.
(WebKit::WebResourceLoadStatisticsStore::setSubframeUnderTopFrameOrigin):
(WebKit::WebResourceLoadStatisticsStore::setSubresourceUnderTopFrameOrigin):
(WebKit::WebResourceLoadStatisticsStore::setSubresourceUniqueRedirectTo):
(WebKit::WebResourceLoadStatisticsStore::setSubresourceUniqueRedirectFrom):
(WebKit::WebResourceLoadStatisticsStore::setTopFrameUniqueRedirectTo):
(WebKit::WebResourceLoadStatisticsStore::setTopFrameUniqueRedirectFrom):
    Test infrastructure.
* UIProcess/WebResourceLoadStatisticsStore.h:

Tools:

* WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::setStatisticsSubresourceUniqueRedirectFrom):
(WTR::TestRunner::setStatisticsTopFrameUniqueRedirectTo):
(WTR::TestRunner::setStatisticsTopFrameUniqueRedirectFrom):
* WebKitTestRunner/InjectedBundle/TestRunner.h:
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::setStatisticsSubresourceUniqueRedirectFrom):
(WTR::TestController::setStatisticsTopFrameUniqueRedirectTo):
(WTR::TestController::setStatisticsTopFrameUniqueRedirectFrom):
* WebKitTestRunner/TestController.h:
* WebKitTestRunner/TestInvocation.cpp:
(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):

LayoutTests:

* http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-subresource-redirect-collusion-expected.txt: Added.
* http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-subresource-redirect-collusion.html: Added.
* http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-redirect-collusion-expected.txt: Added.
* http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-redirect-collusion.html: Added.
* http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-unique-redirects-to-expected.txt: Added.
* http/tests/resourceLoadStatistics/classify-as-prevalent-based-on-top-frame-unique-redirects-to.html: Added.
* platform/wk2/TestExpectations:
    New tests added as [ Pass ].


  Commit: f8fab14eaca16d1130268a8fd95316dc26bd1297
      https://github.com/WebKit/WebKit/commit/f8fab14eaca16d1130268a8fd95316dc26bd1297
  Author: Chris Fleizach <cfleizach at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/accessibility/mac/aria-menu-item-selected-notification.html
    M LayoutTests/accessibility/mac/selection-notification-focus-change-expected.txt
    M LayoutTests/platform/mac-wk2/accessibility/mac/selection-notification-focus-change-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/accessibility/AXObjectCache.h
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  Merge r228417 - AX: defer focusedUIElement notifications
https://bugs.webkit.org/show_bug.cgi?id=182643
<rdar://problem/37394310>

Reviewed by Zalan Bujtas.

Source/WebCore:

Deferring focus changes for accessibility has a number of benefits.
    1) Reduces the chance of calling into layout during layout.
    2) Coalesces multiple focus notifications that would be needlessly sent.
    3) Improves performance by not calling out to the accessibility notification machinery during layout.

In this patch, I also started making more AXObjectCache calls private. This will reduce the chance that clients
will call into AXObjectCache during unexpected times.

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::deferFocusedUIElementChangeIfNeeded):
(WebCore::conditionallyAddNodeToFilterList):
(WebCore::filterVectorPairForRemoval):
(WebCore::filterMapForRemoval):
(WebCore::filterListForRemoval):
(WebCore::AXObjectCache::prepareForDocumentDestruction):
(WebCore::AXObjectCache::performDeferredCacheUpdate):
* accessibility/AXObjectCache.h:
* dom/Document.cpp:
(WebCore::Document::setFocusedElement):

LayoutTests:

* accessibility/mac/aria-menu-item-selected-notification.html:
     Rewrite test to accomodate that focus changes happen asynchronously.
* accessibility/mac/selection-notification-focus-change-expected.txt:
* platform/mac-wk2/accessibility/mac/selection-notification-focus-change-expected.txt:
     The order of notifications is different now that focus changes happen later.


  Commit: c3f26544cfb0d417fdb9f75b912954507d7a8ea7
      https://github.com/WebKit/WebKit/commit/c3f26544cfb0d417fdb9f75b912954507d7a8ea7
  Author: Yoshiaki Jitsukawa <Yoshiaki.Jitsukawa at sony.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AXObjectCache.h

  Log Message:
  -----------
  Merge r228607 - Fix build error after r228417 without ACCESSIBILITY
https://bugs.webkit.org/show_bug.cgi?id=182914

Patch by Yoshiaki Jitsukawa <Yoshiaki.Jitsukawa at sony.com> on 2018-02-18
Reviewed by Chris Fleizach.

An inline empty version of AXObjectCache::deferFocusdUIElementChangeIfNeeded()
needs to be defined if not HAVE(ACCESSIBILITY).

* accessibility/AXObjectCache.h:
(WebCore::AXObjectCache::deferFocusedUIElementChangeIfNeeded):


  Commit: 216bb0c2b05c76a4d0935074f4fdca8bd291cb2e
      https://github.com/WebKit/WebKit/commit/216bb0c2b05c76a4d0935074f4fdca8bd291cb2e
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaSampleGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaSampleGStreamer.h

  Log Message:
  -----------
  Merge r228418 - [Gstreamer][MSE] Add string representation for GStreamerMediaSample
https://bugs.webkit.org/show_bug.cgi?id=180262

Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/mse/GStreamerMediaSample.cpp:
(WebCore::GStreamerMediaSample::offsetTimestampsBy):
* platform/graphics/gstreamer/mse/GStreamerMediaSample.h:


  Commit: fbd872cf6c952957a8ee55e645ecdb2f2882b051
      https://github.com/WebKit/WebKit/commit/fbd872cf6c952957a8ee55e645ecdb2f2882b051
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/ftl/FTLOutput.h
    M Source/JavaScriptCore/heap/MarkedSpace.cpp
    M Source/JavaScriptCore/jit/JITOpcodes.cpp
    M Source/JavaScriptCore/jit/Repatch.cpp
    M Source/JavaScriptCore/jit/ThunkGenerators.cpp
    M Source/JavaScriptCore/llint/LowLevelInterpreter.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
    M Source/JavaScriptCore/runtime/JSAsyncFunction.h
    M Source/JavaScriptCore/runtime/JSAsyncGeneratorFunction.h
    M Source/JavaScriptCore/runtime/JSBoundFunction.h
    M Source/JavaScriptCore/runtime/JSCPoison.h
    M Source/JavaScriptCore/runtime/JSCustomGetterSetterFunction.h
    M Source/JavaScriptCore/runtime/JSFunction.h
    M Source/JavaScriptCore/runtime/JSGeneratorFunction.h
    M Source/JavaScriptCore/runtime/JSNativeStdFunction.h
    M Source/JavaScriptCore/runtime/VM.cpp
    M Source/JavaScriptCore/runtime/VM.h
    M Source/JavaScriptCore/wasm/js/WebAssemblyFunction.h
    M Source/JavaScriptCore/wasm/js/WebAssemblyWrapperFunction.h

  Log Message:
  -----------
  Merge r228420 - Lock down JSFunction
https://bugs.webkit.org/show_bug.cgi?id=182652

Reviewed by Saam Barati.

This poisons pointers in JSFunction and puts all of the types in the JSFunction hierarchy in
isospaces.

This is so neutral on JetStream: 0.01% slower with p = 0.969211.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
(JSC::DFG::SpeculativeJIT::compileNewFunction):
(JSC::DFG::SpeculativeJIT::compileCreateThis):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
(JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPointer):
(JSC::DFG::SpeculativeJIT::TrustedImmPtr::weakPoisonedPointer):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetExecutable):
(JSC::FTL::DFG::LowerDFGToB3::compileNewFunction):
(JSC::FTL::DFG::LowerDFGToB3::weakPointer):
(JSC::FTL::DFG::LowerDFGToB3::weakPoisonedPointer):
* ftl/FTLOutput.h:
(JSC::FTL::Output::weakPointer):
(JSC::FTL::Output::weakPoisonedPointer):
* heap/MarkedSpace.cpp:
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_create_this):
* jit/ThunkGenerators.cpp:
(JSC::virtualThunkFor):
(JSC::nativeForGenerator):
(JSC::boundThisNoArgsFunctionCallGenerator):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/JSAsyncFunction.h:
(JSC::JSAsyncFunction::subspaceFor):
* runtime/JSAsyncGeneratorFunction.h:
(JSC::JSAsyncGeneratorFunction::subspaceFor):
* runtime/JSBoundFunction.h:
(JSC::JSBoundFunction::subspaceFor):
* runtime/JSCPoison.h:
* runtime/JSCustomGetterSetterFunction.h:
(JSC::JSCustomGetterSetterFunction::subspaceFor):
* runtime/JSFunction.h:
(JSC::JSFunction::subspaceFor):
* runtime/JSGeneratorFunction.h:
(JSC::JSGeneratorFunction::subspaceFor):
* runtime/JSNativeStdFunction.h:
(JSC::JSNativeStdFunction::subspaceFor):
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
* wasm/js/WebAssemblyFunction.h:
* wasm/js/WebAssemblyWrapperFunction.h:


  Commit: b1a973e0b50acfa8f3f042996d59be28fdf2ddb2
      https://github.com/WebKit/WebKit/commit/b1a973e0b50acfa8f3f042996d59be28fdf2ddb2
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/array-storage-length.js
    A JSTests/stress/undecided-length.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r228421 - Support GetArrayLength on ArrayStorage in the FTL
https://bugs.webkit.org/show_bug.cgi?id=182625

Reviewed by Saam Barati.

JSTests:

* stress/array-storage-length.js: Added.
(shouldBe):
(testInBound):
(testUncountable):
(testSlowPutInBound):
(testSlowPutUncountable):
* stress/undecided-length.js: Added.
(shouldBe):
(test2):

Source/JavaScriptCore:

This patch adds GetArrayLength and CheckArray + ArrayStorage & SlowPutArrayStorage support for FTL.
The implementation is trivial; just porting one in DFG to FTL.

This fixes several FTL compilation failures in web-tooling-benchmarks while we still need to support
ArrayPush, ArrayPop, Arrayify, and PutByVal.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::checkArray):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetArrayLength):
(JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForArrayify):
(JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForCheckArray):


  Commit: 610738f36112e79cdea5abb0844d90bf1db8af7c
      https://github.com/WebKit/WebKit/commit/610738f36112e79cdea5abb0844d90bf1db8af7c
  Author: Caitlin Potter <caitp at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/tagged-template-object-collect.js
    A JSTests/stress/tagged-template-object.js
    R JSTests/stress/tagged-template-registry-key-collect.js
    R JSTests/stress/tagged-template-registry-key.js
    M JSTests/stress/tagged-templates-identity.js
    M JSTests/stress/template-string-tags-eval.js
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/JavaScriptCore/Sources.txt
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/DirectEvalCodeCache.cpp
    M Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
    M Source/JavaScriptCore/parser/Parser.cpp
    M Source/JavaScriptCore/parser/Parser.h
    M Source/JavaScriptCore/parser/ParserModes.h
    M Source/JavaScriptCore/runtime/EvalExecutable.h
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObject.h
    A Source/JavaScriptCore/runtime/JSTemplateObjectDescriptor.cpp
    A Source/JavaScriptCore/runtime/JSTemplateObjectDescriptor.h
    R Source/JavaScriptCore/runtime/JSTemplateRegistryKey.cpp
    R Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h
    A Source/JavaScriptCore/runtime/TemplateObjectDescriptor.cpp
    A Source/JavaScriptCore/runtime/TemplateObjectDescriptor.h
    R Source/JavaScriptCore/runtime/TemplateRegistry.cpp
    R Source/JavaScriptCore/runtime/TemplateRegistry.h
    R Source/JavaScriptCore/runtime/TemplateRegistryKey.cpp
    R Source/JavaScriptCore/runtime/TemplateRegistryKey.h
    R Source/JavaScriptCore/runtime/TemplateRegistryKeyTable.cpp
    R Source/JavaScriptCore/runtime/TemplateRegistryKeyTable.h
    M Source/JavaScriptCore/runtime/VM.cpp
    M Source/JavaScriptCore/runtime/VM.h
    M Source/JavaScriptCore/runtime/VMEntryScope.cpp

  Log Message:
  -----------
  Merge r228422 - [JSC] cache TaggedTemplate arrays by callsite rather than by contents
https://bugs.webkit.org/show_bug.cgi?id=182717

Reviewed by Yusuke Suzuki.

https://github.com/tc39/ecma262/pull/890 imposes a change to template
literals, to allow template callsite arrays to be collected when the
code containing the tagged template call is collected. This spec change
has received concensus and been ratified.

This change eliminates the eternal map associating template contents
with arrays.

JSTests:

* stress/tagged-template-object-collect.js: Renamed from JSTests/stress/tagged-template-registry-key-collect.js.
* stress/tagged-template-object.js: Renamed from JSTests/stress/tagged-template-registry-key.js.
* stress/tagged-templates-identity.js:
* stress/template-string-tags-eval.js:
* test262.yaml:

Source/JavaScriptCore:

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::setConstantRegisters):
* bytecode/DirectEvalCodeCache.cpp:
(JSC::DirectEvalCodeCache::setSlow):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::allowDirectEvalCache const):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::addTemplateObjectConstant):
(JSC::BytecodeGenerator::emitGetTemplateObject):
(JSC::BytecodeGenerator::addTemplateRegistryKeyConstant): Deleted.
* bytecompiler/BytecodeGenerator.h:
* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::parseMemberExpression):
* parser/Parser.h:
* parser/ParserModes.h:
* runtime/EvalExecutable.h:
(JSC::EvalExecutable::allowDirectEvalCache const):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::templateRegistry): Deleted.
* runtime/JSTemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistry.cpp.
(JSC::JSTemplateObjectDescriptor::JSTemplateObjectDescriptor):
(JSC::JSTemplateObjectDescriptor::create):
(JSC::JSTemplateObjectDescriptor::destroy):
(JSC::JSTemplateObjectDescriptor::createTemplateObject):
* runtime/JSTemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
(JSC::isTemplateObjectDescriptor):
* runtime/JSTemplateRegistryKey.cpp: Removed.
* runtime/TemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.cpp.
(JSC::TemplateObjectDescriptor::~TemplateObjectDescriptor):
* runtime/TemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.h.
(JSC::TemplateObjectDescriptor::operator== const):
(JSC::TemplateObjectDescriptor::operator!= const):
(JSC::TemplateObjectDescriptor::Hasher::hash):
(JSC::TemplateObjectDescriptor::Hasher::equal):
(JSC::TemplateObjectDescriptor::create):
(JSC::TemplateObjectDescriptor::TemplateObjectDescriptor):
(JSC::TemplateObjectDescriptor::calculateHash):
* runtime/TemplateRegistry.h: Removed.
* runtime/TemplateRegistryKeyTable.cpp: Removed.
* runtime/TemplateRegistryKeyTable.h: Removed.
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
(JSC::VM::templateRegistryKeyTable): Deleted.
* runtime/VMEntryScope.cpp:

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::setConstantRegisters):
* bytecode/DirectEvalCodeCache.cpp:
(JSC::DirectEvalCodeCache::setSlow):
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::allowDirectEvalCache const):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::addTemplateObjectConstant):
(JSC::BytecodeGenerator::emitGetTemplateObject):
(JSC::BytecodeGenerator::addTemplateRegistryKeyConstant): Deleted.
* bytecompiler/BytecodeGenerator.h:
* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::parseMemberExpression):
* parser/Parser.h:
* parser/ParserModes.h:
* runtime/EvalExecutable.h:
(JSC::EvalExecutable::allowDirectEvalCache const):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::templateRegistry): Deleted.
* runtime/JSTemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistry.cpp.
(JSC::JSTemplateObjectDescriptor::JSTemplateObjectDescriptor):
(JSC::JSTemplateObjectDescriptor::create):
(JSC::JSTemplateObjectDescriptor::destroy):
(JSC::JSTemplateObjectDescriptor::createTemplateObject):
* runtime/JSTemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
(JSC::isTemplateObjectDescriptor):
* runtime/JSTemplateRegistryKey.cpp: Removed.
* runtime/TemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.cpp.
(JSC::TemplateObjectDescriptor::~TemplateObjectDescriptor):
* runtime/TemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.h.
(JSC::TemplateObjectDescriptor::operator== const):
(JSC::TemplateObjectDescriptor::operator!= const):
(JSC::TemplateObjectDescriptor::Hasher::hash):
(JSC::TemplateObjectDescriptor::Hasher::equal):
(JSC::TemplateObjectDescriptor::create):
(JSC::TemplateObjectDescriptor::TemplateObjectDescriptor):
(JSC::TemplateObjectDescriptor::calculateHash):
* runtime/TemplateRegistry.h: Removed.
* runtime/TemplateRegistryKeyTable.cpp: Removed.
* runtime/TemplateRegistryKeyTable.h: Removed.
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
(JSC::VM::templateRegistryKeyTable): Deleted.
* runtime/VMEntryScope.cpp:

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::setConstantRegisters):
* bytecode/DirectEvalCodeCache.cpp:
(JSC::DirectEvalCodeCache::setSlow):
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::allowDirectEvalCache const):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::addTemplateObjectConstant):
(JSC::BytecodeGenerator::emitGetTemplateObject):
(JSC::BytecodeGenerator::addTemplateRegistryKeyConstant): Deleted.
* bytecompiler/BytecodeGenerator.h:
* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseInner):
(JSC::Parser<LexerType>::parseMemberExpression):
* parser/Parser.h:
* parser/ParserModes.h:
* runtime/EvalExecutable.h:
(JSC::EvalExecutable::allowDirectEvalCache const):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::JSGlobalObject):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::templateRegistry): Deleted.
* runtime/JSTemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistry.cpp.
(JSC::JSTemplateObjectDescriptor::JSTemplateObjectDescriptor):
(JSC::JSTemplateObjectDescriptor::create):
(JSC::JSTemplateObjectDescriptor::destroy):
(JSC::JSTemplateObjectDescriptor::createTemplateObject):
* runtime/JSTemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/JSTemplateRegistryKey.h.
(JSC::isTemplateObjectDescriptor):
* runtime/JSTemplateRegistryKey.cpp: Removed.
* runtime/TemplateObjectDescriptor.cpp: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.cpp.
(JSC::TemplateObjectDescriptor::~TemplateObjectDescriptor):
* runtime/TemplateObjectDescriptor.h: Renamed from Source/JavaScriptCore/runtime/TemplateRegistryKey.h.
(JSC::TemplateObjectDescriptor::operator== const):
(JSC::TemplateObjectDescriptor::operator!= const):
(JSC::TemplateObjectDescriptor::Hasher::hash):
(JSC::TemplateObjectDescriptor::Hasher::equal):
(JSC::TemplateObjectDescriptor::create):
(JSC::TemplateObjectDescriptor::TemplateObjectDescriptor):
(JSC::TemplateObjectDescriptor::calculateHash):
* runtime/TemplateRegistry.h: Removed.
* runtime/TemplateRegistryKeyTable.cpp: Removed.
* runtime/TemplateRegistryKeyTable.h: Removed.
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
(JSC::VM::templateRegistryKeyTable): Deleted.
* runtime/VMEntryScope.cpp:


  Commit: 6e52246379128c87170be86a31cb60ba60c45076
      https://github.com/WebKit/WebKit/commit/6e52246379128c87170be86a31cb60ba60c45076
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderButton.cpp
    M Source/WebCore/rendering/RenderButton.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h

  Log Message:
  -----------
  Merge r228423 - [RenderTreeBuilder] Move RenderButton::takeChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182732
<rdar://problem/37500564>

Reviewed by Antti Koivisto.

No change of functionality.

* rendering/RenderButton.cpp:
(WebCore::RenderButton::setInnerRenderer):
(WebCore::RenderButton::takeChild): Deleted.
* rendering/RenderButton.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChildFromRenderButton):
* rendering/updating/RenderTreeBuilder.h:


  Commit: f3a6dec353939e6f589bad9fc7a1b9ceae116434
      https://github.com/WebKit/WebKit/commit/f3a6dec353939e6f589bad9fc7a1b9ceae116434
  Author: Nan Wang <n_wang at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    R LayoutTests/accessibility/accessibility-object-model-expected.txt
    R LayoutTests/accessibility/accessibility-object-model.html
    R LayoutTests/accessibility/mac/AOM-bool-properties-expected.txt
    R LayoutTests/accessibility/mac/AOM-bool-properties.html
    R LayoutTests/accessibility/mac/AOM-number-properties-expected.txt
    R LayoutTests/accessibility/mac/AOM-number-properties.html
    R LayoutTests/accessibility/mac/AOM-relation-property-expected.txt
    R LayoutTests/accessibility/mac/AOM-relation-property.html
    R LayoutTests/accessibility/mac/AOM-string-properties-expected.txt
    R LayoutTests/accessibility/mac/AOM-string-properties.html
    M LayoutTests/js/dom/dom-static-property-for-in-iteration-expected.txt
    M LayoutTests/platform/mac-wk1/TestExpectations
    M LayoutTests/platform/win/TestExpectations
    M Source/WebCore/CMakeLists.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/DerivedSources.make
    M Source/WebCore/Sources.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
    M Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp
    M Source/WebCore/accessibility/AccessibilityAllInOne.cpp
    M Source/WebCore/accessibility/AccessibilityImageMapLink.cpp
    M Source/WebCore/accessibility/AccessibilityListBoxOption.cpp
    M Source/WebCore/accessibility/AccessibilityNodeObject.cpp
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/AccessibilityObject.h
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
    M Source/WebCore/accessibility/AccessibilityTable.cpp
    M Source/WebCore/accessibility/AccessibilityTableCell.cpp
    M Source/WebCore/accessibility/AccessibilityTableRow.cpp
    R Source/WebCore/accessibility/AccessibleNode.cpp
    R Source/WebCore/accessibility/AccessibleNode.h
    R Source/WebCore/accessibility/AccessibleNode.idl
    M Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
    M Source/WebCore/bindings/js/WebCoreBuiltinNames.h
    M Source/WebCore/dom/Element.cpp
    M Source/WebCore/dom/Element.h
    M Source/WebCore/dom/Element.idl
    M Source/WebCore/dom/ElementRareData.cpp
    M Source/WebCore/dom/ElementRareData.h
    M Source/WebCore/editing/TextIterator.cpp
    M Source/WebCore/rendering/RenderMenuList.cpp

  Log Message:
  -----------
  Merge r228427 - AX: Remove AccessibleNode class
https://bugs.webkit.org/show_bug.cgi?id=182724
<rdar://problem/37486024>

Reviewed by Chris Fleizach.

Source/WebCore:

Removed all the AccessibleNode related code since AOM has
an alternate direction now.

No new tests. Made sure existing tests don't break.

* CMakeLists.txt:
* DerivedSources.make:
* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::findModalNodes):
(WebCore::nodeHasRole):
(WebCore::AXObjectCache::handleLiveRegionCreated):
(WebCore::AXObjectCache::handleMenuItemSelected):
(WebCore::AXObjectCache::handleModalChange):
(WebCore::isNodeAriaVisible):
* accessibility/AccessibilityARIAGrid.cpp:
(WebCore::AccessibilityARIAGrid::isMultiSelectable const):
* accessibility/AccessibilityARIAGridCell.cpp:
(WebCore::AccessibilityARIAGridCell::readOnlyValue const):
* accessibility/AccessibilityAllInOne.cpp:
* accessibility/AccessibilityImageMapLink.cpp:
(WebCore::AccessibilityImageMapLink::roleValue const):
(WebCore::AccessibilityImageMapLink::accessibilityDescription const):
* accessibility/AccessibilityListBoxOption.cpp:
(WebCore::AccessibilityListBoxOption::isEnabled const):
(WebCore::AccessibilityListBoxOption::stringValue const):
* accessibility/AccessibilityNodeObject.cpp:
(WebCore::AccessibilityNodeObject::isEnabled const):
(WebCore::AccessibilityNodeObject::isPressed const):
(WebCore::AccessibilityNodeObject::isChecked const):
(WebCore::AccessibilityNodeObject::isMultiSelectable const):
(WebCore::AccessibilityNodeObject::isRequired const):
(WebCore::AccessibilityNodeObject::headingLevel const):
(WebCore::AccessibilityNodeObject::valueDescription const):
(WebCore::AccessibilityNodeObject::valueForRange const):
(WebCore::AccessibilityNodeObject::maxValueForRange const):
(WebCore::AccessibilityNodeObject::minValueForRange const):
(WebCore::AccessibilityNodeObject::ariaAccessibilityDescription const):
(WebCore::siblingWithAriaRole):
(WebCore::AccessibilityNodeObject::textForLabelElement const):
(WebCore::AccessibilityNodeObject::alternativeText const):
(WebCore::AccessibilityNodeObject::alternativeTextForWebArea const):
(WebCore::AccessibilityNodeObject::hierarchicalLevel const):
(WebCore::shouldUseAccessibilityObjectInnerText):
(WebCore::AccessibilityNodeObject::stringValue const):
(WebCore::accessibleNameForNode):
(WebCore::AccessibilityNodeObject::determineAriaRoleAttribute const):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::readOnlyValue const):
(WebCore::AccessibilityObject::supportsAutoComplete const):
(WebCore::AccessibilityObject::autoCompleteValue const):
(WebCore::AccessibilityObject::ariaIsMultiline const):
(WebCore::AccessibilityObject::invalidStatus const):
(WebCore::AccessibilityObject::supportsCurrent const):
(WebCore::AccessibilityObject::currentState const):
(WebCore::AccessibilityObject::roleDescription const):
(WebCore::AccessibilityObject::keyShortcutsValue const):
(WebCore::AccessibilityObject::placeholderValue const):
(WebCore::AccessibilityObject::supportsARIAAttributes const):
(WebCore::AccessibilityObject::sortDirection const):
(WebCore::AccessibilityObject::supportsHasPopup const):
(WebCore::AccessibilityObject::hasPopupValue const):
(WebCore::AccessibilityObject::supportsSetSize const):
(WebCore::AccessibilityObject::supportsPosInSet const):
(WebCore::AccessibilityObject::setSize const):
(WebCore::AccessibilityObject::posInSet const):
(WebCore::AccessibilityObject::supportsPressed const):
(WebCore::AccessibilityObject::supportsExpanded const):
(WebCore::AccessibilityObject::isExpanded const):
(WebCore::AccessibilityObject::checkboxOrRadioValue const):
(WebCore::AccessibilityObject::pressedIsPresent const):
(WebCore::AccessibilityObject::isAXHidden const):
(WebCore::AccessibilityObject::ariaActiveDescendantReferencingElements const):
(WebCore::AccessibilityObject::ariaDetailsElements const):
(WebCore::AccessibilityObject::ariaDetailsReferencingElements const):
(WebCore::AccessibilityObject::ariaErrorMessageElements const):
(WebCore::AccessibilityObject::ariaErrorMessageReferencingElements const):
(WebCore::AccessibilityObject::setIsIgnoredFromParentDataForChild):
(WebCore::AccessibilityObject::hasProperty const): Deleted.
(WebCore::AccessibilityObject::stringValueForProperty const): Deleted.
(WebCore::AccessibilityObject::boolValueForProperty const): Deleted.
(WebCore::AccessibilityObject::intValueForProperty const): Deleted.
(WebCore::AccessibilityObject::unsignedValueForProperty const): Deleted.
(WebCore::AccessibilityObject::doubleValueForProperty const): Deleted.
(WebCore::AccessibilityObject::elementValueForProperty const): Deleted.
(WebCore::AccessibilityObject::elementsFromProperty const): Deleted.
(WebCore::AccessibilityObject::elementsReferencedByProperty const): Deleted.
* accessibility/AccessibilityObject.h:
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::stringValue const):
(WebCore::AccessibilityRenderObject::exposesTitleUIElement const):
(WebCore::AccessibilityRenderObject::defaultObjectInclusion const):
(WebCore::AccessibilityRenderObject::isSelected const):
(WebCore::AccessibilityRenderObject::activeDescendant const):
(WebCore::AccessibilityRenderObject::determineAccessibilityRole):
(WebCore::AccessibilityRenderObject::orientation const):
(WebCore::AccessibilityRenderObject::canSetExpandedAttribute const):
(WebCore::AccessibilityRenderObject::liveRegionStatus const):
(WebCore::AccessibilityRenderObject::liveRegionRelevant const):
(WebCore::AccessibilityRenderObject::liveRegionAtomic const):
(WebCore::AccessibilityRenderObject::isBusy const):
* accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::isDataTable const):
(WebCore::AccessibilityTable::axColumnCount const):
(WebCore::AccessibilityTable::axRowCount const):
* accessibility/AccessibilityTableCell.cpp:
(WebCore::AccessibilityTableCell::axColumnIndex const):
(WebCore::AccessibilityTableCell::axRowIndex const):
(WebCore::AccessibilityTableCell::axColumnSpan const):
(WebCore::AccessibilityTableCell::axRowSpan const):
* accessibility/AccessibilityTableRow.cpp:
(WebCore::AccessibilityTableRow::axColumnIndex const):
(WebCore::AccessibilityTableRow::axRowIndex const):
* accessibility/AccessibleNode.cpp: Removed.
* accessibility/AccessibleNode.h: Removed.
* accessibility/AccessibleNode.idl: Removed.
* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):
* bindings/js/WebCoreBuiltinNames.h:
* dom/Element.cpp:
(WebCore::Element::canContainRangeEndPoint const):
(WebCore::Element::accessibleNode): Deleted.
(WebCore::Element::existingAccessibleNode const): Deleted.
* dom/Element.h:
* dom/Element.idl:
* dom/ElementRareData.cpp:
* dom/ElementRareData.h:
(WebCore::ElementRareData::accessibleNode const): Deleted.
(WebCore::ElementRareData::setAccessibleNode): Deleted.
* editing/TextIterator.cpp:
(WebCore::isRendererReplacedElement):
* rendering/RenderMenuList.cpp:
(RenderMenuList::itemAccessibilityText const):

LayoutTests:

* accessibility/accessibility-object-model-expected.txt: Removed.
* accessibility/accessibility-object-model.html: Removed.
* accessibility/mac/AOM-bool-properties-expected.txt: Removed.
* accessibility/mac/AOM-bool-properties.html: Removed.
* accessibility/mac/AOM-number-properties-expected.txt: Removed.
* accessibility/mac/AOM-number-properties.html: Removed.
* accessibility/mac/AOM-relation-property-expected.txt: Removed.
* accessibility/mac/AOM-relation-property.html: Removed.
* accessibility/mac/AOM-string-properties-expected.txt: Removed.
* accessibility/mac/AOM-string-properties.html: Removed.
* platform/mac-wk1/TestExpectations:
* platform/win/TestExpectations:


  Commit: aa9ebd8fd83c876fe0245c135c992cabc01b2aed
      https://github.com/WebKit/WebKit/commit/aa9ebd8fd83c876fe0245c135c992cabc01b2aed
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderGrid.cpp
    M Source/WebCore/rendering/RenderGrid.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h

  Log Message:
  -----------
  Merge r228428 - [RenderTreeBuilder] Move RenderGrid::takeChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182734
<rdar://problem/37500876>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::takeChild): Deleted.
* rendering/RenderGrid.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChildFromRenderGrid):
* rendering/updating/RenderTreeBuilder.h:


  Commit: bd888dc6c5449bbe7b102dc0cc03bb762d8825a4
      https://github.com/WebKit/WebKit/commit/bd888dc6c5449bbe7b102dc0cc03bb762d8825a4
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/svg/RenderSVGContainer.cpp
    M Source/WebCore/rendering/svg/RenderSVGContainer.h
    M Source/WebCore/rendering/svg/RenderSVGInline.cpp
    M Source/WebCore/rendering/svg/RenderSVGInline.h
    M Source/WebCore/rendering/svg/RenderSVGRoot.cpp
    M Source/WebCore/rendering/svg/RenderSVGRoot.h
    M Source/WebCore/rendering/svg/RenderSVGText.cpp
    M Source/WebCore/rendering/svg/RenderSVGText.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.h

  Log Message:
  -----------
  Merge r228429 - [RenderTreeBuilder] Move RenderSVG*::takeChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182736
<rdar://problem/37503107>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/svg/RenderSVGContainer.cpp:
(WebCore::RenderSVGContainer::takeChild): Deleted.
* rendering/svg/RenderSVGContainer.h:
* rendering/svg/RenderSVGInline.cpp:
(WebCore::RenderSVGInline::takeChild): Deleted.
* rendering/svg/RenderSVGInline.h:
* rendering/svg/RenderSVGRoot.cpp:
(WebCore::RenderSVGRoot::takeChild): Deleted.
* rendering/svg/RenderSVGRoot.h:
* rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::takeChild): Deleted.
* rendering/svg/RenderSVGText.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
* rendering/updating/RenderTreeBuilderSVG.cpp:
(WebCore::RenderTreeBuilder::SVG::takeChild):
* rendering/updating/RenderTreeBuilderSVG.h:


  Commit: 582a8feda227775af9b7b625098a461ded241106
      https://github.com/WebKit/WebKit/commit/582a8feda227775af9b7b625098a461ded241106
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderBlockFlow.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp

  Log Message:
  -----------
  Merge r228432 - [RenderTreeBuilder] Move RenderBlockFlow::takeChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182739
<rdar://problem/37506542>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::takeChild): Deleted.
* rendering/RenderBlockFlow.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
(WebCore::RenderTreeBuilder::multiColumnRelativeWillBeRemoved): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::takeChild):
* rendering/updating/RenderTreeBuilderBlock.h:


  Commit: b6159b542cbba1dbd1cd7dbb0e6a30a5bfcdef81
      https://github.com/WebKit/WebKit/commit/b6159b542cbba1dbd1cd7dbb0e6a30a5bfcdef81
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/inspector/debugger/reload-paused-expected.txt
    A LayoutTests/inspector/debugger/reload-paused.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/cache/CachedRawResource.cpp
    M Source/WebCore/loader/cache/CachedRawResource.h

  Log Message:
  -----------
  Merge r228435 - Crash when breakpoint hit in unload handler
https://bugs.webkit.org/show_bug.cgi?id=169855
<rdar://problem/28683567>

Source/WebCore:

Reviewed by Daniel Bates.

Test: inspector/debugger/reload-paused.html

CachedRawResource::updateBuffer may generate unload event in client notify callback. If Inspector was
paused, this even would spawn a nested runloop. CachedRawResource::finishLoading would get called in
the nested loop, confusing the DocumentLoader state machine and resulting in crashes later.

* loader/cache/CachedRawResource.cpp:
(WebCore::CachedRawResource::updateBuffer):

- Set a bit when entering the client callback.
- Ensure we don't re-enter updateBuffer.
- If finishLoading got delayed during client callback, do it at the end.

(WebCore::CachedRawResource::finishLoading):

If we are in updateBuffer client callback, save the buffer and bail out.

* loader/cache/CachedRawResource.h:

LayoutTests:

Reviewed by Daniel Bates and Joseph Pecoraro.

* inspector/debugger/reload-paused-expected.txt: Added.
* inspector/debugger/reload-paused.html: Added.


  Commit: 799a2f90828e24ca8e12961ebd39f43c516cb84d
      https://github.com/WebKit/WebKit/commit/799a2f90828e24ca8e12961ebd39f43c516cb84d
  Author: Guillaume Emont <guijemont at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/yarr/YarrJIT.cpp

  Log Message:
  -----------
  Merge r228436 - [YarrJIT][ARM] We need to save r8 as it is the initial start register
https://bugs.webkit.org/show_bug.cgi?id=182157

Reviewed by Saam Barati.

Register r8 is the initial start register since r224172, so we need to
save it. We still need to save r6 as well even though it is not the
initial start register any more, since it is used by the
MacroAssembler which we use (we get crashes in some situations if we
don't save r6). This issue was discovered because
stress/regress-174044.js crashes on a raspberry pi 2 when compiled in
-O2.

* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generateEnter):
(JSC::Yarr::YarrGenerator::generateReturn):


  Commit: 3cef462b6fa9bd6b360be81d0387e00ce7e1bd63
      https://github.com/WebKit/WebKit/commit/3cef462b6fa9bd6b360be81d0387e00ce7e1bd63
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp

  Log Message:
  -----------
  Merge r228441 - [RenderTreeBuilder] Move RenderBlock::takeChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182746
<rdar://problem/37512871>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::takeChild): Deleted.
* rendering/RenderBlock.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
(WebCore::RenderTreeBuilder::takeChildFromRenderMenuList):
(WebCore::RenderTreeBuilder::takeChildFromRenderButton):
(WebCore::RenderTreeBuilder::takeChildFromRenderGrid):
(WebCore::RenderTreeBuilder::takeChildFromRenderBlock): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::takeChild):


  Commit: 0681dd0f880e580584c8089c44c3ca663be9ae72
      https://github.com/WebKit/WebKit/commit/0681dd0f880e580584c8089c44c3ca663be9ae72
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/always-enter-dictionary-indexing-mode-with-getter.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSObject.cpp

  Log Message:
  -----------
  Merge r228454 - putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
https://bugs.webkit.org/show_bug.cgi?id=182755
<rdar://problem/37080864>

Reviewed by Keith Miller.

JSTests:

* stress/always-enter-dictionary-indexing-mode-with-getter.js: Added.
(test1.o.get 10005):
(test1):
(test2.o.get 1000):
(test2):

Source/JavaScriptCore:

putDirectIndexSlowOrBeyondVectorLength with non-zero attributes only converted
the object in question to a dictionary indexing mode when the index is less than
the vector length. This makes no sense. If we're defining a getter, setter, or read
only property, we must always enter the dictionary indexing mode irrespective
of the index in relation to the vector length.

* runtime/JSObject.cpp:
(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):


  Commit: f60bf5dffddf5522c7be7e98375b46705e6c5c9e
      https://github.com/WebKit/WebKit/commit/f60bf5dffddf5522c7be7e98375b46705e6c5c9e
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderObject.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp

  Log Message:
  -----------
  Merge r228464 - [RenderTreeBuilder] Move RenderElement::takeChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182762
<rdar://problem/37523756>

Reviewed by Daniel Bates.

This patch removes the remaining takeChild() related mutation logic from the renderers.

No change in functionality.

* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::moveChildTo):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::takeChild): Deleted.
(WebCore::RenderElement::takeChildInternal): Deleted.
* rendering/RenderElement.h:
* rendering/RenderObject.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
(WebCore::RenderTreeBuilder::childFlowStateChangesAndAffectsParentBlock):
(WebCore::RenderTreeBuilder::takeChildFromRenderElement):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::removeLeftoverAnonymousBlock):
(WebCore::RenderTreeBuilder::Block::takeChild):
(WebCore::RenderTreeBuilder::Block::dropAnonymousBoxChild):
* rendering/updating/RenderTreeBuilderInline.cpp:
(WebCore::RenderTreeBuilder::Inline::splitFlow):
(WebCore::RenderTreeBuilder::Inline::splitInlines):
(WebCore::RenderTreeBuilder::Inline::childBecameNonInline):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::takeChild):
* rendering/updating/RenderTreeBuilderSVG.cpp:
(WebCore::RenderTreeBuilder::SVG::takeChild): Leftover from the previous patch.


  Commit: 5a03800f310ad9b214100afdf77d7e1c7bff29e3
      https://github.com/WebKit/WebKit/commit/5a03800f310ad9b214100afdf77d7e1c7bff29e3
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp

  Log Message:
  -----------
  Merge r228465 - [RenderTreeBuilder] Remove redundant RenderTreeBuilder methods
https://bugs.webkit.org/show_bug.cgi?id=182770
<rdar://problem/37525627>

Reviewed by Daniel Bates.

No change in functionality.

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::dropAnonymousBoxChild): Deleted.
(WebCore::RenderTreeBuilder::moveRubyChildren): Deleted.
(WebCore::RenderTreeBuilder::resolveMovedChildForMultiColumnFlow): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlockFlow.cpp:
(WebCore::RenderTreeBuilder::BlockFlow::insertChild):
* rendering/updating/RenderTreeBuilderInline.cpp:
(WebCore::RenderTreeBuilder::Inline::insertChild):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::takeChild):


  Commit: f46430990f99517f5e981024953a331791519145
      https://github.com/WebKit/WebKit/commit/f46430990f99517f5e981024953a331791519145
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/UserGestureIndicator.cpp

  Log Message:
  -----------
  Merge r228466 - Confirm proper thread in UserGestureIndicator constructor
https://bugs.webkit.org/show_bug.cgi?id=175980

Reviewed by Daniel Bates.

Document is a main-thread object. If we enter the UserGestureIndicator constructor
on a non-main thread, we should ASSERT, not return silently.

* dom/UserGestureIndicator.cpp:
(WebCore::UserGestureIndicator::UserGestureIndicator):


  Commit: ad85e0765b1cdb7f7722f4ed2d1ac255bef6e8ed
      https://github.com/WebKit/WebKit/commit/ad85e0765b1cdb7f7722f4ed2d1ac255bef6e8ed
  Author: Dean Jackson <dino at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLPlugInElement.cpp

  Log Message:
  -----------
  Merge r228476 - CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot + 618
https://bugs.webkit.org/show_bug.cgi?id=182798
<rdar://problem/23337253>

Reviewed by Eric Carlson.

Speculative fix for a crash in HTMLPlugInImageElement::didAddUserAgentShadowRoot.
The guess is that the m_swapRendererTimer is set, and the display state changes to
something that does not require a shadow root, but before the timer fires.
Fix this by ensuring that the timer is reset on every display state change.

* html/HTMLPlugInElement.cpp:
(WebCore::HTMLPlugInElement::setDisplayState): Guard for sets that wouldn't
actually change value, and make sure we always reset the timer.


  Commit: f632575e976126e7293386a6b15618d298cdf6cc
      https://github.com/WebKit/WebKit/commit/f632575e976126e7293386a6b15618d298cdf6cc
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/RegExpInlines.h
    M Source/JavaScriptCore/runtime/VM.cpp
    M Source/JavaScriptCore/runtime/VM.h
    M Source/JavaScriptCore/yarr/YarrJIT.cpp
    M Source/JavaScriptCore/yarr/YarrJIT.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Platform.h

  Log Message:
  -----------
  Merge r228481 - REGRESSION(225695) : com.apple.WebKit.WebContent at com.apple.JavaScriptCore: JSC::RegExp::match + 630 :: stack overflow
https://bugs.webkit.org/show_bug.cgi?id=182705

Reviewed by Mark Lam.

Source/JavaScriptCore:

Moved the pattern context buffer used by YARR JIT'ed code from a stack local to a lazily allocated
buffer on the VM.  Exposed when the buffer is needed to reduce likelihood that we'd allocated it.
Guarded use of the buffer with a lock since the DFG compiler may call into YARR JIT'ed code on a
compilation thread.

* runtime/RegExpInlines.h:
(JSC::RegExp::matchInline):
* runtime/VM.cpp:
(JSC::VM::~VM):
(JSC::VM::acquireRegExpPatternContexBuffer):
(JSC::VM::releaseRegExpPatternContexBuffer):
* runtime/VM.h:
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generate):
(JSC::Yarr::YarrGenerator::backtrack):
(JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
(JSC::Yarr::YarrGenerator::generateEnter):
(JSC::Yarr::YarrGenerator::generateReturn):
(JSC::Yarr::YarrGenerator::YarrGenerator):
(JSC::Yarr::YarrGenerator::compile):
* yarr/YarrJIT.h:
(JSC::Yarr::YarrCodeBlock::usesPatternContextBuffer):
(JSC::Yarr::YarrCodeBlock::setUsesPaternContextBuffer):

Source/WTF:

Moved the setting of ENABLE_YARR_JIT_ALL_PARENS_EXPRESSIONS to Platform.h since more than just the YARR
code needs to know if that feature is enabled.

* wtf/Platform.h:


  Commit: b7874a6383a5fea5913ddf0397cb7bbcd1e30876
      https://github.com/WebKit/WebKit/commit/b7874a6383a5fea5913ddf0397cb7bbcd1e30876
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/speech/SpeechSynthesis.h
    M Source/WebCore/bindings/js/JSDOMGlobalObject.h
    M Source/WebCore/contentextensions/ContentExtensionError.h
    M Source/WebCore/contentextensions/DFA.h
    M Source/WebCore/dom/ContextDestructionObserver.h
    M Source/WebCore/dom/DeviceOrientationClient.h
    M Source/WebCore/dom/DeviceOrientationData.h
    M Source/WebCore/editing/cocoa/HTMLConverter.h
    M Source/WebCore/loader/FrameLoaderStateMachine.h
    M Source/WebCore/loader/cache/CachedResourceHandle.h
    M Source/WebCore/page/FrameDestructionObserver.h
    M Source/WebCore/page/RuntimeEnabledFeatures.h
    M Source/WebCore/platform/URL.h
    M Source/WebCore/platform/audio/AudioHardwareListener.h
    M Source/WebCore/platform/audio/AudioSession.h
    M Source/WebCore/platform/graphics/Color.h
    M Source/WebCore/platform/graphics/IntSize.h
    M Source/WebCore/platform/graphics/transforms/AffineTransform.h
    M Source/WebCore/platform/graphics/win/LocalWindowsContext.h
    M Source/WebCore/platform/network/CacheValidation.h
    M Source/WebCore/platform/network/CredentialBase.h
    M Source/WebCore/platform/network/ResourceHandleClient.h
    M Source/WebCore/platform/network/cf/CertificateInfo.h

  Log Message:
  -----------
  Merge r228483 - WebCore headers should not include config.h or PlatformExportMacros.h
https://bugs.webkit.org/show_bug.cgi?id=182799

Reviewed by Darin Adler.

No new tests. No change in behavior.

* Modules/speech/SpeechSynthesis.h:
* bindings/js/JSDOMGlobalObject.h:
* contentextensions/ContentExtensionError.h:
* contentextensions/DFA.h:
* dom/ContextDestructionObserver.h:
* dom/DeviceOrientationClient.h:
* dom/DeviceOrientationData.h:
* editing/cocoa/HTMLConverter.h:
* loader/FrameLoaderStateMachine.h:
* loader/cache/CachedResourceHandle.h:
* page/FrameDestructionObserver.h:
* page/RuntimeEnabledFeatures.h:
* platform/URL.h:
* platform/audio/AudioHardwareListener.h:
* platform/audio/AudioSession.h:
* platform/graphics/Color.h:
* platform/graphics/IntSize.h:
* platform/graphics/transforms/AffineTransform.h:
* platform/graphics/win/LocalWindowsContext.h:
* platform/network/CacheValidation.h:
* platform/network/CredentialBase.h:
* platform/network/ResourceHandleClient.h:
* platform/network/cf/CertificateInfo.h:


  Commit: 8e429dbf35dc133cc56860083b566da9a2da062c
      https://github.com/WebKit/WebKit/commit/8e429dbf35dc133cc56860083b566da9a2da062c
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/watchdog-dont-malloc-when-in-c-code.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jsc.cpp
    M Source/JavaScriptCore/runtime/VMTraps.cpp

  Log Message:
  -----------
  Merge r228488 - Setting a VMTrap shouldn't look at topCallFrame since that may imply we're in C code and holding the malloc lock
https://bugs.webkit.org/show_bug.cgi?id=182801

Reviewed by Keith Miller.

JSTests:

* stress/watchdog-dont-malloc-when-in-c-code.js: Added.

Source/JavaScriptCore:

VMTraps would sometimes install traps when it paused the JS thread when it
was in C code. This is wrong, as installing traps mallocs, and the JS thread
may have been holding the malloc lock while in C code. This could lead to a
deadlock when C code was holding the malloc lock.

This patch makes it so that we only install traps when we've proven the PC
is in JIT or LLInt code. If we're in JIT/LLInt code, we are guaranteed that
we're not holding the malloc lock.

* jsc.cpp:
(GlobalObject::finishCreation):
(functionMallocInALoop):
* runtime/VMTraps.cpp:
(JSC::VMTraps::tryInstallTrapBreakpoints):


  Commit: 1f4c754df7b76951ce8be322a1ca3f1d5ab43898
      https://github.com/WebKit/WebKit/commit/1f4c754df7b76951ce8be322a1ca3f1d5ab43898
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/wasm/WasmThunks.cpp

  Log Message:
  -----------
  Merge r228491 - Crash: triggerOMGTierUpThunkGenerator() doesn't align the stack pointer before calling C++ code
https://bugs.webkit.org/show_bug.cgi?id=182808

Reviewed by Keith Miller.

Set up a proper frame with a prologue and epilogue to align the stack pointer for the rest of the
thunk.

* wasm/WasmThunks.cpp:
(JSC::Wasm::triggerOMGTierUpThunkGenerator):


  Commit: 057042ee0606d29b5b06ca544ae996304b8f8ef4
      https://github.com/WebKit/WebKit/commit/057042ee0606d29b5b06ca544ae996304b8f8ef4
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/svg/RenderSVGContainer.cpp
    M Source/WebCore/rendering/svg/RenderSVGContainer.h
    M Source/WebCore/rendering/svg/RenderSVGInline.cpp
    M Source/WebCore/rendering/svg/RenderSVGInline.h
    M Source/WebCore/rendering/svg/RenderSVGRoot.cpp
    M Source/WebCore/rendering/svg/RenderSVGRoot.h
    M Source/WebCore/rendering/svg/RenderSVGText.cpp
    M Source/WebCore/rendering/svg/RenderSVGText.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h

  Log Message:
  -----------
  Merge r228492 - [RenderTreeBuilder] Move RenderSVG*::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182811
<rdar://problem/37549714>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/svg/RenderSVGContainer.cpp:
(WebCore::RenderSVGContainer::addChild): Deleted.
* rendering/svg/RenderSVGContainer.h:
* rendering/svg/RenderSVGInline.cpp:
(WebCore::RenderSVGInline::addChild): Deleted.
* rendering/svg/RenderSVGInline.h:
* rendering/svg/RenderSVGRoot.cpp:
(WebCore::RenderSVGRoot::addChild): Deleted.
* rendering/svg/RenderSVGRoot.h:
* rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::addChild): Deleted.
* rendering/svg/RenderSVGText.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild):
(WebCore::RenderTreeBuilder::insertChildToSVGContainer): Deleted.
(WebCore::RenderTreeBuilder::insertChildToSVGInline): Deleted.
(WebCore::RenderTreeBuilder::insertChildToSVGRoot): Deleted.
(WebCore::RenderTreeBuilder::insertChildToSVGText): Deleted.
* rendering/updating/RenderTreeBuilder.h:


  Commit: ea24ba3c6b24a00f9246b9847057cb733247ec19
      https://github.com/WebKit/WebKit/commit/ea24ba3c6b24a00f9246b9847057cb733247ec19
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/css/indirect-adjacent-style-invalidation-1-expected.txt
    M LayoutTests/fast/css/indirect-adjacent-style-invalidation-1.html
    M LayoutTests/fast/css/indirect-adjacent-style-invalidation-2-expected.txt
    M LayoutTests/fast/css/indirect-adjacent-style-invalidation-2.html
    M LayoutTests/fast/css/indirect-adjacent-style-invalidation-3-expected.txt
    M LayoutTests/fast/css/indirect-adjacent-style-invalidation-3.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Element.cpp
    M Source/WebCore/dom/Element.h
    M Source/WebCore/style/StyleInvalidator.cpp
    M Source/WebCore/style/StyleTreeResolver.cpp
    M Source/WebCore/style/StyleTreeResolver.h

  Log Message:
  -----------
  Merge r228497 - Do sibling invalidation on mutation
https://bugs.webkit.org/show_bug.cgi?id=182809

Reviewed by Zalan Bujtas.

Source/WebCore:

We used to invalidate siblings for sibling combinators and nth-pseudo classes during style resolution tree walk.
This would consider any element with invalid style a reason to invalidate siblings too. However we now do
accurate invalidation on class and attribute changes and this approach ends up invalidating too much.

This patch sibling style invalidation to mutation time and removes invalidation code from style resolution tree walk.

* dom/Element.cpp:
(WebCore::invalidateSiblingsIfNeeded):

    Helper to invalidate siblings.

(WebCore::Element::invalidateStyle):
(WebCore::Element::invalidateStyleAndLayerComposition):
(WebCore::Element::invalidateStyleForSubtree):
(WebCore::Element::invalidateStyleAndRenderersForSubtree):

    Invalidate siblings if needed based on affectsNextSibling/affectedByPreviousSibling bits.

(WebCore::Element::invalidateStyleInternal):
(WebCore::Element::invalidateStyleForSubtreeInternal):

    Add "internal" versions that don't invalidate siblings. These are used by StyleInvalidator for accurate invalidation.

* dom/Element.h:
* style/StyleInvalidator.cpp:
(WebCore::Style::Invalidator::invalidateIfNeeded):
(WebCore::Style::Invalidator::invalidateStyle):

    Use internal invalidation functions.

* style/StyleTreeResolver.cpp:
(WebCore::Style::resetStyleForNonRenderedDescendants):
(WebCore::Style::TreeResolver::resolveComposedTree):

    Remove sibling invalidation.

* style/StyleTreeResolver.h:

LayoutTests:

Sibling invalidation now happens on mutation. Update the tests.

* fast/css/indirect-adjacent-style-invalidation-1-expected.txt:
* fast/css/indirect-adjacent-style-invalidation-1.html:
* fast/css/indirect-adjacent-style-invalidation-2-expected.txt:
* fast/css/indirect-adjacent-style-invalidation-2.html:
* fast/css/indirect-adjacent-style-invalidation-3-expected.txt:
* fast/css/indirect-adjacent-style-invalidation-3.html:


  Commit: 6ab88623daed37c9429031eb0d0c2fdc44b76b61
      https://github.com/WebKit/WebKit/commit/6ab88623daed37c9429031eb0d0c2fdc44b76b61
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/JavaScriptCore/bytecode/CallVariant.h
    M Source/JavaScriptCore/bytecode/CodeBlock.h
    M Source/JavaScriptCore/bytecode/ExecutableToCodeBlockEdge.h
    M Source/JavaScriptCore/bytecode/TrackedReferences.h
    M Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
    M Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.h
    M Source/JavaScriptCore/dfg/DFGAbstractValue.h
    M Source/JavaScriptCore/dfg/DFGCommonData.h
    M Source/JavaScriptCore/dfg/DFGFrozenValue.h
    M Source/JavaScriptCore/dfg/DFGStructureAbstractValue.h
    M Source/JavaScriptCore/heap/CellContainerInlines.h
    M Source/JavaScriptCore/heap/ConservativeRoots.cpp
    M Source/JavaScriptCore/heap/GCLogging.cpp
    M Source/JavaScriptCore/heap/HeapInlines.h
    M Source/JavaScriptCore/heap/HeapSnapshotBuilder.cpp
    M Source/JavaScriptCore/heap/MarkedBlock.cpp
    M Source/JavaScriptCore/heap/MarkedBlockInlines.h
    M Source/JavaScriptCore/heap/SubspaceInlines.h
    M Source/JavaScriptCore/heap/WeakInlines.h
    M Source/JavaScriptCore/jit/JITOpcodes.cpp
    M Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
    M Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
    M Source/JavaScriptCore/runtime/ArrayBufferNeuteringWatchpoint.h
    M Source/JavaScriptCore/runtime/BigIntPrototype.cpp
    M Source/JavaScriptCore/runtime/ClassInfo.h
    M Source/JavaScriptCore/runtime/CustomGetterSetter.h
    M Source/JavaScriptCore/runtime/FunctionRareData.h
    M Source/JavaScriptCore/runtime/GetterSetter.h
    M Source/JavaScriptCore/runtime/InferredType.h
    M Source/JavaScriptCore/runtime/InferredTypeTable.h
    M Source/JavaScriptCore/runtime/InferredValue.h
    M Source/JavaScriptCore/runtime/InternalFunction.cpp
    M Source/JavaScriptCore/runtime/JSAPIValueWrapper.h
    M Source/JavaScriptCore/runtime/JSArray.h
    M Source/JavaScriptCore/runtime/JSArrayBufferView.cpp
    A Source/JavaScriptCore/runtime/JSCast.h
    M Source/JavaScriptCore/runtime/JSCell.cpp
    M Source/JavaScriptCore/runtime/JSCell.h
    M Source/JavaScriptCore/runtime/JSCellInlines.h
    M Source/JavaScriptCore/runtime/JSFunction.cpp
    M Source/JavaScriptCore/runtime/JSJob.h
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/JSPromiseDeferred.h
    M Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h
    M Source/JavaScriptCore/runtime/JSType.h
    M Source/JavaScriptCore/runtime/NativeStdFunctionCell.h
    M Source/JavaScriptCore/runtime/ScopedArgumentsTable.h
    M Source/JavaScriptCore/runtime/SparseArrayValueMap.h
    M Source/JavaScriptCore/runtime/Structure.h
    M Source/JavaScriptCore/runtime/StructureChain.h
    M Source/JavaScriptCore/runtime/StructureRareData.h
    M Source/JavaScriptCore/tools/CellProfile.h
    M Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlock.h

  Log Message:
  -----------
  Merge r228500 - We should be able to jsDynamicCast from JSType when possible
https://bugs.webkit.org/show_bug.cgi?id=182804

Reviewed by Filip Pizlo and Mark Lam.

This patch beefs up jsDynamicCast in some of the cases where we
can use the JSType to quickly determine if a cell is a subclass of
the desired type. Since all JSCells have a range of JSTypes they support,
if there is a range exclusive to a class and all subclasses we can use
that range to quickly determine if the cast should be successful.

Additionally, the JSValue versions of jsCast and jsDynamicCast now
call the JSCell version after checking the value is a cell.

Finally, the casting functions have been moved to a new header,
JSCast.h

* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/CallVariant.h:
* bytecode/CodeBlock.h:
* bytecode/ExecutableToCodeBlockEdge.h:
* bytecode/TrackedReferences.h:
* bytecode/UnlinkedCodeBlock.h:
* bytecode/UnlinkedFunctionExecutable.h:
* dfg/DFGAbstractValue.h:
* dfg/DFGCommonData.h:
* dfg/DFGFrozenValue.h:
* dfg/DFGStructureAbstractValue.h:
* heap/CellContainerInlines.h:
* heap/ConservativeRoots.cpp:
* heap/GCLogging.cpp:
* heap/HeapInlines.h:
* heap/HeapSnapshotBuilder.cpp:
* heap/MarkedBlock.cpp:
* heap/MarkedBlockInlines.h:
* heap/SubspaceInlines.h:
* heap/WeakInlines.h:
* jit/JITOpcodes.cpp:
* jit/JITOpcodes32_64.cpp:
* llint/LLIntOffsetsExtractor.cpp:
* runtime/ArrayBufferNeuteringWatchpoint.h:
* runtime/BigIntPrototype.cpp:
* runtime/ClassInfo.h:
* runtime/CustomGetterSetter.h:
* runtime/FunctionRareData.h:
* runtime/GetterSetter.h:
* runtime/InferredType.h:
* runtime/InferredTypeTable.h:
* runtime/InferredValue.h:
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::finishCreation):
* runtime/JSAPIValueWrapper.h:
* runtime/JSArray.h:
(JSC::JSArray::finishCreation):
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::finishCreation):
* runtime/JSCast.h: Added.
(JSC::jsCast):
(JSC::JSCastingHelpers::jsDynamicCastGenericImpl):
(JSC::JSCastingHelpers::jsDynamicCastJSTypeImpl):
(JSC::JSCastingHelpers::JSDynamicCastTraits::cast):
(JSC::jsDynamicCast):
* runtime/JSCell.cpp:
* runtime/JSCell.h:
(JSC::jsCast): Deleted.
(JSC::jsDynamicCast): Deleted.
* runtime/JSCellInlines.h:
* runtime/JSFunction.cpp:
(JSC::JSFunction::finishCreation):
* runtime/JSJob.h:
* runtime/JSObject.h:
(JSC::JSObject::finishCreation):
* runtime/JSPromiseDeferred.h:
* runtime/JSPropertyNameEnumerator.h:
* runtime/NativeStdFunctionCell.h:
* runtime/ScopedArgumentsTable.h:
* runtime/SparseArrayValueMap.h:
* runtime/Structure.h:
* runtime/StructureChain.h:
* runtime/StructureRareData.h:
* tools/CellProfile.h:
* wasm/js/JSWebAssemblyCodeBlock.h:


  Commit: 1088bbc79dc276f3c68014b18fbf16615344db8f
      https://github.com/WebKit/WebKit/commit/1088bbc79dc276f3c68014b18fbf16615344db8f
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/mathml/RenderMathMLFenced.cpp
    M Source/WebCore/rendering/mathml/RenderMathMLFenced.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp

  Log Message:
  -----------
  Merge r228503 - [RenderTreeBuilder] Move RenderMathMLFenced::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182817
<rdar://problem/37556761>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/mathml/RenderMathMLFenced.cpp:
(WebCore::RenderMathMLFenced::addChild): Deleted.
* rendering/mathml/RenderMathMLFenced.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild):
(WebCore::RenderTreeBuilder::insertChildToRenderMathMLFenced): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderMathML.cpp:
(WebCore::RenderTreeBuilder::MathML::insertChild):


  Commit: 02a2d9b71b61e46ffd8bdab260d7a797dc4f1cbf
      https://github.com/WebKit/WebKit/commit/02a2d9b71b61e46ffd8bdab260d7a797dc4f1cbf
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/FontPlatformData.h
    M Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFace.h

  Log Message:
  -----------
  Merge r228507 - HarfBuzzFace should not be ref-counted
https://bugs.webkit.org/show_bug.cgi?id=182823

Reviewed by Carlos Garcia Campos.

The HarfBuzzFace objects shouldn't be copied along in FontPlatformData
copy assignment operator, which made it a requirement for that class to
be ref-counted. Cairo-based HarfBuzzFace implementation uses the
cairo_scaled_font_t object from FontPlatformData internally, but upon
FontPlatformData cloning that scaled font object could change, meaning
HarfBuzzFace object that's shared with another FontPlatformData object
would end up using a different cairo_scaled_font_t object from the one
that's been regenerated in the newly-cloned FontPlatformData object.

Instead of ref-counting the HarfBuzzFace objects, they should be handled
in FontPlatformData through std::unique_ptr<>. In the FontPlatformData
copy assignment operator, the copy target's m_harfBuzzFace object is
nulled out, allowing the next harfBuzzFace() call to construct an
object that properly leverages the cairo_scaled_font_t object that could
have changed during cloning.

