[webkit-changes] [WebKit/WebKit] fc77c1: Branch WebKitGTK+ for 2.22

Adrian Perez noreply at github.com
Thu Dec 1 10:05:42 PST 2022


  Branch: refs/heads/webkitgtk/2.22
  Home:   https://github.com/WebKit/WebKit
  Commit: fc77c1dc99ea9976a15a2bb510553a61f67b9b47
      https://github.com/WebKit/WebKit/commit/fc77c1dc99ea9976a15a2bb510553a61f67b9b47
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-08-16 (Thu, 16 Aug 2018)

  Changed paths:

  Log Message:
  -----------
  Branch WebKitGTK+ for 2.22


  Commit: 3916a167cf0d4fc65e21cd942f9edb1639361ee0
      https://github.com/WebKit/WebKit/commit/3916a167cf0d4fc65e21cd942f9edb1639361ee0
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-08-16 (Thu, 16 Aug 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.21.91 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.21.91.


  Commit: ae7195ad5e4d51914546fd5c972a49ae5b5f0969
      https://github.com/WebKit/WebKit/commit/ae7195ad5e4d51914546fd5c972a49ae5b5f0969
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/OptionSet.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/geolocation/GeolocationController.cpp
    M Source/WebCore/Modules/geolocation/GeolocationController.h
    M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
    M Source/WebCore/html/canvas/WebGLRenderingContextBase.h
    M Source/WebCore/page/ActivityState.cpp
    M Source/WebCore/page/ActivityState.h
    M Source/WebCore/page/ActivityStateChangeObserver.h
    M Source/WebCore/page/FocusController.cpp
    M Source/WebCore/page/FocusController.h
    M Source/WebCore/page/Page.cpp
    M Source/WebCore/page/Page.h
    M Source/WebCore/page/PerformanceMonitor.cpp
    M Source/WebCore/page/PerformanceMonitor.h
    M Source/WebCore/testing/Internals.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/WebPageCreationParameters.h
    M Source/WebKit/UIProcess/API/C/wpe/WKAPICastWPE.h
    M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
    M Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp
    M Source/WebKit/UIProcess/API/wpe/WPEView.cpp
    M Source/WebKit/UIProcess/API/wpe/WPEView.h
    M Source/WebKit/UIProcess/Cocoa/WebViewImpl.mm
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/UIProcess/ios/WKApplicationStateTrackingView.mm
    M Source/WebKit/WebProcess/Plugins/PluginView.cpp
    M Source/WebKit/WebProcess/Plugins/PluginView.h
    M Source/WebKit/WebProcess/WebPage/AcceleratedDrawingArea.cpp
    M Source/WebKit/WebProcess/WebPage/AcceleratedDrawingArea.h
    M Source/WebKit/WebProcess/WebPage/DrawingArea.h
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.h
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.h
    M Source/WebKit/WebProcess/WebPage/WebPage.messages.in
    M Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h
    M Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Source/WebKit/WebProcess/WebProcess.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/OptionSet.cpp

  Log Message:
  -----------
  Merge r234920 - Use OptionSet for ActivityState::Flags
https://bugs.webkit.org/show_bug.cgi?id=188554

Reviewed by Brent Fulgham.

Source/WebCore:

More typesafe flags.

* Modules/geolocation/GeolocationController.cpp:
(WebCore::GeolocationController::activityStateDidChange):
* Modules/geolocation/GeolocationController.h:
* html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::activityStateDidChange):
* html/canvas/WebGLRenderingContextBase.h:
* page/ActivityState.cpp:
(WebCore::operator<<):
(WebCore::activityStateFlagsToString): Deleted.
* page/ActivityState.h:
(WebCore::ActivityState::allFlags):
* page/ActivityStateChangeObserver.h:
* page/FocusController.cpp:
(WebCore::FocusController::FocusController):
(WebCore::FocusController::setFocused):
(WebCore::FocusController::setActivityState):
(WebCore::FocusController::setActive):
* page/FocusController.h:
(WebCore::FocusController::isActive const):
(WebCore::FocusController::isFocused const):
(WebCore::FocusController::contentIsVisible const):
* page/Page.cpp:
(WebCore::pageInitialActivityState):
(WebCore::Page::Page):
(WebCore::Page::setIsInWindow):
(WebCore::Page::updateTimerThrottlingState):
(WebCore::Page::setActivityState):
(WebCore::Page::isVisibleAndActive const):
(WebCore::Page::isWindowActive const):
(WebCore::Page::setIsVisible):
* page/Page.h:
(WebCore::Page::activityState const):
(WebCore::Page::isVisible const):
(WebCore::Page::isInWindow const):
* page/PerformanceMonitor.cpp:
(WebCore::activityStateForCPUSampling):
(WebCore::PerformanceMonitor::activityStateChanged):
* page/PerformanceMonitor.h:
* platform/text/cocoa: Added.

Source/WebKit:

* Shared/WebPageCreationParameters.h:
* UIProcess/Cocoa/WebViewImpl.mm:
(WebKit::WebViewImpl::windowDidOrderOffScreen):
(WebKit::WebViewImpl::windowDidOrderOnScreen):
(WebKit::WebViewImpl::viewDidMoveToWindow):
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::updateActivityState):
(WebKit::WebPageProxy::activityStateDidChange):
(WebKit::WebPageProxy::dispatchActivityStateChange):
(WebKit::WebPageProxy::setMuted):
(WebKit::WebPageProxy::isPlayingMediaDidChange):
* UIProcess/WebPageProxy.h:
(WebKit::WebPageProxy::isInWindow const):
(WebKit::WebPageProxy::isViewVisible const):
(WebKit::WebPageProxy::isViewFocused const):
(WebKit::WebPageProxy::isViewWindowActive const):
* WebProcess/Plugins/PluginView.cpp:
(WebKit::PluginView::activityStateDidChange):
* WebProcess/Plugins/PluginView.h:
* WebProcess/WebPage/DrawingArea.h:
(WebKit::DrawingArea::activityStateDidChange):
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.h:
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm:
(WebKit::RemoteLayerTreeDrawingArea::activityStateDidChange):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::updateThrottleState):
(WebKit::WebPage::updateIsInWindow):
(WebKit::WebPage::visibilityDidChange):
(WebKit::WebPage::setActivityState):
* WebProcess/WebPage/WebPage.h:
(WebKit::WebPage::isVisible const):
(WebKit::WebPage::isVisibleOrOccluded const):
* WebProcess/WebPage/WebPage.messages.in:
* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.h:
* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
(WebKit::TiledCoreAnimationDrawingArea::activityStateDidChange):
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::pageActivityStateDidChange):
* WebProcess/WebProcess.h:

Source/WTF:

* wtf/OptionSet.h:
(WTF::OptionSet::operator^):

Add xor operator, useful for finding changes between sets.

Tools:

* TestWebKitAPI/Tests/WTF/OptionSet.cpp:
(TestWebKitAPI::TEST):


  Commit: 8c7614d6a07c554b89875940ba9ad576462d9126
      https://github.com/WebKit/WebKit/commit/8c7614d6a07c554b89875940ba9ad576462d9126
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp
    M Source/WebKit/UIProcess/API/wpe/WPEView.cpp
    M Source/WebKit/UIProcess/API/wpe/WPEView.h

  Log Message:
  -----------
  Merge r234921 - Unreviewed, WPE build fix after r234920.

* UIProcess/API/wpe/PageClientImpl.cpp:
(WebKit::PageClientImpl::isViewWindowActive):
(WebKit::PageClientImpl::isViewFocused):
(WebKit::PageClientImpl::isViewVisible):
(WebKit::PageClientImpl::isViewInWindow):
* UIProcess/API/wpe/WPEView.cpp:
(WKWPE::View::setViewState):
* UIProcess/API/wpe/WPEView.h:


  Commit: 3748be95eb434a014e18b7fdbd91dff579fa685d
      https://github.com/WebKit/WebKit/commit/3748be95eb434a014e18b7fdbd91dff579fa685d
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/Verification.cpp

  Log Message:
  -----------
  Merge r234922 - [LFC] Bail out of subtree verification when trees are out of sync.
https://bugs.webkit.org/show_bug.cgi?id=188633

Reviewed by Antti Koivisto.

There's no point of trying to match geometry when subtrees are out of sync.
They get out of sync when the render tree has unsupported boxes (see LayoutTreeBuilder).

* layout/Verification.cpp:
(WebCore::Layout::verifyAndOutputSubtree):


  Commit: 677e51da6e79ff59871b115e2c44a677b0c5aa50
      https://github.com/WebKit/WebKit/commit/677e51da6e79ff59871b115e2c44a677b0c5aa50
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/layouttree/LayoutTreeBuilder.cpp

  Log Message:
  -----------
  Merge r234923 - [LFC] Tree builder should construct block and inline containers based on the display type.
https://bugs.webkit.org/show_bug.cgi?id=188632

Reviewed by Antti Koivisto.

Inline elements can also construct RenderBlock renderers (inline-bloc etc), so use the display type instead when deciding what type of container to construct.

* layout/layouttree/LayoutTreeBuilder.cpp:
(WebCore::Layout::TreeBuilder::createSubTree):


  Commit: 3223df354982439ec73b7720d06220f15f3d41a0
      https://github.com/WebKit/WebKit/commit/3223df354982439ec73b7720d06220f15f3d41a0
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/Verification.cpp
    M Source/WebCore/layout/layouttree/LayoutBox.cpp
    M Source/WebCore/layout/layouttree/LayoutBox.h
    M Source/WebCore/layout/layouttree/LayoutTreeBuilder.cpp
    M Source/WebCore/layout/layouttree/LayoutTreeBuilder.h

  Log Message:
  -----------
  Merge r234924 - [LFC] Add showLayoutTree() that does not require LayoutContext.
https://bugs.webkit.org/show_bug.cgi?id=188631

Reviewed by Antti Koivisto.

* layout/layouttree/LayoutBox.cpp:
(WebCore::Layout::Box::formattingContextRoot const):
(WebCore::Layout::Box::initialContainingBlock const):
* layout/layouttree/LayoutBox.h:
* layout/layouttree/LayoutTreeBuilder.cpp:
(WebCore::Layout::outputLayoutTree):
(WebCore::Layout::showLayoutTree):
(WebCore::Layout::TreeBuilder::showLayoutTree): Deleted.
* layout/layouttree/LayoutTreeBuilder.h:


  Commit: efe529d1d809ee06accbd5a0f6f76fdf1e4ac0a3
      https://github.com/WebKit/WebKit/commit/efe529d1d809ee06accbd5a0f6f76fdf1e4ac0a3
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/FormattingContext.cpp
    M Source/WebCore/layout/FormattingContextGeometry.cpp
    M Source/WebCore/layout/blockformatting/BlockFormattingContextGeometry.cpp
    M Source/WebCore/layout/displaytree/DisplayBox.h

  Log Message:
  -----------
  Merge r234925 - [LFC][BFC] Display::Box interface should reflect that padding is optional.
https://bugs.webkit.org/show_bug.cgi?id=188630

Reviewed by Antti Koivisto.

Certain type of boxes can't have paddings (see Layout::Box::isPaddingApplicable).

* layout/FormattingContext.cpp:
(WebCore::Layout::FormattingContext::computeBorderAndPadding const):
(WebCore::Layout::FormattingContext::validateGeometryConstraintsAfterLayout const):
* layout/FormattingContextGeometry.cpp:
(WebCore::Layout::FormattingContext::Geometry::outOfFlowNonReplacedVerticalGeometry):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowNonReplacedHorizontalGeometry):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowReplacedVerticalGeometry):
(WebCore::Layout::FormattingContext::Geometry::outOfFlowReplacedHorizontalGeometry):
* layout/blockformatting/BlockFormattingContextGeometry.cpp:
(WebCore::Layout::BlockFormattingContext::Geometry::inFlowNonReplacedHeightAndMargin):
(WebCore::Layout::BlockFormattingContext::Geometry::inFlowNonReplacedWidthAndMargin):
* layout/displaytree/DisplayBox.h:
(WebCore::Display::Box::width const):
(WebCore::Display::Box::height const):
(WebCore::Display::Box::contentBoxTop const):
(WebCore::Display::Box::contentBoxLeft const):
(WebCore::Display::Box::setPadding):
(WebCore::Display::Box::paddingTop const):
(WebCore::Display::Box::paddingLeft const):
(WebCore::Display::Box::paddingBottom const):
(WebCore::Display::Box::paddingRight const):


  Commit: 709c876eb3b2ec4b0d6bdf2769fef4a47463a42c
      https://github.com/WebKit/WebKit/commit/709c876eb3b2ec4b0d6bdf2769fef4a47463a42c
  Author: Piotr Drąg <piotrdrag at gmail.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/pl.po

  Log Message:
  -----------
  Merge r234926 - [l10n] Updated Polish translation of WebKitGTK+ for 2.22
https://bugs.webkit.org/show_bug.cgi?id=188652

Patch by Piotr Drąg <piotrdrag at gmail.com> on 2018-08-16
Rubber-stamped by Michael Catanzaro.

* pl.po:


  Commit: 667363ca4647d9ff61a914d526e0ff67519f8e45
      https://github.com/WebKit/WebKit/commit/667363ca4647d9ff61a914d526e0ff67519f8e45
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.cpp
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.h
    M Source/WebCore/layout/blockformatting/BlockMarginCollapse.cpp
    M Source/WebCore/layout/displaytree/DisplayBox.cpp
    M Source/WebCore/layout/displaytree/DisplayBox.h

  Log Message:
  -----------
  Merge r234927 - [lFC][Floating] Add estimated margin top computation.
https://bugs.webkit.org/show_bug.cgi?id=188619

Reviewed by Antti Koivisto.

In order to figure out whether a box should avoid a float, we need to know the final positions of both (ignore relative positioning for now).
In block formatting context the final position for a normal flow box includes
1. the static position and
2. the corresponding (non)collapsed margins.
Now the vertical margins are computed when all the descendants are finalized, because the margin values might be depending on the height of the box
(and the height might be based on the content).
So when we get to the point where we intersect the box with the float to decide if the box needs to move, we don't yet have the final vertical position.

The idea here is that as long as we don't cross the block formatting context boundary, we should be able to pre-compute the final top margin.
(if this holds true for all the cases, the estimated prefix could be removed and just use marginTop() instead.)

Covered by existing block-only tests.

* layout/blockformatting/BlockFormattingContext.cpp:
(WebCore::Layout::BlockFormattingContext::layout const):
(WebCore::Layout::BlockFormattingContext::computeEstimatedMarginTop const):
(WebCore::Layout::BlockFormattingContext::computeEstimatedMarginTopForAncestors const):
(WebCore::Layout::BlockFormattingContext::computeFloatingPosition const):
(WebCore::Layout::BlockFormattingContext::computeVerticalPositionForFloatClear const):
(WebCore::Layout::BlockFormattingContext::computeInFlowHeightAndMargin const):
* layout/blockformatting/BlockFormattingContext.h:
* layout/blockformatting/BlockMarginCollapse.cpp:
(WebCore::Layout::BlockFormattingContext::MarginCollapse::estimatedMarginTop):
* layout/displaytree/DisplayBox.cpp:
(WebCore::Display::Box::Box):
* layout/displaytree/DisplayBox.h:
(WebCore::Display::Box::setHasValidTop):
(WebCore::Display::Box::setHasValidLeft):
(WebCore::Display::Box::top const):
(WebCore::Display::Box::left const):
(WebCore::Display::Box::topLeft const):
(WebCore::Display::Box::setTopLeft):
(WebCore::Display::Box::setTop):
(WebCore::Display::Box::setLeft):
(WebCore::Display::Box::setVerticalMargin):
(WebCore::Display::Box::setEstimatedMarginTop):
(WebCore::Display::Box::estimatedMarginTop const):


  Commit: d981a02d1c0cdcf38278e1639f044daaaeb08b2a
      https://github.com/WebKit/WebKit/commit/d981a02d1c0cdcf38278e1639f044daaaeb08b2a
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/wpe/TestExpectations
    A LayoutTests/platform/wpe/fast/box-shadow/basic-shadows-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/border-radius-big-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/box-shadow-radius-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/box-shadow-transformed-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/hidpi-webkit-box-shadow-subpixel-position-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/inset-box-shadow-radius-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/inset-box-shadows-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/inset-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/scaled-box-shadow-expected.txt
    A LayoutTests/platform/wpe/fast/box-shadow/transform-fringing-expected.txt
    A LayoutTests/platform/wpe/fast/box-sizing/box-sizing-expected.txt
    A LayoutTests/platform/wpe/fast/box-sizing/panels-one-expected.txt
    A LayoutTests/platform/wpe/fast/box-sizing/panels-two-expected.txt
    A LayoutTests/platform/wpe/fast/box-sizing/percentage-height-expected.txt
    A LayoutTests/platform/wpe/fast/clip/001-expected.txt
    A LayoutTests/platform/wpe/fast/clip/002-expected.txt
    A LayoutTests/platform/wpe/fast/clip/003-expected.txt
    A LayoutTests/platform/wpe/fast/clip/004-expected.txt
    A LayoutTests/platform/wpe/fast/clip/005-expected.txt
    A LayoutTests/platform/wpe/fast/clip/006-expected.txt
    A LayoutTests/platform/wpe/fast/clip/007-expected.txt
    A LayoutTests/platform/wpe/fast/clip/008-expected.txt
    A LayoutTests/platform/wpe/fast/clip/009-expected.txt
    A LayoutTests/platform/wpe/fast/clip/010-expected.txt
    A LayoutTests/platform/wpe/fast/clip/011-expected.txt
    A LayoutTests/platform/wpe/fast/clip/012-expected.txt
    A LayoutTests/platform/wpe/fast/clip/013-expected.txt
    A LayoutTests/platform/wpe/fast/clip/014-expected.txt
    A LayoutTests/platform/wpe/fast/clip/015-expected.txt
    A LayoutTests/platform/wpe/fast/clip/016-expected.txt
    A LayoutTests/platform/wpe/fast/clip/nestedTransparencyClip-expected.txt
    A LayoutTests/platform/wpe/fast/clip/outline-overflowClip-expected.txt
    A LayoutTests/platform/wpe/fast/clip/overflow-border-radius-clip-expected.txt
    A LayoutTests/platform/wpe/fast/clip/overflow-border-radius-combinations-expected.txt
    A LayoutTests/platform/wpe/fast/clip/overflow-border-radius-composited-expected.txt
    A LayoutTests/platform/wpe/fast/clip/overflow-border-radius-fixed-position-expected.txt
    A LayoutTests/platform/wpe/fast/clip/overflow-border-radius-transformed-expected.txt
    A LayoutTests/platform/wpe/fast/compact/001-expected.txt
    A LayoutTests/platform/wpe/fast/compact/002-expected.txt
    A LayoutTests/platform/wpe/fast/compact/003-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/001-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/002-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/003-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/004-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/005-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/007-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/008-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/009-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/010-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/011-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/012-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/013-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/014-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/015-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/016-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/after-duplicated-after-split-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/after-order-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/before-with-first-letter-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/beforeAfter-interdocument-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/details-summary-before-after-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/first-letter-in-nested-before-table-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/hover-style-change-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/initial-letter-basic-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/initial-letter-border-padding-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/initial-letter-clearance-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/initial-letter-descender-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/initial-letter-raised-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/initial-letter-sunken-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/inline-display-types-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/nested-tables-with-before-after-content-crash-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/no-openclose-quote-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-before-after-child-add-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-cell-before-after-child-add-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-cell-before-content-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-row-before-after-child-add-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-row-before-after-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-row-group-to-inline-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-row-group-with-before-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-row-with-before-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-table-before-after-child-add-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/table-with-before-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/visibleContentHiddenParent-expected.txt
    A LayoutTests/platform/wpe/fast/css-generated-content/wbr-with-before-content-expected.txt
    A LayoutTests/platform/wpe/fast/doctypes/001-expected.txt
    A LayoutTests/platform/wpe/fast/doctypes/002-expected.txt
    A LayoutTests/platform/wpe/fast/doctypes/003-expected.txt
    A LayoutTests/platform/wpe/fast/doctypes/004-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/001-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/002-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/003-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/004-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/005-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/006-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/007-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/008-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/009-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/010-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/011-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/012-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/013-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/014-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/015-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/016-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/017-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/018-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/019-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/020-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/021-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/022-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/023-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/024-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/025-expected.txt
    A LayoutTests/platform/wpe/fast/flexbox/026-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/001-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/002-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/003-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/006-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/14498-positionForCoordinates-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/contenteditable-baseline-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/inline-block-vertical-align-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/overflow-clip-expected.txt
    A LayoutTests/platform/wpe/fast/inline-block/tricky-baseline-expected.txt
    A LayoutTests/platform/wpe/fast/inline/001-expected.txt
    A LayoutTests/platform/wpe/fast/inline/002-expected.txt
    A LayoutTests/platform/wpe/fast/inline/25277-2-expected.txt
    A LayoutTests/platform/wpe/fast/inline/25277-expected.txt
    A LayoutTests/platform/wpe/fast/inline/absolute-positioned-inline-in-centred-block-expected.txt
    A LayoutTests/platform/wpe/fast/inline/br-text-decoration-expected.txt
    A LayoutTests/platform/wpe/fast/inline/continuation-outlines-expected.txt
    A LayoutTests/platform/wpe/fast/inline/continuation-outlines-with-layers-2-expected.txt
    A LayoutTests/platform/wpe/fast/inline/continuation-outlines-with-layers-expected.txt
    A LayoutTests/platform/wpe/fast/inline/drawStyledEmptyInlines-expected.txt
    A LayoutTests/platform/wpe/fast/inline/drawStyledEmptyInlinesWithWS-expected.txt
    A LayoutTests/platform/wpe/fast/inline/emptyInlinesWithinLists-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-borders-with-bidi-override-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-box-background-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-box-background-long-image-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-box-background-repeat-x-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-box-background-repeat-y-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-continuation-borders-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-focus-ring-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-padding-disables-text-quirk-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-text-quirk-bpm-expected.txt
    A LayoutTests/platform/wpe/fast/inline/inline-wrap-with-parent-padding-expected.txt
    A LayoutTests/platform/wpe/fast/inline/justify-emphasis-inline-box-expected.txt
    A LayoutTests/platform/wpe/fast/inline/left-right-center-inline-alignment-in-ltr-and-rtl-blocks-expected.txt
    A LayoutTests/platform/wpe/fast/inline/long-wrapped-line-expected.txt
    A LayoutTests/platform/wpe/fast/inline/nested-top-alignment-expected.txt
    A LayoutTests/platform/wpe/fast/inline/outline-continuations-expected.txt
    A LayoutTests/platform/wpe/fast/inline/percentage-margins-expected.txt
    A LayoutTests/platform/wpe/fast/inline/positioned-object-between-replaced-elements-expected.txt
    A LayoutTests/platform/wpe/fast/inline/positionedLifetime-expected.txt
    A LayoutTests/platform/wpe/fast/inline/styledEmptyInlinesWithBRs-expected.txt
    A LayoutTests/platform/wpe/fast/inline/vertical-align-text-bottom-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/001-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/002-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/003-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/004-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/005-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/006-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/007-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/008-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/009-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/010-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/011-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/012-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/013-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/014-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/016-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/017-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/018-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/019-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/020-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/021-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/junk-data-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/missing-address-end-tag-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/missing-dl-end-tag-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/missing-dt-end-tag-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/missing-end-tag-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/missing-font-end-tag-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/nestedh3s-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/table-inside-stray-table-content-expected.txt
    A LayoutTests/platform/wpe/fast/invalid/td-inside-object-expected.txt
    A LayoutTests/platform/wpe/fast/line-grid/line-align-left-edges-expected.txt
    A LayoutTests/platform/wpe/fast/line-grid/line-align-right-edges-expected.txt
    A LayoutTests/platform/wpe/fast/line-grid/line-grid-contains-value-expected.txt
    A LayoutTests/platform/wpe/fast/line-grid/line-grid-floating-expected.txt
    A LayoutTests/platform/wpe/fast/line-grid/line-grid-inside-columns-expected.txt
    A LayoutTests/platform/wpe/fast/line-grid/line-grid-into-columns-expected.txt
    A LayoutTests/platform/wpe/fast/line-grid/line-grid-into-floats-expected.txt
    A LayoutTests/platform/wpe/fast/line-grid/line-grid-positioned-expected.txt
    A LayoutTests/platform/wpe/fast/lists/001-expected.txt
    A LayoutTests/platform/wpe/fast/lists/001-vertical-expected.txt
    A LayoutTests/platform/wpe/fast/lists/002-expected.txt
    A LayoutTests/platform/wpe/fast/lists/002-vertical-expected.txt
    A LayoutTests/platform/wpe/fast/lists/003-expected.txt
    A LayoutTests/platform/wpe/fast/lists/003-vertical-expected.txt
    A LayoutTests/platform/wpe/fast/lists/004-expected.txt
    A LayoutTests/platform/wpe/fast/lists/005-expected.txt
    A LayoutTests/platform/wpe/fast/lists/005-vertical-expected.txt
    A LayoutTests/platform/wpe/fast/lists/006-expected.txt
    A LayoutTests/platform/wpe/fast/lists/006-vertical-expected.txt
    A LayoutTests/platform/wpe/fast/lists/007-expected.txt
    A LayoutTests/platform/wpe/fast/lists/007-vertical-expected.txt
    A LayoutTests/platform/wpe/fast/lists/008-expected.txt
    A LayoutTests/platform/wpe/fast/lists/008-vertical-expected.txt
    A LayoutTests/platform/wpe/fast/lists/009-expected.txt
    A LayoutTests/platform/wpe/fast/lists/009-vertical-expected.txt
    A LayoutTests/platform/wpe/fast/lists/anonymous-items-expected.txt
    A LayoutTests/platform/wpe/fast/lists/big-list-marker-expected.txt
    A LayoutTests/platform/wpe/fast/lists/drag-into-marker-expected.txt
    A LayoutTests/platform/wpe/fast/lists/dynamic-marker-crash-expected.txt
    A LayoutTests/platform/wpe/fast/lists/inlineBoxWrapperNullCheck-expected.txt
    A LayoutTests/platform/wpe/fast/lists/li-br-expected.txt
    A LayoutTests/platform/wpe/fast/lists/li-style-alpha-huge-value-crash-expected.txt
    A LayoutTests/platform/wpe/fast/lists/list-item-line-height-expected.txt
    A LayoutTests/platform/wpe/fast/lists/list-marker-with-line-height-expected.txt
    A LayoutTests/platform/wpe/fast/lists/list-style-none-crash-expected.txt
    A LayoutTests/platform/wpe/fast/lists/marker-before-empty-inline-expected.txt
    A LayoutTests/platform/wpe/fast/lists/marker-image-error-expected.txt
    A LayoutTests/platform/wpe/fast/lists/markers-in-selection-expected.txt
    A LayoutTests/platform/wpe/fast/lists/numeric-markers-outside-list-expected.txt
    A LayoutTests/platform/wpe/fast/lists/ol-display-types-expected.txt
    A LayoutTests/platform/wpe/fast/lists/ol-start-dynamic-expected.txt
    A LayoutTests/platform/wpe/fast/lists/ol-start-parsing-expected.txt
    A LayoutTests/platform/wpe/fast/lists/olstart-expected.txt
    A LayoutTests/platform/wpe/fast/lists/ordered-list-with-no-ol-tag-expected.txt
    A LayoutTests/platform/wpe/fast/lists/scrolled-marker-paint-expected.txt
    A LayoutTests/platform/wpe/fast/loader/text-document-wrapping-expected.txt
    A LayoutTests/platform/wpe/fast/preloader/document-write-expected.txt
    A LayoutTests/platform/wpe/fast/preloader/script-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/001-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/002-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/003-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/004-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/005-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/006-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/007-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/008-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/absolute-image-sizing-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/absolute-position-percentage-height-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/absolute-position-percentage-width-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/absolute-position-with-auto-height-and-top-and-bottom-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/absolute-position-with-auto-width-and-left-and-right-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/applet-display-none-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/border-radius-clip-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/embed-display-none-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/image-onload-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/image-resize-width-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/image-sizing-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/image-solid-color-with-alpha-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/inline-box-wrapper-handover-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/max-width-percent-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/maxheight-percent-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/maxheight-pxs-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/maxwidth-percent-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/maxwidth-pxs-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/minheight-percent-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/minheight-pxs-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/minwidth-percent-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/minwidth-pxs-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/object-align-hspace-vspace-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/object-display-none-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/percent-height-in-anonymous-block-in-table-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/percent-height-in-anonymous-block-widget-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/replaced-breaking-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/replaced-breaking-mixture-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/replaced-child-of-absolute-with-auto-height-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/selection-rect-in-table-cell-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/selection-rect-transform-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/table-percent-height-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/three-selects-break-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/vertical-lr/absolute-position-percentage-width-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/vertical-lr/absolute-position-with-auto-height-and-top-and-bottom-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/vertical-lr/absolute-position-with-auto-width-and-left-and-right-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/vertical-rl/absolute-position-percentage-width-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/vertical-rl/absolute-position-with-auto-height-and-top-and-bottom-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/vertical-rl/absolute-position-with-auto-width-and-left-and-right-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/width100percent-button-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/width100percent-checkbox-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/width100percent-image-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/width100percent-menulist-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/width100percent-radio-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/width100percent-searchfield-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/width100percent-textarea-expected.txt
    A LayoutTests/platform/wpe/fast/replaced/width100percent-textfield-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/base-shorter-than-text-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/bopomofo-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/bopomofo-letter-spacing-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/bopomofo-rl-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/nested-ruby-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-base-merge-block-children-crash-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-beforeafter-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-empty-rt-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-inline-table-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-length-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-run-break-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-runs-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-runs-spans-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-simple-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-simple-rp-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-text-before-after-content-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/ruby-trailing-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/rubyDOM-insert-rt-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/rubyDOM-insert-text1-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/rubyDOM-insert-text2-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/rubyDOM-insert-text3-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/rubyDOM-remove-rt1-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/rubyDOM-remove-rt2-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/rubyDOM-remove-text1-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/rubyDOM-remove-text2-expected.txt
    A LayoutTests/platform/wpe/fast/ruby/select-ruby-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/Kusa-Makura-background-canvas-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/background-horizontal-bt-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/background-vertical-lr-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/background-vertical-rl-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/basic-vertical-line-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/border-image-horizontal-bt-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/border-image-vertical-lr-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/border-image-vertical-rl-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/border-radius-clipping-vertical-lr-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/border-styles-vertical-lr-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/border-styles-vertical-rl-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/border-vertical-lr-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/box-shadow-horizontal-bt-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/box-shadow-vertical-lr-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/box-shadow-vertical-rl-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/broken-ideograph-small-caps-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/broken-ideographic-font-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/english-bt-text-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/english-lr-text-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/english-rl-text-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/fallback-orientation-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/fieldsets-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/horizontal-bt-replaced-selection-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/japanese-lr-selection-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/japanese-lr-text-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/japanese-rl-selection-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/japanese-rl-text-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/japanese-rl-text-with-broken-font-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/japanese-ruby-horizontal-bt-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/japanese-ruby-vertical-lr-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/japanese-ruby-vertical-rl-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/text-orientation-basic-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/vertical-align-table-baseline-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/vertical-baseline-alignment-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/vertical-font-fallback-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/vertical-lr-replaced-selection-expected.txt
    A LayoutTests/platform/wpe/fast/writing-mode/vertical-rl-replaced-selection-expected.txt

  Log Message:
  -----------
  Merge r234931 - Unreviewed WPE gardening. Enable a few subdirectories under fast/ and
provide platform-specific baselines as well as failure expectations
where required.

* platform/wpe/TestExpectations:
* platform/wpe/fast/box-shadow: Added 10 baselines.
* platform/wpe/fast/box-sizing: Added 4 baselines.
* platform/wpe/fast/clip: Added 23 baselines.
* platform/wpe/fast/compact: Added 3 baselines.
* platform/wpe/fast/css-generated-content: Added 43 baselines.
* platform/wpe/fast/doctypes: Added 4 baselines.
* platform/wpe/fast/flexbox: Added 26 baselines.
* platform/wpe/fast/inline: Added 32 baselines.
* platform/wpe/fast/inline-block: Added 9 baselines.
* platform/wpe/fast/invalid: Added 29 baselines.
* platform/wpe/fast/line-grid: Added 8 baselines.
* platform/wpe/fast/lists: Added 27 baselines.
* platform/wpe/fast/loader: Added 1 baseline.
* platform/wpe/fast/preloader: Added 2 baselines.
* platform/wpe/fast/replaced: Added 57 baselines.
* platform/wpe/fast/ruby: Added 26 baselines.
* platform/wpe/fast/writing-mode: Added 37 baselines.


  Commit: 5de74295d231f08f10a6285c807b3c746cbb80f4
      https://github.com/WebKit/WebKit/commit/5de74295d231f08f10a6285c807b3c746cbb80f4
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/TextureMapper.cmake
    A Source/WebCore/platform/graphics/nicosia/texmap/NicosiaImageBackingTextureMapperImpl.cpp
    A Source/WebCore/platform/graphics/nicosia/texmap/NicosiaImageBackingTextureMapperImpl.h

  Log Message:
  -----------
  Merge r234932 - [Nicosia] Add Nicosia::ImageBackingTextureMapperImpl
https://bugs.webkit.org/show_bug.cgi?id=188550

Reviewed by Carlos Garcia Campos.

Add the Nicosia::ImageBackingTextureMapperImpl class, the
TextureMapper-specific implementation that will extend the ImageBacking
class.

This class will be used to contain and manage updates for layers that
are backed by image objects. The CoordinatedGraphicsLayer instance will
use the LayerState object to track the currently-presented image objects
and to store the latest update of these objects. The Update struct
contains information about the current visibility of the image in the
layer tree as well as the Nicosia::Buffer object containing the painted
image data that's to be presented on the screen.

During the layer flush the flushUpdate() method will move the current
update data into the pending position, from which this data will be
gathered by the composition component through the takeUpdate() method
and used to update the CoordinatedBackingStore object that's kept in
the CompositionState object on this impl class.

This will be deployed for use in the CoordinatedGraphicsLayer at a later
stage as it requires a larger rework in both CoordinatedGraphicsLayer as
well as the CoordinatedGraphicsScene classes.