* platform/graphics/FontPlatformData.h:
* platform/graphics/freetype/FontPlatformDataFreeType.cpp:
(WebCore::FontPlatformData::operator=):
(WebCore::FontPlatformData::harfBuzzFace const):
* platform/graphics/harfbuzz/HarfBuzzFace.h:
(WebCore::HarfBuzzFace::create): Deleted.


  Commit: e3219891e8612ca6c599ebca1e8c8c0875425ebd
      https://github.com/WebKit/WebKit/commit/e3219891e8612ca6c599ebca1e8c8c0875425ebd
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r228508 - [GStreamer] WebVTT caps changed in GStreamer 1.14
https://bugs.webkit.org/show_bug.cgi?id=182690

Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin): Use
text/vtt caps only for GStreamer versions inferior or equal to
1.12. In 1.13 (current git master) the VTT caps format changed to
application/x-subtitle-vtt.


  Commit: b1fa2b335e6f939805565969b4184e19aafeac53
      https://github.com/WebKit/WebKit/commit/b1fa2b335e6f939805565969b4184e19aafeac53
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp

  Log Message:
  -----------
  Merge r228509 - Clean up HarfBuzzFaceCairo
https://bugs.webkit.org/show_bug.cgi?id=182824

Reviewed by Carlos Garcia Campos.

Clean up Cairo-specific bits of HarfBuzzFace implementation.

HarfBuzzFontData is simplified, removing the constructor and turning the
cairo_scaled_font_t member into a RefPtr<>, tying the Cairo object's
lifetime to the lifetime of the HarfBuzzFontData instance.

HarfBuzz font callbacks have the HarfBuzzFontData casting cleaned up,
casting the user data pointer straight into a HarfBuzzFontData reference
that's then used in the functions. HarfBuzzFontData member access is
also adjusted.

HarfBuzzFace::createFace() now references the cairo_scaled_font_t object
that is then set as the user data pointer, with the destroy callback
that dereferences that object also specified. With hb_face_t being a
reference-counted object itself, this ensures the cairo_scaled_font_t
object doesn't get destroyed while hb_face_t is still alive.

In HarfBuzzFace::createFont(), the hb_font_t creation is cleaned up,
with a C++ lambda used as the destroy callback.

* platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:
(WebCore::harfBuzzGetGlyph):
(WebCore::harfBuzzGetGlyphHorizontalAdvance):
(WebCore::harfBuzzGetGlyphExtents):
(WebCore::harfBuzzCairoGetTable):
(WebCore::HarfBuzzFace::createFace):
(WebCore::HarfBuzzFace::createFont):
(WebCore::HarfBuzzFontData::HarfBuzzFontData): Deleted.
(WebCore::destroyHarfBuzzFontData): Deleted.


  Commit: 6eb49ca4bef90ffc354330afa461a241c8e73313
      https://github.com/WebKit/WebKit/commit/6eb49ca4bef90ffc354330afa461a241c8e73313
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderGrid.cpp
    M Source/WebCore/rendering/RenderGrid.h
    M Source/WebCore/rendering/RenderInline.cpp
    M Source/WebCore/rendering/RenderInline.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp

  Log Message:
  -----------
  Merge r228520 - [RenderTreeBuilder] Move RenderInline/RenderGrid::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182819
<rdar://problem/37558187>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderGrid.cpp:
(WebCore::RenderGrid::addChild): Deleted.
* rendering/RenderGrid.h:
* rendering/RenderInline.cpp:
(WebCore::RenderInline::addChild): Deleted.
* rendering/RenderInline.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild):
(WebCore::RenderTreeBuilder::takeChild): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::findOrCreateParentForChild):
* rendering/updating/RenderTreeBuilderSVG.cpp:
(WebCore::RenderTreeBuilder::SVG::insertChild):


  Commit: d59c5faa9af3b57a61f999d00421fb1ead6a2d26
      https://github.com/WebKit/WebKit/commit/d59c5faa9af3b57a61f999d00421fb1ead6a2d26
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/capture/NetworkCaptureManager.cpp
    M Source/WebKit/NetworkProcess/webrtc/NetworkRTCMonitor.h
    M Source/WebKit/Shared/gtk/WebEventFactory.cpp
    M Source/WebKit/UIProcess/API/gtk/PageClientImpl.cpp
    M Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp
    M Source/WebKit/UIProcess/gtk/WebPageProxyGtk.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/wpe/WebEditorClientWPE.cpp
    M Source/WebKit/WebProcess/WebPage/gtk/WebPageGtk.cpp
    M Source/WebKit/WebProcess/WebPage/wpe/WebPageWPE.cpp
    M Source/WebKitLegacy/win/ChangeLog
    M Source/WebKitLegacy/win/FullscreenVideoController.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/win/TestWebCoreStubs.cpp
    M Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp
    M Tools/WebKitTestRunner/InjectedBundle/wpe/AccessibilityControllerWPE.cpp
    M Tools/WebKitTestRunner/InjectedBundle/wpe/AccessibilityUIElementWPE.cpp
    M Tools/WebKitTestRunner/gtk/EventSenderProxyGtk.cpp
    M Tools/WebKitTestRunner/wpe/EventSenderProxyWPE.cpp

  Log Message:
  -----------
  Merge r228521 - WebCore headers should not be included relatively within dependent projects
https://bugs.webkit.org/show_bug.cgi?id=182805

Reviewed by Chris Dumez.

Source/WebKit:

* NetworkProcess/capture/NetworkCaptureManager.cpp:
* NetworkProcess/webrtc/NetworkRTCMonitor.h:
* Shared/gtk/WebEventFactory.cpp:
* UIProcess/API/gtk/PageClientImpl.cpp:
* UIProcess/API/gtk/WebKitWebViewBase.cpp:
* UIProcess/gtk/WebPageProxyGtk.cpp:
* WebProcess/Plugins/Netscape/x11/NetscapePluginX11.cpp:
* WebProcess/WebCoreSupport/gtk/WebEditorClientGtk.cpp:
* WebProcess/WebCoreSupport/wpe/WebEditorClientWPE.cpp:
* WebProcess/WebPage/gtk/WebPageGtk.cpp:
* WebProcess/WebPage/wpe/WebPageWPE.cpp:

Source/WebKitLegacy/win:

* FullscreenVideoController.h:

Tools:

* TestWebKitAPI/win/TestWebCoreStubs.cpp:
* WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:
* WebKitTestRunner/InjectedBundle/wpe/AccessibilityControllerWPE.cpp:
* WebKitTestRunner/InjectedBundle/wpe/AccessibilityUIElementWPE.cpp:
* WebKitTestRunner/gtk/EventSenderProxyGtk.cpp:
* WebKitTestRunner/wpe/EventSenderProxyWPE.cpp:


  Commit: 2f8a9f503c0ecb536bd3051dcf3d795014e163e1
      https://github.com/WebKit/WebKit/commit/2f8a9f503c0ecb536bd3051dcf3d795014e163e1
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/FontPlatformData.h
    M Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp
    M Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp
    M Source/WebCore/platform/graphics/opentype/OpenTypeMathData.cpp

  Log Message:
  -----------
  Merge r228524 - FontPlatformData::harfBuzzFace() should return a reference
https://bugs.webkit.org/show_bug.cgi?id=182825

Reviewed by Carlos Garcia Campos.

Have FontPlatformData::harfBuzzFace() return a reference instead of a
pointer, given that the returned HarfBuzzFace object cannot be null.

Call-sites of FontPlatformData::harfBuzzFace() are adjusted.
OpenTypeMathData constructors are also changed to not rely on
preprocessor to correctly position the closing brace.

* platform/graphics/FontPlatformData.h:
* platform/graphics/freetype/FontPlatformDataFreeType.cpp:
(WebCore::FontPlatformData::harfBuzzFace const):
* platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
(WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
* platform/graphics/opentype/OpenTypeMathData.cpp:
(WebCore::OpenTypeMathData::OpenTypeMathData):


  Commit: f1c94f46f9b9d11cd754bc9df069bf89c4fdce19
      https://github.com/WebKit/WebKit/commit/f1c94f46f9b9d11cd754bc9df069bf89c4fdce19
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFace.cpp
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFace.h
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp

  Log Message:
  -----------
  Merge r228525 - HarfBuzzFace: rework cache entry reference holding
https://bugs.webkit.org/show_bug.cgi?id=182828

Reviewed by Michael Catanzaro.

Move the FaceCacheEntry and HarfBuzzFaceCache types into the
HarfBuzzFace class as CacheEntry and Cache, respectively. The Cache
singleton is also moved there.

In the HarfBuzzFace constructor, we now don't increase the CacheEntry
reference, but instead just keep a reference to that object through
a RefPtr<CacheEntry> object. We don't need to retrieve the hb_face_t
object and the glyph cache HashMap in the constructor anymore, we just
retrieve them when necessary through that CacheEntry reference.

In the destructor, that RefPtr<CacheEntry> object is nulled out before
the object in Cache is removed if that's where the final reference is
kept.

* platform/graphics/harfbuzz/HarfBuzzFace.cpp:
(WebCore::HarfBuzzFace::CacheEntry::CacheEntry):
(WebCore::HarfBuzzFace::CacheEntry::~CacheEntry):
(WebCore::HarfBuzzFace::cache):
(WebCore::HarfBuzzFace::HarfBuzzFace):
(WebCore::HarfBuzzFace::~HarfBuzzFace):
(WebCore::HarfBuzzFace::setScriptForVerticalGlyphSubstitution):
(WebCore::FaceCacheEntry::create): Deleted.
(WebCore::FaceCacheEntry::~FaceCacheEntry): Deleted.
(WebCore::FaceCacheEntry::face): Deleted.
(WebCore::FaceCacheEntry::glyphCache): Deleted.
(WebCore::FaceCacheEntry::FaceCacheEntry): Deleted.
(WebCore::harfBuzzFaceCache): Deleted.
* platform/graphics/harfbuzz/HarfBuzzFace.h:
(WebCore::HarfBuzzFace::CacheEntry::create):
(WebCore::HarfBuzzFace::CacheEntry::face):
(WebCore::HarfBuzzFace::CacheEntry::glyphCache):
* platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:
(WebCore::harfBuzzGetGlyph):
(WebCore::HarfBuzzFace::createFont):


  Commit: 9bf1fc31a2033e367a825f0aa7c5f7c700e17675
      https://github.com/WebKit/WebKit/commit/9bf1fc31a2033e367a825f0aa7c5f7c700e17675
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderTable.cpp
    M Source/WebCore/rendering/RenderTable.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228529 - [RenderTreeBuilder] Move RenderTable::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182832
<rdar://problem/37576362>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderTable.cpp:
(WebCore::RenderTable::willInsertTableColumn):
(WebCore::RenderTable::willInsertTableSection):
(WebCore::RenderTable::addChild): Deleted.
* rendering/RenderTable.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::insertChild):


  Commit: f235b40e6ed32ba01b0cb99836b5e995fe6f2c92
      https://github.com/WebKit/WebKit/commit/f235b40e6ed32ba01b0cb99836b5e995fe6f2c92
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderTableSection.cpp
    M Source/WebCore/rendering/RenderTableSection.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228530 - [RenderTreeBuilder] Move RenderTableSection::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182835
<rdar://problem/37579191>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderTableSection.cpp:
(WebCore::RenderTableSection::willInsertTableRow):
(WebCore::RenderTableSection::addChild): Deleted.
* rendering/RenderTableSection.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild): Leftover from r228529.
(WebCore::RenderTreeBuilder::insertChildToRenderTable): Deleted. Leftover from r228529.
(WebCore::RenderTreeBuilder::insertChildToRenderTableSection): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::insertChild):


  Commit: 6e660ec09fcb6d668fd4e7d5c5d751b1d2e4188c
      https://github.com/WebKit/WebKit/commit/6e660ec09fcb6d668fd4e7d5c5d751b1d2e4188c
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/b3/testb3.cpp
    M Source/JavaScriptCore/dfg/DFGPhase.h
    M Source/JavaScriptCore/dfg/DFGPlan.cpp
    M Source/JavaScriptCore/dfg/DFGPlan.h
    M Source/JavaScriptCore/dynbench.cpp
    M Source/JavaScriptCore/heap/BlockDirectory.cpp
    M Source/JavaScriptCore/heap/BlockDirectory.h
    M Source/JavaScriptCore/heap/FullGCActivityCallback.cpp
    M Source/JavaScriptCore/heap/Heap.cpp
    M Source/JavaScriptCore/heap/Heap.h
    M Source/JavaScriptCore/heap/MarkedSpace.cpp
    M Source/JavaScriptCore/heap/MarkedSpace.h
    M Source/JavaScriptCore/inspector/agents/InspectorConsoleAgent.cpp
    M Source/JavaScriptCore/inspector/agents/InspectorConsoleAgent.h
    M Source/JavaScriptCore/inspector/agents/InspectorRuntimeAgent.cpp
    M Source/JavaScriptCore/jit/JIT.cpp
    M Source/JavaScriptCore/jit/JIT.h
    M Source/JavaScriptCore/jsc.cpp
    M Source/JavaScriptCore/profiler/ProfilerDatabase.cpp
    M Source/JavaScriptCore/profiler/ProfilerEvent.cpp
    M Source/JavaScriptCore/profiler/ProfilerEvent.h
    M Source/JavaScriptCore/runtime/CodeCache.cpp
    M Source/JavaScriptCore/runtime/CodeCache.h
    M Source/JavaScriptCore/runtime/DateConstructor.cpp
    M Source/JavaScriptCore/runtime/TypeProfilerLog.cpp
    M Source/JavaScriptCore/testRegExp.cpp

  Log Message:
  -----------
  Merge r228533 - [JSC] Remove monotonicallyIncreasingTime and currentTime
https://bugs.webkit.org/show_bug.cgi?id=182793

Reviewed by Saam Barati.

We would like to drop monotonicallyIncreasingTime and currentTime from our tree by
replacing them with MonotonicTime and WallTime, which are well-typed alternatives,
compared to double.
This patch removes monotonicallyIncreasingTime and currentTime in JSC.

* b3/testb3.cpp:
(JSC::B3::testComplex):
* dfg/DFGPhase.h:
(JSC::DFG::runAndLog):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThread):
(JSC::DFG::Plan::compileInThreadImpl):
* dfg/DFGPlan.h:
* dynbench.cpp:
(JSC::benchmarkImpl):
* heap/BlockDirectory.cpp:
(JSC::BlockDirectory::isPagedOut):
* heap/BlockDirectory.h:
* heap/FullGCActivityCallback.cpp:
(JSC::FullGCActivityCallback::doCollection):
* heap/Heap.cpp:
(JSC::Heap::isPagedOut):
(JSC::Heap::sweepSynchronously):
* heap/Heap.h:
* heap/MarkedSpace.cpp:
(JSC::MarkedSpace::isPagedOut):
* heap/MarkedSpace.h:
* inspector/agents/InspectorConsoleAgent.cpp:
(Inspector::InspectorConsoleAgent::startTiming):
(Inspector::InspectorConsoleAgent::stopTiming):
* inspector/agents/InspectorConsoleAgent.h:
* inspector/agents/InspectorRuntimeAgent.cpp:
(Inspector::InspectorRuntimeAgent::getRuntimeTypesForVariablesAtOffsets):
* jit/JIT.cpp:
(JSC::JIT::compileWithoutLinking):
(JSC::JIT::compileTimeStats):
* jit/JIT.h:
* jsc.cpp:
(StopWatch::start):
(StopWatch::stop):
(StopWatch::getElapsedMS):
(functionPreciseTime):
(runJSC):
* profiler/ProfilerDatabase.cpp:
(JSC::Profiler::Database::logEvent):
* profiler/ProfilerEvent.cpp:
(JSC::Profiler::Event::toJS const):
* profiler/ProfilerEvent.h:
(JSC::Profiler::Event::Event):
(JSC::Profiler::Event::time const):
* runtime/CodeCache.cpp:
(JSC::CodeCacheMap::pruneSlowCase):
* runtime/CodeCache.h:
(JSC::CodeCacheMap::CodeCacheMap):
(JSC::CodeCacheMap::prune):
* runtime/DateConstructor.cpp:
(JSC::callDate):
* runtime/TypeProfilerLog.cpp:
(JSC::TypeProfilerLog::processLogEntries):
* testRegExp.cpp:
(StopWatch::start):
(StopWatch::stop):
(StopWatch::getElapsedMS):


  Commit: a07a07350924a5f430e594418924640f8b018509
      https://github.com/WebKit/WebKit/commit/a07a07350924a5f430e594418924640f8b018509
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderTableRow.cpp
    M Source/WebCore/rendering/RenderTableRow.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228542 - [RenderTreeBuilder] Move RenderTableRow::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182838
<rdar://problem/37580762>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderTableRow.cpp:
(WebCore::RenderTableRow::didInsertTableCell):
(WebCore::RenderTableRow::addChild): Deleted.
* rendering/RenderTableRow.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild):
(WebCore::RenderTreeBuilder::insertChildToRenderTableRow): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::insertChild):


  Commit: 8623bff9289839c3d724417f3a2325fc5207d115
      https://github.com/WebKit/WebKit/commit/8623bff9289839c3d724417f3a2325fc5207d115
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderMenuList.cpp
    M Source/WebCore/rendering/RenderMenuList.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.h

  Log Message:
  -----------
  Merge r228547 - [RenderTreeBuilder] Move RenderMenuList::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182840
<rdar://problem/37583638>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderMenuList.cpp:
(RenderMenuList::didInsertChild):
(RenderMenuList::addChild): Deleted.
* rendering/RenderMenuList.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild):
* rendering/updating/RenderTreeBuilderFormControls.cpp:
(WebCore::RenderTreeBuilder::FormControls::findOrCreateParentForChild):
(WebCore::RenderTreeBuilder::FormControls::insertChild):
(WebCore::RenderTreeBuilder::FormControls::createInnerRendererIfNeeded): Deleted.
* rendering/updating/RenderTreeBuilderFormControls.h:


  Commit: d9b9a1257cdfdc7d609cd1b438580e90a821f5cd
      https://github.com/WebKit/WebKit/commit/d9b9a1257cdfdc7d609cd1b438580e90a821f5cd
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228550 - [RenderTreeBuilder] parent.Render*::addChild() cleanup
https://bugs.webkit.org/show_bug.cgi?id=182842
<rdar://problem/37585524>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::insertChildIgnoringContinuation):
* rendering/updating/RenderTreeBuilderFormControls.cpp:
(WebCore::RenderTreeBuilder::FormControls::createInnerRendererIfNeeded):
* rendering/updating/RenderTreeBuilderInline.cpp:
(WebCore::RenderTreeBuilder::Inline::insertChildIgnoringContinuation):
* rendering/updating/RenderTreeBuilderMathML.cpp:
(WebCore::RenderTreeBuilder::MathML::makeFences):
(WebCore::RenderTreeBuilder::MathML::insertChild):
* rendering/updating/RenderTreeBuilderSVG.cpp:
(WebCore::RenderTreeBuilder::SVG::insertChild):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::insertChild):


  Commit: 8dcbf722b0c87d064093ba2f46a3f25cec8e1ef3
      https://github.com/WebKit/WebKit/commit/8dcbf722b0c87d064093ba2f46a3f25cec8e1ef3
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/JavaScriptCore/Sources.txt
    M Source/JavaScriptCore/bytecode/ObjectAllocationProfileInlines.h
    M Source/JavaScriptCore/heap/BlockDirectory.cpp
    M Source/JavaScriptCore/heap/BlockDirectory.h
    M Source/JavaScriptCore/heap/CellAttributes.cpp
    M Source/JavaScriptCore/heap/CellAttributes.h
    M Source/JavaScriptCore/heap/LocalAllocator.cpp
    M Source/JavaScriptCore/heap/MarkedBlock.cpp
    M Source/JavaScriptCore/heap/MarkedBlock.h
    A Source/JavaScriptCore/heap/SecurityKind.cpp
    A Source/JavaScriptCore/heap/SecurityKind.h
    M Source/JavaScriptCore/runtime/JSCellInlines.h
    M Source/JavaScriptCore/runtime/JSDestructibleObjectHeapCellType.cpp
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/JSSegmentedVariableObjectHeapCellType.cpp
    M Source/JavaScriptCore/runtime/JSStringHeapCellType.cpp
    M Source/JavaScriptCore/runtime/Symbol.h
    M Source/JavaScriptCore/runtime/VM.cpp
    M Source/JavaScriptCore/runtime/VM.h
    M Source/JavaScriptCore/wasm/js/JSWebAssemblyCodeBlockHeapCellType.cpp

  Log Message:
  -----------
  Merge r228552 - Objects that contain dangerous things should be allocated far away from objects that can do OOB
https://bugs.webkit.org/show_bug.cgi?id=182843

Reviewed by Saam Barati.

To complete our object distancing plan, we need to put objects that can contain unpoisoned data
far away from objects that cannot. Objects referenceable from JSValues cannot contain
unpoisoned data, but auxiliary data can. This further divides auxiliary data that is meant for
storing mostly JSValues from data that is meant for storing anything.

This is achieved by having three SecurityKinds that are used for MarkedBlock selection and
zeroing sort of the same way SecurityOriginToken already was.

This change shouldn't make anything slower. If anything, it will be a small speed-up because it
removes some cases of MarkedBlock zeroing since we don't need to zero blocks used for two of
the SecurityKinds.

* Sources.txt:
* bytecode/ObjectAllocationProfileInlines.h:
(JSC::ObjectAllocationProfile::initializeProfile):
* heap/BlockDirectory.cpp:
(JSC::BlockDirectory::addBlock):
* heap/BlockDirectory.h:
* heap/CellAttributes.cpp:
(JSC::CellAttributes::dump const):
* heap/CellAttributes.h:
(JSC::CellAttributes::CellAttributes):
* heap/LocalAllocator.cpp:
(JSC::LocalAllocator::allocateSlowCase):
(JSC::LocalAllocator::tryAllocateWithoutCollecting):
* heap/MarkedBlock.cpp:
(JSC::MarkedBlock::Handle::didAddToDirectory):
(JSC::MarkedBlock::Handle::associateWithOrigin): Deleted.
* heap/MarkedBlock.h:
* heap/SecurityKind.cpp: Added.
(WTF::printInternal):
* heap/SecurityKind.h: Added.
* runtime/JSCellInlines.h:
(JSC::JSCell::subspaceFor):
* runtime/JSDestructibleObjectHeapCellType.cpp:
(JSC::JSDestructibleObjectHeapCellType::JSDestructibleObjectHeapCellType):
* runtime/JSObject.h:
(JSC::JSObject::subspaceFor):
* runtime/JSSegmentedVariableObjectHeapCellType.cpp:
(JSC::JSSegmentedVariableObjectHeapCellType::JSSegmentedVariableObjectHeapCellType):
* runtime/JSStringHeapCellType.cpp:
(JSC::JSStringHeapCellType::JSStringHeapCellType):
* runtime/Symbol.h:
(JSC::Symbol::subspaceFor):
* runtime/VM.cpp:
(JSC::VM::VM):
* runtime/VM.h:
* wasm/js/JSWebAssemblyCodeBlockHeapCellType.cpp:
(JSC::JSWebAssemblyCodeBlockHeapCellType::JSWebAssemblyCodeBlockHeapCellType):


  Commit: 2bca24be2e2f49b493dfa4387f811e27c0650a96
      https://github.com/WebKit/WebKit/commit/2bca24be2e2f49b493dfa4387f811e27c0650a96
  Author: Dominik Inführ <dominik.infuehr at gmail.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/offlineasm/mips.rb

  Log Message:
  -----------
  Merge r228604 - Offlineasm/MIPS: immediates need to be within 16-bit signed values
https://bugs.webkit.org/show_bug.cgi?id=182890

Patch by Dominik Inführ <dominik.infuehr at gmail.com> on 2018-02-18
Reviewed by Michael Catanzaro.

In Sequence.getModifiedListMIPS(), we allow immediate values within
the range -0xffff..0xffff for immediates (addresses and other
immediates), but then in Immediate.mipsOperand() and
Address.mipsOperand() we raise if immediate values are not within
-0x7fff..0x7fff. This is inconsistent, and broke compilation on mips
since r228552 made the VM structure bigger meaning we address values
with bigger offsets in llint. This change restricts the allowed range,
so that a separate load of the value is done for values outside of
that range.

* offlineasm/mips.rb:


  Commit: 62517cabac82ddcbd90b9222a73fa8594dcec6b5
      https://github.com/WebKit/WebKit/commit/62517cabac82ddcbd90b9222a73fa8594dcec6b5
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFace.cpp
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFace.h
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp

  Log Message:
  -----------
  Merge r228553 - HarfBuzzFace should operate with a FontPlatformData reference
https://bugs.webkit.org/show_bug.cgi?id=182863

Reviewed by Carlos Garcia Campos.

Instead of keeping a never-null pointer to FontPlatformData,
HarfBuzzFace should operate with a FontPlatformData reference.

* platform/graphics/freetype/FontPlatformDataFreeType.cpp:
(WebCore::FontPlatformData::harfBuzzFace const):
* platform/graphics/harfbuzz/HarfBuzzFace.cpp:
(WebCore::HarfBuzzFace::HarfBuzzFace):
* platform/graphics/harfbuzz/HarfBuzzFace.h:
* platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:
(WebCore::HarfBuzzFace::createFace):
(WebCore::HarfBuzzFace::createFont):


  Commit: 89032b939deb9f3d67e56800977b5789aca5e862
      https://github.com/WebKit/WebKit/commit/89032b939deb9f3d67e56800977b5789aca5e862
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderBlockFlow.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp

  Log Message:
  -----------
  Merge r228559 - [RenderTreeBuilder] Move RenderBlock/RenderBlockFlow::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182862
<rdar://problem/37595464>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::addChild): Deleted.
* rendering/RenderBlock.h:
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::addChild): Deleted.
* rendering/RenderBlockFlow.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild):
(WebCore::RenderTreeBuilder::insertChildToRenderBlock): Deleted.
(WebCore::RenderTreeBuilder::insertChildToRenderBlockFlow): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlockFlow.cpp:
(WebCore::RenderTreeBuilder::BlockFlow::insertChild):
* rendering/updating/RenderTreeBuilderFormControls.cpp:
(WebCore::RenderTreeBuilder::FormControls::findOrCreateParentForChild):
* rendering/updating/RenderTreeBuilderMathML.cpp:
(WebCore::RenderTreeBuilder::MathML::makeFences):
(WebCore::RenderTreeBuilder::MathML::insertChild):
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::createFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::processPossibleSpannerDescendant):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::insertChild):
(WebCore::RenderTreeBuilder::Ruby::findOrCreateParentForChild):
(WebCore::RenderTreeBuilder::Ruby::rubyBaseSafe):
* rendering/updating/RenderTreeBuilderSVG.cpp:
(WebCore::RenderTreeBuilder::SVG::insertChild):


  Commit: 7e4ffd431c9a5f7766d25c3633c70a1bda7265a3
      https://github.com/WebKit/WebKit/commit/7e4ffd431c9a5f7766d25c3633c70a1bda7265a3
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M LayoutTests/platform/wpe/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/IDBKeyData.h

  Log Message:
  -----------
  Merge r228560 - IndexedDB: Several test crash in when destroying a IDBKeyData
https://bugs.webkit.org/show_bug.cgi?id=167576

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-16
Reviewed by Michael Catanzaro.

Source/WebCore:

IDBKeyDataHashTraits::constructDeletedValue is using operator= to
assign deletedValue. But, the value is destructed just before
calling constructDeletedValue. You can't use operator= for a
destructed value.

No new tests (Covered by existing tests).

* Modules/indexeddb/IDBKeyData.h:
(WebCore::IDBKeyDataHashTraits::constructDeletedValue):
Construct null value before assigning deletedValue.

LayoutTests:

* platform/gtk/TestExpectations: Unmarked
imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html,
imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html
and storage/indexeddb/modern/index-3-private.html.
* platform/wpe/TestExpectations: Unmarked
imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html and
imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html.


  Commit: 2da2ce5df2677a58afd2c8c280acd2c2c29e819d
      https://github.com/WebKit/WebKit/commit/2da2ce5df2677a58afd2c8c280acd2c2c29e819d
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/inspector/ScriptCallStackFactory.cpp

  Log Message:
  -----------
  Merge r228561 - fast/frames/sandboxed-iframe-navigation-top-denied.html is crashing in Inspector::createScriptCallStackForConsole::Exec for GTK
https://bugs.webkit.org/show_bug.cgi?id=172952

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-16
Reviewed by Michael Catanzaro.

Source/JavaScriptCore:

Null dereference of VM::topCallFrame happens in
Inspector::createScriptCallStackForConsole if the ExecState has no
call frames.

* inspector/ScriptCallStackFactory.cpp:
(Inspector::createScriptCallStack): Do null check of topCallFrame.
(Inspector::createScriptCallStackForConsole): Ditto.

LayoutTests:

* platform/gtk/TestExpectations: Unmarked fast/frames/sandboxed-iframe-navigation-top-denied.html.


  Commit: 733700e1b9624a5b395eed871c26da0597e91c6f
      https://github.com/WebKit/WebKit/commit/733700e1b9624a5b395eed871c26da0597e91c6f
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228566 - [RenderTreeBuilder] Move RenderElement::addChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182878
<rdar://problem/37608349>

Reviewed by Antti Koivisto.

This patch removes the last addChild() related mutation logic from the renderers.

No change in functionality.

* rendering/RenderElement.cpp:
(WebCore::RenderElement::didInsertChild):
(WebCore::RenderElement::addChild): Deleted.
* rendering/RenderElement.h:
(WebCore::RenderElement::isChildAllowed const):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChild):
(WebCore::RenderTreeBuilder::insertChildToRenderElement):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::insertChildIgnoringContinuation):
* rendering/updating/RenderTreeBuilderInline.cpp:
(WebCore::RenderTreeBuilder::Inline::insertChildIgnoringContinuation):
* rendering/updating/RenderTreeBuilderSVG.cpp:
(WebCore::RenderTreeBuilder::SVG::insertChild):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::insertChild):


  Commit: f316363263555a8929993c7e9ed79b3f4094c308
      https://github.com/WebKit/WebKit/commit/f316363263555a8929993c7e9ed79b3f4094c308
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/webaudio/audiobuffersource-ended-detached-frame-expected.txt
    A LayoutTests/webaudio/audiobuffersource-ended-detached-frame.html
    A LayoutTests/webaudio/resources/audiobuffersource-ended-detached-frame-iframe.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp

  Log Message:
  -----------
  Merge r228574 - Crash under WebCore::EventTarget::fireEventListeners
https://bugs.webkit.org/show_bug.cgi?id=182880
<rdar://problem/20788804>

Reviewed by Youenn Fablet.

Source/WebCore:

Make sure the 'ended' event does not get dispatched on a
AudioScheduledSourceNode after ActiveDOMObjects have been stopped.

Test: webaudio/audiobuffersource-ended-detached-frame.html

* Modules/webaudio/AudioScheduledSourceNode.cpp:
(WebCore::AudioScheduledSourceNode::finish):

LayoutTests:

Add layout test coverage.

* webaudio/audiobuffersource-ended-detached-frame-expected.txt: Added.
* webaudio/audiobuffersource-ended-detached-frame.html: Added.
* webaudio/resources/audiobuffersource-ended-detached-frame-iframe.html: Added.


  Commit: 06e6d5f952421f5af4d07269c244aa08f9a0de1e
      https://github.com/WebKit/WebKit/commit/06e6d5f952421f5af4d07269c244aa08f9a0de1e
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderInline.cpp
    M Source/WebCore/rendering/RenderInline.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp

  Log Message:
  -----------
  Merge r228578 - [RenderTreeBuilder] Move RenderBlock/RenderInline::addChildIgnoringContinuation() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182876
<rdar://problem/37607604>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::addChildIgnoringContinuation): Deleted.
* rendering/RenderBlock.h:
* rendering/RenderElement.cpp:
(WebCore::RenderElement::addChildIgnoringContinuation): Deleted.
* rendering/RenderElement.h:
* rendering/RenderInline.cpp:
(WebCore::RenderInline::addChildIgnoringContinuation): Deleted.
* rendering/RenderInline.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChildIgnoringContinuation):
(WebCore::RenderTreeBuilder::insertChildToRenderBlockIgnoringContinuation): Deleted.
(WebCore::RenderTreeBuilder::insertChildToRenderInlineIgnoringContinuation): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::insertChildToContinuation):
* rendering/updating/RenderTreeBuilderInline.cpp:
(WebCore::RenderTreeBuilder::Inline::insertChildToContinuation):
(WebCore::RenderTreeBuilder::Inline::splitInlines):


  Commit: 2a27af85a46d96ef382d58b1eebe43f8b578a43f
      https://github.com/WebKit/WebKit/commit/2a27af85a46d96ef382d58b1eebe43f8b578a43f
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    A LayoutTests/fast/css/calc-mixed-blend-crash-expected.txt
    A LayoutTests/fast/css/calc-mixed-blend-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/CalculationValue.cpp

  Log Message:
  -----------
  Merge r228585 - Assert in mixed blend animation
https://bugs.webkit.org/show_bug.cgi?id=182887
<rdar://problem/37598140>

Reviewed by Zalan Bujtas.

Test: fast/css/calc-mixed-blend-crash.html

* platform/CalculationValue.cpp:
(WebCore::CalcExpressionBlendLength::CalcExpressionBlendLength):

Fix mismatch between the type test and the value used.


  Commit: d6101cdfe15943471c48e494dc8a0da4e647fa95
      https://github.com/WebKit/WebKit/commit/d6101cdfe15943471c48e494dc8a0da4e647fa95
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderObject.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp

  Log Message:
  -----------
  Merge r228588 - [RenderTreeBuilder] Move RenderElement::insertChildInternal() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182885
<rdar://problem/37617371>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderElement.cpp:
(WebCore::RenderElement::insertChildInternal): Deleted.
* rendering/RenderObject.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChildToRenderElement):


  Commit: b4b35ef32be81576c98544447e280dcf69544c8d
      https://github.com/WebKit/WebKit/commit/b4b35ef32be81576c98544447e280dcf69544c8d
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderBlockFlow.h
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderBoxModelObject.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228593 - [RenderTreeBuilder] Move RenderBoxModelObject::moveChild*() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182896
<rdar://problem/37623051>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderBlock.h:
(WebCore::RenderBlock::moveAllChildrenIncludingFloatsTo): Deleted.
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::styleDidChange):
(WebCore::RenderBlockFlow::moveAllChildrenIncludingFloatsTo): Deleted.
* rendering/RenderBlockFlow.h:
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::moveChildTo): Deleted.
(WebCore::RenderBoxModelObject::moveChildrenTo): Deleted.
(WebCore::RenderBoxModelObject::moveAllChildrenToInternal): Deleted.
* rendering/RenderBoxModelObject.h:
(WebCore::RenderBoxModelObject::moveChildTo): Deleted.
(WebCore::RenderBoxModelObject::moveAllChildrenTo): Deleted.
(WebCore::RenderBoxModelObject::moveChildrenTo): Deleted.
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::moveChildTo):
(WebCore::RenderTreeBuilder::moveAllChildrenTo):
(WebCore::RenderTreeBuilder::moveChildrenTo):
(WebCore::RenderTreeBuilder::moveAllChildrenIncludingFloatsTo):
(WebCore::RenderTreeBuilder::makeChildrenNonInline):
(WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::moveAllChildrenToInternal):
(WebCore::RenderTreeBuilder::Block::removeLeftoverAnonymousBlock):
(WebCore::RenderTreeBuilder::Block::takeChild):
(WebCore::RenderTreeBuilder::Block::dropAnonymousBoxChild):
* rendering/updating/RenderTreeBuilderBlockFlow.cpp:
(WebCore::RenderTreeBuilder::BlockFlow::moveAllChildrenIncludingFloatsTo):
* rendering/updating/RenderTreeBuilderBlockFlow.h:
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::createFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::destroyFragmentedFlow):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::moveInlineChildren):
(WebCore::RenderTreeBuilder::Ruby::moveBlockChildren):
(WebCore::RenderTreeBuilder::Ruby::takeChild):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::collapseAndDestroyAnonymousSiblingRows):


  Commit: 9b7293722ed3703c71e65e0c9cee11665a241927
      https://github.com/WebKit/WebKit/commit/9b7293722ed3703c71e65e0c9cee11665a241927
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r228595 - [RenderTreeBuilder] Cleanup RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182899
<rdar://problem/37627888>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::styleDidChange):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
(WebCore::RenderTreeBuilder::moveChildTo):
(WebCore::RenderTreeBuilder::moveAllChildrenTo):
(WebCore::RenderTreeBuilder::moveChildrenTo):
(WebCore::RenderTreeBuilder::moveAllChildrenIncludingFloatsTo):
(WebCore::RenderTreeBuilder::makeChildrenNonInline):
(WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):
(WebCore::RenderTreeBuilder::takeChildFromRenderMenuList): Deleted.
(WebCore::RenderTreeBuilder::takeChildFromRenderButton): Deleted.
* rendering/updating/RenderTreeBuilder.h:
(WebCore::RenderTreeBuilder::current):
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::dropAnonymousBoxChild):
* rendering/updating/RenderTreeBuilderBlockFlow.cpp:
(WebCore::RenderTreeBuilder::BlockFlow::moveAllChildrenIncludingFloatsTo):
* rendering/updating/RenderTreeBuilderFormControls.cpp:
(WebCore::RenderTreeBuilder::FormControls::takeChild):
* rendering/updating/RenderTreeBuilderFormControls.h:
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::createFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::destroyFragmentedFlow):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::moveInlineChildren):
(WebCore::RenderTreeBuilder::Ruby::moveBlockChildren):
(WebCore::RenderTreeBuilder::Ruby::takeChild):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::collapseAndDestroyAnonymousSiblingRows):


  Commit: 1a53311557032f2565d7928c013182b9635889e8
      https://github.com/WebKit/WebKit/commit/1a53311557032f2565d7928c013182b9635889e8
  Author: Charlie Turner <cturner at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r228603 - [GStreamer] Push smaller buffers from HTTP source
https://bugs.webkit.org/show_bug.cgi?id=182829

Reviewed by Philippe Normand.

Split the received buffer into smaller buffers of a size consistent
with the basesrc (4KiB). It is important not to push large buffers
into the appsrc (where large is relative to the appsrc's configured
byte size). If large buffers are pushed, then when they are internally
dequeued by the appsrc, the buffering percentage can dramatically
plummet due to a large amount of bytes being removed after a push. This
can in turn trick the media player into thinking it needs to buffer,
and then issuing a spurious set of playing->paused then
paused->playing transitions, which by the time the buffering logic
completes, data are already available.

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(CachedResourceStreamingClient::dataReceived):


  Commit: d0adce256fb7caeda4a53c86b3a039c2850353a4
      https://github.com/WebKit/WebKit/commit/d0adce256fb7caeda4a53c86b3a039c2850353a4
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/block/crash-when-subtree-is-still-attached-expected.txt
    A LayoutTests/fast/block/crash-when-subtree-is-still-attached.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderElement.cpp

  Log Message:
  -----------
  Merge r228606 - [RenderTreeBuilder] REGRESSION(r228238) Detach renderer before destroying its subtree.
https://bugs.webkit.org/show_bug.cgi?id=182908
<rdar://problem/37619394>

Reviewed by Antti Koivisto.

Source/WebCore:

Prior to r228238 we first detached the to-be-destroyed renderer and then
started nuking its descendants. r228238 changed the order and now the descendants are
destroyed while they are still attached to the tree. Apparently some of the takeChild()
normalization logic gets triggered now that the renderers still have access to their previous/next
siblings. This is unexpected and it shouldn't matter whether the subtree is still attached.
Let's revert it to the original order for now (see webkit.org/b/182909).

Test: fast/block/crash-when-subtree-is-still-attached.html

* rendering/RenderElement.cpp:
(WebCore::RenderElement::removeAndDestroyChild):

LayoutTests:

* fast/block/crash-when-subtree-is-still-attached-expected.txt: Added.
* fast/block/crash-when-subtree-is-still-attached.html: Added.


  Commit: bbfa818b0a8e16c757131353a490366fd3ba44a3
      https://github.com/WebKit/WebKit/commit/bbfa818b0a8e16c757131353a490366fd3ba44a3
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M ChangeLog
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/cmake/WebKitFeatures.cmake

  Log Message:
  -----------
  Merge r228608 - [GTK][WPE] Fullscreen video is broken


  Commit: a5a8a6a9d1d1593eb4d1375476644ebecc0bf7d0
      https://github.com/WebKit/WebKit/commit/a5a8a6a9d1d1593eb4d1375476644ebecc0bf7d0
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M LayoutTests/platform/ios-wk2/TestExpectations
    M LayoutTests/platform/mac/TestExpectations
    M LayoutTests/platform/wpe/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp

  Log Message:
  -----------
  Merge r228609 - REGRESSION(r219298): RELEASE_ASSERT(!m_owningPointerForClose) fails in WebCore::IDBServer::UniqueIDBDatabase::scheduleShutdownForClose
https://bugs.webkit.org/show_bug.cgi?id=174354
<rdar://problem/33294987>

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-19
Reviewed by Michael Catanzaro.

Source/WebCore:

UniqueIDBDatabase::invokeOperationAndTransactionTimer was called
even after m_owningPointerForClose was set in
UniqueIDBDatabase::didDeleteBackingStore.

No new tests (Covered by existing tests).

* Modules/indexeddb/server/UniqueIDBDatabase.cpp:
(WebCore::IDBServer::UniqueIDBDatabase::didDeleteBackingStore):
Do not start deleting the UniqueIDBDatabase. Just call invokeOperationAndTransactionTimer.
(WebCore::IDBServer::UniqueIDBDatabase::invokeOperationAndTransactionTimer):
Assert m_owningPointerForClose is null.

LayoutTests:

* platform/gtk/TestExpectations:
Unmarked imported/w3c/IndexedDB-private-browsing/idbfactory_open.html.
* platform/ios-wk2/TestExpectations:
Unmarked imported/w3c/IndexedDB-private-browsing/idbfactory_open12.html.
* platform/mac/TestExpectations: Ditto.
* platform/wpe/TestExpectations: Unmarked
imported/w3c/IndexedDB-private-browsing/idbfactory_open.html and
imported/w3c/IndexedDB-private-browsing/idbfactory_open12.html.


  Commit: 9abad322374f19506a4c9b9c9d0d0707668f6e61
      https://github.com/WebKit/WebKit/commit/9abad322374f19506a4c9b9c9d0d0707668f6e61
  Author: Xabier Rodriguez-Calvar <calvaris at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerRequestInstallMissingPluginsCallback.h

  Log Message:
  -----------
  Merge r228639 - [GStreamer] Crash in WebCore::MediaPlayerRequestInstallMissingPluginsCallback::complete
https://bugs.webkit.org/show_bug.cgi?id=166733

Reviewed by Philippe Normand.

There are a couple of issues to tackle here.

First is handling getting more than one missing plugin
installation request at the same time. For this we add the request
to a Vector and handle them there.

Second is that if the player is dead and we still get the result,
bad things happen. For that we "weaked" the pointer capture by the
lambda.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer):
Handle Vector of callbacks.
(WebCore::MediaPlayerPrivateGStreamer::handleMessage): Weak
private player pointer and put the callback in the Vector.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
Callback becomes Vector.
* platform/graphics/gstreamer/MediaPlayerRequestInstallMissingPluginsCallback.h:
(WebCore::MediaPlayerRequestInstallMissingPluginsCallback::create):
(WebCore::MediaPlayerRequestInstallMissingPluginsCallback::complete):
(WebCore::MediaPlayerRequestInstallMissingPluginsCallback::MediaPlayerRequestInstallMissingPluginsCallback):
Callback function is refactored into a "using" type and added self
as parameter to the function.


  Commit: 7b82a59180511797fce27d764193532fe36edefc
      https://github.com/WebKit/WebKit/commit/7b82a59180511797fce27d764193532fe36edefc
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h

  Log Message:
  -----------
  Merge r228641 - [GTK][GStreamer] Replaying a webm video twice causes the video to stop getting rendered
https://bugs.webkit.org/show_bug.cgi?id=176789

Reviewed by Xabier Rodriguez-Calvar.

Ensure the wrapped GstGLContext is set when the pipeline goes from
READY to PAUSED state. This is a workaround for
https://bugzilla.gnome.org/show_bug.cgi?id=757933.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer): Add debug statement.
(WebCore::MediaPlayerPrivateGStreamer::readyTimerFired): Ditto.
(WebCore::MediaPlayerPrivateGStreamer::changePipelineState):
Ensure the wrapped GstGLContext is set when the pipeline goes from
READY to PAUSED state.
(WebCore::MediaPlayerPrivateGStreamer::didEnd): Add debug statement.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
Change the requestGLContext to be a method instead of a static
function. Being a static function was a requirement for the now-removed OpenWebRTC player.
(WebCore::MediaPlayerPrivateGStreamerBase::handleSyncMessage): Add
debug statement, fix requestGLContext usage.
(WebCore::MediaPlayerPrivateGStreamerBase::requestGLContext): Refactor as method.
(WebCore::MediaPlayerPrivateGStreamerBase::flushCurrentBuffer): Fix requestGLContext usage.
(WebCore::MediaPlayerPrivateGStreamerBase::createVideoSinkGL): Remove fixed FIXME.
(WebCore::MediaPlayerPrivateGStreamerBase::ensureGLVideoSinkContext):
Set display and app wrapped contexts on the video sink.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:


  Commit: 4274afd2a751ae1447ae7a8228a41e5af0bba944
      https://github.com/WebKit/WebKit/commit/4274afd2a751ae1447ae7a8228a41e5af0bba944
  Author: Manuel Rego Casasnovas <rego at igalia.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-022-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-022.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-023-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-023.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-024-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-024.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-025-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-025.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/w3c-import.log
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/GridTrackSizingAlgorithm.cpp

  Log Message:
  -----------
  Merge r228661 - [css-grid] Apply automatic minimum size clamping to spanning items too
https://bugs.webkit.org/show_bug.cgi?id=182684

Reviewed by Javier Fernandez.

LayoutTests/imported/w3c:

Update WPT tests related to this change.

* web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-022-expected.txt:
* web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-022.html:
* web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-023-expected.txt:
* web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-023.html:
* web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-024-expected.txt: Added.
* web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-024.html: Added.
* web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-025-expected.txt: Added.
* web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-025.html: Added.
* web-platform-tests/css/css-grid/grid-items/w3c-import.log:

Source/WebCore:

In r225776 we added the conditions from the spec to apply
the automatic minimum size clamping when required
but only to non-spanning items.
See: https://drafts.csswg.org/css-grid/#min-size-auto

This patch moves the code from GridTrackSizingAlgorithm::sizeTrackToFitNonSpanningItem()
to GridTrackSizingAlgorithmStrategy::minSizeForChild()
that way the clamping is applied for both spanning and non-spanning items.

This somehow reverts r225776, as it was adding some duplicated code.
All the checks to know if we should use that part of the spec
were already present in GridTrackSizingAlgorithmStrategy::minSizeForChild().

Apart from using the previous code, there's a new loop to verify
that the max track sizing function is fixed for all the tracks of the item.

Tests: imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-024.html
       imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-minimum-size-grid-items-025.html

* rendering/GridTrackSizingAlgorithm.cpp:
(WebCore::GridTrackSizingAlgorithm::sizeTrackToFitNonSpanningItem):
(WebCore::GridTrackSizingAlgorithmStrategy::minSizeForChild const):


  Commit: 5d9e3399b06f09fa7907dadfb18730ff59a9e290
      https://github.com/WebKit/WebKit/commit/5d9e3399b06f09fa7907dadfb18730ff59a9e290
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderView.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp

  Log Message:
  -----------
  Merge r228683 - [RenderTreeBuilder] Move RenderElement::removeAndDestroyChild() to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182915
<rdar://problem/37658123>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderElement.cpp:
(WebCore::RenderElement::removeAndDestroyChild): Deleted.
* rendering/RenderElement.h:
(WebCore::RenderElement::isChildAllowed const):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::removeFromParentAndDestroy):
* rendering/RenderView.cpp:
(WebCore::RenderView::willBeDestroyed):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::removeAndDestroyChild):
(WebCore::RenderTreeBuilder::removeFromParentAndDestroyCleaningUpAnonymousWrappers):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::updateStyle):
(WebCore::RenderTreeBuilder::FirstLetter::createRenderers):


  Commit: d3a7b521db8bc684156ca8da2fcff3a96f38318f
      https://github.com/WebKit/WebKit/commit/d3a7b521db8bc684156ca8da2fcff3a96f38318f
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGGraph.cpp

  Log Message:
  -----------
  Merge r228693 - GetArrayMask should support constant folding
https://bugs.webkit.org/show_bug.cgi?id=182907

Reviewed by Saam Barati.

Implement constant folding for GetArrayMask. This revealed a bug in tryGetFoldableView, where it was
ignoring the result of a jsDynamicCast<>(). This wasn't a bug before because it would have been
impossible for that function to get called with a non-null value if the value was not an array view,
due to type filtering in CheckArray, the fact that CheckArray had to dominate GetArrayLength, and
the fact that the other tryGetFoldableView overload made sure that the array mode was some typed
array.

This isn't a measurable progression, but it does save a register in the codegen for typed array
accesses. Hopefully these improvements add up.

* assembler/AssemblerBuffer.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::tryGetFoldableView):


  Commit: 51676dda22153f97ad7a2f11e2e376192005accb
      https://github.com/WebKit/WebKit/commit/51676dda22153f97ad7a2f11e2e376192005accb
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderButton.cpp
    M Source/WebCore/rendering/RenderFullScreen.cpp
    M Source/WebCore/rendering/RenderListItem.cpp
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderObject.h
    M Source/WebCore/rendering/RenderTextFragment.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp

  Log Message:
  -----------
  Merge r228701 - [RenderTreeBuilder] Remove redundant RenderObject::removeFromParentAndDestroy
https://bugs.webkit.org/show_bug.cgi?id=182926
<rdar://problem/37674997>

Reviewed by Antti Koivisto.

Call RenderTreeBuilder::removeAndDestroyChild() directly instead.

No change in functionality.

* dom/Document.cpp:
(WebCore::Document::setFullScreenRenderer):
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::removeAndDestroyAllContinuations):
* rendering/RenderButton.cpp:
(WebCore::RenderButton::setText):
* rendering/RenderFullScreen.cpp:
(WebCore::RenderFullScreen::willBeDestroyed):
(WebCore::RenderFullScreen::unwrapRenderer):
* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::willBeDestroyed):
* rendering/RenderObject.cpp:
(WebCore::RenderObject::removeFromParentAndDestroy): Deleted.
* rendering/RenderObject.h:
* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::willBeDestroyed):
(WebCore::RenderTextFragment::setText):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::removeFromParentAndDestroyCleaningUpAnonymousWrappers):
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::takeChild):
* rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::RenderTreeBuilder::List::updateItemMarker):
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::destroyFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::handleSpannerRemoval):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::moveBlockChildren):
(WebCore::RenderTreeBuilder::Ruby::takeChild):


  Commit: 04b459e4c1ed0470b69656b8fcc530b2c1558992
      https://github.com/WebKit/WebKit/commit/04b459e4c1ed0470b69656b8fcc530b2c1558992
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderButton.cpp
    M Source/WebCore/rendering/RenderFullScreen.cpp
    M Source/WebCore/rendering/RenderListItem.cpp
    M Source/WebCore/rendering/RenderTextFragment.cpp
    M Source/WebCore/rendering/RenderView.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp

  Log Message:
  -----------
  Merge r228704 - [RenderTreeBuilder] Rename RenderTreeBuilder::removeAndDestroyChild() -> removeAndDestroy()
https://bugs.webkit.org/show_bug.cgi?id=182934
<rdar://problem/37678241>

Reviewed by Antti Koivisto.

No change in functionality.

* dom/Document.cpp:
(WebCore::Document::setFullScreenRenderer):
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::removeAndDestroyAllContinuations):
* rendering/RenderButton.cpp:
(WebCore::RenderButton::setText):
* rendering/RenderFullScreen.cpp:
(WebCore::RenderFullScreen::willBeDestroyed):
(WebCore::RenderFullScreen::unwrapRenderer):
* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::willBeDestroyed):
* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::willBeDestroyed):
(WebCore::RenderTextFragment::setText):
* rendering/RenderView.cpp:
(WebCore::RenderView::willBeDestroyed):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::removeAndDestroy):
(WebCore::RenderTreeBuilder::removeFromParentAndDestroyCleaningUpAnonymousWrappers):
(WebCore::RenderTreeBuilder::removeAndDestroyChild): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::takeChild):
* rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::updateStyle):
(WebCore::RenderTreeBuilder::FirstLetter::createRenderers):
* rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::RenderTreeBuilder::List::updateItemMarker):
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::destroyFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::handleSpannerRemoval):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::moveBlockChildren):
(WebCore::RenderTreeBuilder::Ruby::takeChild):


  Commit: efa06d8f2d213f2f6dbf84219e24ee806d41787c
      https://github.com/WebKit/WebKit/commit/efa06d8f2d213f2f6dbf84219e24ee806d41787c
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r228713 - Null pointer dereference in WebPageProxy::urlSchemeHandlerForScheme()
https://bugs.webkit.org/show_bug.cgi?id=182905
<rdar://problem/37676775>

Reviewed by Alex Christensen.

Return nullptr when querying for the scheme handler of the null string.

Before a navigation is performed WebKit checks if the destination URL is associated with an app
unless the embedding client overrides the WKNavigationDelegate delegate callback -webView:decidePolicyForNavigationAction:decisionHandler.
If the URL is not associated with an app then WebKit may fall back to checking if the embedding
client registered a scheme handler for it. Currently we assume that the scheme is a non-null
string when checking the scheme handler registry. However the scheme can be a null string if
it is part of a malformed URL. And this leads to bad news bears when we try to use it to look
for a scheme handler. Instead check that the scheme is a non-null string before checking to see
if it is in the scheme handler registry.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::urlSchemeHandlerForScheme):


  Commit: 4d3324abd1da78035c94eaeeab1e03753c7f752a
      https://github.com/WebKit/WebKit/commit/4d3324abd1da78035c94eaeeab1e03753c7f752a
  Author: Tim Horton <thorton at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/dom/elementFromPoint-scaled-scrolled-expected.txt
    A LayoutTests/fast/dom/elementFromPoint-scaled-scrolled-layout-viewport-expected.txt
    A LayoutTests/fast/dom/elementFromPoint-scaled-scrolled-layout-viewport.html
    M LayoutTests/fast/dom/elementFromPoint-scaled-scrolled.html
    M LayoutTests/platform/ios-wk2/fast/dom/elementFromPoint-relative-to-viewport-expected.txt
    M LayoutTests/platform/ios/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/TreeScope.cpp
    M Source/WebCore/page/Settings.yaml
    M Source/WebCore/rendering/RenderLayer.cpp

  Log Message:
  -----------
  Merge r228714 - REGRESSION (r219342): Touch event coordinates and elementFromPoint coordinates differ
https://bugs.webkit.org/show_bug.cgi?id=182910
<rdar://problem/37533950>

Reviewed by Simon Fraser.

Source/WebCore:

We reverted other changes to the definition of client coordinates
in r219829 due to compatibility concerns. However, we failed to revert
r219342 on trunk, leaving elementFromPoint() using coordinates relative
to the layout viewport.

Add a currently off-by-default setting to switch on layout-viewport-relative
client coordinates and guard the elementFromPoint changes behind it.
A future patch should roll r219829 back in also behind this setting, so
that everything remains consistent regardless of which coordinate space we choose.

* dom/TreeScope.cpp:
(WebCore::absolutePointIfNotClipped):
* page/Settings.yaml:
* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::hitTest):

LayoutTests:

* fast/dom/elementFromPoint-scaled-scrolled.html:
Revert changes to this test made in r219342.

* fast/dom/elementFromPoint-scaled-scrolled-layout-viewport.html:
* fast/dom/elementFromPoint-scaled-scrolled-layout-viewport-expected.txt:
Add a test that is equivalent to elementFromPoint-scaled-scrolled.html after r219342,
which turns on the new setting. This test is disabled on iOS (like it was
in r219342) because it needs window.scrollTo.

* platform/ios-wk2/fast/dom/elementFromPoint-relative-to-viewport-expected.txt:
This now passes.

* platform/ios/TestExpectations:
Re-mark-failing a test that was un-marked-failing by r219342.


  Commit: 3148dc6cc71e7a5afb0c5738e6d46815bf1bf33c
      https://github.com/WebKit/WebKit/commit/3148dc6cc71e7a5afb0c5738e6d46815bf1bf33c
  Author: Dean Jackson <dino at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/text/font-bad-unitsperem-expected.txt
    A LayoutTests/svg/text/font-bad-unitsperem.html
    A LayoutTests/svg/text/resources/font-bad-unitsperem.svg
    M Source/WebCore/ChangeLog
    M Source/WebCore/svg/SVGFontFaceElement.cpp

  Log Message:
  -----------
  Merge r228715 - SIGFPE @ int WebCore::SVGToOTFFontConverter::scaleUnitsPerEm<int> const + 45
https://bugs.webkit.org/show_bug.cgi?id=182944
<rdar://problem/35369984>

Reviewed by Myles Maxfield.

Source/WebCore:

Avoid a divide-by-zero.

Test: svg/text/font-bad-unitsperem.html

* svg/SVGFontFaceElement.cpp:
(WebCore::SVGFontFaceElement::unitsPerEm const):

LayoutTests:

Add a test with a 0 unitsperem SVG font.

* svg/text/font-bad-unitsperem-expected.txt: Added.
* svg/text/font-bad-unitsperem.html: Added.
* svg/text/resources/font-bad-unitsperem.svg: Added.


  Commit: e6c35305124d3efaae89c5e3cb7b24a17752224b
      https://github.com/WebKit/WebKit/commit/e6c35305124d3efaae89c5e3cb7b24a17752224b
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-20 (Tue, 20 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/MIMETypeRegistry.cpp

  Log Message:
  -----------
  Merge r228716 - Crash under MIMETypeRegistry::isSupportedJavaScriptMIMEType()
https://bugs.webkit.org/show_bug.cgi?id=182927
<rdar://problem/37675748>

Reviewed by Antti Koivisto.

Make it safe to call MIMETypeRegistry::isSupportedJavaScriptMIMEType() from the non-main thread.
It is currently being called from a background thread in the following places:
- ServiceWorkerJob::didReceiveResponse()
- WorkerGlobalScope::importScripts()

These call sites on non-main threads were added recently with the support for service workers.

No new tests, already covered by existing tests that flakily experience service worker
process crashes.

* platform/MIMETypeRegistry.cpp:
(WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):


  Commit: 7fd0302795d6bc60570d69022f29c65b7912e0bf
      https://github.com/WebKit/WebKit/commit/7fd0302795d6bc60570d69022f29c65b7912e0bf
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-02-21 (Wed, 21 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M LayoutTests/platform/gtk/js/dom/dom-static-property-for-in-iteration-expected.txt

  Log Message:
  -----------
  Unreviewed GTK gardening.

* platform/gtk/TestExpectations:
* platform/gtk/js/dom/dom-static-property-for-in-iteration-expected.txt:


  Commit: 9928351e5b5dd6320ce809084544985d030a8925
      https://github.com/WebKit/WebKit/commit/9928351e5b5dd6320ce809084544985d030a8925
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-02-21 (Wed, 21 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/webkitglib-symbols.map

  Log Message:
  -----------
  Unreviewed. Fix distcheck.

Remove symbols found in version script but not in library.

* webkitglib-symbols.map:


  Commit: 9c040900d9e6af881a22ec0dd314564b81ed2e21
      https://github.com/WebKit/WebKit/commit/9c040900d9e6af881a22ec0dd314564b81ed2e21
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-02-21 (Wed, 21 Feb 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.19.91 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.19.91.


  Commit: 9d0037074361060adead79640eaef2d5f8a482c3
      https://github.com/WebKit/WebKit/commit/9d0037074361060adead79640eaef2d5f8a482c3
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGArrayMode.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
    M Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
    M Source/JavaScriptCore/runtime/CommonSlowPaths.h

  Log Message:
  -----------
  Merge r228720 - Don't mark an array profile out of bounds for the cases where the DFG will convert the access to SaneChain
https://bugs.webkit.org/show_bug.cgi?id=182912
<rdar://problem/37685083>

Reviewed by Keith Miller.

In the baseline JIT and LLInt, when we loading a hole from an original array,
with the array prototype chain being normal, we end up marking the ArrayProfile
for that GetByVal as out of bounds. However, the DFG knows exactly how to
optimize this case by returning undefined when loading from a hole. Currently,
it only does this for Contiguous arrays (and sometimes Double arrays).
This patch just makes sure to not mark the ArrayProfile as out of bounds
in this scenario for Contiguous arrays, since the DFG will always optimize
this case.

However, we should extend this by profiling when a GetByVal loads a hole. By
doing so, we can optimize this for Int32, ArrayStorage, and maybe even Double
arrays. That work will happen in:
https://bugs.webkit.org/show_bug.cgi?id=182940

This patch is a 30-50%  speedup on JetStream's hash-map test. This patch
speeds up JetStream by 1% when testing on my iMac.

* dfg/DFGArrayMode.cpp:
(JSC::DFG::ArrayMode::refine const):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* jit/JITOperations.cpp:
(JSC::getByVal):
(JSC::canAccessArgumentIndexQuickly): Deleted.
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::getByVal):
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::canAccessArgumentIndexQuickly):


  Commit: d37752f948b6797a458eb80e33058162d16e1b74
      https://github.com/WebKit/WebKit/commit/d37752f948b6797a458eb80e33058162d16e1b74
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/ReplaceSelectionCommand.cpp
    M Source/WebCore/editing/ReplaceSelectionCommand.h

  Log Message:
  -----------
  Merge r228724 - null m_lastNodeInserted dereference at ReplaceSelectionCommand::InsertedNodes::lastLeafInserted
https://bugs.webkit.org/show_bug.cgi?id=161947

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-19
Reviewed by Ryosuke Niwa.

Source/WebCore:

InsertedNodes happened to be empty if the inserted nodes were
removed. Add more checks if InsertedNodes is empty.

No new tests (Covered by existing tests).

* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::doApply): Return early if InsertedNodes becomes empty.
* editing/ReplaceSelectionCommand.h:
(WebCore::ReplaceSelectionCommand::InsertedNodes::isEmpty): New method.
(WebCore::ReplaceSelectionCommand::InsertedNodes::lastLeafInserted const):
Assert m_lastNodeInserted is not null.
(WebCore::ReplaceSelectionCommand::InsertedNodes::pastLastLeaf const): Ditto.

LayoutTests:

* platform/gtk/TestExpectations:
Unmarked editing/execCommand/crash-replacing-list-by-list.html and editing/inserting/insert-table-in-paragraph-crash.html.


  Commit: 9fa88d4aacec5616ec98e5ec0e018c3609d82471
      https://github.com/WebKit/WebKit/commit/9fa88d4aacec5616ec98e5ec0e018c3609d82471
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/get-prototype-create-this-effectful.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
    M Source/JavaScriptCore/dfg/DFGOperations.cpp
    M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
    M Source/JavaScriptCore/runtime/JSFunction.cpp
    M Source/JavaScriptCore/runtime/JSFunction.h
    M Source/JavaScriptCore/runtime/JSFunctionInlines.h

  Log Message:
  -----------
  Merge r228725 - Don't use JSFunction's allocation profile when getting the prototype can be effectful
https://bugs.webkit.org/show_bug.cgi?id=182942
<rdar://problem/37584764>

Reviewed by Mark Lam.

JSTests:

* stress/get-prototype-create-this-effectful.js: Added.

Source/JavaScriptCore:

Prior to this patch, the create_this implementation assumed that anything
that is a JSFunction can use the object allocation profile and go down the
fast path to allocate the |this| object. Implied by this approach is that
accessing the 'prototype' property of the incoming function is not an
effectful operation. This is inherent to the ObjectAllocationProfile
data structure: it caches the prototype field. However, getting the
'prototype' property might be an effectful operation, e.g, it could
be a getter. Many variants of functions in JS have the 'prototype' property
as non-configurable. However, some functions, like bound functions, do not
have the 'prototype' field with these attributes.

This patch adds the notion of 'canUseAllocationProfile' to JSFunction
and threads it through so that we only go down the fast path and use
the allocation profile when the prototype property is non-configurable.

* bytecompiler/NodesCodegen.cpp:
(JSC::ClassExprNode::emitBytecode):
* dfg/DFGOperations.cpp:
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):
* runtime/JSFunction.cpp:
(JSC::JSFunction::prototypeForConstruction):
(JSC::JSFunction::allocateAndInitializeRareData):
(JSC::JSFunction::initializeRareData):
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::canUseAllocationProfileNonInline):
* runtime/JSFunction.h:
(JSC::JSFunction::ensureRareDataAndAllocationProfile):
* runtime/JSFunctionInlines.h:
(JSC::JSFunction::canUseAllocationProfile):


  Commit: 08abb104e10172566ffee992cb38df61e97a8394
      https://github.com/WebKit/WebKit/commit/08abb104e10172566ffee992cb38df61e97a8394
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/arrayify-array-storage-array.js
    A JSTests/stress/arrayify-array-storage-non-array.js
    A JSTests/stress/arrayify-array-storage.js
    A JSTests/stress/arrayify-slow-put-array-storage-pass-array-storage.js
    A JSTests/stress/arrayify-slow-put-array-storage.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r228726 - [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
https://bugs.webkit.org/show_bug.cgi?id=182731

Reviewed by Saam Barati.

JSTests:

* stress/arrayify-array-storage-array.js: Added.
(shouldBe):
(testArrayStorage):
* stress/arrayify-array-storage-non-array.js: Added.
(shouldBe):
(testArrayStorage):
* stress/arrayify-array-storage.js: Added.
(shouldBe):
(testArrayStorage):
* stress/arrayify-slow-put-array-storage-pass-array-storage.js: Added.
(shouldBe):
(testArrayStorage):
* stress/arrayify-slow-put-array-storage.js: Added.
(shouldBe):
(testArrayStorage):

Source/JavaScriptCore:

This patch adds support for Arrayify(ArrayStorage/SlowPutArrayStorage) to FTL.
Due to ArrayifyToStructure and CheckArray changes, necessary changes for
supporting Arrayify in FTL are already done. Just allowing it in FTLCapabilities.cpp
is enough.

We fix FTL's CheckArray logic. Previously, CheckArray(SlowPutArrayStorage) does not pass
ArrayStorage in FTL. But now it passes this as DFG does. Moreover, we fix DFG's CheckArray
where CheckArray(ArrayStorage+NonArray) can pass ArrayStorage+Array.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::silentFill):
(JSC::DFG::SpeculativeJIT::jumpSlowForUnwantedArrayMode):
* dfg/DFGSpeculativeJIT.h:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::isArrayTypeForArrayify):


  Commit: 6d62173c487e959c687421984248fab6998c1696
      https://github.com/WebKit/WebKit/commit/6d62173c487e959c687421984248fab6998c1696
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/array-pop-array-storage.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r228727 - [FTL] Support ArrayPop for ArrayStorage
https://bugs.webkit.org/show_bug.cgi?id=182783

Reviewed by Saam Barati.

JSTests:

* stress/array-pop-array-storage.js: Added.
(shouldBe):
(test):

Source/JavaScriptCore:

This patch adds ArrayPop(ArrayStorage) support to FTL. We port the implementation in DFG to FTL.

* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPop):


  Commit: 2084e19e3f1cc801008cf80f0b087ab97d5e8af4
      https://github.com/WebKit/WebKit/commit/2084e19e3f1cc801008cf80f0b087ab97d5e8af4
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/array-push-array-storage-beyond-int32.js
    A JSTests/stress/array-push-array-storage.js
    A JSTests/stress/array-push-multiple-array-storage-beyond-int32.js
    A JSTests/stress/array-push-multiple-storage-continuous.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r228728 - [FTL] Support ArrayPush for ArrayStorage
https://bugs.webkit.org/show_bug.cgi?id=182782

Reviewed by Saam Barati.

JSTests:

Existing array-push-multiple-storage.js covers ArrayPush(ArrayStorage) multiple arguments case.

* stress/array-push-array-storage-beyond-int32.js: Added.
(shouldBe):
(test):
* stress/array-push-array-storage.js: Added.
(shouldBe):
(test):
* stress/array-push-multiple-array-storage-beyond-int32.js: Added.
(shouldBe):
(test):
* stress/array-push-multiple-storage-continuous.js: Added.
(shouldBe):
(test):

Source/JavaScriptCore:

This patch adds support for ArrayPush(ArrayStorage). We just port ArrayPush(ArrayStorage) in DFG to FTL.

* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileArrayPush):


  Commit: b5261c156e8a03ab2732f44c20cc564537602e4d
      https://github.com/WebKit/WebKit/commit/b5261c156e8a03ab2732f44c20cc564537602e4d
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/SelectorFilter.cpp
    M Source/WebCore/css/SelectorFilter.h
    M Source/WebCore/style/StyleInvalidator.cpp

  Log Message:
  -----------
  Merge r228729 - Use selector filter when invalidating descendants
https://bugs.webkit.org/show_bug.cgi?id=182839
<rdar://problem/37581072>

Reviewed by Zalan Bujtas.

We can make descendant invalidation faster by enabling filtering.

* css/SelectorFilter.cpp:
(WebCore::SelectorFilter::initializeParentStack):

    Traverse and reverse the ancestor chain, and push it.

(WebCore::SelectorFilter::pushParent):
(WebCore::SelectorFilter::pushParentInitializingIfNeeded):

    Add a version of pushParent that can initialize the stack.

(WebCore::SelectorFilter::popParent):
(WebCore::SelectorFilter::popParentsUntil):

    Pop until a given parent element.

(WebCore::SelectorFilter::pushParentStackFrame): Deleted.
(WebCore::SelectorFilter::popParentStackFrame): Deleted.

    These were the same as push/popParent.

* css/SelectorFilter.h:
(WebCore::SelectorFilter::popParent): Deleted.
* style/StyleInvalidator.cpp:
(WebCore::Style::Invalidator::invalidateStyleForDescendants):

    Use pushParentInitializingIfNeeded.

(WebCore::Style::Invalidator::invalidateStyleWithMatchElement):

    Use selector filter when doing descendant tree invalidation.
    Make sure to pop it until the parent when reusing.


  Commit: e1d896b407175daa4b472590e55740fef0de77e2
      https://github.com/WebKit/WebKit/commit/e1d896b407175daa4b472590e55740fef0de77e2
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/Scripts/webkitpy/port/gtk.py
    M Tools/WebKitTestRunner/TestController.cpp

  Log Message:
  -----------
  Merge r228731 - [WTR][GTK] crash log backtrace doesn't show symbol names for DatabaseProcess and NetworkProcess
https://bugs.webkit.org/show_bug.cgi?id=182953

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-19
Reviewed by Carlos Garcia Campos.

* Scripts/webkitpy/port/gtk.py:
(GtkPort._get_crash_log): Removed the code to convert WebProcess name.
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::webProcessName): Return the correct program name for GTK+ port.
(WTR::TestController::networkProcessName): Ditto.
(WTR::TestController::databaseProcessName): Ditto.


  Commit: 4e50eb01deed99409e2626f535f976378fea9fc4
      https://github.com/WebKit/WebKit/commit/4e50eb01deed99409e2626f535f976378fea9fc4
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp

  Log Message:
  -----------
  Merge r228796 - [GTK] whatsapp web blurry in some parts, sharp on others
https://bugs.webkit.org/show_bug.cgi?id=182673

Reviewed by Carlos Garcia Campos.

CoordinatedGraphicsLayer::createBackingStore() uses the scale factor returned by effectiveContentsScale(),
which is always 1 if selfOrAncestorHaveNonAffineTransforms() returns true. But this fuction always returns
true if the layer has an AnimatedPropertyTransform animation, which means that layers with those animations
won't use the appropriate scale factor, causing blurry renderings.

This patch removes the animations check, so animated layers properly use the required scale factor.

No new tests, no behavior change.

* platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
(WebCore::CoordinatedGraphicsLayer::selfOrAncestorHaveNonAffineTransforms):


  Commit: 62e1c5be61d20e93e70869173b5a6274437ed1ba
      https://github.com/WebKit/WebKit/commit/62e1c5be61d20e93e70869173b5a6274437ed1ba
  Author: Dean Jackson <dino at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/writing-mode/svg-writing-modes-expected.html
    A LayoutTests/fast/writing-mode/svg-writing-modes.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSPrimitiveValueMappings.h

  Log Message:
  -----------
  Merge r228822 - Handle all writing-modes in downcast
https://bugs.webkit.org/show_bug.cgi?id=182949
<rdar://problem/37710687>

Reviewed by Myles Maxfield.

Source/WebCore:

It appears we forgot to handle the deprecated "lr"
writing-mode value.

Test: fast/writing-mode/svg-writing-modes.html

* css/CSSPrimitiveValueMappings.h:
(WebCore::CSSPrimitiveValue::operator WritingMode const):

LayoutTests:

Test all the deprecated SVG writing modes.

* fast/writing-mode/svg-writing-modes-expected.html: Added.
* fast/writing-mode/svg-writing-modes.html: Added.


  Commit: 2d6034e0ab2e61f4d173d5c17c37ea4546300250
      https://github.com/WebKit/WebKit/commit/2d6034e0ab2e61f4d173d5c17c37ea4546300250
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/FindEnchant.cmake

  Log Message:
  -----------
  Merge r228826 - [GTK][CMake] Support building with Enchant 2.x
https://bugs.webkit.org/show_bug.cgi?id=182933

Reviewed by Michael Catanzaro.

* Source/cmake/FindEnchant.cmake: Check for both the "enchant" and "enchant-2"
pkg-config components, picking the first available for which the headers and
library are usable.


  Commit: c0b9b46552f2cfee91e0fcb9694866ce1a87325e
      https://github.com/WebKit/WebKit/commit/c0b9b46552f2cfee91e0fcb9694866ce1a87325e
  Author: John Wilander <wilander at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/wk2/TestExpectations
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.cpp
    M Source/WebKit/UIProcess/WebResourceLoadStatisticsStore.h

  Log Message:
  -----------
  Merge r228828 - Make WebResourceLoadStatisticsStore::processStatisticsAndDataRecords() call WebProcessProxy::notifyPageStatisticsAndDataRecordsProcessed() in a proper callback
https://bugs.webkit.org/show_bug.cgi?id=182719
<rdar://problem/37517370>

Reviewed by Brent Fulgham.

Source/WebKit:

This will allow the page notification, statistics pruning, and persistence write
to be done at the right time and hopefully stabilize the layout tests including:
http/tests/resourceLoadStatistics/partitioned-and-unpartitioned-cookie-deletion.html

* UIProcess/WebResourceLoadStatisticsStore.cpp:
(WebKit::WebResourceLoadStatisticsStore::removeDataRecords):
    Now takes a callback parameter.
(WebKit::WebResourceLoadStatisticsStore::processStatisticsAndDataRecords):
* UIProcess/WebResourceLoadStatisticsStore.h:
    Now calls WebProcessProxy::notifyPageStatisticsAndDataRecordsProcessed()
    in a callback provided to WebResourceLoadStatisticsStore::removeDataRecords().

LayoutTests:

* platform/mac-wk2/TestExpectations:
    Marked http/tests/resourceLoadStatistics/partitioned-and-unpartitioned-cookie-deletion.html
    as [ Pass ].
* platform/wk2/TestExpectations:
    Marked http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store.html
    as [ Pass ]. This should have been done already in r227223:
    https://bugs.webkit.org/show_bug.cgi?id=181822


  Commit: c6f9dde66cf11ab1244fec0dc147d457be8b4454
      https://github.com/WebKit/WebKit/commit/c6f9dde66cf11ab1244fec0dc147d457be8b4454
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/js/dom/webidl-type-mapping-expected.txt
    M LayoutTests/js/dom/webidl-type-mapping.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/JSDOMConvertNumbers.h
    M Source/WebCore/testing/TypeConversions.h
    M Source/WebCore/testing/TypeConversions.idl

  Log Message:
  -----------
  Merge r228851 - Crash under JSC::JSCell::toNumber(JSC::ExecState*)
https://bugs.webkit.org/show_bug.cgi?id=182984
<rdar://problem/37694346>

Reviewed by Mark Lam.

Source/WebCore:

The issue was caused by DOMMatrix attributes potentially returning "impure"
NaN values. We would call JSC::jsNumber(double) to construct the JSValue
but this is only safe for pure NaN values. Make sure we purify the double
returned by the implementation for IDL attributes of type 'unrestricted double'
before calling JSC::jsNumber(double).

No new tests, extended existing test.

* bindings/js/JSDOMConvertNumbers.h:
(WebCore::JSConverter<IDLUnrestrictedDouble>::convert):
* testing/TypeConversions.h:
(WebCore::TypeConversions::testImpureNaNUnrestrictedDouble const):
(WebCore::TypeConversions::testImpureNaN2UnrestrictedDouble const):
(WebCore::TypeConversions::testQuietNaNUnrestrictedDouble const):
* testing/TypeConversions.idl:

LayoutTests:

Add layout test coverage.

* js/dom/webidl-type-mapping-expected.txt:
* js/dom/webidl-type-mapping.html:


  Commit: 7ea1b54fde0b847752a04a51183e3e5f09a30828
      https://github.com/WebKit/WebKit/commit/7ea1b54fde0b847752a04a51183e3e5f09a30828
  Author: BJ Burg <bburg at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp
    M Source/WebKit/UIProcess/WebProcessPool.cpp

  Log Message:
  -----------
  Merge r228854 - ASSERT under WebAutomationSession::setProcessPool() when running W3C test suite a second time
https://bugs.webkit.org/show_bug.cgi?id=182991
<rdar://problem/37620578>

Reviewed by Timothy Hatcher.

Sometimes when running more than one session end-to-end with the same browser instance,
UIProcess would crash under addMessageReceiver because another WebAutomationSession was still
registered. This is hard to reproduce, but upon code inspection, the receiver management code
is somewhat problematic because it only runs when the WebAutomationSession destructor runs.
In some cases the client could retain two sessions and cause the first one to never remove itself
as the message receiver.

Instead of unregistering the session as a message receiver underneath the session's destructor,
do this whenever a new session supplants an old session since there is only one active session at a time.

* UIProcess/Automation/WebAutomationSession.cpp:
(WebKit::WebAutomationSession::~WebAutomationSession):
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::setAutomationSession):


  Commit: 39561e1db8655ac899dd3512ce7945342ecbd0da
      https://github.com/WebKit/WebKit/commit/39561e1db8655ac899dd3512ce7945342ecbd0da
  Author: BJ Burg <bburg at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp

  Log Message:
  -----------
  Merge r228434 - Web Automation: don't return an error if resizing/moving a window has no effect
https://bugs.webkit.org/show_bug.cgi?id=182742

Reviewed by Tim Horton.

* UIProcess/Automation/WebAutomationSession.cpp:
(WebKit::WebAutomationSession::resizeWindowOfBrowsingContext):
(WebKit::WebAutomationSession::moveWindowOfBrowsingContext):
Unify the behavior for all ports. Don't raise an error if the command was
idempotent (by mistake or not). It should not be an error to re-maximize a window.


  Commit: 874400dfe036338edcc9195afe399e467c845706
      https://github.com/WebKit/WebKit/commit/874400dfe036338edcc9195afe399e467c845706
  Author: BJ Burg <bburg at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/JSONValues.h
    M Source/WebDriver/ChangeLog
    M Source/WebDriver/Session.cpp
    M Source/WebDriver/Session.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Automation/Automation.json
    M Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp
    M Source/WebKit/UIProcess/Automation/WebAutomationSession.h

  Log Message:
  -----------
  Merge r228856 - Web Automation: combine session commands to resize and move top-level browsing contexts
https://bugs.webkit.org/show_bug.cgi?id=182749
<rdar://problem/37515170>

Reviewed by Andy Estes.

Source/WebDriver:

The new command can take either size or origin. Just have one session command for use by endpoints.

* Session.cpp:
(WebDriver::Session::setWindowRect):
(WebDriver::Session::moveToplevelBrowsingContextWindow): Deleted.
(WebDriver::Session::resizeToplevelBrowsingContextWindow): Deleted.
* Session.h:

Source/WebKit:

Since moving and resizing the window are both accomplished by setting the window frame,
and the W3C WebDriver specification has a Get/Set Window Rect command, it's time to
deduplicate these two methods which basically do the same thing.

Adopt modern JSON::Value getters that return std::optional<float>. I have been trying
to move the protocol over to this style wholesale, but it is probably easier to do
this conversion in smaller pieces. And so, I have started to do so.

This change is covered by existing WebDriver tests.

* UIProcess/Automation/Automation.json: Add new command.
* UIProcess/Automation/WebAutomationSession.cpp:
(WebKit::WebAutomationSession::setWindowFrameOfBrowsingContext): Added.
(WebKit::WebAutomationSession::resizeWindowOfBrowsingContext): Deleted.
(WebKit::WebAutomationSession::moveWindowOfBrowsingContext): Deleted.
* UIProcess/Automation/WebAutomationSession.h:

Source/WTF:

* wtf/JSONValues.h: add a getDouble() implementation that returns a std::optional<T>
rather than using an out-parameter. I'd like to move more code to this style.


  Commit: 3e348c035270766d93a035edcab60a9e82a2ee18
      https://github.com/WebKit/WebKit/commit/3e348c035270766d93a035edcab60a9e82a2ee18
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderListItem.cpp
    M Source/WebCore/rendering/RenderListItem.h

  Log Message:
  -----------
  Merge r228858 - [RenderTreeBuilder] Move RenderListItem::willBeRemoved() mutation logic to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182943
<rdar://problem/37689029>

Reviewed by Antti Koivisto.

We don't need to destroy the marker in RenderListItem::willBeRemoved(), because it gets deleted
in RenderTreeBuilder::removeAndDestroy() together with RenderListItem (as long as the marker is
the RenderListItem's descendent).

Covered by existing tests.

* rendering/RenderListItem.cpp:
(WebCore::RenderListItem::~RenderListItem):
(WebCore::RenderListItem::willBeDestroyed): Deleted.
* rendering/RenderListItem.h:


  Commit: 1d3a91f684162176fad445e169c495b3ad5f3496
      https://github.com/WebKit/WebKit/commit/1d3a91f684162176fad445e169c495b3ad5f3496
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGArgumentsUtilities.cpp
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGValidate.cpp
    M Source/JavaScriptCore/dfg/DFGVarargsForwardingPhase.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r228860 - DFG::VarargsForwardingPhase should eliminate getting argument length
https://bugs.webkit.org/show_bug.cgi?id=182959

Reviewed by Keith Miller.

JSTests:

* microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js: Added.

Source/JavaScriptCore:

This patch teaches the DFG VarargsForwardingPhase to not treat
length accesses on Cloned/Direct Arguments objects as escapes.
It teaches this phase to materialize the length in the same
way the ArgumentsEliminationPhase does.

This is around a 0.5-1% speedup on ARES6 on my iMac. It speeds
up the ML subtest by 2-4%.

This patch also extends compileGetArgumentCountIncludingThis to take
a parameter that is the inline call frame to load from (in the case
where the inline call frame is a varargs frame). This allows the
the emitCodeToGetArgumentsArrayLength helper function to just emit
a GetArgumentCountIncludingThis node instead of a GetLocal. If we
emitted a GetLocal, we'd need to rerun CPS rethreading.

* dfg/DFGArgumentsEliminationPhase.cpp:
* dfg/DFGArgumentsUtilities.cpp:
(JSC::DFG::emitCodeToGetArgumentsArrayLength):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::getArgumentCount):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGNode.h:
(JSC::DFG::Node::argumentsInlineCallFrame):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetArgumentCountIncludingThis):
* dfg/DFGVarargsForwardingPhase.cpp:
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileGetArgumentCountIncludingThis):


  Commit: f360e389650c2148d2032e6973d58d524c48f3fa
      https://github.com/WebKit/WebKit/commit/f360e389650c2148d2032e6973d58d524c48f3fa
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Sources.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/rendering/RenderFullScreen.cpp
    M Source/WebCore/rendering/RenderFullScreen.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    A Source/WebCore/rendering/updating/RenderTreeBuilderFullScreen.cpp
    A Source/WebCore/rendering/updating/RenderTreeBuilderFullScreen.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp

  Log Message:
  -----------
  Merge r228862 - [RenderTreeBuilder] Move RenderFullScreen::willBeRemoved() mutation logic to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182947
<rdar://problem/37690848>

Reviewed by Antti Koivisto.

No change in functionality.

* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* rendering/RenderFullScreen.cpp:
(WebCore::RenderFullScreen::willBeDestroyed):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
* rendering/updating/RenderTreeBuilder.h:
(WebCore::RenderTreeBuilder::fullScreenBuilder):
* rendering/updating/RenderTreeBuilderFullScreen.cpp: Added.
(WebCore::RenderTreeBuilder::FullScreen::FullScreen):
(WebCore::RenderTreeBuilder::FullScreen::cleanupOnRemoval):
* rendering/updating/RenderTreeBuilderFullScreen.h: Added.
* rendering/updating/RenderTreeBuilderMathML.cpp:


  Commit: e8bbcc8dea54f912759c342b120c1665f33b7efb
      https://github.com/WebKit/WebKit/commit/e8bbcc8dea54f912759c342b120c1665f33b7efb
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merge r228866 - [GStreamer] Create a Wayland GL display instead of EGL
https://bugs.webkit.org/show_bug.cgi?id=182968

Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::ensureGstGLContext):
Add logging and instantiate a GstDisplayWayland display instead of
an EGL display when running under a Wayland compositor.


  Commit: 16fe75250f9149dfe8d9b4d0393197590d90dc3e
      https://github.com/WebKit/WebKit/commit/16fe75250f9149dfe8d9b4d0393197590d90dc3e
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merge r228869 - [GStreamer] We need to adopt GstGlDisplays after GStreamer 1.13.1
https://bugs.webkit.org/show_bug.cgi?id=182996

Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::ensureGstGLContext):
Adopt references when running with GStreamer 1.13.1 to avoid
memory leaks.


  Commit: 891c686a6cad0b2001b0ded1a49a17313116a03d
      https://github.com/WebKit/WebKit/commit/891c686a6cad0b2001b0ded1a49a17313116a03d
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp

  Log Message:
  -----------
  Merge r228879 - [ATK] Remove attributeSet variable from AccessibilityUIElement::attributedStringForRange().
https://bugs.webkit.org/show_bug.cgi?id=183000

Reviewed by Joanmarie Diggs.

It is never initialized, but is passed to atk_attribute_set_free.
This caused a crash in accessibility/content-editable-as-textarea.html on the debug bots.

* WebKitTestRunner/InjectedBundle/atk/AccessibilityUIElementAtk.cpp:
(WTR::AccessibilityUIElement::attributedStringForRange):


  Commit: ba0a1ce503973265f28f57caca4f588b4f68792c
      https://github.com/WebKit/WebKit/commit/ba0a1ce503973265f28f57caca4f588b4f68792c
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/Scripts/webkitpy/port/wpe.py
    M Tools/WebKitTestRunner/TestController.cpp

  Log Message:
  -----------
  Merge r228881 - [WTR][WPE] Correct the process names in TestController.
https://bugs.webkit.org/show_bug.cgi?id=178700

Reviewed by Michael Catanzaro.

Similar to r228731 for GTK.

* Scripts/webkitpy/port/wpe.py:
(WPEPort._get_crash_log): removed the code to convert WebProcess name.
* WebKitTestRunner/TestController.cpp: return the correct process names for WPE.
(WTR::TestController::webProcessName):
(WTR::TestController::networkProcessName):
(WTR::TestController::databaseProcessName):


  Commit: 6c54488f87ec2cc27c4f15569661542027556fe6
      https://github.com/WebKit/WebKit/commit/6c54488f87ec2cc27c4f15569661542027556fe6
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/crypto/gcrypt/CryptoKeyRSAGCrypt.cpp

  Log Message:
  -----------
  Merge r228882 - [GCrypt] Remove unsound assertion from CryptoKeyRSA::exportData().
https://bugs.webkit.org/show_bug.cgi?id=183001

Reviewed by Philippe Normand.

This function is called from structured cloning, in particular when storing
a key in IndexedDB. This would trip the assertion if the key in question is
non-exportable.

The assertion was copied from the macOS implementation in r172389; it was
subsequently removed there in r172898 to handle this case.

Test: crypto/subtle/rsa-indexeddb-non-exportable.html

* crypto/gcrypt/CryptoKeyRSAGCrypt.cpp:
(WebCore::CryptoKeyRSA::exportData const): remove assertion.


  Commit: 30d78bdc562ca783666e135b15884fe795784f05
      https://github.com/WebKit/WebKit/commit/30d78bdc562ca783666e135b15884fe795784f05
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderTextFragment.cpp
    M Source/WebCore/rendering/RenderTextFragment.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.h

  Log Message:
  -----------
  Merge r228884 - [RenderTreeBuilder] Move RenderTextFragment::willBeRemoved() mutation logic to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=182946
<rdar://problem/37690039>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::willBeDestroyed):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::takeChild):
* rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::cleanupOnRemoval):
* rendering/updating/RenderTreeBuilderFirstLetter.h:


  Commit: 9d7f3cab389584946b4a8ad4e5f7e5d0a160ae3a
      https://github.com/WebKit/WebKit/commit/9d7f3cab389584946b4a8ad4e5f7e5d0a160ae3a
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/media/track/track-add-remove-cue-expected.txt
    M LayoutTests/media/track/track-add-remove-cue.html
    M LayoutTests/media/track/track-cue-negative-timestamp-expected.txt
    M LayoutTests/media/track/track-cue-negative-timestamp.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/JSDOMConvertNumbers.h
    M Source/WebCore/html/track/VTTCue.idl

  Log Message:
  -----------
  Merge r228886 - VTTCue constructor should use 'double' type for startTime / endTime
https://bugs.webkit.org/show_bug.cgi?id=182988

Reviewed by Eric Carlson.

Source/WebCore:

VTTCue constructor should use 'double' type for startTime / endTime, not
'unrestricted double':
- https://w3c.github.io/webvtt/#the-vttcue-interface

Otherwise, we end up potentially returning NaN for TextTrackCue.startTime / endTime,
even though those correctly use type 'double':
- https://html.spec.whatwg.org/multipage/media.html#texttrackcue

The new behavior is consistent with Firefox and Chrome.

No new tests, updated existing test.

* bindings/js/JSDOMConvertNumbers.h:
(WebCore::JSConverter<IDLDouble>::convert):
Add assertion to make sure our implementation never tries to return NaN
for an IDL attribute of type 'double'. This would be invalid as per Web
IDL spec and would crash if the NaN being returned was impure as JSValue
could not store it as a double.

* html/track/VTTCue.idl:
Update constructor parameters to use 'double' type instead of 'unrestricted
double', as per:
- https://w3c.github.io/webvtt/#the-vttcue-interface

LayoutTests:

Update existing test to reflect behavior change.

* media/track/track-add-remove-cue-expected.txt:
* media/track/track-add-remove-cue.html:


  Commit: aaa6064238b961b55683ba2b32fda5078940ad1a
      https://github.com/WebKit/WebKit/commit/aaa6064238b961b55683ba2b32fda5078940ad1a
  Author: BJ Burg <bburg at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r228887 - Web Automation: failed provisional loads cause "Navigate To" command to hang
https://bugs.webkit.org/show_bug.cgi?id=183007
<rdar://problem/37751819>

Reviewed by Andy Estes.

This hang was revealed by WPT test current_url.py::get_current_url_file_protocol. Now the
test simply fails because Safari chooses a policy of 'Ignore' for externally-opened files.
I filed an upstream issue with the test here: https://github.com/w3c/webdriver/issues/1232

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
Notify the session that the load failed in the frame, just like we do
for non-provisional failed loads and successful loads.


  Commit: abed3675fd73cb12b8e8cd05fd3512fbc35542fa
      https://github.com/WebKit/WebKit/commit/abed3675fd73cb12b8e8cd05fd3512fbc35542fa
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/LowPowerModeNotifier.cpp
    M Source/WebCore/platform/LowPowerModeNotifier.h
    M Source/WebCore/platform/glib/LowPowerModeNotifierGLib.cpp
    R Source/cmake/FindUPowerGLib.cmake
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r228888 - [GTK] USE_UPOWER causes crashes inside a chroot or on systems with broken dbus/upower
https://bugs.webkit.org/show_bug.cgi?id=181825

Reviewed by Carlos Garcia Campos.

.:

Get rid of the upower-glib dependency. We will use upower's D-Bus API instead.

* Source/cmake/FindUPowerGLib.cmake: Removed.
* Source/cmake/OptionsGTK.cmake:

Source/WebCore:

We could fix this crash, but that would not be good enough, because upower-glib is a
synchronous API that wraps D-Bus calls. That's not acceptable for use in the web process.
Rewrite LowPowerModeNotifierGLib to use upower's D-Bus API directly, instead.

Note that this also enables LowPowerModeNotifier for WPE, since the USE(UPOWER) build
flag is no longer needed.

* platform/LowPowerModeNotifier.cpp:
* platform/LowPowerModeNotifier.h:
* platform/glib/LowPowerModeNotifierGLib.cpp:
(WebCore::LowPowerModeNotifier::LowPowerModeNotifier):
(WebCore::LowPowerModeNotifier::updateWarningLevel):
(WebCore::LowPowerModeNotifier::warningLevelChanged):
(WebCore::LowPowerModeNotifier::gPropertiesChangedCallback):
(WebCore::LowPowerModeNotifier::~LowPowerModeNotifier):
(WebCore::LowPowerModeNotifier::updateState): Deleted.
(WebCore::LowPowerModeNotifier::warningLevelCallback): Deleted.


  Commit: 0b1c9c70e4e13ea8faffd3c8ca50c400b7c6d7f3
      https://github.com/WebKit/WebKit/commit/0b1c9c70e4e13ea8faffd3c8ca50c400b7c6d7f3
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/rendering/RenderView.cpp
    M Source/WebCore/rendering/RenderView.h

  Log Message:
  -----------
  Merge r228889 - [RenderTreeBuilder] Move RenderView::willBeRemoved() mutation logic to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=183009

Reviewed by Antti Koivisto.

No change in functionality.

* dom/Document.cpp:
(WebCore::Document::destroyRenderTree):
* rendering/RenderView.cpp:
(WebCore::RenderView::~RenderView):
(WebCore::RenderView::willBeDestroyed): Deleted.
* rendering/RenderView.h:


  Commit: f0f3697ecba6abc0fbe90fdfcd1535d4fcbc1dc3
      https://github.com/WebKit/WebKit/commit/f0f3697ecba6abc0fbe90fdfcd1535d4fcbc1dc3
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Revert "Merge r228869 - [GStreamer] We need to adopt GstGlDisplays after GStreamer 1.13.1"

This reverts commit 48050e16b968b35602398e0764a44f3f646e6f00.


  Commit: 37eb33e923628a59b83018923a83412e1e584004
      https://github.com/WebKit/WebKit/commit/37eb33e923628a59b83018923a83412e1e584004
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Revert "Merge r228866 - [GStreamer] Create a Wayland GL display instead of EGL"

This reverts commit ae0522d9bdcd6cb914d9a475abdf17172bd9be4a.


  Commit: 8b0076392737a2e0a8db497ad8b137936902664e
      https://github.com/WebKit/WebKit/commit/8b0076392737a2e0a8db497ad8b137936902664e
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merge r228869 - [GStreamer] We need to adopt GstGlDisplays after GStreamer 1.13.1
https://bugs.webkit.org/show_bug.cgi?id=182996

Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::ensureGstGLContext):
Adopt references when running with GStreamer 1.13.1 to avoid
memory leaks.


  Commit: 9461236846b94944b93d6c5911112705acccc6df
      https://github.com/WebKit/WebKit/commit/9461236846b94944b93d6c5911112705acccc6df
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/MiniBrowser/gtk/main.c

  Log Message:
  -----------
  [GTK] Unsafe g_setenv use in MiniBrowser main
https://bugs.webkit.org/show_bug.cgi?id=182978

Reviewed by Carlos Garcia Campos.

setenv (and g_setenv) will randomly crash if called too late.

* MiniBrowser/gtk/main.c:
(main):


  Commit: 784b8ff74f1947df788e046f028498b573144588
      https://github.com/WebKit/WebKit/commit/784b8ff74f1947df788e046f028498b573144588
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Sources.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderBoxModelObject.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    A Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.cpp
    A Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.h

  Log Message:
  -----------
  Merge r228899 - [RenderTreeBuilder] Move RenderBoxModelObject::willBeRemoved() mutation logic to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=183014
<rdar://problem/37757428>

Reviewed by Antti Koivisto.

No change in functionality.

* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::~RenderBoxModelObject):
(WebCore::RenderBoxModelObject::willBeDestroyed):
(WebCore::RenderBoxModelObject::continuationChainNode const):
(): Deleted.
(WebCore::RenderBoxModelObject::removeAndDestroyAllContinuations): Deleted.
* rendering/RenderBoxModelObject.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::RenderTreeBuilder):
(WebCore::RenderTreeBuilder::removeAndDestroy):
* rendering/updating/RenderTreeBuilder.h:
(WebCore::RenderTreeBuilder::continuationBuilder):
* rendering/updating/RenderTreeBuilderContinuation.cpp: Added.
(WebCore::RenderTreeBuilder::Continuation::Continuation):
(WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):
* rendering/updating/RenderTreeBuilderContinuation.h: Added.


  Commit: 20f94a5b354aa2049c187d2134fef7d33d206c0d
      https://github.com/WebKit/WebKit/commit/20f94a5b354aa2049c187d2134fef7d33d206c0d
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-02-26 (Mon, 26 Feb 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/rendering/RenderBlock.h
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderBlockFlow.h
    M Source/WebCore/rendering/RenderBox.cpp
    M Source/WebCore/rendering/RenderBox.h
    M Source/WebCore/rendering/RenderBoxModelObject.cpp
    M Source/WebCore/rendering/RenderBoxModelObject.h
    M Source/WebCore/rendering/RenderCounter.cpp
    M Source/WebCore/rendering/RenderCounter.h
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderEmbeddedObject.cpp
    M Source/WebCore/rendering/RenderEmbeddedObject.h
    M Source/WebCore/rendering/RenderFragmentedFlow.cpp
    M Source/WebCore/rendering/RenderFragmentedFlow.h
    M Source/WebCore/rendering/RenderImage.cpp
    M Source/WebCore/rendering/RenderImage.h
    M Source/WebCore/rendering/RenderInline.cpp
    M Source/WebCore/rendering/RenderInline.h
    M Source/WebCore/rendering/RenderLayerModelObject.cpp
    M Source/WebCore/rendering/RenderLayerModelObject.h
    M Source/WebCore/rendering/RenderListBox.cpp
    M Source/WebCore/rendering/RenderListBox.h
    M Source/WebCore/rendering/RenderListMarker.cpp
    M Source/WebCore/rendering/RenderListMarker.h
    M Source/WebCore/rendering/RenderMenuList.cpp
    M Source/WebCore/rendering/RenderMenuList.h
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderObject.h
    M Source/WebCore/rendering/RenderReplaced.cpp
    M Source/WebCore/rendering/RenderReplaced.h
    M Source/WebCore/rendering/RenderSearchField.cpp
    M Source/WebCore/rendering/RenderSearchField.h
    M Source/WebCore/rendering/RenderSnapshottedPlugIn.cpp
    M Source/WebCore/rendering/RenderSnapshottedPlugIn.h
    M Source/WebCore/rendering/RenderText.cpp
    M Source/WebCore/rendering/RenderText.h
    M Source/WebCore/rendering/RenderTextControlMultiLine.cpp
    M Source/WebCore/rendering/RenderTextControlMultiLine.h
    M Source/WebCore/rendering/RenderVideo.cpp
    M Source/WebCore/rendering/RenderVideo.h
    M Source/WebCore/rendering/RenderWidget.cpp
    M Source/WebCore/rendering/RenderWidget.h
    M Source/WebCore/rendering/svg/RenderSVGBlock.cpp
    M Source/WebCore/rendering/svg/RenderSVGBlock.h
    M Source/WebCore/rendering/svg/RenderSVGImage.cpp
    M Source/WebCore/rendering/svg/RenderSVGImage.h
    M Source/WebCore/rendering/svg/RenderSVGInline.cpp
    M Source/WebCore/rendering/svg/RenderSVGInline.h
    M Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
    M Source/WebCore/rendering/svg/RenderSVGModelObject.h
    M Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
    M Source/WebCore/rendering/svg/RenderSVGResourceContainer.h
    M Source/WebCore/rendering/svg/RenderSVGRoot.cpp
    M Source/WebCore/rendering/svg/RenderSVGRoot.h
    M Source/WebCore/rendering/svg/RenderSVGText.cpp
    M Source/WebCore/rendering/svg/RenderSVGText.h

  Log Message:
  -----------
  Merge r228908 - [RenderTreeBuilder] ::willBeRemoved() does not need RenderTreeBuilder anymore.
https://bugs.webkit.org/show_bug.cgi?id=183019
<rdar://problem/37761421>

Reviewed by Antti Koivisto.

All the willBeDestroyed() mutations have been moved over to RenderTreeBuilder.

No change in functionality.

* rendering/RenderBlock.cpp:
(WebCore::RenderBlock::willBeDestroyed):
* rendering/RenderBlock.h:
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::willBeDestroyed):
* rendering/RenderBlockFlow.h:
* rendering/RenderBox.cpp:
(WebCore::RenderBox::willBeDestroyed):
* rendering/RenderBox.h:
* rendering/RenderBoxModelObject.cpp:
(WebCore::RenderBoxModelObject::willBeDestroyed):
* rendering/RenderBoxModelObject.h:
* rendering/RenderCounter.cpp:
(WebCore::RenderCounter::willBeDestroyed):
* rendering/RenderCounter.h:
* rendering/RenderElement.cpp:
(WebCore::RenderElement::willBeDestroyed):
* rendering/RenderElement.h:
* rendering/RenderEmbeddedObject.cpp:
(WebCore::RenderEmbeddedObject::willBeDestroyed):
* rendering/RenderEmbeddedObject.h:
* rendering/RenderFragmentedFlow.cpp:
(WebCore::RenderFragmentedFlow::willBeDestroyed):
* rendering/RenderFragmentedFlow.h:
* rendering/RenderImage.cpp:
(WebCore::RenderImage::willBeDestroyed):
* rendering/RenderImage.h:
* rendering/RenderInline.cpp:
(WebCore::RenderInline::willBeDestroyed):
* rendering/RenderInline.h:
* rendering/RenderLayerModelObject.cpp:
(WebCore::RenderLayerModelObject::willBeDestroyed):
* rendering/RenderLayerModelObject.h:
* rendering/RenderListBox.cpp:
(WebCore::RenderListBox::willBeDestroyed):
* rendering/RenderListBox.h:
* rendering/RenderListMarker.cpp:
(WebCore::RenderListMarker::willBeDestroyed):
* rendering/RenderListMarker.h:
* rendering/RenderMenuList.cpp:
(WebCore::RenderMenuList::willBeDestroyed):
* rendering/RenderMenuList.h:
* rendering/RenderObject.cpp:
(WebCore::RenderObject::willBeDestroyed):
(WebCore::RenderObject::destroy):
* rendering/RenderObject.h:
* rendering/RenderReplaced.cpp:
(WebCore::RenderReplaced::willBeDestroyed):
* rendering/RenderReplaced.h:
* rendering/RenderSearchField.cpp:
(WebCore::RenderSearchField::willBeDestroyed):
* rendering/RenderSearchField.h:
* rendering/RenderSnapshottedPlugIn.cpp:
(WebCore::RenderSnapshottedPlugIn::willBeDestroyed):
* rendering/RenderSnapshottedPlugIn.h:
* rendering/RenderText.cpp:
(WebCore::RenderText::willBeDestroyed):
* rendering/RenderText.h:
* rendering/RenderTextControlMultiLine.cpp:
(WebCore::RenderTextControlMultiLine::willBeDestroyed):
* rendering/RenderTextControlMultiLine.h:
* rendering/RenderVideo.cpp:
(WebCore::RenderVideo::willBeDestroyed):
* rendering/RenderVideo.h:
* rendering/RenderWidget.cpp:
(WebCore::RenderWidget::willBeDestroyed):
* rendering/RenderWidget.h:
* rendering/svg/RenderSVGBlock.cpp:
(WebCore::RenderSVGBlock::willBeDestroyed):
* rendering/svg/RenderSVGBlock.h:
* rendering/svg/RenderSVGImage.cpp:
(WebCore::RenderSVGImage::willBeDestroyed):
* rendering/svg/RenderSVGImage.h:
* rendering/svg/RenderSVGInline.cpp:
(WebCore::RenderSVGInline::willBeDestroyed):
* rendering/svg/RenderSVGInline.h:
* rendering/svg/RenderSVGModelObject.cpp:
(WebCore::RenderSVGModelObject::willBeDestroyed):
* rendering/svg/RenderSVGModelObject.h:
* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::willBeDestroyed):
* rendering/svg/RenderSVGResourceContainer.h:
* rendering/svg/RenderSVGRoot.cpp:
(WebCore::RenderSVGRoot::willBeDestroyed):
* rendering/svg/RenderSVGRoot.h:
* rendering/svg/RenderSVGText.cpp:
(WebCore::RenderSVGText::willBeDestroyed):
* rendering/svg/RenderSVGText.h:


  Commit: 63ccfaa73878c11a552f55f127cfc0599dc92514
      https://github.com/WebKit/WebKit/commit/63ccfaa73878c11a552f55f127cfc0599dc92514
  Author: mattbaker at apple.com <mattbaker at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/inspector/unit-tests/object-utilities-expected.txt
    M LayoutTests/inspector/unit-tests/object-utilities.html
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Base/Utilities.js

  Log Message:
  -----------
  Merge r228336 - Web Inspector: Object.shallowEqual always fails when comparing array property values
https://bugs.webkit.org/show_bug.cgi?id=182634
<rdar://problem/37374639>

Reviewed by Devin Rousso.

Source/WebInspectorUI:

Object.shallowEqual should use Array.shallowEqual when comparing property
values, since strictly comparing objects/arrays is only true if both
operands reference the same Object.

* UserInterface/Base/Utilities.js:
(value):

LayoutTests:

* inspector/unit-tests/object-utilities-expected.txt:
* inspector/unit-tests/object-utilities.html:


  Commit: de3534536805da931bcda61b13ed8692cd802ead
      https://github.com/WebKit/WebKit/commit/de3534536805da931bcda61b13ed8692cd802ead
  Author: Dean Jackson <dino at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/WebCoreBuiltinNames.h
    M Source/WebCore/html/canvas/ImageBitmapRenderingContext.idl

  Log Message:
  -----------
  Merge r228349 - ImageBitmapRenderingContext should be Runtime guarded
https://bugs.webkit.org/show_bug.cgi?id=182665
<rdar://problem/37411410>

Reviewed by Sam Weinig.

Add a flag to ensure the ImageBitmapRenderingContext interface is only
visible when the runtime feature is enabled.

* bindings/js/WebCoreBuiltinNames.h:
* html/canvas/ImageBitmapRenderingContext.idl:


  Commit: bba795e2db06c252c5c0ff22acd87d0304861547
      https://github.com/WebKit/WebKit/commit/bba795e2db06c252c5c0ff22acd87d0304861547
  Author: mattbaker at apple.com <mattbaker at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/WebInspectorUI.cpp

  Log Message:
  -----------
  Merge r228937 - Web Inspector: REGRESSION (r228349): ImageBitmap builtin is now runtime guarded
https://bugs.webkit.org/show_bug.cgi?id=183056
<rdar://problem/37799067>

Reviewed by Joseph Pecoraro.

* WebProcess/WebPage/WebInspectorUI.cpp:
(WebKit::WebInspectorUI::WebInspectorUI):


  Commit: 6c83cddb102dcc999beba998f38d9162b0f9ffaf
      https://github.com/WebKit/WebKit/commit/6c83cddb102dcc999beba998f38d9162b0f9ffaf
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebKit/CMakeLists.txt
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake
    A Source/WebKit/SourcesWPE.txt

  Log Message:
  -----------
  Merge r228522 - [WPE] Unify build of platform-specific files in WebKit layer
https://bugs.webkit.org/show_bug.cgi?id=182696

Reviewed by Žan Doberšek.

This is easy, because all needed changes were made in the previously-landed patch.

* CMakeLists.txt:
* PlatformWPE.cmake:


  Commit: 04bbd13b612650062d9f816753c4ad637ca66a9b
      https://github.com/WebKit/WebKit/commit/04bbd13b612650062d9f816753c4ad637ca66a9b
  Author: Daniel Bates <dabates at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/encoding/unsupported-encodings-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/encoding/utf-32-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/TextDecoder.cpp
    M Source/WebCore/loader/TextResourceDecoder.cpp
    M Source/WebCore/platform/text/TextEncoding.cpp
    M Source/WebCore/platform/text/TextEncoding.h

  Log Message:
  -----------
  Merge r228594 - Remove UTF-32 BOM parsing code
https://bugs.webkit.org/show_bug.cgi?id=182900
<rdar://problem/37238717>

Patch by Daniel Bates <dabates at apple.com> on 2018-02-16
Reviewed by Alexey Proskuryakov.

LayoutTests/imported/w3c:

Update expected results now that all sub-tests pass.

* web-platform-tests/encoding/unsupported-encodings-expected.txt:
* web-platform-tests/encoding/utf-32-expected.txt:

Source/WebCore:

The UTF-32 encodings were removed from the text codec registry in r224747. So,
we no longer need code to encode or decode these variants.

* dom/TextDecoder.cpp:
(WebCore::codeUnitByteSize):
* loader/TextResourceDecoder.cpp:
(WebCore::TextResourceDecoder::checkForBOM):
(WebCore::TextResourceDecoder::checkForHeadCharset):
* platform/text/TextEncoding.cpp:
(WebCore::TextEncoding::isNonByteBasedEncoding const):
(WebCore::UTF32BigEndianEncoding): Deleted.
(WebCore::UTF32LittleEndianEncoding): Deleted.
* platform/text/TextEncoding.h:


  Commit: 68279f3aeb9a98bc834ffb7e395b41d2d25e550c
      https://github.com/WebKit/WebKit/commit/68279f3aeb9a98bc834ffb7e395b41d2d25e550c
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h

  Log Message:
  -----------
  Merge r228914 - [RenderTreeBuilder] Move RenderObject::insertedInto() mutation logic to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=183022
<rdar://problem/37764326>

Reviewed by Antti Koivisto.

No change in functionality.

* rendering/RenderObject.cpp:
(WebCore::RenderObject::insertedIntoTree):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::insertChildToRenderElementInternal):
(WebCore::RenderTreeBuilder::moveChildrenTo):
(WebCore::RenderTreeBuilder::multiColumnDescendantInserted): Deleted.
* rendering/updating/RenderTreeBuilder.h:


  Commit: 40ff8ef52e749ac178b64d62e9677663cfad8893
      https://github.com/WebKit/WebKit/commit/40ff8ef52e749ac178b64d62e9677663cfad8893
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/GLContext.cpp

  Log Message:
  -----------
  Merge r228917 - including both gl3.h and gl2.h when USE_OPENGL_ES is enabled
https://bugs.webkit.org/show_bug.cgi?id=183008

Reviewed by Michael Catanzaro.

Don't include GLES3 headers as we stick to GLES2 API resources.

No new tests, no behavior change.

* platform/graphics/GLContext.cpp:


  Commit: 394524b20481adc189f9377046f7b896b466b059
      https://github.com/WebKit/WebKit/commit/394524b20481adc189f9377046f7b896b466b059
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/dom/Document/open-with-pending-load-async-policy-expected.txt
    A LayoutTests/fast/dom/Document/open-with-pending-load-async-policy.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/loader/PolicyChecker.cpp

  Log Message:
  -----------
  Merge r228922 - Document.open() cancels existing provisional load but not navigation policy check
https://bugs.webkit.org/show_bug.cgi?id=183012
<rdar://problem/37755831>

Reviewed by Alex Christensen.

Source/WebCore:

Test: fast/dom/Document/open-with-pending-load-async-policy.html

* dom/Document.cpp:
(WebCore::Document::open):
The existing code was calling FrameLoader::stopAllLoaders() when the loader's state
is FrameStateProvisional. The issue is that the FrameLoader's state only gets set
to FrameStateProvisional after the policy decision for the navigation is made.
This means that we fail to cancel a pending load if is still in the policy decision
stage, which can happen when the policy decision is made asynchronously. We now
also cancel such pending navigation policy checks as well.

* loader/PolicyChecker.cpp:
(WebCore::PolicyChecker::checkNavigationPolicy):
Make sure the m_delegateIsDecidingNavigationPolicy flag gets reset inside the
lambda. Otherwise, it gets reset too early when the policy decision is made
asynchronously.

LayoutTests:

Add layout test coverage.

* fast/dom/Document/open-with-pending-load-async-policy-expected.txt: Added.
* fast/dom/Document/open-with-pending-load-async-policy.html: Added.


  Commit: 8acd40b0f743e38df4c8f4bf896421c1d1b86b27
      https://github.com/WebKit/WebKit/commit/8acd40b0f743e38df4c8f4bf896421c1d1b86b27
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/SuperSampler.cpp
    M Source/WTF/ChangeLog
    M Source/WTF/benchmarks/LockFairnessTest.cpp
    M Source/WTF/benchmarks/LockSpeedTest.cpp
    M Source/WTF/wtf/CurrentTime.cpp
    M Source/WTF/wtf/CurrentTime.h
    M Source/WTF/wtf/DebugUtilities.h
    M Source/WTF/wtf/Seconds.cpp
    M Source/WTF/wtf/Seconds.h
    M Source/WTF/wtf/StackShotProfiler.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/PluginProcess/WebProcessConnection.cpp
    M Source/WebKit/UIProcess/linux/MemoryPressureMonitor.cpp
    M Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp
    M Tools/ChangeLog
    M Tools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
    M Tools/DumpRenderTree/TestNetscapePlugIn/Tests/EvaluateJSWithinNPP_New.cpp
    M Tools/DumpRenderTree/TestNetscapePlugIn/Tests/InvokeDestroysPluginWithinNPP_New.cpp
    M Tools/DumpRenderTree/TestNetscapePlugIn/Tests/SlowNPPNew.cpp
    M Tools/TestWebKitAPI/Tests/WTF/Signals.cpp
    M Tools/TestWebKitAPI/Tests/WTF/ThreadGroup.cpp
    M Tools/TestWebKitAPI/Tests/WTF/WorkQueue.cpp
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/PictureInPictureDelegate.mm
    M Tools/TestWebKitAPI/Tests/ios/DataInteractionTests.mm
    M Tools/TestWebKitAPI/jsconly/PlatformUtilitiesJSCOnly.cpp

  Log Message:
  -----------
  Merge r228926 - Remove sleep(double) and sleepMS(double) interfaces
https://bugs.webkit.org/show_bug.cgi?id=183038

Reviewed by Mark Lam.

Source/JavaScriptCore:

* bytecode/SuperSampler.cpp:
(JSC::initializeSuperSampler):

Source/WebKit:

* PluginProcess/WebProcessConnection.cpp:
(WebKit::WebProcessConnection::createPluginAsynchronously):
* UIProcess/linux/MemoryPressureMonitor.cpp:
(WebKit::pollIntervalForUsedMemoryPercentage):
(WebKit::MemoryPressureMonitor::MemoryPressureMonitor):
* WebProcess/wpe/WebProcessMainWPE.cpp:

Source/WTF:

This patch removes sleep(double) and sleepMS(double) interfaces.
We can just use sleep(Seconds) instead.

* benchmarks/LockFairnessTest.cpp:
* benchmarks/LockSpeedTest.cpp:
* wtf/CurrentTime.cpp:
(WTF::sleep):
* wtf/CurrentTime.h:
(WTF::sleepMS): Deleted.
* wtf/DebugUtilities.h:
* wtf/Seconds.cpp:
(WTF::sleep): Deleted.
* wtf/Seconds.h:
* wtf/StackShotProfiler.h:

Tools:

* DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
(PluginTest::indicateTestFailure):
* DumpRenderTree/TestNetscapePlugIn/Tests/EvaluateJSWithinNPP_New.cpp:
(EvaluteJSWithinNPP_New::NPP_New):
* DumpRenderTree/TestNetscapePlugIn/Tests/InvokeDestroysPluginWithinNPP_New.cpp:
(InvokeDestroysPluginWithinNPP_New::NPP_New):
* DumpRenderTree/TestNetscapePlugIn/Tests/SlowNPPNew.cpp:
* TestWebKitAPI/Tests/WTF/Signals.cpp:
(TEST):
* TestWebKitAPI/Tests/WTF/ThreadGroup.cpp:
(TestWebKitAPI::testThreadGroup):
* TestWebKitAPI/Tests/WTF/WorkQueue.cpp:
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebKitCocoa/PictureInPictureDelegate.mm:
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/ios/DataInteractionTests.mm:
(TestWebKitAPI::TEST):
* TestWebKitAPI/jsconly/PlatformUtilitiesJSCOnly.cpp:
(TestWebKitAPI::Util::sleep):


  Commit: 2bcaa36b741b57c95ef610d2a3349c7a58c8e467
      https://github.com/WebKit/WebKit/commit/2bcaa36b741b57c95ef610d2a3349c7a58c8e467
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/ARM64Assembler.h
    M Source/JavaScriptCore/assembler/MacroAssembler.cpp
    M Source/JavaScriptCore/assembler/MacroAssembler.h
    M Source/JavaScriptCore/assembler/MacroAssemblerARM.h
    M Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
    M Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
    M Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
    M Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
    M Source/JavaScriptCore/assembler/ProbeStack.h

  Log Message:
  -----------
  Merge r228932 - Refactor MacroAssembler code to improve reuse and extensibility.
https://bugs.webkit.org/show_bug.cgi?id=183054
<rdar://problem/37797337>

Reviewed by Saam Barati.

* assembler/ARM64Assembler.h:
* assembler/MacroAssembler.cpp:
* assembler/MacroAssembler.h:
* assembler/MacroAssemblerARM.h:
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::canCompact):
(JSC::MacroAssemblerARM64::computeJumpType):
(JSC::MacroAssemblerARM64::jumpSizeDelta):
(JSC::MacroAssemblerARM64::link):
(JSC::MacroAssemblerARM64::load64):
(JSC::MacroAssemblerARM64::load64WithAddressOffsetPatch):
(JSC::MacroAssemblerARM64::load32):
(JSC::MacroAssemblerARM64::load32WithAddressOffsetPatch):
(JSC::MacroAssemblerARM64::load16):
(JSC::MacroAssemblerARM64::load16SignedExtendTo32):
(JSC::MacroAssemblerARM64::load8):
(JSC::MacroAssemblerARM64::load8SignedExtendTo32):
(JSC::MacroAssemblerARM64::store64):
(JSC::MacroAssemblerARM64::store64WithAddressOffsetPatch):
(JSC::MacroAssemblerARM64::store32):
(JSC::MacroAssemblerARM64::store32WithAddressOffsetPatch):
(JSC::MacroAssemblerARM64::store16):
(JSC::MacroAssemblerARM64::store8):
(JSC::MacroAssemblerARM64::getEffectiveAddress):
(JSC::MacroAssemblerARM64::branchDoubleNonZero):
(JSC::MacroAssemblerARM64::branchDoubleZeroOrNaN):
(JSC::MacroAssemblerARM64::branchTruncateDoubleToInt32):
(JSC::MacroAssemblerARM64::loadDouble):
(JSC::MacroAssemblerARM64::loadFloat):
(JSC::MacroAssemblerARM64::moveConditionallyAfterFloatingPointCompare):
(JSC::MacroAssemblerARM64::moveDoubleConditionallyAfterFloatingPointCompare):
(JSC::MacroAssemblerARM64::storeDouble):
(JSC::MacroAssemblerARM64::storeFloat):
(JSC::MacroAssemblerARM64::call):
(JSC::MacroAssemblerARM64::jump):
(JSC::MacroAssemblerARM64::tailRecursiveCall):
(JSC::MacroAssemblerARM64::setCarry):
(JSC::MacroAssemblerARM64::reemitInitialMoveWithPatch):
(JSC::MacroAssemblerARM64::isBreakpoint):
(JSC::MacroAssemblerARM64::invert):
(JSC::MacroAssemblerARM64::readCallTarget):
(JSC::MacroAssemblerARM64::replaceWithVMHalt):
(JSC::MacroAssemblerARM64::replaceWithJump):
(JSC::MacroAssemblerARM64::maxJumpReplacementSize):
(JSC::MacroAssemblerARM64::patchableJumpSize):
(JSC::MacroAssemblerARM64::repatchCall):
(JSC::MacroAssemblerARM64::makeBranch):
(JSC::MacroAssemblerARM64::makeCompareAndBranch):
(JSC::MacroAssemblerARM64::makeTestBitAndBranch):
(JSC::MacroAssemblerARM64::ARM64Condition):
(JSC::MacroAssemblerARM64::moveWithFixedWidth):
(JSC::MacroAssemblerARM64::load):
(JSC::MacroAssemblerARM64::store):
(JSC::MacroAssemblerARM64::tryLoadWithOffset):
(JSC::MacroAssemblerARM64::tryLoadSignedWithOffset):
(JSC::MacroAssemblerARM64::tryStoreWithOffset):
(JSC::MacroAssemblerARM64::jumpAfterFloatingPointCompare):
(JSC::MacroAssemblerARM64::linkCall):
* assembler/MacroAssemblerARMv7.h:
* assembler/MacroAssemblerMIPS.h:
* assembler/MacroAssemblerX86Common.h:
* assembler/ProbeStack.h:
- Removed a forward declaration of an obsolete class.


  Commit: 1fb8a0f62b4d72eb369ca2843f715da3a82bb528
      https://github.com/WebKit/WebKit/commit/1fb8a0f62b4d72eb369ca2843f715da3a82bb528
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/ResourceRequestBase.cpp

  Log Message:
  -----------
  Merge r228934 - ResourceRequestBase::isolatedCopy() fails to isolate copy the cachePartition
https://bugs.webkit.org/show_bug.cgi?id=183059
<rdar://problem/37800202>

Reviewed by Youenn Fablet.

Update ResourceRequestBase::setAsIsolatedCopy() to call isolatedCopy() on the cachePartition as well,
given that it is a String and it would not be safe to send it to another thread otherwise.

* platform/network/ResourceRequestBase.cpp:
(WebCore::ResourceRequestBase::setAsIsolatedCopy):


  Commit: e55cfb10b0ff6316c99ec40185063c245e23616c
      https://github.com/WebKit/WebKit/commit/e55cfb10b0ff6316c99ec40185063c245e23616c
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderButton.cpp
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/RenderFullScreen.cpp
    M Source/WebCore/rendering/RenderMenuList.cpp
    M Source/WebCore/rendering/RenderMenuList.h
    M Source/WebCore/rendering/RenderQuote.cpp
    M Source/WebCore/rendering/RenderTextFragment.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderFullScreen.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMathML.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderMathML.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.h
    M Source/WebCore/rendering/updating/RenderTreeUpdater.cpp
    M Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.cpp

  Log Message:
  -----------
  Merge r228938 - [RenderTreeBuilder] Rename insertChild() -> attach(), takeChild() -> detach() and removeAndDestroy() -> destroy()
https://bugs.webkit.org/show_bug.cgi?id=183061
<rdar://problem/37800269>

Reviewed by Ryosuke Niwa.

...and moveChildTo() -> move() (moveChildrenTo() -> moveChildren()),
removeFromParentAndDestroyCleaningUpAnonymousWrappers() -> destroyAndCleanUpAnonymousWrappers()

No change in functionality.