The implementation itself differs from the current image backing support
in CoordinatedGraphicsLayer and CompositingCoordinator by abandoning the
idea of sharing single image backings between layers that might be
backed by identical Image objects. We thus end up trading any memory
consumption benefit in these scenarios for a much simplified
implementation. Overall this area needs more research both in figuring
out whether there's worthy improvements in grouping image backings, as
well as investigating whether it's possible to avoid additional image
rasterization by just leveraging direct pixel data via the
NativeImagePtr object.

* platform/TextureMapper.cmake:
* platform/graphics/nicosia/texmap/NicosiaImageBackingTextureMapperImpl.cpp: Added.
(Nicosia::ImageBackingTextureMapperImpl::createFactory):
(Nicosia::ImageBackingTextureMapperImpl::flushUpdate):
(Nicosia::ImageBackingTextureMapperImpl::takeUpdate):
* platform/graphics/nicosia/texmap/NicosiaImageBackingTextureMapperImpl.h: Added.


  Commit: 174520c678ff68e1273cd256fc23443a91cdb10e
      https://github.com/WebKit/WebKit/commit/174520c678ff68e1273cd256fc23443a91cdb10e
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/Downloads/PendingDownload.cpp
    M Source/WebKit/NetworkProcess/Downloads/PendingDownload.h
    M Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp
    M Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.h
    M Source/WebKit/NetworkProcess/NetworkLoad.cpp
    M Source/WebKit/NetworkProcess/NetworkLoad.h
    M Source/WebKit/NetworkProcess/NetworkLoadClient.h
    M Source/WebKit/NetworkProcess/NetworkProcess.cpp
    M Source/WebKit/NetworkProcess/NetworkProcess.h
    M Source/WebKit/NetworkProcess/NetworkProcess.messages.in
    M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
    M Source/WebKit/NetworkProcess/NetworkResourceLoader.h
    M Source/WebKit/NetworkProcess/PreconnectTask.cpp
    M Source/WebKit/NetworkProcess/PreconnectTask.h
    M Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp
    M Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoad.h
    M Source/WebKit/Shared/Authentication/AuthenticationManager.cpp
    M Source/WebKit/Shared/Authentication/AuthenticationManager.h
    M Source/WebKit/UIProcess/API/C/WKPage.cpp
    M Source/WebKit/UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h
    M Source/WebKit/UIProcess/Cocoa/NavigationState.h
    M Source/WebKit/UIProcess/Cocoa/NavigationState.mm
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h

  Log Message:
  -----------
  Merge r234941 - Stop using canAuthenticateAgainstProtectionSpace in modern WebKit
https://bugs.webkit.org/show_bug.cgi?id=188639

Reviewed by Youenn Fablet.

canAuthenticateAgainstProtectionSpace is an unnecessary step in the authentication process.
It is leftover from when it was necessary when we used NSURLConnection, which is only used in WebKitLegacy now.
Now it's just an extra IPC roundtrip asking if we should use NSURLSessionAuthChallengeRejectProtectionSpace
or if we are going to ask the API client.  We can move this step into the C API for compatibility
with the 1 client that still uses it (not for long, see rdar://problem/43358403) and simplify and optimize
authentication.

* NetworkProcess/Downloads/PendingDownload.cpp:
(WebKit::PendingDownload::canAuthenticateAgainstProtectionSpaceAsync): Deleted.
* NetworkProcess/Downloads/PendingDownload.h:
* NetworkProcess/NetworkCORSPreflightChecker.cpp:
(WebKit::NetworkCORSPreflightChecker::didReceiveChallenge):
* NetworkProcess/NetworkLoad.cpp:
(WebKit::NetworkLoad::~NetworkLoad):
(WebKit::NetworkLoad::didReceiveChallenge):
(WebKit::NetworkLoad::completeAuthenticationChallenge): Deleted.
(WebKit::NetworkLoad::continueCanAuthenticateAgainstProtectionSpace): Deleted.
* NetworkProcess/NetworkLoad.h:
* NetworkProcess/NetworkLoadClient.h:
* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::cancelDownload):
(WebKit::NetworkProcess::canAuthenticateAgainstProtectionSpace): Deleted.
(WebKit::NetworkProcess::continueCanAuthenticateAgainstProtectionSpace): Deleted.
* NetworkProcess/NetworkProcess.h:
* NetworkProcess/NetworkProcess.messages.in:
* NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::canAuthenticateAgainstProtectionSpaceAsync): Deleted.
* NetworkProcess/NetworkResourceLoader.h:
* NetworkProcess/PreconnectTask.cpp:
(WebKit::PreconnectTask::canAuthenticateAgainstProtectionSpaceAsync): Deleted.
* NetworkProcess/PreconnectTask.h:
* NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:
(WebKit::NetworkCache::SpeculativeLoad::canAuthenticateAgainstProtectionSpaceAsync): Deleted.
* NetworkProcess/cache/NetworkCacheSpeculativeLoad.h:
* Shared/Authentication/AuthenticationManager.cpp:
(WebKit::AuthenticationManager::didReceiveAuthenticationChallenge):
* Shared/Authentication/AuthenticationManager.h:
* UIProcess/API/C/WKPage.cpp:
(WKPageSetPageNavigationClient):
* UIProcess/API/Cocoa/WKNavigationDelegatePrivate.h:
* UIProcess/Cocoa/NavigationState.h:
* UIProcess/Cocoa/NavigationState.mm:
(WebKit::NavigationState::setNavigationDelegate):
(WebKit::NavigationState::NavigationClient::didReceiveAuthenticationChallenge):
(WebKit::NavigationState::NavigationClient::canAuthenticateAgainstProtectionSpace): Deleted.
* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::canAuthenticateAgainstProtectionSpace): Deleted.
* UIProcess/Network/NetworkProcessProxy.h:
* UIProcess/Network/NetworkProcessProxy.messages.in:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::canAuthenticateAgainstProtectionSpace): Deleted.
* UIProcess/WebPageProxy.h:


  Commit: 56d5c1f965b54f7781567f32bfd50229e9511ae0
      https://github.com/WebKit/WebKit/commit/56d5c1f965b54f7781567f32bfd50229e9511ae0
  Author: Alex Christensen <achristensen at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/text/WTFString.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/contentextensions/ContentExtensionCompiler.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/Vector.cpp

  Log Message:
  -----------
  Merge r234943 - Re-introduce assertion removed in r234890
https://bugs.webkit.org/show_bug.cgi?id=188611

Patch by Alex Christensen <achristensen at webkit.org> on 2018-08-16
Reviewed by Geoffrey Garen.

Source/WebCore:

The assertion was failing because Vector<String>::operator== was using memcmp,
which failed to consider different instances of equal Strings equal.  Added an
API test and this assertion, which now succeeds.

* contentextensions/ContentExtensionCompiler.cpp:
(WebCore::ContentExtensions::compileRuleList):

Source/WTF:

* wtf/text/WTFString.h:

Tools:

* TestWebKitAPI/Tests/WTF/Vector.cpp:
(TestWebKitAPI::TEST):


  Commit: 80ed8ec4a26258026a6a2d5406d5b71a506ffa19
      https://github.com/WebKit/WebKit/commit/80ed8ec4a26258026a6a2d5406d5b71a506ffa19
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/custom-elements/perform-microtask-checkpoint-before-construction-expected.txt
    A LayoutTests/fast/custom-elements/perform-microtask-checkpoint-before-construction.html
    M LayoutTests/fast/dom/MutationObserver/parser-mutations.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/html/parser/HTMLDocumentParser.cpp

  Log Message:
  -----------
  Merge r234944 - Perform a microtask checkpoint before creating a custom element
https://bugs.webkit.org/show_bug.cgi?id=188189
<rdar://problem/42843022>

Reviewed by Geoffrey Garen.

Source/WebCore:

Fixed the bug that the HTML parser was not performing a microtask checkpoint prior to synchronously constructing
a custom element in the concept to create an element for a token:
https://html.spec.whatwg.org/multipage/parsing.html#creating-and-inserting-nodes:perform-a-microtask-checkpoint

Also added a microtask checkpoint before dispatching DOMContentLoaded to work around webkit.org/b/82931 since
scheduling a task to fire a DOMContentLoaded event in Document::finishedParsing as the HTML5 spec mandates
is a long standing bug with a lot of implications, which is completely outside the scope of this bug fix:
https://html.spec.whatwg.org/multipage/parsing.html#stop-parsing

Test: fast/custom-elements/perform-microtask-checkpoint-before-construction.html

* dom/Document.cpp:
(WebCore::Document::finishedParsing): Perform a microtask checkpoint before dispatching DOMContentLoaded here as
a workaround for webkit.org/b/82931.
* html/parser/HTMLDocumentParser.cpp:
(WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder): Perform a microtask checkpoint here to fix the bug.

LayoutTests:

Added a W3C style testharness.js test for perfoming microtask checkpoint before constructing
a custom element synchronously.

* fast/custom-elements/perform-microtask-checkpoint-before-construction-expected.txt: Added.
* fast/custom-elements/perform-microtask-checkpoint-before-construction.html: Added.
* fast/dom/MutationObserver/parser-mutations.html: Fixed the test per new behavior in Document::finishParsing.
Because iframe loads synchronously and fires DOMContentLoaded, mutation records are now delivered twice after
iframe element is encountered in this test and before script element executes. Concatenate the mutation records
arrays to account for this behavioral change. New WebKit behavior matches that of Chrome; namely this test
fails both on Chrome Canary 70 and trunk WebKit with this patch without this fix.


  Commit: 4357c8f5fb387972771bbe0b341f40ba499dfd4f
      https://github.com/WebKit/WebKit/commit/4357c8f5fb387972771bbe0b341f40ba499dfd4f
  Author: Joseph Pecoraro <pecoraro at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/inspector/worker/debugger-pause.html
    A LayoutTests/inspector/worker/resources/worker-utilities.js
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Protocol/Target.js

  Log Message:
  -----------
  Merge r234945 - LayoutTest inspector/worker/debugger-pause.html sometimes times out
https://bugs.webkit.org/show_bug.cgi?id=188580

Patch by Joseph Pecoraro <pecoraro at apple.com> on 2018-08-16
Reviewed by Matt Baker.

Source/WebInspectorUI:

* UserInterface/Protocol/Target.js:
(WI.Target.prototype.get mainResource):
(WI.Target.prototype.set mainResource):
Dispatch an event when the Main Resource is set.

LayoutTests:

* inspector/worker/debugger-pause.html:
* inspector/worker/resources/worker-utilities.js: Added.
(TestPage.registerInitializer.window.awaitTargetMainResource):
(TestPage.registerInitializer):
Use a more deterministic wait for the main resource.


  Commit: a1aab89fae8a26b466d2d9942ddbafb5ea06030c
      https://github.com/WebKit/WebKit/commit/a1aab89fae8a26b466d2d9942ddbafb5ea06030c
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/custom-elements/defined-update-style-expected.html
    A LayoutTests/fast/custom-elements/defined-update-style.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/custom-elements/pseudo-class-defined-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Element.cpp

  Log Message:
  -----------
  Merge r234953 - Custom element doesn't invalidate its style when :defined rule starts to apply
https://bugs.webkit.org/show_bug.cgi?id=188637

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Rebaselined the test now that all relevant test cases pass. The only remaining test failures
are for customized builtins which we do not and shall not implement.

* web-platform-tests/custom-elements/pseudo-class-defined-expected.txt:

Source/WebCore:

Fixed the bug by invalidating the subtree when a custom element gets defined.

Test: fast/custom-elements/defined-update-style.html

* dom/Element.cpp:
(WebCore::Element::setIsDefinedCustomElement):

LayoutTests:

Added a regression test.

* fast/custom-elements/defined-update-style-expected.html: Added.
* fast/custom-elements/defined-update-style.html: Added.


  Commit: a690ba7c33ebb4b0271855a0ff68cc8dbc16a4f6
      https://github.com/WebKit/WebKit/commit/a690ba7c33ebb4b0271855a0ff68cc8dbc16a4f6
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/C/WKPage.cpp
    M Source/WebKit/UIProcess/API/Cocoa/WKBrowsingContextController.mm
    M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
    M Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.h
    M Source/WebKit/WebProcess/WebPage/WebPage.messages.in

  Log Message:
  -----------
  Merge r234954 - Consolidate data/string API loading paths
https://bugs.webkit.org/show_bug.cgi?id=188417

Reviewed by Michael Catanzaro.

loadHTMLString and loadData are basically duplicate code.
loadPlainTextString was also basically the same except it didn't set up a navigation, which
was almost certainly a bug, but nobody uses it in all of Apple and Debian.  We should probably deprecate
and remove it, but for now I make it use the same data loading path.

* UIProcess/API/C/WKPage.cpp:
(WKPageLoadData):
(WKPageLoadDataWithUserData):
(loadString):
(WKPageLoadHTMLString):
(WKPageLoadHTMLStringWithUserData):
(WKPageLoadPlainTextString):
(WKPageLoadPlainTextStringWithUserData):
* UIProcess/API/Cocoa/WKBrowsingContextController.mm:
(-[WKBrowsingContextController loadHTMLString:baseURL:userData:]):
(-[WKBrowsingContextController loadData:MIMEType:textEncodingName:baseURL:userData:]):
* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView loadData:MIMEType:characterEncodingName:baseURL:]):
(-[WKWebView _loadData:MIMEType:characterEncodingName:baseURL:userData:]):
* UIProcess/API/glib/WebKitWebView.cpp:
(webkit_web_view_load_html):
(webkit_web_view_load_plain_text):
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::loadData):
(WebKit::WebPageProxy::loadHTMLString): Deleted.
(WebKit::WebPageProxy::loadPlainTextString): Deleted.
* UIProcess/WebPageProxy.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::loadData):
(WebKit::WebPage::loadString): Deleted.
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:


  Commit: 93173f022313a110c7382de2236d100f9d34d847
      https://github.com/WebKit/WebKit/commit/93173f022313a110c7382de2236d100f9d34d847
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/JSHTMLElementCustom.cpp

  Log Message:
  -----------
  Merge r234957 - Custom element constructor doesn't use HTMLElement in new.target's realm
https://bugs.webkit.org/show_bug.cgi?id=188634

Reviewed by Keith Miller.

LayoutTests/imported/w3c:

Rebaselined the test now that all relevant test cases pass. All remaining test failures are
for customized builtin, which we do not and shall not implement.

* web-platform-tests/custom-elements/htmlconstructor/newtarget-expected.txt:

Source/WebCore:

Fixed the bug that HTMLElement's constructor was constructing an element of its own realm
instead of the realm of new.target. This results in the JS wrapper created for the element
belonging to the global object of the HTMLElement constructor which was invoked instead of
the global object of new.target as specified in:
https://html.spec.whatwg.org/multipage/dom.html#html-element-constructors

In particular, step 9.2. specifies that we "perform element.[[SetPrototypeOf]](prototype)."
where prototype is the result of Get(NewTarget, "prototype") in step 7.

WebKit's new behavior matches that of Chrome and Firefox.

Test: imported/w3c/web-platform-tests/custom-elements/htmlconstructor/newtarget.html

* bindings/js/JSHTMLElementCustom.cpp:
(WebCore::constructJSHTMLElement):


  Commit: 08d6621766bb5c90ede6ea7ad7728fcc829e3a76
      https://github.com/WebKit/WebKit/commit/08d6621766bb5c90ede6ea7ad7728fcc829e3a76
  Author: Joseph Pecoraro <pecoraro at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/NetworkResourceDetailView.js
    M Source/WebInspectorUI/UserInterface/Views/NetworkTableContentView.js

  Log Message:
  -----------
  Merge r234963 - Web Inspector: Show Initiator information in Network Table
https://bugs.webkit.org/show_bug.cgi?id=188590
<rdar://problem/43305488>

Patch by Joseph Pecoraro <pecoraro at apple.com> on 2018-08-16
Reviewed by Matt Baker.

* UserInterface/Views/NetworkResourceDetailView.js:
(WI.NetworkResourceDetailView):
(WI.NetworkResourceDetailView.prototype.shown):
(WI.NetworkResourceDetailView.prototype.willShowWithCookie):
(WI.NetworkResourceDetailView.prototype._showContentViewForNavigationItem):
When a ResourceDetailView gets shown, it may also want to show its initial content view
with a cookie as the cookie may contain position highlight information.

* UserInterface/Views/NetworkTableContentView.js:
(WI.NetworkTableContentView):
(WI.NetworkTableContentView.prototype._showResourceDetailView):
(WI.NetworkTableContentView.prototype.showRepresentedObject):
When showing a represented object, pass the cookie information on to the detail
view's so that it may include the cookie when showing the final content view.

(WI.NetworkTableContentView.prototype.tablePopulateCell):
(WI.NetworkTableContentView.prototype._populateInitiatorCell):
(WI.NetworkTableContentView.prototype.initialLayout):
New initiator column contains a source code link to the call site.

(WI.NetworkTableContentView.prototype._generateSortComparator):
(WI.NetworkTableContentView.prototype._entryForResource):
Entry data for the initiator is a display string that can be sorted easily.


  Commit: bca24ecdf033bac3cb23e0cfc7c9f1e6256aea5e
      https://github.com/WebKit/WebKit/commit/bca24ecdf033bac3cb23e0cfc7c9f1e6256aea5e
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/DOMWindow.cpp
    M Source/WebCore/page/Settings.yaml

  Log Message:
  -----------
  Merge r234967 - Remove unused allowScriptsToCloseWindows setting
https://bugs.webkit.org/show_bug.cgi?id=188602

Reviewed by Simon Fraser.

No change in behaviour. It was always false.

* page/DOMWindow.cpp:
(WebCore::DOMWindow::close):
* page/Settings.yaml:


  Commit: 6e3a67b11f2f9d450ca4e5ddcf0934549cf22c37
      https://github.com/WebKit/WebKit/commit/6e3a67b11f2f9d450ca4e5ddcf0934549cf22c37
  Author: Sihui Liu <sihui_liu at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.cpp
    M Source/WebKit/NetworkProcess/NetworkProcessCreationParameters.h
    M Source/WebKit/UIProcess/Cocoa/WebProcessPoolCocoa.mm

  Log Message:
  -----------
  Merge r234970 - Remove unused parentProcessName from NetworkProcessCreationParameters
https://bugs.webkit.org/show_bug.cgi?id=188618

Reviewed by Alex Christensen.

* NetworkProcess/NetworkProcessCreationParameters.cpp:
(WebKit::NetworkProcessCreationParameters::encode const):
(WebKit::NetworkProcessCreationParameters::decode):
* NetworkProcess/NetworkProcessCreationParameters.h:
* UIProcess/Cocoa/WebProcessPoolCocoa.mm:
(WebKit::WebProcessPool::platformInitializeNetworkProcess):


  Commit: a07dd181c631b19570236fcf1d17032ebfee9fc7
      https://github.com/WebKit/WebKit/commit/a07dd181c631b19570236fcf1d17032ebfee9fc7
  Author: Devin Rousso <drousso at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/inspector/dom-debugger/event-breakpoint-with-navigation-expected.txt
    A LayoutTests/inspector/dom-debugger/event-breakpoint-with-navigation.html
    A LayoutTests/inspector/dom-debugger/event-breakpoints-expected.txt
    A LayoutTests/inspector/dom-debugger/event-breakpoints.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.cpp
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/Localizations/en.lproj/localizedStrings.js
    M Source/WebInspectorUI/UserInterface/Controllers/DOMDebuggerManager.js
    M Source/WebInspectorUI/UserInterface/Controllers/DebuggerManager.js
    A Source/WebInspectorUI/UserInterface/Controllers/EventBreakpointTreeController.js
    A Source/WebInspectorUI/UserInterface/Images/EventBreakpoint.svg
    M Source/WebInspectorUI/UserInterface/Main.html
    A Source/WebInspectorUI/UserInterface/Models/EventBreakpoint.js
    M Source/WebInspectorUI/UserInterface/Test.html
    M Source/WebInspectorUI/UserInterface/Views/DebuggerSidebarPanel.js
    A Source/WebInspectorUI/UserInterface/Views/EventBreakpointPopover.css
    A Source/WebInspectorUI/UserInterface/Views/EventBreakpointPopover.js
    A Source/WebInspectorUI/UserInterface/Views/EventBreakpointTreeElement.css
    A Source/WebInspectorUI/UserInterface/Views/EventBreakpointTreeElement.js
    M Source/WebInspectorUI/UserInterface/Views/NavigationSidebarPanel.js

  Log Message:
  -----------
  Merge r234974 - Web Inspector: support breakpoints for arbitrary event names
https://bugs.webkit.org/show_bug.cgi?id=183118

Reviewed by Joseph Pecoraro.

Source/WebCore:

Tests: inspector/dom-debugger/event-breakpoints.html
       inspector/dom-debugger/event-breakpoints-with-navigation.html

* inspector/agents/InspectorDOMDebuggerAgent.cpp:
(WebCore::InspectorDOMDebuggerAgent::pauseOnNativeEventIfNeeded):

Source/WebInspectorUI:

Create UI for setting breakpoints on event names. Ties into renamed DOMDebugger commands,
specifically `setEventBreakpoint` and `removeEventBreakpoint`, that will pause execution if
any DOM event is fired that matches any previously registered breakpoints.

Event breakpoints are distinguished by name, and they currently apply globally, meaning
that only one breakpoint per event name can be registered.

Event breakpoints are created in the Debugger tab in a new "Event Breakpoints" section in
the Navigation sidebar. A new type of popover, EventBreakpointPopover, is used, but right
now all it contains is a basic text input for the event name. Similarly, a new TreeElement
subclass, EventBreakpointTreeElement, is used when showing the list of event listener
breakpoints, but all it shows now is the event name.

The majority of the logic in this patch was derived from XHR breakpoints.

* Localizations/en.lproj/localizedStrings.js:
* UserInterface/Main.html:
* UserInterface/Test.html:
* UserInterface/Images/EventBreakpoint.svg: Added.

* UserInterface/Models/EventBreakpoint.js: Added.
(WI.EventBreakpoint):
(WI.EventBreakpoint.prototype.get eventName):
(WI.EventBreakpoint.prototype.get disabled):
(WI.EventBreakpoint.prototype.set disabled):
(WI.EventBreakpoint.prototype.get serializableInfo):
(WI.EventBreakpoint.prototype.saveIdentityToCookie):

* UserInterface/Controllers/DOMDebuggerManager.js:
(WI.DOMDebuggerManager):
(WI.DOMDebuggerManager.prototype.get eventBreakpoints): Added.
(WI.DOMDebuggerManager.prototype.eventBreakpointForEventName): Added.
(WI.DOMDebuggerManager.prototype.addEventBreakpoint): Added.
(WI.DOMDebuggerManager.prototype.removeEventBreakpoint): Added.
(WI.DOMDebuggerManager.prototype._speculativelyResolveBreakpoints):
(WI.DOMDebuggerManager.prototype._updateEventBreakpoint.breakpointUpdated): Added.
(WI.DOMDebuggerManager.prototype._updateEventBreakpoint): Added.
(WI.DOMDebuggerManager.prototype._resolveEventBreakpoint): Added.
(WI.DOMDebuggerManager.prototype._saveEventBreakpoints): Added.
(WI.DOMDebuggerManager.prototype._eventBreakpointDisabledStateDidChange): Added.

* UserInterface/Controllers/DebuggerManager.js:
(WI.DebuggerManager.prototype._pauseReasonFromPayload):

* UserInterface/Controllers/EventBreakpointTreeController.js: Added.
(WI.EventBreakpointTreeController):
(WI.EventBreakpointTreeController.prototype.revealAndSelect):
(WI.EventBreakpointTreeController.prototype._eventBreakpointAdded):
(WI.EventBreakpointTreeController.prototype._eventBreakpointRemoved):
(WI.EventBreakpointTreeController.prototype._addTreeElement):

* UserInterface/Views/DebuggerSidebarPanel.js:
(WI.DebuggerSidebarPanel):
(WI.DebuggerSidebarPanel.prototype._updatePauseReasonSection):
(WI.DebuggerSidebarPanel.prototype._eventBreakpointAddedOrRemoved): Added.
(WI.DebuggerSidebarPanel.prototype._addEventBreakpointButtonClicked): Added.
(WI.DebuggerSidebarPanel.prototype.willDismissPopover):

* UserInterface/Views/EventBreakpointTreeElement.js: Added.
(WI.EventBreakpointTreeElement):
(WI.EventBreakpointTreeElement.prototype.onattach):
(WI.EventBreakpointTreeElement.prototype.ondetach):
(WI.EventBreakpointTreeElement.prototype.ondelete):
(WI.EventBreakpointTreeElement.prototype.onenter):
(WI.EventBreakpointTreeElement.prototype.onspace):
(WI.EventBreakpointTreeElement.prototype.populateContextMenu):
(WI.EventBreakpointTreeElement.prototype._statusImageElementClicked):
(WI.EventBreakpointTreeElement.prototype._statusImageElementFocused):
(WI.EventBreakpointTreeElement.prototype._statusImageElementMouseDown):
(WI.EventBreakpointTreeElement.prototype._toggleBreakpoint):
(WI.EventBreakpointTreeElement.prototype._updateStatus):
* UserInterface/Views/EventBreakpointTreeElement.css: Added.
(.breakpoint.event-listener:not(.breakpoint-paused-icon) .icon):

* UserInterface/Views/EventBreakpointPopover.js: Added.
(WI.EventBreakpointPopover):
(WI.EventBreakpointPopover.prototype.get result):
(WI.EventBreakpointPopover.prototype.get value):
(WI.EventBreakpointPopover.prototype.show):
(WI.EventBreakpointPopover.prototype._presentOverTargetElement):
* UserInterface/Views/EventBreakpointPopover.css: Added.
(.popover .event-listener-breakpoint-content):
(.popover .event-listener-breakpoint-content > input):

* UserInterface/Views/NavigationSidebarPanel.js:
(WI.NavigationSidebarPanel.prototype._isTreeElementWithoutRepresentedObject):

LayoutTests:

* inspector/dom-debugger/event-breakpoints-expected.txt: Added.
* inspector/dom-debugger/event-breakpoints.html: Added.

* inspector/dom-debugger/event-breakpoints-with-navigation-expected.txt: Added.
* inspector/dom-debugger/event-breakpoints-with-navigation.html: Added.


  Commit: 407cef5190c81bad3093aa32f5f499dec9abe0e3
      https://github.com/WebKit/WebKit/commit/407cef5190c81bad3093aa32f5f499dec9abe0e3
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/RegisterState.h

  Log Message:
  -----------
  Merge r234975 - [JSC] alignas for RegisterState should respect alignof(RegisterState) too
https://bugs.webkit.org/show_bug.cgi?id=188686

Reviewed by Saam Barati.

RegisterState would have larger alignment than `alignof(void*)`. We use the larger alignment value
for `alignof` for RegisterState.

* heap/RegisterState.h:


  Commit: a156a327546a99cfddfbd9e2eb1badfecb8d8e72
      https://github.com/WebKit/WebKit/commit/a156a327546a99cfddfbd9e2eb1badfecb8d8e72
  Author: Philippe Normand <philn at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp

  Log Message:
  -----------
  Merge r234977 - [GStreamer][MSE] Disable last-sample support in AppendPipeline
https://bugs.webkit.org/show_bug.cgi?id=188649

Patch by Philippe Normand <philn at igalia.com> on 2018-08-17
Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/mse/AppendPipeline.cpp:
(WebCore::AppendPipeline::AppendPipeline): This property isn't
used by the append pipeline. So as a micro-optimization, it is now
disabled.


  Commit: d1eb4096a4498638443146d9a6bb1f2167395a03
      https://github.com/WebKit/WebKit/commit/d1eb4096a4498638443146d9a6bb1f2167395a03
  Author: Philippe Normand <philn at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merge r234978 - [GStreamer] Enable fpsdisplaysink only when MEDIA_STATISTICS is enabled
https://bugs.webkit.org/show_bug.cgi?id=188648

Patch by Philippe Normand <philn at igalia.com> on 2018-08-17
Reviewed by Xabier Rodriguez-Calvar.

The fpsdisplaysink is useful only when MEDIA_STATISTICS is turned on.
The text overlay is now enabled when GST_DEBUG tracing is enabled for the player.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::createVideoSink):


  Commit: 6405cdb6caf60a006eba217323ed8ea30286fed1
      https://github.com/WebKit/WebKit/commit/6405cdb6caf60a006eba217323ed8ea30286fed1
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merge r234979 - [GTK] Never return an uninitialized ImageGStreamer object.
https://bugs.webkit.org/show_bug.cgi?id=188305

Reviewed by Philippe Normand.

The single caller was already checking for a null return value, so
make that check actually do something. Also remove the null-check on
the return value of image(), which asserted that it would never return
null.

Test: fast/canvas/canvas-createPattern-video-loading.html

* platform/graphics/gstreamer/ImageGStreamer.h:
(WebCore::ImageGStreamer::createImage): Return null if m_image wasn't created.
(WebCore::ImageGStreamer::image): Return a reference.
(WebCore::ImageGStreamer::rect): Always assert that m_image is present.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::paint): Update for new signature.


  Commit: c9b68047de3706a0354c021202ecaa36247f92b6
      https://github.com/WebKit/WebKit/commit/c9b68047de3706a0354c021202ecaa36247f92b6
  Author: David Kilzer <ddkilzer at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Assertions.h
    M Source/WTF/wtf/Optional.h

  Log Message:
  -----------
  Merge r234980 - WTF's internal std::optional implementation should release assert on all bad accesses
<https://webkit.org/b/187669>

Reviewed by Ryosuke Niwa.

* wtf/Assertions.h:
(RELEASE_ASSERT_UNDER_CONSTEXPR_CONTEXT): Add macro definitions.
* wtf/Optional.h:
(std::optional::operator -> const):
(std::optional::operator ->):
(std::optional::operator * const):
(std::optional::operator *):
(std::optional::value const):
(std::optional::value):
(std::optional<T::operator-> const):
(std::optional<T::operator* const):
(std::optional<T::value const):
- Change ASSERT_UNDER_CONSTEXPR_CONTEXT() macros to
  RELEASE_ASSERT_UNDER_CONSTEXPR_CONTEXT() macros.


  Commit: 999c289c1ef90deb1736bb2999cb50f2785e4515
      https://github.com/WebKit/WebKit/commit/999c289c1ef90deb1736bb2999cb50f2785e4515
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp

  Log Message:
  -----------
  Merge r234982 - [SOUP] Handle OAuth authentication after r234912
https://bugs.webkit.org/show_bug.cgi?id=188651

Reviewed by Carlos Garcia Campos.

Update this switch to consider the new OAuth enum value added in r234912. I suppose OAuth is
used for HTTP Auth now. It will be a one-time compatibility break as passwords previously
stored with type "Unknown" will no longer be accessible.

* platform/network/soup/NetworkStorageSessionSoup.cpp:
(WebCore::authTypeFromProtectionSpaceAuthenticationScheme):


  Commit: 01fb78f6c55fe88eb1d843213f8b3ec30c453722
      https://github.com/WebKit/WebKit/commit/01fb78f6c55fe88eb1d843213f8b3ec30c453722
  Author: Philippe Normand <philn at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h

  Log Message:
  -----------
  Merge r234983 - [GStreamer] reduce position queries frequency
https://bugs.webkit.org/show_bug.cgi?id=188645

Patch by Philippe Normand <philn at igalia.com> on 2018-08-17
Reviewed by Xabier Rodriguez-Calvar.

There is no need to perform dozens of position queries per second.
One every 300ms is enough.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::MediaPlayerPrivateGStreamer):
(WebCore::MediaPlayerPrivateGStreamer::playbackPosition const):
(WebCore::MediaPlayerPrivateGStreamer::asyncStateChangeDone):
(WebCore::MediaPlayerPrivateGStreamer::updateStates):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:


  Commit: 0a2144a6d444da4356d3166f8ee7e24660d51819
      https://github.com/WebKit/WebKit/commit/0a2144a6d444da4356d3166f8ee7e24660d51819
  Author: Yusuke Suzuki <yusukesuzuki at slowstart.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/ARM64Assembler.h
    M Source/JavaScriptCore/assembler/ARMAssembler.h
    M Source/JavaScriptCore/assembler/ARMv7Assembler.h
    M Source/JavaScriptCore/assembler/MIPSAssembler.h
    M Source/JavaScriptCore/assembler/MacroAssembler.h
    M Source/JavaScriptCore/assembler/X86Assembler.h
    M Source/JavaScriptCore/jit/CCallHelpers.h
    M Source/JavaScriptCore/jit/FPRInfo.h
    M Source/JavaScriptCore/jit/GPRInfo.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/cssjit/FunctionCall.h
    M Source/WebCore/cssjit/SelectorCompiler.cpp
    M Source/WebCore/html/HTMLKeygenElement.cpp

  Log Message:
  -----------
  Merge r234984 - [JSC] Add GPRReg::InvalidGPRReg and FPRReg::InvalidFPRReg
https://bugs.webkit.org/show_bug.cgi?id=188589

Patch by Yusuke Suzuki  <yusukesuzuki at slowstart.org> and Fujii Hironori <Hironori.Fujii at sony.com> on 2018-08-17
Reviewed by Mark Lam.
And reviewed by Yusuke Suzuki for Hironori's change.

Source/JavaScriptCore:

Since GPRReg(RegisterID) and FPRReg(FPRegisterID) do not include -1 in their enum values,
UBSan dumps bunch of warnings "runtime error: load of value 4294967295, which is not a valid value for type 'RegisterID'".

- We add InvalidGPRReg and InvalidFPRReg to enum values of GPRReg and FPRReg to suppress the above warnings.
- We make GPRReg and FPRReg int8_t enums.
- We replace `#define InvalidGPRReg ((JSC::GPRReg)-1)` to `static constexpr GPRReg InvalidGPRReg { GPRReg::InvalidGPRReg };`.
- We add operator+/- definition for RegisterIDs as a MSVC workaround. MSVC fails to resolve operator+ and operator-
  if `enum : int8_t` is used instead of `enum`.