* dom/Document.cpp:
(WebCore::Document::destroyRenderTree):
(WebCore::Document::setFullScreenRenderer):
* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::styleDidChange):
* rendering/RenderButton.cpp:
(WebCore::RenderButton::setText):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::didAttachChild):
(WebCore::RenderElement::didInsertChild): Deleted.
* rendering/RenderElement.h:
* rendering/RenderFullScreen.cpp:
(WebCore::RenderFullScreen::wrapNewRenderer):
(WebCore::RenderFullScreen::wrapExistingRenderer):
(WebCore::RenderFullScreen::unwrapRenderer):
(WebCore::RenderFullScreen::createPlaceholder):
* rendering/RenderMenuList.cpp:
(RenderMenuList::didAttachChild):
(RenderMenuList::setText):
(RenderMenuList::didInsertChild): Deleted.
* rendering/RenderMenuList.h:
* rendering/RenderQuote.cpp:
(WebCore::RenderQuote::updateTextRenderer):
* rendering/RenderTextFragment.cpp:
(WebCore::RenderTextFragment::setText):
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::destroy):
(WebCore::RenderTreeBuilder::attach):
(WebCore::RenderTreeBuilder::attachIgnoringContinuation):
(WebCore::RenderTreeBuilder::detach):
(WebCore::RenderTreeBuilder::attachToRenderElement):
(WebCore::RenderTreeBuilder::attachToRenderElementInternal):
(WebCore::RenderTreeBuilder::move):
(WebCore::RenderTreeBuilder::moveAllChildren):
(WebCore::RenderTreeBuilder::moveChildren):
(WebCore::RenderTreeBuilder::moveAllChildrenIncludingFloats):
(WebCore::RenderTreeBuilder::makeChildrenNonInline):
(WebCore::RenderTreeBuilder::splitAnonymousBoxesAroundChild):
(WebCore::RenderTreeBuilder::childFlowStateChangesAndAffectsParentBlock):
(WebCore::RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers):
(WebCore::RenderTreeBuilder::detachFromRenderGrid):
(WebCore::RenderTreeBuilder::detachFromRenderElement):
(WebCore::RenderTreeBuilder::attachToRenderGrid):
(WebCore::RenderTreeBuilder::removeAndDestroy): Deleted.
(WebCore::RenderTreeBuilder::insertChild): Deleted.
(WebCore::RenderTreeBuilder::insertChildIgnoringContinuation): Deleted.
(WebCore::RenderTreeBuilder::takeChild): Deleted.
(WebCore::RenderTreeBuilder::insertChildToRenderElement): Deleted.
(WebCore::RenderTreeBuilder::insertChildToRenderElementInternal): Deleted.
(WebCore::RenderTreeBuilder::moveChildTo): Deleted.
(WebCore::RenderTreeBuilder::moveAllChildrenTo): Deleted.
(WebCore::RenderTreeBuilder::moveChildrenTo): Deleted.
(WebCore::RenderTreeBuilder::moveAllChildrenIncludingFloatsTo): Deleted.
(WebCore::RenderTreeBuilder::removeFromParentAndDestroyCleaningUpAnonymousWrappers): Deleted.
(WebCore::RenderTreeBuilder::takeChildFromRenderGrid): Deleted.
(WebCore::RenderTreeBuilder::takeChildFromRenderElement): Deleted.
(WebCore::RenderTreeBuilder::insertChildToRenderGrid): Deleted.
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::attach):
(WebCore::RenderTreeBuilder::Block::insertChildToContinuation):
(WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation):
(WebCore::RenderTreeBuilder::Block::removeLeftoverAnonymousBlock):
(WebCore::RenderTreeBuilder::Block::detach):
(WebCore::RenderTreeBuilder::Block::dropAnonymousBoxChild):
(WebCore::RenderTreeBuilder::Block::insertChild): Deleted.
(WebCore::RenderTreeBuilder::Block::insertChildIgnoringContinuation): Deleted.
(WebCore::RenderTreeBuilder::Block::takeChild): Deleted.
* rendering/updating/RenderTreeBuilderBlock.h:
* rendering/updating/RenderTreeBuilderBlockFlow.cpp:
(WebCore::RenderTreeBuilder::BlockFlow::attach):
(WebCore::RenderTreeBuilder::BlockFlow::moveAllChildrenIncludingFloats):
(WebCore::RenderTreeBuilder::BlockFlow::insertChild): Deleted.
(WebCore::RenderTreeBuilder::BlockFlow::moveAllChildrenIncludingFloatsTo): Deleted.
* rendering/updating/RenderTreeBuilderBlockFlow.h:
* rendering/updating/RenderTreeBuilderContinuation.cpp:
(WebCore::RenderTreeBuilder::Continuation::cleanupOnDestroy):
* rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::cleanupOnDestroy):
(WebCore::RenderTreeBuilder::FirstLetter::updateStyle):
(WebCore::RenderTreeBuilder::FirstLetter::createRenderers):
* rendering/updating/RenderTreeBuilderFormControls.cpp:
(WebCore::RenderTreeBuilder::FormControls::attach):
(WebCore::RenderTreeBuilder::FormControls::detach):
(WebCore::RenderTreeBuilder::FormControls::findOrCreateParentForChild):
(WebCore::RenderTreeBuilder::FormControls::insertChild): Deleted.
(WebCore::RenderTreeBuilder::FormControls::takeChild): Deleted.
* rendering/updating/RenderTreeBuilderFormControls.h:
* rendering/updating/RenderTreeBuilderFullScreen.cpp:
(WebCore::RenderTreeBuilder::FullScreen::cleanupOnDestroy):
* rendering/updating/RenderTreeBuilderInline.cpp:
(WebCore::RenderTreeBuilder::Inline::attach):
(WebCore::RenderTreeBuilder::Inline::insertChildToContinuation):
(WebCore::RenderTreeBuilder::Inline::attachIgnoringContinuation):
(WebCore::RenderTreeBuilder::Inline::splitFlow):
(WebCore::RenderTreeBuilder::Inline::splitInlines):
(WebCore::RenderTreeBuilder::Inline::childBecameNonInline):
(WebCore::RenderTreeBuilder::Inline::insertChild): Deleted.
(WebCore::RenderTreeBuilder::Inline::insertChildIgnoringContinuation): Deleted.
* rendering/updating/RenderTreeBuilderInline.h:
* rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::RenderTreeBuilder::List::updateItemMarker):
* rendering/updating/RenderTreeBuilderMathML.cpp:
(WebCore::RenderTreeBuilder::MathML::makeFences):
(WebCore::RenderTreeBuilder::MathML::attach):
(WebCore::RenderTreeBuilder::MathML::insertChild): Deleted.
* rendering/updating/RenderTreeBuilderMathML.h:
* rendering/updating/RenderTreeBuilderMultiColumn.cpp:
(WebCore::RenderTreeBuilder::MultiColumn::createFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::destroyFragmentedFlow):
(WebCore::RenderTreeBuilder::MultiColumn::processPossibleSpannerDescendant):
(WebCore::RenderTreeBuilder::MultiColumn::handleSpannerRemoval):
* rendering/updating/RenderTreeBuilderRuby.cpp:
(WebCore::RenderTreeBuilder::Ruby::moveInlineChildren):
(WebCore::RenderTreeBuilder::Ruby::moveBlockChildren):
(WebCore::RenderTreeBuilder::Ruby::attach):
(WebCore::RenderTreeBuilder::Ruby::findOrCreateParentForChild):
(WebCore::RenderTreeBuilder::Ruby::rubyBaseSafe):
(WebCore::RenderTreeBuilder::Ruby::detach):
(WebCore::RenderTreeBuilder::Ruby::insertChild): Deleted.
(WebCore::RenderTreeBuilder::Ruby::takeChild): Deleted.
* rendering/updating/RenderTreeBuilderRuby.h:
* rendering/updating/RenderTreeBuilderSVG.cpp:
(WebCore::RenderTreeBuilder::SVG::attach):
(WebCore::RenderTreeBuilder::SVG::detach):
(WebCore::RenderTreeBuilder::SVG::insertChild): Deleted.
(WebCore::RenderTreeBuilder::SVG::takeChild): Deleted.
* rendering/updating/RenderTreeBuilderSVG.h:
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::findOrCreateParentForChild):
(WebCore::RenderTreeBuilder::Table::attach):
(WebCore::RenderTreeBuilder::Table::collapseAndDestroyAnonymousSiblingRows):
(WebCore::RenderTreeBuilder::Table::insertChild): Deleted.
* rendering/updating/RenderTreeBuilderTable.h:
* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::createRenderer):
(WebCore::RenderTreeUpdater::createTextRenderer):
(WebCore::RenderTreeUpdater::tearDownRenderers):
(WebCore::RenderTreeUpdater::tearDownTextRenderer):
(WebCore::RenderTreeUpdater::tearDownLeftoverPaginationRenderersIfNeeded):
* rendering/updating/RenderTreeUpdaterGeneratedContent.cpp:
(WebCore::createContentRenderers):


  Commit: 58db5ead5b1eeacc2cca77f178c6e08366f88eb9
      https://github.com/WebKit/WebKit/commit/58db5ead5b1eeacc2cca77f178c6e08366f88eb9
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Condition.h
    M Source/WTF/wtf/CurrentTime.cpp
    M Source/WTF/wtf/CurrentTime.h
    M Source/WTF/wtf/DateMath.h
    M Source/WTF/wtf/ParkingLot.cpp
    M Source/WTF/wtf/ThreadingPrimitives.h
    M Source/WTF/wtf/ThreadingPthreads.cpp
    M Source/WTF/wtf/ThreadingWin.cpp
    M Source/WTF/wtf/WallTime.cpp
    M Source/WTF/wtf/WallTime.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/geolocation/Geolocation.cpp
    M Source/WebCore/dom/DOMTimeStamp.h
    M Source/WebCore/fileapi/File.cpp
    M Source/WebCore/history/HistoryItem.cpp
    M Source/WebCore/html/BaseDateAndTimeInputType.cpp
    M Source/WebCore/html/DateTimeInputType.cpp
    M Source/WebCore/html/MonthInputType.cpp
    M Source/WebCore/html/TimeInputType.cpp
    M Source/WebCore/inspector/agents/InspectorNetworkAgent.cpp
    M Source/WebCore/loader/EmptyFrameLoaderClient.h
    M Source/WebCore/loader/FormSubmission.cpp
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/loader/FrameLoader.h
    M Source/WebCore/loader/FrameLoaderClient.h
    M Source/WebCore/loader/NavigationScheduler.cpp
    M Source/WebCore/page/History.cpp
    M Source/WebCore/page/History.h
    M Source/WebCore/page/PageOverlay.cpp
    M Source/WebCore/page/PageOverlay.h
    M Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
    M Source/WebCore/platform/ios/LegacyTileLayerPool.h
    M Source/WebCore/platform/ios/LegacyTileLayerPool.mm
    M Source/WebCore/platform/ios/SystemMemoryIOS.cpp
    M Source/WebCore/platform/mediastream/mac/DisplayCaptureSourceCocoa.cpp
    M Source/WebCore/platform/mediastream/mac/ScreenDisplayCaptureSourceMac.mm
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngineCache.cpp
    M Source/WebKit/PluginProcess/WebProcessConnection.cpp
    M Source/WebKit/Shared/WebProcessCreationParameters.h
    M Source/WebKit/Shared/linux/WebMemorySamplerLinux.cpp
    M Source/WebKit/Shared/mac/WebMemorySampler.mac.mm
    M Source/WebKit/UIProcess/API/C/WKContext.cpp
    M Source/WebKit/UIProcess/API/glib/IconDatabase.cpp
    M Source/WebKit/UIProcess/DrawingAreaProxyImpl.cpp
    M Source/WebKit/UIProcess/Plugins/PlugInAutoStartProvider.cpp
    M Source/WebKit/UIProcess/Plugins/PlugInAutoStartProvider.h
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Source/WebKit/UIProcess/WebProcessPool.h
    M Source/WebKit/WebProcess/InjectedBundle/API/APIInjectedBundlePageLoaderClient.h
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Source/WebKit/WebProcess/WebProcess.h
    M Source/WebKit/WebProcess/WebProcess.messages.in
    M Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm
    M Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h
    M Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.mm
    M Source/WebKitLegacy/win/ChangeLog
    M Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.cpp
    M Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.h
    M Source/WebKitLegacy/win/WebDownload.h
    M Source/WebKitLegacy/win/WebDownloadCFNet.cpp
    M Tools/ChangeLog
    M Tools/DumpRenderTree/TestRunner.cpp
    M Tools/DumpRenderTree/mac/TestRunnerMac.mm
    M Tools/TestWebKitAPI/Tests/WTF/Condition.cpp
    M Tools/TestWebKitAPI/Tests/WTF/ThreadGroup.cpp
    M Tools/TestWebKitAPI/Tests/WTF/WorkQueue.cpp
    M Tools/WebKitTestRunner/GeolocationProviderMock.cpp
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp

  Log Message:
  -----------
  Merge r228942 - Remove currentTime() / currentTimeMS()
https://bugs.webkit.org/show_bug.cgi?id=183052

Reviewed by Mark Lam.

Source/WebCore:

* Modules/geolocation/Geolocation.cpp:
(WebCore::Geolocation::haveSuitableCachedPosition):
* dom/DOMTimeStamp.h:
(WebCore::convertSecondsToDOMTimeStamp):
* fileapi/File.cpp:
(WebCore::File::File):
(WebCore::File::lastModified const):
* history/HistoryItem.cpp:
(WebCore::generateSequenceNumber):
* html/BaseDateAndTimeInputType.cpp:
(WebCore::BaseDateAndTimeInputType::defaultValueForStepUp const):
* html/DateTimeInputType.cpp:
(WebCore::DateTimeInputType::defaultValueForStepUp const):
* html/MonthInputType.cpp:
(WebCore::MonthInputType::defaultValueForStepUp const):
* html/TimeInputType.cpp:
(WebCore::TimeInputType::defaultValueForStepUp const):
* inspector/agents/InspectorNetworkAgent.cpp:
(WebCore::InspectorNetworkAgent::willSendRequest):
(WebCore::InspectorNetworkAgent::willSendWebSocketHandshakeRequest):
* loader/EmptyFrameLoaderClient.h:
* loader/FormSubmission.cpp:
(WebCore::generateFormDataIdentifier):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::clientRedirected):
* loader/FrameLoader.h:
* loader/FrameLoaderClient.h:
* loader/NavigationScheduler.cpp:
* page/History.cpp:
(WebCore::History::stateObjectAdded):
* page/History.h:
* page/PageOverlay.cpp:
(WebCore::PageOverlay::startFadeAnimation):
(WebCore::PageOverlay::fadeAnimationTimerFired):
* page/PageOverlay.h:
* platform/graphics/cg/GraphicsContextCG.cpp:
(WebCore::GraphicsContext::drawNativeImage):
* platform/ios/LegacyTileLayerPool.h:
* platform/ios/LegacyTileLayerPool.mm:
(WebCore::LegacyTileLayerPool::LegacyTileLayerPool):
(WebCore::LegacyTileLayerPool::addLayer):
(WebCore::LegacyTileLayerPool::decayedCapacity const):
(WebCore::LegacyTileLayerPool::prune):
* platform/ios/SystemMemoryIOS.cpp:
(WebCore::systemMemoryLevel):
* platform/mediastream/mac/DisplayCaptureSourceCocoa.cpp:
* platform/mediastream/mac/ScreenDisplayCaptureSourceMac.mm:

Source/WebKit:

* NetworkProcess/cache/CacheStorageEngineCache.cpp:
* PluginProcess/WebProcessConnection.cpp:
* Shared/WebProcessCreationParameters.h:
* Shared/linux/WebMemorySamplerLinux.cpp:
(WebKit::WebMemorySampler::sampleWebKit const):
* Shared/mac/WebMemorySampler.mac.mm:
(WebKit::WebMemorySampler::sampleWebKit const):
* UIProcess/API/C/WKContext.cpp:
(WKContextSetPlugInAutoStartOriginsFilteringOutEntriesAddedAfterTime):
* UIProcess/API/glib/IconDatabase.cpp:
(WebKit::IconDatabase::setIconDataForIconURL):
(WebKit::IconDatabase::synchronousLoadDecisionForIconURL):
(WebKit::IconDatabase::performURLImport):
* UIProcess/DrawingAreaProxyImpl.cpp:
* UIProcess/Plugins/PlugInAutoStartProvider.cpp:
(WebKit::expirationTimeFromNow):
(WebKit::PlugInAutoStartProvider::addAutoStartOriginHash):
(WebKit::PlugInAutoStartProvider::autoStartOriginsTableCopy const):
(WebKit::PlugInAutoStartProvider::setAutoStartOriginsTable):
(WebKit::PlugInAutoStartProvider::setAutoStartOriginsFilteringOutEntriesAddedAfterTime):
(WebKit::PlugInAutoStartProvider::setAutoStartOriginsTableWithItemsPassingTest):
(WebKit::PlugInAutoStartProvider::didReceiveUserInteraction):
* UIProcess/Plugins/PlugInAutoStartProvider.h:
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::processDidFinishLaunching):
(WebKit::WebProcessPool::startMemorySampler):
(WebKit::WebProcessPool::setPlugInAutoStartOriginsFilteringOutEntriesAddedAfterTime):
* UIProcess/WebProcessPool.h:
* WebProcess/InjectedBundle/API/APIInjectedBundlePageLoaderClient.h:
(API::InjectedBundle::PageLoaderClient::willPerformClientRedirectForFrame):
* WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp:
(WebKit::InjectedBundlePageLoaderClient::willPerformClientRedirectForFrame):
* WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.h:
* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchWillPerformClientRedirect):
* WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
* WebProcess/WebProcess.cpp:
(WebKit::m_webSQLiteDatabaseTracker):
(WebKit::WebProcess::isPlugInAutoStartOriginHash):
(WebKit::WebProcess::plugInDidStartFromOrigin):
(WebKit::WebProcess::didAddPlugInAutoStartOriginHash):
(WebKit::WebProcess::resetPlugInAutoStartOriginDefaultHashes):
(WebKit::WebProcess::resetPlugInAutoStartOriginHashes):
(WebKit::WebProcess::plugInDidReceiveUserInteraction):
* WebProcess/WebProcess.h:
* WebProcess/WebProcess.messages.in:
* WebProcess/cocoa/WebProcessCocoa.mm:
* WebProcess/wpe/WebProcessMainWPE.cpp:

Source/WebKitLegacy/mac:

* WebCoreSupport/WebFrameLoaderClient.h:
* WebCoreSupport/WebFrameLoaderClient.mm:
(WebFrameLoaderClient::dispatchWillPerformClientRedirect):

Source/WebKitLegacy/win:

* WebCoreSupport/WebFrameLoaderClient.cpp:
(WebFrameLoaderClient::dispatchWillPerformClientRedirect):
* WebCoreSupport/WebFrameLoaderClient.h:
* WebDownload.h:
* WebDownloadCFNet.cpp:
(WebDownload::didStart):
(WebDownload::didReceiveData):
(WebDownload::didFinish):

Source/WTF:

This patch removes WTF::currentTime() and WTF::currentTimeMS().
We have fancy WallTime APIs. It has strong types like WallTime and Seconds,
and this reduces the chance of bugs mixing doubles which represent milliseconds
and seconds.

* wtf/Condition.h:
* wtf/CurrentTime.cpp:
(WTF::currentTime):
(WTF::WallTime::now):
* wtf/CurrentTime.h:
(WTF::currentTimeMS): Deleted.
* wtf/DateMath.h:
(WTF::jsCurrentTime):
* wtf/ParkingLot.cpp:
(WTF::ParkingLot::parkConditionallyImpl):
* wtf/ThreadingPrimitives.h:
* wtf/ThreadingPthreads.cpp:
(WTF::ThreadCondition::timedWait):
* wtf/ThreadingWin.cpp:
(WTF::ThreadCondition::timedWait):
(WTF::absoluteTimeToWaitTimeoutInterval):
* wtf/WallTime.cpp:
(WTF::WallTime::now): Deleted.
* wtf/WallTime.h:

Tools:

* DumpRenderTree/TestRunner.cpp:
(preciseTimeCallback):
* DumpRenderTree/mac/TestRunnerMac.mm:
(TestRunner::setMockGeolocationPosition):
* TestWebKitAPI/Tests/WTF/Condition.cpp:
* TestWebKitAPI/Tests/WTF/ThreadGroup.cpp:
* TestWebKitAPI/Tests/WTF/WorkQueue.cpp:
* WebKitTestRunner/GeolocationProviderMock.cpp:
(WTR::GeolocationProviderMock::setPosition):
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::preciseTime):


  Commit: 20db6e21c1266696baad01e783f717755c21db20
      https://github.com/WebKit/WebKit/commit/20db6e21c1266696baad01e783f717755c21db20
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/IconDatabase.cpp

  Log Message:
  -----------
  Merge r228979 - Unreviewed GTK Debug build fix after r228942.

* UIProcess/API/glib/IconDatabase.cpp:
(WebKit::IconDatabase::iconDatabaseSyncThread):
(WebKit::IconDatabase::syncThreadMainLoop):
(WebKit::IconDatabase::readFromDatabase):
(WebKit::IconDatabase::writeToDatabase):
(WebKit::IconDatabase::cleanupSyncThread):


  Commit: ddd96a53f0d3d3da22fa46ce72d73b464fe3ea17
      https://github.com/WebKit/WebKit/commit/ddd96a53f0d3d3da22fa46ce72d73b464fe3ea17
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/has-indexed-property-array-storage.js
    A JSTests/stress/has-indexed-property-slow-put-array-storage.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r228943 - [FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage
https://bugs.webkit.org/show_bug.cgi?id=182792

Reviewed by Mark Lam.

JSTests:

* stress/has-indexed-property-array-storage.js: Added.
(shouldBe):
(test1):
(test2):
* stress/has-indexed-property-slow-put-array-storage.js: Added.
(shouldBe):
(test1):
(test2):

Source/JavaScriptCore:

This patch adds HasIndexedProperty for ArrayStorage and SlowPutArrayStorage in FTL.
HasIndexedProperty with ArrayStorage frequently causes FTL compilation failures
in web-tooling-benchmarks.

* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):


  Commit: 8ddb40fe8dc07cbbcd863a92aad0a6482a161108
      https://github.com/WebKit/WebKit/commit/8ddb40fe8dc07cbbcd863a92aad0a6482a161108
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r228944 - [GStreamer] media/video-src-blob-using-open-panel.html crashes in Debug
https://bugs.webkit.org/show_bug.cgi?id=183005

Reviewed by Xabier Rodriguez-Calvar.

Test: media/video-src-blob-using-open-panel.html

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::convertToInternalProtocol): Also convert blob URIs
because they're handled by our httpsrc element.
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcGetProtocols): Prefix blob URIs too, for consistency purpose.


  Commit: a19a0f5592a963526cd9a8a9244c549eefb7ee15
      https://github.com/WebKit/WebKit/commit/a19a0f5592a963526cd9a8a9244c549eefb7ee15
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r228945 - [GStreamer] HTTP totalBytes query returns 0 after seeking (sometimes)
https://bugs.webkit.org/show_bug.cgi?id=183002

Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webkit_web_src_init): Initialize member variables. Also no need
to set the appsrc size at that point.
(webKitWebSrcStop): There is no need to reset the size when
seeking. Size should in most cases represent the Content-Length
response attribute, even when seeking.
(webKitWebSrcStart): No need to reset the size attribute.
(webKitWebSrcQueryWithParent): Let appsrc handle DURATION queries.
(CachedResourceStreamingClient::responseReceived): Emit duration notification one time only.


  Commit: 4448058001312a00a46146a0c47ca7d23ab49ae6
      https://github.com/WebKit/WebKit/commit/4448058001312a00a46146a0c47ca7d23ab49ae6
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.h

  Log Message:
  -----------
  Merge r228948 - [RenderTreeBuilder] Add WARN_UNUSED_RETURN to detach()
https://bugs.webkit.org/show_bug.cgi?id=183073
<rdar://problem/37814585>

Reviewed by Antti Koivisto.

So that we don't destroy a renderer accidentally.

* rendering/updating/RenderTreeBuilderBlock.h:
* rendering/updating/RenderTreeBuilderRuby.h:
* rendering/updating/RenderTreeBuilderSVG.h:


  Commit: ea3dd77c76ee66a53d2a143494ddc04d817fb571
      https://github.com/WebKit/WebKit/commit/ea3dd77c76ee66a53d2a143494ddc04d817fb571
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/rendering/RenderFullScreen.cpp
    M Source/WebCore/rendering/RenderFullScreen.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderFullScreen.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFullScreen.h

  Log Message:
  -----------
  Merge r228949 - [RenderTreeBuilder] Move RenderFullScreen::createPlaceholder to RenderTreeBuilder
https://bugs.webkit.org/show_bug.cgi?id=183027
<rdar://problem/37773058>

Reviewed by Antti Koivisto.

No change in functionality.

* dom/Document.cpp:
(WebCore::Document::setFullScreenRenderer):
* dom/Document.h:
* rendering/RenderFullScreen.cpp:
(WebCore::RenderFullScreenPlaceholder::RenderFullScreenPlaceholder):
(WebCore::RenderFullScreenPlaceholder::isRenderFullScreenPlaceholder const):
(WebCore::RenderFullScreen::wrapNewRenderer):
(WebCore::RenderFullScreen::wrapExistingRenderer):
(): Deleted.
(WebCore::RenderFullScreen::createPlaceholder): Deleted.
* rendering/RenderFullScreen.h:
* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::createPlaceholderForFullScreen):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderFullScreen.cpp:
(WebCore::RenderTreeBuilder::FullScreen::createPlaceholder):
* rendering/updating/RenderTreeBuilderFullScreen.h:


  Commit: 3cf4c7b887f5045dcb630d7c83963355c6e3f3aa
      https://github.com/WebKit/WebKit/commit/3cf4c7b887f5045dcb630d7c83963355c6e3f3aa
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/stress/dead-fiat-value-to-int52-then-exit-not-double.js
    M JSTests/stress/dead-fiat-value-to-int52-then-exit-not-int52.js
    M JSTests/stress/dead-fiat-value-to-int52.js
    M JSTests/stress/dead-osr-entry-value.js
    M JSTests/stress/fiat-value-to-int52-then-exit-not-double.js
    M JSTests/stress/fiat-value-to-int52-then-exit-not-int52.js
    M JSTests/stress/fiat-value-to-int52-then-fail-to-fold.js
    M JSTests/stress/fiat-value-to-int52-then-fold.js
    M JSTests/stress/fiat-value-to-int52.js
    M JSTests/stress/fold-based-on-int32-proof-mul-branch.js
    M JSTests/stress/fold-profiled-call-to-call.js
    M JSTests/stress/fold-to-double-constant-then-exit.js
    M JSTests/stress/fold-to-int52-constant-then-exit.js
    M JSTests/stress/fold-to-primitive-in-cfa.js
    M JSTests/stress/fold-to-primitive-to-identity-in-cfa.js
    A JSTests/stress/has-indexed-property-array-storage-ftl.js
    A JSTests/stress/has-indexed-property-slow-put-array-storage-ftl.js
    M JSTests/stress/int52-ai-add-then-filter-int32.js
    M JSTests/stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js
    M JSTests/stress/int52-ai-mul-then-filter-int32.js
    M JSTests/stress/int52-ai-neg-then-filter-int32.js
    M JSTests/stress/int52-ai-sub-then-filter-int32.js
    M JSTests/stress/licm-pre-header-cannot-exit-nested.js
    M JSTests/stress/licm-pre-header-cannot-exit.js
    M JSTests/stress/sparse-array-entry-update-144067.js
    M JSTests/stress/test-spec-misc.js
    M JSTests/stress/tricky-array-bounds-checks.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/jsc.cpp
    M Source/JavaScriptCore/runtime/Intrinsic.cpp
    M Source/JavaScriptCore/runtime/Intrinsic.h
    M Source/JavaScriptCore/tools/JSDollarVM.cpp

  Log Message:
  -----------
  Merge r228950 - [JSC] Implement $vm.ftlTrue function for FTL testing
https://bugs.webkit.org/show_bug.cgi?id=183071

Reviewed by Mark Lam.

JSTests:

* stress/dead-fiat-value-to-int52-then-exit-not-double.js:
(foo):
* stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
(foo):
* stress/dead-fiat-value-to-int52.js:
(foo):
* stress/dead-osr-entry-value.js:
(foo):
* stress/fiat-value-to-int52-then-exit-not-double.js:
(foo):
* stress/fiat-value-to-int52-then-exit-not-int52.js:
(foo):
* stress/fiat-value-to-int52-then-fail-to-fold.js:
(foo):
* stress/fiat-value-to-int52-then-fold.js:
(foo):
* stress/fiat-value-to-int52.js:
(foo):
* stress/fold-based-on-int32-proof-mul-branch.js:
(foo):
* stress/fold-profiled-call-to-call.js:
(foo):
* stress/fold-to-double-constant-then-exit.js:
(foo):
* stress/fold-to-int52-constant-then-exit.js:
(foo):
* stress/fold-to-primitive-in-cfa.js:
(foo):
* stress/fold-to-primitive-to-identity-in-cfa.js:
(foo):
* stress/has-indexed-property-array-storage-ftl.js: Added.
(shouldBe):
(test1):
(test2):
* stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
(shouldBe):
(test1):
(test2):
* stress/int52-ai-add-then-filter-int32.js:
(foo):
* stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
(foo):
* stress/int52-ai-mul-then-filter-int32.js:
(foo):
* stress/int52-ai-neg-then-filter-int32.js:
(foo):
* stress/int52-ai-sub-then-filter-int32.js:
(foo):
* stress/licm-pre-header-cannot-exit-nested.js:
(foo):
* stress/licm-pre-header-cannot-exit.js:
(foo):
* stress/sparse-array-entry-update-144067.js:
(useMemoryToTriggerGCs):
* stress/test-spec-misc.js:
(foo):
* stress/tricky-array-bounds-checks.js:
(foo):

Source/JavaScriptCore:

Add $vm.ftlTrue, which becomes true if the caller is compiled in FTL.
This is useful for testing whether the caller function is compiled in FTL.

We also remove duplicate DFGTrue function in jsc.cpp. We have $vm.dfgTrue.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* jsc.cpp:
(GlobalObject::finishCreation):
(functionFalse1):
(functionFalse2): Deleted.
* runtime/Intrinsic.cpp:
(JSC::intrinsicName):
* runtime/Intrinsic.h:
* tools/JSDollarVM.cpp:
(JSC::functionFTLTrue):
(JSC::JSDollarVM::finishCreation):


  Commit: 4fe6f767031e2903cfb5b37447a97d63ccd5fe58
      https://github.com/WebKit/WebKit/commit/4fe6f767031e2903cfb5b37447a97d63ccd5fe58
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp

  Log Message:
  -----------
  Merge r228952 - ArgumentsEliminationPhase has a branch on GetByOffset that should be an assert
https://bugs.webkit.org/show_bug.cgi?id=182982

Reviewed by Yusuke Suzuki.

I don't know why this check was not always an assert. When we see
a GetByOffset on an eliminated allocation, that allocation *must*
be a PhantomClonedArguments. If it weren't, the GetByOffset would
have escaped it. Because this transformation happens by visiting
blocks in pre-order, and by visiting nodes in a block starting from
index zero to index block->size() - 1, we're guaranteed that eliminated
allocations get transformed before users of it, since we visit nodes
in dominator order.

* dfg/DFGArgumentsEliminationPhase.cpp:


  Commit: be0ec0ee0e5a4fbc4fefada1bcb777430ac5aad8
      https://github.com/WebKit/WebKit/commit/be0ec0ee0e5a4fbc4fefada1bcb777430ac5aad8
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Assertions.cpp

  Log Message:
  -----------
  Merge r228953 - warning: unused variable 'InitialBufferSize' in Assertions.cpp
https://bugs.webkit.org/show_bug.cgi?id=183076

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-23
Reviewed by Yusuke Suzuki.

* wtf/Assertions.cpp: Moved the definition of InitialBufferSize to inside #if.


  Commit: 796a0ede80f4729633ac2d0fe3ae2b08408d9755
      https://github.com/WebKit/WebKit/commit/796a0ede80f4729633ac2d0fe3ae2b08408d9755
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderContinuation.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderFullScreen.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderList.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMathML.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderMultiColumn.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderSVG.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.h
    M Source/WebCore/rendering/updating/RenderTreeUpdaterGeneratedContent.h

  Log Message:
  -----------
  Merge r228954 - [RenderTreeBuilder] Make RenderTreeBuilder::* classes WTF_MAKE_FAST_ALLOCATED
https://bugs.webkit.org/show_bug.cgi?id=183084
<rdar://problem/37828706>

Reviewed by Antti Koivisto.

* rendering/updating/RenderTreeBuilderBlock.h:
* rendering/updating/RenderTreeBuilderBlockFlow.h:
* rendering/updating/RenderTreeBuilderContinuation.h:
* rendering/updating/RenderTreeBuilderFirstLetter.h:
* rendering/updating/RenderTreeBuilderFormControls.h:
* rendering/updating/RenderTreeBuilderFullScreen.h:
* rendering/updating/RenderTreeBuilderInline.h:
* rendering/updating/RenderTreeBuilderList.h:
* rendering/updating/RenderTreeBuilderMathML.h:
* rendering/updating/RenderTreeBuilderMultiColumn.h:
* rendering/updating/RenderTreeBuilderRuby.h:
* rendering/updating/RenderTreeBuilderSVG.h:
* rendering/updating/RenderTreeBuilderTable.h:
* rendering/updating/RenderTreeUpdaterGeneratedContent.h:


  Commit: 3d4e80c22bacace67fabb8933f936b641186f8ef
      https://github.com/WebKit/WebKit/commit/3d4e80c22bacace67fabb8933f936b641186f8ef
  Author: Aleksandr Skachkov <gskachkov at gmail.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/wasm/function-tests/memory-reuse.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmBinding.cpp
    M Source/JavaScriptCore/wasm/WasmInstance.h
    M Source/JavaScriptCore/wasm/WasmMemory.cpp
    M Source/JavaScriptCore/wasm/WasmMemory.h
    M Source/JavaScriptCore/wasm/js/JSToWasm.cpp
    M Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp

  Log Message:
  -----------
  Merge r228966 - WebAssembly: cache memory address / size on instance
https://bugs.webkit.org/show_bug.cgi?id=177305

Reviewed by JF Bastien.

JSTests:

* wasm/function-tests/memory-reuse.js: Added.
(createWasmInstance):
(doCheckTrap):
(doMemoryGrow):
(doCheck):
(checkWasmInstancesWithSharedMemory):

Source/JavaScriptCore:

Cache memory address/size in wasm:Instance to avoid load wasm:Memory
object during access to memory and memory size property in JiT

* wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::B3IRGenerator::restoreWebAssemblyGlobalState):
(JSC::Wasm::B3IRGenerator::addCurrentMemory):
(JSC::Wasm::B3IRGenerator::addCallIndirect):
* wasm/WasmBinding.cpp:
(JSC::Wasm::wasmToWasm):
* wasm/WasmInstance.h:
(JSC::Wasm::Instance::cachedMemory const):
(JSC::Wasm::Instance::cachedMemorySize const):
(JSC::Wasm::Instance::createWeakPtr):
(JSC::Wasm::Instance::setMemory):
(JSC::Wasm::Instance::updateCachedMemory):
(JSC::Wasm::Instance::offsetOfCachedMemory):
(JSC::Wasm::Instance::offsetOfCachedMemorySize):
(JSC::Wasm::Instance::offsetOfCachedIndexingMask):
(JSC::Wasm::Instance::allocationSize):
* wasm/WasmMemory.cpp:
(JSC::Wasm::Memory::grow):
(JSC::Wasm::Memory::registerInstance):
* wasm/WasmMemory.h:
(JSC::Wasm::Memory::indexingMask):
* wasm/js/JSToWasm.cpp:
(JSC::Wasm::createJSToWasmWrapper):
* wasm/js/WebAssemblyModuleRecord.cpp:
(JSC::WebAssemblyModuleRecord::evaluate):


  Commit: 7f9f5492655af2b194a3f4152a98fcf6633dccfc
      https://github.com/WebKit/WebKit/commit/7f9f5492655af2b194a3f4152a98fcf6633dccfc
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/number-is-integer-intrinsic.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGOperations.cpp
    M Source/JavaScriptCore/dfg/DFGOperations.h
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/Intrinsic.cpp
    M Source/JavaScriptCore/runtime/Intrinsic.h
    M Source/JavaScriptCore/runtime/NumberConstructor.cpp
    M Source/JavaScriptCore/runtime/NumberConstructor.h

  Log Message:
  -----------
  Merge r228968 - Make Number.isInteger an intrinsic
https://bugs.webkit.org/show_bug.cgi?id=183088

Reviewed by JF Bastien.

JSTests:

* stress/number-is-integer-intrinsic.js: Added.

Source/JavaScriptCore:

When profiling the ML subtest in ARES, I noticed it was spending some
time in Number.isInteger. This patch makes that operation an intrinsic
in the DFG/FTL. It might be a speedup by 1% or so on that subtest, but
it's likely not an aggregate speedup on ARES. However, it is definitely
faster than calling into a builtin function, so we might as well have
it as an intrinsic.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileNumberIsInteger):
(JSC::FTL::DFG::LowerDFGToB3::unboxDouble):
* runtime/Intrinsic.cpp:
(JSC::intrinsicName):
* runtime/Intrinsic.h:
* runtime/NumberConstructor.cpp:
(JSC::NumberConstructor::finishCreation):
(JSC::numberConstructorFuncIsInteger):
* runtime/NumberConstructor.h:
(JSC::NumberConstructor::isIntegerImpl):


  Commit: c39317fd457e844a9f634e72c37a3e59baca38b1
      https://github.com/WebKit/WebKit/commit/c39317fd457e844a9f634e72c37a3e59baca38b1
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
    M Source/WebCore/page/SecurityOrigin.cpp
    M Source/WebCore/page/SecurityOrigin.h
    M Source/WebCore/platform/SchemeRegistry.cpp
    M Source/WebCore/platform/SchemeRegistry.h

  Log Message:
  -----------
  Merge r228972 - Crash under SchemeRegistry::shouldTreatURLSchemeAsLocal(WTF::String const&)
https://bugs.webkit.org/show_bug.cgi?id=183066
<rdar://problem/37804111>

Reviewed by Ryosuke Niwa.

SecurityOrigin objects are constructed on various threads. However, someone added a
shouldTreatAsPotentiallyTrustworthy() call to the SecurityOrigin constructor which
was not thread safe. This is because this function relies on SchemeRegistry::shouldTreatURLSchemeAsSecure()
and SchemeRegistry::shouldTreatURLSchemeAsLocal() which were relying on global static HashMaps without
locks.

Update SecurityOrigin to initialize m_isPotentiallyTrustworthy lazily, to avoid paying
initialization cost in the constructor. This is only queries by SecurityContext::isSecureContext().

Make SchemeRegistry::shouldTreatURLSchemeAsLocal() and SchemeRegistry::shouldTreatURLSchemeAsSecure()
thread-safe, since they are needed to initialize SecurityOrigin::m_isPotentiallyTrustworthy from
various threads.

SchemeRegistry::shouldTreatURLSchemeAsSecure() is only called from SecurityOrigin (which requires
thread-safety), and getUserMedia() which is not hot code so the extra locking there should not
be an issue.

SchemeRegistry::shouldTreatURLSchemeAsLocal() is called from SecurityOrigin (which requires thread-
safety). It is also called from isQuickLookPreviewURL(), MHTMLArchive::create(), Page::userStyleSheetLocationChanged(),
isRemoteWebArchive() and HTMLPlugInImageElement. All these are not hot code so I do not think
we need a fast path.

* page/SecurityOrigin.cpp:
(WebCore::isLoopbackIPAddress):
(WebCore::shouldTreatAsPotentiallyTrustworthy):
(WebCore::SecurityOrigin::isPotentiallyTrustworthy const):
(WebCore::SecurityOrigin::isLocalHostOrLoopbackIPAddress):
* page/SecurityOrigin.h:
* platform/SchemeRegistry.cpp:
(WebCore::localURLSchemesLock):
(WebCore::localURLSchemes):
(WebCore::secureSchemesLock):
(WebCore::secureSchemes):
(WebCore::SchemeRegistry::registerURLSchemeAsLocal):
(WebCore::SchemeRegistry::removeURLSchemeRegisteredAsLocal):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsLocal):
(WebCore::SchemeRegistry::registerURLSchemeAsSecure):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsSecure):
* platform/SchemeRegistry.h:


  Commit: 0820d5c9cefb0c10f723088814bd520f2bd95474
      https://github.com/WebKit/WebKit/commit/0820d5c9cefb0c10f723088814bd520f2bd95474
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/loader/DocumentLoader.h
    M Source/WebCore/loader/appcache/ApplicationCacheHost.cpp

  Log Message:
  -----------
  Merge r228975 - Null-dereference of the second argument `resource` of DocumentLoader::scheduleSubstituteResourceLoad
https://bugs.webkit.org/show_bug.cgi?id=182920

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-24
Reviewed by Darin Adler.

A test case
imported/w3c/web-platform-tests/html/browsers/offline/appcache/workers/appcache-worker.html
always crashes due to a null-dereference if compiled and optimized
by GCC 7.2. The second argument `resource` of
DocumentLoader::scheduleSubstituteResourceLoad can be null if the
resource can't be found in cache. I guess GCC optimizes inline
HashMap::add based on assuming the `resource` never becomes null
because its type is SubstituteResource&.

This changes introduces a new method
DocumentLoader::scheduleCannotShowURLError because it looks tricky
to pass a nullptr to the second argument of
scheduleSubstituteResourceLoad.

No new tests (Covered by existing tests).

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::scheduleCannotShowURLError): Added a new method.
* loader/DocumentLoader.h:
* loader/appcache/ApplicationCacheHost.cpp:
(WebCore::ApplicationCacheHost::maybeLoadResource):
Call scheduleCannotShowURLError if the resource not found in the appcache.


  Commit: 3e8f20b87e76dabffb6ceeff00aa9d368273e21a
      https://github.com/WebKit/WebKit/commit/3e8f20b87e76dabffb6ceeff00aa9d368273e21a
  Author: Alexey Proskuryakov <ap at webkit.org>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/TestController.cpp
    M Tools/WebKitTestRunner/TestInvocation.cpp
    M Tools/WebKitTestRunner/TestInvocation.h
    M Tools/WebKitTestRunner/cocoa/TestControllerCocoa.mm
    M Tools/WebKitTestRunner/ios/TestControllerIOS.mm
    M Tools/WebKitTestRunner/mac/TestControllerMac.mm

  Log Message:
  -----------
  Merge r228983 - Various crashes in WebKitTestRunner, especially when system is under heavy load
https://bugs.webkit.org/show_bug.cgi?id=183109

Reviewed by Tim Horton.

WebKitTestRunner had many places where it sent messages to WebContent with a timeout,
but it didn't handle the timeout when it did occur. Nearly all of those would result
in logic errors and failing tests, and most would even result in stack corruption,
as the response handler modified local variables.

There is only one timeout scenario that we actually mean to handle in WKTR. That's
when a test freezes after it is done (e.g. an infinite loop in beforeunload) - we don't
want to blame the next test for freezing, so we silently relaunch WebContent.
Everything else is cargo cult code that never worked.

This patch addresses the crashes, and actually makes tests pass a lot more on an
overloaded system.

* WebKitTestRunner/TestController.cpp:
(WTR::TestController::resetStateToConsistentValues): Moved m_doneResetting assignment
to where it's actually needed, for clarity.
(WTR::TestController::reattachPageToWebProcess): This function used to always hit
and ignore message timeout, as m_doneResetting is only updated by navigation callback
when the state is Resetting. This change makes it faster.
(WTR::TestController::platformResetStateToConsistentValues): Style fix.
(WTR::TestController::clearServiceWorkerRegistrations): Timing out here wasn't
handled in a meaningful manner, and would even corrupt the stack.
(WTR::TestController::clearDOMCache): Ditto.
(WTR::TestController::clearDOMCaches): Ditto.
(WTR::TestController::hasDOMCache): Ditto.
(WTR::TestController::domCacheSize): Ditto.
(WTR::TestController::isStatisticsPrevalentResource): Ditto.
(WTR::TestController::isStatisticsRegisteredAsSubFrameUnder): Ditto.
(WTR::TestController::isStatisticsRegisteredAsRedirectingTo): Ditto.
(WTR::TestController::isStatisticsHasHadUserInteraction): Ditto.
(WTR::TestController::isStatisticsGrandfathered): Ditto.
(WTR::TestController::statisticsUpdateCookiePartitioning): Ditto.
(WTR::TestController::statisticsSetShouldPartitionCookiesForHost): Ditto.
(WTR::TestController::statisticsClearInMemoryAndPersistentStore): Ditto.
(WTR::TestController::statisticsClearInMemoryAndPersistentStoreModifiedSinceHours): Ditto.
(WTR::TestController::statisticsClearThroughWebsiteDataRemoval): Ditto.

* WebKitTestRunner/TestInvocation.cpp:
(WTR::TestInvocation::shortTimeout const): Made shortTimeout shorter (on a hunch).
(WTR::TestInvocation::invoke): Removed a timeout waiting for initial response. There
is never a logical reason for such a timeout, as we always have a new or responsive
WebContent process here.
(WTR::TestInvocation::dumpResults): Removed another timeout that we don't know how to
properly handle.
(WTR::TestInvocation::didReceiveMessageFromInjectedBundle): Removed assignment to
m_errorMessage, which had no effect in this context.

* WebKitTestRunner/TestInvocation.h: Removed no longer used code.

* WebKitTestRunner/cocoa/TestControllerCocoa.mm:
(WTR::TestController::cocoaResetStateToConsistentValues): Use a named constant for
no timeout.

* WebKitTestRunner/ios/TestControllerIOS.mm:
(WTR::TestController::platformConfigureViewForTest): Removed a useless timeout.
Not sure if timing out here would corrupt the stack or not, but there is no reason
to impose arbitrary limits on individual steps of a test.

* WebKitTestRunner/mac/TestControllerMac.mm:
(WTR::TestController::platformConfigureViewForTest): Use a named constant for
no timeout.


  Commit: 8700e202778d586ec4124f52128c0c1c1502e15e
      https://github.com/WebKit/WebKit/commit/8700e202778d586ec4124f52128c0c1c1502e15e
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/ios-wk2/TestExpectations
    M LayoutTests/platform/wk2/TestExpectations
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp

  Log Message:
  -----------
  Merge r228984 - [WK2] http/tests/navigation/new-window-redirect-history.html crashes
https://bugs.webkit.org/show_bug.cgi?id=127683

Patch by Fujii Hironori <Hironori.Fujii at sony.com> on 2018-02-25
Reviewed by Dan Bernstein.

Tools:

m_previousTestBackForwardListItem was null for the new window.
m_previousTestBackForwardListItem is initialized only for the main
window in InjectedBundlePage::prepare.

* WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
(WTR::InjectedBundlePage::dumpBackForwardList):
Do null-check of m_previousTestBackForwardListItem.

LayoutTests:

* platform/ios-wk2/TestExpectations:
Unmarked http/tests/navigation/new-window-redirect-history.html.
* platform/wk2/TestExpectations: Ditto.


  Commit: 82911c582f9fe132f72ff391aa4cfc816a89dc52
      https://github.com/WebKit/WebKit/commit/82911c582f9fe132f72ff391aa4cfc816a89dc52
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/stress/has-indexed-property-array-storage-ftl.js
    M JSTests/stress/has-indexed-property-slow-put-array-storage-ftl.js

  Log Message:
  -----------
  Merge r228986 - Unreviewed, skip FTL tests if FTL is disabled
https://bugs.webkit.org/show_bug.cgi?id=183071

* stress/has-indexed-property-array-storage-ftl.js:
* stress/has-indexed-property-slow-put-array-storage-ftl.js:


  Commit: b39aeba9c811e42bdde6b63910c390c46952cbc4
      https://github.com/WebKit/WebKit/commit/b39aeba9c811e42bdde6b63910c390c46952cbc4
  Author: Commit Queue <commit-queue at webkit.org>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/inspector/network/har/har-page-expected.txt
    M LayoutTests/http/tests/inspector/network/har/har-page.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event.https-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/loader/NavigationScheduler.cpp

  Log Message:
  -----------
  Merge r229027 - Unreviewed, rolling out r226745.
https://bugs.webkit.org/show_bug.cgi?id=183132

This is breaking some websites (Requested by youenn on

Reverted changeset:

"Use no-cache fetch mode when loading main documents with
location.reload()"
https://bugs.webkit.org/show_bug.cgi?id=181285
https://trac.webkit.org/changeset/226745


  Commit: 5546cde38115230cb87beb69d889c35649d2ddc7
      https://github.com/WebKit/WebKit/commit/5546cde38115230cb87beb69d889c35649d2ddc7
  Author: Charlie Turner <cturner at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/messageports/MessagePortChannel.h

  Log Message:
  -----------
  Merge r229004 - Fix build error with !LOG_DISABLED
https://bugs.webkit.org/show_bug.cgi?id=183049

Reviewed by Philippe Normand.

The following error message was being reported when doing a
release build with -DLOG_DISABLED=0:

../../Source/WebCore/dom/messageports/MessagePortChannel.cpp: In member function ‘void WebCore::MessagePortChannel::entanglePortWithProcess(const WebCore::MessagePortIdentifier&, WebCore::ProcessIdentifier)’:


  Commit: 37cc3d44f2cd45455f8fd7b207cc1690e36ba13e
      https://github.com/WebKit/WebKit/commit/37cc3d44f2cd45455f8fd7b207cc1690e36ba13e
  Author: Youenn Fablet <youenn at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/MessagePort.cpp
    M Source/WebCore/dom/MessagePort.h
    M Source/WebCore/dom/messageports/MessagePortChannelProviderImpl.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp
    M Source/WebKit/WebProcess/WebProcess.cpp

  Log Message:
  -----------
  Merge r229028 - MessagePort is not always destroyed in the right thread
https://bugs.webkit.org/show_bug.cgi?id=183053

Patch by Youenn Fablet <youenn at apple.com> on 2018-02-26
Reviewed by Chris Dumez.

Source/WebCore:

Make existingMessagePortForIdentifier take a lambda so that we hold the lock until there
is no longer a need to keep the MessagePort around.
This is very time sensitive and does not happen a lot when running WPT tests.

Update existing call sites to pass a lambda.

* dom/MessagePort.cpp:
(WebCore::MessagePort::existingMessagePortForIdentifier):
* dom/MessagePort.h:
* dom/messageports/MessagePortChannelProviderImpl.cpp:
(WebCore::MessagePortChannelProviderImpl::postMessageToRemote):
(WebCore::MessagePortChannelProviderImpl::checkProcessLocalPortForActivity):

Source/WebKit:

Update code to pass a lambda to MessagePort::existingMessagePortForIdentifier.

* WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp:
(WebKit::WebMessagePortChannelProvider::checkProcessLocalPortForActivity):
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::messagesAvailableForPort):


  Commit: 67f53cd5966ea5045e8975eb680156583bd0c051
      https://github.com/WebKit/WebKit/commit/67f53cd5966ea5045e8975eb680156583bd0c051
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/dont-validate-stack-offset-in-b3-because-it-might-be-guarded-by-control-flow.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/b3/B3Validate.cpp

  Log Message:
  -----------
  Merge r229036 - validateStackAccess should not validate if the offset is within the stack bounds
https://bugs.webkit.org/show_bug.cgi?id=183067
<rdar://problem/37749988>

Reviewed by Mark Lam.

JSTests:

* stress/dont-validate-stack-offset-in-b3-because-it-might-be-guarded-by-control-flow.js: Added.
(assert):
(test.a):
(test.b):
(test):

Source/JavaScriptCore:

The validation rule was saying that any load from the stack must be
within the stack bounds of the frame. However, it's natural for a user
of B3 to emit code that may be outside of B3's stack bounds, but guard
such a load with a branch. The FTL does exactly this with GetMyArgumentByVal.
B3 is wrong to assert that this is a static property about all stack loads.

* b3/B3Validate.cpp:


  Commit: ca58a2af390a5beb82eae695533884a7aeb52fd1
      https://github.com/WebKit/WebKit/commit/ca58a2af390a5beb82eae695533884a7aeb52fd1
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/put-by-val-array-storage.js
    A JSTests/stress/put-by-val-direct-out-of-bounds-setter.js
    A JSTests/stress/put-by-val-slow-put-array-storage.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGOperations.cpp
    M Source/JavaScriptCore/dfg/DFGOperations.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.cpp
    M Source/JavaScriptCore/ftl/FTLAbstractHeapRepository.h
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r229053 - [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
https://bugs.webkit.org/show_bug.cgi?id=182965

Reviewed by Saam Barati.

JSTests:

* stress/put-by-val-array-storage.js: Added.
(shouldBe):
(testArrayStorageInBounds):
* stress/put-by-val-direct-out-of-bounds-setter.js: Added.
(shouldBe):
(testInt32.createBuiltin):
(set for):
* stress/put-by-val-slow-put-array-storage.js: Added.
(shouldBe):
(testArrayStorageInBounds):

Source/JavaScriptCore:

This patch extends FTL coverage for PutByVal by adding ArrayStorage and SlwoPutArrayStorage support.
Basically large part of the patch is porting from DFG code. Since PutByVal already emits CheckInBounds
for InBounds case, we do not have OutOfBounds check for that case.
This is the last change for FTL to support all the types of DFG nodes except for CreateThis.

* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileDoublePutByVal):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compilePutByVal):
(JSC::FTL::DFG::LowerDFGToB3::contiguousPutByValOutOfBounds):
For consistency, we use operationPutByValXXX and operationPutByValDirectXXX.
But except for SlowPutArrayStorage case, basically it is meaningless since
we do not have indexed accessors.


  Commit: 950c5e51a67c1a2288f8d59fcb9e12c50a17213f
      https://github.com/WebKit/WebKit/commit/950c5e51a67c1a2288f8d59fcb9e12c50a17213f
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/LinkBuffer.h
    M Source/JavaScriptCore/assembler/testmasm.cpp
    M Source/JavaScriptCore/b3/B3Compile.cpp
    M Source/JavaScriptCore/b3/air/testair.cpp
    M Source/JavaScriptCore/b3/testb3.cpp
    M Source/JavaScriptCore/bytecode/InlineAccess.cpp
    M Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp
    M Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp
    M Source/JavaScriptCore/dfg/DFGOSRExit.cpp
    M Source/JavaScriptCore/dfg/DFGThunks.cpp
    M Source/JavaScriptCore/ftl/FTLJITFinalizer.cpp
    M Source/JavaScriptCore/ftl/FTLLazySlowPath.cpp
    M Source/JavaScriptCore/ftl/FTLOSRExitCompiler.cpp
    M Source/JavaScriptCore/ftl/FTLThunks.cpp
    M Source/JavaScriptCore/jit/ExecutableAllocator.cpp
    M Source/JavaScriptCore/jit/JIT.cpp
    M Source/JavaScriptCore/jit/JITMathIC.h
    M Source/JavaScriptCore/jit/JITOpcodes.cpp
    M Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
    M Source/JavaScriptCore/jit/JITPropertyAccess.cpp
    M Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
    M Source/JavaScriptCore/jit/JITStubRoutine.h
    M Source/JavaScriptCore/jit/Repatch.cpp
    M Source/JavaScriptCore/jit/SpecializedThunkJIT.h
    M Source/JavaScriptCore/jit/ThunkGenerators.cpp
    M Source/JavaScriptCore/llint/LLIntThunks.cpp
    M Source/JavaScriptCore/wasm/WasmBBQPlan.cpp
    M Source/JavaScriptCore/wasm/WasmBinding.cpp
    M Source/JavaScriptCore/wasm/WasmOMGPlan.cpp
    M Source/JavaScriptCore/wasm/WasmThunks.cpp
    M Source/JavaScriptCore/wasm/js/WasmToJS.cpp
    M Source/JavaScriptCore/yarr/YarrJIT.cpp
    M Source/WebCore/ChangeLog
    M Source/WebCore/cssjit/SelectorCompiler.cpp

  Log Message:
  -----------
  Merge r229054 - Modernize FINALIZE_CODE and peer macros to use __VA_ARGS__ arguments.
https://bugs.webkit.org/show_bug.cgi?id=183159
<rdar://problem/37930837>

Reviewed by Keith Miller.

Source/JavaScriptCore:

* assembler/LinkBuffer.h:
* assembler/testmasm.cpp:
(JSC::compile):
* b3/B3Compile.cpp:
(JSC::B3::compile):
* b3/air/testair.cpp:
* b3/testb3.cpp:
(JSC::B3::testEntrySwitchSimple):
(JSC::B3::testEntrySwitchNoEntrySwitch):
(JSC::B3::testEntrySwitchWithCommonPaths):
(JSC::B3::testEntrySwitchWithCommonPathsAndNonTrivialEntrypoint):
(JSC::B3::testEntrySwitchLoop):
* bytecode/InlineAccess.cpp:
(JSC::linkCodeInline):
(JSC::InlineAccess::rewireStubAsJump):
* bytecode/PolymorphicAccess.cpp:
(JSC::PolymorphicAccess::regenerate):
* dfg/DFGJITFinalizer.cpp:
(JSC::DFG::JITFinalizer::finalize):
(JSC::DFG::JITFinalizer::finalizeFunction):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::compileOSRExit):
* dfg/DFGThunks.cpp:
(JSC::DFG::osrExitThunkGenerator):
(JSC::DFG::osrExitGenerationThunkGenerator):
(JSC::DFG::osrEntryThunkGenerator):
* ftl/FTLJITFinalizer.cpp:
(JSC::FTL::JITFinalizer::finalizeCommon):
* ftl/FTLLazySlowPath.cpp:
(JSC::FTL::LazySlowPath::generate):
* ftl/FTLOSRExitCompiler.cpp:
(JSC::FTL::compileStub):
* ftl/FTLThunks.cpp:
(JSC::FTL::genericGenerationThunkGenerator):
(JSC::FTL::slowPathCallThunkGenerator):
* jit/ExecutableAllocator.cpp:
* jit/JIT.cpp:
(JSC::JIT::link):
* jit/JITMathIC.h:
(JSC::isProfileEmpty):
* jit/JITOpcodes.cpp:
(JSC::JIT::privateCompileHasIndexedProperty):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::privateCompileHasIndexedProperty):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::stringGetByValStubGenerator):
(JSC::JIT::privateCompileGetByVal):
(JSC::JIT::privateCompileGetByValWithCachedId):
(JSC::JIT::privateCompilePutByVal):
(JSC::JIT::privateCompilePutByValWithCachedId):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::stringGetByValStubGenerator):
* jit/JITStubRoutine.h:
* jit/Repatch.cpp:
(JSC::linkPolymorphicCall):
* jit/SpecializedThunkJIT.h:
(JSC::SpecializedThunkJIT::finalize):
* jit/ThunkGenerators.cpp:
(JSC::throwExceptionFromCallSlowPathGenerator):
(JSC::linkCallThunkGenerator):
(JSC::linkPolymorphicCallThunkGenerator):
(JSC::virtualThunkFor):
(JSC::nativeForGenerator):
(JSC::arityFixupGenerator):
(JSC::unreachableGenerator):
(JSC::boundThisNoArgsFunctionCallGenerator):
* llint/LLIntThunks.cpp:
(JSC::LLInt::generateThunkWithJumpTo):
* wasm/WasmBBQPlan.cpp:
(JSC::Wasm::BBQPlan::complete):
* wasm/WasmBinding.cpp:
(JSC::Wasm::wasmToWasm):
* wasm/WasmOMGPlan.cpp:
(JSC::Wasm::OMGPlan::work):
* wasm/WasmThunks.cpp:
(JSC::Wasm::throwExceptionFromWasmThunkGenerator):
(JSC::Wasm::throwStackOverflowFromWasmThunkGenerator):
(JSC::Wasm::triggerOMGTierUpThunkGenerator):
* wasm/js/WasmToJS.cpp:
(JSC::Wasm::handleBadI64Use):
(JSC::Wasm::wasmToJS):
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::compile):

Source/WebCore:

No new tests needed because this is just a refactoring patch.

* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorCodeGenerator::compile):


  Commit: 9f476d2b245a20f96f1c1f28778ea31e296ff39d
      https://github.com/WebKit/WebKit/commit/9f476d2b245a20f96f1c1f28778ea31e296ff39d
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/stress/has-indexed-property-array-storage-ftl.js
    M JSTests/stress/has-indexed-property-slow-put-array-storage-ftl.js
    M Tools/ChangeLog
    M Tools/Scripts/run-jsc-stress-tests

  Log Message:
  -----------
  Merge r229057 - Unreviewed, skip FTL tests if FTL is disabled
https://bugs.webkit.org/show_bug.cgi?id=183071

JSTests:

* stress/has-indexed-property-array-storage-ftl.js:
* stress/has-indexed-property-slow-put-array-storage-ftl.js:

Tools:

* Scripts/run-jsc-stress-tests:


  Commit: d241d48b14711aad431074fdf66af18cdb5461b9
      https://github.com/WebKit/WebKit/commit/d241d48b14711aad431074fdf66af18cdb5461b9
  Author: Milan Crha <mcrha at redhat.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  Merge r229061 - Potential privacy issue: DNS prefetching can be re-enabled
https://bugs.webkit.org/show_bug.cgi?id=182924

Patch by Milan Crha <mcrha at redhat.com> on 2018-02-27
Reviewed by Michael Catanzaro.

* dom/Document.cpp:
(WebCore::Document::parseDNSPrefetchControlHeader):


  Commit: f8526d354b3c1a5aab1a6e6169835d3ff8d41312
      https://github.com/WebKit/WebKit/commit/f8526d354b3c1a5aab1a6e6169835d3ff8d41312
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Sources.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/rendering/InlineTextBox.cpp
    M Source/WebCore/rendering/InlineTextBox.h
    A Source/WebCore/rendering/MarkedText.cpp
    A Source/WebCore/rendering/MarkedText.h
    R Source/WebCore/rendering/MarkerSubrange.cpp
    R Source/WebCore/rendering/MarkerSubrange.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
    A Tools/TestWebKitAPI/Tests/WebCore/MarkedText.cpp
    R Tools/TestWebKitAPI/Tests/WebCore/MarkerSubrange.cpp

  Log Message:
  -----------
  Merge r229079 - Standardize terminology for marked text
https://bugs.webkit.org/show_bug.cgi?id=180999

Reviewed by Zalan Bujtas.

The name MarkerSubrange is a misnomer for a data structure that associates a text subrange with a type
and optional document marker. In particular, a MarkerSubrange may not always correspond to a document
marker. For instance, selected text is represented using a MarkerSubrange that does not have a
corresponding document marker. Let's standardize on the phrase "marked text" as the canonical way to
describe these tagged text subranges.