* assembler/ARM64Assembler.h:
* assembler/ARMAssembler.h:
* assembler/ARMv7Assembler.h:
* assembler/MIPSAssembler.h:
* assembler/MacroAssembler.h:
* assembler/X86Assembler.h:
* jit/CCallHelpers.h:
(JSC::CCallHelpers::clampArrayToSize):
* jit/FPRInfo.h:
* jit/GPRInfo.h:
(JSC::JSValueRegs::JSValueRegs):
(JSC::JSValueRegs::tagGPR const):
(JSC::JSValueRegs::payloadGPR const):
(JSC::JSValueSource::JSValueSource):
(JSC::JSValueSource::unboxedCell):
(JSC::JSValueSource::operator bool const):
(JSC::JSValueSource::base const):
(JSC::JSValueSource::tagGPR const):
(JSC::JSValueSource::payloadGPR const):
(JSC::JSValueSource::hasKnownTag const):

Source/WebCore:

* cssjit/FunctionCall.h:
(WebCore::FunctionCall::FunctionCall):
* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorCodeGenerator::modulo):
* html/HTMLKeygenElement.cpp:
Remove `using namespace WebCore` not to introduce `operator+/-` which makes the resolution of `operator+/-` for RegisterID ambiguous.


  Commit: 6053e17f234d34cc0f86a27d4e4dd98d0e6de87e
      https://github.com/WebKit/WebKit/commit/6053e17f234d34cc0f86a27d4e4dd98d0e6de87e
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/LoadParameters.cpp
    M Source/WebKit/Shared/LoadParameters.h
    M Source/WebKit/UIProcess/API/C/WKPage.cpp
    M Source/WebKit/UIProcess/API/Cocoa/WKBrowsingContextController.mm
    M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
    M Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.h
    M Source/WebKit/WebProcess/WebPage/WebPage.messages.in

  Log Message:
  -----------
  Merge r234985 - Replace WebPageProxy::loadAlternateHTMLString with loadAlternateHTML
https://bugs.webkit.org/show_bug.cgi?id=188679

Reviewed by Carlos Garcia Campos.

* Shared/LoadParameters.cpp:
(WebKit::LoadParameters::encode const):
(WebKit::LoadParameters::decode):
* Shared/LoadParameters.h:
* UIProcess/API/C/WKPage.cpp:
(encodingOf):
(dataFrom):
(loadString):
(WKPageLoadAlternateHTMLString):
(WKPageLoadAlternateHTMLStringWithUserData):
* UIProcess/API/Cocoa/WKBrowsingContextController.mm:
(-[WKBrowsingContextController loadAlternateHTMLString:baseURL:forUnreachableURL:]):
* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _loadAlternateHTMLString:baseURL:forUnreachableURL:]):
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::loadAlternateHTML):
(WebKit::WebPageProxy::loadAlternateHTMLString): Deleted.
* UIProcess/WebPageProxy.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::loadAlternateHTMLString):


  Commit: affa162682a0363c3ee5898218c75ff1a2b956a4
      https://github.com/WebKit/WebKit/commit/affa162682a0363c3ee5898218c75ff1a2b956a4
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/C/WKPage.cpp

  Log Message:
  -----------
  Merge r234989 - Fix API tests after r234985
https://bugs.webkit.org/show_bug.cgi?id=188679

* UIProcess/API/C/WKPage.cpp:
(encodingOf):
(dataFrom):
The encoding of null strings had changed, which is no big deal because there's no data in that encoding,
but switching it back fixes the tests.


  Commit: 753f771e64fc2e4ddbc1382fbe4884b86e86fdd9
      https://github.com/WebKit/WebKit/commit/753f771e64fc2e4ddbc1382fbe4884b86e86fdd9
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/NetworkLoad.cpp
    M Source/WebKit/NetworkProcess/NetworkSession.cpp
    M Source/WebKit/NetworkProcess/NetworkSession.h
    M Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm

  Log Message:
  -----------
  Merge r234990 - Simplify server trust authentication flow
https://bugs.webkit.org/show_bug.cgi?id=188684

Reviewed by Youenn Fablet.

We unnecessarily had the allowsSpecificHTTPSCertificateForHost check at two different abstraction levels.

* NetworkProcess/NetworkLoad.cpp:
(WebKit::NetworkLoad::didReceiveChallenge):
* NetworkProcess/NetworkSession.cpp:
(WebKit::NetworkSession::allowsSpecificHTTPSCertificateForHost): Deleted.
* NetworkProcess/NetworkSession.h:
* NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(-[WKNetworkSessionDelegate URLSession:task:didReceiveChallenge:completionHandler:]):


  Commit: 156517c5412fe0d71cf19eb6b903aaedc60ccda5
      https://github.com/WebKit/WebKit/commit/156517c5412fe0d71cf19eb6b903aaedc60ccda5
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.cpp
    M Source/WebCore/Modules/applepay/ApplePayPaymentAuthorizedEvent.cpp
    M Source/WebCore/Modules/applepay/ApplePayPaymentMethodSelectedEvent.cpp
    M Source/WebCore/Modules/applepay/ApplePaySession.cpp
    M Source/WebCore/Modules/applepay/ApplePayShippingContactSelectedEvent.cpp
    M Source/WebCore/Modules/applepay/ApplePayShippingMethodSelectedEvent.cpp
    M Source/WebCore/Modules/applepay/ApplePayValidateMerchantEvent.cpp
    M Source/WebCore/Modules/encryptedmedia/MediaKeySession.cpp
    M Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeyMessageEvent.cpp
    M Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeyNeededEvent.cpp
    M Source/WebCore/Modules/encryptedmedia/legacy/WebKitMediaKeySession.cpp
    M Source/WebCore/Modules/gamepad/GamepadEvent.cpp
    M Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
    M Source/WebCore/Modules/indexeddb/IDBOpenDBRequest.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequest.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequestCompletionEvent.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequestCompletionEvent.h
    M Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
    M Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.cpp
    M Source/WebCore/Modules/mediasession/MediaSession.cpp
    M Source/WebCore/Modules/mediasource/MediaSource.cpp
    M Source/WebCore/Modules/mediasource/SourceBuffer.cpp
    M Source/WebCore/Modules/mediasource/SourceBufferList.cpp
    M Source/WebCore/Modules/mediastream/MediaDevices.cpp
    M Source/WebCore/Modules/mediastream/MediaStream.cpp
    M Source/WebCore/Modules/mediastream/MediaStreamEvent.cpp
    M Source/WebCore/Modules/mediastream/MediaStreamEvent.h
    M Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
    M Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.cpp
    M Source/WebCore/Modules/mediastream/MediaStreamTrackEvent.h
    M Source/WebCore/Modules/mediastream/OverconstrainedErrorEvent.h
    M Source/WebCore/Modules/mediastream/PeerConnectionBackend.cpp
    M Source/WebCore/Modules/mediastream/RTCDTMFToneChangeEvent.cpp
    M Source/WebCore/Modules/mediastream/RTCDataChannel.cpp
    M Source/WebCore/Modules/mediastream/RTCDataChannelEvent.cpp
    M Source/WebCore/Modules/mediastream/RTCDataChannelEvent.h
    M Source/WebCore/Modules/mediastream/RTCPeerConnection.cpp
    M Source/WebCore/Modules/mediastream/RTCPeerConnectionIceEvent.cpp
    M Source/WebCore/Modules/mediastream/RTCPeerConnectionIceEvent.h
    M Source/WebCore/Modules/mediastream/RTCTrackEvent.cpp
    M Source/WebCore/Modules/mediastream/RTCTrackEvent.h
    M Source/WebCore/Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.cpp
    M Source/WebCore/Modules/notifications/Notification.cpp
    M Source/WebCore/Modules/paymentrequest/MerchantValidationEvent.cpp
    M Source/WebCore/Modules/paymentrequest/PaymentRequestUpdateEvent.cpp
    M Source/WebCore/Modules/plugins/QuickTimePluginReplacement.mm
    M Source/WebCore/Modules/speech/SpeechSynthesisEvent.cpp
    M Source/WebCore/Modules/webaudio/AudioContext.cpp
    M Source/WebCore/Modules/webaudio/AudioProcessingEvent.cpp
    M Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp
    M Source/WebCore/Modules/webaudio/OfflineAudioCompletionEvent.cpp
    M Source/WebCore/Modules/websockets/CloseEvent.h
    M Source/WebCore/Modules/websockets/WebSocket.cpp
    M Source/WebCore/Modules/webvr/VRDisplayEvent.cpp
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/AccessibleSetValueEvent.cpp
    M Source/WebCore/animation/AnimationPlaybackEvent.cpp
    M Source/WebCore/dom/AbortSignal.cpp
    M Source/WebCore/dom/AnimationEvent.cpp
    M Source/WebCore/dom/BeforeLoadEvent.h
    M Source/WebCore/dom/BeforeTextInsertedEvent.cpp
    M Source/WebCore/dom/BeforeUnloadEvent.cpp
    M Source/WebCore/dom/CharacterData.cpp
    M Source/WebCore/dom/CompositionEvent.cpp
    M Source/WebCore/dom/ContainerNode.cpp
    M Source/WebCore/dom/DeviceMotionEvent.cpp
    M Source/WebCore/dom/DeviceOrientationEvent.cpp
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/DocumentEventQueue.cpp
    M Source/WebCore/dom/DocumentEventQueue.h
    M Source/WebCore/dom/Element.cpp
    M Source/WebCore/dom/ErrorEvent.cpp
    M Source/WebCore/dom/Event.cpp
    M Source/WebCore/dom/Event.h
    M Source/WebCore/dom/FocusEvent.cpp
    M Source/WebCore/dom/FocusEvent.h
    M Source/WebCore/dom/HashChangeEvent.h
    M Source/WebCore/dom/InputEvent.cpp
    M Source/WebCore/dom/InputEvent.h
    M Source/WebCore/dom/KeyboardEvent.cpp
    M Source/WebCore/dom/MessageEvent.cpp
    M Source/WebCore/dom/MouseEvent.cpp
    M Source/WebCore/dom/MouseEvent.h
    M Source/WebCore/dom/MouseRelatedEvent.cpp
    M Source/WebCore/dom/MouseRelatedEvent.h
    M Source/WebCore/dom/MutationEvent.cpp
    M Source/WebCore/dom/MutationEvent.h
    M Source/WebCore/dom/Node.cpp
    M Source/WebCore/dom/OverflowEvent.cpp
    M Source/WebCore/dom/PageTransitionEvent.cpp
    M Source/WebCore/dom/PopStateEvent.cpp
    M Source/WebCore/dom/ProgressEvent.cpp
    M Source/WebCore/dom/ScriptElement.cpp
    M Source/WebCore/dom/SecurityPolicyViolationEvent.h
    M Source/WebCore/dom/SimulatedClick.cpp
    M Source/WebCore/dom/TextEvent.cpp
    M Source/WebCore/dom/TouchEvent.cpp
    M Source/WebCore/dom/TransitionEvent.cpp
    M Source/WebCore/dom/UIEvent.cpp
    M Source/WebCore/dom/UIEvent.h
    M Source/WebCore/dom/UIEventWithKeyState.h
    M Source/WebCore/dom/WebKitAnimationEvent.cpp
    M Source/WebCore/dom/WebKitTransitionEvent.cpp
    M Source/WebCore/dom/WheelEvent.cpp
    M Source/WebCore/editing/Editor.cpp
    M Source/WebCore/editing/FrameSelection.cpp
    M Source/WebCore/html/HTMLDetailsElement.cpp
    M Source/WebCore/html/HTMLFormControlElement.cpp
    M Source/WebCore/html/HTMLFormElement.cpp
    M Source/WebCore/html/HTMLImageLoader.cpp
    M Source/WebCore/html/HTMLInputElement.cpp
    M Source/WebCore/html/HTMLLinkElement.cpp
    M Source/WebCore/html/HTMLMediaElement.cpp
    M Source/WebCore/html/HTMLPlugInImageElement.cpp
    M Source/WebCore/html/HTMLScriptElement.cpp
    M Source/WebCore/html/HTMLSlotElement.cpp
    M Source/WebCore/html/HTMLSourceElement.cpp
    M Source/WebCore/html/HTMLStyleElement.cpp
    M Source/WebCore/html/HTMLTextFormControlElement.cpp
    M Source/WebCore/html/HTMLTrackElement.cpp
    M Source/WebCore/html/MediaController.cpp
    M Source/WebCore/html/canvas/WebGLContextEvent.cpp
    M Source/WebCore/html/canvas/WebGLContextEvent.h
    M Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp
    M Source/WebCore/html/parser/HTMLScriptRunner.cpp
    M Source/WebCore/html/track/TrackEvent.cpp
    M Source/WebCore/html/track/TrackEvent.h
    M Source/WebCore/html/track/TrackListBase.cpp
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/loader/ImageLoader.cpp
    M Source/WebCore/loader/PolicyChecker.cpp
    M Source/WebCore/loader/appcache/ApplicationCacheHost.cpp
    M Source/WebCore/page/DOMWindow.cpp
    M Source/WebCore/page/EventHandler.cpp
    M Source/WebCore/page/EventSource.cpp
    M Source/WebCore/page/FocusController.cpp
    M Source/WebCore/page/FrameView.cpp
    M Source/WebCore/page/Page.cpp
    M Source/WebCore/page/Performance.cpp
    M Source/WebCore/page/PointerLockController.cpp
    M Source/WebCore/page/VisualViewport.cpp
    M Source/WebCore/storage/StorageEvent.cpp
    M Source/WebCore/svg/SVGElement.cpp
    M Source/WebCore/svg/SVGImageLoader.cpp
    M Source/WebCore/svg/SVGUseElement.cpp
    M Source/WebCore/svg/animation/SVGSMILElement.cpp
    M Source/WebCore/workers/Worker.cpp
    M Source/WebCore/workers/WorkerMessagingProxy.cpp
    M Source/WebCore/workers/service/ExtendableEvent.cpp
    M Source/WebCore/workers/service/ExtendableEvent.h
    M Source/WebCore/workers/service/ExtendableMessageEvent.cpp
    M Source/WebCore/workers/service/ServiceWorker.cpp
    M Source/WebCore/workers/service/ServiceWorkerContainer.cpp
    M Source/WebCore/workers/service/ServiceWorkerRegistration.cpp
    M Source/WebCore/workers/service/context/ServiceWorkerThreadProxy.cpp
    M Source/WebCore/xml/XMLHttpRequest.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKitLegacy/ios/ChangeLog
    M Source/WebKitLegacy/ios/WebView/WebPDFViewPlaceholder.mm
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebView/WebPDFView.mm
    M Source/WebKitLegacy/mac/WebView/WebView.mm

  Log Message:
  -----------
  Merge r234995 - Replace canBubble and cancelable booleans in Event by enum classes
https://bugs.webkit.org/show_bug.cgi?id=188692

Reviewed by Alex Christensen.

Source/WebCore:

Replaced booleans indicating whether an event can bubble and an event is cancelable
by two enum classes: CanBubble and IsCancelable.

No new tests since there should be no behavioral changes.

* Modules/airplay/WebKitPlaybackTargetAvailabilityEvent.cpp:
(WebCore::WebKitPlaybackTargetAvailabilityEvent::WebKitPlaybackTargetAvailabilityEvent):
* Modules/applepay/ApplePayPaymentAuthorizedEvent.cpp:
(WebCore::ApplePayPaymentAuthorizedEvent::ApplePayPaymentAuthorizedEvent):
* Modules/applepay/ApplePayPaymentMethodSelectedEvent.cpp:
(WebCore::ApplePayPaymentMethodSelectedEvent::ApplePayPaymentMethodSelectedEvent):
* Modules/applepay/ApplePaySession.cpp:
(WebCore::ApplePaySession::didCancelPaymentSession):
* Modules/applepay/ApplePayShippingContactSelectedEvent.cpp:
(WebCore::ApplePayShippingContactSelectedEvent::ApplePayShippingContactSelectedEvent):
* Modules/applepay/ApplePayShippingMethodSelectedEvent.cpp:
(WebCore::ApplePayShippingMethodSelectedEvent::ApplePayShippingMethodSelectedEvent):
* Modules/applepay/ApplePayValidateMerchantEvent.cpp:
(WebCore::ApplePayValidateMerchantEvent::ApplePayValidateMerchantEvent):
* Modules/encryptedmedia/MediaKeySession.cpp:
(WebCore::MediaKeySession::updateKeyStatuses):
* Modules/encryptedmedia/legacy/WebKitMediaKeyMessageEvent.cpp:
(WebCore::WebKitMediaKeyMessageEvent::WebKitMediaKeyMessageEvent):
* Modules/encryptedmedia/legacy/WebKitMediaKeyNeededEvent.cpp:
(WebCore::WebKitMediaKeyNeededEvent::WebKitMediaKeyNeededEvent):
* Modules/encryptedmedia/legacy/WebKitMediaKeySession.cpp:
(WebCore::WebKitMediaKeySession::addKeyTimerFired):
(WebCore::WebKitMediaKeySession::sendError):
* Modules/gamepad/GamepadEvent.cpp:
(WebCore::GamepadEvent::GamepadEvent):
* Modules/indexeddb/IDBDatabase.cpp:
(WebCore::IDBDatabase::connectionToServerLost):
* Modules/indexeddb/IDBOpenDBRequest.cpp:
(WebCore::IDBOpenDBRequest::onError):
(WebCore::IDBOpenDBRequest::fireSuccessAfterVersionChangeCommit):
(WebCore::IDBOpenDBRequest::fireErrorAfterVersionChangeCompletion):
(WebCore::IDBOpenDBRequest::onSuccess):
* Modules/indexeddb/IDBRequest.cpp:
(WebCore::IDBRequest::onError):
(WebCore::IDBRequest::onSuccess):
* Modules/indexeddb/IDBRequestCompletionEvent.cpp:
(WebCore::IDBRequestCompletionEvent::IDBRequestCompletionEvent):
* Modules/indexeddb/IDBRequestCompletionEvent.h:
(WebCore::IDBRequestCompletionEvent::create):
* Modules/indexeddb/IDBTransaction.cpp:
(WebCore::IDBTransaction::fireOnComplete):
(WebCore::IDBTransaction::fireOnAbort):
* Modules/indexeddb/IDBVersionChangeEvent.cpp:
(WebCore::IDBVersionChangeEvent::IDBVersionChangeEvent):
* Modules/mediasession/MediaSession.cpp:
(WebCore::MediaSession::skipToNextTrack):
(WebCore::MediaSession::skipToPreviousTrack):
* Modules/mediasource/MediaSource.cpp:
(WebCore::MediaSource::scheduleEvent):
* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::scheduleEvent):
* Modules/mediasource/SourceBufferList.cpp:
(WebCore::SourceBufferList::scheduleEvent):
* Modules/mediastream/MediaDevices.cpp:
(WebCore::MediaDevices::scheduledEventTimerFired):
* Modules/mediastream/MediaStream.cpp:
(WebCore::MediaStream::internalAddTrack):
(WebCore::MediaStream::internalRemoveTrack):
* Modules/mediastream/MediaStreamEvent.cpp:
(WebCore::MediaStreamEvent::create):
(WebCore::MediaStreamEvent::MediaStreamEvent):
* Modules/mediastream/MediaStreamEvent.h:
* Modules/mediastream/MediaStreamTrack.cpp:
(WebCore::MediaStreamTrack::trackEnded):
(WebCore::MediaStreamTrack::trackMutedChanged):
* Modules/mediastream/MediaStreamTrackEvent.cpp:
(WebCore::MediaStreamTrackEvent::create):
(WebCore::MediaStreamTrackEvent::MediaStreamTrackEvent):
* Modules/mediastream/MediaStreamTrackEvent.h:
* Modules/mediastream/OverconstrainedErrorEvent.h:
(WebCore::OverconstrainedErrorEvent::create):
(WebCore::OverconstrainedErrorEvent::OverconstrainedErrorEvent):
* Modules/mediastream/PeerConnectionBackend.cpp:
(WebCore::PeerConnectionBackend::fireICECandidateEvent):
(WebCore::PeerConnectionBackend::doneGatheringCandidates):
(WebCore::PeerConnectionBackend::updateSignalingState):
* Modules/mediastream/RTCDTMFToneChangeEvent.cpp:
(WebCore::RTCDTMFToneChangeEvent::RTCDTMFToneChangeEvent):
* Modules/mediastream/RTCDataChannel.cpp:
(WebCore::RTCDataChannel::didChangeReadyState):
(WebCore::RTCDataChannel::didDetectError):
(WebCore::RTCDataChannel::bufferedAmountIsDecreasing):
* Modules/mediastream/RTCDataChannelEvent.cpp:
(WebCore::RTCDataChannelEvent::create):
(WebCore::RTCDataChannelEvent::RTCDataChannelEvent):
* Modules/mediastream/RTCDataChannelEvent.h:
* Modules/mediastream/RTCPeerConnection.cpp:
(WebCore::RTCPeerConnection::updateIceGatheringState):
(WebCore::RTCPeerConnection::updateIceConnectionState):
(WebCore::RTCPeerConnection::updateConnectionState):
(WebCore::RTCPeerConnection::scheduleNegotiationNeededEvent):
* Modules/mediastream/RTCPeerConnectionIceEvent.cpp:
(WebCore::RTCPeerConnectionIceEvent::create):
(WebCore::RTCPeerConnectionIceEvent::RTCPeerConnectionIceEvent):
* Modules/mediastream/RTCPeerConnectionIceEvent.h:
* Modules/mediastream/RTCTrackEvent.cpp:
(WebCore::RTCTrackEvent::create):
(WebCore::RTCTrackEvent::RTCTrackEvent):
* Modules/mediastream/RTCTrackEvent.h:
* Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.cpp:
(WebCore::LibWebRTCMediaEndpoint::addRemoteStream):
(WebCore::LibWebRTCMediaEndpoint::addRemoteTrack):
(WebCore::LibWebRTCMediaEndpoint::addDataChannel):
* Modules/notifications/Notification.cpp:
(WebCore::Notification::dispatchShowEvent):
(WebCore::Notification::dispatchClickEvent):
(WebCore::Notification::dispatchCloseEvent):
(WebCore::Notification::dispatchErrorEvent):
* Modules/paymentrequest/MerchantValidationEvent.cpp:
(WebCore::MerchantValidationEvent::MerchantValidationEvent):
* Modules/paymentrequest/PaymentRequestUpdateEvent.cpp:
(WebCore::PaymentRequestUpdateEvent::PaymentRequestUpdateEvent):
* Modules/plugins/QuickTimePluginReplacement.mm:
(WebCore::QuickTimePluginReplacement::postEvent):
* Modules/speech/SpeechSynthesisEvent.cpp:
(WebCore::SpeechSynthesisEvent::SpeechSynthesisEvent):
* Modules/webaudio/AudioContext.cpp:
(WebCore::AudioContext::setState):
* Modules/webaudio/AudioProcessingEvent.cpp:
(WebCore::AudioProcessingEvent::AudioProcessingEvent):
* Modules/webaudio/AudioScheduledSourceNode.cpp:
(WebCore::AudioScheduledSourceNode::finish):
* Modules/webaudio/OfflineAudioCompletionEvent.cpp:
(WebCore::OfflineAudioCompletionEvent::OfflineAudioCompletionEvent):
* Modules/websockets/CloseEvent.h:
(WebCore::CloseEvent::CloseEvent):
* Modules/websockets/WebSocket.cpp:
(WebCore::WebSocket::didConnect):
(WebCore::WebSocket::dispatchOrQueueErrorEvent):
* Modules/webvr/VRDisplayEvent.cpp:
(WebCore::VRDisplayEvent::VRDisplayEvent):
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::dispatchAccessibilityEventWithType const):
* accessibility/AccessibleSetValueEvent.cpp:
(WebCore::AccessibleSetValueEvent::AccessibleSetValueEvent):
* animation/AnimationPlaybackEvent.cpp:
(WebCore::AnimationPlaybackEvent::AnimationPlaybackEvent):
* dom/AbortSignal.cpp:
(WebCore::AbortSignal::abort):
* dom/AnimationEvent.cpp:
(WebCore::AnimationEvent::AnimationEvent):
* dom/BeforeLoadEvent.h:
* dom/BeforeTextInsertedEvent.cpp:
(WebCore::BeforeTextInsertedEvent::BeforeTextInsertedEvent):
* dom/BeforeUnloadEvent.cpp:
(WebCore::BeforeUnloadEvent::BeforeUnloadEvent):
* dom/CharacterData.cpp:
(WebCore::CharacterData::dispatchModifiedEvent):
* dom/CompositionEvent.cpp:
(WebCore::CompositionEvent::CompositionEvent):
* dom/ContainerNode.cpp:
(WebCore::dispatchChildInsertionEvents):
(WebCore::dispatchChildRemovalEvents):
* dom/DeviceMotionEvent.cpp:
(WebCore::DeviceMotionEvent::DeviceMotionEvent):
* dom/DeviceOrientationEvent.cpp:
(WebCore::DeviceOrientationEvent::DeviceOrientationEvent):
* dom/Document.cpp:
(WebCore::Document::setReadyState):
(WebCore::Document::visibilityStateChanged):
(WebCore::Document::finishedParsing):
(WebCore::Document::dispatchFullScreenChangeOrErrorEvent):
(WebCore::Document::orientationChanged):
* dom/DocumentEventQueue.cpp:
(WebCore::DocumentEventQueue::enqueueOrDispatchScrollEvent):
(WebCore::DocumentEventQueue::enqueueScrollEvent):
(WebCore::DocumentEventQueue::enqueueResizeEvent):
* dom/DocumentEventQueue.h:
* dom/Element.cpp:
(WebCore::Element::dispatchMouseEvent):
(WebCore::Element::dispatchFocusInEvent):
(WebCore::Element::dispatchFocusOutEvent):
(WebCore::Element::dispatchFocusEvent):
(WebCore::Element::dispatchBlurEvent):
(WebCore::Element::dispatchWebKitImageReadyEventForTesting):
* dom/ErrorEvent.cpp:
(WebCore::ErrorEvent::ErrorEvent):
* dom/Event.cpp:
(WebCore::Event::Event):
(WebCore::Event::create):
* dom/Event.h:
* dom/FocusEvent.cpp:
(WebCore::FocusEvent::FocusEvent):
* dom/FocusEvent.h:
* dom/HashChangeEvent.h:
* dom/InputEvent.cpp:
(WebCore::InputEvent::create):
(WebCore::InputEvent::InputEvent):
* dom/InputEvent.h:
* dom/KeyboardEvent.cpp:
(WebCore::KeyboardEvent::KeyboardEvent):
* dom/MessageEvent.cpp:
(WebCore::MessageEvent::MessageEvent):
* dom/MouseEvent.cpp:
(WebCore::MouseEvent::create):
(WebCore::MouseEvent::MouseEvent):
* dom/MouseEvent.h:
* dom/MouseRelatedEvent.cpp:
(WebCore::MouseRelatedEvent::MouseRelatedEvent):
* dom/MouseRelatedEvent.h:
* dom/MutationEvent.cpp:
(WebCore::MutationEvent::MutationEvent):
* dom/MutationEvent.h:
* dom/Node.cpp:
(WebCore::Node::dispatchSubtreeModifiedEvent):
(WebCore::Node::dispatchDOMActivateEvent):
(WebCore::Node::dispatchInputEvent):
* dom/OverflowEvent.cpp:
(WebCore::OverflowEvent::OverflowEvent):
* dom/PageTransitionEvent.cpp:
(WebCore::PageTransitionEvent::PageTransitionEvent):
* dom/PopStateEvent.cpp:
(WebCore::PopStateEvent::PopStateEvent):
* dom/ProgressEvent.cpp:
(WebCore::ProgressEvent::ProgressEvent):
* dom/ScriptElement.cpp:
(WebCore::ScriptElement::dispatchErrorEvent):
* dom/SecurityPolicyViolationEvent.h:
* dom/SimulatedClick.cpp:
* dom/TextEvent.cpp:
(WebCore::TextEvent::TextEvent):
* dom/TransitionEvent.cpp:
(WebCore::TransitionEvent::TransitionEvent):
* dom/UIEvent.cpp:
(WebCore::UIEvent::UIEvent):
* dom/UIEvent.h:
(WebCore::UIEvent::create):
* dom/UIEventWithKeyState.h:
(WebCore::UIEventWithKeyState::UIEventWithKeyState):
* dom/WebKitAnimationEvent.cpp:
(WebCore::WebKitAnimationEvent::WebKitAnimationEvent):
* dom/WebKitTransitionEvent.cpp:
(WebCore::WebKitTransitionEvent::WebKitTransitionEvent):
* dom/WheelEvent.cpp:
(WebCore::WheelEvent::WheelEvent):
* editing/Editor.cpp:
(WebCore::dispatchBeforeInputEvent):
(WebCore::dispatchBeforeInputEvents):
(WebCore::Editor::willApplyEditing const):
* editing/FrameSelection.cpp:
(WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance):
(WebCore::FrameSelection::selectAll):
(WebCore::FrameSelection::dispatchSelectStart):
* html/HTMLDetailsElement.cpp:
(WebCore::HTMLDetailsElement::dispatchPendingEvent):
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::dispatchChangeEvent):
(WebCore::HTMLFormControlElement::checkValidity):
* html/HTMLFormElement.cpp:
(WebCore::HTMLFormElement::prepareForSubmission):
(WebCore::HTMLFormElement::reset):
* html/HTMLImageLoader.cpp:
(WebCore::HTMLImageLoader::dispatchLoadEvent):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::onSearch):
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::dispatchPendingEvent):
* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::scheduleEvent):
(WebCore::HTMLMediaElement::notifyAboutPlaying):
(WebCore::HTMLMediaElement::updateActiveTextTrackCues):
(WebCore::HTMLMediaElement::layoutSizeChanged):
* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::checkSnapshotStatus):
* html/HTMLScriptElement.cpp:
(WebCore::HTMLScriptElement::dispatchLoadEvent):
* html/HTMLSlotElement.cpp:
(WebCore::HTMLSlotElement::dispatchSlotChangeEvent):
* html/HTMLSourceElement.cpp:
(WebCore::HTMLSourceElement::errorEventTimerFired):
* html/HTMLStyleElement.cpp:
(WebCore::HTMLStyleElement::dispatchPendingEvent):
* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::selectionChanged):
* html/HTMLTrackElement.cpp:
(WebCore::HTMLTrackElement::didCompleteLoad):
* html/MediaController.cpp:
(WebCore::MediaController::scheduleEvent):
* html/canvas/WebGLContextEvent.cpp:
(WebCore::WebGLContextEvent::WebGLContextEvent):
* html/canvas/WebGLContextEvent.h:
* html/canvas/WebGLRenderingContextBase.cpp:
(WebCore::WebGLRenderingContextBase::create):
(WebCore::WebGLRenderingContextBase::dispatchContextLostEvent):
(WebCore::WebGLRenderingContextBase::maybeRestoreContext):
(WebCore::WebGLRenderingContextBase::dispatchContextChangedEvent):
* html/parser/HTMLScriptRunner.cpp:
(WebCore::createScriptLoadEvent):
* html/track/TrackEvent.cpp:
(WebCore::TrackEvent::TrackEvent):
* html/track/TrackEvent.h:
* html/track/TrackListBase.cpp:
(WebCore::TrackListBase::scheduleTrackEvent):
(WebCore::TrackListBase::scheduleChangeEvent):
* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::stopLoadingAfterXFrameOptionsOrContentSecurityPolicyDenied):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::dispatchUnloadEvents):
* loader/ImageLoader.cpp:
(WebCore::ImageLoader::dispatchPendingErrorEvent):
* loader/PolicyChecker.cpp:
(WebCore::PolicyChecker::checkNavigationPolicy):
* loader/appcache/ApplicationCacheHost.cpp:
(WebCore::createApplicationCacheEvent):
* page/DOMWindow.cpp:
(WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
(WebCore::DOMWindow::languagesChanged):
(WebCore::DOMWindow::dispatchLoadEvent):
* page/EventHandler.cpp:
(WebCore::dispatchSelectStart):
(WebCore::EventHandler::dispatchDragEvent):
* page/EventSource.cpp:
(WebCore::EventSource::scheduleReconnect):
(WebCore::EventSource::didReceiveResponse):
(WebCore::EventSource::abortConnectionAttempt):
* page/FocusController.cpp:
(WebCore::dispatchEventsOnWindowAndFocusedElement):
(WebCore::FocusController::setFocusedFrame):
* page/FrameView.cpp:
(WebCore::FrameView::sendResizeEventIfNeeded):
* page/Page.cpp:
(WebCore::networkStateChanged):
* page/Performance.cpp:
(WebCore::Performance::resourceTimingBufferFullTimerFired):
* page/PointerLockController.cpp:
(WebCore::PointerLockController::enqueueEvent):
* page/VisualViewport.cpp:
(WebCore::VisualViewport::enqueueResizeEvent):
(WebCore::VisualViewport::enqueueScrollEvent):
* storage/StorageEvent.cpp:
(WebCore::StorageEvent::StorageEvent):
* svg/SVGElement.cpp:
(WebCore::SVGElement::sendSVGLoadEventIfPossible):
* svg/SVGImageLoader.cpp:
(WebCore::SVGImageLoader::dispatchLoadEvent):
* svg/SVGUseElement.cpp:
(WebCore::SVGUseElement::notifyFinished):
* svg/animation/SVGSMILElement.cpp:
(WebCore::SVGSMILElement::dispatchPendingEvent):
* workers/Worker.cpp:
(WebCore::Worker::notifyFinished):
* workers/WorkerMessagingProxy.cpp:
(WebCore::WorkerMessagingProxy::notifyNetworkStateChange):
* workers/service/ExtendableEvent.cpp:
(WebCore::ExtendableEvent::ExtendableEvent):
* workers/service/ExtendableEvent.h:
* workers/service/ExtendableMessageEvent.cpp:
(WebCore::ExtendableMessageEvent::ExtendableMessageEvent):
* workers/service/ServiceWorker.cpp:
(WebCore::ServiceWorker::scheduleTaskToUpdateState):
* workers/service/ServiceWorkerContainer.cpp:
(WebCore::ServiceWorkerContainer::scheduleTaskToFireControllerChangeEvent):
* workers/service/ServiceWorkerRegistration.cpp:
(WebCore::ServiceWorkerRegistration::scheduleTaskToFireUpdateFoundEvent):
* workers/service/context/ServiceWorkerThreadProxy.cpp:
(WebCore::ServiceWorkerThreadProxy::notifyNetworkStateChange):
* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::callReadyStateChangeListener):

Source/WebKit:

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::navigateToPDFLinkWithSimulatedClick):

Source/WebKitLegacy/ios:

* WebView/WebPDFViewPlaceholder.mm:
(-[WebPDFViewPlaceholder simulateClickOnLinkToURL:]):

Source/WebKitLegacy/mac:

* WebView/WebPDFView.mm:
(-[WebPDFView PDFViewWillClickOnLink:withURL:]):
* WebView/WebView.mm:
(-[WebView _dispatchUnloadEvent]):


  Commit: 898675442d0b5aa63a980894c327f7d5cfdc4b74
      https://github.com/WebKit/WebKit/commit/898675442d0b5aa63a980894c327f7d5cfdc4b74
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Event.h

  Log Message:
  -----------
  Merge r234999 - Replace canBubble and cancelable booleans in Event by enum classes
https://bugs.webkit.org/show_bug.cgi?id=188692
<rdar://problem/43411944>

Rubber-stamped by Alex Christensen.