Source/WebCore:

* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* rendering/InlineTextBox.cpp:
(WebCore::InlineTextBox::localSelectionRect const):
(WebCore::InlineTextBox::MarkedTextStyle::areBackgroundMarkedTextStylesEqual):
(WebCore::InlineTextBox::MarkedTextStyle::areForegroundMarkedTextStylesEqual):
(WebCore::InlineTextBox::MarkedTextStyle::areDecorationMarkedTextStylesEqual):
(WebCore::InlineTextBox::StyledMarkedText::StyledMarkedText):
(WebCore::createMarkedTextFromSelectionInBox):
(WebCore::InlineTextBox::paint):
(WebCore::InlineTextBox::paintPlatformDocumentMarkers):
(WebCore::InlineTextBox::paintPlatformDocumentMarker):
(WebCore::InlineTextBox::computeStyleForUnmarkedMarkedText const):
(WebCore::InlineTextBox::resolveStyleForMarkedText):
(WebCore::InlineTextBox::subdivideAndResolveStyle):
(WebCore::InlineTextBox::coalesceAdjacentMarkedTexts):
(WebCore::InlineTextBox::collectMarkedTextsForDraggedContent):
(WebCore::InlineTextBox::collectMarkedTextsForDocumentMarkers):
(WebCore::InlineTextBox::paintMarkedTexts):
(WebCore::InlineTextBox::paintMarkedTextBackground):
(WebCore::InlineTextBox::paintMarkedTextForeground):
(WebCore::InlineTextBox::paintMarkedTextDecoration):
(WebCore::InlineTextBox::paintCompositionBackground):
(WebCore::InlineTextBox::MarkerSubrangeStyle::areBackgroundMarkerSubrangeStylesEqual): Deleted.
(WebCore::InlineTextBox::MarkerSubrangeStyle::areForegroundMarkerSubrangeStylesEqual): Deleted.
(WebCore::InlineTextBox::MarkerSubrangeStyle::areDecorationMarkerSubrangeStylesEqual): Deleted.
(WebCore::InlineTextBox::StyledMarkerSubrange::StyledMarkerSubrange): Deleted.
(WebCore::createMarkerSubrangeFromSelectionInBox): Deleted.
(WebCore::InlineTextBox::computeStyleForUnmarkedMarkerSubrange const): Deleted.
(WebCore::InlineTextBox::resolveStyleForSubrange): Deleted.
(WebCore::InlineTextBox::coalesceAdjacentSubranges): Deleted.
(WebCore::InlineTextBox::collectSubrangesForDraggedContent): Deleted.
(WebCore::InlineTextBox::collectSubrangesForDocumentMarkers): Deleted.
(WebCore::InlineTextBox::paintMarkerSubranges): Deleted.
(WebCore::InlineTextBox::paintTextSubrangeBackground): Deleted.
(WebCore::InlineTextBox::paintTextSubrangeForeground): Deleted.
(WebCore::InlineTextBox::paintTextSubrangeDecoration): Deleted.
* rendering/InlineTextBox.h:
(WebCore::InlineTextBox::paintMarkedTexts):
(WebCore::InlineTextBox::paintMarkerSubranges): Deleted.
* rendering/MarkedText.cpp: Renamed from Source/WebCore/rendering/MarkerSubrange.cpp.
(WebCore::subdivide):
* rendering/MarkedText.h: Renamed from Source/WebCore/rendering/MarkerSubrange.h.
(WebCore::MarkedText::MarkedText):
(WebCore::MarkedText::isEmpty const):
(WebCore::MarkedText::operator!= const):
(WebCore::MarkedText::operator== const):

Tools:

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebCore/MarkedText.cpp: Added.
(WebCore::operator<<):
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebCore/MarkerSubrange.cpp: Removed.


  Commit: 8847315675498c8bed371e5bb3ae1ae007ba921f
      https://github.com/WebKit/WebKit/commit/8847315675498c8bed371e5bb3ae1ae007ba921f
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/AbstractMacroAssembler.h
    M Source/JavaScriptCore/assembler/MacroAssembler.h
    M Source/JavaScriptCore/assembler/MacroAssemblerARM.h
    M Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
    M Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h
    M Source/JavaScriptCore/assembler/MacroAssemblerMIPS.h
    M Source/JavaScriptCore/assembler/MacroAssemblerX86.h
    M Source/JavaScriptCore/assembler/MacroAssemblerX86_64.h
    M Source/JavaScriptCore/bytecode/AccessCase.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/dfg/DFGThunks.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/ftl/FTLThunks.cpp
    M Source/JavaScriptCore/jit/AssemblyHelpers.cpp
    M Source/JavaScriptCore/jit/IntrinsicEmitter.cpp
    M Source/JavaScriptCore/jit/JITCall.cpp
    M Source/JavaScriptCore/jit/JITCall32_64.cpp
    M Source/JavaScriptCore/jit/ScratchRegisterAllocator.cpp
    M Source/JavaScriptCore/wasm/js/WasmToJS.cpp
    M Source/JavaScriptCore/yarr/YarrJIT.cpp

  Log Message:
  -----------
  Merge r229087 - Replace TrustedImmPtr(0) with TrustedImmPtr(nullptr)
https://bugs.webkit.org/show_bug.cgi?id=183195

Reviewed by Mark Lam.

* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::TrustedImmPtr::TrustedImmPtr):
* assembler/MacroAssembler.h:
(JSC::MacroAssembler::patchableBranchPtr):
(JSC::MacroAssembler::patchableBranchPtrWithPatch):
* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::branchPtrWithPatch):
(JSC::MacroAssemblerARM::storePtrWithPatch):
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::call):
(JSC::MacroAssemblerARM64::tailRecursiveCall):
(JSC::MacroAssemblerARM64::branchPtrWithPatch):
(JSC::MacroAssemblerARM64::patchableBranchPtrWithPatch):
(JSC::MacroAssemblerARM64::storePtrWithPatch):
* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::branchPtrWithPatch):
(JSC::MacroAssemblerARMv7::patchableBranchPtr):
(JSC::MacroAssemblerARMv7::patchableBranchPtrWithPatch):
(JSC::MacroAssemblerARMv7::storePtrWithPatch):
* assembler/MacroAssemblerMIPS.h:
(JSC::MacroAssemblerMIPS::branchPtrWithPatch):
(JSC::MacroAssemblerMIPS::storePtrWithPatch):
* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::branchPtrWithPatch):
* assembler/MacroAssemblerX86_64.h:
(JSC::MacroAssemblerX86_64::callWithSlowPathReturnType):
(JSC::MacroAssemblerX86_64::call):
(JSC::MacroAssemblerX86_64::tailRecursiveCall):
(JSC::MacroAssemblerX86_64::makeTailRecursiveCall):
(JSC::MacroAssemblerX86_64::branchPtrWithPatch):
* bytecode/AccessCase.cpp:
(JSC::AccessCase::generateImpl):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::emitAllocateRawObject):
(JSC::DFG::SpeculativeJIT::compileToLowerCase):
(JSC::DFG::SpeculativeJIT::compileMakeRope):
(JSC::DFG::SpeculativeJIT::compileGetTypedArrayByteOffset):
(JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
(JSC::DFG::SpeculativeJIT::compileCreateDirectArguments):
(JSC::DFG::SpeculativeJIT::compileNewArrayWithSpread):
(JSC::DFG::SpeculativeJIT::compileArraySlice):
(JSC::DFG::SpeculativeJIT::compileAllocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileReallocatePropertyStorage):
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::TrustedImmPtr::TrustedImmPtr):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitCall):
(JSC::DFG::SpeculativeJIT::compile):
(JSC::DFG::SpeculativeJIT::compileAllocateNewArrayWithSize):
* dfg/DFGThunks.cpp:
(JSC::DFG::osrExitGenerationThunkGenerator):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstruct):
(JSC::FTL::DFG::LowerDFGToB3::compileTailCall):
(JSC::FTL::DFG::LowerDFGToB3::compileCallOrConstructVarargs):
* ftl/FTLThunks.cpp:
(JSC::FTL::genericGenerationThunkGenerator):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::debugCall):
(JSC::AssemblyHelpers::sanitizeStackInline):
* jit/IntrinsicEmitter.cpp:
(JSC::IntrinsicGetterAccessCase::emitIntrinsicGetter):
* jit/JITCall.cpp:
(JSC::JIT::compileOpCall):
* jit/JITCall32_64.cpp:
(JSC::JIT::compileOpCall):
* jit/ScratchRegisterAllocator.cpp:
(JSC::ScratchRegisterAllocator::restoreUsedRegistersFromScratchBufferForCall):
* wasm/js/WasmToJS.cpp:
(JSC::Wasm::wasmToJS):
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::initParenContextFreeList):
(JSC::Yarr::YarrGenerator::storeToFrameWithPatch):
(JSC::Yarr::YarrGenerator::generate):


  Commit: 876d995fd026438ee9b47417bd0d0eeb8e98c98d
      https://github.com/WebKit/WebKit/commit/876d995fd026438ee9b47417bd0d0eeb8e98c98d
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/SelectorFilter.cpp

  Log Message:
  -----------
  Merge r229090 - Filter attribute selectors with selector filter
https://bugs.webkit.org/show_bug.cgi?id=183200

Reviewed by Zalan Bujtas.

Currently selector filtering is done based on tags, classes and ids. We should include attributes too.

This patch adds filtering based on attribute name (but not content).

* css/SelectorFilter.cpp:
(WebCore::isExcludedAttribute):

    Ignore id, class and style attributes. First two are already handled and the last is common but is rarely
    used in selectors.

(WebCore::collectElementIdentifierHashes):

    Collect attributes.
    Remove the unnecessary StyledElement casting.

(WebCore::collectSimpleSelectorHash):

    Collect attribute selectors.

(WebCore::chooseSelectorHashesForFilter):

    Pick attributes with high priority for the filter as it is likely a good signal.


  Commit: c28d42bbf429c0a53190aeb85f281efdcd866d9c
      https://github.com/WebKit/WebKit/commit/c28d42bbf429c0a53190aeb85f281efdcd866d9c
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h

  Log Message:
  -----------
  Merge r229091 - Remove RenderElement::s_affectsParentBlock
https://bugs.webkit.org/show_bug.cgi?id=183187
<rdar://problem/37961079>

Reviewed by Antti Koivisto.

Remove the hack to track floating/out-of-flow changes between styleWillChange and styleDidChange.

Covered by existing tests.

* rendering/RenderElement.cpp:
(WebCore::RenderElement::styleWillChange):
(WebCore::RenderElement::styleDidChange):
* rendering/RenderElement.h:


  Commit: 1af8276a7fe6c3ed10b79ba3a41322cb6e77a840
      https://github.com/WebKit/WebKit/commit/1af8276a7fe6c3ed10b79ba3a41322cb6e77a840
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/import-with-empty-string.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jsc.cpp

  Log Message:
  -----------
  Merge r229092 - JSC crash with `import("")`
https://bugs.webkit.org/show_bug.cgi?id=183175

Reviewed by Saam Barati.

JSTests:

* stress/import-with-empty-string.js: Added.

Source/JavaScriptCore:

Add file existence and file type check for module loader implementation in jsc.cpp.
This is not safe for TOCTOU, but it is OK since this functionality is used for the
JSC shell (jsc.cpp): testing purpose.

* jsc.cpp:
(fillBufferWithContentsOfFile):
(fetchModuleFromLocalFileSystem):


  Commit: dba6a54ddde735117c649022efa4a0448cdd1f6d
      https://github.com/WebKit/WebKit/commit/dba6a54ddde735117c649022efa4a0448cdd1f6d
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    A LayoutTests/http/wpt/html/browsers/browsing-the-web/navigating-across-documents/006-expected.txt
    A LayoutTests/http/wpt/html/browsers/browsing-the-web/navigating-across-documents/006.html
    A LayoutTests/http/wpt/html/browsers/browsing-the-web/navigating-across-documents/click.html
    A LayoutTests/http/wpt/html/browsers/browsing-the-web/navigating-across-documents/href.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp

  Log Message:
  -----------
  Merge r229108 - html/browsers/browsing-the-web/navigating-across-documents/006.html fails with async policy delegates
https://bugs.webkit.org/show_bug.cgi?id=183168
<rdar://problem/37951341>

Reviewed by Alex Christensen.

Source/WebCore:

The test has an anchor element with both a 'click' event handler which submits a form
and an href attribute. When clicking the link, as per specification, things happen in
this order:
1. We fire the click event at the anchor, which will execute the event handler and submit the form.
   Submitting the form *schedules* a navigation to 'click.html'.
2. We execute the anchor activation code which *navigates* to 'href.html'. The navigation to
   'href' is supposed to cancel the pending navigation to 'click.html' and we should navigate
   to 'href.html', which is what the test asserts.

The issue for us is that we do not cancel pending navigations until after the navigation
policy decision is made, when the provisional loads actually starts, in FrameLoader::provisionalLoadStarted().
Because the policy decision for the navigation can now be made asynchronously, the NavigationScheduler
timer can now fire while the decision is made and we'll submit the form, thus navigating to
'click.html'.

To address the issue, we now cancel any pending navigations in FrameLoader::loadWithDocumentLoader(),
*before* doing the policy check for the navigation.

Test: http/wpt/html/browsers/browsing-the-web/navigating-across-documents/006.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadWithDocumentLoader):

LayoutTests:

Add layout test coverage.

* TestExpectations:
* http/wpt/html/browsers/browsing-the-web/navigating-across-documents/006-expected.txt: Added.
* http/wpt/html/browsers/browsing-the-web/navigating-across-documents/006.html: Added.
* http/wpt/html/browsers/browsing-the-web/navigating-across-documents/click.html: Added.
* http/wpt/html/browsers/browsing-the-web/navigating-across-documents/href.html: Added.


  Commit: f834d5fa50abe41dbe27c2e9d2d5a70c4cefb62a
      https://github.com/WebKit/WebKit/commit/f834d5fa50abe41dbe27c2e9d2d5a70c4cefb62a
  Author: JF Bastien <jfbastien at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/Heap.cpp

  Log Message:
  -----------
  Merge r229109 - GC should sweep code block before deleting
https://bugs.webkit.org/show_bug.cgi?id=183229
<rdar://problem/32767615>

Reviewed by Saam Barati, Fil Pizlo.

Stub routines shouldn't get deleted before codeblocks have been
swept, otherwise there's a small race window where the codeblock
thinks it's still reachable.

* heap/Heap.cpp:
(JSC::Heap::deleteUnmarkedCompiledCode):
(JSC::Heap::sweepInFinalize):


  Commit: 87c97d83bd08e47151e4369d55806c0a463158da
      https://github.com/WebKit/WebKit/commit/87c97d83bd08e47151e4369d55806c0a463158da
  Author: Dominik Infuehr <dinfuehr at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
    M Source/JavaScriptCore/yarr/YarrInterpreter.cpp

  Log Message:
  -----------
  Merge r229125 - [ARM] Fix compile error in debug builds by invoking unpoisoned().

Patch by Dominik Infuehr <dinfuehr at igalia.com> on 2018-02-28
Reviewed by Mark Lam.

* assembler/MacroAssemblerCodeRef.h:
(JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr): Fix compile error.
(JSC::MacroAssemblerCodePtr::createFromExecutableAddress()): Ditto.
(JSC::MacroAssemblerCodePtr::dataLocation()): Ditto.
* yarr/YarrInterpreter.cpp:
(JSC::Yarr::ByteCompiler::dumpDisjunction): use %zu for printf'ing size_t.


  Commit: 7ab277aeea68f1a2854a3ff9575cc5381858febc
      https://github.com/WebKit/WebKit/commit/7ab277aeea68f1a2854a3ff9575cc5381858febc
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
    M Source/WebKit/UIProcess/gtk/WaylandCompositor.h

  Log Message:
  -----------
  Merge r229126 - REGRESSION(r221514): [GTK] UI process crash in WebKit::WaylandCompositor::Surface::flushPendingFrameCallbacks
https://bugs.webkit.org/show_bug.cgi?id=183091

Reviewed by Michael Catanzaro.

Invalidate the surface in the page map when the backing store is destroyed.

* UIProcess/gtk/WaylandCompositor.cpp:
(WebKit::WaylandCompositor::willDestroySurface):
* UIProcess/gtk/WaylandCompositor.h:


  Commit: 11e77040976f0fe0a6de91db02266f34e85d031f
      https://github.com/WebKit/WebKit/commit/11e77040976f0fe0a6de91db02266f34e85d031f
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/freetype/FontCacheFreeType.cpp
    M Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp

  Log Message:
  -----------
  Merge r229128 - [FreeType] Color emojis in WebKitGTK+ for great justice
https://bugs.webkit.org/show_bug.cgi?id=183155

Reviewed by Michael Catanzaro.

Emojis are actually rendered if there's an emoji font installed in the system, but the size is so tiny that we
don't see them. This is because for some reason the matrix we are getting from fontconfig contains a scale,
which we don't expect. We only get the fontconfig matrix to apply rotations in case of oblique fonts, and then we
always apply the scale for the computed pixel font size. Ignoring the fontconfig matrix scale fixes the issue.

* platform/graphics/freetype/FontCacheFreeType.cpp:
(WebCore::fontWeightToFontconfigWeight): Moved here since it's now used by configurePatternForFontDescription().
(WebCore::configurePatternForFontDescription): Helper function to apply the same options for fallback pattern.
(WebCore::createFontConfigPatternForCharacters): Use configurePatternForFontDescription().
(WebCore::findBestFontGivenFallbacks): Adopt the returned reference.
(WebCore::FontCache::systemFallbackForCharacters): Clean it up.
(WebCore::FontCache::createFontPlatformData): Use configurePatternForFontDescription().
* platform/graphics/freetype/FontPlatformDataFreeType.cpp:
(WebCore::FontPlatformData::buildScaledFont): Ignore the scale returned by fontconfig matrix.


  Commit: c783d1ded9a95feb67615b07bdacfbc08d20bd24
      https://github.com/WebKit/WebKit/commit/c783d1ded9a95feb67615b07bdacfbc08d20bd24
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jsc.cpp

  Log Message:
  -----------
  Merge r229129 - Unreviewed, fix exception check for ExceptionScope
https://bugs.webkit.org/show_bug.cgi?id=183175

* jsc.cpp:
(GlobalObject::moduleLoaderFetch):


  Commit: 4e1c5bb169182b1907c640ad3345c621d87eee64
      https://github.com/WebKit/WebKit/commit/4e1c5bb169182b1907c640ad3345c621d87eee64
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/loader/iframe-src-invalid-url-expected.txt
    M LayoutTests/fast/loader/policy-delegate-action-hit-test-zoomed-expected.txt
    A LayoutTests/http/wpt/html/browsers/windows/browsing-context-expected.txt
    A LayoutTests/http/wpt/html/browsers/windows/browsing-context.html
    M LayoutTests/loader/navigation-policy/should-open-external-urls/subframe-click-target-self-expected.txt
    M LayoutTests/loader/navigation-policy/should-open-external-urls/subframe-click-target-top-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/PolicyChecker.cpp

  Log Message:
  -----------
  Merge r229133 - imported/w3c/web-platform-tests/html/browsers/windows/browsing-context.html fails with async policy delegates
https://bugs.webkit.org/show_bug.cgi?id=183225
<rdar://problem/38003828>

Reviewed by Alex Christensen.

Source/WebCore:

Bypass navigation policy check when loading about:blank. This does not seem necessary and it would not
be Web-compatible for such policy check to happen synchronously. This is because an iframe without src
or src="about:blank" should load synchronously as per HTML specification.

Test: http/wpt/html/browsers/windows/browsing-context.html

* loader/PolicyChecker.cpp:
(WebCore::PolicyChecker::checkNavigationPolicy):

LayoutTests:

* http/wpt/html/browsers/windows/browsing-context-expected.txt: Added.
* http/wpt/html/browsers/windows/browsing-context.html: Added.
Add layout test coverage.

* fast/loader/iframe-src-invalid-url-expected.txt:
* fast/loader/policy-delegate-action-hit-test-zoomed-expected.txt:
* loader/navigation-policy/should-open-external-urls/subframe-click-target-self-expected.txt:
* loader/navigation-policy/should-open-external-urls/subframe-click-target-top-expected.txt:
Rebaseline a few layout tests now that the log lines for the about:blank policy checks are
gone.


  Commit: cf8a4e94894131cd262180db1eba26fce4ee3064
      https://github.com/WebKit/WebKit/commit/cf8a4e94894131cd262180db1eba26fce4ee3064
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/cache/NetworkCacheEntry.cpp

  Log Message:
  -----------
  Merge r229134 - Crash when updating cache entry after validation in apps that uses class A file protection
https://bugs.webkit.org/show_bug.cgi?id=183242
<rdar://problem/33289058>

Reviewed by Chris Dumez.

When validating a cache entry, we keep it alive until we get a network response. With 304 response
we then update the headers of this existing entry. This accesses the body data of the entry which
may be backed by a mapped file. If the app uses class A protection, user might have locked
the device and the entry might have become inaccessible, leading to a crash.

* NetworkProcess/cache/NetworkCacheEntry.cpp:
(WebKit::NetworkCache::Entry::setNeedsValidation):

In case of class A protection, pull the data to a memory buffer immediately before starting a revalidation request.
This makes the window where the file could become inaccessible much shorter (since it no longer depends on network).


  Commit: 927f2436bd2ded771a19134b8b8ed59e1e0a79dc
      https://github.com/WebKit/WebKit/commit/927f2436bd2ded771a19134b8b8ed59e1e0a79dc
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h

  Log Message:
  -----------
  Merge r229137 - Remove RenderElement::s_noLongerAffectsParentBlock
https://bugs.webkit.org/show_bug.cgi?id=183196
<rdar://problem/38030797>

Reviewed by Antti Koivisto.

Remove the hack to track floating/out-of-flow changes between styleWillChange and styleDidChange.

Covered by existing tests.

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::styleDidChange):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::styleWillChange):
(WebCore::RenderElement::noLongerAffectsParentBlock const):
(WebCore::RenderElement::styleDidChange):
* rendering/RenderElement.h:
(WebCore::RenderElement::noLongerAffectsParentBlock const): Deleted.


  Commit: 4086270a48f2238ce8b627f49a3c2df0f2545108
      https://github.com/WebKit/WebKit/commit/4086270a48f2238ce8b627f49a3c2df0f2545108
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsCommon.cmake

  Log Message:
  -----------
  Merge r229155 - [CMake] configure failure for aarch64
https://bugs.webkit.org/show_bug.cgi?id=183268

Unreviewed build fix. This failure is caused by a simple typo.

* Source/cmake/OptionsCommon.cmake:


  Commit: b444158c01a958a1ecb8db29149d84f871a2f807
      https://github.com/WebKit/WebKit/commit/b444158c01a958a1ecb8db29149d84f871a2f807
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/having-a-bad-time-with-derived-arrays.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/FunctionRareData.h
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
    M Source/JavaScriptCore/runtime/StructureCache.h

  Log Message:
  -----------
  We need to clear cached structures when having a bad time
https://bugs.webkit.org/show_bug.cgi?id=183256
<rdar://problem/36245022>

Reviewed by Mark Lam.

JSTests:

* stress/having-a-bad-time-with-derived-arrays.js: Added.
(assert):
(defineSetter):
(iterate):
(doSlice):

Source/JavaScriptCore:

This patch makes both InternalFunctionAllocationProfile and the VM's
structure cache having-a-bad-time aware. For InternalFunctionAllocationProfile,
we clear them when they'd produce an object with a bad indexing type.
For the VM's Structure cache, we conservatively clear the entire cache
since it may be housing Structures with bad indexing types.

* runtime/FunctionRareData.h:
(JSC::FunctionRareData::clearInternalFunctionAllocationProfile):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::haveABadTime):
* runtime/StructureCache.h:
(JSC::StructureCache::clear):


  Commit: 88eb309d186e10bde61c9947466ae1b531760078
      https://github.com/WebKit/WebKit/commit/88eb309d186e10bde61c9947466ae1b531760078
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/async-arrow-function-in-class-heritage.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/parser/Parser.cpp

  Log Message:
  -----------
  Merge r229162 - ASSERTION FAILED: matchContextualKeyword(m_vm->propertyNames->async)
https://bugs.webkit.org/show_bug.cgi?id=183173

Reviewed by Saam Barati.

JSTests:

* stress/async-arrow-function-in-class-heritage.js: Added.
(testSyntax):
(testSyntaxError):
(SyntaxError):

Source/JavaScriptCore:

Classifier could propagate an error which does not occur at the first token
of the given expression. We should check whether the given token is "async"
instead of assertion.

* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseAssignmentExpression):


  Commit: 45301a6e63091f66e45c4cab9e748b0836fe4c1d
      https://github.com/WebKit/WebKit/commit/45301a6e63091f66e45c4cab9e748b0836fe4c1d
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/fast/text/international/bidi-LDB-2-CSS-expected.png
    M LayoutTests/platform/gtk/fast/text/international/bidi-LDB-2-CSS-expected.txt
    M LayoutTests/platform/gtk/fast/text/international/bidi-LDB-2-HTML-expected.png
    M LayoutTests/platform/gtk/fast/text/international/bidi-LDB-2-HTML-expected.txt
    M LayoutTests/platform/gtk/fast/text/international/bidi-LDB-2-formatting-characters-expected.png
    M LayoutTests/platform/gtk/fast/text/international/bidi-LDB-2-formatting-characters-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/FontPlatformData.h
    M Source/WebCore/platform/graphics/freetype/FontCacheFreeType.cpp
    M Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp

  Log Message:
  -----------
  Merge r229164 - [FreeType] Remove FontPlatformData fallbacks
https://bugs.webkit.org/show_bug.cgi?id=183210

Reviewed by Michael Catanzaro.

Source/WebCore:

They are only used by FontCache::systemFallbackForCharacters() where a direct FcFontMatch provides the same
or better results.

* platform/graphics/FontPlatformData.h: Remove fallbacks.
* platform/graphics/freetype/FontCacheFreeType.cpp:
(WebCore::FontCache::systemFallbackForCharacters): Use FcFontMatch() only.
* platform/graphics/freetype/FontPlatformDataFreeType.cpp:
(WebCore::FontPlatformData::fallbacks): Removed.

LayoutTests:

Rebaseline 3 tests that progressed.

* platform/gtk/fast/text/international/bidi-LDB-2-CSS-expected.png:
* platform/gtk/fast/text/international/bidi-LDB-2-CSS-expected.txt:
* platform/gtk/fast/text/international/bidi-LDB-2-HTML-expected.png:
* platform/gtk/fast/text/international/bidi-LDB-2-HTML-expected.txt:
* platform/gtk/fast/text/international/bidi-LDB-2-formatting-characters-expected.png:
* platform/gtk/fast/text/international/bidi-LDB-2-formatting-characters-expected.txt:


  Commit: 11d40a534450e451a573994fbbc76f151cd79446
      https://github.com/WebKit/WebKit/commit/11d40a534450e451a573994fbbc76f151cd79446
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/combining-enclosing-keycap.html
    M LayoutTests/platform/gtk/TestExpectations
    A LayoutTests/platform/gtk/fast/text/combining-enclosing-keycap-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/FontCairoHarfbuzzNG.cpp
    M Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp

  Log Message:
  -----------
  Merge r229165 - REGRESSION(r222843): [HarfBuzz] Combining enclosed keycap not correctly handled
https://bugs.webkit.org/show_bug.cgi?id=183246

Reviewed by Michael Catanzaro.

Source/WebCore:

We are not correctly handling the combining enclosed keycap since we switched to use
ComplexTextController. This is because fontForCombiningCharacterSequence() always returns the font of the first
character, without checking if that font can render the whole sequence or not. Before 222843, the shaper did
that check when creating the text runs. In this case the sequence was split and a different font was used for the
text and the mark. This patch makes fontForCombiningCharacterSequence() try to find a suitable font for the
whole sequence, first looking at the CSS fallbacks and finally at system ones. The result is much better than
the old one, because we use the same font for both the text and the mark. If there isn't any font to render the
mark, then we fallback to use the first character font, since we will end up rendering the missing glyph
character, it's better to use the same font than the first character one.

Test: fast/text/combining-enclosing-keycap.html

* platform/graphics/cairo/FontCairoHarfbuzzNG.cpp:
(WebCore::FontCascade::fontForCombiningCharacterSequence const): Check if the first charatcer font can render
the whole sequence, trying with fallbacks otherwise.
* platform/graphics/freetype/SimpleFontDataFreeType.cpp:
(WebCore::Font::canRenderCombiningCharacterSequence const): Check if the font face has glyphs for the whole
sequence not just the first character.

LayoutTests:

* fast/text/combining-enclosing-keycap-expected.txt: Added.
* platform/gtk/fast/text/combining-enclosing-keycap.html: Added.
* platform/gtk/TestExpectations:


  Commit: 2bc682a2fe3affaa3c4c6a9f60ccda370cba013b
      https://github.com/WebKit/WebKit/commit/2bc682a2fe3affaa3c4c6a9f60ccda370cba013b
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M WebDriverTests/ChangeLog
    M WebDriverTests/imported/w3c/importer.json
    M WebDriverTests/imported/w3c/tools/webdriver/webdriver/transport.py
    M WebDriverTests/imported/w3c/tools/wptrunner/MANIFEST.in
    M WebDriverTests/imported/w3c/tools/wptrunner/README.rst
    M WebDriverTests/imported/w3c/tools/wptrunner/requirements.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/requirements_chrome.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/requirements_edge.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/requirements_firefox.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/requirements_ie.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/requirements_opera.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/requirements_sauce.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/requirements_servo.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/setup.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/chrome.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/chrome_android.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/edge.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/firefox.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/ie.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/opera.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/sauce.py
    R WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/server-locations.txt
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/servo.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/browsers/servodriver.py
    R WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/config.json
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/environment.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/executors/executorservo.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/font.py
    R WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/hosts.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/testrunner.py
    A WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/tests/browsers/__init__.py
    R WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/tests/test_hosts.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/webdriver_server.py
    M WebDriverTests/imported/w3c/tools/wptrunner/wptrunner/wptrunner.py
    M WebDriverTests/imported/w3c/webdriver/OWNERS
    M WebDriverTests/imported/w3c/webdriver/tests/actions/mouse.py
    M WebDriverTests/imported/w3c/webdriver/tests/actions/mouse_dblclick.py
    A WebDriverTests/imported/w3c/webdriver/tests/actions/pointer_origin.py
    M WebDriverTests/imported/w3c/webdriver/tests/actions/support/mouse.py
    M WebDriverTests/imported/w3c/webdriver/tests/element_click/bubbling.py
    M WebDriverTests/imported/w3c/webdriver/tests/element_click/select.py
    M WebDriverTests/imported/w3c/webdriver/tests/element_send_keys/form_controls.py
    M WebDriverTests/imported/w3c/webdriver/tests/element_send_keys/interactability.py
    M WebDriverTests/imported/w3c/webdriver/tests/execute_script/cyclic.py
    M WebDriverTests/imported/w3c/webdriver/tests/fullscreen_window.py
    M WebDriverTests/imported/w3c/webdriver/tests/interface.html
    M WebDriverTests/imported/w3c/webdriver/tests/state/get_element_property.py

  Log Message:
  -----------
  Merge r229166 - Unreviewed. Update W3C WebDriver imported tests.

* imported/w3c/importer.json:
* imported/w3c/tools/webdriver/webdriver/transport.py:
* imported/w3c/tools/wptrunner/MANIFEST.in:
* imported/w3c/tools/wptrunner/README.rst:
* imported/w3c/tools/wptrunner/requirements.txt:
* imported/w3c/tools/wptrunner/requirements_chrome.txt:
* imported/w3c/tools/wptrunner/requirements_edge.txt:
* imported/w3c/tools/wptrunner/requirements_firefox.txt:
* imported/w3c/tools/wptrunner/requirements_ie.txt:
* imported/w3c/tools/wptrunner/requirements_opera.txt:
* imported/w3c/tools/wptrunner/requirements_sauce.txt:
* imported/w3c/tools/wptrunner/requirements_servo.txt:
* imported/w3c/tools/wptrunner/setup.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/chrome.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/chrome_android.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/edge.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/firefox.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/ie.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/opera.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/sauce.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/server-locations.txt: Removed.
* imported/w3c/tools/wptrunner/wptrunner/browsers/servo.py:
* imported/w3c/tools/wptrunner/wptrunner/browsers/servodriver.py:
* imported/w3c/tools/wptrunner/wptrunner/config.json: Removed.
* imported/w3c/tools/wptrunner/wptrunner/environment.py:
* imported/w3c/tools/wptrunner/wptrunner/executors/executorservo.py:
* imported/w3c/tools/wptrunner/wptrunner/font.py:
* imported/w3c/tools/wptrunner/wptrunner/hosts.py: Removed.
* imported/w3c/tools/wptrunner/wptrunner/testrunner.py:
* imported/w3c/tools/wptrunner/wptrunner/tests/browsers/__init__.py: Added.
* imported/w3c/tools/wptrunner/wptrunner/tests/test_hosts.py: Removed.
* imported/w3c/tools/wptrunner/wptrunner/webdriver_server.py:
* imported/w3c/tools/wptrunner/wptrunner/wptrunner.py:
* imported/w3c/webdriver/OWNERS:
* imported/w3c/webdriver/tests/actions/mouse.py:
* imported/w3c/webdriver/tests/actions/mouse_dblclick.py:
* imported/w3c/webdriver/tests/actions/pointer_origin.py: Added.
* imported/w3c/webdriver/tests/actions/support/mouse.py:
* imported/w3c/webdriver/tests/element_click/bubbling.py:
* imported/w3c/webdriver/tests/element_click/select.py:
* imported/w3c/webdriver/tests/element_send_keys/form_controls.py:
* imported/w3c/webdriver/tests/element_send_keys/interactability.py:
* imported/w3c/webdriver/tests/execute_script/cyclic.py:
* imported/w3c/webdriver/tests/fullscreen_window.py:
* imported/w3c/webdriver/tests/interface.html:
* imported/w3c/webdriver/tests/state/get_element_property.py:


  Commit: 8915eb877664b3672cf96564da1f1a6c5f969128
      https://github.com/WebKit/WebKit/commit/8915eb877664b3672cf96564da1f1a6c5f969128
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M WebDriverTests/ChangeLog
    M WebDriverTests/TestExpectations.json

  Log Message:
  -----------
  Merge r229167 - Unreviewed gardening. Skip new action tests added in r229166.

* TestExpectations.json:


  Commit: 8f627a01947c5ac13c466b78f0002155ca90e6bf
      https://github.com/WebKit/WebKit/commit/8f627a01947c5ac13c466b78f0002155ca90e6bf
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.js

  Log Message:
  -----------
  Merge r229210 - Automation: stale elements not detected when removed from the DOM
https://bugs.webkit.org/show_bug.cgi?id=183278

Reviewed by Brian Burg.

We detect stale elements when the page is reloaded because the maps are recreated, but if an element is removed
from the DOM for the same document we keep the nodes in the maps. We should clear stale elements before
accessing the maps.

Fixes: imported/selenium/py/test/selenium/webdriver/common/webdriverwait_tests.py::testExpectedConditionStalenessOf

* WebProcess/Automation/WebAutomationSessionProxy.js:
(let.AutomationSessionProxy.prototype.evaluateJavaScriptFunction): Call _clearStaleNodes()
(let.AutomationSessionProxy.prototype.nodeForIdentifier): Ditto.
(let.AutomationSessionProxy.prototype._clearStaleNodes): Check if cached nodes are still in document and remove them
from the maps if they aren't.


  Commit: 08f0e136a131c6c39847022f49fa6e1ae57784cd
      https://github.com/WebKit/WebKit/commit/08f0e136a131c6c39847022f49fa6e1ae57784cd
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebDriver/ChangeLog
    M Source/WebDriver/Session.cpp

  Log Message:
  -----------
  Merge r229211 - WebDriver: Also ignore NoSuchwindow errors when waiting for navigation to complete
https://bugs.webkit.org/show_bug.cgi?id=183280

Reviewed by Brian Burg.

We currently ignore NoSuchFrame, but navigation or previous command might have closed the window too.

Fixes: imported/selenium/py/test/selenium/webdriver/common/window_switching_tests.py::testClickingOnAButtonThatClosesAnOpenWindowDoesNotCauseTheBrowserToHang
       imported/selenium/py/test/selenium/webdriver/common/window_switching_tests.py::testCanCallGetWindowHandlesAfterClosingAWindow

* Session.cpp:
(WebDriver::Session::waitForNavigationToComplete): Ignore NoSuchWindow errors.


  Commit: ddbbd7f5450094a1a89d188ca618913cdeb76e36
      https://github.com/WebKit/WebKit/commit/ddbbd7f5450094a1a89d188ca618913cdeb76e36
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp

  Log Message:
  -----------
  Merge r229212 - Automation: clicking on a disabled option element shouldn't produce an error
https://bugs.webkit.org/show_bug.cgi?id=183284

Reviewed by Brian Burg.

This was expected by selenium, but the WebDriver spec says we should simply do nothing in those cases.

14.1 Element Click.
https://w3c.github.io/webdriver/webdriver-spec.html#element-click

Fixes: imported/w3c/webdriver/tests/element_click/select.py::test_option_disabled

* WebProcess/Automation/WebAutomationSessionProxy.cpp:
(WebKit::WebAutomationSessionProxy::selectOptionElement):


  Commit: 8e563f78b6935aa230678e58e6cc402922e692bc
      https://github.com/WebKit/WebKit/commit/8e563f78b6935aa230678e58e6cc402922e692bc
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M WebDriverTests/ChangeLog
    M WebDriverTests/imported/selenium/importer.json
    M WebDriverTests/imported/selenium/py/selenium/__init__.py
    M WebDriverTests/imported/selenium/py/selenium/common/exceptions.py
    M WebDriverTests/imported/selenium/py/selenium/webdriver/__init__.py
    M WebDriverTests/imported/selenium/py/selenium/webdriver/remote/webelement.py
    M WebDriverTests/imported/selenium/py/selenium/webdriver/safari/webdriver.py
    M WebDriverTests/imported/selenium/py/test/selenium/webdriver/common/select_class_tests.py

  Log Message:
  -----------
  Merge r229213 - Unreviewed. Update Selenium WebDriver imported tests.

* imported/selenium/importer.json:
* imported/selenium/py/selenium/__init__.py:
* imported/selenium/py/selenium/common/exceptions.py:
* imported/selenium/py/selenium/webdriver/__init__.py:
* imported/selenium/py/selenium/webdriver/remote/webelement.py:
* imported/selenium/py/selenium/webdriver/safari/webdriver.py:
* imported/selenium/py/test/selenium/webdriver/common/select_class_tests.py:


  Commit: 08bba0198a7066fb3b132b37fb823daf384f7960
      https://github.com/WebKit/WebKit/commit/08bba0198a7066fb3b132b37fb823daf384f7960
  Author: Claudio Saavedra <csaavedra at igalia.com>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations

  Log Message:
  -----------
  Merge r229171 - [GTK] Unreviewed gardening

* platform/gtk/TestExpectations: Add
imported/w3c/web-platform-tests/css/css-ui/text-overflow-022.html,
which started failing in the bots.


  Commit: 734d065d3605d35ce985103f6f7a2e4c84e1cca4
      https://github.com/WebKit/WebKit/commit/734d065d3605d35ce985103f6f7a2e4c84e1cca4
  Author: Andika Triwidada <atriwidada at gnome.org>
  Date:   2018-03-05 (Mon, 05 Mar 2018)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/id.po

  Log Message:
  -----------
  Merge r229203 - [l10n] Updated Indonesian translation for WebKitGTK+
https://bugs.webkit.org/show_bug.cgi?id=183318

Patch by Andika Triwidada <atriwidada at gnome.org> on 2018-03-04
Rubber-stamped by Michael Catanzaro.

* id.po:


  Commit: 20ec124dea279219482335cb76f573a04494e6c6
      https://github.com/WebKit/WebKit/commit/20ec124dea279219482335cb76f573a04494e6c6
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-03-06 (Tue, 06 Mar 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.19.92 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.19.92.


  Commit: ceef22426ea6bdf3c5ce3c4eef31150b85331dce
      https://github.com/WebKit/WebKit/commit/ceef22426ea6bdf3c5ce3c4eef31150b85331dce
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-03-09 (Fri, 09 Mar 2018)

  Changed paths:
    M Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitWebsiteData.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitWebsiteDataManager.cpp
    M Source/WebKit/UIProcess/API/gtk/WebKitWebsiteData.h
    M Source/WebKit/UIProcess/API/gtk/WebKitWebsiteDataManager.h
    M Source/WebKit/UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt
    M Source/WebKit/UIProcess/API/wpe/WebKitWebsiteData.h
    M Source/WebKit/UIProcess/API/wpe/WebKitWebsiteDataManager.h
    M Tools/MiniBrowser/gtk/main.c
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebsiteData.cpp
    M Tools/TestWebKitAPI/glib/WebKitGLib/TestMain.h
    M Tools/TestWebKitAPI/glib/WebKitGLib/WebViewTest.cpp
    M Tools/TestWebKitAPI/glib/WebKitGLib/WebViewTest.h

  Log Message:
  -----------
  Revert "[GTK][WPE] Add API to configure and enable resource load statistics"

This reverts commit 6fe1852f8509b29ef0869f9030179ef099cac864.


  Commit: 73757970270afe880683af0e12aef1ae5ef657f5
      https://github.com/WebKit/WebKit/commit/73757970270afe880683af0e12aef1ae5ef657f5
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-12 (Mon, 12 Mar 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/WebInspectorProxyGtk.cpp

  Log Message:
  -----------
  Merge r229396 - REGRESSION(r218089): [GTK] webkit_web_view_get_inspector() needs to be called, otherwise inspector does not close
https://bugs.webkit.org/show_bug.cgi?id=181126

Reviewed by Carlos Alberto Lopez Perez.

Fix the condition to decide whether to detach the inspector view ourselves.

* UIProcess/gtk/WebInspectorProxyGtk.cpp:
(WebKit::WebInspectorProxy::platformDetach): Remove the inspector view from its parent if we don't have a client
or the client didn't detach it.


  Commit: fe9fe84413b46382754752462a79c1555b610809
      https://github.com/WebKit/WebKit/commit/fe9fe84413b46382754752462a79c1555b610809
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-03-12 (Mon, 12 Mar 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitWebPage.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/WebExtensionTest.cpp

  Log Message:
  -----------
  Merge r229461 - [GTK] Do not use WebKitDOMHTMLFormElement as argument of signal WebKitWebPage::will-submit-form
https://bugs.webkit.org/show_bug.cgi?id=183510

Reviewed by Michael Catanzaro.

Source/WebKit:

In 2.22 WebKitDOMHTMLFormElement will be deprecated in GTK+ port and won't still exist in WPE. The new
JavaScript GLib API will be used to replace most of the DOM API, but a few classes will remain with a minimal
API for things that can't be done with JavaScript. WebKitDOMElement will stay and will be added to WPE as well,
so if we change the signal parameter to WebKitDOMElement we will be able to keep using
WebKitWebPage::will-submit-form without any changes. WPE will gain this signal and the rest of the API that uses
DOM.

* WebProcess/InjectedBundle/API/glib/WebKitWebPage.cpp:
(webkit_web_page_class_init):

Tools:

Update the test to use WebKitDOMElement instead and fix a memory leak.

* TestWebKitAPI/Tests/WebKitGLib/WebExtensionTest.cpp:
(handleFormSubmissionCallback):
(willSubmitFormCallback):


  Commit: ca12edfaa2b04de75755a6c33351be9f3e9025c8
      https://github.com/WebKit/WebKit/commit/ca12edfaa2b04de75755a6c33351be9f3e9025c8
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-03-12 (Mon, 12 Mar 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp

  Log Message:
  -----------
  Merge r229525 - [GTK] Crash in WebCore::PlatformDisplayWayland::~PlatformDisplayWayland
https://bugs.webkit.org/show_bug.cgi?id=176490

Reviewed by Žan Doberšek.

Destroy the wl_display with wl_display_disconnect() (client process API), not
wl_display_destroy() (server process API). It has to be destroyed last, so explicitly
destroy the wl_registry and wl_compositor first.

* platform/graphics/wayland/PlatformDisplayWayland.cpp:
(WebCore::PlatformDisplayWayland::~PlatformDisplayWayland):


  Commit: ec8c6c0aecb1f77e6560ef0156e2927ef80f4cb0
      https://github.com/WebKit/WebKit/commit/ec8c6c0aecb1f77e6560ef0156e2927ef80f4cb0
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-03-12 (Mon, 12 Mar 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.20.0 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.20.0.


  Commit: d46d85ef8561d4d6f8c404a7c4d37c1bfde9e59b
      https://github.com/WebKit/WebKit/commit/d46d85ef8561d4d6f8c404a7c4d37c1bfde9e59b
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/repaint/absolute-position-change-containing-block-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderBlockFlow.cpp
    M Source/WebCore/rendering/RenderElement.cpp
    M Source/WebCore/rendering/RenderElement.h
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeUpdater.cpp
    M Source/WebCore/rendering/updating/RenderTreeUpdater.h

  Log Message:
  -----------
  Merge r229200  - [RenderTreeBuilder] Move styleDidChange mutation logic to RenderTreeUpdater
https://bugs.webkit.org/show_bug.cgi?id=183273
<rdar://problem/38054892>

Reviewed by Antti Koivisto.

Source/WebCore:

Covered by existing tests.

* rendering/RenderBlockFlow.cpp:
(WebCore::RenderBlockFlow::styleDidChange):
* rendering/RenderElement.cpp:
(WebCore::RenderElement::styleDidChange):
(WebCore::RenderElement::noLongerAffectsParentBlock const): Deleted.
* rendering/RenderElement.h:
* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::updateElementRenderer):

LayoutTests:

This is just a different repaint order.

* fast/repaint/absolute-position-change-containing-block-expected.txt:


  Commit: 43aa95249a678ac3f3e8c6da60f4f6b4b9ffd6ec
      https://github.com/WebKit/WebKit/commit/43aa95249a678ac3f3e8c6da60f4f6b4b9ffd6ec
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/NetworkProcess.cpp
    M Source/WebKit/NetworkProcess/NetworkProcess.h
    M Source/WebKit/NetworkProcess/NetworkProcess.messages.in
    M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r229201 - Notify the NetworkProcess when a session is servicing an automation client
https://bugs.webkit.org/show_bug.cgi?id=183306
<rdar://problem/37835783>

Reviewed by Brian Burg.

Network loads servicing WebDriver are done through an ephemeral session. While this is great
for protecting a developer's machine from sharing state with test runs, it has the unintended
effect of blocking certain logging operations.

We do not log content in ephemeral sessions to protect user privacy. However, ephemeral sessions
generated by WebDriver should participate in logging so that proper testing (with logging) can
be done.

This patch signals the NetworkProcess when an ephemeral session (created for automation purposes)
is created, so that it can allow logging.

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::destroySession): Remove controlled-by-automation entry.
(WebKit::NetworkProcess::sessionIsControlledByAutomation const): Added.
(WebKit::NetworkProcess::setSessionIsControlledByAutomation): Added.
* NetworkProcess/NetworkProcess.h:
* NetworkProcess/NetworkProcess.messages.in:
* NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::isAlwaysOnLoggingAllowed const): Checks if the relevant session
is servicing an automation client, and returns true if it is.
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::WebPageProxy): Signal the network process if this page is being created
for an automation client.


  Commit: ff581b6661a82094e5b7672c68d4f92246913b7a
      https://github.com/WebKit/WebKit/commit/ff581b6661a82094e5b7672c68d4f92246913b7a
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/ios/svg/W3C-SVG-1.1/text-altglyph-01-b-expected.txt
    M LayoutTests/platform/ios/svg/text/text-altglyph-01-b-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/svg/SVGToOTFFontConversion.cpp

  Log Message:
  -----------
  Merge r229202 - Delete incorrect version of clampTo() function from SVGToOTFFontConversion.cpp
https://bugs.webkit.org/show_bug.cgi?id=183165

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2018-03-03
Reviewed by Darin Adler.

Source/WebCore:

Some of the calls in SVGToOTFFontConversion.cpp were directed to the function
in MathExtras.h while the rest were directed to this local static function.
There should not be two versions with the same name while they are supposed
to do the same thing. Besides, the local version does not work correctly
if the type of the argument's max limit is less the max limit of the returned
type, e.g. char -> uint16_t.

* svg/SVGToOTFFontConversion.cpp:
(WebCore::clampTo): Deleted.

LayoutTests:

Re-baseline the results of these two tests since the local version of
clampTo() was not returning the expected results always.

* platform/ios/svg/W3C-SVG-1.1/text-altglyph-01-b-expected.txt:
* platform/ios/svg/text/text-altglyph-01-b-expected.txt:


  Commit: ae15cc59e0c12d1126144ff392d04d1b1dcd332a
      https://github.com/WebKit/WebKit/commit/ae15cc59e0c12d1126144ff392d04d1b1dcd332a
  Author: BJ Burg <bburg at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp

  Log Message:
  -----------
  Merge r229206 - Web Automation: script evaluations via WebDriver should have a user gesture indicator
https://bugs.webkit.org/show_bug.cgi?id=183230
<rdar://problem/37959739>

Reviewed by Andy Estes.

APIs that normally require a user gesture should just work when using via WebDriver.
To support cases where tests need to simulate user actions with JavaScript, use a
fake user gesture, similar to how -[WKWebView evaluateJavaScript:] forces a user
gesture when clients evaluate JavaScript in their web view.

No new tests, this is covered by W3C tests that use the Fullscreen API.
This API does nothing if there is no user gesture; with this patch, it just works.

* WebProcess/Automation/WebAutomationSessionProxy.cpp:
(WebKit::WebAutomationSessionProxy::evaluateJavaScriptFunction):


  Commit: 304aafd5c4f9ba28009325f5bfcae92442f791a9
      https://github.com/WebKit/WebKit/commit/304aafd5c4f9ba28009325f5bfcae92442f791a9
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Element.cpp

  Log Message:
  -----------
  Merge r229288 - Don't invalidate all children when doing insertion/deletion in presence of backward positional selectors
https://bugs.webkit.org/show_bug.cgi?id=183325
<rdar://problem/38134480>

Reviewed by Zalan Bujtas.

It is sufficient to invalidate siblings before the mutation point.

* dom/Element.cpp:
(WebCore::checkForSiblingStyleChanges):

We already do sibling walk in the case of forwards positional rules and sibling combinators. The work
done here is insignifant compared to cost of overinvalidating.


  Commit: cd21a2f3fed8433fc5ba4f98441213861cc7dbed
      https://github.com/WebKit/WebKit/commit/cd21a2f3fed8433fc5ba4f98441213861cc7dbed
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/JITThunks.cpp
    M Source/JavaScriptCore/runtime/VM.cpp

  Log Message:
  -----------
  Merge r229302 - JITThunk functions should only be called when the JIT is enabled.
https://bugs.webkit.org/show_bug.cgi?id=183351
<rdar://problem/38160091>

Reviewed by Keith Miller.

* jit/JITThunks.cpp:
(JSC::JITThunks::ctiNativeCall):
(JSC::JITThunks::ctiNativeConstruct):
(JSC::JITThunks::ctiInternalFunctionCall):
(JSC::JITThunks::ctiInternalFunctionConstruct):
* runtime/VM.cpp:
(JSC::VM::VM):
(JSC::VM::getCTIInternalFunctionTrampolineFor):


  Commit: bcc83e4e3ae11004cfe2a0065728546b4ac2818a
      https://github.com/WebKit/WebKit/commit/bcc83e4e3ae11004cfe2a0065728546b4ac2818a
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/svg/SVGToOTFFontConversion.cpp

  Log Message:
  -----------
  Merge r229328 - Change the type of SVGToOTFFontConverter::m_weight to be not a char
https://bugs.webkit.org/show_bug.cgi?id=183339

Reviewed by Alex Christensen.

No new tests because there is no behavior change.

* svg/SVGToOTFFontConversion.cpp:
(WebCore::SVGToOTFFontConverter::appendOS2Table):
(WebCore::SVGToOTFFontConverter::SVGToOTFFontConverter):


  Commit: 71f07a53aa0ca53ba1869727d12ba55bdfcb2049
      https://github.com/WebKit/WebKit/commit/71f07a53aa0ca53ba1869727d12ba55bdfcb2049
  Author: Sihui Liu <sihui_liu at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt
    A LayoutTests/http/tests/history/replacestate-no-url-expected.txt
    A LayoutTests/http/tests/history/replacestate-no-url.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/History.cpp

  Log Message:
  -----------
  Merge r229375 - replaceState cause back/forward malfunction on html page with <base href="/"> tag
https://bugs.webkit.org/show_bug.cgi?id=182678
<rdar://problem/37517821>

Patch by Sihui Liu <sihui_liu at apple.com> on 2018-03-07
Reviewed by Chris Dumez.

Source/WebCore:

replaceState should not change URL when the URL argument is NULL, but should change URL when the URL argument is an empty string.

Test: http/tests/history/replacestate-no-url.html

* page/History.cpp:
(WebCore::History::urlForState):

LayoutTests:

* http/tests/history/replacestate-no-url-expected.txt: Added.
* http/tests/history/replacestate-no-url.html: Added.
Add layout test coverage.

* fast/loader/stateobjects/pushstate-with-fragment-urls-and-hashchange-expected.txt:
Rebaseline a layout test as empty string for URL is handled differently.


  Commit: a89b5fdaefcbeab60c5c33fd4003d67bdf46b593
      https://github.com/WebKit/WebKit/commit/a89b5fdaefcbeab60c5c33fd4003d67bdf46b593
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt
    A LayoutTests/fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLInputElement.cpp

  Log Message:
  -----------
  Merge r229393 - Invalid innerTextRenderer in RenderTextControlSingleLine::styleDidChange()
https://bugs.webkit.org/show_bug.cgi?id=183385
<rdar://problem/38085397>

Reviewed by Antti Koivisto.

Source/WebCore:

When HTMLInputElement::updateType() is called with a dirty value, we eagerly change the m_inputType first
and then we take care of the dirty value by calling setAttributeWithoutSynchronization().
With a DOMSubtreeModified event listener attached, setAttributeWithoutSynchronization() can end up running some
layout code (offsetHeight) with a renderer - m_inputType mismatch.

This patch ensures that we don't change the m_inputType until after we finished setting the new value.

Test: fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html

* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::updateType):

LayoutTests:

* fast/DOM/HTMLInputElement/input-value-and-type-change-crash-expected.txt: Added.
* fast/DOM/HTMLInputElement/input-value-and-type-change-crash.html: Added.


  Commit: 1c4d6914c055de4b2f1323aee57567481daf7701
      https://github.com/WebKit/WebKit/commit/1c4d6914c055de4b2f1323aee57567481daf7701
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitWebExtension.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitWebExtensionPrivate.h
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMClientRectList.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/FrameTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestFrame.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGLib/WebProcessTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGtk/DOMClientRectTest.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGtk/TestAutocleanups.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGtk/TestDOMClientRect.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGtk/TestDOMNode.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGtk/TestDOMNodeFilter.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGtk/TestDOMXPathNSResolver.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGtk/TestEditor.cpp
    M Tools/TestWebKitAPI/glib/WebKitGLib/WebViewTest.cpp
    M Tools/TestWebKitAPI/glib/WebKitGLib/WebViewTest.h

  Log Message:
  -----------
  Merge r229395 - [GTK][WPE] Leak checker is not working in WebKitGLib web process tests
https://bugs.webkit.org/show_bug.cgi?id=183404

Reviewed by Michael Catanzaro.

Source/WebKit:

Add private helper for testing to do a garbage collection when the page is closing.

* WebProcess/InjectedBundle/API/glib/WebKitWebExtension.cpp:
(webkitWebExtensionSetGarbageCollectOnPageDestroy):
* WebProcess/InjectedBundle/API/glib/WebKitWebExtensionPrivate.h:
* WebProcess/InjectedBundle/API/gtk/DOM/WebKitDOMClientRectList.h: Fix annotation of
webkit_dom_client_rect_list_item(), it should be transfer full.

Tools:

This might have regressed when we started to use the JSC garbage collector timers. The thing is that we expect
that the WebProcessTester object that we expose to JavaScript is released when the web frame is destroyed, but
that's no longer the case. On window object cleared a GC is scheduled, but JSC timers do the actual garbage
collection later. In the case of tests that never happens because the web process finishes quickly after the
test. We need to force a garbage collection at some point when the web page is destroyed. We can't use the
WebKitWebPage destroy signal, since we are also checking that WebKitWebPage isn't leaked. The
API::InjectedBundle::Client::willDestroyPage() always happen when the page is closed, even if WebKitWebPage is
still alive, so we can force the GC at that point. The only problem is that the frame is detached right after
that point, so we can't check WebKitFrame leaks. The only frame in the tests is the main one, so we can assume
that if WebKitWebPage is released, the frame is too.

* TestWebKitAPI/Tests/WebKitGLib/FrameTest.cpp:
(WebKitFrameTest::testMainFrame): Stop checking we don't leak WebKitFrame.
(WebKitFrameTest::testURI): Ditto.
(WebKitFrameTest::testJavaScriptContext): Ditto.
* TestWebKitAPI/Tests/WebKitGLib/TestFrame.cpp:
(testWebKitFrameMainFrame): Use new WebViewTest::runWebProcessTest() API.
(testWebKitFrameURI): Ditto.
(testWebKitFrameJavaScriptContext): Ditto.
(webkitFrameTestRun): Deleted.
* TestWebKitAPI/Tests/WebKitGLib/WebProcessTest.cpp:
(runTest): We no longer need the special case for dom-cache test.
(windowObjectClearedCallback): Only expose test runner object to JavaScript when loading tests.
(webkit_web_extension_initialize): Call webkitWebExtensionSetGarbageCollectOnPageDestroy() to ensure a garbage
collection is performed when the page is closing.
* TestWebKitAPI/Tests/WebKitGtk/DOMClientRectTest.cpp:
(WebKitDOMClientRectTest::testDivClientRectsPositionAndLength): Fix memory leak,
webkit_dom_client_rect_list_item() returns a full reference.
* TestWebKitAPI/Tests/WebKitGtk/TestAutocleanups.cpp:
(testWebProcessAutocleanups):Use new WebViewTest::runWebProcessTest() API.
* TestWebKitAPI/Tests/WebKitGtk/TestDOMClientRect.cpp:
(testWebKitDOMClientRectDivBoundingClientRectPosition): Use new WebViewTest::runWebProcessTest() API.
(testWebKitDOMClientRectDivClientRectsPositionAndLength): Use new WebViewTest::runWebProcessTest() API.
(prepareDOMForClientRectPositionTests): Deleted.
* TestWebKitAPI/Tests/WebKitGtk/TestDOMNode.cpp:
(testWebKitDOMNodeHierarchyNavigation): Use new WebViewTest::runWebProcessTest() API.
(testWebKitDOMNodeInsertion): Ditto.
(testWebKitDOMNodeTagNamesNodeList): Ditto.
(testWebKitDOMNodeTagNamesHTMLCollection): Ditto.
(testWebKitDOMObjectCache): We no longer need to run the test several times, since runWebProcessTest() loads
about blank after every test.
(prepareDOMForTagNamesTests): Deleted.
* TestWebKitAPI/Tests/WebKitGtk/TestDOMNodeFilter.cpp:
(testWebKitDOMNodeFilterTreeWalker): Use new WebViewTest::runWebProcessTest() API.
(testWebKitDOMNodeFilterNodeIterator): Ditto.
(runTest): Deleted.
* TestWebKitAPI/Tests/WebKitGtk/TestDOMXPathNSResolver.cpp:
(testWebKitDOMXPathNSResolverNative): Use new WebViewTest::runWebProcessTest() API.
(testWebKitDOMXPathNSResolverCustom): Ditto.
* TestWebKitAPI/Tests/WebKitGtk/TestEditor.cpp:
(testWebKitWebEditorSelectionChanged): Use new WebViewTest::runWebProcessTest() API.
* TestWebKitAPI/glib/WebKitGLib/WebViewTest.cpp:
(WebViewTest::runWebProcessTest): It now receives the contents, so it automatically loads the view using
"webprocess://test" as base URI, used to detect tests in the web process. It also loads about:blank after every
test to ensure that window object is cleared.
* TestWebKitAPI/glib/WebKitGLib/WebViewTest.h:


  Commit: 9f2fefc3ab1771794d3796beb97e13292d89e8dd
      https://github.com/WebKit/WebKit/commit/9f2fefc3ab1771794d3796beb97e13292d89e8dd
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/glib/RunLoopGLib.cpp

  Log Message:
  -----------
  Merge r229406 - [GLib] RunLoop::wakeUp(): use a zero value instead of the monotonic time
https://bugs.webkit.org/show_bug.cgi?id=183447

Reviewed by Carlos Garcia Campos.

* wtf/glib/RunLoopGLib.cpp:
(WTF::RunLoop::wakeUp): Micro-optimize the wake-up schedule by using
a zero value as the GSource ready time, instead of retrieving and using
the current monotonic time.


  Commit: 73764a7808974a5d17294396a49d22b1a3e464fa
      https://github.com/WebKit/WebKit/commit/73764a7808974a5d17294396a49d22b1a3e464fa
  Author: Danyao Wang <danyao at chromium.org>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    A LayoutTests/http/tests/navigation/pushstate-at-unique-origin-denied-expected.txt
    A LayoutTests/http/tests/navigation/pushstate-at-unique-origin-denied.php
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/History.cpp
    M Source/WebCore/platform/URL.cpp
    M Source/WebCore/platform/URL.h
    M Tools/TestWebKitAPI/Tests/WebCore/URL.cpp

  Log Message:
  -----------
  Merge r229540 - Add a query and fragment exception to history API's unique origin restriction.
https://bugs.webkit.org/show_bug.cgi?id=183028

Patch by Danyao Wang <danyao at chromium.org> on 2018-03-12
Reviewed by Brent Fulgham.

Tests: http/tests/navigation/pushstate-at-unique-origin-denied.php
       Tools/TestWebKitAPI/Tests/WebCore/URL.cpp

* page/History.cpp:
(WebCore::History::stateObjectAdded):


  Commit: a524b69d63d1d3daa87f2ccc8f018163d5edc644
      https://github.com/WebKit/WebKit/commit/a524b69d63d1d3daa87f2ccc8f018163d5edc644
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/Gigacage.cpp

  Log Message:
  -----------
  Merge r229669 - Improve error message when Gigacage cannot allocate virtual memory
https://bugs.webkit.org/show_bug.cgi?id=183329

Reviewed by Filip Pizlo.

We've discovered that Deja Dup monitor sets a virtual memory limit, breaking Gigacage. Since
it runs in the background on a fresh out-of-the-box install of Ubuntu, this is not good.
That will have to be fixed by Deja Dup, but there is concern that other applications might
try this, or that users will set a virtual memory limit for the entire desktop session. Of
particular concern is the possibility that users might have copypasted a ulimit line into
a session startup script without understanding it. Let's try to make it slightly easier to
understand what's going wrong.

* bmalloc/Gigacage.cpp:
(Gigacage::ensureGigacage):


  Commit: 2a963575a19c0227cad784f02e3b3dac161cdfb2
      https://github.com/WebKit/WebKit/commit/2a963575a19c0227cad784f02e3b3dac161cdfb2
  Author: Nan Wang <n_wang at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityObject.cpp

  Log Message:
  -----------
  Merge r229499 - AX: AOM: More accessibility events support
https://bugs.webkit.org/show_bug.cgi?id=183023
<rdar://problem/37764380>

Reviewed by Chris Fleizach.

Source/WebCore:

The test is crashing when we call updateBackingStore when
the AXObjectCache object is gone. Added a check to fix that.

Modified the test by using the right format of setTimeout and extended the delay.

* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::updateBackingStore):

LayoutTests:

* accessibility/mac/AOM-events-webarea-crash.html:


  Commit: 88973487d438c65f1b737420226f7625fc64630c
      https://github.com/WebKit/WebKit/commit/88973487d438c65f1b737420226f7625fc64630c
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/ThirdParty/ANGLE/ChangeLog
    M Source/ThirdParty/ANGLE/changes.diff
    M Source/ThirdParty/ANGLE/include/EGL/eglplatform.h

  Log Message:
  -----------
  Merge r229721 - REGRESSION(r225340): WPE port should not be getting EGL X11 types on ANGLE
https://bugs.webkit.org/show_bug.cgi?id=183749

Reviewed by Alex Christensen.

Add back the USE_WPE ifdef.

* changes.diff:
* include/EGL/eglplatform.h:


  Commit: 12a27d1e44fdc9736e5df8a464152e301bfc1658
      https://github.com/WebKit/WebKit/commit/12a27d1e44fdc9736e5df8a464152e301bfc1658
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/GStreamerUtilities.h

  Log Message:
  -----------
  Merge r229803 - [WPE] Build failure with ENABLE_VIDEO=OFF when GStreamer is not available
https://bugs.webkit.org/show_bug.cgi?id=183811

Reviewed by Philippe Normand.

Add build guards for USE_GSTREAMER.

No new tests, it is a build fix.

* platform/graphics/gstreamer/GStreamerUtilities.h:


  Commit: 3356496be2976b6562770e51d5b90542fe037598
      https://github.com/WebKit/WebKit/commit/3356496be2976b6562770e51d5b90542fe037598
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/JSWebAnimationCustom.cpp

  Log Message:
  -----------
  Merge r229848 - [WPE][GTK] Build failure when ENABLE_VIDEO, ENABLE_WEB_AUDIO and ENABLE_XSLT are disabled
https://bugs.webkit.org/show_bug.cgi?id=183896

Reviewed by Yusuke Suzuki.

No new tests needed.

* bindings/js/JSWebAnimationCustom.cpp: Add missing #include of Document.h


  Commit: 776c27269a3c38426242fb3e40cfb011c8c014bb
      https://github.com/WebKit/WebKit/commit/776c27269a3c38426242fb3e40cfb011c8c014bb
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/array-reverse-doesnt-clobber.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/ArrayPrototype.cpp

  Log Message:
  -----------
  Merge r229850 - Race Condition in arrayProtoFuncReverse() causes wrong results or crash
https://bugs.webkit.org/show_bug.cgi?id=183901

Reviewed by Keith Miller.

JSTests:

New test.

* stress/array-reverse-doesnt-clobber.js: Added.
(testArrayReverse):
(createArrayOfArrays):
(createArrayStorage):

Source/JavaScriptCore:

Added write barriers to ensure the reversed contents are properly marked.

* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncReverse):


  Commit: 02fe893a5369cdb7dee6305fc33a800351f0bc2a
      https://github.com/WebKit/WebKit/commit/02fe893a5369cdb7dee6305fc33a800351f0bc2a
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M ChangeLog
    M LayoutTests/ChangeLog
    M LayoutTests/platform/wpe/TestExpectations
    M Source/cmake/OptionsWPE.cmake
    M Tools/ChangeLog
    M Tools/wpe/jhbuild.modules

  Log Message:
  -----------
  Merge r229866 - [WPE] Enable WOFF2 support
https://bugs.webkit.org/show_bug.cgi?id=178158

Reviewed by Frédéric Wang.

.:

* Source/cmake/OptionsWPE.cmake: Add needed logic to detect the Brotli and WOFF2 libraries.

Tools:

* wpe/jhbuild.modules: Add "brotli" and "woff2" to the JHBuild moduleset.

LayoutTests:

* platform/wpe/TestExpectations: Unskip the fast/text/woff2.html and fast/text/woff2-totalsfntsize.html


  Commit: 29ce1578e6b9582d8f4989eac3f7282f1cd56ec2
      https://github.com/WebKit/WebKit/commit/29ce1578e6b9582d8f4989eac3f7282f1cd56ec2
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/simple-line-layout-dynamic-letter-word-spacing-expected.html
    A LayoutTests/fast/text/simple-line-layout-dynamic-letter-word-spacing.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderText.cpp

  Log Message:
  -----------
  Merge r229867 - [Simple line layout] Text with letter spacing is not positioned properly.
https://bugs.webkit.org/show_bug.cgi?id=183079
<rdar://problem/38762569>

Reviewed by Antti Koivisto.

Source/WebCore:

We need to recompute RenderText::m_canUseSimplifiedTextMeasuring when the font cascade changes
since we might not be able to use the fast path anymore.

Test: fast/text/simple-line-layout-dynamic-letter-word-spacing.html

* rendering/RenderText.cpp:
(WebCore::RenderText::styleDidChange):

LayoutTests:

* fast/text/simple-line-layout-dynamic-letter-word-spacing-expected.html: Added.
* fast/text/simple-line-layout-dynamic-letter-word-spacing.html: Added.


  Commit: 9d1bfb1f0433b6d8cd1f9a48d72eca7339368959
      https://github.com/WebKit/WebKit/commit/9d1bfb1f0433b6d8cd1f9a48d72eca7339368959
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/MemoryPressureHandler.cpp

  Log Message:
  -----------
  Merge r229894 - WebProcess memory monitor thresholds should be better tuned for embedded systems.
https://bugs.webkit.org/show_bug.cgi?id=183773

Reviewed by Yusuke Suzuki.

Take into account the total system RAM for the thresholds calculation.

For systems with more than 3GB the conservative and strict thresholds remain as they are,
but for systems with less RAM the thresholds are dynamically configured as follows:

- Conservative threshold (release non critical memory) if WebProcess using more than 33% of the total RAM.
- Strict threshold (release all possible memory) if WebProcess using more than 50% of the total RAM.

The Kill threshold is also modified. Now it is capped at 90% of the total RAM.

* wtf/MemoryPressureHandler.cpp:
(WTF::thresholdForMemoryKillWithProcessState):
(WTF::thresholdForPolicy):
(WTF::MemoryPressureHandler::shrinkOrDie):


  Commit: 5f4762b15875a9fc085f90c91be3b0d631ec8d3a
      https://github.com/WebKit/WebKit/commit/5f4762b15875a9fc085f90c91be3b0d631ec8d3a
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/BlockDirectory.cpp

  Log Message:
  -----------
  Merge r229962 - r228149 accidentally removed code that resets m_emptyCursor at the end of a GC
https://bugs.webkit.org/show_bug.cgi?id=183995

Reviewed by Filip Pizlo.

The removal of this line of code was unintended and happened during some
refactoring Fil was doing. The consequence of removing this line of code
is that the m_emptyCursor became a monotonically increasing integer, leading
the cursor to usually being out of bounds of the block range (depending on
what the program is doing). This made the functionality of finding an empty
block to steal almost always fail.

* heap/BlockDirectory.cpp:
(JSC::BlockDirectory::prepareForAllocation):


  Commit: 6b3645ee7bdb900c862467d4480bae6b089b61ce
      https://github.com/WebKit/WebKit/commit/6b3645ee7bdb900c862467d4480bae6b089b61ce
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/MemoryPressureHandler.cpp

  Log Message:
  -----------
  Merge r229965 - WebProcess memory monitor: use %zu format specifier for size_t
https://bugs.webkit.org/show_bug.cgi?id=183997

Reviewed by Michael Catanzaro.

usse %zu format specifier for size_t instead of %lu.

* wtf/MemoryPressureHandler.cpp:
(WTF::MemoryPressureHandler::shrinkOrDie):
(WTF::MemoryPressureHandler::measurementTimerFired):


  Commit: 30e42e372ba9824b7895deb0feadfd9824925a52
      https://github.com/WebKit/WebKit/commit/30e42e372ba9824b7895deb0feadfd9824925a52
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/webkit-web-extension.h

  Log Message:
  -----------
  Merge r229971 - [GTK] WebKitWebProcessEnumTypes.h missing from webkit-web-extension.h
https://bugs.webkit.org/show_bug.cgi?id=183998

Reviewed by Carlos Garcia Campos.

* WebProcess/InjectedBundle/API/gtk/webkit-web-extension.h:


  Commit: dc2aa218cde54245bc9f5c1b5e9ef7ed049b88af
      https://github.com/WebKit/WebKit/commit/dc2aa218cde54245bc9f5c1b5e9ef7ed049b88af
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/text/enchant/TextCheckerEnchant.cpp
    M Source/WebCore/platform/text/enchant/TextCheckerEnchant.h

  Log Message:
  -----------
  Merge r229994 - [GTK] Layout test editing/deleting/delete-surrogatepair.html crashing with CRITICAL **: enchant_dict_check: assertion 'g_utf8_validate(word, len, NULL)' failed
https://bugs.webkit.org/show_bug.cgi?id=176799

Reviewed by Carlos Garcia Campos.

Source/WebCore:

The length of a surrogate-pair UTF-16 character is 2 even though
the number of characters is 1. An incorrect string length was
passed to enchant_dict_check if the string contains a
surrogate-pair character because the length was calculated by
applying UTF-16 character position to UTF-8 string.

No new tests (Covered by existing tests).

* platform/text/enchant/TextCheckerEnchant.cpp:
(WebCore::TextCheckerEnchant::checkSpellingOfWord): Changed the
type of an argument `word` from CString to String. Convert a
substring of the argument into UTF-8.
(WebCore::TextCheckerEnchant::checkSpellingOfString): Pass the
original UTF-16 string to checkSpellingOfWord instead of a
converted UTF-8 string.
* platform/text/enchant/TextCheckerEnchant.h: Changed the type of
an argument `word` from CString to String.

LayoutTests:

* platform/gtk/TestExpectations: Unmarked editing/deleting/delete-surrogatepair.html.


  Commit: d043f0ef75ea64ffd262d732245bc220b3558cc5
      https://github.com/WebKit/WebKit/commit/d043f0ef75ea64ffd262d732245bc220b3558cc5
  Author: Robin Morisset <rmorisset at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/json-stringified-overflow.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSONObject.cpp
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/text/StringBuilder.h
    M Source/WTF/wtf/text/StringBuilderJSON.cpp

  Log Message:
  -----------
  Merge r230026 - appendQuotedJSONString stops on arithmetic overflow instead of propagating it upwards
https://bugs.webkit.org/show_bug.cgi?id=183894

Reviewed by Saam Barati.

JSTests:

* stress/json-stringified-overflow.js: Added.
(catch):

Source/JavaScriptCore:

Use the return value of appendQuotedJSONString to fail more gracefully when given a string that is too large to handle.

* runtime/JSONObject.cpp:
(JSC::Stringifier::appendStringifiedValue):

Source/WTF:

appendQuotedJSONString now returns a bool indicating whether it succeeded, instead of silently failing when given a string too large
to fit in 4GB.

* wtf/text/StringBuilder.h:
* wtf/text/StringBuilderJSON.cpp:
(WTF::StringBuilder::appendQuotedJSONString):


  Commit: 260cd2423fb2d81024edc8016ad62941e77c11ca
      https://github.com/WebKit/WebKit/commit/260cd2423fb2d81024edc8016ad62941e77c11ca
  Author: Rafael Fontenelle <rafaelff at gnome.org>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/pt_BR.po

  Log Message:
  -----------
  Merge r230073 - [l10n] [pt_BR] Updated Brazilian Portuguese translation
https://bugs.webkit.org/show_bug.cgi?id=184132

Patch by Rafael Fontenelle <rafaelff at gnome.org> on 2018-03-29
Rubber-stamped by Michael Catanzaro.

* pt_BR.po:


  Commit: 8e8df7aed17995f00afecf084855fdb06caf9d5a
      https://github.com/WebKit/WebKit/commit/8e8df7aed17995f00afecf084855fdb06caf9d5a
  Author: Carlos Eduardo Ramalho <cadubentzen at gmail.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/wpe/WebEventFactory.cpp

  Log Message:
  -----------
  Merge r230074 - [WPE] Floating point exception in WebEventFactory::createWebWheelEvent
https://bugs.webkit.org/show_bug.cgi?id=184037

Patch by Carlos Eduardo Ramalho <cadubentzen at gmail.com> on 2018-03-29
Reviewed by Žan Doberšek.

* Shared/wpe/WebEventFactory.cpp:
(WebKit::WebEventFactory::createWebWheelEvent): Use std::copysign() to avoid division by 0.


  Commit: cea5df284f32b6639bd42590cd6260a5d6ce7e7c
      https://github.com/WebKit/WebKit/commit/cea5df284f32b6639bd42590cd6260a5d6ce7e7c
  Author: BJ Burg <bburg at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/Automation/WebAutomationSessionProxy.cpp

  Log Message:
  -----------
  Merge r230088 - Web Automation: clipToViewport is ignored for element screenshots
https://bugs.webkit.org/show_bug.cgi?id=184158
<rdar://problem/39014307>

Reviewed by Timothy Hatcher.

In §19.2 Take Element Screenshot, step 5.2 says that we should clip
the element screenshot rect with the visible viewport rect. We don't
do that right now even though we pass over clipToViewport.

* WebProcess/Automation/WebAutomationSessionProxy.cpp:
(WebKit::snapshotRectForScreenshot):
Clip the rect to viewport if needed.

(WebKit::WebAutomationSessionProxy::takeScreenshot):
This scrollIntoView is misplaced; by this point we have already done
the math to figure out the screenshot rect. Move it before computing the rect.


  Commit: f7f36998ab1c970913e4a79ac82b346a9ecbcfe9
      https://github.com/WebKit/WebKit/commit/f7f36998ab1c970913e4a79ac82b346a9ecbcfe9
  Author: Robin Morisset <rmorisset at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/large-unshift-splice.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/ArrayPrototype.cpp
    M Source/JavaScriptCore/runtime/JSArray.cpp
    M Source/JavaScriptCore/runtime/JSObject.h

  Log Message:
  -----------
  Merge r230101 - Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
https://bugs.webkit.org/show_bug.cgi?id=183657
JSTests:

Reviewed by Keith Miller.

* stress/large-unshift-splice.js: Added.
(make_contig_arr):

Source/JavaScriptCore:

<rdar://problem/38464399>

Reviewed by Keith Miller.

There was just a missing check in unshiftCountForIndexingType.
I've also replaced 'return false' by 'return true' in the case of an 'out-of-memory' exception, because 'return false' means 'please continue to the slow path',
and the slow path has an assert that there is no unhandled exception (line 360 of ArrayPrototype.cpp).
Finally, I made the assert in ensureLength a release assert as it would have caught this bug and prevented it from being a security risk.

* runtime/ArrayPrototype.cpp:
(JSC::unshift):
* runtime/JSArray.cpp:
(JSC::JSArray::unshiftCountWithAnyIndexingType):
* runtime/JSObject.h:
(JSC::JSObject::ensureLength):


  Commit: bab9ab659b066ff7c9a6600ae880e2b90aff5282
      https://github.com/WebKit/WebKit/commit/bab9ab659b066ff7c9a6600ae880e2b90aff5282
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js
    A JSTests/stress/hoist-get-by-offset-with-control-dependent-inferred-type.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h

  Log Message:
  -----------
  Merge r230143 - JSC crash in JIT code with for-of loop and Array/Set iterators
https://bugs.webkit.org/show_bug.cgi?id=183174

Reviewed by Saam Barati.

JSTests:

* microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x.
(foo):
* stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed.
(f):

Source/JavaScriptCore:

* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute): Fix the bug by making GetByOffset and friends verify that they are getting the type proof they want at the desired hoisting site.


  Commit: 071190d6f920084fdd8baa9fd3836c9c35e4fa66
      https://github.com/WebKit/WebKit/commit/071190d6f920084fdd8baa9fd3836c9c35e4fa66
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/DragAndDropHandler.cpp

  Log Message:
  -----------
  Merge r230156 - [GTK] DragAndDropHandler.cpp should include GUniquePtrGtk.h
https://bugs.webkit.org/show_bug.cgi?id=184119

Reviewed by Daniel Bates.

* UIProcess/gtk/DragAndDropHandler.cpp:


  Commit: d3c3980e95435edcc83cc8c009bf8269dd1d0506
      https://github.com/WebKit/WebKit/commit/d3c3980e95435edcc83cc8c009bf8269dd1d0506
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/NetworkStorageSession.h
    M Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp
    M Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp

  Log Message:
  -----------
  Merge r230196 - [GTK] NetworkProcess from WebKitGtk+ 2.19.9x SIGSEVs in NetworkStorageSession (secret search callback)
https://bugs.webkit.org/show_bug.cgi?id=183346

Reviewed by Michael Catanzaro.

Source/WebCore:

This might happen if a request is cancelled right after the password request starts and before it finishes. We
should cancel the password search when the network request is cancelled, not only when the NetworkStorageSession
is destroyed.

* platform/network/NetworkStorageSession.h:
* platform/network/soup/NetworkStorageSessionSoup.cpp:
(WebCore::NetworkStorageSession::~NetworkStorageSession):
(WebCore::SecretServiceSearchData::SecretServiceSearchData): Helper struct to keep the request cancellable and
completion handler.
(WebCore::NetworkStorageSession::getCredentialFromPersistentStorage): Create a SecretServiceSearchData for the
request.
* platform/network/soup/ResourceHandleSoup.cpp:
(WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Pass the request cancellable to
NetworkStorageSession::getCredentialFromPersistentStorage().

Source/WebKit:

Pass the request cancellable to NetworkStorageSession::getCredentialFromPersistentStorage().

* NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::authenticate):


  Commit: 4c59c053ae59fa0854d983380012c4737b6fea2e
      https://github.com/WebKit/WebKit/commit/4c59c053ae59fa0854d983380012c4737b6fea2e
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/text/enchant/TextCheckerEnchant.cpp

  Log Message:
  -----------
  Merge r230197 - [GTK] Segfaults in enchant_broker_free_dict()
https://bugs.webkit.org/show_bug.cgi?id=183738

Reviewed by Michael Catanzaro.

Check enchant_broker_request_dict() didn't return nullptr before adding it to the m_enchantDictionaries vector.

* platform/text/enchant/TextCheckerEnchant.cpp:
(WebCore::TextCheckerEnchant::updateSpellCheckingLanguages):


  Commit: bac8912ec069f24b5fa2ddc0441c616a8d9b8a9c
      https://github.com/WebKit/WebKit/commit/bac8912ec069f24b5fa2ddc0441c616a8d9b8a9c
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/SecurityOrigin.cpp
    M Source/WebCore/page/SecurityOrigin.h
    M Source/WebCore/page/SecurityPolicy.cpp
    M Source/WebCore/platform/SchemeRegistry.cpp
    M Source/WebCore/platform/SchemeRegistry.h

  Log Message:
  -----------
  Merge r230205 - Make SecurityOrigin safe to create and use from any thread
https://bugs.webkit.org/show_bug.cgi?id=184216

Reviewed by Youenn Fablet.

We found that we have a decent amount of code constructing and using SecurityOrigin
objects from non-main threads. Unfortunately, this was not safe, mostly due to
SecurityOrigin's reliance on the SchemeRegistry.

This patch makes it safe to construct a SecurityOrigin on any thread A and use
it later on the same thread A. However, developers still need to call isolatedCopy()
if they want to pass such object to another thread B.

* page/SecurityOrigin.cpp:
(WebCore::SecurityOrigin::canDisplay const):
* page/SecurityOrigin.h:
* page/SecurityPolicy.cpp:
(WebCore::originAccessMapLock):
(WebCore::originAccessMap):
(WebCore::SecurityPolicy::isAccessWhiteListed):
(WebCore::SecurityPolicy::addOriginAccessWhitelistEntry):
(WebCore::SecurityPolicy::removeOriginAccessWhitelistEntry):
(WebCore::SecurityPolicy::resetOriginAccessWhitelists):
* platform/SchemeRegistry.cpp:
(WebCore::schemeRegistryLock):
(WebCore::allBuiltinSchemes):
(WebCore::builtinLocalURLSchemes):
(WebCore::localURLSchemes):
(WebCore::displayIsolatedURLSchemes):
(WebCore::builtinSecureSchemes):
(WebCore::secureSchemes):
(WebCore::builtinSchemesWithUniqueOrigins):
(WebCore::schemesWithUniqueOrigins):
(WebCore::builtinEmptyDocumentSchemes):
(WebCore::emptyDocumentSchemes):
(WebCore::schemesForbiddenFromDomainRelaxation):
(WebCore::builtinCanDisplayOnlyIfCanRequestSchemes):
(WebCore::canDisplayOnlyIfCanRequestSchemes):
(WebCore::notAllowingJavascriptURLsSchemes):
(WebCore::SchemeRegistry::registerURLSchemeAsLocal):
(WebCore::SchemeRegistry::removeURLSchemeRegisteredAsLocal):
(WebCore::schemesAllowingLocalStorageAccessInPrivateBrowsing):
(WebCore::schemesAllowingDatabaseAccessInPrivateBrowsing):
(WebCore::builtinCORSEnabledSchemes):
(WebCore::CORSEnabledSchemes):
(WebCore::ContentSecurityPolicyBypassingSchemes):
(WebCore::cachePartitioningSchemes):
(WebCore::serviceWorkerSchemes):
(WebCore::alwaysRevalidatedSchemes):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsLocal):
(WebCore::SchemeRegistry::registerURLSchemeAsNoAccess):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsNoAccess):
(WebCore::SchemeRegistry::registerURLSchemeAsDisplayIsolated):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated):
(WebCore::SchemeRegistry::registerURLSchemeAsSecure):
(WebCore::SchemeRegistry::shouldTreatURLSchemeAsSecure):
(WebCore::SchemeRegistry::canDisplayOnlyIfCanRequest):
(WebCore::SchemeRegistry::registerAsCanDisplayOnlyIfCanRequest):
(WebCore::SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy):
(WebCore::SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy):
(WebCore::SchemeRegistry::schemeShouldBypassContentSecurityPolicy):
(WebCore::SchemeRegistry::registerURLSchemeAsCachePartitioned):
(WebCore::SchemeRegistry::shouldPartitionCacheForURLScheme):
(WebCore::SchemeRegistry::registerURLSchemeServiceWorkersCanHandle):
(WebCore::SchemeRegistry::canServiceWorkersHandleURLScheme):
(WebCore::SchemeRegistry::isServiceWorkerContainerCustomScheme):
* platform/SchemeRegistry.h:


  Commit: f632aa320cc9251c65dbcf74f9292ce7880f53cf
      https://github.com/WebKit/WebKit/commit/f632aa320cc9251c65dbcf74f9292ce7880f53cf
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGtk/TestContextMenu.cpp

  Log Message:
  -----------
  Merge r230244 - [GTK] Test /webkit/WebKitWebPage/context-menu is failing since r229831
https://bugs.webkit.org/show_bug.cgi?id=184260

Reviewed by Michael Catanzaro.

This is not a regression introduced in r229831, though, it's a bug in the test itself revealed by r229831. We
should wait for the load to complete before trying to show the context menu.

* TestWebKitAPI/Tests/WebKitGtk/TestContextMenu.cpp:
(testContextMenuWebExtensionMenu):


  Commit: 4f645258970b9ba62795feee230ec75eecf81b02
      https://github.com/WebKit/WebKit/commit/4f645258970b9ba62795feee230ec75eecf81b02
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit/PageLoadBasic.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestLoaderClient.cpp

  Log Message:
  -----------
  Merge r230245 - ASSERTION FAILED: !m_mainFrame->coreFrame()->loader().frameHasLoaded() || !m_pendingNavigationID when reloading page while a page is loading
https://bugs.webkit.org/show_bug.cgi?id=153210

Reviewed by Alex Christensen.

Source/WebKit:

The assert happens when WebPage::reload() is called twice and the first time the reload is ignored by
FrameLoader because the document URL is empty. In that case the pending navigation is not reset, because
FrameLoader::reload() returns before creating the document loader.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::reload): Check if the pending navigation has been reset after calling FrameLoader::reload()
and reset it otherwise.

Tools:

Add unit tests to WebKit C API and WebKitGLib.

* TestWebKitAPI/Tests/WebKit/PageLoadBasic.cpp:
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebKitGLib/TestLoaderClient.cpp:
(LoadTwiceAndReloadTest::reloadOnFinishLoad):
(LoadTwiceAndReloadTest::LoadTwiceAndReloadTest):
(LoadTwiceAndReloadTest::~LoadTwiceAndReloadTest):
(LoadTwiceAndReloadTest::waitUntilFinished):
(testWebViewLoadTwiceAndReload):
(beforeAll):


  Commit: f963d0ceab5e96b1fe417199e00ddd4cf5237970
      https://github.com/WebKit/WebKit/commit/f963d0ceab5e96b1fe417199e00ddd4cf5237970
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSArray.cpp

  Log Message:
  -----------
  Merge r230264 - JSArray::appendMemcpy seems to be missing a barrier
https://bugs.webkit.org/show_bug.cgi?id=184290

Reviewed by Mark Lam.

If you write to an array that may contain pointers and you didn't just allocate it, then you need to
barrier right after.

I don't know if this is really a bug - it's possible that all callers of appendMemcpy do things that
obviate the need for this barrier. But these barriers are cheap, so we should do them if in doubt.

* runtime/JSArray.cpp:
(JSC::JSArray::appendMemcpy):


  Commit: e2bc7097bdfd1ce68e4ab302c07a7ae7ef9ab474
      https://github.com/WebKit/WebKit/commit/e2bc7097bdfd1ce68e4ab302c07a7ae7ef9ab474
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/array-push-nan-to-double-array-cse-sane-and-insane-chain.js
    A JSTests/stress/array-push-nan-to-double-array.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGCSEPhase.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGHeapLocation.cpp
    M Source/JavaScriptCore/dfg/DFGHeapLocation.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r230287 - REGRESSION(r222563): removed DoubleReal type check causes tons of crashes because CSE has never known how to handle SaneChain
https://bugs.webkit.org/show_bug.cgi?id=184319

Reviewed by Saam Barati.

JSTests:

* stress/array-push-nan-to-double-array-cse-sane-and-insane-chain.js: Added.
(foo):
(bar):
* stress/array-push-nan-to-double-array.js: Added.
(foo):
(bar):

Source/JavaScriptCore:

In r222581, we replaced type checks about DoubleReal in ArrayPush in the DFG/FTL backends with
assertions. That's correct because FixupPhase was emitting those checks as Check(DoubleRealRep:) before
the ArrayPush.

But this revealed a longstanding CSE bug: CSE will happily match a SaneChain GetByVal with a InBounds
GetByVal. SaneChain can return NaN while InBounds cannot. This means that if we first use AI to
eliminate the Check(DoubleRealRep:) based on the input being a GetByVal(InBounds) but then replace that
with a GetByVal(SaneChain), then we will hit the assertion.

This teaches CSE to not replace GetByVal(InBounds) with GetByVal(SaneChain) and vice versa. That gets
tricky because PutByVal can match either. So, we use the fact that it's legal for a store to def() more
than once: PutByVal now defs() a HeapLocation for InBounds and a HeapLocation for SaneChain.

* dfg/DFGCSEPhase.cpp:
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileArrayPush):


  Commit: 6fcfecb9c068a280600a2e0b28751851529cd7cf
      https://github.com/WebKit/WebKit/commit/6fcfecb9c068a280600a2e0b28751851529cd7cf
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/block/crash-when-subtree-is-still-attached-expected.txt
    A LayoutTests/fast/block/crash-while-folding-anonymous-blocks-expected.txt
    A LayoutTests/fast/block/crash-while-folding-anonymous-blocks.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp

  Log Message:
  -----------
  Merge r230313 - Folding anonymous blocks should not result in deleting content.
https://bugs.webkit.org/show_bug.cgi?id=184339
<rdar://problem/37327428>

Reviewed by Antti Koivisto.

Source/WebCore:

While folding multiple anonymous blocks (moving the children from next sibling over to previous sibling)
we should ensure that the block we are about to destroy does not gain new descendants.
In case of 4 sibling anonymous blocks (A B C D), while destroying B
1. we move C's children to A and destroy C.
2. While destroying C, we notice B and C as sibling anonymous blocks and we move
D's children over to B (even though B is going to be destroyed as we climb back on the stack).

In this patch, B is detached from the tree before we start moving renderers around so that a subsequent folding won't
find B anymore as a candidate.

Test: fast/block/crash-while-folding-anonymous-blocks.html

* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::detach):

LayoutTests:

* fast/block/crash-when-subtree-is-still-attached-expected.txt: Progressing. This test does not
intend to remove "foobar" text at all.
* fast/block/crash-while-folding-anonymous-blocks-expected.txt: Added.
* fast/block/crash-while-folding-anonymous-blocks.html: Added.


  Commit: aa2e426525a252fec14d6e4b254b49f9dd565736
      https://github.com/WebKit/WebKit/commit/aa2e426525a252fec14d6e4b254b49f9dd565736
  Author: BJ Burg <bburg at apple.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp

  Log Message:
  -----------
  Merge r230367 - REGRESSION(r228371): WebAutomationSession::deleteAllCookies doesn't delete some cookies
https://bugs.webkit.org/show_bug.cgi?id=184334
<rdar://problem/39212863>

Reviewed by Timothy Hatcher.

When WebDriver adds a cookie for 'localhost', it actually uses the domain '.localhost' per RFC.
When deleting cookies, we first fetch all cookies matching the document's hostname, and
then delete them one by one. However, this code path does not add the dot prefix. This causes
no cookies to match the requested domain, and thus none of them are deleted.

* UIProcess/Automation/WebAutomationSession.cpp:
(WebKit::domainByAddingDotPrefixIfNeeded): Extract this helper method.
(WebKit::WebAutomationSession::addSingleCookie): Use helper method.
(WebKit::WebAutomationSession::deleteAllCookies): Add a dot prefix when
requesting to delete all cookies for a hostname.


  Commit: 536bb194038259c8dfaaff73d0e4cfc300d34a92
      https://github.com/WebKit/WebKit/commit/536bb194038259c8dfaaff73d0e4cfc300d34a92
  Author: Daniel Rusek <mail at asciiwolf.com>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/cs.po

  Log Message:
  -----------
  Merge r230384 - Updated Czech translation
https://bugs.webkit.org/show_bug.cgi?id=184403

Patch by Daniel Rusek <mail at asciiwolf.com> on 2018-04-08
Rubber-stamped by Michael Catanzaro.

* cs.po:


  Commit: 021410f736f3d1fb33070ba45f5901cceb13acc0
      https://github.com/WebKit/WebKit/commit/021410f736f3d1fb33070ba45f5901cceb13acc0
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/gtk/WaylandCompositorDisplay.cpp

  Log Message:
  -----------
  Merge r230390 - [GTK] WaylandCompositorDisplay leaks its wl_display
https://bugs.webkit.org/show_bug.cgi?id=184406

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Remove the protected default constructor, for good measure.

* platform/graphics/wayland/PlatformDisplayWayland.h:

Source/WebKit:

* WebProcess/gtk/WaylandCompositorDisplay.cpp:
(WebKit::WaylandCompositorDisplay::create): Fix a log message (drive-by).
(WebKit::WaylandCompositorDisplay::WaylandCompositorDisplay): Fix the leak.


  Commit: d3c86af992d7e8724a1efc2ea72360b4170b7a1b
      https://github.com/WebKit/WebKit/commit/d3c86af992d7e8724a1efc2ea72360b4170b7a1b
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-04-09 (Mon, 09 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/gtk/docs/webkit2gtk-docs.sgml

  Log Message:
  -----------
  Unreviewed. Fix title of 2.20 new symbols section in docs.

* UIProcess/API/gtk/docs/webkit2gtk-docs.sgml:


  Commit: b0031f07e2faefb3ebb91dc43dc2dcdd218e145d
      https://github.com/WebKit/WebKit/commit/b0031f07e2faefb3ebb91dc43dc2dcdd218e145d
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/gtk/WaylandCompositorDisplay.cpp

  Log Message:
  -----------
  Merge r230442 - Unreviewed, rolling out r230390.

Broke accelerated compositing

Reverted changeset:

"[GTK] WaylandCompositorDisplay leaks its wl_display"
https://bugs.webkit.org/show_bug.cgi?id=184406
https://trac.webkit.org/changeset/230390


  Commit: 6fff9a77d701725c4473b5a2e9f8c2c32a8428c5
      https://github.com/WebKit/WebKit/commit/6fff9a77d701725c4473b5a2e9f8c2c32a8428c5
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/Connection.h
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp

  Log Message:
  -----------
  REGRESSION(r222772): [GTK][WPE] WebProcess from WebKitGtk+ 2.19.9x SIGSEVs in WebKit::WebProcess::ensureNetworkProcessConnection() at Source/WebKit/WebProcess/WebProcess.cpp:1127
https://bugs.webkit.org/show_bug.cgi?id=183348

Reviewed by Michael Catanzaro.

Source/WebKit:

When connection doesn't exit in case of sync message failure, always exit in case of failing to send
GetNetworkProcessConnection message. This can happen when the WebView is created and destroyed quickly.

* Platform/IPC/Connection.h:
(IPC::Connection::shouldExitOnSyncMessageSendFailure const):
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::ensureNetworkProcessConnection):

Tools:

Add a test case to reproduce the crash.

* TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp:
(testWebViewCloseQuickly):
(beforeAll):


  Commit: 523c9dd26b8df0788f48c715e67bee285e296a96
      https://github.com/WebKit/WebKit/commit/523c9dd26b8df0788f48c715e67bee285e296a96
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-04-10 (Tue, 10 Apr 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.20.1 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.20.1.


  Commit: 1a9ad2be35f67ddc6014d0e08a867933004aad02
      https://github.com/WebKit/WebKit/commit/1a9ad2be35f67ddc6014d0e08a867933004aad02
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/Connection.h
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp

  Log Message:
  -----------
  Revert "REGRESSION(r222772): [GTK][WPE] WebProcess from WebKitGtk+ 2.19.9x SIGSEVs in WebKit::WebProcess::ensureNetworkProcessConnection() at Source/WebKit/WebProcess/WebProcess.cpp:1127"

This reverts commit r230476.


  Commit: b72ca489feb76391cd29aa2d8bd16cbf6d835f9c
      https://github.com/WebKit/WebKit/commit/b72ca489feb76391cd29aa2d8bd16cbf6d835f9c
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp

  Log Message:
  -----------
  Merge r231298 - REGRESSION(r222772): [GTK][WPE] WebProcess from WebKitGtk+ 2.19.9x SIGSEVs in WebKit::WebProcess::ensureNetworkProcessConnection() at Source/WebKit/WebProcess/WebProcess.cpp:1127
https://bugs.webkit.org/show_bug.cgi?id=183348

Reviewed by Michael Catanzaro.

Source/WebKit:

When connection doesn't exit in case of sync message failure, always exit in case of failing to send
GetNetworkProcessConnection or GetStorageProcessConnection messages. This can happen when the WebView is created
and destroyed quickly.

* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::ensureNetworkProcessConnection):
(WebKit::WebProcess::ensureWebToStorageProcessConnection):

Tools:

Add a test case to reproduce the crash.

* TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp:
(testWebViewCloseQuickly):
(beforeAll):


  Commit: 1dd95dfa152e8eaab839eb083242e7ab3c636b88
      https://github.com/WebKit/WebKit/commit/1dd95dfa152e8eaab839eb083242e7ab3c636b88
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderImage.cpp

  Log Message:
  -----------
  Merge r230480 - Do not layout images when we only need the overflow information.
https://bugs.webkit.org/show_bug.cgi?id=175331

Reviewed by Simon Fraser.

This improves MotionMark's Simple Leaves by ~10%.

Covered by existing tests.

* rendering/RenderImage.cpp:
(WebCore::RenderImage::layout):


  Commit: 04bfdec92687b062dfc52b80ecd8d64c8092c7b8
      https://github.com/WebKit/WebKit/commit/04bfdec92687b062dfc52b80ecd8d64c8092c7b8
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebProcess.cpp

  Log Message:
  -----------
  Merge r230481 - [GTK][WPE] Race condition when destroying webprocesses
https://bugs.webkit.org/show_bug.cgi?id=184445

Reviewed by Carlos Garcia Campos.

Ensure that the WebProcess is properly closing its pages when it's exiting because
the UIProcess has invalidated the IPC connection.

* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::didClose):


  Commit: 66b580401d0f3d99b43048678783589adc00bde8
      https://github.com/WebKit/WebKit/commit/66b580401d0f3d99b43048678783589adc00bde8
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGClobberize.h

  Log Message:
  -----------
  Merge r230485 - REGRESSION(r227341 and r227742): AI and clobberize should be precise and consistent about the effectfulness of CompareEq
https://bugs.webkit.org/show_bug.cgi?id=184455

Reviewed by Michael Saboff.

LICM is sort of an assertion that AI is as precise as clobberize about effects. If clobberize
says that something is not effectful, then LICM will try to hoist it. But LICM's AI hack
(AtTailAbstractState) cannot handle hoisting of things that have effects. So, if AI thinks that
the thing being hoisted does have effects, then we get a crash.

In r227341, we incorrectly told AI that CompareEq(Untyped:, _) is effectful. In fact, only
ComapreEq(Untyped:, Untyped:) is effectful, and clobberize knew this already. As a result, LICM
would blow up if we hoisted CompareEq(Untyped:, Other:), which clobberize knew wasn't
effectful.

Instead of fixing this by making AI precise, in r227742 we made matters worse by then breaking
clobberize to also think that CompareEq(Untyped:, _) is effectful.

This fixes the whole situation by teaching both clobberize and AI that the only effectful form
of CompareEq is ComapreEq(Untyped:, Untyped:).

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):


  Commit: 0794095a3a170d71826e78136203d1371ef9342e
      https://github.com/WebKit/WebKit/commit/0794095a3a170d71826e78136203d1371ef9342e
  Author: Wenson Hsieh <wenson_hsieh at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/editing/selection/iframe-update-selection-appearance-expected.txt
    A LayoutTests/editing/selection/iframe-update-selection-appearance.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/FrameSelection.cpp

  Log Message:
  -----------
  Merge r230513 - FrameSelection::appearanceUpdateTimerFired should be robust against layout passes underneath it
https://bugs.webkit.org/show_bug.cgi?id=183395
<rdar://problem/38055732>

Reviewed by Zalan Bujtas.

Source/WebCore:

In the case where a FrameSelection updates its appearance when m_appearanceUpdateTimer is fired, the
FrameSelection's Frame is unprotected, and can be removed by arbitrary script. This patch applies a simple
mitigation by wrapping the Frame in a Ref when firing the appearance update timer.

Test: editing/selection/iframe-update-selection-appearance.html

* editing/FrameSelection.cpp:
(WebCore::FrameSelection::appearanceUpdateTimerFired):

LayoutTests:

Add a new layout test that passes if we didn't crash.

* editing/selection/iframe-update-selection-appearance-expected.txt: Added.
* editing/selection/iframe-update-selection-appearance.html: Added.


  Commit: 2521669cb18c07696842f66e30e1d9572e0e9e36
      https://github.com/WebKit/WebKit/commit/2521669cb18c07696842f66e30e1d9572e0e9e36
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/PlatformDisplay.cpp
    M Source/WebCore/platform/graphics/PlatformDisplay.h
    M Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp
    M Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.h
    M Source/WebCore/platform/graphics/win/PlatformDisplayWin.h
    M Source/WebCore/platform/graphics/wpe/PlatformDisplayWPE.cpp
    M Source/WebCore/platform/graphics/wpe/PlatformDisplayWPE.h
    M Source/WebCore/platform/graphics/x11/PlatformDisplayX11.cpp
    M Source/WebCore/platform/graphics/x11/PlatformDisplayX11.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/gtk/WaylandCompositorDisplay.cpp

  Log Message:
  -----------
  Merge r230529 - [GTK] WaylandCompositorDisplay leaks its wl_display
https://bugs.webkit.org/show_bug.cgi?id=184406

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Well, this was harder than expected. We really just want to fix a small leak in the WebKit
layer, but that requires a change in how WaylandCompositorDisplay calls the
PlatformDisplayWayland constructor, to pass NativeDisplayOwned::Yes. That means
WaylandCompositorDisplay can no longer use PlatformDisplayWayland's protected default
constructor. Problem is that the normal PlatformDisplayWayland constructor calls
PlatformDisplayWayland::initialize, which calls PlatformDisplayWayland::registryGlobal,
which is a virtual function. The WaylandCompositorDisplay portion of the object is not
constructed yet at this point, so WaylandCompositorDisplay::registryGlobal will never be
called if we do that. I had to revert the previous version of this fix due to this problem.
It had broken accelerated compositing.

I'm reminded of Effective C++ item #9: Never call virtual functions during construction or
destruction ("because such calls will never go to a more derived class than that of the
currently executing constructor or destructor"). This code is fragile and likely to break
again in the future, so let's refactor it a bit. Instead of calling initialize in the
constructor, we'll call it from create functions. We'll have to add a couple create
functions, and make the constructor protected to ensure it's not possible to create a
PlatformDisplayWayland without initializing it. For good parallelism, do the same for the
other PlatformDisplay classes.

This commit additionally removes PlatformDisplayWayland's protected default constructor,
since it's not needed anymore.

The NativeDisplayOwned arguments to the PlatformDisplay constructors are now mandatory,
instead of using NativeDisplayOwned::No as the default value, since that was dangerously
close to being the cause of this leak, and the constructors are now accessed from private
create functions anyway. Some more caution when using default parameter values is warranted
in the future.

Lastly, since we have to change PlatformDisplay::createPlatformDisplay to use the new create
functions, take the opportunity to move things around a bit for clarity. There should be no
change in behavior. I was just disappointed that the PlatformDisplayWPE creation was at the
bottom of the function, after a comment indicating that normal display creation has failed,
which is not the case for WPE.

This all might have been a bit overkill, since the leak could probably have been fixed by
passing nullptr to the PlatformDisplayWayland constructor for the wl_display and not
removing WaylandCompositorDisplay's call to PlatformDisplayWayland::initialize. But the
correctness of that code would then rely on implementation details of initialize, so this
refactor seems better.

No new tests since there *should* be no behavior change. Then again, I'm touching
PlatformDisplay, and history shows we don't have the greatest track record of touching this
code without introducing problems.

* platform/graphics/PlatformDisplay.cpp:
(WebCore::PlatformDisplay::createPlatformDisplay):
* platform/graphics/PlatformDisplay.h:
* platform/graphics/wayland/PlatformDisplayWayland.cpp:
(WebCore::PlatformDisplayWayland::create):
(WebCore::PlatformDisplayWayland::create):
(WebCore::PlatformDisplayWayland::createHeadless):
(WebCore::PlatformDisplayWayland::PlatformDisplayWayland):
(WebCore::PlatformDisplayWayland::initialize):
* platform/graphics/wayland/PlatformDisplayWayland.h:
* platform/graphics/win/PlatformDisplayWin.h:
* platform/graphics/wpe/PlatformDisplayWPE.cpp:
(WebCore::create):
* platform/graphics/wpe/PlatformDisplayWPE.h:
* platform/graphics/x11/PlatformDisplayX11.cpp:
(WebCore::PlatformDisplayX11::create):
(WebCore::PlatformDisplayX11::create):
(WebCore::PlatformDisplayX11::createHeadless):
* platform/graphics/x11/PlatformDisplayX11.h:

Source/WebKit:

Since we allocate our own wl_display here, need to chain up to the parent constructor
passing NativeDisplayOwned::Yes, or it won't ever be released. Move the initialize call to
the create function to ensure it's called after the constructor completes.

* WebProcess/gtk/WaylandCompositorDisplay.cpp:
(WebKit::WaylandCompositorDisplay::create): Fix a log message (drive-by).
(WebKit::WaylandCompositorDisplay::WaylandCompositorDisplay):


  Commit: 04fd7d47ef8af27d6531eed03d9718cda9ee8b9b
      https://github.com/WebKit/WebKit/commit/04fd7d47ef8af27d6531eed03d9718cda9ee8b9b
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/wayland/PlatformDisplayWayland.cpp

  Log Message:
  -----------
  Merge r230706 - [GTK] Build fix after r230529 (WaylandCompositorDisplay leaks its wl_display)
https://bugs.webkit.org/show_bug.cgi?id=184406

Rubber-stamped by Michael Catanzaro.

Fix build with clang 3.8

No new tests, it is a build fix.

* platform/graphics/wayland/PlatformDisplayWayland.cpp:
(WebCore::PlatformDisplayWayland::create):


  Commit: 98a4ea22650bb0909402a213f76780acf552919d
      https://github.com/WebKit/WebKit/commit/98a4ea22650bb0909402a213f76780acf552919d
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/RegisterState.h
    M Source/JavaScriptCore/jit/JIT.h
    M Source/JavaScriptCore/runtime/VM.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Gigacage.cpp
    M Source/WTF/wtf/Gigacage.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cpu/arm/filters/FELightingNEON.cpp
    M Source/WebCore/platform/graphics/cpu/arm/filters/FELightingNEON.h
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/Gigacage.cpp
    M Source/bmalloc/bmalloc/Gigacage.h

  Log Message:
  -----------
  Merge r230380 - Use alignas instead of compiler-specific attributes
https://bugs.webkit.org/show_bug.cgi?id=183508

Reviewed by Mark Lam.

Source/bmalloc:

Use alignas for g_gigacageBasePtr. We also add reinterpret_cast to fix
compile errors in ARMv7 and MIPS JSCOnly ports.

* bmalloc/Gigacage.cpp:
* bmalloc/Gigacage.h:
(Gigacage::basePtrs):

Source/JavaScriptCore:

Use C++11 alignas specifier. It is portable compared to compiler-specific aligned attributes.

* heap/RegisterState.h:
* jit/JIT.h:
(JSC::JIT::compile): Deleted.
(JSC::JIT::compileGetByVal): Deleted.
(JSC::JIT::compileGetByValWithCachedId): Deleted.
(JSC::JIT::compilePutByVal): Deleted.
(JSC::JIT::compileDirectPutByVal): Deleted.
(JSC::JIT::compilePutByValWithCachedId): Deleted.
(JSC::JIT::compileHasIndexedProperty): Deleted.
(JSC::JIT::appendCall): Deleted.
(JSC::JIT::appendCallWithSlowPathReturnType): Deleted.
(JSC::JIT::exceptionCheck): Deleted.
(JSC::JIT::exceptionCheckWithCallFrameRollback): Deleted.
(JSC::JIT::emitInt32Load): Deleted.
(JSC::JIT::emitInt32GetByVal): Deleted.
(JSC::JIT::emitInt32PutByVal): Deleted.
(JSC::JIT::emitDoublePutByVal): Deleted.
(JSC::JIT::emitContiguousPutByVal): Deleted.
(JSC::JIT::emitStoreCell): Deleted.
(JSC::JIT::getSlowCase): Deleted.
(JSC::JIT::linkSlowCase): Deleted.
(JSC::JIT::linkDummySlowCase): Deleted.
(JSC::JIT::linkAllSlowCases): Deleted.
(JSC::JIT::callOperation): Deleted.
(JSC::JIT::callOperationWithProfile): Deleted.
(JSC::JIT::callOperationWithResult): Deleted.
(JSC::JIT::callOperationNoExceptionCheck): Deleted.
(JSC::JIT::callOperationWithCallFrameRollbackOnException): Deleted.
(JSC::JIT::emitEnterOptimizationCheck): Deleted.
(JSC::JIT::sampleCodeBlock): Deleted.
(JSC::JIT::canBeOptimized): Deleted.
(JSC::JIT::canBeOptimizedOrInlined): Deleted.
(JSC::JIT::shouldEmitProfiling): Deleted.
* runtime/VM.h:

Source/WebCore:

Use alignas instead of aligned.

* platform/graphics/cpu/arm/filters/FELightingNEON.cpp:
* platform/graphics/cpu/arm/filters/FELightingNEON.h:
(WebCore::FELighting::platformApplyNeon):

Source/WTF:

Use alignas for g_gigacageBasePtr. We also add reinterpret_cast to fix
compile errors in ARMv7 and MIPS JSCOnly ports.

* wtf/Gigacage.cpp:
* wtf/Gigacage.h:
(Gigacage::basePtrs):


  Commit: 5a15d5c0afb7e55f67a1f60a3bd1400c1d9f0014
      https://github.com/WebKit/WebKit/commit/5a15d5c0afb7e55f67a1f60a3bd1400c1d9f0014
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h

  Log Message:
  -----------
  Merge r230627 - [GTK] [gstreamer] video won't unpause when built with -DUSE_GSTREAMER_GL=OFF
https://bugs.webkit.org/show_bug.cgi?id=183362

Reviewed by Carlos Garcia Campos.

Remove the drawCancelled flag and use a new one to indicate that the player is being destroyed.
That new flag is only enabled on destruction and it's not modified by cancelRepaint(), which
can be used to handle the pause event without avoiding future renderings. Also cancelRepaint()
has only effect when not in AC mode.

Covered by existent tests.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
(WebCore::MediaPlayerPrivateGStreamerBase::cancelRepaint):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:


  Commit: 759923a0030d9dcb9b328d088389f7fb5e16d9e6
      https://github.com/WebKit/WebKit/commit/759923a0030d9dcb9b328d088389f7fb5e16d9e6
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h

  Log Message:
  -----------
  Merge r230629 - REGRESSION(r230627): [GTK][WPE] Possible deadlock when destroying the player in non AC mode
https://bugs.webkit.org/show_bug.cgi?id=184583

Reviewed by Carlos Garcia Campos.

In non AC mode, ensure that a deadlock can't happen when destroying MediaPlayerPrivateGStreamerBase.

Covered by existent tests.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::~MediaPlayerPrivateGStreamerBase):
(WebCore::MediaPlayerPrivateGStreamerBase::triggerRepaint):
(WebCore::MediaPlayerPrivateGStreamerBase::cancelRepaint):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.h:


  Commit: f4ad44299d9877046528bc5b82df8cc8c20e1aa6
      https://github.com/WebKit/WebKit/commit/f4ad44299d9877046528bc5b82df8cc8c20e1aa6
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitBackForwardList.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitNetworkProxySettings.cpp

  Log Message:
  -----------
  Merge r230718 - [WPE][GTK] GObject introspection annotation fixes: BackForwardList, NetworkProxySettings
https://bugs.webkit.org/show_bug.cgi?id=184658

Reviewed by Carlos Garcia Campos.

Thanks to Dylan Simon for recommending these annotation fixes.

* UIProcess/API/glib/WebKitBackForwardList.cpp:
* UIProcess/API/glib/WebKitNetworkProxySettings.cpp:


  Commit: 6d5b971c0f5d5ea03f3a31c4c5313d26caad8822
      https://github.com/WebKit/WebKit/commit/6d5b971c0f5d5ea03f3a31c4c5313d26caad8822
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merge r230749 - [GTK] Webkit should spoof as Safari on a Mac for Outlook.com
https://bugs.webkit.org/show_bug.cgi?id=184573

Reviewed by Carlos Alberto Lopez Perez.

Source/WebCore:

Add quirk for outlook.live.com.

* platform/UserAgentQuirks.cpp:
(WebCore::urlRequiresMacintoshPlatform):

Tools:

* TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:
(TestWebKitAPI::TEST):


  Commit: d1ad3805106a0bdbfb35aeac6573b38cb4bb37bd
      https://github.com/WebKit/WebKit/commit/d1ad3805106a0bdbfb35aeac6573b38cb4bb37bd
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/forms/scrollheight-with-mutation-crash-expected.txt
    A LayoutTests/fast/forms/scrollheight-with-mutation-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  Merge r229505 - Turn off offset*/scroll* optimization for input elements with shadow content
https://bugs.webkit.org/show_bug.cgi?id=182383
<rdar://problem/37114190>

Reviewed by Antti Koivisto.

Source/WebCore:

We normally ensure clean tree before calling offsetHeight/Width, scrollHeight/Width.
In certain cases (see updateLayoutIfDimensionsOutOfDate() for details), it's okay to return
the previously computed values even when some part of the tree is dirty.
In case of shadow content, updateLayoutIfDimensionsOutOfDate() might return false (no need to layout)
for the root, while true (needs layout) for the shadow content.
This could confuse the caller (Element::scrollWidth/Height etc) and lead to incorrect result.

Test: fast/forms/scrollheight-with-mutation-crash.html

* dom/Document.cpp:
(WebCore::Document::updateLayoutIfDimensionsOutOfDate):

LayoutTests:

* fast/forms/scrollheight-with-mutation-crash-expected.txt: Added.
* fast/forms/scrollheight-with-mutation-crash.html: Added.


  Commit: 4c440d65d981521dcc2f547ec573c994c276d665
      https://github.com/WebKit/WebKit/commit/4c440d65d981521dcc2f547ec573c994c276d665
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M ChangeLog
    M Source/PlatformGTK.cmake
    M Tools/ChangeLog
    M Tools/gtk/gtkdoc.py
    M Tools/gtk/manifest.txt.in

  Log Message:
  -----------
  Merge r230837 - [GTK] Local cross references are broken in API documentation
https://bugs.webkit.org/show_bug.cgi?id=184771

Reviewed by Michael Catanzaro.

.:

Update the documentation html paths and install the JSC GLib API too.

* Source/PlatformGTK.cmake:

Tools:

The problem is that gtkdoc-fixxref expects the links to be in the form html/modulename (like the installed
ones), but we generate the documentation as modulename/html. So, links to WebKitDOM or JSC are generated as
../html/Foo. The rebase command considers html to be the module name in this case, creating broken links in all
the cases.

* gtk/gtkdoc.py:
(GTKDoc._copy_doc_files_to_output_dir): We don't have any html dir in the source tree so, we are not copying
anything here.
(GTKDoc._run_gtkdoc_mkhtml): Create the html dir here using html/modulename instead now.
(GTKDoc._run_gtkdoc_fixxref): Pass the new directory as module dir to gtkdoc-fixxref and fix several links for
which gtkdoc-fixxref always uses absolute paths.
* gtk/manifest.txt.in: Update the documentation html paths and include the JSC GLib API in the tarball too.


  Commit: b39d98891a3c1da906968010263fb9179fe4d350
      https://github.com/WebKit/WebKit/commit/b39d98891a3c1da906968010263fb9179fe4d350
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/ResourceError.h
    M Source/WebCore/platform/network/soup/ResourceErrorSoup.cpp
    M Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
    M Source/WebCore/platform/network/soup/SoupNetworkSession.cpp
    M Source/WebCore/platform/network/soup/SoupNetworkSession.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp
    M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.h

  Log Message:
  -----------
  Merge r230885 - [SOUP] Do TLS error checking on GTlsConnection::accept-certificate
https://bugs.webkit.org/show_bug.cgi?id=184480

Reviewed by Michael Catanzaro.

Source/WebCore:

* platform/network/soup/ResourceError.h: Change tlsError to recieve a failing URL instead of a SoupRequest,
since the request was only used to get the failing URL.
* platform/network/soup/ResourceErrorSoup.cpp:
(WebCore::ResourceError::tlsError): Use the given failing URL.
* platform/network/soup/SoupNetworkSession.cpp:
(WebCore::SoupNetworkSession::SoupNetworkSession): Use ssl-strict when creating the SoupSession to handle the
certificates ourselves by connecting to GTlsConnection::accept-certificate.
(WebCore::SoupNetworkSession::checkTLSErrors): Updated to receive a URL, certificate and errors instead of
receiving a SoupRequest and SoupMessage and extract the url, certirficate and errors from them. Also return the
optional error directly instead of using a completion handler since the function is always synchronous.
* platform/network/soup/SoupNetworkSession.h:

Source/WebKit:

Connect to GTlsConnection::accept-certificate signal instead of SoupMessage::notify::tls-errors to perform the
TLS errors check.

* NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::createRequest): Do not connect to SoupMessage::notify::tls-errors.
(WebKit::NetworkDataTaskSoup::tlsConnectionAcceptCertificateCallback): Call tlsConnectionAcceptCertificate() is
the task is still ongoing.
(WebKit::NetworkDataTaskSoup::tlsConnectionAcceptCertificate): Check TLS errors here.
(WebKit::NetworkDataTaskSoup::networkEventCallback): Pass the stream to networkEvent.
(WebKit::NetworkDataTaskSoup::networkEvent): Connect to GTlsConnection::accept-certificate.
* NetworkProcess/soup/NetworkDataTaskSoup.h:


  Commit: 43e3a3cf2464bbff7f14b32f939d245f551826bf
      https://github.com/WebKit/WebKit/commit/43e3a3cf2464bbff7f14b32f939d245f551826bf
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/SocketStreamHandleImpl.h
    M Source/WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestSSL.cpp

  Log Message:
  -----------
  Merge r230886 - REGRESSION(r228088): [SOUP] Check TLS errors for WebSockets on GTlsConnection::accept-certificate
https://bugs.webkit.org/show_bug.cgi?id=184804

Source/WebCore:

Reviewed by Michael Catanzaro.

* platform/network/soup/SocketStreamHandleImpl.h: Add a public url getter.
* platform/network/soup/SocketStreamHandleImplSoup.cpp:
(WebCore::acceptCertificateCallback): Call SoupNetworkSession::checkTLSErrors() to decide whether to accept the
certificate or not.
(WebCore::connectProgressCallback): Receive the SocketStreamHandle and pass it to acceptCertificateCallback callback.
(WebCore::socketClientEventCallback): Ditto.
(WebCore::SocketStreamHandleImpl::create): Always connect to network events.
(WebCore::wssConnectionAcceptCertificateCallback): Deleted.
(WebCore::wssSocketClientEventCallback): Deleted.

Tools:

Patch by Michael Catanzaro <mcatanzaro at igalia.com> on 2018-04-20
Reviewed by Carlos Garcia Campos.

* TestWebKitAPI/Tests/WebKitGLib/TestSSL.cpp:
(WebSocketTest::WebSocketTest):
(WebSocketTest::~WebSocketTest):
(WebSocketTest::serverWebSocketCallback):
(WebSocketTest::webSocketTestResultCallback):
(WebSocketTest::connectToServerAndWaitForEvents):
(testWebSocketTLSErrors):
(beforeAll):


  Commit: a8e7a0aebcd047080b0d913bab37b2fff4df3b72
      https://github.com/WebKit/WebKit/commit/a8e7a0aebcd047080b0d913bab37b2fff4df3b72
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Tools/ChangeLog
    A Tools/TestWebKitAPI/Tests/WebKitGLib/resources/generate-test-cert.sh
    A Tools/TestWebKitAPI/Tests/WebKitGLib/resources/test-cert.conf
    M Tools/TestWebKitAPI/Tests/WebKitGLib/resources/test-cert.pem

  Log Message:
  -----------
  Merge r230911 - [GTK][WPE] TestSSL fails due to additional TLS errors returned
https://bugs.webkit.org/show_bug.cgi?id=184860

Reviewed by Carlos Garcia Campos.

Add script and config file for regenerating the test certificate.
Regenerate it. TestSSL no longer fails on my machine.

I do see a ton of network process crashes and JavaScript errors, none of
which prevent the test from passing, but this commit only claims to fix
the certificate validation portion of the test.

* TestWebKitAPI/Tests/WebKitGLib/resources/generate-test-cert.sh: Added.
* TestWebKitAPI/Tests/WebKitGLib/resources/test-cert.conf: Added.
* TestWebKitAPI/Tests/WebKitGLib/resources/test-cert.pem:


  Commit: 401d43a02bd8b79b9b2dbb109808118b4b5b889d
      https://github.com/WebKit/WebKit/commit/401d43a02bd8b79b9b2dbb109808118b4b5b889d
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

  Log Message:
  -----------
  Merge r230928 - Roll out r226655 because it broke OSR entry when the pre-header is inadequately profiled.

Rubber stamped by Saam Barati.

This is a >2x speed-up in SunSpider/bitops-bitwise-and. We don't really care about SunSpider
anymore, but r226655 didn't result in any benchmark wins and just regressed this test by a lot.
Seems sensible to just roll it out.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::addToGraph):
(JSC::DFG::ByteCodeParser::parse):


  Commit: a2f04b49dc25b60b1018abc1e2f8da1708880834
      https://github.com/WebKit/WebKit/commit/a2f04b49dc25b60b1018abc1e2f8da1708880834
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    R LayoutTests/fast/frames/flattening/media-query-growing-content-expected.txt
    R LayoutTests/fast/frames/flattening/media-query-growing-content.html
    R LayoutTests/fast/frames/flattening/resources/media-query-min-height-with-flattening.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/MediaQueryEvaluator.cpp
    M Source/WebCore/page/FrameView.cpp
    M Source/WebCore/page/FrameView.h
    M Source/WebCore/page/LayoutContext.cpp

  Log Message:
  -----------
  Merge r230933 - REGRESSION (r220112): reCAPTCHA images render off screen on Twitch.tv app Log In or Sign Up
https://bugs.webkit.org/show_bug.cgi?id=182859
<rdar://problem/37595065>

Source/WebCore:

Reviewed by Zalan Bujtas.

Roll out this change from the trunk as the issue it fixed no longer occurs.