Make these enum classes uint8_t.

* dom/Event.h:


  Commit: cb0755380cf3f388f3ede04561972edad2a42ca0
      https://github.com/WebKit/WebKit/commit/cb0755380cf3f388f3ede04561972edad2a42ca0
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/ResourceLoadObserver.cpp

  Log Message:
  -----------
  Merge r235000 - Remove Adobe SSO exception now that StorageAccess API is available
https://bugs.webkit.org/show_bug.cgi?id=188710
<rdar://problem/35056707>

Reviewed by Alex Christensen.

Remove custom quirk now that proper API exists to allow the same functions.

* loader/ResourceLoadObserver.cpp:
(WebCore::ResourceLoadObserver::logSubresourceLoading): Remove unneeded quirk.
(WebCore::resourceNeedsSSOQuirk): Deleted.


  Commit: 21f1c500d1a45e8b369d05e67b73d22de58db803
      https://github.com/WebKit/WebKit/commit/21f1c500d1a45e8b369d05e67b73d22de58db803
  Author: Alex Christensen <achristensen at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSSelectorList.cpp
    M Source/WebCore/css/CSSSelectorList.h
    M Source/WebCore/css/StyleRule.cpp
    M Source/WebCore/css/parser/CSSParserImpl.cpp
    M Source/WebCore/css/parser/CSSSelectorParser.cpp

  Log Message:
  -----------
  Merge r235002 - Clean up CSSSelectorList after r234825
https://bugs.webkit.org/show_bug.cgi?id=188566

Patch by Alex Christensen <achristensen at webkit.org> on 2018-08-17
Reviewed by Megan Gardner.

This is responding to Darin's feedback in https://bugs.webkit.org/show_bug.cgi?id=188539

* css/CSSSelectorList.cpp:
(WebCore::CSSSelectorList::operator=): Deleted.
* css/CSSSelectorList.h:
(WebCore::CSSSelectorList::CSSSelectorList):
* css/parser/CSSParserImpl.cpp:
(WebCore::CSSParserImpl::parsePageSelector):
* css/parser/CSSSelectorParser.cpp:
(WebCore::CSSSelectorParser::consumeComplexSelectorList):
(WebCore::CSSSelectorParser::consumeCompoundSelectorList):


  Commit: 9f0f5038f4c6c290fead6cb7cf7688da338dbf28
      https://github.com/WebKit/WebKit/commit/9f0f5038f4c6c290fead6cb7cf7688da338dbf28
  Author: Tim Horton <thorton at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Configurations/BaseTarget.xcconfig
    M Source/WebKit/Shared/APIWebArchive.mm
    M Source/WebKit/Shared/APIWebArchiveResource.mm
    M Source/WebKit/Shared/NavigationActionData.cpp
    M Source/WebKit/Shared/RemoteLayerTree/RemoteLayerBackingStore.mm
    M Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreeTransaction.mm
    M Source/WebKit/Shared/WebPlatformTouchPoint.cpp
    M Source/WebKit/Shared/WebPopupItem.cpp
    M Source/WebKit/Shared/WebPreferencesStore.cpp
    M Source/WebKit/Shared/WebRenderLayer.cpp
    M Source/WebKit/Shared/cf/ArgumentCodersCF.cpp
    M Source/WebKit/Shared/gtk/WebEventFactory.cpp
    M Source/WebKit/Shared/ios/ChildProcessIOS.mm
    M Source/WebKit/Shared/mac/WebCoreArgumentCodersMac.mm
    M Source/WebKit/Shared/mac/WebEventFactory.mm
    M Source/WebKit/Shared/mac/WebMemorySampler.mac.mm
    A Source/WebKit/Sources.txt
    A Source/WebKit/SourcesCocoa.txt

  Log Message:
  -----------
  Merge r235006 - Start bringing up Unified Sources in WebKit2
https://bugs.webkit.org/show_bug.cgi?id=188703

Reviewed by Simon Fraser.

* Configurations/BaseTarget.xcconfig:
Add SRCROOT to the include path, so unified sources can find the source files.

* Shared/APIWebArchive.mm:
(API::releaseWebArchiveData):
(API::WebArchive::data):
(API::releaseCFData): Deleted.
* Shared/APIWebArchiveResource.mm:
(API::releaseWebArchiveResourceData):
(API::WebArchiveResource::data):
(API::releaseCFData): Deleted.
Disambiguate two static methods by renaming them.

* Shared/cf/ArgumentCodersCF.cpp:
Leave a comment about the bizarreness of this file.

* Shared/NavigationActionData.cpp:
(WebKit::NavigationActionData::decode):
* Shared/WebPlatformTouchPoint.cpp:
* Shared/WebPopupItem.cpp:
(WebKit::WebPopupItem::WebPopupItem):
(WebKit::WebPopupItem::decode):
* Shared/WebPreferencesStore.cpp:
* Shared/WebRenderLayer.cpp:
(WebKit::WebRenderLayer::create):
(WebKit::WebRenderLayer::createArrayFromLayerList):
(WebKit::WebRenderLayer::WebRenderLayer):
* Shared/gtk/WebEventFactory.cpp:
* Shared/mac/WebCoreArgumentCodersMac.mm:
* Shared/mac/WebEventFactory.mm:
(WebKit::WebEventFactory::createWebMouseEvent):
(WebKit::WebEventFactory::createWebWheelEvent):
(WebKit::WebEventFactory::createWebKeyboardEvent):
* Shared/mac/WebMemorySampler.mac.mm:
(WebKit::WebMemorySampler::sampleWebKit const):
* UIProcess/API/APIAutomationSessionClient.h:
(API::AutomationSessionClient::sessionIdentifier const):
(API::AutomationSessionClient::messageOfCurrentJavaScriptDialogOnPage):
* Shared/RemoteLayerTree/RemoteLayerBackingStore.mm:
(WebKit::RemoteLayerBackingStore::ensureBackingStore):
(WebKit::RemoteLayerBackingStore::setNeedsDisplay):
(WebKit::RemoteLayerBackingStore::backingStoreSize const):
(WebKit::RemoteLayerBackingStore::swapToValidFrontBuffer):
(WebKit::RemoteLayerBackingStore::display):
(WebKit::RemoteLayerBackingStore::drawInContext):
(WebKit::RemoteLayerBackingStore::applyBackingStoreToLayer):
* Shared/RemoteLayerTree/RemoteLayerTreeTransaction.mm:
(WebKit::RemoteLayerTreeTransaction::LayerCreationProperties::LayerCreationProperties):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::LayerProperties):
(WebKit::RemoteLayerTreeTransaction::LayerProperties::decode):
(WebKit::RemoteLayerTreeTransaction::decode):
(WebKit::RemoteLayerTreeTransaction::setRootLayerID):
(WebKit::RemoteLayerTreeTransaction::setDestroyedLayerIDs):
(WebKit::RemoteLayerTreeTransaction::setLayerIDsWithNewlyUnreachableBackingStore):
(WebKit::dumpChangedLayers):
(WebKit::RemoteLayerTreeTransaction::description const):
* Shared/WebPlatformTouchPoint.cpp:
(WebKit::WebPlatformTouchPoint::WebPlatformTouchPoint):
Get rid of lots of `using namespace`.

* Sources.txt: Added.
* SourcesCocoa.txt: Added.
* WebKit.xcodeproj/project.pbxproj:
Set up unified sources.
Right now, we only unify Platform/ and Shared/[^API].


  Commit: 6949238202bc2d3d2546c2f0c750f0e656af4600
      https://github.com/WebKit/WebKit/commit/6949238202bc2d3d2546c2f0c750f0e656af4600
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/cfa-expected-values-must-set-clobbered-to-false.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGCFAPhase.cpp

  Log Message:
  -----------
  Merge r235007 - intersectionOfPastValuesAtHead must filter values after they've observed an invalidation point
https://bugs.webkit.org/show_bug.cgi?id=188707
<rdar://problem/43015442>

Reviewed by Mark Lam.

JSTests:

* stress/cfa-expected-values-must-set-clobbered-to-false.js: Added.
(foo):
(let.comp.valueOf):
(result):

Source/JavaScriptCore:

We use the values in intersectionOfPastValuesAtHead to verify that it is safe to
OSR enter at the head of a block. We verify it's safe to OSR enter by checking
that each incoming value is compatible with its corresponding AbstractValue.

The bug is that we were sometimes filtering the intersectionOfPastValuesAtHead
with abstract values that were clobbererd. This meant that the value we're
verifying with at OSR entry effectively has an infinite structure set because
it's clobbered. So, imagine we have code like this:
```
---> We OSR enter here, and we're clobbered here
InvalidationPoint
GetByOffset(@base)
```

The abstract value for @base inside intersectionOfPastValuesAtHead has a
clobberred structure set, so we'd allow an incoming object with any
structure. However, this is wrong because the invalidation point is no
longer fulfilling its promise that it filters the structure that @base has.

We fix this by filtering the AbstractValues in intersectionOfPastValuesAtHead
as if the incoming value may be live past an InvalidationPoint.
This places a stricter requirement that to safely OSR enter at any basic
block, all incoming values must be compatible as if they lived past
the execution of an invalidation point.

* dfg/DFGCFAPhase.cpp:
(JSC::DFG::CFAPhase::run):


  Commit: 10c1cf7cc7c4441d09fb59f126d964785052f0f0
      https://github.com/WebKit/WebKit/commit/10c1cf7cc7c4441d09fb59f126d964785052f0f0
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Event.cpp
    M Source/WebCore/dom/Event.h

  Log Message:
  -----------
  Merge r235009 - Pack booleans in Event into a bitfield
https://bugs.webkit.org/show_bug.cgi?id=188713

Reviewed by Daniel Bates.

Use bitfields for booleans in Event class.

* dom/Event.cpp:
(WebCore::Event::Event):
* dom/Event.h:
(WebCore::Event::IsComposed): Added.
(WebCore::Event): Packed booleans into a bitfield.


  Commit: e63c40c5b62e3caca75a3265159e0982649a8869
      https://github.com/WebKit/WebKit/commit/e63c40c5b62e3caca75a3265159e0982649a8869
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/WebKitCompilerFlags.cmake

  Log Message:
  -----------
  Merge r235010 - Adjust CMAKE_MODULE_LINKER_FLAGS for asan
https://bugs.webkit.org/show_bug.cgi?id=188699

Reviewed by Konstantin Tokarev.

* Source/cmake/WebKitCompilerFlags.cmake:


  Commit: fb12eef73472b85aad5f0d5a1113d9c68435c2bf
      https://github.com/WebKit/WebKit/commit/fb12eef73472b85aad5f0d5a1113d9c68435c2bf
  Author: Ali Juma <ajuma at chromium.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/bounding-box-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/client-rect-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/containing-block-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/cross-origin-iframe-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/disconnect-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/display-none-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/edge-inclusive-intersection-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/iframe-no-root-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/inline-client-rect-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/isIntersecting-change-events-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/multiple-targets-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/multiple-thresholds-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/observer-without-js-reference-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/remove-element-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/root-margin-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/same-document-no-root-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/same-document-root-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/same-document-zero-size-target-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/shadow-content-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/text-target-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/timestamp-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/unclipped-root-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/zero-area-element-hidden-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/intersection-observer/zero-area-element-visible-expected.txt
    M LayoutTests/intersection-observer/root-element-deleted.html
    A LayoutTests/intersection-observer/root-element-moved-expected.txt
    A LayoutTests/intersection-observer/root-element-moved.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/Element.cpp
    M Source/WebCore/page/IntersectionObserver.cpp
    M Source/WebCore/page/IntersectionObserver.h
    M Source/WebCore/page/IntersectionObserver.idl
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/Internals.idl

  Log Message:
  -----------
  Merge r235014 - [IntersectionObserver] Fire an initial dummy notification
https://bugs.webkit.org/show_bug.cgi?id=188670

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

Rebaseline tests now that an initial notification is fired.

* web-platform-tests/intersection-observer/bounding-box-expected.txt:
* web-platform-tests/intersection-observer/client-rect-expected.txt:
* web-platform-tests/intersection-observer/containing-block-expected.txt:
* web-platform-tests/intersection-observer/cross-origin-iframe-expected.txt:
* web-platform-tests/intersection-observer/disconnect-expected.txt:
* web-platform-tests/intersection-observer/display-none-expected.txt:
* web-platform-tests/intersection-observer/edge-inclusive-intersection-expected.txt:
* web-platform-tests/intersection-observer/iframe-no-root-expected.txt:
* web-platform-tests/intersection-observer/inline-client-rect-expected.txt:
* web-platform-tests/intersection-observer/isIntersecting-change-events-expected.txt:
* web-platform-tests/intersection-observer/multiple-targets-expected.txt:
* web-platform-tests/intersection-observer/multiple-thresholds-expected.txt:
* web-platform-tests/intersection-observer/observer-without-js-reference-expected.txt:
* web-platform-tests/intersection-observer/remove-element-expected.txt:
* web-platform-tests/intersection-observer/root-margin-expected.txt:
* web-platform-tests/intersection-observer/same-document-no-root-expected.txt:
* web-platform-tests/intersection-observer/same-document-root-expected.txt:
* web-platform-tests/intersection-observer/same-document-zero-size-target-expected.txt:
* web-platform-tests/intersection-observer/shadow-content-expected.txt:
* web-platform-tests/intersection-observer/text-target-expected.txt:
* web-platform-tests/intersection-observer/timestamp-expected.txt:
* web-platform-tests/intersection-observer/unclipped-root-expected.txt:
* web-platform-tests/intersection-observer/zero-area-element-hidden-expected.txt:
* web-platform-tests/intersection-observer/zero-area-element-visible-expected.txt:

Source/WebCore:

Add logic to track ongoing intersection observations. Create an IntersectionObserverRegistration
and fire a single dummy notification for each one.

Test: intersection-observer/root-element-moved.html
Also tested by existing tests in imported/w3c/web-platform-tests/intersection-observer.

* dom/Document.cpp:
(WebCore::Document::~Document):
(WebCore::Document::addIntersectionObserver):
(WebCore::Document::removeIntersectionObserver):
(WebCore::Document::updateIntersectionObservations):
(WebCore::Document::notifyIntersectionObserversTimerFired):
* dom/Document.h:
(WebCore::Document::numberOfIntersectionObservers const):
* dom/Element.cpp:
(WebCore::Element::didMoveToNewDocument):
(WebCore::Element::disconnectFromIntersectionObservers):
* page/IntersectionObserver.cpp:
(WebCore::IntersectionObserver::create):
(WebCore::IntersectionObserver::IntersectionObserver):
(WebCore::IntersectionObserver::~IntersectionObserver):
(WebCore::IntersectionObserver::observe):
(WebCore::IntersectionObserver::unobserve):
(WebCore::IntersectionObserver::disconnect):
(WebCore::IntersectionObserver::takeRecords):
(WebCore::IntersectionObserver::targetDestroyed):
(WebCore::IntersectionObserver::removeTargetRegistration):
(WebCore::IntersectionObserver::removeAllTargets):
(WebCore::IntersectionObserver::rootDestroyed):
(WebCore::IntersectionObserver::appendQueuedEntry):
(WebCore::IntersectionObserver::notify):
* page/IntersectionObserver.h:
(WebCore::IntersectionObserver::trackingDocument):
(WebCore::IntersectionObserver:: const):
(WebCore::IntersectionObserver::hasObservationTargets const):
* page/IntersectionObserver.idl:
* testing/Internals.cpp:
(WebCore::Internals::numberOfIntersectionObservers const):
* testing/Internals.h:
* testing/Internals.idl:

LayoutTests:

* intersection-observer/root-element-deleted.html: Add additional assertions.
* intersection-observer/root-element-moved-expected.txt: Added.
* intersection-observer/root-element-moved.html: Added.


  Commit: 5cb0d8bac4eac933e173bbfb510a58b0ab5e37b9
      https://github.com/WebKit/WebKit/commit/5cb0d8bac4eac933e173bbfb510a58b0ab5e37b9
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/AssemblerBuffer.h
    M Source/JavaScriptCore/assembler/MacroAssemblerX86.h
    M Source/JavaScriptCore/assembler/X86Assembler.h
    M Source/JavaScriptCore/interpreter/InterpreterInlines.h
    M Source/WTF/ChangeLog
    M Source/WTF/WTF.xcodeproj/project.pbxproj
    M Source/WTF/wtf/CMakeLists.txt
    A Source/WTF/wtf/UnalignedAccess.h
    M Source/WTF/wtf/text/StringCommon.h

  Log Message:
  -----------
  Merge r235018 - [WTF] Add WTF::unalignedLoad and WTF::unalignedStore
https://bugs.webkit.org/show_bug.cgi?id=188716

Reviewed by Darin Adler.

Source/JavaScriptCore:

Use WTF::unalignedLoad and WTF::unalignedStore to avoid undefined behavior.
The compiler can emit appropriate mov operations in x86 even if we use these
helper functions.

* assembler/AssemblerBuffer.h:
(JSC::AssemblerBuffer::LocalWriter::putIntegralUnchecked):
(JSC::AssemblerBuffer::putIntegral):
(JSC::AssemblerBuffer::putIntegralUnchecked):
* assembler/MacroAssemblerX86.h:
(JSC::MacroAssemblerX86::readCallTarget):
* assembler/X86Assembler.h:
(JSC::X86Assembler::linkJump):
(JSC::X86Assembler::readPointer):
(JSC::X86Assembler::replaceWithHlt):
(JSC::X86Assembler::replaceWithJump):
(JSC::X86Assembler::setPointer):
(JSC::X86Assembler::setInt32):
(JSC::X86Assembler::setInt8):
* interpreter/InterpreterInlines.h:
(JSC::Interpreter::getOpcodeID): Embedded opcode may be misaligned. Actually UBSan detects misaligned accesses here.

Source/WTF:

While some CPUs allow unaligned accesses to memory, doing it in C++ with `reinterpret_cast<>` is
undefined behavior. This patch adds WTF::{unalignedLoad,unalignedStore} helper functions, which
can load from and store to the pointer in an unaligned manner.
Actual implementation uses `memcpy`. This can be optimized to direct unaligned access operations
in supported CPUs like x86. Even though a CPU does not support unaligned accesses, memcpy is still
safe and the compiler emits appropriate code.

We name these functions `unalignedLoad` and `unalignedStore` instead of `loadUnaligned` and `storeUnaligned`
in order to align them to `atomicLoad` and `atomicStore`.

* WTF.xcodeproj/project.pbxproj:
* wtf/CMakeLists.txt:
* wtf/UnalignedAccess.h: Added.
(WTF::unalignedLoad):
(WTF::unalignedStore):
* wtf/text/StringCommon.h:
(WTF::equal):
(WTF::loadUnaligned): Deleted.


  Commit: 74a35b7e886973d9f628363ffeba332ca7036f56
      https://github.com/WebKit/WebKit/commit/74a35b7e886973d9f628363ffeba332ca7036f56
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Event.cpp
    M Source/WebCore/dom/Event.h

  Log Message:
  -----------
  Merge r235020 - Shrink size of WebCore::Event further by reordering members
https://bugs.webkit.org/show_bug.cgi?id=188734

Reviewed by Daniel Bates.

Since WebCore::Event is ref-counted class, it has 4bytes m_refCount at the head of the class.
So placing 4bytes just after that before placing 8bytes aligned member (like pointers in 64bit
platforms) can save the size of WebCore::Event further.
This patch reorders members of WebCore::Event to shrink the size from 80bytes to 72bytes.

No behavior change.

* dom/Event.cpp:
(WebCore::Event::Event):
* dom/Event.h:


  Commit: f0b459f8222a36bdd0e76fe3353da65b56a7f263
      https://github.com/WebKit/WebKit/commit/f0b459f8222a36bdd0e76fe3353da65b56a7f263
  Author: Commit Queue <commit-queue at webkit.org>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssembler.h

  Log Message:
  -----------
  Merge r235021 - Unreviewed, rolling out r234852.
https://bugs.webkit.org/show_bug.cgi?id=188736

Workaround is not correct (Requested by yusukesuzuki on

Reverted changeset:

"[JSC] Should not rotate constant with 64"
https://bugs.webkit.org/show_bug.cgi?id=188556
https://trac.webkit.org/changeset/234852


  Commit: f9b4516999288698becb3e483136e91f9ae0a1a6
      https://github.com/WebKit/WebKit/commit/f9b4516999288698becb3e483136e91f9ae0a1a6
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/API/glib/JSCContext.cpp
    M Source/JavaScriptCore/API/glib/JSCContext.h
    M Source/JavaScriptCore/API/glib/JSCException.cpp
    M Source/JavaScriptCore/API/glib/JSCException.h
    M Source/JavaScriptCore/API/glib/docs/jsc-glib-4.0-sections.txt
    M Source/JavaScriptCore/ChangeLog
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/JavaScriptCore/glib/TestJSC.cpp

  Log Message:
  -----------
  Merge r235023 - [GLIB] Complete the JSCException API
https://bugs.webkit.org/show_bug.cgi?id=188695

Reviewed by Michael Catanzaro.

Source/JavaScriptCore:

Add more API to JSCException:
 - New function to get the column number
 - New function get exception as string (toString())
 - Add the possibility to create exceptions with a custom error name.
 - New function to get the exception error name
 - New function to get the exception backtrace.
 - New convenience function to report a exception by returning a formatted string with all the exception
   details, to be shown as a user error message.

* API/glib/JSCContext.cpp:
(jsc_context_throw_with_name):
* API/glib/JSCContext.h:
* API/glib/JSCException.cpp:
(jscExceptionEnsureProperties):
(jsc_exception_new):
(jsc_exception_new_with_name):
(jsc_exception_get_name):
(jsc_exception_get_column_number):
(jsc_exception_get_back_trace_string):
(jsc_exception_to_string):
(jsc_exception_report):
* API/glib/JSCException.h:
* API/glib/docs/jsc-glib-4.0-sections.txt:

Tools:

Add cases to test the new API.

* TestWebKitAPI/Tests/JavaScriptCore/glib/TestJSC.cpp:
(testJSCCheckSyntax):
(createCustomError):
(testJSCExceptions):


  Commit: 4fdf250797699dcbed7a6f768e60918d2c965ba4
      https://github.com/WebKit/WebKit/commit/4fdf250797699dcbed7a6f768e60918d2c965ba4
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/API/glib/JSCContext.cpp
    M Source/JavaScriptCore/API/glib/JSCContext.h
    M Source/JavaScriptCore/API/glib/JSCException.cpp
    M Source/JavaScriptCore/API/glib/JSCException.h
    M Source/JavaScriptCore/API/glib/docs/jsc-glib-4.0-sections.txt
    M Source/JavaScriptCore/ChangeLog
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/JavaScriptCore/glib/TestJSC.cpp

  Log Message:
  -----------
  Merge r235024 - [GLIB] Add API to throw exceptions using printf formatted strings
https://bugs.webkit.org/show_bug.cgi?id=188698

Reviewed by Michael Catanzaro.

Source/JavaScriptCore:

Add jsc_context_throw_printf() and jsc_context_throw_with_name_printf(). Also add new public constructors of
JSCException using printf formatted string.

* API/glib/JSCContext.cpp:
(jsc_context_throw_printf):
(jsc_context_throw_with_name_printf):
* API/glib/JSCContext.h:
* API/glib/JSCException.cpp:
(jsc_exception_new_printf):
(jsc_exception_new_vprintf):
(jsc_exception_new_with_name_printf):
(jsc_exception_new_with_name_vprintf):
* API/glib/JSCException.h:
* API/glib/docs/jsc-glib-4.0-sections.txt:

Tools:

Add cases to test the new API.

* TestWebKitAPI/Tests/JavaScriptCore/glib/TestJSC.cpp:
(createFormattedError):
(createCustomFormattedError):
(testJSCExceptions):


  Commit: 7e455d4a494ff59a53afbd6c8dbf992c0cfc226b
      https://github.com/WebKit/WebKit/commit/7e455d4a494ff59a53afbd6c8dbf992c0cfc226b
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/fetch/api/policies/referrer-origin-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/fetch/api/policies/referrer-origin-service-worker.https-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/fetch/api/policies/referrer-origin-worker-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/fetch/api/request/request-init-001.sub-expected.txt
    M LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/request/request-init-001.sub-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/fetch/FetchRequest.cpp

  Log Message:
  -----------
  Merge r235025 - Relax Request constructor around referrers
https://bugs.webkit.org/show_bug.cgi?id=168649

Patch by Rob Buis <rbuis at igalia.com> on 2018-08-20
Reviewed by Darin Adler.

LayoutTests/imported/w3c:

* web-platform-tests/fetch/api/policies/referrer-origin-expected.txt:
* web-platform-tests/fetch/api/policies/referrer-origin-service-worker.https-expected.txt:
* web-platform-tests/fetch/api/policies/referrer-origin-worker-expected.txt:
* web-platform-tests/fetch/api/request/request-init-001.sub-expected.txt:

Source/WebCore:

Implement remaining part of fetch change
https://github.com/whatwg/fetch/pull/377, i.e.
if "parsedReferrer’s origin is not same origin with origin",
then set request’s referrer to "client", instead of
throwing an exception [1].

WebKit's new behavior matches that of Chrome and Firefox.

Testing is covered by existing wpt tests.

[1] Step 15.3.3 of https://fetch.spec.whatwg.org/#main-fetch

* Modules/fetch/FetchRequest.cpp:
(WebCore::computeReferrer):

LayoutTests:

* platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/request/request-init-001.sub-expected.txt:


  Commit: 53ead6cec5b913a127a708da6719350a3dd9afb9
      https://github.com/WebKit/WebKit/commit/53ead6cec5b913a127a708da6719350a3dd9afb9
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp

  Log Message:
  -----------
  Merge r235026 - [SOUP] Check length before calling soup_message_body_append_buffer.
https://bugs.webkit.org/show_bug.cgi?id=176803

Reviewed by Carlos Garcia Campos.

Source/WebCore:

The function has a precondition that the buffer is non-empty.

Test: http/tests/local/blob/send-hybrid-blob-using-open-panel.html

* platform/network/soup/ResourceRequestSoup.cpp:
(WebCore::appendEncodedBlobItemToSoupMessageBody):
(WebCore::ResourceRequest::updateSoupMessageBody const):

LayoutTests:

* platform/gtk/TestExpectations: Enable test.


  Commit: f6a1fffef62928ffc35baa757f9789661bb94588
      https://github.com/WebKit/WebKit/commit/f6a1fffef62928ffc35baa757f9789661bb94588
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-08-20 (Mon, 20 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebsiteData/WebsiteDataRecord.cpp

  Log Message:
  -----------
  Merge r235036 - Unreviewed. Fix GTK/WPE cookie API tests after r234396.

* UIProcess/WebsiteData/WebsiteDataRecord.cpp:
(WebKit::WebsiteDataRecord::displayNameForCookieHostName): Bring back the check to handle localhost as an
special case for non cocoa ports.


  Commit: 99118b6ee8fcc5c4f60fd72afe60a3065d34d5ed
      https://github.com/WebKit/WebKit/commit/99118b6ee8fcc5c4f60fd72afe60a3065d34d5ed
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/dom/Window/open-invalid-url-expected.txt
    M LayoutTests/fast/dom/Window/open-invalid-url.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/url/failure-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/DOMWindow.cpp
    M Source/WebCore/page/DOMWindow.h
    M Source/WebCore/page/DOMWindow.idl
    M Source/WebCore/testing/Internals.cpp

  Log Message:
  -----------
  Merge r235050 - Throw an exception if window.open() gets passed a URL that cannot be parsed
https://bugs.webkit.org/show_bug.cgi?id=171656

Patch by Rob Buis <rbuis at igalia.com> on 2018-08-20
Reviewed by Darin Adler.

LayoutTests/imported/w3c:

* web-platform-tests/url/failure-expected.txt:

Source/WebCore:

Throw a SyntaxError exception when an invalid url gets passed into window.open().

Tests: imported/w3c/web-platform-tests/url/failure.html
       fast/dom/Window/open-invalid-url.html

* page/DOMWindow.cpp:
(WebCore::DOMWindow::createWindow):
(WebCore::DOMWindow::open):
(WebCore::DOMWindow::showModalDialog):
* page/DOMWindow.h:
* page/DOMWindow.idl:
* testing/Internals.cpp:
(WebCore::Internals::openDummyInspectorFrontend):

LayoutTests:

* fast/dom/Window/open-invalid-url-expected.txt:
* fast/dom/Window/open-invalid-url.html:


  Commit: b180f59e83e8fe2f4b7ca0bbe605ec090edf749a
      https://github.com/WebKit/WebKit/commit/b180f59e83e8fe2f4b7ca0bbe605ec090edf749a
  Author: Bernhard M. Wiedemann <bwiedemann at suse.de>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/glib/generate-inspector-gresource-manifest.py

  Log Message:
  -----------
  Merge r235080 - [GTK] Sort inspector GResource manifest to ensure reproducible builds
https://bugs.webkit.org/show_bug.cgi?id=188738

Patch by Bernhard M. Wiedemann <bwiedemann at suse.de> on 2018-08-20
Reviewed by Michael Catanzaro.

* glib/generate-inspector-gresource-manifest.py:
(get_filenames): sort list of input files


  Commit: c9b75770624e93baf6b5e792e64589ddd576d626
      https://github.com/WebKit/WebKit/commit/c9b75770624e93baf6b5e792e64589ddd576d626
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/PlatformKeyboardEvent.h
    M Source/WebKit/CMakeLists.txt
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformGTK.cmake
    M Source/WebKit/PlatformWin.cmake
    M Source/WebKit/Sources.txt
    M Source/WebKit/SourcesCocoa.txt
    M Source/WebKit/SourcesGTK.txt
    M Source/WebKit/SourcesWPE.txt

  Log Message:
  -----------
  Merge r235098 - [CMake] Sync unified build with Cocoa ports
https://bugs.webkit.org/show_bug.cgi?id=188732

Reviewed by Tim Horton.

Source/WebCore:

For iOS, disambiguate between ::WebEvent declared in PlatformKeyboardEvent.h and
WebCore::WebEvent declared in WebEvent.h. It's expected that we'll have to deal with random
issues like this when modifying unrelated source files in higher-level projects, since any
change to the sources list changes which files get bundled together, and headers from
lower-level projects that were not included before may now be included together.

* platform/PlatformKeyboardEvent.h:
(WebCore::PlatformKeyboardEvent::event const):

Source/WebKit:

Sync unified build with Cocoa ports. This enables unified build for WebKit/Platform and
WebKit/Shared.

Lots of files need to be moved around since the existing Sources.txt was not copied from
CMakeLists.txt. This replaces the Sources.txt with the sources list from CMakeList.txt.
Files that are not built for Cocoa are moved to SourcesGTK.txt, SourcesWPE.txt, and
PlatformWin.cmake. Files that are built only on Cocoa are moved to SourcesCocoa.txt. There's
plenty of room to determine if many of these files really need to be platform-specific in
the future, but let's not change that now.

Unfortunately, several files under Shared and PluginProcess need to be un-unified to be
usable for GTK's WebKitPluginProcess2. I've never managed to understand why, but it won't
link otherwise. Fortunately, this only affects a few files (listed in
PluginProcessGTK2_SOURCES), only a couple dozen of which are cross-platform.

* CMakeLists.txt:
* PlatformWin.cmake:
* Sources.txt:
* SourcesCocoa.txt:
* SourcesGTK.txt:
* SourcesWPE.txt:


  Commit: d88c831cfc82dcd03b30cef22e0daa0c87490e5a
      https://github.com/WebKit/WebKit/commit/d88c831cfc82dcd03b30cef22e0daa0c87490e5a
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/Cookies/WebCookieManager.cpp
    M Source/WebKit/NetworkProcess/Downloads/Download.cpp
    M Source/WebKit/NetworkProcess/Downloads/DownloadManager.cpp
    M Source/WebKit/NetworkProcess/Downloads/PendingDownload.cpp
    M Source/WebKit/NetworkProcess/Downloads/cocoa/DownloadCocoa.mm
    M Source/WebKit/NetworkProcess/FileAPI/NetworkBlobRegistry.cpp
    M Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp
    M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
    M Source/WebKit/NetworkProcess/NetworkContentRuleListManager.cpp
    M Source/WebKit/NetworkProcess/NetworkDataTask.cpp
    M Source/WebKit/NetworkProcess/NetworkDataTaskBlob.cpp
    M Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp
    M Source/WebKit/NetworkProcess/NetworkProcess.cpp
    M Source/WebKit/NetworkProcess/NetworkProcessPlatformStrategies.cpp
    M Source/WebKit/NetworkProcess/NetworkResourceLoadParameters.cpp
    M Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp
    M Source/WebKit/NetworkProcess/NetworkSession.cpp
    M Source/WebKit/NetworkProcess/NetworkSocketStream.cpp
    M Source/WebKit/NetworkProcess/PingLoad.cpp
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngine.cpp
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngineCache.cpp
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngineCaches.cpp
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngineConnection.cpp
    M Source/WebKit/NetworkProcess/cache/NetworkCache.cpp
    M Source/WebKit/NetworkProcess/capture/NetworkCaptureEvent.cpp
    M Source/WebKit/NetworkProcess/capture/NetworkCaptureManager.cpp
    M Source/WebKit/NetworkProcess/capture/NetworkCaptureRecorder.cpp
    M Source/WebKit/NetworkProcess/capture/NetworkCaptureReplayer.cpp
    M Source/WebKit/NetworkProcess/capture/NetworkDataTaskReplay.cpp
    M Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm
    M Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm
    M Source/WebKit/NetworkProcess/webrtc/NetworkMDNSRegister.cpp
    M Source/WebKit/Sources.txt
    M Source/WebKit/SourcesCocoa.txt

  Log Message:
  -----------
  Merge r235101 - Use unified build for NetworkProcess
https://bugs.webkit.org/show_bug.cgi?id=185011

Reviewed by Alex Christensen.