* css/MediaQueryEvaluator.cpp:
(WebCore::orientationEvaluate):
(WebCore::aspectRatioEvaluate):
(WebCore::heightEvaluate):
(WebCore::widthEvaluate):
* page/FrameView.cpp:
(WebCore::FrameView::layoutSizeForMediaQuery const): Deleted.
* page/FrameView.h:
* page/LayoutContext.cpp:
(WebCore::LayoutContext::handleLayoutWithFrameFlatteningIfNeeded):

LayoutTests:

Reviewed by Zalan Bujtas

* fast/frames/flattening/media-query-growing-content-expected.txt: Removed.
* fast/frames/flattening/media-query-growing-content.html: Removed.
* fast/frames/flattening/resources/media-query-min-height-with-flattening.html: Removed.


  Commit: 4e6b488549e7cb7be0b83ccea80c54502d4f18f5
      https://github.com/WebKit/WebKit/commit/4e6b488549e7cb7be0b83ccea80c54502d4f18f5
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
    M Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp

  Log Message:
  -----------
  Merge r230950 - [CoordGraphics] Avoid painting backing stores for zero-opacity layers
https://bugs.webkit.org/show_bug.cgi?id=184143

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Skip generating backing stores for layers that have zero opacity and do
not animate the opacity value. In the current CoordinatedGraphics system
this can end up saving loads of memory on Web content that deploys a
large number of such elements.

* platform/graphics/texmap/TextureMapperLayer.h:
* platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
(WebCore::CoordinatedGraphicsLayer::shouldHaveBackingStore const):

Source/WebKit:

* Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:
(WebKit::layerShouldHaveBackingStore):
Mirror CoordinatedGraphicsLayer's backing store requirements.


  Commit: be1c24c81c0f5500648b77d0fcc3de8ad3ac3131
      https://github.com/WebKit/WebKit/commit/be1c24c81c0f5500648b77d0fcc3de8ad3ac3131
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp

  Log Message:
  -----------
  Merge r230954 - REGRESSION(r230950): Faulty commit sequencing in CoordinatedGraphicsScene
https://bugs.webkit.org/show_bug.cgi?id=184917

Reviewed by Michael Catanzaro.

After r230950, current animation state for a given layer is also taken
into account when determining whether or not the layer requires a
backing store. For that to work properly, all the animation state has
to be updated before the backing store work. This patch changes the
order of helper method invocations in
CoordinatedGraphicsScene::setLayerState() to address that.

* Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:
(WebKit::CoordinatedGraphicsScene::setLayerState):


  Commit: c8cab3301280400f282d3a63a2f67936404b51c3
      https://github.com/WebKit/WebKit/commit/c8cab3301280400f282d3a63a2f67936404b51c3
  Author: Tadeu Zagallo <tzagallo at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/local/formdata/send-form-data-with-empty-file-expected.txt
    A LayoutTests/http/tests/local/formdata/send-form-data-with-empty-file.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/FormData.cpp

  Log Message:
  -----------
  Merge r230963 - REGRESSION(r221839): Fix requests with FormData containing empty files
https://bugs.webkit.org/show_bug.cgi?id=184490
<rdar://problem/39385169>

Patch by Tadeu Zagallo <tzagallo at apple.com> on 2018-04-24
Reviewed by Geoffrey Garen.

Source/WebCore:

We should not append the blob to the FormData when it is a file but has no path. It broke
the submission since the request was failing to read the file in FormDataStreamCFNet.h:156

Test: http/tests/local/formdata/send-form-data-with-empty-file.html

* platform/network/FormData.cpp:
(WebCore::FormData::appendMultiPartFileValue):

LayoutTests:

Verify that the final boundary is present in the request body when submitting FormData containing an empty file.

* http/tests/local/formdata/send-form-data-with-empty-file-expected.txt: Added.
* http/tests/local/formdata/send-form-data-with-empty-file.html: Added.


  Commit: 6dd0e21bb1e5e7e51c8f29c38c0273365c52f64e
      https://github.com/WebKit/WebKit/commit/6dd0e21bb1e5e7e51c8f29c38c0273365c52f64e
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/fromCharCode-exception-check.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/StringConstructor.cpp

  Log Message:
  -----------
  Merge r230980 - fromCharCode is missing some exception checks
https://bugs.webkit.org/show_bug.cgi?id=184952

Reviewed by Saam Barati.

JSTests:

* stress/fromCharCode-exception-check.js: Added.
(get catch):

Source/JavaScriptCore:

I also removed the pointless slow path function and moved it into the
main function.

* runtime/StringConstructor.cpp:
(JSC::stringFromCharCode):
(JSC::stringFromCharCodeSlowCase): Deleted.


  Commit: 90fdf82c18ef408b744d305d079f86a408c898ba
      https://github.com/WebKit/WebKit/commit/90fdf82c18ef408b744d305d079f86a408c898ba
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp

  Log Message:
  -----------
  Merge r231132 - [GTK] WebProcess from WebKitGtk+ 2.19.92 SIGSEVs in WebCore::TextureMapperGL::~TextureMapperGL
https://bugs.webkit.org/show_bug.cgi?id=184040

Reviewed by Michael Catanzaro.

This can happen when using single shared process model or when the process limit is reached in multiple process
model. In this case, all pages in the same web process with accelerated compositing enabled share the same
compositing thread. Every page sets its GL context as current when rendering a frame, but not when invalidating
the threaded compositor when the page is closed. So, if a hidden tab is closed, the threaded compositor is
invalidated and the GL resources of the current context (the visible page) are destroyed. This is also causing
the blank pages issue when closing a tab related to another one, the current one stops rendering anything because
its GL context has been released. We should make the threaded compositor context current when invalidating it.

* Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:
(WebKit::ThreadedCompositor::invalidate):


  Commit: b6e6671adad42f2b4f6430137d800f40b79a4f24
      https://github.com/WebKit/WebKit/commit/b6e6671adad42f2b4f6430137d800f40b79a4f24
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merge r231156 - [GTK] Webkit should spoof as Safari on a Mac when on Chase.com
https://bugs.webkit.org/show_bug.cgi?id=185103

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Send a fake user agent to chase.com to make it work.

* platform/UserAgentQuirks.cpp:
(WebCore::urlRequiresMacintoshPlatform):
(WebCore::UserAgentQuirks::stringForQuirk): Also, remove this stale comment.

Tools:

* TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:
(TestWebKitAPI::TEST):


  Commit: fe01ed88c1d2429aaafbb0ca37b116678aa7520a
      https://github.com/WebKit/WebKit/commit/fe01ed88c1d2429aaafbb0ca37b116678aa7520a
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M PerformanceTests/ChangeLog
    A PerformanceTests/Layout/system-ui.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/FontCascadeFonts.cpp

  Log Message:
  -----------
  Merge r231187 - Improve the performance of FontCascadeDescription's effectiveFamilies
https://bugs.webkit.org/show_bug.cgi?id=184720
PerformanceTests:

Reviewed by Simon Fraser.

This performance test calls SystemFontDatabase::systemFontCascadeList() around 2,000,000 times (before
this patch is applied), which is roughly equivalent to the page we found the performance problem on.
The calling pattern is roughly equivalent in this test.

* Layout/system-ui.html: Added.

Source/WebCore:

<rdar://problem/38970927>

Reviewed by Simon Fraser.

The page that had the performance problem renders many different Chinese characters in system-ui
with only a small number of individual fonts. It turns out we were calling into the system-ui
machinery for each character in order to opportunistically start loading data URLs (see also:
https://bugs.webkit.org/show_bug.cgi?id=175845). These data URLS will never represent the system
font, so we don't need to invoke the system-ui machinery at all.

This patch makes a 92x performance improvement on the associated performance test. This test is
designed to test Chinese text rendered with system-ui.

Performance test: Layout/system-ui.html

* platform/graphics/FontCascadeFonts.cpp:
(WebCore::opportunisticallyStartFontDataURLLoading):


  Commit: b6fcbbc6f8d653e6eadd0ca8b1108328a52f0041
      https://github.com/WebKit/WebKit/commit/b6fcbbc6f8d653e6eadd0ca8b1108328a52f0041
  Author: Dominik Infuehr <dinfuehr at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/closure-recursive-tail-call-infinite-loop.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGMayExit.cpp
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merge r231195 - Add SetCallee as DFG-Operation
https://bugs.webkit.org/show_bug.cgi?id=184582

Patch by Dominik Infuehr <dinfuehr at igalia.com> on 2018-05-01
Reviewed by Filip Pizlo.

JSTests:

Added test that runs into infinite loop without updating the callee and
therefore emitting SetCallee in DFG for recursive tail calls.

* stress/closure-recursive-tail-call-infinite-loop.js: Added.
(Foo):
(second):
(first):
(return.closure):
(createClosure):

Source/JavaScriptCore:

For recursive tail calls not only the argument count can change but also the
callee. Add SetCallee to DFG that sets the callee slot in the current call frame.
Also update the callee when optimizing a recursive tail call.
Enable recursive tail call optimization also for closures.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleRecursiveTailCall):
(JSC::DFG::ByteCodeParser::handleCallVariant):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGMayExit.cpp:
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileSetCallee):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileSetCallee):


  Commit: cf8c63082a5325d573990ae19c436143494fc4f4
      https://github.com/WebKit/WebKit/commit/cf8c63082a5325d573990ae19c436143494fc4f4
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp
    M Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h

  Log Message:
  -----------
  Merge r231300 - WebCore::TextureMapperLayer object used after freed
https://bugs.webkit.org/show_bug.cgi?id=184729

Reviewed by Michael Catanzaro.

Replace the raw pointers with WeakPtr for effectTarget, maskLayer and replicaLayer
inside TextureMapperLayer.

* platform/graphics/texmap/TextureMapperLayer.cpp:
(WebCore::TextureMapperLayer::~TextureMapperLayer):
(WebCore::TextureMapperLayer::setMaskLayer):
(WebCore::TextureMapperLayer::setReplicaLayer):
* platform/graphics/texmap/TextureMapperLayer.h:


  Commit: 1eafa87473650a399c56cf712500f3f6437b5b1b
      https://github.com/WebKit/WebKit/commit/1eafa87473650a399c56cf712500f3f6437b5b1b
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/ResourceRequestBase.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitDownload.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitDownloadClient.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitDownloadPrivate.h
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestDownloads.cpp

  Log Message:
  -----------
  Merge r231350 - [GTK] Epiphany (GNOME Web) says "Error downloading: Service Unavailable." when trying to download an image from discogs.com
https://bugs.webkit.org/show_bug.cgi?id=174730

Reviewed by Michael Catanzaro.

Source/WebCore:

Export ResourceRequestBase::hasHTTPHeaderField().

* platform/network/ResourceRequestBase.h:

Source/WebKit:

The problem is that we don't send any User-Agent HTTP header for downloads started by WebProcessPool::download().

* UIProcess/API/glib/WebKitDownload.cpp:
(webkitDownloadUpdateRequest): Helper to update the cached request.
(webkitDownloadStarted): Updated the cached request if we have one.
(webkit_download_get_request): Use webkitDownloadUpdateRequest().
* UIProcess/API/glib/WebKitDownloadClient.cpp:
* UIProcess/API/glib/WebKitDownloadPrivate.h:
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::download): Set the User-Agent HTTP header if there isn't any.

Tools:

Update unit tests to check that User-Agent header is included in HTTP download requests.

* TestWebKitAPI/Tests/WebKitGLib/TestDownloads.cpp:
(testDownloadRemoteFile):
(testWebViewDownloadURI):
(testPolicyResponseDownload):
(testPolicyResponseDownloadCancel):
(testDownloadMIMEType):
(testContextMenuDownloadActions):


  Commit: 9833f3161e0faa42c2cead707f85254a99654187
      https://github.com/WebKit/WebKit/commit/9833f3161e0faa42c2cead707f85254a99654187
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-05-07 (Mon, 07 May 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.20.2 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.20.2.


  Commit: d3ef0626c5e37332dc2743617c047c20ae7e3ba5
      https://github.com/WebKit/WebKit/commit/d3ef0626c5e37332dc2743617c047c20ae7e3ba5
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebProcess.cpp

  Log Message:
  -----------
  Merge r231482 - Unreviewed. Add missing exit not included in r231298.

* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::ensureWebToStorageProcessConnection):


  Commit: cda85ae463986d3c5df95d51500a82b64ffc6e93
      https://github.com/WebKit/WebKit/commit/cda85ae463986d3c5df95d51500a82b64ffc6e93
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformGTK.cmake
    M Source/WebKit/PlatformWPE.cmake
    A Source/WebKit/Shared/glib/ProcessExecutablePathGLib.cpp
    R Source/WebKit/Shared/gtk/ProcessExecutablePathGtk.cpp
    R Source/WebKit/Shared/wpe/ProcessExecutablePathWPE.cpp
    M Source/WebKit/SourcesGTK.txt
    M Source/WebKit/SourcesWPE.txt
    M Source/cmake/OptionsCommon.cmake
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Merge r230429 - [WPE] Use GNU install directories
https://bugs.webkit.org/show_bug.cgi?id=184377

Reviewed by Carlos Garcia Campos.

.:

Notably, this means all the CMake arguments that distributors use to customize install
directories (-DCMAKE_INSTALL_*DIR) will no longer be ignored.

* Source/cmake/OptionsCommon.cmake:
* Source/cmake/OptionsWPE.cmake:

Source/WebKit:

Merge ProcessExecutablePathGtk and ProcessExecutablePathWPE into ProcessExecutablePathGLib.
WPE will now load its secondary processes from PKGLIBEXECDIR, like WebKitGTK+.

* PlatformWPE.cmake:
* Shared/glib/ProcessExecutablePathGLib.cpp: Renamed from Source/WebKit/Shared/gtk/ProcessExecutablePathGtk.cpp.
(WebKit::getExecutablePath):
(WebKit::findWebKitProcess):
(WebKit::executablePathOfWebProcess):
(WebKit::executablePathOfPluginProcess):
(WebKit::executablePathOfNetworkProcess):
(WebKit::executablePathOfStorageProcess):
* Shared/wpe/ProcessExecutablePathWPE.cpp: Removed.
* SourcesGTK.txt:
* SourcesWPE.txt:


  Commit: 2078291a62d2020d1f2b44a57b478b3cfafa1c73
      https://github.com/WebKit/WebKit/commit/2078291a62d2020d1f2b44a57b478b3cfafa1c73
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake
    M Source/WebKit/wpe/wpe-webkit.pc.in

  Log Message:
  -----------
  Merge r230449 - [WPE] Add API version to library soname and pkg-config files
https://bugs.webkit.org/show_bug.cgi?id=180608

Reviewed by Žan Doberšek.

* PlatformWPE.cmake:
* wpe/wpe-webkit.pc.in:


  Commit: 49dc535972723c02bc74c586423190d4db432d26
      https://github.com/WebKit/WebKit/commit/49dc535972723c02bc74c586423190d4db432d26
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/PlatformWPE.cmake

  Log Message:
  -----------
  Merge r230450 - [WPE] Don't install JSC C API headers
https://bugs.webkit.org/show_bug.cgi?id=184375

Reviewed by Žan Doberšek.

None of the functions declared in these headers are exported in WPE. Use the new jsc API
instead.

* PlatformWPE.cmake:


  Commit: b58dc12693c2241c9628acdf072930e3b1ed650e
      https://github.com/WebKit/WebKit/commit/b58dc12693c2241c9628acdf072930e3b1ed650e
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
    M Source/WebKit/UIProcess/API/wpe/WebKitWebViewBackend.cpp
    M Source/WebKit/UIProcess/API/wpe/WebKitWebViewBackendPrivate.h
    M Source/WebKit/UIProcess/API/wpe/WebKitWebViewWPE.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp
    M Tools/TestWebKitAPI/glib/WebKitGLib/TestMain.h

  Log Message:
  -----------
  Merge r230557 - [WPE] Make WebKitWebViewBackend object mandatory for webkit_web_view_new*() constructors
https://bugs.webkit.org/show_bug.cgi?id=184513

Reviewed by Michael Catanzaro.

Source/WebKit:

webkit_web_view_new*() constructors should always expect a non-null
WebKitWebViewBackend object, forcing the user to specify how the
wpe_view_backend object is managed for the WebKitWebView that's being
created.

webkitWebViewBackendCreateDefault() and the default
_WebKitWebViewBackend() constructor are removed. WPE-specific
webkit_web_view_new*() entrypoints are updated to bail if the passed-in
WebKitWebViewBackend object is null. Documentation is updated
accordingly.

* UIProcess/API/glib/WebKitWebView.cpp:
(webkitWebViewConstructed):
* UIProcess/API/wpe/WebKitWebViewBackend.cpp:
(webkitWebViewBackendCreateDefault): Deleted.
* UIProcess/API/wpe/WebKitWebViewBackendPrivate.h:
* UIProcess/API/wpe/WebKitWebViewWPE.cpp:
(webkit_web_view_new):
(webkit_web_view_new_with_context):
(webkit_web_view_new_with_related_view):
(webkit_web_view_new_with_settings):
(webkit_web_view_new_with_user_content_manager):

Tools:

Update the WPE-specific testWebViewWebBackend() test case, removing the
test that passes a null WebKitWebViewBackend object to the
webkit_web_view_new() call.

Helper createWebViewBackend() that's called via Test::createWebView()
variations is updated to, in case of not using the headless backend,
return a WebKitWebViewBackend instance that wraps around a
default wpe_view_backend object.

* TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp:
(testWebViewWebBackend):
* TestWebKitAPI/glib/WebKitGLib/TestMain.h:
(Test::createWebViewBackend):


  Commit: ffdfcf594068de3f539c5f5b0743875c98d55e1d
      https://github.com/WebKit/WebKit/commit/ffdfcf594068de3f539c5f5b0743875c98d55e1d
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M ChangeLog
    A Source/cmake/FindWPEBackend-fdo.cmake
    R Source/cmake/FindWPEBackend-mesa.cmake
    M Tools/ChangeLog
    M Tools/Scripts/webkitdirs.pm
    M Tools/Scripts/webkitpy/port/waylanddriver.py
    M Tools/Scripts/webkitpy/port/wpe.py
    M Tools/TestWebKitAPI/PlatformWebView.h
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp
    M Tools/TestWebKitAPI/glib/WebKitGLib/TestMain.h
    M Tools/TestWebKitAPI/wpe/PlatformWebViewWPE.cpp
    M Tools/wpe/HeadlessViewBackend/CMakeLists.txt
    M Tools/wpe/HeadlessViewBackend/HeadlessViewBackend.cpp
    M Tools/wpe/HeadlessViewBackend/HeadlessViewBackend.h
    M Tools/wpe/jhbuild.modules

  Log Message:
  -----------
  Merge r230562 - [WPE] Switch testing process to using WPEBackend-fdo
https://bugs.webkit.org/show_bug.cgi?id=184357

Reviewed by Carlos Alberto Lopez Perez.

.:

* Source/cmake/FindWPEBackend-fdo.cmake: Renamed from Source/cmake/FindWPEBackend-mesa.cmake.

Tools:

Switch WPE testing to using the WPEBackend-fdo implementation that
depends on the WL_bind_wayland_display EGL extension, as defined under
the freedesktop.org project.
https://cgit.freedesktop.org/mesa/mesa/tree/docs/specs/WL_bind_wayland_display.spec

HeadlessViewBackend is refactored to use the WPEBackend-fdo API, but
otherwise is not changed in functionality.

Unit tests now have to unconditionally use HeadlessViewBackend as a
wpe_view_backend provider, since WPEBackend-fdo does not provide a
default wpe_view_backend implementation. Unit tests covering that are
adjusted to instead use a mock wpe_view_backend interface.

* Scripts/webkitdirs.pm:
(builtDylibPathForName): Fix the libWPEWebKit.so name to also include
the API version that was added in r230449.
* Scripts/webkitpy/port/waylanddriver.py:
(WaylandDriver._setup_environ_for_test): Export EGL_PLATFORM=wayland.
* Scripts/webkitpy/port/wpe.py:
(WPEPort._driver_class): Use WaylandDriver by default.
* TestWebKitAPI/PlatformWebView.h:
(): Deleted.
* TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp:
(testWebViewWebBackend):
* TestWebKitAPI/glib/WebKitGLib/TestMain.h:
(Test::createWebViewBackend):
* TestWebKitAPI/wpe/PlatformWebViewWPE.cpp:
(TestWebKitAPI::PlatformWebView::~PlatformWebView):
(TestWebKitAPI::PlatformWebView::initialize):
* wpe/HeadlessViewBackend/CMakeLists.txt:
* wpe/HeadlessViewBackend/HeadlessViewBackend.cpp:
(getEGLDisplay):
(HeadlessViewBackend::HeadlessViewBackend):
(HeadlessViewBackend::~HeadlessViewBackend):
(HeadlessViewBackend::backend const):
(HeadlessViewBackend::createSnapshot):
(HeadlessViewBackend::performUpdate):
(HeadlessViewBackend::makeCurrent): Deleted.
* wpe/HeadlessViewBackend/HeadlessViewBackend.h:
* wpe/jhbuild.modules: Module name cleanup. Dyz version is bumped.


  Commit: ba7b0f94f514b050ee6140814cd9322a6727086a
      https://github.com/WebKit/WebKit/commit/ba7b0f94f514b050ee6140814cd9322a6727086a
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M ChangeLog
    R Source/cmake/FindLibGBM.cmake
    M Tools/ChangeLog
    M Tools/wpe/HeadlessViewBackend/CMakeLists.txt
    M Tools/wpe/install-dependencies

  Log Message:
  -----------
  Merge r230949 - [WPE] Remove libgbm dependency
https://bugs.webkit.org/show_bug.cgi?id=184906

Reviewed by Carlos Garcia Campos.

.:

Remove the libgbm CMake search module. It's not necessary anymore
after r230562.

* Source/cmake/FindLibGBM.cmake: Removed.

Tools:

Stop searching for libgbm, using its compiler flags for the
HeadlessViewBackend compilation and linking against the .so object.
This is not necessary anymore after r230562 switched to a different
backend implementation for testing.

* wpe/HeadlessViewBackend/CMakeLists.txt:
* wpe/install-dependencies:


  Commit: c9967dfd6ab737612c47a4dd81b9f7dd96784632
      https://github.com/WebKit/WebKit/commit/c9967dfd6ab737612c47a4dd81b9f7dd96784632
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/PlatformWPE.cmake
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake
    M Source/WebKit/wpe/wpe-webkit.pc.in

  Log Message:
  -----------
  Merge r230576 - [WPE] Improve include hierarchy
https://bugs.webkit.org/show_bug.cgi?id=184376

Reviewed by Žan Doberšek.

Source/JavaScriptCore:

Install JSC headers under /usr/include/wpe-webkit-0.1/jsc instead of
/usr/include/wpe-0.1/WPE/jsc.

* PlatformWPE.cmake:

Source/WebKit:

Install our headers under /usr/include/wpe-webkit-0.1/wpe instead of
/usr/include/wpe-0.1/WPE/wpe. Too much WPE, not enough WebKit!

* PlatformWPE.cmake:
* wpe/wpe-webkit.pc.in:


  Commit: 0750cfffc4701707319bceae72d456cbf2f4c802
      https://github.com/WebKit/WebKit/commit/0750cfffc4701707319bceae72d456cbf2f4c802
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/PlatformWPE.cmake
    M Source/JavaScriptCore/inspector/remote/glib/RemoteInspectorUtils.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake

  Log Message:
  -----------
  Merge r230585 - [WPE] Move libWPEWebInspectorResources.so to pkglibdir
https://bugs.webkit.org/show_bug.cgi?id=184379

Reviewed by Žan Doberšek.

Source/JavaScriptCore:

Load the module from the new location.

* PlatformWPE.cmake:
* inspector/remote/glib/RemoteInspectorUtils.cpp:
(Inspector::backendCommands):

Source/WebKit:

This is important to allow parallel installation.

* PlatformWPE.cmake:


  Commit: 33e21459c8a0e5071bc8bd81208cfc2a31ce5f24
      https://github.com/WebKit/WebKit/commit/33e21459c8a0e5071bc8bd81208cfc2a31ce5f24
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake
    M Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
    A Source/WebKit/WebProcess/InjectedBundle/API/wpe/WebKitWebProcessEnumTypes.cpp.template
    A Source/WebKit/WebProcess/InjectedBundle/API/wpe/WebKitWebProcessEnumTypes.h.template
    A Source/WebKit/wpe/wpe-web-extension.pc.in

  Log Message:
  -----------
  Merge r230661 - [WPE] Install files needed for WebKitWebExtensions
https://bugs.webkit.org/show_bug.cgi?id=179915

Reviewed by Žan Doberšek.

.:

* Source/cmake/OptionsWPE.cmake:

Source/WebKit:

* PlatformWPE.cmake: Install pkg-config file, injected bundle, and API headers.
* UIProcess/API/glib/WebKitWebContext.cpp: Load the injected bundle when installed.
* wpe/wpe-web-extension.pc.in: Added.


  Commit: 7fed8434ada28bb74c565b6c4d767a09ab925d0a
      https://github.com/WebKit/WebKit/commit/7fed8434ada28bb74c565b6c4d767a09ab925d0a
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitCookieManager.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitFormSubmissionRequest.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitNavigationPolicyDecision.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitSettings.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
    M Source/WebKit/UIProcess/API/wpe/WebKitCookieManager.h
    M Source/WebKit/UIProcess/API/wpe/WebKitFormSubmissionRequest.h
    M Source/WebKit/UIProcess/API/wpe/WebKitNavigationPolicyDecision.h
    M Source/WebKit/UIProcess/API/wpe/WebKitSettings.h
    M Source/WebKit/UIProcess/API/wpe/WebKitWebContext.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestAuthentication.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitSettings.cpp
    M Tools/TestWebKitAPI/glib/CMakeLists.txt

  Log Message:
  -----------
  Merge r231004 - [WPE] Remove deprecated functions and properties from the API
https://bugs.webkit.org/show_bug.cgi?id=179295

Reviewed by Žan Doberšek.

Source/WebKit:

* UIProcess/API/glib/WebKitCookieManager.cpp:
* UIProcess/API/glib/WebKitFormSubmissionRequest.cpp:
* UIProcess/API/glib/WebKitNavigationPolicyDecision.cpp:
(webkitNavigationPolicyDecisionGetProperty):
(webkit_navigation_policy_decision_class_init):
* UIProcess/API/glib/WebKitSettings.cpp:
(webKitSettingsSetProperty):
(webKitSettingsGetProperty):
(webkit_settings_class_init):
* UIProcess/API/glib/WebKitWebContext.cpp:
(webkitWebContextGetProperty):
(webkitWebContextSetProperty):
(webkit_web_context_class_init):
* UIProcess/API/glib/WebKitWebView.cpp:
(webkit_web_view_class_init):
(webkitWebViewHandleAuthenticationChallenge):
(webkitWebViewWebProcessTerminated):
* UIProcess/API/wpe/WebKitCookieManager.h:
* UIProcess/API/wpe/WebKitFormSubmissionRequest.h:
* UIProcess/API/wpe/WebKitNavigationPolicyDecision.h:
* UIProcess/API/wpe/WebKitSettings.h:
* UIProcess/API/wpe/WebKitWebContext.h:

Tools:

* TestWebKitAPI/Tests/WebKitGLib/TestAuthentication.cpp:
(testWebViewAuthenticationStorage): Disable this test for now. It will require some effort
to rewrite LoadTrackingTest to not require the web view at construction time.
* TestWebKitAPI/Tests/WebKitGLib/TestWebKitSettings.cpp:
(testWebKitSettings): Don't test private browsing setting, which is gone.
* TestWebKitAPI/glib/CMakeLists.txt: Disable TestCookieManager for now.


  Commit: 5a2f398aa68cd9abcf38c4e948d79f096870fd8d
      https://github.com/WebKit/WebKit/commit/5a2f398aa68cd9abcf38c4e948d79f096870fd8d
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/egl/GLContextEGLWPE.cpp
    M Source/WebCore/platform/graphics/wpe/PlatformDisplayWPE.cpp
    M Source/WebCore/platform/wpe/PlatformPasteboardWPE.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/NativeWebTouchEvent.h
    M Source/WebKit/Shared/wpe/WebEventFactory.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitPrivate.cpp
    M Source/WebKit/UIProcess/API/wpe/CompositingManagerProxy.cpp
    M Source/WebKit/UIProcess/API/wpe/ScrollGestureController.h
    M Source/WebKit/UIProcess/API/wpe/WPEView.cpp
    M Source/WebKit/UIProcess/API/wpe/WebKitWebViewBackend.h
    M Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp
    M Source/WebKit/WebProcess/WebPage/wpe/AcceleratedSurfaceWPE.cpp
    M Source/cmake/FindWPEBackend-fdo.cmake
    M Source/cmake/FindWPEBackend.cmake
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/PlatformWPE.cmake
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp
    M Tools/TestWebKitAPI/glib/PlatformWPE.cmake
    M Tools/WebKitTestRunner/EventSenderProxy.h
    M Tools/WebKitTestRunner/PlatformWPE.cmake
    M Tools/WebKitTestRunner/wpe/EventSenderProxyWPE.cpp
    M Tools/wpe/HeadlessViewBackend/CMakeLists.txt
    M Tools/wpe/HeadlessViewBackend/HeadlessViewBackend.cpp
    M Tools/wpe/HeadlessViewBackend/HeadlessViewBackend.h
    M Tools/wpe/jhbuild.modules

  Log Message:
  -----------
  Merge r231042 - [WPE] Build and link against latest WPEBackend and WPEBackend-fdo
https://bugs.webkit.org/show_bug.cgi?id=184643

Reviewed by Žan Doberšek.

.:

Update find modules to include the API versions.

* Source/cmake/FindWPEBackend-fdo.cmake:
* Source/cmake/FindWPEBackend.cmake:

Source/WebCore:

Adapt to single-header WPE includes.

* platform/graphics/egl/GLContextEGLWPE.cpp:
* platform/graphics/wpe/PlatformDisplayWPE.cpp:
* platform/wpe/PlatformPasteboardWPE.cpp:

Source/WebKit:

Adapt to single-header WPE includes.

Null-initialize padding to silence -Wmissing-field-initializers. (Yuck.)

* Shared/NativeWebTouchEvent.h:
* Shared/wpe/WebEventFactory.cpp:
* UIProcess/API/glib/WebKitPrivate.cpp:
* UIProcess/API/wpe/CompositingManagerProxy.cpp:
* UIProcess/API/wpe/ScrollGestureController.h:
* UIProcess/API/wpe/WPEView.cpp:
(WKWPE::m_backend):
* UIProcess/API/wpe/WebKitWebViewBackend.h:
* UIProcess/Launcher/glib/ProcessLauncherGLib.cpp:
* WebProcess/WebPage/wpe/AcceleratedSurfaceWPE.cpp:
(WebKit::AcceleratedSurfaceWPE::initialize):

Tools:

Add missing INCLUDE_DIRS in many places.

Adapt to single-header WPE includes.

Null-initialize padding to silence -Wmissing-field-initializers. (Yuck.)

* TestWebKitAPI/PlatformWPE.cmake:
* TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp:
(testWebViewWebBackend):
* TestWebKitAPI/glib/PlatformWPE.cmake:
* WebKitTestRunner/EventSenderProxy.h:
* WebKitTestRunner/PlatformWPE.cmake:
* WebKitTestRunner/wpe/EventSenderProxyWPE.cpp:
* wpe/HeadlessViewBackend/CMakeLists.txt:
* wpe/HeadlessViewBackend/HeadlessViewBackend.cpp:
* wpe/HeadlessViewBackend/HeadlessViewBackend.h:
* wpe/jhbuild.modules:


  Commit: b407d7383f9ac1c1b21aecb8e25540bf776ee84d
      https://github.com/WebKit/WebKit/commit/b407d7383f9ac1c1b21aecb8e25540bf776ee84d
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-09 (Wed, 09 May 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/ProbeContext.h
    M Source/JavaScriptCore/b3/air/AirArg.h
    M Source/JavaScriptCore/dfg/DFGDoubleFormatState.h
    M Source/JavaScriptCore/heap/MarkedBlockInlines.h
    M Source/JavaScriptCore/runtime/ConfigFile.cpp
    M Source/JavaScriptCore/runtime/IntlDateTimeFormat.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
    M Source/ThirdParty/ChangeLog
    M Source/ThirdParty/xdgmime/CMakeLists.txt
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashTable.h
    M Source/WTF/wtf/StdLibExtras.h
    M Source/WTF/wtf/Vector.h
    M Source/WTF/wtf/glib/WTFGType.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformGTK.cmake
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/css/CSSFontFace.cpp
    M Source/WebCore/css/CSSSelectorList.cpp
    M Source/WebCore/editing/TextIterator.cpp
    M Source/WebCore/platform/Length.h
    M Source/WebCore/platform/graphics/Gradient.cpp
    M Source/WebCore/platform/graphics/SurrogatePairAwareTextIterator.cpp
    M Source/WebCore/platform/graphics/cairo/FontCairoHarfbuzzNG.cpp
    M Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp
    M Source/WebCore/platform/graphics/freetype/SimpleFontDataFreeType.cpp
    M Source/WebCore/platform/graphics/gstreamer/GstAllocatorFastMalloc.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/eme/WebKitClearKeyDecryptorGStreamer.cpp
    M Source/WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp
    M Source/WebCore/platform/text/TextEncoding.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/glib/GSocketMonitor.cpp
    M Source/WebKit/Shared/API/glib/WebKitContextMenu.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/CMakeLists.txt
    M Tools/gtk/jhbuild.modules
    A Tools/gtk/patches/glib-cast-function-type.patch
    M Tools/wpe/jhbuild.modules
    A Tools/wpe/patches/glib-cast-function-type.patch

  Log Message:
  -----------
  Merge r231565 - [WPE] Build cleanly with GCC 8 and ICU 60
https://bugs.webkit.org/show_bug.cgi?id=185462

Reviewed by Carlos Alberto Lopez Perez.

Source/JavaScriptCore:

* API/glib/JSCClass.cpp: Silence many -Wcast-function-type warnings.
(jsc_class_add_constructor):
(jsc_class_add_method):
* API/glib/JSCValue.cpp: Silence many -Wcast-function-type warnings.
(jsc_value_object_define_property_accessor):
(jsc_value_new_function):
* CMakeLists.txt: Build BuiltinNames.cpp with -fno-var-tracking-assignments. This was a
problem with GCC 7 too, but might as well fix it now.
* assembler/ProbeContext.h:
(JSC::Probe::CPUState::gpr const): Silence a -Wclass-memaccess warning.
(JSC::Probe::CPUState::spr const): Ditto. Assume std::remove_const is safe to clobber.
* b3/air/AirArg.h:
(JSC::B3::Air::Arg::isRepresentableAs): Silence -Wfallthrough warning.
* builtins/BuiltinNames.cpp:
(JSC::BuiltinNames::BuiltinNames): Moved from BuiltinNames.h so we can use a special flag.
* builtins/BuiltinNames.h:
(JSC::BuiltinNames::BuiltinNames): Moved to BuiltinNames.cpp.
* dfg/DFGDoubleFormatState.h:
(JSC::DFG::mergeDoubleFormatStates): Silence -Wfallthrough warnings.
* heap/MarkedBlockInlines.h:
(JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType): Silence -Wfallthrough warnings.
* runtime/ConfigFile.cpp:
(JSC::ConfigFile::canonicalizePaths): Here GCC found a genuine mistake, strncat is called
with the wrong length parameter and the result is not null-terminated. Also, silence a
-Wstringop-truncation warning as we intentionally truncate filenames that exceed PATH_MAX.
* runtime/IntlDateTimeFormat.cpp:
(JSC::IntlDateTimeFormat::partTypeString): Avoid an ICU deprecation warning.
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init): We were unconditionally running some BigInt code by accident.
(JSC::JSGlobalObject::visitChildren): Probably a serious bug? Fixed.

Source/ThirdParty:

* xdgmime/CMakeLists.txt: Silence -Wno-cast-function-type. I'm not fighting xdg-mime.

Source/WebCore:

* PlatformGTK.cmake: Include directories are in the wrong place.
* accessibility/AXObjectCache.cpp: Silence -Wclass-memaccess problems and leave warnings.
(WebCore::AXObjectCache::startOrEndTextMarkerDataForRange):
(WebCore::AXObjectCache::textMarkerDataForCharacterOffset):
(WebCore::AXObjectCache::textMarkerDataForVisiblePosition):
(WebCore::AXObjectCache::textMarkerDataForFirstPositionInTextControl):
* css/CSSFontFace.cpp: Silence -Wfallthrough
(WebCore::CSSFontFace::fontLoadTiming const):
* css/CSSSelectorList.cpp: Silence -Wclass-memaccess, this one is intentional.
(WebCore::CSSSelectorList::adoptSelectorVector):
* editing/TextIterator.cpp: Silence ICU deprecation warnings.
* platform/Length.h:
(WebCore::Length::operator=): More -Wclass-memaccess, looks benign.
* platform/graphics/Gradient.cpp:
(WebCore::Gradient::hash const): -Wclass-memaccess again. Leave a warning.
* platform/graphics/SurrogatePairAwareTextIterator.cpp: Silence ICU deprecation warnings.
* platform/graphics/cairo/FontCairoHarfbuzzNG.cpp:
(WebCore::FontCascade::fontForCombiningCharacterSequence const): Silence ICU deprecation.
* platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
(WebCore::FontCustomPlatformData::FontCustomPlatformData): Silence -Wcast-function-type.
* platform/graphics/freetype/SimpleFontDataFreeType.cpp:
(WebCore::Font::canRenderCombiningCharacterSequence const): Silence ICU deprecation.
* platform/graphics/gstreamer/GstAllocatorFastMalloc.cpp:
(gstAllocatorFastMallocMemUnmap): Fix -Wcast-function-type.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::updateTracks): Fix bad printf.
(WebCore::MediaPlayerPrivateGStreamer::enableTrack): Another bad printf.
(WebCore::findHLSQueue): Fix -Wcast-function-type.
* platform/graphics/gstreamer/eme/WebKitClearKeyDecryptorGStreamer.cpp:
(webKitMediaClearKeyDecryptorDecrypt): Fix another bad printf.
* platform/network/soup/SocketStreamHandleImplSoup.cpp: Silence -Wcast-function-type.
(WebCore::SocketStreamHandleImpl::beginWaitingForSocketWritability):
* platform/text/TextEncoding.cpp: Silence ICU deprecration.

Source/WebKit:

* Platform/IPC/glib/GSocketMonitor.cpp:
(IPC::GSocketMonitor::start): Silence -Wcast-function-type warning.
* Shared/API/glib/WebKitContextMenu.cpp:
(webkit_context_menu_new_with_items): Ditto.

Source/WTF:

* wtf/HashTable.h:
(WTF::HashTableBucketInitializer<true>::initialize): Since -Wclass-memaccess warning. This
is probably safe enough, since it's for an empty bucket.
* wtf/StdLibExtras.h:
(WTF::bitwise_cast): Silence -Wclass-memaccess as we use type traits to ensure safety here.
* wtf/Vector.h: Ditto, all uses are safe.
* wtf/glib/WTFGType.h: Silence -Wcast-function-type.

Tools:

* TestWebKitAPI/CMakeLists.txt: Fix weird build failure, we were missing a directory. Not
sure why this was never noticed until now or why the bots are OK.
* gtk/jhbuild.modules: Add upstream patch to avoid warnings inside G_DEFINE_TYPE.
* gtk/patches/glib-cast-function-type.patch: Added.
* wpe/jhbuild.modules: Add upstream patch to avoid warnings inside G_DEFINE_TYPE.
* wpe/patches/glib-cast-function-type.patch: Added.


  Commit: e75945eafb21182c0bffd12f8228813be6542e79
      https://github.com/WebKit/WebKit/commit/e75945eafb21182c0bffd12f8228813be6542e79
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-05-10 (Thu, 10 May 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    A Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake
    M Tools/ChangeLog
    M Tools/wpe/manifest.txt.in

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE and NEWS for 2.19.92 release.


  Commit: 0128712c0dd0563883a9dadd3097822778b7ac44
      https://github.com/WebKit/WebKit/commit/0128712c0dd0563883a9dadd3097822778b7ac44
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-05-10 (Thu, 10 May 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/MarkedBlock.cpp
    M Source/ThirdParty/ChangeLog
    M Source/ThirdParty/openvr/src/CMakeLists.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp

  Log Message:
  -----------
  Unreviewed, silence a couple more build warnings on the stable branch


  Commit: e2c38ee55c6aa1b8ab95c4f54aecb55062717ee5
      https://github.com/WebKit/WebKit/commit/e2c38ee55c6aa1b8ab95c4f54aecb55062717ee5
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-05-10 (Thu, 10 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake

  Log Message:
  -----------
  Unreviewed, install WebKitHitTestResult.h

Not sure what I was thinking yesterday, but I removed this required
header. I did not notice because I validated the release using dyz,
which does not use our headers at all.


  Commit: 843dfaf0b9fb49c52e2d8bbe1295b4d744f78b49
      https://github.com/WebKit/WebKit/commit/843dfaf0b9fb49c52e2d8bbe1295b4d744f78b49
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-05-10 (Thu, 10 May 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake
    M Source/WebKit/UIProcess/API/glib/WebKitUserContentManager.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
    M Source/WebKit/UIProcess/API/wpe/WebKitUserContentManager.h
    M Source/WebKit/UIProcess/API/wpe/WebKitWebView.h
    M Source/WebKit/UIProcess/API/wpe/webkit.h
    M Source/WebKit/WebProcess/InjectedBundle/API/glib/WebKitFrame.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/wpe/WebKitFrame.h
    M Source/WebKit/WebProcess/InjectedBundle/API/wpe/webkit-web-extension.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/glib/CMakeLists.txt
    M Tools/TestWebKitAPI/glib/WebKitGLib/WebViewTest.cpp
    M Tools/TestWebKitAPI/glib/WebKitGLib/WebViewTest.h

  Log Message:
  -----------
  [WPE][Stable] Remove unusable JavaScript APIs

There is no JSC API provided with WPE 2.20. We don't want to expose the old C API, because
that is going to be obsolete in 2.22. And backporting the new GObject API to this branch
would be inappropriate.

This means that we need to remove WebKitJavascriptResult.

Reviewed by Carlos Alberto Lopez Perez.


  Commit: a6c10eeb13d5b7c1a56cc601ad731d792b402872
      https://github.com/WebKit/WebKit/commit/a6c10eeb13d5b7c1a56cc601ad731d792b402872
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-05-11 (Fri, 11 May 2018)

  Changed paths:
    M Source/ThirdParty/ChangeLog
    M Source/ThirdParty/gtest/CMakeLists.txt
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/AtomicString.cpp
    M Tools/TestWebKitAPI/Tests/WTF/WTFString.cpp

  Log Message:
  -----------
  Merge r231661 - Fix some -Wstring-op-truncation warnings
https://bugs.webkit.org/show_bug.cgi?id=185496

Reviewed by Alex Christensen.

Source/ThirdParty:

Disable this warning when building gtest.

* gtest/CMakeLists.txt:

Tools:

We have an off-by-one in the use of strncpy. The strings would not be null-terminated if
the input was too long. Ensure the buffers are zero-initialized so we don't need to manually
set the last bucket to NUL.

* TestWebKitAPI/Tests/WTF/AtomicString.cpp:
(TestWebKitAPI::testAtomicStringNumber):
* TestWebKitAPI/Tests/WTF/WTFString.cpp:
(TestWebKitAPI::testStringNumberFixedPrecision):
(TestWebKitAPI::testStringNumberFixedWidth):
(TestWebKitAPI::testStringNumber):


  Commit: 2df6c88ad902587795f06c94898ae8d1c6ae0951
      https://github.com/WebKit/WebKit/commit/2df6c88ad902587795f06c94898ae8d1c6ae0951
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-05-11 (Fri, 11 May 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for 2.19.93 release.


  Commit: 03b9eafbcc1398b2b87c282e7aa62ffd9ea98fb0
      https://github.com/WebKit/WebKit/commit/03b9eafbcc1398b2b87c282e7aa62ffd9ea98fb0
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2018-05-18 (Fri, 18 May 2018)

  Changed paths:
    M ChangeLog
    M LayoutTests/ChangeLog
    M LayoutTests/platform/wpe/TestExpectations
    A LayoutTests/platform/wpe/fullscreen/full-screen-placeholder-expected.txt
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp
    M Source/WebKit/UIProcess/API/wpe/PageClientImpl.h
    M Source/WebKit/UIProcess/API/wpe/WPEView.h
    M Source/cmake/OptionsWPE.cmake
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp

  Log Message:
  -----------
  Merge r231917 - [WPE] Implement and enable FULLSCREEN_API
https://bugs.webkit.org/show_bug.cgi?id=185676

Reviewed by Žan Doberšek.

.:

Remove the CMake option to disable this option for WPE.
This feature gets enabled now via Source/cmake/WebKitFeatures.cmake

* Source/cmake/OptionsWPE.cmake:

Source/WebKit:

Do the initial implementation of FULLSCREEN_API for WPE and
enable the CMake option by default.

Most of the layout tests (55 of 58) are passing and the feature
seems to work fine on different websites that use it.

* UIProcess/API/wpe/PageClientImpl.cpp:
(WebKit::PageClientImpl::fullScreenManagerProxyClient):
(WebKit::PageClientImpl::closeFullScreenManager):
(WebKit::PageClientImpl::isFullScreen):
(WebKit::PageClientImpl::enterFullScreen):
(WebKit::PageClientImpl::exitFullScreen):
(WebKit::PageClientImpl::beganEnterFullScreen):
(WebKit::PageClientImpl::beganExitFullScreen):
* UIProcess/API/wpe/PageClientImpl.h:
* UIProcess/API/wpe/WPEView.h:
(WKWPE::View::isFullScreen):
(WKWPE::View::setFullScreen):

Tools:

* TestWebKitAPI/Tests/WebKitGLib/TestWebKitWebView.cpp:
(testWebViewFullScreen):

LayoutTests:

Enable all the 58 fullscreen related tests.
Are all passing but 3.

* platform/wpe/TestExpectations:
* platform/wpe/fullscreen/full-screen-placeholder-expected.txt: Added. Copied baseline from WebKitGTK+ port.


  Commit: cb4f16775672def07cc8f5782fb7d43cc31aaef5
      https://github.com/WebKit/WebKit/commit/cb4f16775672def07cc8f5782fb7d43cc31aaef5
  Author: Thomas Klausner <tk at giga.or.at>
  Date:   2018-05-18 (Fri, 18 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/SoupNetworkSession.h

  Log Message:
  -----------
  Merged r231804 - Add missing header to fix build.
https://bugs.webkit.org/show_bug.cgi?id=185378

Patch by Thomas Klausner <tk at giga.or.at> on 2018-05-15
Reviewed by Michael Catanzaro.

* platform/network/soup/SoupNetworkSession.h:


  Commit: d9443b23d44f2de9e5f277fea03b883432f0d2b8
      https://github.com/WebKit/WebKit/commit/d9443b23d44f2de9e5f277fea03b883432f0d2b8
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-05-18 (Fri, 18 May 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merged r231801 - [WPE] Build failure with RPi userland drivers and gstreamer-gl
https://bugs.webkit.org/show_bug.cgi?id=185639

Reviewed by Philippe Normand.

When building for the RPi with userland drivers (dispmanx) override the
value of GST_GL_HAVE_GLSYNC to 1 to avoid that the gstreamer-gl headers
try to redefine the GLsync type that is already defined in libepoxy.

Defining __gl2_h_ is also needed to avoid other conflicting type
definitions that happen between libepoxy and RPi GLES2 userland
headers when the gstreamer-gl headers are included.

The issue doesn't happen with 1.14.0, so a check for that is added
as well.

No new tests, no behavior change. It is a build fix.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:


  Commit: 2dca3e5de6be74b71ba6c44925a3cc6c0e342aaf
      https://github.com/WebKit/WebKit/commit/2dca3e5de6be74b71ba6c44925a3cc6c0e342aaf
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-05-18 (Fri, 18 May 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    R Source/WTF/wtf/Atomics.cpp
    M Source/WTF/wtf/CMakeLists.txt

  Log Message:
  -----------
  Merged r230254 - [WTF] Remove Atomics.cpp
https://bugs.webkit.org/show_bug.cgi?id=184300

Reviewed by Konstantin Tokarev.

This Atomics.cpp is a workaround for GCC which version is < 4.8.
Our compiler requirement is now 5.0.0. This workaround is no
longer necessary.

* wtf/Atomics.cpp: Removed.
* wtf/CMakeLists.txt:


  Commit: 45bd5661efac69a0cb453186b72b423338bd1cdf
      https://github.com/WebKit/WebKit/commit/45bd5661efac69a0cb453186b72b423338bd1cdf
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-05-18 (Fri, 18 May 2018)

  Changed paths:
    M ChangeLog
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/WebKit/CMakeLists.txt
    M Source/WebKit/ChangeLog
    M Source/cmake/OptionsGTK.cmake
    M Source/cmake/OptionsJSCOnly.cmake
    M Source/cmake/OptionsWPE.cmake
    M Source/cmake/WebKitCompilerFlags.cmake

  Log Message:
  -----------
  Merged r231843 - [CMake] Properly detect compiler flags, needed libs, and fallbacks for usage of 64-bit atomic operations
https://bugs.webkit.org/show_bug.cgi?id=182622

Reviewed by Michael Catanzaro.

.:

* Source/cmake/OptionsGTK.cmake:
* Source/cmake/OptionsJSCOnly.cmake:
* Source/cmake/OptionsWPE.cmake:
Enable THREADS_PREFER_PTHREAD_FLAG. This uses -pthread instead of
-lpthread, fixing the 64-bit RISC-V build of the GTK+ port due to
missing atomic primitives.

* Source/cmake/WebKitCompilerFlags.cmake:
Move the test to detect whether we need to link against libatomic
to a common CMake file so it can be used from both JavaScriptCore
and WebKit.

Source/JavaScriptCore:

We were linking JavaScriptCore against libatomic in MIPS because
in that architecture __atomic_fetch_add_8() is not a compiler
intrinsic and is provided by that library instead. However other
architectures (e.g armel) are in the same situation, so we need a
generic test.

That test already exists in WebKit/CMakeLists.txt, so we just have
to move it to a common file (WebKitCompilerFlags.cmake) and use
its result (ATOMIC_INT64_REQUIRES_LIBATOMIC) here.

* CMakeLists.txt:

Source/WebKit:

Move the test to determine whether we need to link against
libatomic to the common file WebKitCompilerFlags.cmake so it can
also be used for JavaScriptCore.

* CMakeLists.txt:


  Commit: 3a972f589b3b43f0ef5b3cad7c0cb1e31505737e
      https://github.com/WebKit/WebKit/commit/3a972f589b3b43f0ef5b3cad7c0cb1e31505737e
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-05-18 (Fri, 18 May 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for 2.20.0 release.


  Commit: f9227a426dfc809f6633785d5a6cc591bbdd9ecf
      https://github.com/WebKit/WebKit/commit/f9227a426dfc809f6633785d5a6cc591bbdd9ecf
  Author: Jan Alexander Steffens <jan.steffens at gmail.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M ChangeLog
    M Source/PlatformGTK.cmake

  Log Message:
  -----------
  Merge r231631 - [GTK] gtk-doc installation subdir duplicated
https://bugs.webkit.org/show_bug.cgi?id=185468

Patch by Jan Alexander Steffens <jan.steffens at gmail.com> on 2018-05-09
Reviewed by Carlos Garcia Campos.

The GTK docs are installed into a duplicated subdir,
e.g. /usr/share/doc/gtk-doc/html/webkit2gtk-4.0/webkit2gtk-4.0.

* Source/PlatformGTK.cmake:


  Commit: c7d12a5ae0ad4c9304eb2d30a4745eeb36a5d19f
      https://github.com/WebKit/WebKit/commit/c7d12a5ae0ad4c9304eb2d30a4745eeb36a5d19f
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/Gigacage.h

  Log Message:
  -----------
  Merge r232059 - Define GIGACAGE_ALLOCATION_CAN_FAIL on Linux
https://bugs.webkit.org/show_bug.cgi?id=183329

Reviewed by Michael Catanzaro.

We specify `GIGACAGE_ALLOCATION_CAN_FAIL 1` in Linux since
Linux can fail to `mmap` if `vm.overcommit_memory = 2`.
Users can enable Gigacage if users enable overcommit_memory.

* bmalloc/Gigacage.h:


  Commit: 06420d7050d5334b38589bc755984c93c08ee598
      https://github.com/WebKit/WebKit/commit/06420d7050d5334b38589bc755984c93c08ee598
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M ChangeLog
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/WebKit/CMakeLists.txt
    M Source/WebKit/ChangeLog
    M Source/cmake/OptionsGTK.cmake
    M Source/cmake/OptionsJSCOnly.cmake
    M Source/cmake/OptionsWPE.cmake
    M Source/cmake/WebKitCompilerFlags.cmake

  Log Message:
  -----------
  Merge r232062 - Unreviewed, rolling out r231843.

Broke cross build

Reverted changeset:

"[CMake] Properly detect compiler flags, needed libs, and
fallbacks for usage of 64-bit atomic operations"
https://bugs.webkit.org/show_bug.cgi?id=182622
https://trac.webkit.org/changeset/231843


  Commit: d764a6d3bf10a0338ab5a8380ce5eff3daa71ede
      https://github.com/WebKit/WebKit/commit/d764a6d3bf10a0338ab5a8380ce5eff3daa71ede
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M ChangeLog
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/WebKit/CMakeLists.txt
    M Source/WebKit/ChangeLog
    M Source/cmake/WebKitCompilerFlags.cmake

  Log Message:
  -----------
  Merge r232067 - [CMake] Properly detect compiler flags, needed libs, and fallbacks for usage of 64-bit atomic operations
https://bugs.webkit.org/show_bug.cgi?id=182622
<rdar://problem/40292317>

Reviewed by Michael Catanzaro.

.:

* Source/cmake/WebKitCompilerFlags.cmake:
Move the test to detect whether we need to link against libatomic
to a common CMake file so it can be used from both JavaScriptCore
and WebKit.

Source/JavaScriptCore:

We were linking JavaScriptCore against libatomic in MIPS because
in that architecture __atomic_fetch_add_8() is not a compiler
intrinsic and is provided by that library instead. However other
architectures (e.g armel) are in the same situation, so we need a
generic test.

That test already exists in WebKit/CMakeLists.txt, so we just have
to move it to a common file (WebKitCompilerFlags.cmake) and use
its result (ATOMIC_INT64_REQUIRES_LIBATOMIC) here.

* CMakeLists.txt:

Source/WebKit:

Move the test to determine whether we need to link against
libatomic to the common file WebKitCompilerFlags.cmake so it can
also be used for JavaScriptCore.

* CMakeLists.txt:


  Commit: 7245dd71b2b38c1f1b94395c2646b9d021f2ab2b
      https://github.com/WebKit/WebKit/commit/7245dd71b2b38c1f1b94395c2646b9d021f2ab2b
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitFaviconDatabase.cpp

  Log Message:
  -----------
  Merge r232397 - [GTK] Crash in WebKitFaviconDatabase when pageURL is unset
https://bugs.webkit.org/show_bug.cgi?id=186164

Reviewed by Carlos Garcia Campos.

PageURL can legitimately be null here if JavaScript does something silly with window.open.

* UIProcess/API/glib/WebKitFaviconDatabase.cpp:
(webkitFaviconDatabaseSetIconURLForPageURL):
(webkitFaviconDatabaseSetIconForPageURL):


  Commit: bbaf29074958e63b6d011c1eb6e2b2340f024877
      https://github.com/WebKit/WebKit/commit/bbaf29074958e63b6d011c1eb6e2b2340f024877
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp

  Log Message:
  -----------
  Merge r232618 - [GTK][WPE] Wrong result when calling ImageBufferCairo's getImageData()
https://bugs.webkit.org/show_bug.cgi?id=186384

Reviewed by Michael Catanzaro.

Fix calculations so the result is the expected one.

* platform/graphics/cairo/ImageBufferCairo.cpp:
(WebCore::getImageData):


  Commit: e3696fcece2048e4112428b8f19b16147e19232a
      https://github.com/WebKit/WebKit/commit/e3696fcece2048e4112428b8f19b16147e19232a
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merge r232667 - [WPE][GTK] paypal.com requires user agent quirk
https://bugs.webkit.org/show_bug.cgi?id=186466

Reviewed by Carlos Garcia Campos.

Source/WebCore:

* platform/UserAgentQuirks.cpp:
(WebCore::urlRequiresMacintoshPlatform):

Tools:

* TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:
(TestWebKitAPI::TEST):


  Commit: f58d194ec5fc0f1a74867d47049daf93d10218e4
      https://github.com/WebKit/WebKit/commit/f58d194ec5fc0f1a74867d47049daf93d10218e4
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/images/positioned-image-when-transform-is-present-expected.html
    A LayoutTests/fast/images/positioned-image-when-transform-is-present.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderImage.cpp
    M Source/WebCore/rendering/RenderObject.h

  Log Message:
  -----------
  Merge r232663 - REGRESSION (r230480): Cannot adjust photo position on LinkedIn's profile page
https://bugs.webkit.org/show_bug.cgi?id=186464
<rdar://problem/40369448>

Reviewed by Simon Fraser.

Source/WebCore:

The optimization logic for skipping image layout when we only need overflow computation should check if the image actually needs
simplified layout only. The needsSimplifiedNormalFlowLayout() flag means that the overflow information needs to be updated but
it does not mean that overflow is the only property that we need to recompute.

Test: fast/images/positioned-image-when-transform-is-present.html

* rendering/RenderImage.cpp:
(WebCore::RenderImage::layout):
* rendering/RenderObject.h:
(WebCore::RenderObject::needsSimplifiedNormalFlowLayoutOnly const):

LayoutTests:

* fast/images/positioned-image-when-transform-is-present-expected.html: Added.
* fast/images/positioned-image-when-transform-is-present.html: Added.


  Commit: 02d74966f068541a4913156d2885b0b69a539791
      https://github.com/WebKit/WebKit/commit/02d74966f068541a4913156d2885b0b69a539791
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebKit/CMakeLists.txt
    M Source/WebKit/ChangeLog

  Log Message:
  -----------
  Unreviewed. Remove PRIVATE keyword added in r232676.

* CMakeLists.txt:


  Commit: ea52e1ed9c9715054f8aa0f676cc7657f3a4507c
      https://github.com/WebKit/WebKit/commit/ea52e1ed9c9715054f8aa0f676cc7657f3a4507c
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/storageAccess/has-storage-access-crash-expected.txt
    A LayoutTests/http/tests/storageAccess/has-storage-access-crash.html
    A LayoutTests/http/tests/storageAccess/request-storage-access-crash-expected.txt
    A LayoutTests/http/tests/storageAccess/request-storage-access-crash.html
    M LayoutTests/platform/mac-wk2/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  Merge r232584 - Handle Storage Access API calls in the absence of an attached frame
https://bugs.webkit.org/show_bug.cgi?id=186373
<rdar://problem/40028265>

Reviewed by Daniel Bates.

Source/WebCore:

Tests: http/tests/storageAccess/has-storage-access-crash.html
       http/tests/storageAccess/request-storage-access-crash.html

The new frame-specific storage access checks were done without confirming a
frame was present, although the frame state was validated in other parts of
the same method.

This patch checks for a non-null frame before making frame-specific calls.

* dom/Document.cpp:
(WebCore::Document::hasStorageAccess):
(WebCore::Document::requestStorageAccess):

LayoutTests:

* http/tests/storageAccess/has-storage-access-crash-expected.txt: Added.
* http/tests/storageAccess/has-storage-access-crash.html: Added.
* http/tests/storageAccess/request-storage-access-crash-expected.txt: Added.
* http/tests/storageAccess/request-storage-access-crash.html: Added.
* platform/mac-wk2/TestExpectations: Add the two new tests for HighSierra+


  Commit: 8d4e6794f4055849bc9e4995d4732c00b224a98e
      https://github.com/WebKit/WebKit/commit/8d4e6794f4055849bc9e4995d4732c00b224a98e
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/MiniBrowser/gtk/BrowserWindow.c

  Log Message:
  -----------
  Merge r232009 - [GTK] MiniBrowser crashes when loading twice quickly
https://bugs.webkit.org/show_bug.cgi?id=185763

Reviewed by Michael Catanzaro.

This is very difficult to reproduce manually, but it happens when running WebDriver tests where loads are very
fast and multiple loads are done quickly. The problem is that we use an idle to reset the progress bar, but we
don't reset it when a new load starts. We always reset the last idle on destroy, but if there's another one
leaked, it will crash when scheduled if the window has already been destroyed.

* MiniBrowser/gtk/BrowserWindow.c:
(webViewLoadProgressChanged): Stop any pending reset task when progress != 1.


  Commit: b7d6323fa4db8494a3b337a62f5ab79eac42d73a
      https://github.com/WebKit/WebKit/commit/b7d6323fa4db8494a3b337a62f5ab79eac42d73a
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/CookieJarSoup.cpp
    M Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp

  Log Message:
  -----------
  Merge r232066 - [GTK] WebDriver: Network process crash when running imported/w3c/webdriver/tests/delete_cookie/delete.py::test_unknown_cookie
https://bugs.webkit.org/show_bug.cgi?id=185867

Reviewed by Michael Catanzaro.

We need to null check the value returned by URL::createSoupURI() before passing it to soup.

* platform/network/soup/CookieJarSoup.cpp:
(WebCore::setCookiesFromDOM):
(WebCore::cookiesForSession):
(WebCore::getRawCookies):
(WebCore::deleteCookie):
* platform/network/soup/NetworkStorageSessionSoup.cpp:
(WebCore::NetworkStorageSession::getCookies):


  Commit: ee72f6b7e7f796867fcabc10a9c763ae8a41d927
      https://github.com/WebKit/WebKit/commit/ee72f6b7e7f796867fcabc10a9c763ae8a41d927
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebDriver/ChangeLog
    M Source/WebDriver/glib/SessionHostGlib.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitAutomationSession.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitWebContextPrivate.h

  Log Message:
  -----------
  Merge r232111 - [GTK] WebDriver: implement AutomationSessionClient::didDisconnectFromRemote
https://bugs.webkit.org/show_bug.cgi?id=185866

Reviewed by Brian Burg.

Source/WebDriver:

Close the dbus connection when receiving an empty target list.

* glib/SessionHostGlib.cpp:
(WebDriver::SessionHost::setTargetList):

Source/WebKit:

To handle the case of the session being closed by the browser, for example in case of a network process
crash. This is currently causing WebDriver tests to timeout in the bot.

* UIProcess/API/glib/WebKitAutomationSession.cpp: Add an implementation of didDisconnectFromRemote() to notify
the WebContext that the session will be closed.
* UIProcess/API/glib/WebKitWebContext.cpp: Remove the automation session when closed.
* UIProcess/API/glib/WebKitWebContextPrivate.h:


  Commit: 08612e261021688a73e4e923e82d07832221a04e
      https://github.com/WebKit/WebKit/commit/08612e261021688a73e4e923e82d07832221a04e
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/UIProcess/gtk/InputMethodFilter.cpp

  Log Message:
  -----------
  Merge r232049 - [GTK][Wayland] UI process crash when closing the window
https://bugs.webkit.org/show_bug.cgi?id=185818

Reviewed by Michael Catanzaro.

This happens when a page containing a text field is loaded but the focus remains in the url bar when the window
is closed. This is because we are sending a notify-in to the IM context, but the focus is still in the URL
bar. That confuses the wayland input method manager that tries to free the text of the web view IM context that has
already been deleted.

* UIProcess/gtk/InputMethodFilter.cpp:
(WebKit::InputMethodFilter::setEnabled): Only send notify-in if the view is actually focused.


  Commit: b5927004837e885b61ef950aa1b1aac6bccce55a
      https://github.com/WebKit/WebKit/commit/b5927004837e885b61ef950aa1b1aac6bccce55a
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/InputMethodFilter.cpp
    M Source/WebKit/UIProcess/gtk/InputMethodFilter.h

  Log Message:
  -----------
  Merge r232151 - Unreviewed. Fix GTK+ input method unit tests after r232049.

Unit tests don't use a WebPageProxy.

* UIProcess/gtk/InputMethodFilter.cpp:
(WebKit::InputMethodFilter::isViewFocused const):
(WebKit::InputMethodFilter::setEnabled):
* UIProcess/gtk/InputMethodFilter.h:


  Commit: b885e93919615980497f7ef3fe1e786b097ace71
      https://github.com/WebKit/WebKit/commit/b885e93919615980497f7ef3fe1e786b097ace71
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/dom/reuse-pathseg-after-changing-d-expected.txt
    A LayoutTests/svg/dom/reuse-pathseg-after-changing-d.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/svg/SVGPathElement.cpp
    M Source/WebCore/svg/SVGPathSegList.cpp
    M Source/WebCore/svg/SVGPathSegList.h
    M Source/WebCore/svg/SVGPathSegListValues.cpp
    M Source/WebCore/svg/SVGPathSegListValues.h

  Log Message:
  -----------
  Merge r229830 - Disconnect the SVGPathSegList items from their SVGPathElement before rebuilding a new list
https://bugs.webkit.org/show_bug.cgi?id=183723
<rdar://problem/38517871>

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2018-03-21
Reviewed by Daniel Bates.

Source/WebCore:

When setting the "d" attribute directly on a path, we rebuild the list
of path segments held for creating the property tear off. The old path
segments need to get disconnected from the path element. We already do
that when a path segment is replaced or removed.

Test: svg/dom/reuse-pathseg-after-changing-d.html

* svg/SVGPathElement.cpp:
(WebCore::SVGPathElement::svgAttributeChanged):
* svg/SVGPathSegList.cpp:
(WebCore::SVGPathSegList::clear): SVGPathSegListValues::clearContextAndRoles()
will now be called from SVGPathSegListValues::clear() via SVGListProperty::clearValues().
(WebCore::SVGPathSegList::replaceItem):
(WebCore::SVGPathSegList::removeItem):
(WebCore::SVGPathSegList::clearContextAndRoles): Deleted.
* svg/SVGPathSegList.h: SVGPathSegListValues::clearContextAndRoles() will
now be called from SVGPathSegListValues::clear() via SVGListProperty::initializeValues().
* svg/SVGPathSegListValues.cpp:
(WebCore::SVGPathSegListValues::clearItemContextAndRole):
(WebCore::SVGPathSegListValues::clearContextAndRoles):
* svg/SVGPathSegListValues.h:
(WebCore::SVGPathSegListValues::operator=):
(WebCore::SVGPathSegListValues::clear):

LayoutTests:

* svg/dom/reuse-pathseg-after-changing-d-expected.txt: Added.
* svg/dom/reuse-pathseg-after-changing-d.html: Added.


  Commit: 03f0cf1a1a11210acf28a5bfcf7d61bb0cd5ee08
      https://github.com/WebKit/WebKit/commit/03f0cf1a1a11210acf28a5bfcf7d61bb0cd5ee08
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/security/css-mask-image-expected.html
    A LayoutTests/http/tests/security/css-mask-image.html
    A LayoutTests/http/tests/security/resources/black-square.png
    A LayoutTests/http/tests/security/resources/fail-mask.png
    M LayoutTests/media/modern-media-controls/resources/media-controls-loader.js
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Settings.yaml
    M Source/WebCore/style/StylePendingResources.cpp

  Log Message:
  -----------
  Merge r230006 - CSS mask images should be retrieved using potentially CORS-enabled fetch
https://bugs.webkit.org/show_bug.cgi?id=179983
<rdar://problem/35678149>

Reviewed by Brent Fulgham.

Source/WebCore:

As per <https://drafts.fxtf.org/css-masking-1/#priv-sec> (Editor’s Draft, 23 December 2017)
we should fetch CSS mask images using a potentially CORS-enabled fetch.

Both cross-origin CSS shape-outside images and CSS mask images may be sensitive to timing
attacks that can be used to reveal their pixel data when retrieved without regard to CORS.
For the same reason that we fetch CSS shape-outside images using a potentially CORS-enabled
fetch we should fetch CSS mask the same way. This also makes the behavior of WebKit more
closely align with the behavior in the spec.

Test: http/tests/security/css-mask-image.html

* page/Settings.yaml: Add a setting for toggle "Anonymous" mode fetching of mask images (defaults: true).
We need this setting to avoid breaking the developer convenience feature that some modern media controls
layout tests employ to load assets from the filesystem as opposed to using the hardcoded data URLs baked
into the WebKit binary.
* style/StylePendingResources.cpp: Substitute LoadPolicy::NoCORS and LoadPolicy::Anonymous for
LoadPolicy::Normal and LoadPolicy::ShapeOutside, respectively, to match the terminology used
in the HTML, CSS Shapes Module Level 1, and CSS Masking Module Level 1 specs.
(WebCore::Style::loadPendingImage): Ditto.
(WebCore::Style::loadPendingResources): Use load policy LoadPolicy::Anonymous when fetching
a mask image or shape-outside image.

LayoutTests:

Add a test to ensure we do not fetch a cross-origin CSS mask image that does
not allow CORS access.

* http/tests/security/css-mask-image-expected.html: Added.
* http/tests/security/css-mask-image.html: Added.
* http/tests/security/resources/black-square.png: Added.
* http/tests/security/resources/fail-mask.png: Added.
* media/modern-media-controls/resources/media-controls-loader.js: Disable "Anonymous" mode
fetching of mask images to allow modern media controls to load mask assets from the filesystem.


  Commit: 2d5f589d9c917a217bac628e565a2f551718a324
      https://github.com/WebKit/WebKit/commit/2d5f589d9c917a217bac628e565a2f551718a324
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/style/StylePendingResources.cpp

  Log Message:
  -----------
  Merge r230016 - Attempt to fix media control layout tests after <https://trac.webkit.org/changeset/230006/>
(https://bugs.webkit.org/show_bug.cgi?id=179983)

Exempt elements in user agent shadow DOM from having to perform a potentially CORS-
enabled fetch for a mask image to try to fix the following tests from timing out:
    media/modern-media-controls/media-controller/media-controller-inline-to-fullscreen-to-inline.html
    media/modern-media-controls/media-controller/media-controller-inline-to-fullscreen-to-pip-to-inline.html

* style/StylePendingResources.cpp:
(WebCore::Style::loadPendingImage):


  Commit: 2bc84b61677d537f7ffcd3da499952283af1477b
      https://github.com/WebKit/WebKit/commit/2bc84b61677d537f7ffcd3da499952283af1477b
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/websocket/tests/hybi/cookie_wsh.py
    A LayoutTests/http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior-expected.txt
    A LayoutTests/http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/websockets/WebSocketChannel.cpp
    M Source/WebCore/Modules/websockets/WebSocketHandshake.h

  Log Message:
  -----------
  Merge r230052 - WebSocket cookie incorrectly stored
https://bugs.webkit.org/show_bug.cgi?id=184100
<rdar://problem/37928715>

Reviewed by Brent Fulgham.

Source/WebCore:

A cookie received in a WebSocket response should be stored with respect to the
origin of the WebSocket server in order for it to be sent in a subsequent request.

Also removed a FIXME about implementing support for the long since
deprecated Set-Cookie2 header.

Test: http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html

* Modules/websockets/WebSocketChannel.cpp:
(WebCore::WebSocketChannel::processBuffer):
* Modules/websockets/WebSocketHandshake.h:

LayoutTests:

* http/tests/websocket/tests/hybi/cookie_wsh.py: Added. Downloaded from
<https://github.com/w3c/pywebsocket/blob/b2e1d11086fdf00b33a0d30c504f227e7d4fa86b/src/example/cookie_wsh.py>.
(_add_set_cookie):
(web_socket_do_extra_handshake):
(web_socket_transfer_data):
* http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior-expected.txt: Added.
* http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html: Added.


  Commit: e03cf66d2168e0f917a3ba8ae40ce08fa2dda281
      https://github.com/WebKit/WebKit/commit/e03cf66d2168e0f917a3ba8ae40ce08fa2dda281
  Author: JF Bastien <jfbastien at apple.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/wasm/regress/183342.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/wasm/WasmModuleParser.cpp
    M Source/JavaScriptCore/wasm/js/JSWebAssemblyHelpers.h
    M Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.cpp

  Log Message:
  -----------
  Merge r230119 - WebAssembly compilation from DataView


  Commit: f63fc89563401f9b2c1557b5e9dd506b9168d224
      https://github.com/WebKit/WebKit/commit/f63fc89563401f9b2c1557b5e9dd506b9168d224
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/create-this-property-change.js
    A JSTests/stress/create-this-structure-change-without-cse.js
    A JSTests/stress/create-this-structure-change.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGClobberize.h

  Log Message:
  -----------
  Merge r229987 - DFG should know that CreateThis can be effectful
https://bugs.webkit.org/show_bug.cgi?id=184013

Reviewed by Saam Barati.

JSTests:

* stress/create-this-property-change.js: Added.
(Foo):
(RealBar):
(get if):
* stress/create-this-structure-change-without-cse.js: Added.
(Foo):
(RealBar):
(get if):
* stress/create-this-structure-change.js: Added.
(Foo):
(RealBar):
(get if):

Source/JavaScriptCore:

As shown in the tests added in JSTests, CreateThis can be effectful if the constructor this
is a proxy.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):


  Commit: 6fec52ab97ff45dfbdfca26d860b5d87731d7430
      https://github.com/WebKit/WebKit/commit/6fec52ab97ff45dfbdfca26d860b5d87731d7430
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/generator-prototype-copy.js
    A JSTests/stress/generator-type-check.js
    A JSTests/stress/get-by-id-direct-getter.js
    A JSTests/stress/get-by-id-direct.js
    M JSTests/test262.yaml
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/builtins/ArrayIteratorPrototype.js
    M Source/JavaScriptCore/builtins/AsyncFromSyncIteratorPrototype.js
    M Source/JavaScriptCore/builtins/AsyncFunctionPrototype.js
    M Source/JavaScriptCore/builtins/AsyncGeneratorPrototype.js
    M Source/JavaScriptCore/builtins/GeneratorPrototype.js
    M Source/JavaScriptCore/builtins/MapIteratorPrototype.js
    M Source/JavaScriptCore/builtins/PromiseOperations.js
    M Source/JavaScriptCore/builtins/PromisePrototype.js
    M Source/JavaScriptCore/builtins/SetIteratorPrototype.js
    M Source/JavaScriptCore/builtins/StringIteratorPrototype.js
    M Source/JavaScriptCore/builtins/TypedArrayConstructor.js
    M Source/JavaScriptCore/bytecode/BytecodeDumper.cpp
    M Source/JavaScriptCore/bytecode/BytecodeIntrinsicRegistry.h
    M Source/JavaScriptCore/bytecode/BytecodeList.json
    M Source/JavaScriptCore/bytecode/BytecodeUseDef.h
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
    M Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
    M Source/JavaScriptCore/bytecode/StructureStubInfo.h
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
    M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGCapabilities.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGOperations.cpp
    M Source/JavaScriptCore/dfg/DFGOperations.h
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/jit/JIT.cpp
    M Source/JavaScriptCore/jit/JIT.h
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/jit/JITOperations.h
    M Source/JavaScriptCore/jit/JITPropertyAccess.cpp
    M Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
    M Source/JavaScriptCore/jit/Repatch.cpp
    M Source/JavaScriptCore/jit/Repatch.h
    M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
    M Source/JavaScriptCore/llint/LLIntSlowPaths.h
    M Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
    M Source/JavaScriptCore/runtime/JSCJSValue.h
    M Source/JavaScriptCore/runtime/JSCJSValueInlines.h
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/JSObjectInlines.h

  Log Message:
  -----------
  Merge r230376 - [JSC] Introduce op_get_by_id_direct
https://bugs.webkit.org/show_bug.cgi?id=183970

Reviewed by Filip Pizlo.

JSTests:

* stress/generator-prototype-copy.js: Added.
(gen):
(catch):
Adopted JF's tests.

* stress/generator-type-check.js: Added.
(shouldThrow):
(foo2):
(i.shouldThrow):
* stress/get-by-id-direct-getter.js: Added.
(shouldBe):
(shouldThrow):
(obj.get hello):
(builtin.createBuiltin):
(obj2.get length):
* stress/get-by-id-direct.js: Added.
(shouldBe):
(shouldThrow):
(builtin.createBuiltin):
* test262.yaml:
We fixed long-standing spec compatibility issue.
As a result, this patch makes several test262 tests passed!

Source/JavaScriptCore:

This patch introduces op_get_by_id_direct bytecode. This is super similar to op_get_by_id.
But it just performs [[GetOwnProperty]] operation instead of [[Get]]. We support this
in all the tiers, so using this opcode does not lead to inefficiency.

Main purpose of this op_get_by_id_direct is using it for private properties. We are using
properties indexed with private symbols to implement ECMAScript internal fields. Before this
patch, we just use get and put operations. However, it is not the correct semantics: accessing
to the internal fields should not traverse prototype chain, which is specified in the spec.
We use op_get_by_id_direct to access to properties which are used internal fields, so that
prototype chains are not traversed.

To emit op_get_by_id_direct, we introduce a new bytecode intrinsic @getByIdDirectPrivate().
When you write `@getByIdDirectPrivate(object, "name")`, the bytecode generator emits the
bytecode `op_get_by_id_direct, object, @name`.

* builtins/ArrayIteratorPrototype.js:
(next):
(globalPrivate.arrayIteratorValueNext):
(globalPrivate.arrayIteratorKeyNext):
(globalPrivate.arrayIteratorKeyValueNext):
* builtins/AsyncFromSyncIteratorPrototype.js:
* builtins/AsyncFunctionPrototype.js:
(globalPrivate.asyncFunctionResume):
* builtins/AsyncGeneratorPrototype.js:
(globalPrivate.asyncGeneratorQueueIsEmpty):
(globalPrivate.asyncGeneratorQueueEnqueue):
(globalPrivate.asyncGeneratorQueueDequeue):
(globalPrivate.asyncGeneratorDequeue):
(globalPrivate.isExecutionState):
(globalPrivate.isSuspendYieldState):
(globalPrivate.asyncGeneratorReject):
(globalPrivate.asyncGeneratorResolve):
(globalPrivate.doAsyncGeneratorBodyCall):
(globalPrivate.asyncGeneratorEnqueue):
* builtins/GeneratorPrototype.js:
(globalPrivate.generatorResume):
(next):
(return):
(throw):
* builtins/MapIteratorPrototype.js:
(next):
* builtins/PromiseOperations.js:
(globalPrivate.isPromise):
(globalPrivate.rejectPromise):
(globalPrivate.fulfillPromise):
* builtins/PromisePrototype.js:
(then):
* builtins/SetIteratorPrototype.js:
(next):
* builtins/StringIteratorPrototype.js:
(next):
* builtins/TypedArrayConstructor.js:
(of):
(from):
* bytecode/BytecodeDumper.cpp:
(JSC::BytecodeDumper<Block>::dumpBytecode):
* bytecode/BytecodeIntrinsicRegistry.h:
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::finalizeLLIntInlineCaches):
* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeFromLLInt):
(JSC::GetByIdStatus::computeFor):
* bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::reset):
* bytecode/StructureStubInfo.h:
(JSC::appropriateOptimizingGetByIdFunction):
(JSC::appropriateGenericGetByIdFunction):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitDirectGetById):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::BytecodeIntrinsicNode::emit_intrinsic_getByIdDirect):
(JSC::BytecodeIntrinsicNode::emit_intrinsic_getByIdDirectPrivate):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleGetById):
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToGetByOffset):
(JSC::DFG::Node::convertToMultiGetByOffset):
(JSC::DFG::Node::hasIdentifier):
(JSC::DFG::Node::hasHeapPrediction):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileGetById):
(JSC::DFG::SpeculativeJIT::compileGetByIdFlush):
(JSC::DFG::SpeculativeJIT::compileTryGetById): Deleted.
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileGetById):
(JSC::FTL::DFG::LowerDFGToB3::compileGetByIdWithThis):
(JSC::FTL::DFG::LowerDFGToB3::getById):
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
(JSC::JIT::privateCompileSlowCases):
* jit/JIT.h:
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_id_direct):
(JSC::JIT::emitSlow_op_get_by_id_direct):
* jit/Repatch.cpp:
(JSC::appropriateOptimizingGetByIdFunction):
(JSC::appropriateGetByIdFunction):
(JSC::tryCacheGetByID):
(JSC::repatchGetByID):
(JSC::appropriateGenericGetByIdFunction): Deleted.
* jit/Repatch.h:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/JSCJSValue.h:
* runtime/JSCJSValueInlines.h:
(JSC::JSValue::getOwnPropertySlot const):
* runtime/JSObject.h:
* runtime/JSObjectInlines.h:
(JSC::JSObject::getOwnPropertySlotInline):


  Commit: b039db878f15043ed1c893080789c3951954bc72
      https://github.com/WebKit/WebKit/commit/b039db878f15043ed1c893080789c3951954bc72
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

  Log Message:
  -----------
  Merge r230379 - Unreviewed, follow-up patch for DFG 32bit
https://bugs.webkit.org/show_bug.cgi?id=183970

* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::cachedGetById):


  Commit: 2aba0d5481ae5d2757674a3bf9fc885899dfdce9
      https://github.com/WebKit/WebKit/commit/2aba0d5481ae5d2757674a3bf9fc885899dfdce9
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-06-11 (Mon, 11 Jun 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.20.3 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.20.3.


  Commit: f6b64e30f264b2a74b60fae744ab754fef6de7d5
      https://github.com/WebKit/WebKit/commit/f6b64e30f264b2a74b60fae744ab754fef6de7d5
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-06-14 (Thu, 14 Jun 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/function-caller-async-arrow-function-body.js
    A JSTests/stress/function-caller-async-function-body.js
    A JSTests/stress/function-caller-async-generator-body.js
    A JSTests/stress/function-caller-generator-body.js
    A JSTests/stress/function-caller-generator-method-body.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/builtins/BuiltinNames.h
    M Source/JavaScriptCore/runtime/JSFunction.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h

  Log Message:
  -----------
  Merge r230662 - Function.prototype.caller shouldn't return generator bodies
https://bugs.webkit.org/show_bug.cgi?id=184630

Reviewed by Yusuke Suzuki.
JSTests:

* stress/function-caller-async-arrow-function-body.js: Added.
* stress/function-caller-async-function-body.js: Added.
* stress/function-caller-async-generator-body.js: Added.
* stress/function-caller-generator-body.js: Added.
* stress/function-caller-generator-method-body.js: Added.

Source/JavaScriptCore:

Function.prototype.caller no longer returns generator bodies. Those are meant to be
private.

Also added some builtin debugging tools so that it's easier to do the investigation that I
did.

* builtins/BuiltinNames.h:
* runtime/JSFunction.cpp:
(JSC::JSFunction::callerGetter):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncBuiltinDescribe):
* runtime/JSGlobalObjectFunctions.h:


  Commit: ddcb399348433b700fd990452b7e9c2f02ab9462
      https://github.com/WebKit/WebKit/commit/ddcb399348433b700fd990452b7e9c2f02ab9462
  Author: Caitlin Potter <caitp at igalia.com>
  Date:   2018-06-14 (Thu, 14 Jun 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/Instruction.h
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
    M Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
    M Source/JavaScriptCore/runtime/CommonSlowPaths.h

  Log Message:
  -----------
  Merged r232816 - [LLInt] use loadp consistently for get_from_scope/put_to_scope
https://bugs.webkit.org/show_bug.cgi?id=132333

Patch by Caitlin Potter <caitp at igalia.com> on 2018-06-13
Reviewed by Mark Lam.

Using `loadis` for register indexes and `loadp` for constant scopes /
symboltables makes sense, but is problematic for big-endian
architectures.

Consistently treating the operand as a pointer simplifies determining
how to access the operand, and helps avoid bad accesses and crashes on
big-endian ports.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
* bytecode/Instruction.h:
* jit/JITOperations.cpp:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CommonSlowPaths.h:
(JSC::CommonSlowPaths::tryCachePutToScopeGlobal):
(JSC::CommonSlowPaths::tryCacheGetFromScopeGlobal):


  Commit: d4ecf7e52df2bb75ea71b6c6b22bbe9bbc12467e
      https://github.com/WebKit/WebKit/commit/d4ecf7e52df2bb75ea71b6c6b22bbe9bbc12467e
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-06-14 (Thu, 14 Jun 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/inspector/remote/glib/RemoteInspectorUtils.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/wpe/WebKit2InspectorGResourceBundle.xml
    M Source/WebKit/UIProcess/gtk/WebInspectorProxyGtk.cpp
    M Source/WebKit/UIProcess/wpe/WebInspectorProxyWPE.cpp
    M Source/WebKit/WebProcess/WebPage/gtk/WebInspectorUIGtk.cpp
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/InjectedBundle/gtk/TestRunnerGtk.cpp
    M Tools/glib/generate-inspector-gresource-manifest.py

  Log Message:
  -----------
  Merged r232832 - [WPE] Trying to access the remote inspector hits an assertion in the UIProcess
https://bugs.webkit.org/show_bug.cgi?id=186588

Reviewed by Carlos Garcia Campos.

Make both the WPE and GTK+ ports use /org/webkit/inspector as base prefix
for resource paths, which avoids needing a switcheroo depending on the port.

Source/JavaScriptCore:

* inspector/remote/glib/RemoteInspectorUtils.cpp:

Source/WebKit:

* UIProcess/API/wpe/WebKit2InspectorGResourceBundle.xml:
* UIProcess/gtk/WebInspectorProxyGtk.cpp:
(WebKit::WebInspectorProxy::inspectorPageURL):
(WebKit::WebInspectorProxy::inspectorTestPageURL):
(WebKit::WebInspectorProxy::inspectorBaseURL):
* UIProcess/wpe/WebInspectorProxyWPE.cpp:
(WebKit::WebInspectorProxy::inspectorPageURL):
(WebKit::WebInspectorProxy::inspectorTestPageURL):
(WebKit::WebInspectorProxy::inspectorBaseURL):
* WebProcess/WebPage/gtk/WebInspectorUIGtk.cpp:
(WebKit::WebInspectorUI::localizedStringsURL):
(WebKit::RemoteWebInspectorUI::localizedStringsURL):

Tools:

* WebKitTestRunner/InjectedBundle/gtk/TestRunnerGtk.cpp:
(WTR::TestRunner::inspectorTestStubURL):
* glib/generate-inspector-gresource-manifest.py:


  Commit: b1845b60136b721cc504324d7ea4c17f3fae7466
      https://github.com/WebKit/WebKit/commit/b1845b60136b721cc504324d7ea4c17f3fae7466
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-06-14 (Thu, 14 Jun 2018)

  Changed paths:
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for 2.20.1 release.


  Commit: dc21e8d057305ff3dd6b522975c692a094219e26
      https://github.com/WebKit/WebKit/commit/dc21e8d057305ff3dd6b522975c692a094219e26
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-07-25 (Wed, 25 Jul 2018)

  Changed paths:
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  [GTK][STABLE] Non-deterministic build failure (missing JavaScriptCore/JSContextRef.h)


  Commit: b4cc88e36a7750f34e8c4620f3f6f06a0805650f
      https://github.com/WebKit/WebKit/commit/b4cc88e36a7750f34e8c4620f3f6f06a0805650f
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-07-25 (Wed, 25 Jul 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/Instruction.h
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
    M Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
    M Source/JavaScriptCore/runtime/CommonSlowPaths.h

  Log Message:
  -----------
  Merge r232883 - Unreviewed, rolling out r232816.

Suggested by Caitlin:
"this patch clearly does get some things wrong, and it's not
easy to find what those things are"

Reverted changeset:

"[LLInt] use loadp consistently for
get_from_scope/put_to_scope"
https://bugs.webkit.org/show_bug.cgi?id=132333
https://trac.webkit.org/changeset/232816


  Commit: 6664c0693b71590aabae74fe8ac014f89c885fdc
      https://github.com/WebKit/WebKit/commit/6664c0693b71590aabae74fe8ac014f89c885fdc
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-07-25 (Wed, 25 Jul 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h
    M Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp

  Log Message:
  -----------
  Merge r233080 - REGRESSION(r230950): [GTK] WebKit::CoordinatedBackingStoreTile::setBackBuffer(): WebKitWebProcess killed by SIGSEGV (ASSERTION FAILED: it != m_tiles.end())
https://bugs.webkit.org/show_bug.cgi?id=186206

Source/WebCore:

Unreviewed manual rollout of r230950

* platform/graphics/texmap/TextureMapperLayer.h:
* platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
(WebCore::CoordinatedGraphicsLayer::shouldHaveBackingStore const):

Source/WebKit:

Unreviewed manual rollout of r230950

* Shared/CoordinatedGraphics/CoordinatedGraphicsScene.cpp:
(WebKit::layerShouldHaveBackingStore):

LayoutTests:

Unreviewed, remove crash expectations for crashes introduced by r230950.

* platform/gtk/TestExpectations:


  Commit: a0ac962f4296b22f1f441bc658ab8896013fd895
      https://github.com/WebKit/WebKit/commit/a0ac962f4296b22f1f441bc658ab8896013fd895
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-07-25 (Wed, 25 Jul 2018)

  Changed paths:
    M LayoutTests/platform/gtk/TestExpectations

  Log Message:
  -----------
  Unreviewed, fix merge conflict from previous patch

I failed to address a merge conflict in the TestExpectations.


  Commit: 44e0d373569d264f119761448b62f5ec9e938489
      https://github.com/WebKit/WebKit/commit/44e0d373569d264f119761448b62f5ec9e938489
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/StringConstructor.cpp

  Log Message:
  -----------
  Merge r231171 - Remove unneeded exception check from String.fromCharCode
https://bugs.webkit.org/show_bug.cgi?id=185083

Reviewed by Mark Lam.

* runtime/StringConstructor.cpp:
(JSC::stringFromCharCode):


  Commit: a74610a3c3626d7bc548ffa928e7eb0ea964f1aa
      https://github.com/WebKit/WebKit/commit/a74610a3c3626d7bc548ffa928e7eb0ea964f1aa
  Author: JF Bastien <jfbastien at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/put-by-id-direct-strict-transition.js
    A JSTests/stress/put-by-id-direct-transition.js
    A JSTests/stress/put-getter-setter-by-id-strict-transition.js
    A JSTests/stress/put-getter-setter-by-id-transition.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSObjectInlines.h

  Log Message:
  -----------
  Merge r230740 - A put is not an ExistingProperty put when we transition a structure because of an attributes change
https://bugs.webkit.org/show_bug.cgi?id=184706
<rdar://problem/38871451>

Reviewed by Saam Barati.

JSTests:

* stress/put-by-id-direct-strict-transition.js: Added.
(const.foo):
(j.const.obj.set hello):
* stress/put-by-id-direct-transition.js: Added.
(const.foo):
(j.const.obj.set hello):
* stress/put-getter-setter-by-id-strict-transition.js: Added.
(const.foo):
(j.const.obj.set hello):
* stress/put-getter-setter-by-id-transition.js: Added.
(const.foo):
(j.const.obj.set hello):

Source/JavaScriptCore:

When putting a property on a structure and the slot is a different
type, the slot can't be said to have already been existing.

* runtime/JSObjectInlines.h:
(JSC::JSObject::putDirectInternal):


  Commit: 44981076243e4a96188cb11e129a165587737dcf
      https://github.com/WebKit/WebKit/commit/44981076243e4a96188cb11e129a165587737dcf
  Author: JF Bastien <jfbastien at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/json-stringified-overflow-2.js
    M JSTests/stress/json-stringified-overflow.js
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/text/StringBuilderJSON.cpp

  Log Message:
  -----------
  Merge r230863 - Handle more JSON stringify OOM
https://bugs.webkit.org/show_bug.cgi?id=184846
<rdar://problem/39390672>

Reviewed by Mark Lam.

JSTests:

* stress/json-stringified-overflow-2.js: Added. Same as the one
below, but with a bigger input which will trigger a different code
path.
(catch):
* stress/json-stringified-overflow.js: Modify the test to only
catch OOM on stringification. not on string creation.

Source/WTF:

JSON stringification can OOM easily. Here's another case.

* wtf/text/StringBuilderJSON.cpp:
(WTF::StringBuilder::appendQuotedJSONString):


  Commit: 24fb95a3d9d269dff61e1aae0c665af4215761c4
      https://github.com/WebKit/WebKit/commit/24fb95a3d9d269dff61e1aae0c665af4215761c4
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/stress/json-stringified-overflow-2.js
    M JSTests/stress/json-stringified-overflow.js

  Log Message:
  -----------
  Merge r230972 - Gardening: test fix after r230863.
https://bugs.webkit.org/show_bug.cgi?id=184846
<rdar://problem/39390672>

Not reviewed.

* stress/json-stringified-overflow-2.js:
(catch):
* stress/json-stringified-overflow.js:
(catch):


  Commit: 9ae04ec1fe68462e7c2b793e3e0cd19d2b4dd8e6
      https://github.com/WebKit/WebKit/commit/9ae04ec1fe68462e7c2b793e3e0cd19d2b4dd8e6
  Author: Robin Morisset <rmorisset at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/create-rest-while-having-a-bad-time.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObject.h

  Log Message:
  -----------
  Merge r231034 - In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
https://bugs.webkit.org/show_bug.cgi?id=184773
<rdar://problem/37773612>

Reviewed by Filip Pizlo.

JSTests:

This bug requires a race between the thread doing FTL compilation and the main thread, but it triggers in 100% of cases (before the fix) on my machine
so I decided to add it to the stress tests nonetheless.

* stress/create-rest-while-having-a-bad-time.js: Added.
(f):
(g):
(h):

Source/JavaScriptCore:

We were calling restParameterStructure(), which returns arrayStructureForIndexingTypeDuringAllocation(ArrayWithContiguous).
arrayStructureForIndexingTypeDuringAllocation uses m_arrayStructureForIndexingShapeDuringAllocation, which is set to SlowPutArrayStorage when we are 'having a bad time'.
This is problematic, because the structure is then passed to allocateUninitializedContiguousJSArray, which ASSERTs that the indexing type is contiguous (or int32).
We solve the problem by using originalArrayStructureForIndexingType which always returns a structure with the right indexing type (contiguous), even if we are having a bad time.
This is safe, as we are under isWatchingHavingABadTimeWatchpoint, so if we have a bad time, the code we generate will never be installed.

* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCreateRest):


  Commit: 86cb3eda615b549f2d3968d5e0684a050ba1701a
      https://github.com/WebKit/WebKit/commit/86cb3eda615b549f2d3968d5e0684a050ba1701a
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regexp-exec-test-effectful-last-index.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGClobberize.h

  Log Message:
  -----------
  Merge r231145 - We don't model regexp effects properly
https://bugs.webkit.org/show_bug.cgi?id=185059
<rdar://problem/39736150>

Reviewed by Filip Pizlo.

JSTests:

* stress/regexp-exec-test-effectful-last-index.js: Added.
(assert):
(foo):
(i.regexLastIndex.toString):
(bar):

Source/JavaScriptCore:

RegExp exec/test can do arbitrary effects when toNumbering the lastIndex if
the regexp is global.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):


  Commit: f96c09a6fc7165deccbbe17adc9997a59e552415
      https://github.com/WebKit/WebKit/commit/f96c09a6fc7165deccbbe17adc9997a59e552415
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/forms/form-submission-crash-3-expected.txt
    A LayoutTests/fast/forms/form-submission-crash-3.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLButtonElement.cpp
    M Source/WebCore/html/HTMLFormElement.cpp
    M Source/WebCore/html/ImageInputType.cpp
    M Source/WebCore/html/SubmitInputType.cpp

  Log Message:
  -----------
  Merge r231236 - Prevent Debug ASSERT when changing forms
https://bugs.webkit.org/show_bug.cgi?id=185173
<rdar://problem/39738669>

Reviewed by Ryosuke Niwa.

Form submission could trigger a debug assertion during validation when
a form is changed during an input submission. Fix this by cleaning up
the event handling logic and make it more consistent with modern WebKit
coding style.

Test: fast/forms/form-submission-crash-3.html

* html/HTMLButtonElement.cpp:
(WebCore::HTMLButtonElement::defaultEventHandler): Make sure layout runs before
attempting to perform event handling.
* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::reportValidity): Ditto.
(WebCore::HTMLFormElement::validateInteractively): Remove call to perform layout here,
since we expect this to happen earlier in the layout pass. Add an assertion that the
tree is not dirty.
* html/ImageInputType.cpp:
(WebCore::ImageInputType::handleDOMActivateEvent): Make sure layout runs before
attempting to perform event handling.
* html/SubmitInputType.cpp:
(WebCore::SubmitInputType::handleDOMActivateEvent): Ditto.

LayoutTests:
Prevent assertion when changing forms
https://bugs.webkit.org/show_bug.cgi?id=185173
<rdar://problem/39738669>

Reviewed by Ryosuke Niwa.

* fast/forms/form-submission-crash-3-expected.txt: Added.
* fast/forms/form-submission-crash-3.html: Added.


  Commit: cc051d9a0fda2f4d960a975b31da86747e9a1c97
      https://github.com/WebKit/WebKit/commit/cc051d9a0fda2f4d960a975b31da86747e9a1c97
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/forms/access-key-mutation-2-expected.txt
    A LayoutTests/fast/forms/access-key-mutation-2.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLInputElement.cpp
    M Source/WebCore/html/HTMLInputElement.h
    M Source/WebCore/html/InputType.cpp
    M Source/WebCore/html/InputType.h

  Log Message:
  -----------
  Merge r231291 - Use RetainPtr for form input type
https://bugs.webkit.org/show_bug.cgi?id=185210
<rdar://problem/39734040>

Reviewed by Ryosuke Niwa.

Source/WebCore:

Refactor our HTMLInputElement class to store its InputType member as a RefPtr.

Test: fast/forms/access-key-mutation-2.html.

* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::HTMLInputElement):
(WebCore::HTMLInputElement::didAddUserAgentShadowRoot):
(WebCore::HTMLInputElement::accessKeyAction):
(WebCore::HTMLInputElement::parseAttribute):
(WebCore::HTMLInputElement::appendFormData):
* html/HTMLInputElement.h:
* html/InputType.cpp:
(WebCore::createInputType):
(WebCore::InputType::create):
(WebCore::InputType::createText):
* html/InputType.h:

LayoutTests:

* fast/forms/access-key-mutation-2-expected.txt: Added.
* fast/forms/access-key-mutation-2.html: Added.


  Commit: d55da7d3f8766bcdc36ab9f8ae169bf8110445f8
      https://github.com/WebKit/WebKit/commit/d55da7d3f8766bcdc36ab9f8ae169bf8110445f8
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/BaseButtonInputType.cpp
    M Source/WebCore/html/BaseCheckableInputType.cpp
    M Source/WebCore/html/BaseClickableWithKeyInputType.cpp
    M Source/WebCore/html/BaseDateAndTimeInputType.cpp
    M Source/WebCore/html/BaseTextInputType.cpp
    M Source/WebCore/html/CheckboxInputType.cpp
    M Source/WebCore/html/ColorInputType.cpp
    M Source/WebCore/html/EmailInputType.cpp
    M Source/WebCore/html/FileInputType.cpp
    M Source/WebCore/html/HTMLInputElement.h
    M Source/WebCore/html/HiddenInputType.cpp
    M Source/WebCore/html/ImageInputType.cpp
    M Source/WebCore/html/InputType.cpp
    M Source/WebCore/html/InputType.h
    M Source/WebCore/html/NumberInputType.cpp
    M Source/WebCore/html/RadioInputType.cpp
    M Source/WebCore/html/RangeInputType.cpp
    M Source/WebCore/html/ResetInputType.cpp
    M Source/WebCore/html/SearchInputType.cpp
    M Source/WebCore/html/SubmitInputType.cpp
    M Source/WebCore/html/TextFieldInputType.cpp
    M Source/WebCore/html/URLInputType.cpp

  Log Message:
  -----------
  Merge r232496 - REGRESSION(r231291): InputType should hold a WeakPtr to its HTMLInputElement
https://bugs.webkit.org/show_bug.cgi?id=186096
<rdar://problem/40651015>

Reviewed by Ryosuke Niwa.

Now that the InputType may be kept alive as part of in-flight form submissions, we
shouldn't assume that the referenced HTMLInputElement is still valid before using it.

The only time we should be lacking a referencing element is in cases where the InputType
is changing, either through a change in the HTMLInputElement's type attribute. In those
cases we should check for a valid HTMLInputElement. In other cases, we should ASSERT.

* html/BaseButtonInputType.cpp:
(WebCore::BaseButtonInputType::createInputRenderer):
(WebCore::BaseButtonInputType::setValue):
* html/BaseCheckableInputType.cpp:
(WebCore::BaseCheckableInputType::saveFormControlState const):
(WebCore::BaseCheckableInputType::restoreFormControlState):
(WebCore::BaseCheckableInputType::appendFormData const):
(WebCore::BaseCheckableInputType::handleKeydownEvent):
(WebCore::BaseCheckableInputType::accessKeyAction):
(WebCore::BaseCheckableInputType::setValue):
* html/BaseChooserOnlyDateAndTimeInputType.cpp:
(WebCore::BaseChooserOnlyDateAndTimeInputType::attributeChanged): Add a nullptr check
here, since this is called directly by code that causes the old InputType to be removed,
which could leave us with a nullptr element().
* html/BaseClickableWithKeyInputType.cpp:
(WebCore::BaseClickableWithKeyInputType::handleKeydownEvent):
(WebCore::BaseClickableWithKeyInputType::handleKeypressEvent):
(WebCore::BaseClickableWithKeyInputType::accessKeyAction):
* html/BaseDateAndTimeInputType.cpp:
(WebCore::BaseDateAndTimeInputType::attributeChanged): Add a nullptr check
here, since this is called directly by code that causes the old InputType to be removed,
which could leave us with a nullptr element().
* html/BaseTextInputType.cpp:
(WebCore::BaseTextInputType::patternMismatch const):
* html/CheckboxInputType.cpp:
(WebCore::CheckboxInputType::valueMissing const):
(WebCore::CheckboxInputType::willDispatchClick):
(WebCore::CheckboxInputType::didDispatchClick):
(WebCore::CheckboxInputType::shouldAppearIndeterminate const):
* html/ColorInputType.cpp:
(WebCore::ColorInputType::valueAsColor const):
(WebCore::ColorInputType::createShadowSubtree):
(WebCore::ColorInputType::handleDOMActivateEvent):
(WebCore::ColorInputType::didChooseColor):
(WebCore::ColorInputType::updateColorSwatch):
(WebCore::ColorInputType::shadowColorSwatch const):
(WebCore::ColorInputType::elementRectRelativeToRootView const):
(WebCore::ColorInputType::shouldShowSuggestions const):
(WebCore::ColorInputType::suggestions const):
* html/EmailInputType.cpp:
(WebCore::EmailInputType::typeMismatchFor const):
(WebCore::EmailInputType::typeMismatch const):
(WebCore::EmailInputType::typeMismatchText const):
(WebCore::EmailInputType::sanitizeValue const):
* html/FileInputType.cpp:
(WebCore::FileInputType::appendFormData const):
(WebCore::FileInputType::attributeChanged): Add a nullptr check here, since
this is called directly by code that causes the old InputType to be removed,
which could leave us with a nullptr element().
(WebCore::FileInputType::valueMissing const):
(WebCore::FileInputType::valueMissingText const):
(WebCore::FileInputType::handleDOMActivateEvent):
(WebCore::FileInputType::createInputRenderer):
(WebCore::FileInputType::setValue):
(WebCore::FileInputType::createShadowSubtree):
(WebCore::FileInputType::disabledAttributeChanged):
(WebCore::FileInputType::multipleAttributeChanged):
(WebCore::FileInputType::allowsDirectories const):
(WebCore::FileInputType::setFiles):
(WebCore::FileInputType::iconLoaded):
(WebCore::FileInputType::receiveDroppedFiles):
(WebCore::FileInputType::defaultToolTip const):
* html/HTMLInputElement.h:
(WebCore::HTMLInputElement::weakPtrFactory const):
* html/HiddenInputType.cpp:
(WebCore::HiddenInputType::saveFormControlState const):
(WebCore::HiddenInputType::restoreFormControlState):
(WebCore::HiddenInputType::setValue):
(WebCore::HiddenInputType::appendFormData const):
* html/ImageInputType.cpp:
(WebCore::ImageInputType::appendFormData const):
(WebCore::ImageInputType::handleDOMActivateEvent):
(WebCore::ImageInputType::createInputRenderer):
(WebCore::ImageInputType::altAttributeChanged):
(WebCore::ImageInputType::srcAttributeChanged):
(WebCore::ImageInputType::attach):
(WebCore::ImageInputType::height const):
(WebCore::ImageInputType::width const):
* html/InputType.cpp:
(WebCore::InputType::saveFormControlState const):
(WebCore::InputType::restoreFormControlState):
(WebCore::InputType::isFormDataAppendable const):
(WebCore::InputType::appendFormData const):
(WebCore::InputType::sizeShouldIncludeDecoration const):
(WebCore::InputType::validationMessage const):
(WebCore::InputType::createInputRenderer):
(WebCore::InputType::blur):
(WebCore::InputType::destroyShadowSubtree):
(WebCore::InputType::dispatchSimulatedClickIfActive const):
(WebCore::InputType::chrome const):
(WebCore::InputType::isKeyboardFocusable const):
(WebCore::InputType::isMouseFocusable const):
(WebCore::InputType::accessKeyAction):
(WebCore::InputType::setValue):
(WebCore::InputType::visibleValue const):
(WebCore::InputType::applyStep):
(WebCore::InputType::stepUpFromRenderer):
* html/InputType.h:
(WebCore::InputType::InputType):
(WebCore::InputType::element const):
* html/NumberInputType.cpp:
(WebCore::NumberInputType::attributeChanged): Add a nullptr check here, since
this is called directly by code that causes the old InputType to be removed,
which could leave us with a nullptr element().
(WebCore::NumberInputType::setValue):
(WebCore::NumberInputType::valueAsDouble const):
(WebCore::NumberInputType::setValueAsDouble const):
(WebCore::NumberInputType::setValueAsDecimal const):
(WebCore::NumberInputType::typeMismatch const):
(WebCore::NumberInputType::createStepRange const):
(WebCore::NumberInputType::sizeShouldIncludeDecoration const):
(WebCore::NumberInputType::decorationWidth const):
(WebCore::NumberInputType::localizeValue const):
(WebCore::NumberInputType::visibleValue const):
(WebCore::NumberInputType::convertFromVisibleValue const):
(WebCore::NumberInputType::hasBadInput const):
(WebCore::NumberInputType::minOrMaxAttributeChanged):
(WebCore::NumberInputType::stepAttributeChanged):
* html/RadioInputType.cpp:
(WebCore::RadioInputType::valueMissing const):
(WebCore::RadioInputType::handleKeydownEvent):
(WebCore::RadioInputType::handleKeyupEvent):
(WebCore::RadioInputType::isKeyboardFocusable const):
(WebCore::RadioInputType::shouldSendChangeEventAfterCheckedChanged):
(WebCore::RadioInputType::willDispatchClick):
(WebCore::RadioInputType::didDispatchClick):
(WebCore::RadioInputType::matchesIndeterminatePseudoClass const):
* html/RangeInputType.cpp:
(WebCore::RangeInputType::attributeChanged): Add a nullptr check here, since
this is called directly by code that causes the old InputType to be removed,
which could leave us with a nullptr element().
(WebCore::RangeInputType::valueAsDouble const):
(WebCore::RangeInputType::setValueAsDecimal const):
(WebCore::RangeInputType::createStepRange const):
(WebCore::RangeInputType::handleMouseDownEvent):
(WebCore::RangeInputType::handleTouchEvent):
(WebCore::RangeInputType::handleKeydownEvent):
(WebCore::RangeInputType::createShadowSubtree):
(WebCore::RangeInputType::sliderTrackElement const):
(WebCore::RangeInputType::createInputRenderer):
(WebCore::RangeInputType::accessKeyAction):
(WebCore::RangeInputType::minOrMaxAttributeChanged):
(WebCore::RangeInputType::setValue):
(WebCore::RangeInputType::updateTickMarkValues):
* html/ResetInputType.cpp:
(WebCore::ResetInputType::handleDOMActivateEvent):
* html/SearchInputType.cpp:
(WebCore::SearchInputType::addSearchResult):
(WebCore::SearchInputType::maxResultsAttributeChanged):
(WebCore::SearchInputType::createInputRenderer):
(WebCore::SearchInputType::createShadowSubtree):
(WebCore::SearchInputType::handleKeydownEvent):
(WebCore::SearchInputType::startSearchEventTimer):
(WebCore::SearchInputType::searchEventTimerFired):
(WebCore::SearchInputType::searchEventsShouldBeDispatched const):
(WebCore::SearchInputType::didSetValueByUserEdit):
(WebCore::SearchInputType::sizeShouldIncludeDecoration const):
* html/SubmitInputType.cpp:
(WebCore::SubmitInputType::appendFormData const):
(WebCore::SubmitInputType::handleDOMActivateEvent):
* html/TextFieldInputType.cpp:
(WebCore::TextFieldInputType::attributeChanged): Add a nullptr check here, since
this is called directly by code that causes the old InputType to be removed,
which could leave us with a nullptr element().
(WebCore::TextFieldInputType::isKeyboardFocusable const):
(WebCore::TextFieldInputType::isMouseFocusable const):
(WebCore::TextFieldInputType::valueMissing const):
(WebCore::TextFieldInputType::setValue):
(WebCore::TextFieldInputType::handleKeydownEvent):
(WebCore::TextFieldInputType::handleKeydownEventForSpinButton):
(WebCore::TextFieldInputType::forwardEvent):
(WebCore::TextFieldInputType::elementDidBlur):
(WebCore::TextFieldInputType::handleFocusEvent):
(WebCore::TextFieldInputType::handleBlurEvent):
(WebCore::TextFieldInputType::createInputRenderer):
(WebCore::TextFieldInputType::shouldHaveSpinButton const):
(WebCore::TextFieldInputType::shouldHaveCapsLockIndicator const):
(WebCore::TextFieldInputType::createShadowSubtree):
(WebCore::TextFieldInputType::handleBeforeTextInsertedEvent):
(WebCore::TextFieldInputType::updatePlaceholderText):
(WebCore::TextFieldInputType::appendFormData const):
(WebCore::TextFieldInputType::subtreeHasChanged):
(WebCore::TextFieldInputType::didSetValueByUserEdit):
(WebCore::TextFieldInputType::updateInnerTextValue):
(WebCore::TextFieldInputType::focusAndSelectSpinButtonOwner):
(WebCore::TextFieldInputType::shouldSpinButtonRespondToMouseEvents):
(WebCore::TextFieldInputType::shouldSpinButtonRespondToWheelEvents):
(WebCore::TextFieldInputType::shouldDrawCapsLockIndicator const):
(WebCore::TextFieldInputType::shouldDrawAutoFillButton const):
(WebCore::TextFieldInputType::autoFillButtonElementWasClicked):
(WebCore::TextFieldInputType::createContainer):
(WebCore::TextFieldInputType::createAutoFillButton):
(WebCore::TextFieldInputType::updateAutoFillButton):
* html/URLInputType.cpp:
(WebCore::URLInputType::typeMismatch const):


  Commit: f82c21e618dc1b6fa09c1c5f8a34846d9f1a8ca5
      https://github.com/WebKit/WebKit/commit/f82c21e618dc1b6fa09c1c5f8a34846d9f1a8ca5
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/ScrollView.h
    M Source/WebCore/platform/Widget.cpp
    M Source/WebCore/platform/Widget.h

  Log Message:
  -----------
  Merge r231335 - Widgets should hold a WeakPtr to their parents
https://bugs.webkit.org/show_bug.cgi?id=185239
<rdar://problem/39741250>

Reviewed by Zalan Bujtas.

* platform/ScrollView.h:
(WebCore::ScrollView::weakPtrFactory): Added.
* platform/Widget.cpp:
(WebCore::Widget::init): Don't perform an unnecessary assignment.
(WebCore::Widget::setParent): Grab a WeakPtr to the parent ScrollView.
* platform/Widget.h:
(WebCore::Widget::parent const): Change type to a WeakPtr.


  Commit: 8d873cf39286cd002e08c44b3663ba0990c6b020
      https://github.com/WebKit/WebKit/commit/8d873cf39286cd002e08c44b3663ba0990c6b020
  Author: Dean Jackson <dino at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/canvas/webgl/index-validation-with-subsequent-draws-expected.txt
    A LayoutTests/fast/canvas/webgl/index-validation-with-subsequent-draws.html
    M LayoutTests/platform/mac/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
    M Source/WebCore/html/canvas/WebGLRenderingContextBase.h

  Log Message:
  -----------
  Merge r231441 - WebGL: Reset simulated values after validation fails
https://bugs.webkit.org/show_bug.cgi?id=185363
<rdar://problem/39733417>

Reviewed by Anders Carlsson.

Source/WebCore:

While fixing a previous bug, I forgot to reset some values
when validation fails. This caused a bug where a subsequent
invalid call might use those values and escape detection.

Test: fast/canvas/webgl/index-validation-with-subsequent-draws.html

* html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::simulateVertexAttrib0): Reset the
sizes when validation fails.
* html/canvas/WebGLRenderingContextBase.h:

LayoutTests:

* fast/canvas/webgl/index-validation-with-subsequent-draws-expected.txt: Added.
* fast/canvas/webgl/index-validation-with-subsequent-draws.html: Added.


  Commit: b1db9906878f6feca374953fa0f197e39fdf01d2
      https://github.com/WebKit/WebKit/commit/b1db9906878f6feca374953fa0f197e39fdf01d2
  Author: Jer Noble <jer.noble at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/media/resources/1000Hz-sin.wav
    A LayoutTests/http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-expected.txt
    A LayoutTests/http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html
    A LayoutTests/http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-expected.txt
    A LayoutTests/http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/webaudio/AudioContext.cpp
    M Source/WebCore/Modules/webaudio/AudioContext.h
    M Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.cpp
    M Source/WebCore/Modules/webaudio/MediaElementAudioSourceNode.h

  Log Message:
  -----------
  Merge r231513 - Mute MediaElementSourceNode when tainted.
https://bugs.webkit.org/show_bug.cgi?id=184866

Reviewed by Eric Carlson.

Source/WebCore:

Test: http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin.html

* Modules/webaudio/AudioContext.cpp:
(WebCore::AudioContext::wouldTaintOrigin const):
* Modules/webaudio/AudioContext.h:
* Modules/webaudio/MediaElementAudioSourceNode.cpp:
(WebCore::MediaElementAudioSourceNode::setFormat):
(WebCore::MediaElementAudioSourceNode::wouldTaintOrigin):
(WebCore::MediaElementAudioSourceNode::process):
* Modules/webaudio/MediaElementAudioSourceNode.h:

LayoutTests:

* http/tests/media/resources/1000Hz-sin.wav: Added.
* http/tests/security/webaudio-render-remote-audio-allowed-crossorigin-expected.txt: Added.
* http/tests/security/webaudio-render-remote-audio-allowed-crossorigin.html: Added.
* http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin-expected.txt: Added.
* http/tests/security/webaudio-render-remote-audio-blocked-no-crossorigin.html: Added.


  Commit: 0dbc03e64916f33bdf07a31dd038dc53f5554496
      https://github.com/WebKit/WebKit/commit/0dbc03e64916f33bdf07a31dd038dc53f5554496
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/Watchpoint.cpp
    M Source/JavaScriptCore/bytecode/Watchpoint.h
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/JSObjectInlines.h
    M Source/JavaScriptCore/runtime/Structure.cpp
    M Source/JavaScriptCore/runtime/Structure.h

  Log Message:
  -----------
  Merge r231518 - Deferred firing of structure transition watchpoints is racy
https://bugs.webkit.org/show_bug.cgi?id=185438

Reviewed by Saam Barati.

Changed DeferredStructureTransitionWatchpointFire to take the watchpoints to fire
and fire them in the destructor.  When the watchpoints are taken from the
original WatchpointSet, that WatchpointSet if marked invalid.

* bytecode/Watchpoint.cpp:
(JSC::WatchpointSet::fireAllSlow):
(JSC::WatchpointSet::take):
(JSC::DeferredWatchpointFire::DeferredWatchpointFire):
(JSC::DeferredWatchpointFire::~DeferredWatchpointFire):
(JSC::DeferredWatchpointFire::fireAll):
(JSC::DeferredWatchpointFire::takeWatchpointsToFire):
* bytecode/Watchpoint.h:
(JSC::WatchpointSet::fireAll):
(JSC::InlineWatchpointSet::fireAll):
* runtime/JSObject.cpp:
(JSC::JSObject::setPrototypeDirect):
(JSC::JSObject::convertToDictionary):
* runtime/JSObjectInlines.h:
(JSC::JSObject::putDirectInternal):
* runtime/Structure.cpp:
(JSC::Structure::Structure):
(JSC::DeferredStructureTransitionWatchpointFire::DeferredStructureTransitionWatchpointFire):
(JSC::DeferredStructureTransitionWatchpointFire::~DeferredStructureTransitionWatchpointFire):
(JSC::DeferredStructureTransitionWatchpointFire::dump const):
(JSC::Structure::didTransitionFromThisStructure const):
(JSC::DeferredStructureTransitionWatchpointFire::add): Deleted.
* runtime/Structure.h:
(JSC::DeferredStructureTransitionWatchpointFire::structure const):


  Commit: fd87072c1f37d290ec2e4e1e719d36578c1f4ddb
      https://github.com/WebKit/WebKit/commit/fd87072c1f37d290ec2e4e1e719d36578c1f4ddb
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-185995.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
    M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

  Log Message:
  -----------
  Merge r232219 - for-in loops should preserve and restore the TDZ stack for each of its internal loops.
https://bugs.webkit.org/show_bug.cgi?id=185995
<rdar://problem/40173142>

Reviewed by Saam Barati.

JSTests:

* stress/regress-185995.js: Added.

Source/JavaScriptCore:

This is because there's no guarantee that any of the loop bodies will be
executed.  Hence, there's no guarantee that the TDZ variables will have been
initialized after each loop body.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::preserveTDZStack):
(JSC::BytecodeGenerator::restoreTDZStack):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ForInNode::emitBytecode):


  Commit: 24030a1cb0babea0669c649ac1eb4d34eed204d1
      https://github.com/WebKit/WebKit/commit/24030a1cb0babea0669c649ac1eb4d34eed204d1
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/llint-proto-get-by-id-cache-change-prototype.js
    A JSTests/stress/llint-proto-get-by-id-cache-intercept-value.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/CodeBlock.h
    M Source/JavaScriptCore/bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h
    M Source/JavaScriptCore/bytecode/ObjectPropertyConditionSet.h
    M Source/JavaScriptCore/bytecode/Watchpoint.h
    M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Bag.h

  Log Message:
  -----------
  Merge r232313 - LLInt get_by_id prototype caching doesn't properly handle changes
https://bugs.webkit.org/show_bug.cgi?id=186112

Reviewed by Filip Pizlo.

JSTests:

* stress/llint-proto-get-by-id-cache-change-prototype.js: Added.
(foo):
* stress/llint-proto-get-by-id-cache-intercept-value.js: Added.
(foo):

Source/JavaScriptCore:

The caching would sometimes fail to track that a prototype had changed
and wouldn't update its set of watchpoints.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finalizeLLIntInlineCaches):
* bytecode/CodeBlock.h:
* bytecode/LLIntPrototypeLoadAdaptiveStructureWatchpoint.h:
(JSC::LLIntPrototypeLoadAdaptiveStructureWatchpoint::key const):
* bytecode/ObjectPropertyConditionSet.h:
(JSC::ObjectPropertyConditionSet::size const):
* bytecode/Watchpoint.h:
(JSC::Watchpoint::Watchpoint): Deleted.
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::setupGetByIdPrototypeCache):

Source/WTF:

Mark some methods const.

* wtf/Bag.h:
(WTF::Bag::begin const):
(WTF::Bag::end const):
(WTF::Bag::unwrappedHead const):
(WTF::Bag::end): Deleted.
(WTF::Bag::unwrappedHead): Deleted.


  Commit: 7bdff4ef3c203f0b475a1eb300e580573ab53ecc
      https://github.com/WebKit/WebKit/commit/7bdff4ef3c203f0b475a1eb300e580573ab53ecc
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M Source/ThirdParty/ChangeLog
    M Source/ThirdParty/xdgmime/src/xdgmimecache.c
    M Source/ThirdParty/xdgmime/src/xdgmimeglob.c

  Log Message:
  -----------
  Merge r233404 - Fix off-by-one error in xdg_mime_get_simple_globs
https://bugs.webkit.org/show_bug.cgi?id=186554

Reviewed by Daniel Bates.

We have an off-by-one error here in some code that was added for WebKit. (This is not an
issue with upstream xdgmime.)

No new tests. This problem is caught by TestDownloads, but only when running with ASan
enabled.

* xdgmime/src/xdgmimecache.c:
(get_simple_globs):
* xdgmime/src/xdgmimeglob.c:
(get_simple_globs):


  Commit: 1511f56603f62534603b6fc26d7ddbe63028aac5
      https://github.com/WebKit/WebKit/commit/1511f56603f62534603b6fc26d7ddbe63028aac5
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp
    M Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.h

  Log Message:
  -----------
  Merge r233193 - [GTK] Many webpages can crash the browser in WebCore::CoordinatedGraphicsLayer::transformedVisibleRect
https://bugs.webkit.org/show_bug.cgi?id=179304

Reviewed by Michael Catanzaro.

Source/WebCore:

When adding new CoordinatedGraphicsLayers to the tree, check that they have the appropriate
CompositingCoordinator. If that's not the case, set the appropriate one to the layer and its
children and set the state of those layers so they are rendered properly.

* platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
(WebCore::CoordinatedGraphicsLayer::addChild):
(WebCore::CoordinatedGraphicsLayer::addChildAtIndex):
(WebCore::CoordinatedGraphicsLayer::addChildAbove):
(WebCore::CoordinatedGraphicsLayer::addChildBelow):
(WebCore::CoordinatedGraphicsLayer::replaceChild):
(WebCore::CoordinatedGraphicsLayer::setCoordinatorIncludingSubLayersIfNeeded):
* platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.h:

Source/WebKit:

Add a way to attach to the CompositingCoordinator layers that were not created by it.

* WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp:
(WebKit::CompositingCoordinator::attachLayer):
* WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.h:


  Commit: bf88ffcc7cd916d8e72ea81251929d1a0b1826aa
      https://github.com/WebKit/WebKit/commit/bf88ffcc7cd916d8e72ea81251929d1a0b1826aa
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2018-07-31 (Tue, 31 Jul 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp

  Log Message:
  -----------
  Merge r233353 - [WPE] Some frames are dropped when using rAF to animate an element
https://bugs.webkit.org/show_bug.cgi?id=187175

Always call renderNextFrame in ThreadedCompositor::requestDisplayRefreshMonitorUpdate()
so we have to process any pending layer flush request.

Reviewed by Žan Doberšek.

* Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:
(WebKit::ThreadedCompositor::handleDisplayRefreshMonitorUpdate):


  Commit: 20a5e6916bb293f58430753c41e66badb5edf7fb
      https://github.com/WebKit/WebKit/commit/20a5e6916bb293f58430753c41e66badb5edf7fb
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-08-06 (Mon, 06 Aug 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.20.4 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.20.4.


  Commit: 612ed1e978c2de79678730edc51344e04fc4965e
      https://github.com/WebKit/WebKit/commit/612ed1e978c2de79678730edc51344e04fc4965e
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-08-06 (Mon, 06 Aug 2018)

  Changed paths:
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for 2.20.2 release.


  Commit: 212b04cd22dd7285cd19d1c167dea63d02ea8b3f
      https://github.com/WebKit/WebKit/commit/212b04cd22dd7285cd19d1c167dea63d02ea8b3f
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-08-07 (Tue, 07 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp

  Log Message:
  -----------
  [GTK] [2.20.4] Occasional rendering artifacts
https://bugs.webkit.org/show_bug.cgi?id=188377

Unreviewed manual rollout of r234420, which is causing issues on this branch.

* Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:
(WebKit::ThreadedCompositor::handleDisplayRefreshMonitorUpdate):


  Commit: 6fd4c1c61e9d63919c08c7e5f96e9a08f89f71b9
      https://github.com/WebKit/WebKit/commit/6fd4c1c61e9d63919c08c7e5f96e9a08f89f71b9
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-08-13 (Mon, 13 Aug 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.20.5 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.20.5.


Compare: https://github.com/WebKit/WebKit/compare/8428e032601b%5E...6fd4c1c61e9d


More information about the webkit-changes mailing list