* NetworkProcess/Cookies/WebCookieManager.cpp:
* NetworkProcess/Downloads/Download.cpp:
* NetworkProcess/Downloads/DownloadManager.cpp:
* NetworkProcess/Downloads/PendingDownload.cpp:
* NetworkProcess/FileAPI/NetworkBlobRegistry.cpp:
* NetworkProcess/NetworkCORSPreflightChecker.cpp:
* NetworkProcess/NetworkConnectionToWebProcess.cpp:
* NetworkProcess/NetworkContentRuleListManager.cpp:
* NetworkProcess/NetworkDataTask.cpp:
* NetworkProcess/NetworkDataTaskBlob.cpp:
* NetworkProcess/NetworkLoadChecker.cpp:
* NetworkProcess/NetworkProcess.cpp:
* NetworkProcess/NetworkProcessPlatformStrategies.cpp:
* NetworkProcess/NetworkResourceLoadParameters.cpp:
* NetworkProcess/NetworkResourceLoader.cpp:
* NetworkProcess/NetworkSession.cpp:
* NetworkProcess/NetworkSocketStream.cpp:
* NetworkProcess/PingLoad.cpp:
* NetworkProcess/cache/CacheStorageEngine.cpp:
* NetworkProcess/cache/CacheStorageEngineCache.cpp:
* NetworkProcess/cache/CacheStorageEngineCaches.cpp:
* NetworkProcess/cache/CacheStorageEngineConnection.cpp:
* NetworkProcess/cache/NetworkCache.cpp:
* NetworkProcess/capture/NetworkCaptureEvent.cpp:
* NetworkProcess/capture/NetworkCaptureManager.cpp:
* NetworkProcess/capture/NetworkCaptureRecorder.cpp:
* NetworkProcess/capture/NetworkCaptureReplayer.cpp:
* NetworkProcess/capture/NetworkDataTaskReplay.cpp:
* NetworkProcess/webrtc/NetworkMDNSRegister.cpp:
* NetworkProcess/Downloads/cocoa/DownloadCocoa.mm:
(WebKit::Download::platformCancelNetworkLoad):
* NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
* NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(-[WKNetworkSessionDelegate URLSession:didBecomeInvalidWithError:]):
(-[WKNetworkSessionDelegate URLSession:dataTask:willCacheResponse:completionHandler:]):
Fix the build with unified sources.

* Sources.txt: Un- at no-unify NetworkProcess/*.
* SourcesCocoa.txt: Un- at no-unify NetworkProcess/*.


  Commit: 406d58087ddfcf10d675913e78c6c48498c7909d
      https://github.com/WebKit/WebKit/commit/406d58087ddfcf10d675913e78c6c48498c7909d
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/llint/LowLevelInterpreter.asm

  Log Message:
  -----------
  Merge r235102 - Fix the LLInt so that btjs shows vmEntryToJavaScript instead of llintPCRangeStart for the entry frame.
https://bugs.webkit.org/show_bug.cgi?id=188769

Reviewed by Michael Saboff.

* llint/LowLevelInterpreter.asm:
- Just put an unused instruction between llintPCRangeStart and vmEntryToJavaScript
  so that libunwind doesn't get confused by the 2 labels pointing to the same
  code address.


  Commit: 4cb22e71b75c8a0b58c0984e5e0d37836719b438
      https://github.com/WebKit/WebKit/commit/4cb22e71b75c8a0b58c0984e5e0d37836719b438
  Author: Devin Rousso <drousso at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/inspector/dom/breakpoint-for-event-listener-expected.txt
    A LayoutTests/inspector/dom/breakpoint-for-event-listener.html
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/inspector/protocol/DOM.json
    M Source/WebCore/ChangeLog
    M Source/WebCore/inspector/InspectorInstrumentation.cpp
    M Source/WebCore/inspector/InspectorInstrumentation.h
    M Source/WebCore/inspector/agents/InspectorDOMAgent.cpp
    M Source/WebCore/inspector/agents/InspectorDOMAgent.h
    M Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.cpp
    M Source/WebCore/inspector/agents/InspectorDOMDebuggerAgent.h
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/Localizations/en.lproj/localizedStrings.js
    M Source/WebInspectorUI/UserInterface/Controllers/DOMDebuggerManager.js
    M Source/WebInspectorUI/UserInterface/Controllers/DOMTreeManager.js
    M Source/WebInspectorUI/UserInterface/Controllers/EventBreakpointTreeController.js
    M Source/WebInspectorUI/UserInterface/Models/EventBreakpoint.js
    M Source/WebInspectorUI/UserInterface/Views/DebuggerSidebarPanel.js
    M Source/WebInspectorUI/UserInterface/Views/EventBreakpointTreeElement.js
    M Source/WebInspectorUI/UserInterface/Views/EventListenerSectionGroup.js

  Log Message:
  -----------
  Merge r235103 - Web Inspector: allow breakpoints to be set for specific event listeners
https://bugs.webkit.org/show_bug.cgi?id=183138

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

* inspector/protocol/DOM.json:
Add `setBreakpointForEventListener` and `removeBreakpointForEventListener`, each of which
takes an `eventListenerId` and toggles whether that specific usage of that event listener
should have a breakpoint and pause before running.

Source/WebCore:

Test: inspector/dom/breakpoint-for-event-listener.html

* inspector/agents/InspectorDOMAgent.h:
* inspector/agents/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::getEventListenersForNode):
(WebCore::InspectorDOMAgent::setEventListenerDisabled):
(WebCore::InspectorDOMAgent::setBreakpointForEventListener): Added.
(WebCore::InspectorDOMAgent::removeBreakpointForEventListener): Added.
(WebCore::InspectorDOMAgent::buildObjectForEventListener):
(WebCore::InspectorDOMAgent::willRemoveEventListener):
(WebCore::InspectorDOMAgent::isEventListenerDisabled):
(WebCore::InspectorDOMAgent::hasBreakpointForEventListener): Added.
(WebCore::InspectorDOMAgent::idForEventListener): Added.
Rework the event listener data structure to be based on ID instead of `EventListener`, since
it is possible to have the same `EventListener` be used for multiple events.

* inspector/agents/InspectorDOMDebuggerAgent.h:
* inspector/agents/InspectorDOMDebuggerAgent.cpp:
(WebCore::InspectorDOMDebuggerAgent::setEventListenerBreakpoint):
(WebCore::InspectorDOMDebuggerAgent::setInstrumentationBreakpoint):
(WebCore::InspectorDOMDebuggerAgent::removeEventListenerBreakpoint):
(WebCore::InspectorDOMDebuggerAgent::removeInstrumentationBreakpoint):
(WebCore::InspectorDOMDebuggerAgent::willHandleEvent): Added.
(WebCore::InspectorDOMDebuggerAgent::pauseOnNativeEventIfNeeded):
For DOM events, also check to see if there is a matching event listener specific breakpoint
set via the DOMAgent, and break on it if one is found.

* inspector/InspectorInstrumentation.h:
* inspector/InspectorInstrumentation.cpp:
(WebCore::InspectorInstrumentation::didInstallTimerImpl):
(WebCore::InspectorInstrumentation::didRemoveTimerImpl):
(WebCore::InspectorInstrumentation::willHandleEventImpl):
(WebCore::InspectorInstrumentation::willFireTimerImpl):
(WebCore::InspectorInstrumentation::pauseOnNativeEventIfNeeded):
(WebCore::InspectorInstrumentation::didRequestAnimationFrameImpl):
(WebCore::InspectorInstrumentation::didCancelAnimationFrameImpl):
(WebCore::InspectorInstrumentation::willFireAnimationFrameImpl):
Split off `pauseOnNativeEventIfNeeded` to only handle non-DOM events, since all DOM events
would already only go through `willHandleEvent`.

Source/WebInspectorUI:

* Localizations/en.lproj/localizedStrings.js:

* UserInterface/Models/EventBreakpoint.js:
(WI.EventBreakpoint):
(WI.EventBreakpoint.fromPayload): Added.
(WI.EventBreakpoint.prototype.get eventListener): Added.

* UserInterface/Controllers/DOMDebuggerManager.js:
(WI.DOMDebuggerManager):

* UserInterface/Controllers/DOMTreeManager.js:
(WI.DOMTreeManager):
(WI.DOMTreeManager.prototype.get eventBreakpoints): Added.
(WI.DOMTreeManager.prototype._setDocument):
(WI.DOMTreeManager.prototype.setEventListenerDisabled):
(WI.DOMTreeManager.prototype.setBreakpointForEventListener): Added.
(WI.DOMTreeManager.prototype.removeBreakpointForEventListener): Added.
(WI.DOMTreeManager.prototype.breakpointForEventListenerId): Added.

* UserInterface/Controllers/EventBreakpointTreeController.js:
(WI.EventBreakpointTreeController):

* UserInterface/Views/DebuggerSidebarPanel.js:
(WI.DebuggerSidebarPanel.prototype._updatePauseReasonSection):

* UserInterface/Views/EventListenerSectionGroup.js:
(WI.EventListenerSectionGroup):
(WI.EventListenerSectionGroup.prototype._createDisabledToggleRow):
(WI.EventListenerSectionGroup.prototype._createBreakpointToggleRow): Added.

* UserInterface/Views/EventBreakpointTreeElement.js:
(WI.EventBreakpointTreeElement):
(WI.EventBreakpointTreeElement.prototype.ondelete):
(WI.EventBreakpointTreeElement.prototype.populateContextMenu):
(WI.EventBreakpointTreeElement.prototype._toggleBreakpoint):

LayoutTests:

* inspector/dom/breakpoint-for-event-listener-expected.txt: Added.
* inspector/dom/breakpoint-for-event-listener.html: Added.


  Commit: bfb7e9f5f8e3480b38d76f649f259e30b6f043b3
      https://github.com/WebKit/WebKit/commit/bfb7e9f5f8e3480b38d76f649f259e30b6f043b3
  Author: Yusuke Suzuki <utatane.tea at gmail.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/characters-regexp-ignore-case.js
    A JSTests/stress/characters-regexp.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/LinkBuffer.h
    M Source/JavaScriptCore/runtime/Options.h
    M Source/JavaScriptCore/yarr/YarrJIT.cpp

  Log Message:
  -----------
  Merge r235104 - [YARR] Extend size of fixed characters bulk matching in 64bit platform
https://bugs.webkit.org/show_bug.cgi?id=181989

Patch by Yusuke Suzuki <utatane.tea at gmail.com> on 2018-08-20
Reviewed by Michael Saboff.

JSTests:

* stress/characters-regexp-ignore-case.js: Added.
(shouldBe):
(testH):
(testHe):
(testHel):
(testHell):
(testHello):
(testHelloW):
(testHelloWo):
(testHelloWor):
(testHelloWorl):
(testHelloWorld):
* stress/characters-regexp.js: Added.
(shouldBe):
(testH):
(testHe):
(testHel):
(testHell):
(testHello):
(testHelloW):
(testHelloWo):
(testHelloWor):
(testHelloWorl):
(testHelloWorld):

Source/JavaScriptCore:

This patch extends bulk matching style for fixed-sized characters.
In 64bit environment, the GPR can hold up to 8 characters. This change
reduces the code size since we can fuse multiple `mov` operations into one.

* assembler/LinkBuffer.h:
* runtime/Options.h:
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
(JSC::Yarr::YarrGenerator::compile):


  Commit: cb4065f2fd28d7447e6d00a0e23545f7883686cc
      https://github.com/WebKit/WebKit/commit/cb4065f2fd28d7447e6d00a0e23545f7883686cc
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/microbenchmarks/data-view-accesses-2.js
    A JSTests/microbenchmarks/data-view-accesses.js
    A JSTests/stress/dataview-jit-bounds-checks.js
    A JSTests/stress/dataview-jit-get.js
    A JSTests/stress/dataview-jit-neuter.js
    A JSTests/stress/dataview-jit-set.js
    A JSTests/stress/dataview-jit-unaligned-accesses.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
    M Source/JavaScriptCore/assembler/MacroAssemblerX86Common.h
    M Source/JavaScriptCore/assembler/X86Assembler.h
    M Source/JavaScriptCore/assembler/testmasm.cpp
    M Source/JavaScriptCore/bytecode/DataFormat.h
    M Source/JavaScriptCore/bytecode/SpeculatedType.cpp
    M Source/JavaScriptCore/bytecode/SpeculatedType.h
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/dfg/DFGUseKind.cpp
    M Source/JavaScriptCore/dfg/DFGUseKind.h
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/Intrinsic.cpp
    M Source/JavaScriptCore/runtime/Intrinsic.h
    M Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/TriState.h

  Log Message:
  -----------
  Merge r235106 - Inline DataView accesses into DFG/FTL
https://bugs.webkit.org/show_bug.cgi?id=188573
<rdar://problem/43286746>

Reviewed by Michael Saboff.

JSTests:

* microbenchmarks/data-view-accesses-2.js: Added.
(assert):
(let.p.of.Object.keys.let.str):
(let.p.of.Object.keys):
(test):
* microbenchmarks/data-view-accesses.js: Added.
(assert):
(let.p.of.Object.keys.let.str):
(let.p.of.Object.keys):
* stress/dataview-jit-bounds-checks.js: Added.
(assert):
(let.p.of.Object.keys.let.str):
(let.p.of.Object.keys):
* stress/dataview-jit-get.js: Added.
(assert):
(test1.bigEndian):
(test1.littleEndian):
(test1.biEndian):
(test1):
(test2.bigEndian):
(test2.littleEndian):
(test2.biEndian):
(test2):
(test3.bigEndian):
(test3.littleEndian):
(test3.biEndian):
(test3):
(test4.bigEndian):
(test4.littleEndian):
(test4.biEndian):
(test4):
(test5.bigEndian):
(test5.littleEndian):
(test5.biEndian):
(test5):
(test6.bigEndian):
(test6.littleEndian):
(test6.biEndian):
(test6):
(test7.load):
(test7):
(test8.load):
(test8):
* stress/dataview-jit-neuter.js: Added.
(assert):
(test.load):
(test):
(test2.load):
(test2):
* stress/dataview-jit-set.js: Added.
(assert):
(isLittleEndian):
(readByte):
(readHex):
(test.storeLittleEndian):
(test.storeBigEndian):
(test.store):
(test):
(test2.storeLittleEndian):
(test2.storeBigEndian):
(test2.store):
(test2):
(test3.storeLittleEndian):
(test3.storeBigEndian):
(test3.store):
(test3):
(test4.storeLittleEndian):
(test4.storeBigEndian):
(test4.store):
(test4):
(test5.storeLittleEndian):
(test5.storeBigEndian):
(test5.store):
(test5):
(test6.storeLittleEndian):
(test6.storeBigEndian):
(test6.store):
(test6):
(test7.store):
(test7):
(test8.store):
(test8):
* stress/dataview-jit-unaligned-accesses.js: Added.
(assert):
(let.p.of.Object.keys.let.str):
(let.p.of.Object.keys):

Source/JavaScriptCore:

This patch teaches the DFG/FTL to inline DataView accesses. The approach is
straight forward. We inline the various get*/set* operations as intrinsics.

This patch takes the most obvious approach for now. We OSR exit when:
- An isLittleEndian argument is provided, and is not a boolean.
- The index isn't an integer.
- The |this| isn't a DataView.
- We do an OOB access (or see a neutered array)

To implement this change in a performant way, this patch teaches the macro
assembler how to emit byte swap operations. The semantics of the added functions
are byteSwap + zero extend. This means for the 16bit byte swaps, we need
to actually emit zero extend instructions. For the 32/64bit byte swaps,
the instructions already have these semantics.

This patch is just a lightweight initial implementation. There are some easy
extensions we can do in future changes:
- Teach B3 how to byte swap: https://bugs.webkit.org/show_bug.cgi?id=188759
- CSE DataViewGet* nodes: https://bugs.webkit.org/show_bug.cgi?id=188768

* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::byteSwap16):
(JSC::MacroAssemblerARM64::byteSwap32):
(JSC::MacroAssemblerARM64::byteSwap64):
* assembler/MacroAssemblerX86Common.h:
(JSC::MacroAssemblerX86Common::byteSwap32):
(JSC::MacroAssemblerX86Common::byteSwap16):
(JSC::MacroAssemblerX86Common::byteSwap64):
* assembler/X86Assembler.h:
(JSC::X86Assembler::bswapl_r):
(JSC::X86Assembler::bswapq_r):
(JSC::X86Assembler::shiftInstruction16):
(JSC::X86Assembler::rolw_i8r):
(JSC::X86Assembler::X86InstructionFormatter::SingleInstructionBufferWriter::memoryModRM):
* assembler/testmasm.cpp:
(JSC::testByteSwap):
(JSC::run):
* bytecode/DataFormat.h:
* bytecode/SpeculatedType.cpp:
(JSC::dumpSpeculation):
(JSC::speculationFromClassInfo):
(JSC::speculationFromJSType):
(JSC::speculationFromString):
* bytecode/SpeculatedType.h:
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::hasHeapPrediction):
(JSC::DFG::Node::dataViewData):
* dfg/DFGNodeType.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::SafeToExecuteEdge::operator()):
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::speculateDataViewObject):
(JSC::DFG::SpeculativeJIT::speculate):
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGUseKind.cpp:
(WTF::printInternal):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):
(JSC::DFG::isCell):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::byteSwap32):
(JSC::FTL::DFG::LowerDFGToB3::byteSwap64):
(JSC::FTL::DFG::LowerDFGToB3::emitCodeBasedOnEndiannessBranch):
(JSC::FTL::DFG::LowerDFGToB3::compileDataViewGet):
(JSC::FTL::DFG::LowerDFGToB3::compileDataViewSet):
(JSC::FTL::DFG::LowerDFGToB3::lowDataViewObject):
(JSC::FTL::DFG::LowerDFGToB3::speculate):
(JSC::FTL::DFG::LowerDFGToB3::speculateDataViewObject):
* runtime/Intrinsic.cpp:
(JSC::intrinsicName):
* runtime/Intrinsic.h:
* runtime/JSDataViewPrototype.cpp:

Source/WTF:

* wtf/TriState.h:


  Commit: 0ceb206dac2315bb17a1ca2cb0fde15703b0f00b
      https://github.com/WebKit/WebKit/commit/0ceb206dac2315bb17a1ca2cb0fde15703b0f00b
  Author: Commit Queue <commit-queue at webkit.org>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merge r235108 - Unreviewed, rolling out r234979.
https://bugs.webkit.org/show_bug.cgi?id=188780

broke ubuntu LTS build (Requested by philn on #webkit).

Reverted changeset:

"[GTK] Never return an uninitialized ImageGStreamer object."
https://bugs.webkit.org/show_bug.cgi?id=188305
https://trac.webkit.org/changeset/234979


  Commit: ea385e3992162140f8d77683f11c373db2efaa17
      https://github.com/WebKit/WebKit/commit/ea385e3992162140f8d77683f11c373db2efaa17
  Author: Philippe Normand <philn at igalia.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/PlaybackPipeline.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamerPrivate.h

  Log Message:
  -----------
  Merge r235109 - [GStreamer][MSE] Remove parsers from playback pipeline
https://bugs.webkit.org/show_bug.cgi?id=188646

Patch by Philippe Normand <philn at igalia.com> on 2018-08-16
Reviewed by Xabier Rodriguez-Calvar.

Decodebin already includes parsers in front of the decoders.

No new tests, existing MSE tests cover this change.

* platform/graphics/gstreamer/mse/PlaybackPipeline.cpp:
(WebCore::PlaybackPipeline::addSourceBuffer):
(WebCore::PlaybackPipeline::attachTrack):
* platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp:
(webKitMediaSrcLinkSourcePad):
* platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamerPrivate.h:


  Commit: 5c6b41900a20849700e0e6ca4f810c4694638d99
      https://github.com/WebKit/WebKit/commit/5c6b41900a20849700e0e6ca4f810c4694638d99
  Author: Philippe Normand <philn at igalia.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamerPrivate.h

  Log Message:
  -----------
  Merge r235110 - [GStreamer][MSE] Generic main thread notification support
https://bugs.webkit.org/show_bug.cgi?id=188647

Patch by Philippe Normand <philn at igalia.com> on 2018-08-21
Reviewed by Xabier Rodriguez-Calvar.

Using GstBus for main thread notifications has the side effect of "leaking" the
application messages to the media player, leading to CPU cycles wasting.

No new tests, existing MSE tests cover this change.

* platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp:
(webkit_media_src_init):
(webKitMediaSrcFinalize):
(webKitMediaSrcSetMediaPlayerPrivate):
* platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamerPrivate.h:


  Commit: 5473bfa2c47f9fc285004864b2359b300290ccd9
      https://github.com/WebKit/WebKit/commit/5473bfa2c47f9fc285004864b2359b300290ccd9
  Author: Philippe Normand <philn at igalia.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r235112 - [GStreamer] Warn early about incomplete MSE track switching support
https://bugs.webkit.org/show_bug.cgi?id=188653

Patch by Philippe Normand <philn at igalia.com> on 2018-08-21
Reviewed by Xabier Rodriguez-Calvar.

The proper track switching support shall be fixed at some point by:
https://bugs.webkit.org/show_bug.cgi?id=182531.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::updateTracks): Remove redundant test.
(WebCore::MediaPlayerPrivateGStreamer::enableTrack): Exit early if
this method is called by the MSE player.


  Commit: 1142f62795944aaf96e34e4a0f7c9b3eefb751d3
      https://github.com/WebKit/WebKit/commit/1142f62795944aaf96e34e4a0f7c9b3eefb751d3
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/linux/MemoryFootprintLinux.cpp

  Log Message:
  -----------
  Merge r235113 - [Linux] Cache the memory footprint and only update it after 1 second
https://bugs.webkit.org/show_bug.cgi?id=188791

Reviewed by Yusuke Suzuki.

Getting the memory footprint is an expensive operation in Linux. When called multiple times, the CPU usage is
too much (see bug #188787). We could cache the result for at least 1 second to ensure we don't call it more than
once per second.

* wtf/linux/MemoryFootprintLinux.cpp:
(WTF::forEachLine):
(WTF::computeMemoryFootprint):
(WTF::memoryFootprint):


  Commit: b0aef601f776ec201a97e468b735e86691fe72c3
      https://github.com/WebKit/WebKit/commit/b0aef601f776ec201a97e468b735e86691fe72c3
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/track/AudioTrackList.cpp
    M Source/WebCore/html/track/TextTrackList.cpp
    M Source/WebCore/html/track/VideoTrackList.cpp
    M Source/WebCore/page/SecurityOriginData.cpp
    M Source/WebCore/page/TextIndicator.cpp
    M Source/WebCore/platform/geoclue/GeolocationProviderGeoclue.cpp
    M Source/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp
    M Source/WebCore/platform/graphics/win/FullScreenController.cpp
    M Source/WebCore/platform/mediastream/CaptureDeviceManager.cpp
    M Source/WebCore/platform/mock/MediaPlaybackTargetPickerMock.cpp
    M Source/WebCore/svg/animation/SMILTime.cpp
    M Source/WebCore/testing/js/WebCoreTestSupport.cpp
    M Source/WebCore/xml/XPathParser.cpp

  Log Message:
  -----------
  Merge r235115 - Don't place "using namespace XXX;" in global space for unified source builds
https://bugs.webkit.org/show_bug.cgi?id=188739

Reviewed by Yusuke Suzuki.

No new tests (No behavior change).

* html/track/AudioTrackList.cpp:
* html/track/TextTrackList.cpp:
* html/track/VideoTrackList.cpp:
* page/SecurityOriginData.cpp:
* page/TextIndicator.cpp:
* platform/geoclue/GeolocationProviderGeoclue.cpp:
* platform/graphics/gstreamer/ImageGStreamerCairo.cpp:
* platform/graphics/win/FullScreenController.cpp:
* platform/mediastream/CaptureDeviceManager.cpp:
* platform/mock/MediaPlaybackTargetPickerMock.cpp:
* svg/animation/SMILTime.cpp:
* testing/js/WebCoreTestSupport.cpp:
* xml/XPathParser.cpp:


  Commit: efbacb3904c176ff65ea19b8ac9dc70447ea545f
      https://github.com/WebKit/WebKit/commit/efbacb3904c176ff65ea19b8ac9dc70447ea545f
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M ChangeLog
    A Source/cmake/FindWPE.cmake
    R Source/cmake/FindWPEBackend.cmake
    M Source/cmake/OptionsWPE.cmake
    M Tools/ChangeLog
    M Tools/flatpak/org.webkit.WPE.yaml
    M Tools/wpe/jhbuild.modules

  Log Message:
  -----------
  Merge r235116 - [WPE] Update to use libwpe-1.0.0 and WPEBackend-fdo-1.0.0
https://bugs.webkit.org/show_bug.cgi?id=188782

Reviewed by Michael Catanzaro.

Make the build depend on wpe-0.2, and change the Flatpak and JHBuild development
environments to use version 1.0.0 of libwpe and WPEBackend-fdo.

.:

* Source/cmake/FindWPE.cmake: Renamed from Source/cmake/FindWPEBackend.cmake and changed
to check for libwpe-0.2.
* Source/cmake/OptionsWPE.cmake: Adapt to the rename to FindWPE.cmake.

Tools:

* flatpak/org.webkit.WPE.yaml: Update to use libwpe and WPEBackend-fdo version 1.0.0 from
release tarballs, and removed the (now unneeded) Lua and LuaJIT modules.
* wpe/jhbuild.modules: Ditto.


  Commit: 96580fd1701602bc96de1bc2501f92f1f07cbf49
      https://github.com/WebKit/WebKit/commit/96580fd1701602bc96de1bc2501f92f1f07cbf49
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit/CloseThenTerminate.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/CookieManager.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/DeferredViewInWindowStateChange.mm
    M Tools/TestWebKitAPI/Tests/WebKit/DidNotHandleKeyDown.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/DidRemoveFrameFromHiearchyInPageCache.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/EventModifiers.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/Find.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/FindMatches.mm
    M Tools/TestWebKitAPI/Tests/WebKit/ForceRepaint.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/FrameHandle.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/Geolocation.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/HitTestResultNodeHandle.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/InjectedBundleBasic.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/LimitTitleSize.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/LoadAlternateHTMLStringWithNonDirectoryURL.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/LoadCanceledNoServerRedirectCallback.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/LoadPageOnCrash.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/MenuTypesForMouseEvents.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/MouseMoveAfterCrash.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayoutFails.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/PageLoadBasic.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/PendingAPIRequestURL.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/ResizeWindowAfterCrash.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/RestoreSessionState.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/RestoreSessionStateContainingFormData.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/ScrollPinningBehaviors.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/SpacebarScrolling.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/StopLoadingDuringDidFailProvisionalLoad.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/TerminateTwice.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/TextFieldDidBeginAndEndEditing.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/UserMessage.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/WKPageConfiguration.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/WKPageCopySessionStateWithFiltering.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/WKPageGetScaleFactorNotZero.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/WKPageIsPlayingAudio.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/WKThumbnailView.mm
    M Tools/TestWebKitAPI/Tests/WebKit/WebArchive.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/mac/AttributedSubstringForProposedRangeWithImage.mm
    M Tools/TestWebKitAPI/Tests/WebKit/mac/ContextMenuDownload.mm
    M Tools/TestWebKitAPI/Tests/WebKit/mac/CustomBundleParameter.mm
    M Tools/TestWebKitAPI/Tests/WebKit/mac/EditorCommands.mm
    M Tools/TestWebKitAPI/Tests/WebKit/mac/GetPIDAfterAbortedProcessLaunch.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/mac/InjectedBundleAppleEvent.cpp
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/FullscreenDelegate.mm
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/PictureInPictureDelegate.mm
    M Tools/TestWebKitAPI/Tests/mac/FirstResponderScrollingPosition.mm
    M Tools/TestWebKitAPI/mac/WebKitAgnosticTest.mm

  Log Message:
  -----------
  Merge r235117 - Replace WKPageLoaderClient with WKPageNavigationClient in many API tests
https://bugs.webkit.org/show_bug.cgi?id=188771

Reviewed by Tim Horton.

* TestWebKitAPI/Tests/WebKit/CloseThenTerminate.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/CookieManager.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/DeferredViewInWindowStateChange.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/DidNotHandleKeyDown.cpp:
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/DidRemoveFrameFromHiearchyInPageCache.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/EventModifiers.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setClients):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/Find.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/FindMatches.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/ForceRepaint.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/FrameHandle.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/Geolocation.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/HitTestResultNodeHandle.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/InjectedBundleBasic.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/LimitTitleSize.cpp:
(TestWebKitAPI::didFinishLoadForFrame):
* TestWebKitAPI/Tests/WebKit/LoadAlternateHTMLStringWithNonDirectoryURL.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::loadAlternateHTMLString):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/LoadCanceledNoServerRedirectCallback.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/LoadPageOnCrash.cpp:
(TestWebKitAPI::WebKit2CrashLoader::WebKit2CrashLoader):
(TestWebKitAPI::didFinishLoad):
* TestWebKitAPI/Tests/WebKit/MenuTypesForMouseEvents.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/MouseMoveAfterCrash.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayoutFails.cpp:
(TestWebKitAPI::didFinishLoadForFrame):
* TestWebKitAPI/Tests/WebKit/PageLoadBasic.cpp:
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebKit/PendingAPIRequestURL.cpp:
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebKit/ResizeWindowAfterCrash.cpp:
(TestWebKitAPI::didFinishLoad):
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebKit/RestoreSessionState.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/RestoreSessionStateContainingFormData.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/ScrollPinningBehaviors.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishDocumentLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/SpacebarScrolling.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/StopLoadingDuringDidFailProvisionalLoad.cpp:
(TestWebKitAPI::didFailProvisionalNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFailProvisionalLoadWithErrorForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/TerminateTwice.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/TextFieldDidBeginAndEndEditing.cpp:
(TestWebKitAPI::WebKit2TextFieldBeginAndEditEditingTest::didFinishNavigation):
(TestWebKitAPI::WebKit2TextFieldBeginAndEditEditingTest::setPageLoaderClient):
(TestWebKitAPI::WebKit2TextFieldBeginAndEditEditingTest::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/UserMessage.cpp:
(TestWebKitAPI::WebKit2UserMessageRoundTripTest::didFinishNavigation):
(TestWebKitAPI::WebKit2UserMessageRoundTripTest::setPageLoaderClient):
(TestWebKitAPI::WebKit2UserMessageRoundTripTest::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/WKPageConfiguration.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/WKPageCopySessionStateWithFiltering.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/WKPageGetScaleFactorNotZero.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/WKPageIsPlayingAudio.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setUpClients):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/WKThumbnailView.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/WebArchive.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/mac/AttributedSubstringForProposedRangeWithImage.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/mac/ContextMenuDownload.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/mac/CustomBundleParameter.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/mac/EditorCommands.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/mac/GetPIDAfterAbortedProcessLaunch.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/mac/InjectedBundleAppleEvent.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKitCocoa/FullscreenDelegate.mm:
(didFinishNavigation):
(TestWebKitAPI::TEST):
(didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKitCocoa/PictureInPictureDelegate.mm:
(didFinishNavigation):
(TestWebKitAPI::TEST):
(didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/mac/FirstResponderScrollingPosition.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/mac/WebKitAgnosticTest.mm:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.


  Commit: 8a1bcffe87e57cdf939a20c11d665a2e81065260
      https://github.com/WebKit/WebKit/commit/8a1bcffe87e57cdf939a20c11d665a2e81065260
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/PlatformMac.cmake
    M Source/WebCore/SourcesCocoa.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm
    M Source/WebCore/editing/AlternativeTextController.cpp
    M Source/WebCore/editing/Editor.cpp
    M Source/WebCore/editing/Editor.h
    M Source/WebCore/editing/SpellChecker.cpp
    M Source/WebCore/editing/SpellChecker.h
    M Source/WebCore/editing/TextCheckingHelper.cpp
    M Source/WebCore/editing/TextCheckingHelper.h
    M Source/WebCore/loader/EmptyClients.cpp
    M Source/WebCore/platform/text/TextCheckerClient.h
    M Source/WebCore/platform/text/TextChecking.h
    A Source/WebCore/platform/text/mac/TextCheckingMac.mm
    M Source/WebCore/testing/Internals.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Scripts/webkit/messages.py
    M Source/WebKit/Shared/WebCoreArgumentCoders.cpp
    M Source/WebKit/UIProcess/Cocoa/WebViewImpl.mm
    M Source/WebKit/UIProcess/TextChecker.h
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/UIProcess/WebPageProxy.messages.in
    M Source/WebKit/UIProcess/gtk/TextCheckerGtk.cpp
    M Source/WebKit/UIProcess/ios/TextCheckerIOS.mm
    M Source/WebKit/UIProcess/mac/TextCheckerMac.mm
    M Source/WebKit/UIProcess/win/TextCheckerWin.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.h
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.h
    M Source/WebKitLegacy/mac/WebCoreSupport/WebEditorClient.mm
    M Source/WebKitLegacy/mac/WebView/WebView.mm

  Log Message:
  -----------
  Merge r235120 - Replace TextCheckingTypeMask with OptionSet
https://bugs.webkit.org/show_bug.cgi?id=188678

Reviewed by Antti Koivisto.

Source/WebCore:

Replaces TextCheckingTypeMask with an OptionSet to improve type safety and code clarity. Additionally
change the values of TextCheckingType such that all the enumerators fit within an uint8_t.

* PlatformMac.cmake:
* SourcesCocoa.txt:
* WebCore.xcodeproj/project.pbxproj:
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::hasMisspelling const):
* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(AXAttributeStringSetSpelling):
* editing/AlternativeTextController.cpp:
(WebCore::AlternativeTextController::timerFired):
(WebCore::AlternativeTextController::processMarkersOnTextToBeReplacedByResult):
* editing/Editor.cpp:
(WebCore::Editor::replaceSelectionWithFragment):
(WebCore::Editor::markMisspellingsAfterTypingToWord):
(WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
(WebCore::isAutomaticTextReplacementType):
(WebCore::Editor::markAndReplaceFor): For now, change a local variable from const to non-const to work
around the following MSVC compiler bug: <https://developercommunity.visualstudio.com/content/problem/316713/msvc-cant-compile-webkits-optionsetcontainsany.html>.
(WebCore::Editor::markMisspellingsAndBadGrammar):
(WebCore::Editor::updateMarkersForWordsAffectedByEditing):
(WebCore::Editor::editorUIUpdateTimerFired):
(WebCore::Editor::resolveTextCheckingTypeMask):
* editing/Editor.h:
* editing/SpellChecker.cpp:
(WebCore::SpellCheckRequest::SpellCheckRequest):
(WebCore::SpellCheckRequest::create):
(WebCore::SpellChecker::didCheckSucceed):
* editing/SpellChecker.h:
* editing/TextCheckingHelper.cpp:
(WebCore::findGrammaticalErrors):
(WebCore::findMisspellings):
(WebCore::TextCheckingHelper::findFirstMisspellingOrBadGrammar):
(WebCore::TextCheckingHelper::guessesForMisspelledOrUngrammaticalRange const):
(WebCore::checkTextOfParagraph):
* editing/TextCheckingHelper.h:
* loader/EmptyClients.cpp:
* platform/text/TextCheckerClient.h:
* platform/text/TextChecking.h: Remove TextCheckingTypeMask. Reorganized the fields of TextCheckingRequestData
to coallesce padding and move it to the end of class. Also used default initializer syntax and defaulted (= default)
the default constructor of TextCheckingRequestData, removing the need for a user-defined default constructor.
(WebCore::TextCheckingRequestData::TextCheckingRequestData):
(WebCore::TextCheckingRequestData::text const): Changed return type from String to const String&
to avoid unnecessary ref-count churn for callers that do not need to take a shared ownership in
this string.
(WebCore::TextCheckingRequestData::checkingTypes const): Renamed; formerly named mask.
(WebCore::TextCheckingRequestData::mask const): Deleted.
* platform/text/mac/TextCheckingMac.mm: Added.
(WebCore::nsTextCheckingTypes):
* testing/Internals.cpp:
(WebCore::Internals::handleAcceptedCandidate):

Source/WebKit:

* Scripts/webkit/messages.py: Add WebCore::TextCheckingType to the special case map so that
the generator knows what header has the definition for this type.
* Shared/WebCoreArgumentCoders.cpp:
(IPC::ArgumentCoder<TextCheckingRequestData>::encode):
(IPC::ArgumentCoder<TextCheckingRequestData>::decode):
* UIProcess/Cocoa/WebViewImpl.mm:
(WebKit::coreTextCheckingType):
(WebKit::textCheckingResultFromNSTextCheckingResult):
* UIProcess/TextChecker.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::checkTextOfParagraph):
* UIProcess/WebPageProxy.h:
* UIProcess/WebPageProxy.messages.in:
* UIProcess/gtk/TextCheckerGtk.cpp:
(WebKit::TextChecker::requestCheckingOfString):
(WebKit::TextChecker::checkTextOfParagraph): Also simplified return expressions.
* UIProcess/ios/TextCheckerIOS.mm:
(WebKit::TextChecker::checkTextOfParagraph):
* UIProcess/mac/TextCheckerMac.mm:
(WebKit::TextChecker::checkTextOfParagraph):
* UIProcess/win/TextCheckerWin.cpp:
(WebKit::TextChecker::checkTextOfParagraph):
* WebProcess/WebCoreSupport/WebEditorClient.cpp:
(WebKit::WebEditorClient::shouldEraseMarkersAfterChangeSelection const):
(WebKit::WebEditorClient::checkTextOfParagraph):
* WebProcess/WebCoreSupport/WebEditorClient.h:

Source/WebKitLegacy/mac:

Currently we have code in WebEditorClient::checkTextOfParagraph() that incorrectly assumes
that the enumerators of TextCheckingType have a one-to-one correspondence with NSTextCheckingType.
(This is not the case because there is not corresponding NSTextCheckingType for TextCheckingTypeShowCorrectionPanel).
We now explicitly convert from OptionSet<TextCheckingType> to NSTextCheckingTypes.

* WebCoreSupport/WebEditorClient.h:
* WebCoreSupport/WebEditorClient.mm:
(WebEditorClient::checkTextOfParagraph):
(WebEditorClient::shouldEraseMarkersAfterChangeSelection const):
(core): Fix up code style nits; compare resultType on the right-hand side instead of the
left as this is more readable and unncessary now that modern compilers like Clang have
diagnostics to catch accidental assignments when equality was intended.
(WebEditorClient::didCheckSucceed):
* WebView/WebView.mm:
(coreTextCheckingType):
(textCheckingResultFromNSTextCheckingResult):


  Commit: 465e376de469eef8979d18ce3dbc228f3387093d
      https://github.com/WebKit/WebKit/commit/465e376de469eef8979d18ce3dbc228f3387093d
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/history/go-back-to-object-subframe-expected.txt
    A LayoutTests/fast/history/go-back-to-object-subframe.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp

  Log Message:
  -----------
  Merge r235121 - Disallow navigations when page cache updates the current document of the frame
https://bugs.webkit.org/show_bug.cgi?id=188422

Reviewed by Ryosuke Niwa.

Source/WebCore:

Make use of NavigationDisabler to disallow navigations when associating the cached
document back with its frame (i.e. calling Frame::setDocument()).

When we associate a cached document with its frame we will construct its render tree
and run post style resolution callbacks that can do anything, including performing
a frame load. Until page restoration is comnplete the frame tree is in a transient
state that makes reasoning about it difficult and error prone. We should not allow
navigations in this state.

Test: fast/history/go-back-to-object-subframe.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::open):

LayoutTests:

Add a test case that ensures that we do not hit the assertion ASSERT(ownerFrame || m_frame.isMainFrame())
in FrameLoader::addExtraFieldsToRequest() when navigating back to a page that loads a nested
page, whose URL contains a fragment, via an HTML object element. This assertion fails if
navigations are allowed when restoring a page from the page cache.

This change does not prevent navigations initiated from a pageshow event handler.

* fast/history/go-back-to-object-subframe-expected.txt: Added.
* fast/history/go-back-to-object-subframe.html: Added.


  Commit: 87ff37e0060beebd2914ad13866876220614cc1f
      https://github.com/WebKit/WebKit/commit/87ff37e0060beebd2914ad13866876220614cc1f
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit/AboutBlankLoad.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/EphemeralSessionPushStateNoHistoryCallback.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/FailedLoad.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/FrameMIMETypeHTML.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/FrameMIMETypePNG.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/LayoutMilestonesWithAllContentInFrame.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayoutFrames.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/PageLoadBasic.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/PageLoadDidChangeLocationWithinPageForFrame.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/PrivateBrowsingPushStateNoHistoryCallback.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/WKBundleFileHandle.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/mac/RestoreStateAfterTermination.mm
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/CommandBackForward.mm

  Log Message:
  -----------
  Merge r235123 - Transition more API tests from WKPageLoaderClient to WKPageNavigationClient
https://bugs.webkit.org/show_bug.cgi?id=188797

Reviewed by Tim Horton.

* TestWebKitAPI/Tests/WebKit/AboutBlankLoad.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/EphemeralSessionPushStateNoHistoryCallback.cpp:
(TestWebKitAPI::didSameDocumentNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didSameDocumentNavigationForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/FailedLoad.cpp:
(TestWebKitAPI::didFailProvisionalNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFailProvisionalLoadWithErrorForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/FrameMIMETypeHTML.cpp:
(TestWebKitAPI::didStartProvisionalNavigation):
(TestWebKitAPI::didCommitNavigation):
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didStartProvisionalLoadForFrame): Deleted.
(TestWebKitAPI::didCommitLoadForFrame): Deleted.
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/FrameMIMETypePNG.cpp:
(TestWebKitAPI::didStartProvisionalNavigation):
(TestWebKitAPI::didCommitNavigation):
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didStartProvisionalLoadForFrame): Deleted.
(TestWebKitAPI::didCommitLoadForFrame): Deleted.
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/LayoutMilestonesWithAllContentInFrame.cpp:
(TestWebKitAPI::renderingProgressDidChange):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didLayout): Deleted.
* TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayoutFrames.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::renderingProgressDidChange):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
(TestWebKitAPI::didLayout): Deleted.
* TestWebKitAPI/Tests/WebKit/PageLoadBasic.cpp:
(TestWebKitAPI::State::State):
(TestWebKitAPI::didStartProvisionalNavigation):
(TestWebKitAPI::didCommitNavigation):
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::decidePolicyForNavigationAction):
(TestWebKitAPI::decidePolicyForResponse):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didStartProvisionalLoadForFrame): Deleted.
(TestWebKitAPI::didCommitLoadForFrame): Deleted.
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
(TestWebKitAPI::decidePolicyForNewWindowAction): Deleted.
* TestWebKitAPI/Tests/WebKit/PageLoadDidChangeLocationWithinPageForFrame.cpp:
(TestWebKitAPI::didSameDocumentNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
(TestWebKitAPI::didSameDocumentNavigationForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/PrivateBrowsingPushStateNoHistoryCallback.cpp:
(TestWebKitAPI::TEST):
(TestWebKitAPI::didSameDocumentNavigationForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/ReloadPageAfterCrash.cpp:
(TestWebKitAPI::didFinishLoad):
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebKit/WKBundleFileHandle.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/mac/RestoreStateAfterTermination.mm:
(TestWebKitAPI::didFinishLoad):
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/WebKitCocoa/CommandBackForward.mm:
(WebKit2_CommandBackForwardTestWKView::SetUp):
(WebKit2_CommandBackForwardTestWKView::didFinishLoadForFrame): Deleted.


  Commit: 12180091598f62841eaa4044ee0dd03f10860167
      https://github.com/WebKit/WebKit/commit/12180091598f62841eaa4044ee0dd03f10860167
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h

  Log Message:
  -----------
  Merge r235133 - Increment NetworkCache::Storage::lastStableVersion after r233742
https://bugs.webkit.org/show_bug.cgi?id=188798
<rdar://43561761>

Reviewed by Geoffrey Garen.

* NetworkProcess/cache/NetworkCacheStorage.h:


  Commit: 2a3146e2e7a21578405b9ca668f31dc93607971d
      https://github.com/WebKit/WebKit/commit/2a3146e2e7a21578405b9ca668f31dc93607971d
  Author: Joseph Pecoraro <pecoraro at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    A Source/WebInspectorUI/UserInterface/Images/Rulers.svg

  Log Message:
  -----------
  Merge r235134 - Web Inspector: Rulers.svg is missing
https://bugs.webkit.org/show_bug.cgi?id=188806
<rdar://problem/43574273>

Patch by Joseph Pecoraro <pecoraro at apple.com> on 2018-08-21
Reviewed by Devin Rousso.

* UserInterface/Images/Rulers.svg: Added.


  Commit: 345651b5e78be17d5e588d0077f7bb1f03c30bf9
      https://github.com/WebKit/WebKit/commit/345651b5e78be17d5e588d0077f7bb1f03c30bf9
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayout.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayoutFails.cpp
    M Tools/TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayoutForImages.cpp

  Log Message:
  -----------
  Merge r235138 - Transition more API tests from WKPageLoaderClient to WKPageNavigationClient
https://bugs.webkit.org/show_bug.cgi?id=188813

Reviewed by Andy Estes.

* TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayout.cpp:
(TestWebKitAPI::didLayout):
(TestWebKitAPI::setPageLoaderClient):
* TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayoutFails.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::didLayout):
(TestWebKitAPI::setPageLoaderClient):
(TestWebKitAPI::didFinishLoadForFrame): Deleted.
* TestWebKitAPI/Tests/WebKit/NewFirstVisuallyNonEmptyLayoutForImages.cpp:
(TestWebKitAPI::didLayout):
(TestWebKitAPI::setPageLoaderClient):


  Commit: 968fdef59654229d7a2f367d586994ffa296eb3b
      https://github.com/WebKit/WebKit/commit/968fdef59654229d7a2f367d586994ffa296eb3b
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/C/WKPageRenderingProgressEvents.h
    M Source/WebKit/UIProcess/API/C/WKPageRenderingProgressEventsInternal.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit/ResizeReversePaginatedWebView.cpp

  Log Message:
  -----------
  Merge r235148 - Transition ResizeReversePaginatedWebView API test from WKPageLoaderClient to WKPageNavigationClient
https://bugs.webkit.org/show_bug.cgi?id=188821

Reviewed by Simon Fraser.

Source/WebKit:

Add some more values to WKPageRenderingProgressEvents which were already supported by _WKRenderingProgressEvents and WKLayoutMilestones.

* UIProcess/API/C/WKPageRenderingProgressEvents.h:
* UIProcess/API/C/WKPageRenderingProgressEventsInternal.h:
(pageRenderingProgressEvents):

Tools:

* TestWebKitAPI/Tests/WebKit/ResizeReversePaginatedWebView.cpp:
(TestWebKitAPI::didLayout):
(TestWebKitAPI::TEST):


  Commit: 1f0d453e7b63174d0506911c7163126b504e474c
      https://github.com/WebKit/WebKit/commit/1f0d453e7b63174d0506911c7163126b504e474c
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Element.cpp
    M Source/WebCore/dom/KeyboardEvent.cpp
    M Source/WebCore/dom/MouseEvent.cpp
    M Source/WebCore/dom/MouseEvent.h
    M Source/WebCore/dom/MouseRelatedEvent.cpp
    M Source/WebCore/dom/MouseRelatedEvent.h
    M Source/WebCore/dom/SimulatedClick.cpp
    M Source/WebCore/dom/TouchEvent.cpp
    M Source/WebCore/dom/TouchEvent.h
    M Source/WebCore/dom/UIEventWithKeyState.h
    M Source/WebCore/dom/WheelEvent.cpp
    M Source/WebCore/page/EventHandler.cpp
    M Source/WebCore/platform/PlatformEvent.h
    M Source/WebCore/platform/mac/PlatformEventFactoryMac.h
    M Source/WebCore/platform/mac/PlatformEventFactoryMac.mm
    M Source/WebCore/testing/Internals.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKitLegacy/ios/ChangeLog
    M Source/WebKitLegacy/ios/WebView/WebPDFViewPlaceholder.mm
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebView/WebPDFView.mm

  Log Message:
  -----------
  Merge r235158 - Replace booleans for modifier keys in UIEventWithKeyState with OptionSet<Modifier>
https://bugs.webkit.org/show_bug.cgi?id=188777

Reviewed by Simon Fraser.

Source/WebCore:

Replaced boolean arguments and instance variables for modifier keys (ctrl, alt, shift, and meta keys) in
UIEventWithKeyState with OptionSet<Modifier> and isSimulated boolean in MouseRelatedEvent with IsSimulated
enum class.

Also made movementDelta always compiled instead of only when ENABLE(POINTER_LOCK) to simplify the code.

No new tests since there should be no observable behavioral change.

* dom/Element.cpp:
(WebCore::Element::dispatchMouseEvent):
* dom/KeyboardEvent.cpp:
(WebCore::KeyboardEvent::KeyboardEvent):
(WebCore::KeyboardEvent::initKeyboardEvent): Call setModifierKeys.
* dom/MouseEvent.cpp:
(WebCore::MouseEvent::create):
(WebCore::MouseEvent::MouseEvent):
(WebCore::MouseEvent::initMouseEvent): Ditto.
* dom/MouseEvent.h:
* dom/MouseRelatedEvent.cpp:
(WebCore::MouseRelatedEvent::MouseRelatedEvent): Added a new variant which takes the minimum arguments
for gesture & touch events. In those events, detail is always set to 0, movementDelta is always set to 0,0,
and they are never simulated.
* dom/MouseRelatedEvent.h:
(WebCore::MouseRelatedEvent::IsSimulated): Added.
* dom/SimulatedClick.cpp:
(WebCore::SimulatedMouseEvent::SimulatedMouseEvent): Get OptionSet<Modifier> out of the underlying event
instead of manually setting each key state. This code now preserves the state of caps lock and alt-graph
keys but this is not observable because we have yet to implement getModifierState on MouseEvent.
(WebCore::SimulatedMouseEvent::modifiersFromUnderlyingEvent): Added.
* dom/TouchEvent.cpp:
(WebCore::TouchEvent::TouchEvent):
* dom/TouchEvent.h:
* dom/UIEventWithKeyState.h:
(WebCore::UIEventWithKeyState::Modifier): Alias to PlatformEvent::Modifier.
(WebCore::UIEventWithKeyState::ctrlKey const): Updated to use m_modifiers.
(WebCore::UIEventWithKeyState::shiftKey const): Ditto.
(WebCore::UIEventWithKeyState::altKey const): Ditto.
(WebCore::UIEventWithKeyState::metaKey const): Ditto.
(WebCore::UIEventWithKeyState::altGraphKey const): Ditto.
(WebCore::UIEventWithKeyState::capsLockKey const): Ditto.
(WebCore::UIEventWithKeyState::modifierKeys): Added.
(WebCore::UIEventWithKeyState::UIEventWithKeyState): Now takes OptionSet<Modifier>.
(WebCore::UIEventWithKeyState::setModifierKeys): Added. Used by init*Event functions in subclasses. Note that
these functions preseve the states of alt-graph and caps lock keys to match the existing behaviors in this
cleanup patch but they don't match behaviors of Chrome or Firefox.
(WebCore::UIEventWithKeyState::modifiersFromInitializer): Added.
* dom/WheelEvent.cpp:
(WebCore::WheelEvent::WheelEvent): Simulated::No corresponds to the last boolean being false.
* page/EventHandler.cpp:
(WebCore::EventHandler::dispatchDragEvent):
(WebCore::EventHandler::handleTouchEvent):
* platform/PlatformEvent.h:
(WebCore::PlatformEvent::Modifier): Added AltGraphKey.
* platform/mac/PlatformEventFactoryMac.h:
(WebCore::modifiersForEvent): Exported to be used in [WebPDFView PDFViewWillClickOnLink:withURL:].
* platform/mac/PlatformEventFactoryMac.mm:
(WebCore::modifiersForEvent):
* testing/Internals.cpp:
(WebCore::Internals::accessKeyModifiers const):

Source/WebKit:

Added two FIXMEs.

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::navigateToPDFLinkWithSimulatedClick):

Source/WebKitLegacy/ios:

Create MouseEvent::create with IsSimulated set to Yes; correspoding to the last argument
being "true" before the code change.

* WebView/WebPDFViewPlaceholder.mm:
(-[WebPDFViewPlaceholder simulateClickOnLinkToURL:]):

Source/WebKitLegacy/mac:

Create MouseEvent::create with IsSimulated set to Yes; correspoding to the last argument
being "true" before the code change.

Use modifiersForEvent to convert [nsEvent modifierFlags] to OptionSet<Modifier>.

* WebView/WebPDFView.mm:
(-[WebPDFView PDFViewWillClickOnLink:withURL:]):


  Commit: f6e5498347c69a4f5797686d7c30aec3506df294
      https://github.com/WebKit/WebKit/commit/f6e5498347c69a4f5797686d7c30aec3506df294
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssembler.h

  Log Message:
  -----------
  Merge r235160 - [JSC] Should not rotate constant with 64
https://bugs.webkit.org/show_bug.cgi?id=188556

Reviewed by Saam Barati.

To defend against JIT splaying, we rotate a constant with a randomly generated seed.
But if a seed becomes 64 or 0, the following code performs `value << 64` or `value >> 64`
where value's type is uint64_t, and they cause undefined behaviors (UBs). This patch limits
the seed in the range of [1, 63] not to generate code causing UBs. This is found by UBSan.

* assembler/MacroAssembler.h:
(JSC::MacroAssembler::generateRotationSeed):
(JSC::MacroAssembler::rotationBlindConstant):


  Commit: 9c2e22c023710523616015fe3bcdcdf671350cbc
      https://github.com/WebKit/WebKit/commit/9c2e22c023710523616015fe3bcdcdf671350cbc
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/HeapUtil.h

  Log Message:
  -----------
  Merge r235161 - [JSC] HeapUtil should care about pointer overflow
https://bugs.webkit.org/show_bug.cgi?id=188740

Reviewed by Saam Barati.

`pointer - sizeof(IndexingHeader) - 1` causes an undefined behavior if a pointer overflows.
For example, if `pointer` is nullptr, it causes pointer overflow. Instead of calculating this
with `char*` pointer, we cast it to `uintptr_t` temporarily. This issue is found by UBSan.

* heap/HeapUtil.h:
(JSC::HeapUtil::findGCObjectPointersForMarking):


  Commit: df80447259192cd8fa5469bc081a24bcc8c042f8
      https://github.com/WebKit/WebKit/commit/df80447259192cd8fa5469bc081a24bcc8c042f8
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayerCompositor.cpp

  Log Message:
  -----------
  Merge r235162 - Do not try to update the compositing policy when not in accelerated compositing mode
https://bugs.webkit.org/show_bug.cgi?id=188787

Reviewed by Simon Fraser.

RenderLayerCompositor::updateCompositingPolicy() is called very often (called from
RenderLayerCompositor::cacheAcceleratedCompositingFlags()) and it uses WTF::memoryFootprint() to decide the
current compositing policy. Getting the memory footprint is an expensive operation in Linux (and I suspect other
non-cocoa ports too), causing an excessive CPU usage. This caused the WPE and GTK+ unit test
/webkit/WebKitWebContext/uri-scheme to start timing out in the bots, because the test expects things to happen
fast and that's no longer the case. We could reduce the CPU usage a lot by not trying to update the policy when
not in accelerated compositing mode. We will need a solution for the accelerated compositing mode, though.

Fixes WPE/GTK+ unit test /webkit/WebKitWebContext/uri-scheme.

* rendering/RenderLayerCompositor.cpp:
(WebCore::RenderLayerCompositor::updateCompositingPolicy): Return early when not in accelerated compositing mode.


  Commit: db2b31400567825568a0ca246f78f29740ed0bc4
      https://github.com/WebKit/WebKit/commit/db2b31400567825568a0ca246f78f29740ed0bc4
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitUserContent.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitUserContentManager.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitUserContentPrivate.h
    M Source/WebKit/UIProcess/API/gtk/WebKitUserContent.h
    M Source/WebKit/UIProcess/API/gtk/WebKitUserContentManager.h
    M Source/WebKit/UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt
    M Source/WebKit/UIProcess/API/wpe/WebKitUserContent.h
    M Source/WebKit/UIProcess/API/wpe/WebKitUserContentManager.h
    M Source/WebKit/WebProcess/UserContent/WebUserContentController.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitUserContentManager.cpp

  Log Message:
  -----------
  Merge r235282 - [GTK][WPE] Add API to inject/register user content in isolated worlds
https://bugs.webkit.org/show_bug.cgi?id=188883

Reviewed by Michael Catanzaro.

Source/WebKit:

Add new API to create user scripts/stylesheets for a given script world and to register/unregister user script
messages in a given script world.

* UIProcess/API/glib/WebKitUserContent.cpp:
(webkitUserContentWorld):
(_WebKitUserStyleSheet::_WebKitUserStyleSheet):
(webkit_user_style_sheet_new):
(webkit_user_style_sheet_new_for_world):
(_WebKitUserScript::_WebKitUserScript):
(webkit_user_script_new):
(webkit_user_script_new_for_world):
* UIProcess/API/glib/WebKitUserContentManager.cpp:
(webkit_user_content_manager_register_script_message_handler_in_world):
(webkit_user_content_manager_unregister_script_message_handler_in_world):
* UIProcess/API/glib/WebKitUserContentPrivate.h:
* UIProcess/API/gtk/WebKitUserContent.h:
* UIProcess/API/gtk/WebKitUserContentManager.h:
* UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt:
* UIProcess/API/wpe/WebKitUserContent.h:
* UIProcess/API/wpe/WebKitUserContentManager.h:
* WebProcess/UserContent/WebUserContentController.cpp:
(WebKit::WebUserContentController::addUserContentWorlds):

Tools:

Add test cases for the new API.

* TestWebKitAPI/Tests/WebKitGLib/TestWebKitUserContentManager.cpp:
(isStyleSheetInjectedForURLAtPath):
(isScriptInjectedForURLAtPath):
(testUserContentManagerInjectedStyleSheet):
(testUserContentManagerInjectedScript):
(UserScriptMessageTest::registerHandler):
(UserScriptMessageTest::unregisterHandler):
(UserScriptMessageTest::postMessageAndWaitUntilReceived):
(testUserContentManagerScriptMessageInWorldReceived):
(beforeAll):


  Commit: 53cf7b581cd25aa2e746ae3fb0ea55da48f52a60
      https://github.com/WebKit/WebKit/commit/53cf7b581cd25aa2e746ae3fb0ea55da48f52a60
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M Source/WebKit/gtk/NEWS

  Log Message:
  -----------
  Unreviewed. Fix GTK+ NEWS file formatting

I broke it by mistake when releasing 2.21.91


  Commit: 1f66e45c58ad637f924048abc03ab94fa940f4be
      https://github.com/WebKit/WebKit/commit/1f66e45c58ad637f924048abc03ab94fa940f4be
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-08-24 (Fri, 24 Aug 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.21.92 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.21.92.


  Commit: 01425f8cd6efff1913e43007c17d4ee556813bff
      https://github.com/WebKit/WebKit/commit/01425f8cd6efff1913e43007c17d4ee556813bff
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2018-09-03 (Mon, 03 Sep 2018)

  Changed paths:
    M CMakeLists.txt
    M ChangeLog

  Log Message:
  -----------
  Merge r235194 - Don't use WTF_CPU_MIPS when building for mips64
https://bugs.webkit.org/show_bug.cgi?id=188858

Reviewed by Michael Catanzaro.

* CMakeLists.txt: Use WTF_CPU_MIPS64 for this architecture.


  Commit: d7f831a0980c49fd28b996883d8efe7c5fd9401a
      https://github.com/WebKit/WebKit/commit/d7f831a0980c49fd28b996883d8efe7c5fd9401a
  Author: Patrick Griffis <pgriffis at igalia.com>
  Date:   2018-09-03 (Mon, 03 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/API/glib/JSCValue.h
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Merge r235373 - [GTK][JSC] Add warn_unused_result attribute to some APIs
https://bugs.webkit.org/show_bug.cgi?id=188983

Patch by Patrick Griffis <pgriffis at igalia.com> on 2018-08-27
Reviewed by Michael Catanzaro.

* API/glib/JSCValue.h:


  Commit: b9967f3be8868b13a499e024d1f196898170b2f3
      https://github.com/WebKit/WebKit/commit/b9967f3be8868b13a499e024d1f196898170b2f3
  Author: Yoshiaki Jitsukawa <yoshiaki.jitsukawa at sony.com>
  Date:   2018-09-03 (Mon, 03 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/unix/ConnectionUnix.cpp

  Log Message:
  -----------
  Merge r235499 - [ConnectionUnix] Shrink sizeof AttachmentInfo by reordering members
https://bugs.webkit.org/show_bug.cgi?id=189149

Reviewed by Michael Catanzaro.

Reorder members to shrink the size of AttachmentInfo so that
we can attach more attachments.

* Platform/IPC/unix/ConnectionUnix.cpp:


  Commit: 2a0ee87c2f0efb9bcf5edd35c0cc23ce9cc7ba0b
      https://github.com/WebKit/WebKit/commit/2a0ee87c2f0efb9bcf5edd35c0cc23ce9cc7ba0b
  Author: Justin Michaud <justin at justinmichaud.com>
  Date:   2018-09-03 (Mon, 03 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp
    M Source/WebKit/UIProcess/API/gtk/PageClientImpl.cpp
    M Source/WebKit/UIProcess/API/gtk/PageClientImpl.h
    M Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp
    M Source/WebKit/UIProcess/gtk/GestureController.cpp
    M Source/WebKit/UIProcess/gtk/GestureController.h

  Log Message:
  -----------
  Merge r235529 - [GTK] Touchscreen pinch to zoom should scale the page like other platforms
https://bugs.webkit.org/show_bug.cgi?id=188746

Changes the pinch-to-zoom gesture to magnify/scale the page, rather than zooming in. Also resets this magnification when the zoom level is changed.

Patch by Justin Michaud <justin at justinmichaud.com> on 2018-08-30
Reviewed by Michael Catanzaro.

* UIProcess/API/glib/WebKitWebView.cpp:
(webkit_web_view_set_zoom_level):
* UIProcess/API/gtk/PageClientImpl.cpp:
(WebKit::PageClientImpl::zoom): Deleted.
* UIProcess/API/gtk/PageClientImpl.h:
* UIProcess/API/gtk/WebKitWebViewBase.cpp:
* UIProcess/gtk/GestureController.cpp:
(WebKit::GestureController::ZoomGesture::handleZoom):
(WebKit::GestureController::ZoomGesture::scaleChanged):
* UIProcess/gtk/GestureController.h:


  Commit: 25d9a1f73b5e51e39934af4a78f8ae9a718c2a1c
      https://github.com/WebKit/WebKit/commit/25d9a1f73b5e51e39934af4a78f8ae9a718c2a1c
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-09-03 (Mon, 03 Sep 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/wpe/manifest.txt.in

  Log Message:
  -----------
  Merge r235588 - [WPE] 2.21.91 fails to build with ENABLE_MINIBROWSER
https://bugs.webkit.org/show_bug.cgi?id=189006

Reviewed by Darin Adler.

The MiniBrowser source code is missing from the tarball. Oops! Add it.

* wpe/manifest.txt.in:


  Commit: 71adfa293049d1a0ea937ce3e61c232d4f9c9331
      https://github.com/WebKit/WebKit/commit/71adfa293049d1a0ea937ce3e61c232d4f9c9331
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-09-03 (Mon, 03 Sep 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.22.0 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.22.0.


  Commit: ffb13666f527690c1c5e5a6aff1ace927a2a58cb
      https://github.com/WebKit/WebKit/commit/ffb13666f527690c1c5e5a6aff1ace927a2a58cb
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-09-06 (Thu, 06 Sep 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for 2.21.92 release.

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.21.92.


  Commit: 002e6490391b267ac4651c37561fda5a1cedecd8
      https://github.com/WebKit/WebKit/commit/002e6490391b267ac4651c37561fda5a1cedecd8
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/blockformatting/BlockMarginCollapse.cpp

  Log Message:
  -----------
  Merge r235170 - Add changes missing from r234925.

* layout/blockformatting/BlockMarginCollapse.cpp:
(WebCore::Layout::isMarginTopCollapsedWithParent):
(WebCore::Layout::isMarginBottomCollapsedThrough):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::isMarginBottomCollapsedWithParent):


  Commit: c1d694d30b54a852719fe4e83863542d71f31c14
      https://github.com/WebKit/WebKit/commit/c1d694d30b54a852719fe4e83863542d71f31c14
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merge r235171 - [GTK] Never return an uninitialized ImageGStreamer object.
https://bugs.webkit.org/show_bug.cgi?id=188305

Reviewed by Philippe Normand.

The single caller was already checking for a null return value, so
make that check actually do something. Also remove the null-check on
the return value of image(), which asserted that it would never return
null.

Test: fast/canvas/canvas-createPattern-video-loading.html

* platform/graphics/gstreamer/ImageGStreamer.h:
(WebCore::ImageGStreamer::createImage): Return null if m_image wasn't created.
(WebCore::ImageGStreamer::image): Return a reference.
(WebCore::ImageGStreamer::rect): Always assert that m_image is present.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::paint): Update for new signature.


  Commit: 6c74f14a6f632649b955cf73d6a9f94499ccd1a9
      https://github.com/WebKit/WebKit/commit/6c74f14a6f632649b955cf73d6a9f94499ccd1a9
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    M LayoutTests/http/tests/subresource-integrity/sri-fetch.js
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/fetch/api/basic/integrity-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/fetch/FetchRequest.cpp

  Log Message:
  -----------
  Merge r235174 - Fetch: Stop checking Request.integrity's value in no-cors mode
https://bugs.webkit.org/show_bug.cgi?id=188802

Patch by Rob Buis <rbuis at igalia.com> on 2018-08-22
Reviewed by Frédéric Wang.

LayoutTests/imported/w3c:

Update integrity.html expected result.

* web-platform-tests/fetch/api/basic/integrity-expected.txt:

Source/WebCore:

Remove this check since it was removed from the spec.

Behavior matches Chrome and Firefox.

Test: http/tests/subresource-integrity/sri-fetch.js:

* Modules/fetch/FetchRequest.cpp:
(WebCore::FetchRequest::initializeOptions):

LayoutTests:

Unskip fetch/api/basic/integrity.html and adjust sri-fetch.js.

* TestExpectations:
* http/tests/subresource-integrity/sri-fetch.js:


  Commit: 447ec39cbbec50ef11a12b9124588e1df4e1f02a
      https://github.com/WebKit/WebKit/commit/447ec39cbbec50ef11a12b9124588e1df4e1f02a
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/bug-188298.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp

  Log Message:
  -----------
  Merge r235177 - The DFG CFGSimplification phase shouldn’t jettison a block when it’s the target of both branch directions.
https://bugs.webkit.org/show_bug.cgi?id=188298
<rdar://problem/42888427>

Reviewed by Saam Barati.

JSTests:

* stress/bug-188298.js: Added.

Source/JavaScriptCore:

In the event that both targets of a Branch is the same block, then even if we'll
always take one path of the branch, the other target is not unreachable because
it is the same target as the one in the taken path.  Hence, it should not be
jettisoned.

* JavaScriptCore.xcodeproj/project.pbxproj:
- Added DFGCFG.h which is in use and should have been added to the project.
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::run):


  Commit: 089deca6a40478ca5a9d4bc0a7561807f46cdb00
      https://github.com/WebKit/WebKit/commit/089deca6a40478ca5a9d4bc0a7561807f46cdb00
  Author: Tim Horton <thorton at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Sources.txt
    M Source/WebKit/SourcesCocoa.txt
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp
    M Source/WebKit/WebProcess/Databases/WebDatabaseProvider.cpp
    M Source/WebKit/WebProcess/EntryPoint/mac/XPCService/WebContentServiceEntryPoint.mm
    M Source/WebKit/WebProcess/FileAPI/BlobRegistryProxy.cpp
    M Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp
    M Source/WebKit/WebProcess/Gamepad/WebGamepadProvider.cpp
    M Source/WebKit/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp
    M Source/WebKit/WebProcess/Geolocation/WebGeolocationManager.cpp
    M Source/WebKit/WebProcess/InjectedBundle/API/c/mac/WKBundlePageBannerMac.mm
    M Source/WebKit/WebProcess/InjectedBundle/API/gtk/DOM/GObjectEventListener.cpp
    M Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleCSSStyleDeclarationHandle.cpp
    M Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleFileHandle.cpp
    M Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp
    M Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundleBackForwardList.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundleBackForwardListItem.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundleDOMWindowExtension.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundleHitTestResult.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundleNavigationAction.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageContextMenuClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageEditorClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageFormClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageResourceLoadClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundlePageUIClient.cpp
    M Source/WebKit/WebProcess/InjectedBundle/InjectedBundleScriptWorld.cpp
    M Source/WebKit/WebProcess/InjectedBundle/mac/InjectedBundleMac.mm
    M Source/WebKit/WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp
    M Source/WebKit/WebProcess/Network/NetworkProcessConnection.cpp
    M Source/WebKit/WebProcess/Network/WebLoaderStrategy.cpp
    M Source/WebKit/WebProcess/Network/WebResourceLoader.cpp
    M Source/WebKit/WebProcess/Network/WebSocketProvider.cpp
    M Source/WebKit/WebProcess/Network/WebSocketStream.cpp
    M Source/WebKit/WebProcess/Network/webrtc/LibWebRTCProvider.cpp
    M Source/WebKit/WebProcess/Network/webrtc/LibWebRTCResolver.cpp
    M Source/WebKit/WebProcess/Network/webrtc/LibWebRTCResolver.h
    M Source/WebKit/WebProcess/Network/webrtc/LibWebRTCSocket.cpp
    M Source/WebKit/WebProcess/Network/webrtc/LibWebRTCSocket.h
    M Source/WebKit/WebProcess/Network/webrtc/WebMDNSRegister.cpp
    M Source/WebKit/WebProcess/Network/webrtc/WebRTCMonitor.cpp
    M Source/WebKit/WebProcess/Network/webrtc/WebRTCMonitor.h
    M Source/WebKit/WebProcess/Notifications/NotificationPermissionRequestManager.cpp
    M Source/WebKit/WebProcess/Notifications/WebNotificationManager.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/JSNPMethod.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/JSNPObject.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/NPJSObject.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/NetscapePlugin.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/NetscapePluginNone.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/NetscapePluginStream.cpp
    M Source/WebKit/WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm
    M Source/WebKit/WebProcess/Plugins/PDF/PDFPlugin.mm
    M Source/WebKit/WebProcess/Plugins/PDF/PDFPluginAnnotation.mm
    M Source/WebKit/WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm
    M Source/WebKit/WebProcess/Plugins/PDF/PDFPluginPasswordField.mm
    M Source/WebKit/WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm
    M Source/WebKit/WebProcess/Plugins/Plugin.cpp
    M Source/WebKit/WebProcess/Plugins/PluginProcessConnection.cpp
    M Source/WebKit/WebProcess/Plugins/PluginProxy.cpp
    M Source/WebKit/WebProcess/Plugins/PluginView.cpp
    M Source/WebKit/WebProcess/Plugins/WebPluginInfoProvider.cpp
    M Source/WebKit/WebProcess/Storage/ServiceWorkerClientFetch.cpp
    M Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp
    M Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp
    M Source/WebKit/WebProcess/Storage/WebSWOriginTable.cpp
    M Source/WebKit/WebProcess/Storage/WebServiceWorkerFetchTaskClient.cpp
    M Source/WebKit/WebProcess/Storage/WebServiceWorkerProvider.cpp
    M Source/WebKit/WebProcess/Storage/WebToStorageProcessConnection.cpp
    M Source/WebKit/WebProcess/UserContent/WebUserContentController.cpp
    M Source/WebKit/WebProcess/WebConnectionToUIProcess.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/SessionStateConversion.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebColorChooser.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebContextMenuClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebDataListSuggestionPicker.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebDiagnosticLoggingClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebDragClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebEditorClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebGeolocationClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebInspectorClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebNotificationClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebPerformanceLoggingClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebPlatformStrategies.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebPopupMenu.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebProgressTrackerClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebUserMediaClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebValidationMessageClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/ios/WebChromeClientIOS.mm
    M Source/WebKit/WebProcess/WebCoreSupport/ios/WebEditorClientIOS.mm
    M Source/WebKit/WebProcess/WebCoreSupport/ios/WebFrameLoaderClientIOS.mm
    M Source/WebKit/WebProcess/WebCoreSupport/mac/WebAlternativeTextClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm
    M Source/WebKit/WebProcess/WebCoreSupport/mac/WebDragClientMac.mm
    M Source/WebKit/WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm
    M Source/WebKit/WebProcess/WebCoreSupport/mac/WebFrameNetworkingContext.mm
    M Source/WebKit/WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm
    M Source/WebKit/WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/win/WebContextMenuClientWin.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/wpe/WebEditorClientWPE.cpp
    M Source/WebKit/WebProcess/WebPage/Cocoa/WebPageCocoa.mm
    M Source/WebKit/WebProcess/WebPage/DrawingArea.cpp
    M Source/WebKit/WebProcess/WebPage/EventDispatcher.cpp
    M Source/WebKit/WebProcess/WebPage/FindController.cpp
    M Source/WebKit/WebProcess/WebPage/LayerTreeHost.cpp
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/GraphicsLayerCARemote.cpp
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemote.cpp
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemoteCustom.mm
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemoteTiledBacking.cpp
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeContext.mm
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDisplayRefreshMonitor.mm
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.mm
    M Source/WebKit/WebProcess/WebPage/RemoteWebInspectorUI.cpp
    M Source/WebKit/WebProcess/WebPage/ViewGestureGeometryCollector.cpp
    M Source/WebKit/WebProcess/WebPage/VisitedLinkTableController.cpp
    M Source/WebKit/WebProcess/WebPage/WebBackForwardListProxy.cpp
    M Source/WebKit/WebProcess/WebPage/WebContextMenu.cpp
    M Source/WebKit/WebProcess/WebPage/WebDocumentLoader.cpp
    M Source/WebKit/WebProcess/WebPage/WebFrame.cpp
    M Source/WebKit/WebProcess/WebPage/WebInspector.cpp
    M Source/WebKit/WebProcess/WebPage/WebInspectorUI.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/WebPageOverlay.cpp
    M Source/WebKit/WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp
    M Source/WebKit/WebProcess/WebPage/WebURLSchemeTaskProxy.cpp
    M Source/WebKit/WebProcess/WebPage/ios/FindControllerIOS.mm
    M Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm
    M Source/WebKit/WebProcess/WebPage/mac/DrawingAreaMac.cpp
    M Source/WebKit/WebProcess/WebPage/mac/PageBannerMac.mm
    M Source/WebKit/WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm
    M Source/WebKit/WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm
    M Source/WebKit/WebProcess/WebPage/mac/WebPageMac.mm
    M Source/WebKit/WebProcess/WebPage/win/WebPageWin.cpp
    M Source/WebKit/WebProcess/WebPage/wpe/AcceleratedSurfaceWPE.cpp
    M Source/WebKit/WebProcess/WebPage/wpe/WebPageWPE.cpp
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageAreaImpl.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageNamespaceImpl.cpp
    M Source/WebKit/WebProcess/WebStorage/WebStorageNamespaceProvider.cpp
    M Source/WebKit/WebProcess/cocoa/PlaybackSessionManager.mm
    M Source/WebKit/WebProcess/cocoa/UserMediaCaptureManager.cpp
    M Source/WebKit/WebProcess/cocoa/VideoFullscreenManager.mm
    M Source/WebKit/WebProcess/cocoa/WebProcessCocoa.mm
    M Source/WebKit/WebProcess/win/WebProcessMainWin.cpp
    M Source/WebKit/WebProcess/win/WebProcessWin.cpp
    M Source/WebKit/WebProcess/wpe/WebProcessMainWPE.cpp

  Log Message:
  -----------
  Merge r235176 - Use unified build for WebProcess
https://bugs.webkit.org/show_bug.cgi?id=185015

Reviewed by Alex Christensen.

* Sources.txt:
* SourcesCocoa.txt:
* UIProcess/WebPageProxy.h:
* WebKit.xcodeproj/project.pbxproj:
* WebProcess/Databases/IndexedDB/WebIDBConnectionToServer.cpp:
* WebProcess/Databases/WebDatabaseProvider.cpp:
* WebProcess/EntryPoint/mac/XPCService/WebContentServiceEntryPoint.mm:
* WebProcess/FileAPI/BlobRegistryProxy.cpp:
* WebProcess/FullScreen/WebFullScreenManager.cpp:
* WebProcess/Gamepad/WebGamepadProvider.cpp:
* WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp:
* WebProcess/Geolocation/WebGeolocationManager.cpp:
* WebProcess/InjectedBundle/API/c/mac/WKBundlePageBannerMac.mm:
* WebProcess/InjectedBundle/API/gtk/DOM/GObjectEventListener.cpp:
* WebProcess/InjectedBundle/DOM/InjectedBundleCSSStyleDeclarationHandle.cpp:
* WebProcess/InjectedBundle/DOM/InjectedBundleFileHandle.cpp:
* WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp:
* WebProcess/InjectedBundle/DOM/InjectedBundleRangeHandle.cpp:
* WebProcess/InjectedBundle/InjectedBundle.cpp:
* WebProcess/InjectedBundle/InjectedBundleBackForwardList.cpp:
* WebProcess/InjectedBundle/InjectedBundleBackForwardListItem.cpp:
* WebProcess/InjectedBundle/InjectedBundleDOMWindowExtension.cpp:
* WebProcess/InjectedBundle/InjectedBundleHitTestResult.cpp:
* WebProcess/InjectedBundle/InjectedBundleNavigationAction.cpp:
* WebProcess/InjectedBundle/InjectedBundlePageContextMenuClient.cpp:
* WebProcess/InjectedBundle/InjectedBundlePageEditorClient.cpp:
* WebProcess/InjectedBundle/InjectedBundlePageFormClient.cpp:
* WebProcess/InjectedBundle/InjectedBundlePageFullScreenClient.cpp:
* WebProcess/InjectedBundle/InjectedBundlePageLoaderClient.cpp:
* WebProcess/InjectedBundle/InjectedBundlePagePolicyClient.cpp:
* WebProcess/InjectedBundle/InjectedBundlePageResourceLoadClient.cpp:
* WebProcess/InjectedBundle/InjectedBundlePageUIClient.cpp:
* WebProcess/InjectedBundle/InjectedBundleScriptWorld.cpp:
* WebProcess/InjectedBundle/mac/InjectedBundleMac.mm:
* WebProcess/MediaStream/UserMediaPermissionRequestManager.cpp:
* WebProcess/Network/NetworkProcessConnection.cpp:
* WebProcess/Network/WebLoaderStrategy.cpp:
* WebProcess/Network/WebResourceLoader.cpp:
* WebProcess/Network/WebSocketProvider.cpp:
* WebProcess/Network/WebSocketStream.cpp:
* WebProcess/Network/webrtc/LibWebRTCProvider.cpp:
* WebProcess/Network/webrtc/LibWebRTCResolver.cpp:
* WebProcess/Network/webrtc/LibWebRTCResolver.h:
* WebProcess/Network/webrtc/LibWebRTCSocket.cpp:
* WebProcess/Network/webrtc/LibWebRTCSocket.h:
* WebProcess/Network/webrtc/WebMDNSRegister.cpp:
* WebProcess/Network/webrtc/WebRTCMonitor.cpp:
* WebProcess/Network/webrtc/WebRTCMonitor.h:
* WebProcess/Notifications/NotificationPermissionRequestManager.cpp:
* WebProcess/Notifications/WebNotificationManager.cpp:
* WebProcess/Plugins/Netscape/JSNPMethod.cpp:
* WebProcess/Plugins/Netscape/JSNPObject.cpp:
* WebProcess/Plugins/Netscape/NPJSObject.cpp:
* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
* WebProcess/Plugins/Netscape/NetscapeBrowserFuncs.cpp:
* WebProcess/Plugins/Netscape/NetscapePlugin.cpp:
* WebProcess/Plugins/Netscape/NetscapePluginNone.cpp:
* WebProcess/Plugins/Netscape/NetscapePluginStream.cpp:
* WebProcess/Plugins/Netscape/mac/NetscapePluginMac.mm:
* WebProcess/Plugins/PDF/PDFPlugin.mm:
* WebProcess/Plugins/PDF/PDFPluginAnnotation.mm:
* WebProcess/Plugins/PDF/PDFPluginChoiceAnnotation.mm:
* WebProcess/Plugins/PDF/PDFPluginPasswordField.mm:
* WebProcess/Plugins/PDF/PDFPluginTextAnnotation.mm:
* WebProcess/Plugins/Plugin.cpp:
* WebProcess/Plugins/PluginProcessConnection.cpp:
* WebProcess/Plugins/PluginProxy.cpp:
* WebProcess/Plugins/PluginView.cpp:
* WebProcess/Plugins/WebPluginInfoProvider.cpp:
* WebProcess/Storage/ServiceWorkerClientFetch.cpp:
* WebProcess/Storage/WebSWClientConnection.cpp:
* WebProcess/Storage/WebSWContextManagerConnection.cpp:
* WebProcess/Storage/WebSWOriginTable.cpp:
* WebProcess/Storage/WebServiceWorkerFetchTaskClient.cpp:
* WebProcess/Storage/WebServiceWorkerProvider.cpp:
* WebProcess/Storage/WebToStorageProcessConnection.cpp:
* WebProcess/UserContent/WebUserContentController.cpp:
* WebProcess/WebConnectionToUIProcess.cpp:
* WebProcess/WebCoreSupport/SessionStateConversion.cpp:
* WebProcess/WebCoreSupport/WebChromeClient.cpp:
* WebProcess/WebCoreSupport/WebColorChooser.cpp:
* WebProcess/WebCoreSupport/WebContextMenuClient.cpp:
* WebProcess/WebCoreSupport/WebDataListSuggestionPicker.cpp:
* WebProcess/WebCoreSupport/WebDiagnosticLoggingClient.cpp:
* WebProcess/WebCoreSupport/WebDragClient.cpp:
* WebProcess/WebCoreSupport/WebEditorClient.cpp:
* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
* WebProcess/WebCoreSupport/WebGeolocationClient.cpp:
* WebProcess/WebCoreSupport/WebInspectorClient.cpp:
* WebProcess/WebCoreSupport/WebMessagePortChannelProvider.cpp:
* WebProcess/WebCoreSupport/WebNotificationClient.cpp:
* WebProcess/WebCoreSupport/WebPerformanceLoggingClient.cpp:
* WebProcess/WebCoreSupport/WebPlatformStrategies.cpp:
* WebProcess/WebCoreSupport/WebPopupMenu.cpp:
* WebProcess/WebCoreSupport/WebProgressTrackerClient.cpp:
* WebProcess/WebCoreSupport/WebSearchPopupMenu.cpp:
* WebProcess/WebCoreSupport/WebUserMediaClient.cpp:
* WebProcess/WebCoreSupport/WebValidationMessageClient.cpp:
* WebProcess/WebCoreSupport/ios/WebChromeClientIOS.mm:
* WebProcess/WebCoreSupport/ios/WebEditorClientIOS.mm:
* WebProcess/WebCoreSupport/ios/WebFrameLoaderClientIOS.mm:
* WebProcess/WebCoreSupport/mac/WebAlternativeTextClient.cpp:
* WebProcess/WebCoreSupport/mac/WebContextMenuClientMac.mm:
* WebProcess/WebCoreSupport/mac/WebDragClientMac.mm:
* WebProcess/WebCoreSupport/mac/WebEditorClientMac.mm:
* WebProcess/WebCoreSupport/mac/WebFrameNetworkingContext.mm:
* WebProcess/WebCoreSupport/mac/WebPopupMenuMac.mm:
* WebProcess/WebCoreSupport/soup/WebFrameNetworkingContext.cpp:
* WebProcess/WebCoreSupport/win/WebContextMenuClientWin.cpp:
* WebProcess/WebCoreSupport/win/WebPopupMenuWin.cpp:
* WebProcess/WebCoreSupport/wpe/WebEditorClientWPE.cpp:
* WebProcess/WebPage/Cocoa/WebPageCocoa.mm:
* WebProcess/WebPage/DrawingArea.cpp:
* WebProcess/WebPage/EventDispatcher.cpp:
* WebProcess/WebPage/FindController.cpp:
* WebProcess/WebPage/LayerTreeHost.cpp:
* WebProcess/WebPage/RemoteLayerTree/GraphicsLayerCARemote.cpp:
* WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemote.cpp:
* WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemoteCustom.mm:
* WebProcess/WebPage/RemoteLayerTree/PlatformCALayerRemoteTiledBacking.cpp:
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeContext.mm:
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDisplayRefreshMonitor.mm:
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm:
* WebProcess/WebPage/RemoteLayerTree/RemoteScrollingCoordinator.mm:
* WebProcess/WebPage/RemoteWebInspectorUI.cpp:
* WebProcess/WebPage/ViewGestureGeometryCollector.cpp:
* WebProcess/WebPage/VisitedLinkTableController.cpp:
* WebProcess/WebPage/WebBackForwardListProxy.cpp:
* WebProcess/WebPage/WebContextMenu.cpp:
* WebProcess/WebPage/WebDocumentLoader.cpp:
* WebProcess/WebPage/WebFrame.cpp:
* WebProcess/WebPage/WebInspector.cpp:
* WebProcess/WebPage/WebInspectorUI.cpp:
* WebProcess/WebPage/WebPage.cpp:
* WebProcess/WebPage/WebPageOverlay.cpp:
* WebProcess/WebPage/WebURLSchemeHandlerProxy.cpp:
* WebProcess/WebPage/WebURLSchemeTaskProxy.cpp:
* WebProcess/WebPage/ios/FindControllerIOS.mm:
* WebProcess/WebPage/ios/WebPageIOS.mm:
* WebProcess/WebPage/mac/DrawingAreaMac.cpp:
* WebProcess/WebPage/mac/PageBannerMac.mm:
* WebProcess/WebPage/mac/TiledCoreAnimationDrawingArea.mm:
* WebProcess/WebPage/mac/WKAccessibilityWebPageObjectBase.mm:
* WebProcess/WebPage/mac/WebPageMac.mm:
* WebProcess/WebPage/win/WebPageWin.cpp:
* WebProcess/WebPage/wpe/AcceleratedSurfaceWPE.cpp:
* WebProcess/WebPage/wpe/WebPageWPE.cpp:
* WebProcess/WebProcess.cpp:
* WebProcess/WebStorage/StorageAreaImpl.cpp:
* WebProcess/WebStorage/StorageAreaMap.cpp:
* WebProcess/WebStorage/StorageNamespaceImpl.cpp:
* WebProcess/WebStorage/WebStorageNamespaceProvider.cpp:
* WebProcess/cocoa/PlaybackSessionManager.mm:
* WebProcess/cocoa/UserMediaCaptureManager.cpp:
* WebProcess/cocoa/VideoFullscreenManager.mm:
* WebProcess/cocoa/WebProcessCocoa.mm:
* WebProcess/win/WebProcessMainWin.cpp:
* WebProcess/win/WebProcessWin.cpp:
* WebProcess/wpe/WebProcessMainWPE.cpp:


  Commit: 49ec052f2faac8ead950542c78acc62958bf1841
      https://github.com/WebKit/WebKit/commit/49ec052f2faac8ead950542c78acc62958bf1841
  Author: Tim Horton <thorton at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Sources.txt

  Log Message:
  -----------
  Merge r235208 - De-unify WebPage
https://bugs.webkit.org/show_bug.cgi?id=188865

Reviewed by Wenson Hsieh.

* Sources.txt:
* WebKit.xcodeproj/project.pbxproj:
WebPage being unified is causing mysterious build issues inside Carbon headers
on High Sierra only. Also, WebPage by itself takes longer to build than
most full unified source files, so it might not make sense to unify it
with others (to maximize parallelism).


  Commit: 17df0004bf907d59e482f023e06f2a5b29fc0da1
      https://github.com/WebKit/WebKit/commit/17df0004bf907d59e482f023e06f2a5b29fc0da1
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/yarr/YarrJIT.cpp

  Log Message:
  -----------
  Merge r235238 - YARR: Need to JIT compile a RegExp before using containsNestedSubpatterns flag
https://bugs.webkit.org/show_bug.cgi?id=188895

Reviewed by Mark Lam.

Found while working on another change.  This will allow processing of nested
parenthesis that require saved ParenContext structures.

* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::compile):


  Commit: 6d7c172afb8f8edf487001f92ba892ad4124d9e3
      https://github.com/WebKit/WebKit/commit/6d7c172afb8f8edf487001f92ba892ad4124d9e3
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    A LayoutTests/fast/files/blob-network-process-crash-expected.txt
    A LayoutTests/fast/files/blob-network-process-crash.html
    M LayoutTests/platform/wk2/TestExpectations
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/FileAPI/NetworkBlobRegistry.cpp
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/InjectedBundle/TestRunner.cpp
    M Tools/WebKitTestRunner/TestInvocation.cpp

  Log Message:
  -----------
  Merge r235243 - Assert in NetworkBlobRegistry::unregisterBlobURL after network process had terminated
https://bugs.webkit.org/show_bug.cgi?id=188880

Reviewed by Saam Barati.

Source/WebKit:

Removed the debug assertion. WebContent process might be asking this network process
to unregister a blob registered from another network processs which had since crashed.

We could keep track of which blob had been registered with which network process
in WebContent process and avoid sending IPC to the network process but that's a lot of
house-keeping for virtually no benefit other than not hitting this assertion.

* NetworkProcess/FileAPI/NetworkBlobRegistry.cpp:
(WebKit::NetworkBlobRegistry::unregisterBlobURL):

Tools:

Fixed the bug that testRunner's terminateNetworkProcess, terminateServiceWorkerProcess, and terminateStorageProcess
were asynchronously terminating respective processes. Do so synchronously so that we can deterministically
test WebKit's behavior in layout tests.

* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::terminateNetworkProcess):
(WTR::TestRunner::terminateServiceWorkerProcess):
(WTR::TestRunner::terminateStorageProcess):
* WebKitTestRunner/TestInvocation.cpp:
(WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):

LayoutTests:

Added a layout test which demonstrates this debug assertion.

* TestExpectations:
* fast/files/blob-network-process-crash-expected.txt: Added.
* fast/files/blob-network-process-crash.html: Added.
* platform/wk2/TestExpectations:


  Commit: fabed89298598ca5fcc5ea07ded51f8a74101add
      https://github.com/WebKit/WebKit/commit/fabed89298598ca5fcc5ea07ded51f8a74101add
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/API/APIUtils.h
    M Source/JavaScriptCore/API/JSBase.cpp
    M Source/JavaScriptCore/API/JSContextRef.cpp
    M Source/JavaScriptCore/API/JSValue.mm
    M Source/JavaScriptCore/API/glib/JSCClass.cpp
    M Source/JavaScriptCore/API/glib/JSCContext.cpp
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/debugger/Debugger.cpp
    M Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp
    M Source/JavaScriptCore/interpreter/CallFrame.cpp
    M Source/JavaScriptCore/interpreter/CallFrame.h
    M Source/JavaScriptCore/interpreter/Interpreter.cpp
    M Source/JavaScriptCore/runtime/CallData.cpp
    M Source/JavaScriptCore/runtime/Completion.cpp
    M Source/JavaScriptCore/runtime/ConstructData.cpp
    M Source/JavaScriptCore/runtime/Error.cpp
    M Source/JavaScriptCore/runtime/VM.cpp
    M Source/JavaScriptCore/runtime/VM.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
    M Source/WebCore/bindings/js/JSDOMGlobalObject.cpp
    M Source/WebCore/bindings/js/JSDOMWindowBase.cpp
    M Source/WebCore/bridge/c/c_utility.cpp
    M Source/WebCore/bridge/objc/WebScriptObject.mm
    M Source/WebCore/bridge/objc/objc_instance.mm
    M Source/WebCore/bridge/objc/objc_runtime.mm
    M Source/WebCore/bridge/objc/objc_utility.mm
    M Source/WebCore/testing/Internals.cpp
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebView/WebScriptDebugger.mm

  Log Message:
  -----------
  Merge r235254 - Move vmEntryGlobalObject() to VM from CallFrame.
https://bugs.webkit.org/show_bug.cgi?id=188900
<rdar://problem/43655753>

Reviewed by Michael Saboff.

Source/JavaScriptCore:

Also introduced CallFrame::isGlobalExec() which makes use of one property of
GlobalExecs to identify them i.e. GlobalExecs have null callerFrame and returnPCs.
CallFrame::initGlobalExec() ensures this.

In contrast, normal CallFrames always have a callerFrame (because they must at
least be preceded by a VM EntryFrame) and a returnPC (at least return to the
VM entry glue).

* API/APIUtils.h:
(handleExceptionIfNeeded):
(setException):
* API/JSBase.cpp:
(JSEvaluateScript):
(JSCheckScriptSyntax):
* API/JSContextRef.cpp:
(JSGlobalContextRetain):
(JSGlobalContextRelease):
(JSGlobalContextCopyName):
(JSGlobalContextSetName):
(JSGlobalContextGetRemoteInspectionEnabled):
(JSGlobalContextSetRemoteInspectionEnabled):
(JSGlobalContextGetIncludesNativeCallStackWhenReportingExceptions):
(JSGlobalContextSetIncludesNativeCallStackWhenReportingExceptions):
(JSGlobalContextGetDebuggerRunLoop):
(JSGlobalContextSetDebuggerRunLoop):
(JSGlobalContextGetAugmentableInspectorController):
* API/JSValue.mm:
(reportExceptionToInspector):
* API/glib/JSCClass.cpp:
(jscContextForObject):
* API/glib/JSCContext.cpp:
(jsc_context_evaluate_in_object):
* debugger/Debugger.cpp:
(JSC::Debugger::pauseIfNeeded):
* debugger/DebuggerCallFrame.cpp:
(JSC::DebuggerCallFrame::vmEntryGlobalObject const):
(JSC::DebuggerCallFrame::evaluateWithScopeExtension):
* interpreter/CallFrame.cpp:
(JSC::CallFrame::vmEntryGlobalObject): Deleted.
* interpreter/CallFrame.h:
(JSC::ExecState::scope const):
(JSC::ExecState::noCaller):
(JSC::ExecState::isGlobalExec const):
* interpreter/Interpreter.cpp:
(JSC::notifyDebuggerOfUnwinding):
(JSC::Interpreter::notifyDebuggerOfExceptionToBeThrown):
(JSC::Interpreter::debug):
* runtime/CallData.cpp:
(JSC::profiledCall):
* runtime/Completion.cpp:
(JSC::evaluate):
(JSC::profiledEvaluate):
(JSC::evaluateWithScopeExtension):
(JSC::loadAndEvaluateModule):
(JSC::loadModule):
(JSC::linkAndEvaluateModule):
(JSC::importModule):
* runtime/ConstructData.cpp:
(JSC::profiledConstruct):
* runtime/Error.cpp:
(JSC::getStackTrace):
* runtime/VM.cpp:
(JSC::VM::throwException):
(JSC::VM::vmEntryGlobalObject const):
* runtime/VM.h:

Source/WebCore:

No new tests needed because this patch does not introduce new functionality.

* bindings/js/JSCustomXPathNSResolver.cpp:
(WebCore::JSCustomXPathNSResolver::create):
* bindings/js/JSDOMGlobalObject.cpp:
(WebCore::callerGlobalObject):
(WebCore::toJSDOMGlobalObject): Deleted.
* bindings/js/JSDOMWindowBase.cpp:
(WebCore::firstDOMWindow):
* bridge/c/c_utility.cpp:
(JSC::Bindings::convertValueToNPVariant):
* bridge/objc/WebScriptObject.mm:
(WebCore::addExceptionToConsole):
* bridge/objc/objc_instance.mm:
(ObjcInstance::moveGlobalExceptionToExecState):
* bridge/objc/objc_runtime.mm:
(JSC::Bindings::convertValueToObjcObject):
* bridge/objc/objc_utility.mm:
(JSC::Bindings::convertValueToObjcValue):
* testing/Internals.cpp:
(WebCore::Internals::cloneArrayBuffer):

Source/WebKitLegacy/mac:

* WebView/WebScriptDebugger.mm:
(WebScriptDebugger::sourceParsed):


  Commit: 5ce801cd1abc2567b131673a3a568796daa6b52b
      https://github.com/WebKit/WebKit/commit/5ce801cd1abc2567b131673a3a568796daa6b52b
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/EdenGCActivityCallback.cpp
    M Source/JavaScriptCore/heap/EdenGCActivityCallback.h
    M Source/JavaScriptCore/heap/FullGCActivityCallback.cpp
    M Source/JavaScriptCore/heap/FullGCActivityCallback.h
    M Source/JavaScriptCore/heap/GCActivityCallback.cpp
    M Source/JavaScriptCore/heap/GCActivityCallback.h
    M Source/JavaScriptCore/heap/Heap.cpp
    M Source/JavaScriptCore/heap/IncrementalSweeper.cpp
    M Source/JavaScriptCore/heap/IncrementalSweeper.h
    M Source/JavaScriptCore/heap/StopIfNecessaryTimer.cpp
    M Source/JavaScriptCore/heap/StopIfNecessaryTimer.h
    M Source/JavaScriptCore/runtime/JSRunLoopTimer.cpp
    M Source/JavaScriptCore/runtime/JSRunLoopTimer.h
    M Source/JavaScriptCore/runtime/PromiseDeferredTimer.cpp
    M Source/JavaScriptCore/runtime/PromiseDeferredTimer.h
    M Source/JavaScriptCore/runtime/VM.cpp
    M Source/JavaScriptCore/runtime/VM.h
    M Source/JavaScriptCore/wasm/js/WebAssemblyPrototype.cpp
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/cocoa/ResourceUsageThreadCocoa.mm
    M Source/WebCore/page/linux/ResourceUsageThreadLinux.cpp

  Log Message:
  -----------
  Merge r235261 - JSRunLoopTimer may run part of a member function after it's destroyed
https://bugs.webkit.org/show_bug.cgi?id=188426

Reviewed by Mark Lam.

Source/JavaScriptCore:

When I was reading the JSRunLoopTimer code, I noticed that it is possible
to end up running timer code after the class had been destroyed.

The issue I spotted was in this function:
```
void JSRunLoopTimer::timerDidFire()
{
    JSLock* apiLock = m_apiLock.get();
    if (!apiLock) {
        // Likely a buggy usage: the timer fired while JSRunLoopTimer was being destroyed.
        return;
    }
    // HERE
    std::lock_guard<JSLock> lock(*apiLock);
    RefPtr<VM> vm = apiLock->vm();
    if (!vm) {
        // The VM has been destroyed, so we should just give up.
        return;
    }

    doWork();
}
```

Look at the comment 'HERE'. Let's say that the timer callback thread gets context
switched before grabbing the API lock. Then, some other thread destroys the VM.
And let's say that the VM owns (perhaps transitively) this timer. Then, the
timer would run code and access member variables after it was destroyed.

This patch fixes this issue by introducing a new timer manager class.
This class manages timers on a per VM basis. When a timer is scheduled,
this class refs the timer. It also calls the timer callback while actively
maintaining a +1 ref to it. So, it's no longer possible to call the timer
callback after the timer has been destroyed. However, calling a timer callback
can still race with the VM being destroyed. We continue to detect this case and
bail out of the callback early.

This patch also removes a lot of duplicate code between GCActivityCallback
and JSRunLoopTimer.

* heap/EdenGCActivityCallback.cpp:
(JSC::EdenGCActivityCallback::doCollection):
(JSC::EdenGCActivityCallback::lastGCLength):
(JSC::EdenGCActivityCallback::deathRate):
* heap/EdenGCActivityCallback.h:
* heap/FullGCActivityCallback.cpp:
(JSC::FullGCActivityCallback::doCollection):
(JSC::FullGCActivityCallback::lastGCLength):
(JSC::FullGCActivityCallback::deathRate):
* heap/FullGCActivityCallback.h:
* heap/GCActivityCallback.cpp:
(JSC::GCActivityCallback::doWork):
(JSC::GCActivityCallback::scheduleTimer):
(JSC::GCActivityCallback::didAllocate):
(JSC::GCActivityCallback::willCollect):
(JSC::GCActivityCallback::cancel):
(JSC::GCActivityCallback::cancelTimer): Deleted.
(JSC::GCActivityCallback::nextFireTime): Deleted.
* heap/GCActivityCallback.h:
* heap/Heap.cpp:
(JSC::Heap::reportAbandonedObjectGraph):
(JSC::Heap::notifyIncrementalSweeper):
(JSC::Heap::updateAllocationLimits):
(JSC::Heap::didAllocate):
* heap/IncrementalSweeper.cpp:
(JSC::IncrementalSweeper::scheduleTimer):
(JSC::IncrementalSweeper::doWork):
(JSC::IncrementalSweeper::doSweep):
(JSC::IncrementalSweeper::sweepNextBlock):
(JSC::IncrementalSweeper::startSweeping):
(JSC::IncrementalSweeper::stopSweeping):
* heap/IncrementalSweeper.h:
* heap/StopIfNecessaryTimer.cpp:
(JSC::StopIfNecessaryTimer::doWork):
(JSC::StopIfNecessaryTimer::scheduleSoon):
* heap/StopIfNecessaryTimer.h:
* runtime/JSRunLoopTimer.cpp:
(JSC::epochTime):
(JSC::JSRunLoopTimer::Manager::timerDidFireCallback):
(JSC::JSRunLoopTimer::Manager::PerVMData::setRunLoop):
(JSC::JSRunLoopTimer::Manager::PerVMData::PerVMData):
(JSC::JSRunLoopTimer::Manager::PerVMData::~PerVMData):
(JSC::JSRunLoopTimer::Manager::timerDidFire):
(JSC::JSRunLoopTimer::Manager::shared):
(JSC::JSRunLoopTimer::Manager::registerVM):
(JSC::JSRunLoopTimer::Manager::unregisterVM):
(JSC::JSRunLoopTimer::Manager::scheduleTimer):
(JSC::JSRunLoopTimer::Manager::cancelTimer):
(JSC::JSRunLoopTimer::Manager::timeUntilFire):
(JSC::JSRunLoopTimer::Manager::didChangeRunLoop):
(JSC::JSRunLoopTimer::timerDidFire):
(JSC::JSRunLoopTimer::JSRunLoopTimer):
(JSC::JSRunLoopTimer::timeUntilFire):
(JSC::JSRunLoopTimer::setTimeUntilFire):
(JSC::JSRunLoopTimer::cancelTimer):
(JSC::JSRunLoopTimer::setRunLoop): Deleted.
(JSC::JSRunLoopTimer::timerDidFireCallback): Deleted.
(JSC::JSRunLoopTimer::scheduleTimer): Deleted.
* runtime/JSRunLoopTimer.h:
(JSC::JSRunLoopTimer::Manager::PerVMData::PerVMData):
* runtime/PromiseDeferredTimer.cpp:
(JSC::PromiseDeferredTimer::doWork):
(JSC::PromiseDeferredTimer::runRunLoop):
(JSC::PromiseDeferredTimer::addPendingPromise):
(JSC::PromiseDeferredTimer::hasPendingPromise):
(JSC::PromiseDeferredTimer::hasDependancyInPendingPromise):
(JSC::PromiseDeferredTimer::cancelPendingPromise):
(JSC::PromiseDeferredTimer::scheduleWorkSoon):
* runtime/PromiseDeferredTimer.h:
* runtime/VM.cpp:
(JSC::VM::VM):
(JSC::VM::~VM):
(JSC::VM::setRunLoop):
(JSC::VM::registerRunLoopTimer): Deleted.
(JSC::VM::unregisterRunLoopTimer): Deleted.
* runtime/VM.h:
(JSC::VM::runLoop const):
* wasm/js/WebAssemblyPrototype.cpp:
(JSC::webAssemblyModuleValidateAsyncInternal):
(JSC::instantiate):
(JSC::compileAndInstantiate):
(JSC::webAssemblyModuleInstantinateAsyncInternal):
(JSC::webAssemblyCompileStreamingInternal):
(JSC::webAssemblyInstantiateStreamingInternal):

Source/WebCore:

* page/cocoa/ResourceUsageThreadCocoa.mm:
(WebCore::ResourceUsageThread::platformThreadBody):
* page/linux/ResourceUsageThreadLinux.cpp:
(WebCore::ResourceUsageThread::platformThreadBody):


  Commit: 6635e25910750a37b9002d67233ff4789595ed51
      https://github.com/WebKit/WebKit/commit/6635e25910750a37b9002d67233ff4789595ed51
  Author: Tim Horton <thorton at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Sources.txt
    M Source/WebKit/SourcesCocoa.txt
    M Source/WebKit/UIProcess/API/APIWebsiteDataStore.h
    M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
    M Source/WebKit/UIProcess/API/Cocoa/WKWebViewConfiguration.mm
    M Source/WebKit/UIProcess/API/glib/IconDatabase.cpp
    M Source/WebKit/UIProcess/API/gtk/PageClientImpl.cpp
    M Source/WebKit/UIProcess/API/gtk/WebKitColorChooser.cpp
    M Source/WebKit/UIProcess/API/gtk/WebKitPopupMenu.cpp
    M Source/WebKit/UIProcess/API/gtk/WebKitRemoteInspectorProtocolHandler.cpp
    M Source/WebKit/UIProcess/ApplicationStateTracker.mm
    M Source/WebKit/UIProcess/Authentication/mac/WebCredentialMac.mm
    M Source/WebKit/UIProcess/Automation/cocoa/WebAutomationSessionCocoa.mm
    M Source/WebKit/UIProcess/Automation/ios/WebAutomationSessionIOS.mm
    M Source/WebKit/UIProcess/Automation/mac/WebAutomationSessionMac.mm
    M Source/WebKit/UIProcess/Cocoa/NavigationState.mm
    M Source/WebKit/UIProcess/Cocoa/PlaybackSessionManagerProxy.mm
    M Source/WebKit/UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp
    M Source/WebKit/UIProcess/Cocoa/VideoFullscreenManagerProxy.mm
    M Source/WebKit/UIProcess/Cocoa/ViewGestureController.cpp
    M Source/WebKit/UIProcess/Cocoa/WKWebViewContentProviderRegistry.mm
    M Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm
    M Source/WebKit/UIProcess/Cocoa/WebPasteboardProxyCocoa.mm
    M Source/WebKit/UIProcess/Cocoa/WebURLSchemeHandlerCocoa.mm
    M Source/WebKit/UIProcess/Cocoa/WebViewImpl.mm
    M Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp
    M Source/WebKit/UIProcess/DrawingAreaProxy.cpp
    M Source/WebKit/UIProcess/Gamepad/UIGamepad.cpp
    M Source/WebKit/UIProcess/Gamepad/UIGamepadProvider.cpp
    M Source/WebKit/UIProcess/Gamepad/cocoa/UIGamepadProviderCocoa.mm
    M Source/WebKit/UIProcess/HighPerformanceGraphicsUsageSampler.cpp
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
    M Source/WebKit/UIProcess/Notifications/WebNotificationManagerProxy.cpp
    M Source/WebKit/UIProcess/PerActivityStateCPUUsageSampler.cpp
    M Source/WebKit/UIProcess/Plugins/PluginInfoStore.cpp
    M Source/WebKit/UIProcess/Plugins/PluginProcessProxy.cpp
    M Source/WebKit/UIProcess/Plugins/mac/PluginInfoStoreMac.mm
    M Source/WebKit/UIProcess/Plugins/mac/PluginProcessProxyMac.mm
    M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm
    M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm
    M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeScrollingPerformanceData.mm
    M Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp
    M Source/WebKit/UIProcess/RemoteLayerTree/RemoteScrollingTree.cpp
    M Source/WebKit/UIProcess/RemoteLayerTree/ios/RemoteScrollingCoordinatorProxyIOS.mm
    M Source/WebKit/UIProcess/RemoteLayerTree/ios/ScrollingTreeOverflowScrollingNodeIOS.mm
    M Source/WebKit/UIProcess/RemoteWebInspectorProxy.cpp
    M Source/WebKit/UIProcess/ResourceLoadStatisticsMemoryStore.cpp
    M Source/WebKit/UIProcess/ServiceWorkerProcessProxy.cpp
    M Source/WebKit/UIProcess/Storage/StorageProcessProxy.cpp
    M Source/WebKit/UIProcess/SuspendedPageProxy.cpp
    M Source/WebKit/UIProcess/TextCheckerCompletion.cpp
    M Source/WebKit/UIProcess/UIMessagePortChannelProvider.cpp
    M Source/WebKit/UIProcess/UserMediaPermissionCheckProxy.cpp
    M Source/WebKit/UIProcess/UserMediaPermissionRequestManagerProxy.cpp
    M Source/WebKit/UIProcess/UserMediaPermissionRequestProxy.cpp
    M Source/WebKit/UIProcess/VisitedLinkStore.cpp
    M Source/WebKit/UIProcess/WKInspectorHighlightView.mm
    M Source/WebKit/UIProcess/WebBackForwardList.cpp
    M Source/WebKit/UIProcess/WebContextMenuListenerProxy.cpp
    M Source/WebKit/UIProcess/WebCookieManagerProxy.cpp
    M Source/WebKit/UIProcess/WebEditCommandProxy.cpp
    M Source/WebKit/UIProcess/WebFrameProxy.cpp
    M Source/WebKit/UIProcess/WebFullScreenManagerProxy.cpp
    M Source/WebKit/UIProcess/WebInspectorProxy.cpp
    M Source/WebKit/UIProcess/WebNavigationState.cpp
    M Source/WebKit/UIProcess/WebOpenPanelResultListenerProxy.cpp
    M Source/WebKit/UIProcess/WebPageInjectedBundleClient.cpp
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Source/WebKit/UIProcess/WebProcessProxy.cpp
    M Source/WebKit/UIProcess/WebStorage/LocalStorageDatabaseTracker.cpp
    M Source/WebKit/UIProcess/WebURLSchemeHandler.cpp
    M Source/WebKit/UIProcess/WebURLSchemeTask.cpp
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreX11.cpp
    M Source/WebKit/UIProcess/ios/DragDropInteractionState.mm
    M Source/WebKit/UIProcess/ios/InputViewUpdateDeferrer.mm
    M Source/WebKit/UIProcess/ios/PageClientImplIOS.mm
    M Source/WebKit/UIProcess/ios/SmartMagnificationController.mm
    M Source/WebKit/UIProcess/ios/ViewGestureControllerIOS.mm
    M Source/WebKit/UIProcess/ios/WKActionSheetAssistant.mm
    M Source/WebKit/UIProcess/ios/WKApplicationStateTrackingView.mm
    M Source/WebKit/UIProcess/ios/WKGeolocationProviderIOS.mm
    M Source/WebKit/UIProcess/ios/WKKeyboardScrollingAnimator.mm
    M Source/WebKit/UIProcess/ios/WKLegacyPDFView.mm
    M Source/WebKit/UIProcess/ios/WKPDFView.mm
    M Source/WebKit/UIProcess/ios/WKScrollView.mm
    M Source/WebKit/UIProcess/ios/WKSystemPreviewView.mm
    M Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm
    M Source/WebKit/UIProcess/mac/CorrectionPanel.mm
    M Source/WebKit/UIProcess/mac/PageClientImplMac.mm
    M Source/WebKit/UIProcess/mac/RemoteWebInspectorProxyMac.mm
    M Source/WebKit/UIProcess/mac/TextCheckerMac.mm
    M Source/WebKit/UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm
    M Source/WebKit/UIProcess/mac/ViewGestureControllerMac.mm
    M Source/WebKit/UIProcess/mac/ViewSnapshotStore.mm
    M Source/WebKit/UIProcess/mac/WKFullKeyboardAccessWatcher.mm
    M Source/WebKit/UIProcess/mac/WKFullScreenWindowController.mm
    M Source/WebKit/UIProcess/mac/WKImmediateActionController.mm
    M Source/WebKit/UIProcess/mac/WKPrintingView.mm
    M Source/WebKit/UIProcess/mac/WKTextFinderClient.mm
    M Source/WebKit/UIProcess/mac/WKTextInputWindowController.mm
    M Source/WebKit/UIProcess/mac/WKViewLayoutStrategy.mm
    M Source/WebKit/UIProcess/mac/WebColorPickerMac.mm
    M Source/WebKit/UIProcess/mac/WebContextMenuProxyMac.mm
    M Source/WebKit/UIProcess/mac/WebInspectorProxyMac.mm
    M Source/WebKit/UIProcess/mac/WebPageProxyMac.mm
    M Source/WebKit/UIProcess/mac/WebPopupMenuProxyMac.mm
    M Source/WebKit/UIProcess/win/PageClientImpl.cpp
    M Source/WebKit/UIProcess/win/TextCheckerWin.cpp
    M Source/WebKit/UIProcess/win/WebContextMenuProxyWin.cpp
    M Source/WebKit/UIProcess/win/WebPopupMenuProxyWin.cpp
    M Source/WebKit/UIProcess/win/WebView.cpp
    M Source/WebKit/UIProcess/wpe/TextCheckerWPE.cpp
    M Source/WebKit/UIProcess/wpe/WebPasteboardProxyWPE.cpp

  Log Message:
  -----------
  Merge r235265 - Use unified build for UIProcess
https://bugs.webkit.org/show_bug.cgi?id=185014

Reviewed by Alex Christensen.

* Sources.txt:
* SourcesCocoa.txt:
* UIProcess/API/APIWebsiteDataStore.h:
* UIProcess/API/Cocoa/WKWebView.mm:
* UIProcess/API/Cocoa/WKWebViewConfiguration.mm:
(-[WKWebViewConfiguration urlSchemeHandlerForURLScheme:]):
* UIProcess/API/glib/IconDatabase.cpp:
* UIProcess/API/gtk/PageClientImpl.cpp:
* UIProcess/API/gtk/WebKitColorChooser.cpp:
* UIProcess/API/gtk/WebKitPopupMenu.cpp:
* UIProcess/API/gtk/WebKitRemoteInspectorProtocolHandler.cpp:
* UIProcess/ApplicationStateTracker.mm:
* UIProcess/Authentication/mac/WebCredentialMac.mm:
* UIProcess/Automation/cocoa/WebAutomationSessionCocoa.mm:
* UIProcess/Automation/ios/WebAutomationSessionIOS.mm:
* UIProcess/Automation/mac/WebAutomationSessionMac.mm:
* UIProcess/Cocoa/NavigationState.mm:
* UIProcess/Cocoa/PlaybackSessionManagerProxy.mm:
* UIProcess/Cocoa/UserMediaCaptureManagerProxy.cpp:
* UIProcess/Cocoa/VideoFullscreenManagerProxy.mm:
* UIProcess/Cocoa/ViewGestureController.cpp:
* UIProcess/Cocoa/WKWebViewContentProviderRegistry.mm:
(-[WKWebViewContentProviderRegistry initWithConfiguration:]):
(-[WKWebViewContentProviderRegistry addPage:]):
(-[WKWebViewContentProviderRegistry removePage:]):
* UIProcess/Cocoa/WebPageProxyCocoa.mm:
* UIProcess/Cocoa/WebPasteboardProxyCocoa.mm:
* UIProcess/Cocoa/WebProcessPoolCocoa.mm:
* UIProcess/Cocoa/WebURLSchemeHandlerCocoa.mm:
* UIProcess/Cocoa/WebViewImpl.mm:
(WebKit::WebViewImpl::performDragOperation):
* UIProcess/Downloads/DownloadProxy.cpp:
* UIProcess/DrawingAreaProxy.cpp:
* UIProcess/Gamepad/UIGamepad.cpp:
* UIProcess/Gamepad/UIGamepadProvider.cpp:
* UIProcess/Gamepad/cocoa/UIGamepadProviderCocoa.mm:
* UIProcess/HighPerformanceGraphicsUsageSampler.cpp:
* UIProcess/Network/NetworkProcessProxy.cpp:
* UIProcess/Notifications/WebNotificationManagerProxy.cpp:
* UIProcess/PerActivityStateCPUUsageSampler.cpp:
* UIProcess/Plugins/PluginInfoStore.cpp:
* UIProcess/Plugins/PluginProcessProxy.cpp:
* UIProcess/Plugins/mac/PluginInfoStoreMac.mm:
* UIProcess/Plugins/mac/PluginProcessProxyMac.mm:
* UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:
* UIProcess/RemoteLayerTree/RemoteLayerTreeHost.mm:
* UIProcess/RemoteLayerTree/RemoteLayerTreeScrollingPerformanceData.mm:
* UIProcess/RemoteLayerTree/RemoteScrollingCoordinatorProxy.cpp:
* UIProcess/RemoteLayerTree/RemoteScrollingTree.cpp:
* UIProcess/RemoteLayerTree/ios/RemoteScrollingCoordinatorProxyIOS.mm:
* UIProcess/RemoteLayerTree/ios/ScrollingTreeOverflowScrollingNodeIOS.mm:
* UIProcess/RemoteWebInspectorProxy.cpp:
* UIProcess/ResourceLoadStatisticsMemoryStore.cpp:
* UIProcess/ServiceWorkerProcessProxy.cpp:
* UIProcess/Storage/StorageProcessProxy.cpp:
* UIProcess/SuspendedPageProxy.cpp:
* UIProcess/TextCheckerCompletion.cpp:
* UIProcess/UIMessagePortChannelProvider.cpp:
* UIProcess/UserMediaPermissionCheckProxy.cpp:
* UIProcess/UserMediaPermissionRequestManagerProxy.cpp:
* UIProcess/UserMediaPermissionRequestProxy.cpp:
* UIProcess/VisitedLinkStore.cpp:
* UIProcess/WKInspectorHighlightView.mm:
(findIntersectionOnLineBetweenPoints):
(quadIntersection):
(layerPathWithHole):
(layerPath):
(-[WKInspectorHighlightView _layoutForNodeHighlight:offset:]):
(-[WKInspectorHighlightView _layoutForNodeListHighlight:]):
(-[WKInspectorHighlightView _layoutForRectsHighlight:]):
(-[WKInspectorHighlightView update:]):
* UIProcess/WebBackForwardList.cpp:
* UIProcess/WebContextMenuListenerProxy.cpp:
* UIProcess/WebCookieManagerProxy.cpp:
* UIProcess/WebEditCommandProxy.cpp:
* UIProcess/WebFrameProxy.cpp:
* UIProcess/WebFullScreenManagerProxy.cpp:
* UIProcess/WebInspectorProxy.cpp:
* UIProcess/WebNavigationState.cpp:
* UIProcess/WebOpenPanelResultListenerProxy.cpp:
* UIProcess/WebPageInjectedBundleClient.cpp:
* UIProcess/WebPageProxy.cpp:
* UIProcess/WebProcessPool.cpp:
* UIProcess/WebProcessProxy.cpp:
* UIProcess/WebStorage/LocalStorageDatabaseTracker.cpp:
* UIProcess/WebURLSchemeHandler.cpp:
* UIProcess/WebURLSchemeTask.cpp:
* UIProcess/gtk/AcceleratedBackingStoreWayland.cpp:
* UIProcess/gtk/AcceleratedBackingStoreX11.cpp:
* UIProcess/ios/DragDropInteractionState.mm:
* UIProcess/ios/InputViewUpdateDeferrer.mm:
* UIProcess/ios/PageClientImplIOS.mm:
(-[WKEditCommandObjC initWithWebEditCommandProxy:]):
(-[WKEditCommandObjC command]):
* UIProcess/ios/SmartMagnificationController.mm:
* UIProcess/ios/TextCheckerIOS.mm:
* UIProcess/ios/ViewGestureControllerIOS.mm:
(WebKit::ViewGestureController::beginSwipeGesture):
(WebKit::ViewGestureController::removeSwipeSnapshot):
* UIProcess/ios/WKActionSheetAssistant.mm:
(presentationStyleForView):
* UIProcess/ios/WKApplicationStateTrackingView.mm:
(-[WKApplicationStateTrackingView initWithFrame:webView:]):
(-[WKApplicationStateTrackingView _applicationDidEnterBackground]):
(-[WKApplicationStateTrackingView _applicationDidFinishSnapshottingAfterEnteringBackground]):
(-[WKApplicationStateTrackingView _applicationWillEnterForeground]):
* UIProcess/ios/WKGeolocationProviderIOS.mm:
(-[WKGeolocationProviderIOS _startUpdating]):
(-[WKGeolocationProviderIOS _stopUpdating]):
(-[WKGeolocationProviderIOS _setEnableHighAccuracy:]):
(-[WKGeolocationProviderIOS init]):
(-[WKGeolocationProviderIOS initWithProcessPool:]):
(-[WKGeolocationProviderIOS decidePolicyForGeolocationRequestFromOrigin:frame:completionHandler:view:]):
(-[WKGeolocationProviderIOS geolocationAuthorizationGranted]):
(-[WKLegacyCoreLocationProvider positionChanged:]):
* UIProcess/ios/WKKeyboardScrollingAnimator.mm:
(-[WKKeyboardScrollingAnimator _scrollOffsetForEvent:]):
(-[WKKeyboardScrollingAnimator beginWithEvent:]):
(-[WKKeyboardScrollingAnimator handleKeyEvent:]):
(-[WKKeyboardScrollingAnimator startAnimatedScroll]):
(-[WKKeyboardScrollingAnimator stopAnimatedScroll]):
* UIProcess/ios/WKLegacyPDFView.mm:
* UIProcess/ios/WKPDFView.mm:
(-[WKPDFView web_setContentProviderData:suggestedFilename:]):
* UIProcess/ios/WKScrollView.mm:
(-[WKScrollView _systemContentInset]):
* UIProcess/ios/WKSystemPreviewView.mm:
* UIProcess/ios/WebPageProxyIOS.mm:
* UIProcess/mac/CorrectionPanel.mm:
(correctionIndicatorType):
* UIProcess/mac/PageClientImplMac.mm:
* UIProcess/mac/RemoteWebInspectorProxyMac.mm:
(-[WKRemoteWebInspectorProxyObjCAdapter initWithRemoteWebInspectorProxy:]):
* UIProcess/mac/TextCheckerMac.mm:
* UIProcess/mac/TiledCoreAnimationDrawingAreaProxy.mm:
* UIProcess/mac/ViewGestureControllerMac.mm:
* UIProcess/mac/ViewSnapshotStore.mm:
* UIProcess/mac/WKFullKeyboardAccessWatcher.mm:
(-[WKFullKeyboardAccessWatcher notifyAllProcessPools]):
* UIProcess/mac/WKFullScreenWindowController.mm:
(WebKit::WKFullScreenWindowControllerVideoFullscreenModelClient::setInterface):
(WebKit::WKFullScreenWindowControllerVideoFullscreenModelClient::interface const):
(-[WKFullScreenWindowController initWithWindow:webView:page:]):
(-[WKFullScreenWindowController enterFullScreen:]):
(-[WKFullScreenWindowController finishedEnterFullScreenAnimation:]):
(-[WKFullScreenWindowController finishedExitFullScreenAnimation:]):
(-[WKFullScreenWindowController windowDidEnterFullScreen:]):
(-[WKFullScreenWindowController windowDidExitFullScreen:]):
(-[WKFullScreenWindowController _manager]):
(-[WKFullScreenWindowController _replaceView:with:]):
(zoomAnimation):
(createMask):
(maskAnimation):
* UIProcess/mac/WKImmediateActionController.mm:
(-[WKImmediateActionController initWithPage:view:viewImpl:recognizer:]):
(-[WKImmediateActionController willDestroyView:]):
(-[WKImmediateActionController _clearImmediateActionState]):
(-[WKImmediateActionController didPerformImmediateActionHitTest:contentPreventsDefault:userData:]):
(-[WKImmediateActionController immediateActionRecognizerWillPrepare:]):
(-[WKImmediateActionController immediateActionRecognizerWillBeginAnimation:]):
(-[WKImmediateActionController _webHitTestResult]):
(-[WKImmediateActionController _defaultAnimationController]):
(-[WKImmediateActionController menuItem:maxSizeForPoint:]):
(-[WKImmediateActionController _animationControllerForDataDetectedText]):
(-[WKImmediateActionController _animationControllerForDataDetectedLink]):
(-[WKImmediateActionController _animationControllerForText]):
* UIProcess/mac/WKInspectorViewController.mm:
(-[WKInspectorViewController initWithInspectedPage:]):
(-[WKInspectorViewController webView]):
(-[WKInspectorViewController configuration]):
(-[WKInspectorViewController webView:runOpenPanelWithParameters:initiatedByFrame:completionHandler:]):
(-[WKInspectorViewController webView:decidePolicyForNavigationAction:decisionHandler:]):
(-[WKInspectorViewController inspectorWKWebViewReload:]):
* UIProcess/mac/WKPrintingView.mm:
(-[WKPrintingView _expectedPreviewCallbackForRect:]):
(pageDidDrawToImage):
(-[WKPrintingView _preparePDFDataForPrintingOnSecondaryThread]):
(pageDidComputePageRects):
(-[WKPrintingView _askPageToComputePageRects]):
(-[WKPrintingView _pageForRect:]):
(-[WKPrintingView _drawPDFDocument:page:atPoint:]):
(-[WKPrintingView _drawPreview:]):
(-[WKPrintingView drawRect:]):
(-[WKPrintingView rectForPage:]):
* UIProcess/mac/WKTextFinderClient.mm:
(-[WKTextFinderClient initWithPage:view:]):
(-[WKTextFinderClient findMatchesForString:relativeToMatch:findOptions:maxResults:resultCollector:]):
(-[WKTextFinderClient getSelectedText:]):
(arrayFromRects):
(-[WKTextFinderClient didFindStringMatchesWithRects:didWrapAround:]):
(-[WKTextFinderClient didGetImageForMatchResult:]):
* UIProcess/mac/WKTextInputWindowController.mm:
* UIProcess/mac/WKViewLayoutStrategy.mm:
(+[WKViewLayoutStrategy layoutStrategyWithPage:view:viewImpl:mode:]):
(-[WKViewLayoutStrategy initWithPage:view:viewImpl:mode:]):
(-[WKViewViewSizeLayoutStrategy initWithPage:view:viewImpl:mode:]):
(-[WKViewFixedSizeLayoutStrategy initWithPage:view:viewImpl:mode:]):
(-[WKViewDynamicSizeComputedFromViewScaleLayoutStrategy initWithPage:view:viewImpl:mode:]):
(-[WKViewDynamicSizeComputedFromMinimumDocumentSizeLayoutStrategy initWithPage:view:viewImpl:mode:]):
* UIProcess/mac/WebColorPickerMac.mm:
* UIProcess/mac/WebContextMenuProxyMac.mm:
(-[WKMenuTarget forwardContextMenuAction:]):
(WebKit::menuItemIdentifier):
(WebKit::WebContextMenuProxyMac::createContextMenuItem):
* UIProcess/mac/WebInspectorProxyMac.mm:
(-[WKWebInspectorProxyObjCAdapter initWithWebInspectorProxy:]):
* UIProcess/mac/WebPageProxyMac.mm:
* UIProcess/mac/WebPopupMenuProxyMac.mm:
* UIProcess/win/PageClientImpl.cpp:
* UIProcess/win/TextCheckerWin.cpp:
* UIProcess/win/WebContextMenuProxyWin.cpp:
* UIProcess/win/WebPopupMenuProxyWin.cpp:
* UIProcess/win/WebView.cpp:
* UIProcess/wpe/TextCheckerWPE.cpp:
* UIProcess/wpe/WebPasteboardProxyWPE.cpp:
* WebKit.xcodeproj/project.pbxproj:


  Commit: 31d5be3979972e17ddc6152f79c6ac58bd7463b2
      https://github.com/WebKit/WebKit/commit/31d5be3979972e17ddc6152f79c6ac58bd7463b2
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/events/init-event-clears-capslock-expected.txt
    A LayoutTests/fast/events/init-event-clears-capslock.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/UIEventWithKeyState.h

  Log Message:
  -----------
  Merge r235268 - initKeyboardEvent doesn't clear CapsLock state
https://bugs.webkit.org/show_bug.cgi?id=188909

Reviewed by Wenson Hsieh.

Source/WebCore:

Fixed the bug by not preserving CapsLock state in setModifierKeys variant which takes boolean
for altGraphKey, which is only called by KeyboardEvent::initKeyboardEvent.

Test: fast/events/init-event-clears-capslock.html

* dom/UIEventWithKeyState.h:
(WebCore::UIEventWithKeyState::setModifierKeys):

LayoutTests:

Added a regression test. Note that altGraph is only supported in WebKit
so Chrome and Firefox would fail to reset it via initKeyboardEvent.

* fast/events/init-event-clears-capslock-expected.txt: Added.
* fast/events/init-event-clears-capslock.html: Added.


  Commit: 761971725f45ec754f7ce177a7ca737d89ef1cbc
      https://github.com/WebKit/WebKit/commit/761971725f45ec754f7ce177a7ca737d89ef1cbc
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/WeakPtr.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/MediaQueryEvaluator.cpp
    M Source/WebCore/css/MediaQueryEvaluator.h
    M Source/WebCore/rendering/FloatingObjects.cpp
    M Source/WebCore/rendering/FloatingObjects.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/WeakPtr.cpp

  Log Message:
  -----------
  Merge r235315 - Allow creating WeakPtrs to const objects
https://bugs.webkit.org/show_bug.cgi?id=188785

Reviewed by Geoff Garen.

Source/WebCore:

Remove some unneeded const_casts.

* css/MediaQueryEvaluator.cpp:
(WebCore::MediaQueryEvaluator::MediaQueryEvaluator):
(WebCore::MediaQueryEvaluator::evaluate const):
* css/MediaQueryEvaluator.h:
* rendering/FloatingObjects.cpp:
(WebCore::ComputeFloatOffsetAdapter::ComputeFloatOffsetAdapter):
(WebCore::ComputeFloatOffsetForFloatLayoutAdapter::ComputeFloatOffsetForFloatLayoutAdapter):
(WebCore::ComputeFloatOffsetForLineLayoutAdapter::ComputeFloatOffsetForLineLayoutAdapter):
(WebCore::FindNextFloatLogicalBottomAdapter::FindNextFloatLogicalBottomAdapter):
(WebCore::FloatingObjects::FloatingObjects):
* rendering/FloatingObjects.h:
(WebCore::FloatingObjects::renderer const):

Source/WTF:

const Foo foo;
WeakPtr<const Foo> weakConstFoo = makeWeakPtr(foo);

* wtf/WeakPtr.h:
(WTF::WeakPtrFactory::createWeakPtr const):

Add a separate factory function for const T.
The underlying WeakReference is kept non-const in all cases.

Tools:

* TestWebKitAPI/Tests/WTF/WeakPtr.cpp:
(TestWebKitAPI::Base::weakPtrFactory const):
(TestWebKitAPI::TEST):
(TestWebKitAPI::Base::weakPtrFactory): Deleted.


  Commit: fbafa82e3c5b30eda9b7401c1364da83ff797775
      https://github.com/WebKit/WebKit/commit/fbafa82e3c5b30eda9b7401c1364da83ff797775
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/yarr/YarrJIT.cpp
    M Source/JavaScriptCore/yarr/YarrJIT.h

  Log Message:
  -----------
  Merge r235322 - YARR: JIT RegExps with non-greedy parenthesized sub patterns
https://bugs.webkit.org/show_bug.cgi?id=180876

Reviewed by Filip Pizlo.

Implemented the non-greedy nested parenthesis based on the prior greedy nested parenthesis work.
For the matching code, the greedy path was correct except that we don't try matching for the
non-greedy case.  Added a jump out to the term after the parenthesis and a label to perform the
first / next match when we backtrack.  The backtracking code needs to check to see if we have
tried the first match or if we can do another match.

Updated the disassembly annotations to include parenthesis capturing info, quantifier type and
count.  Did other minor cleanup as well.

Fixed function name typo, added missing 't' in "setUsesPaternContextBuffer()".

Updated the text in some comments, both for this change as well as accuracy for existing code.

* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generate):
(JSC::Yarr::YarrGenerator::backtrack):
(JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
(JSC::Yarr::YarrGenerator::compile):
(JSC::Yarr::dumpCompileFailure):
(JSC::Yarr::jitCompile):
* yarr/YarrJIT.h:
(JSC::Yarr::YarrCodeBlock::setUsesPatternContextBuffer):
(JSC::Yarr::YarrCodeBlock::setUsesPaternContextBuffer): Deleted.


  Commit: 92b828e2167f5127d6d577fbc227f43bd2c83e88
      https://github.com/WebKit/WebKit/commit/92b828e2167f5127d6d577fbc227f43bd2c83e88
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/events/constructors/keyboard-event-getModifierState-expected.txt
    M LayoutTests/fast/events/constructors/keyboard-event-getModifierState.html
    A LayoutTests/fast/events/constructors/mouse-event-getModifierState-expected.txt
    A LayoutTests/fast/events/constructors/mouse-event-getModifierState.html
    A LayoutTests/fast/events/dblclick-event-getModifierState-expected.txt
    A LayoutTests/fast/events/dblclick-event-getModifierState.html
    M LayoutTests/fast/events/init-event-clears-capslock-expected.txt
    M LayoutTests/fast/events/init-event-clears-capslock.html
    M LayoutTests/platform/ios/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/KeyboardEvent.cpp
    M Source/WebCore/dom/KeyboardEvent.h
    M Source/WebCore/dom/KeyboardEvent.idl
    M Source/WebCore/dom/MouseEvent.idl
    M Source/WebCore/dom/UIEventWithKeyState.cpp
    M Source/WebCore/dom/UIEventWithKeyState.h

  Log Message:
  -----------
  Merge r235329 - Add getModifierState to MouseEvent
https://bugs.webkit.org/show_bug.cgi?id=188913
<rdar://problem/43668772>

Reviewed by Simon Fraser.

Source/WebCore:

Moved getModifierState from KeyboardEvent to UIEventWithKeyState and exposed it in MouseEvent.
See https://www.w3.org/TR/2016/WD-uievents-20160804/#mouseevent

This patch also fixes the bug that initMouseEvent was not clearing AltGraph and CapsLock states,
which was preserved in the refactoring done in r235158.

Tests: fast/events/constructors/mouse-event-getModifierState.html
       fast/events/dblclick-event-getModifierState.html

* dom/KeyboardEvent.cpp:
(WebCore::KeyboardEvent::getModifierState const): Moved to UIEventWithKeyState.
* dom/KeyboardEvent.h:
* dom/KeyboardEvent.idl: Insert a blank line to match the spec's IDL.
* dom/MouseEvent.idl: Added getModifierState.
* dom/UIEventWithKeyState.cpp:
(WebCore::UIEventWithKeyState::modifiersFromInitializer): Moved from the header file.
(WebCore::UIEventWithKeyState::getModifierState const):
(WebCore::UIEventWithKeyState::setModifierKeys): Moved from the header file.
* dom/UIEventWithKeyState.h:
(WebCore::UIEventWithKeyState::modifierKeys const):
(WebCore::UIEventWithKeyState::setModifierKeys): Deleted the variant which didn't take altGraphKey
since that variant behaves same as the one which takes altGraphKey.

LayoutTests:

Added two tests for getModifierState: one manually setting modifier key states in MouseEvent's constructor,
and another one for dblclick inheriting modifier key states from the click event.

Also improved the test coverage for KeyboardEvent's getModifierState.

* fast/events/constructors/keyboard-event-getModifierState-expected.txt:
* fast/events/constructors/keyboard-event-getModifierState.html: Added more test cases.
* fast/events/constructors/mouse-event-getModifierState-expected.txt: Added.
* fast/events/constructors/mouse-event-getModifierState.html: Added.
* fast/events/dblclick-event-getModifierState-expected.txt: Added.
* fast/events/dblclick-event-getModifierState.html: Added.
* fast/events/init-event-clears-capslock-expected.txt:
* fast/events/init-event-clears-capslock.html: Added tests for MouseEvent. Note that initMouseEvent doesn't
take altGraphKey boolean unlike initKeyboardEvent.
* platform/ios/TestExpectations: Skip the dblclick test in iOS since click event isn't supported on iOS.


  Commit: 46485ecc7284fb2ea27385bd3b99b0e81d3526ca
      https://github.com/WebKit/WebKit/commit/46485ecc7284fb2ea27385bd3b99b0e81d3526ca
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.cpp
    M Source/JavaScriptCore/yarr/YarrCanonicalizeUCS2.js

  Log Message:
  -----------
  Merge r235333 - YARR: Update UCS canonicalization tables for Unicode 11
https://bugs.webkit.org/show_bug.cgi?id=188928

Reviewed by Mark Lam.

Generated YarrCanonicalizeUCS2.cpp from YarrCanonicalizeUCS2.js.

This passes JavaScriptCore and test262 tests.

* yarr/YarrCanonicalizeUCS2.cpp:
* yarr/YarrCanonicalizeUCS2.js:
(printHeader):


  Commit: b60d822c634b1434275fb9853d4df9d4ba498c46
      https://github.com/WebKit/WebKit/commit/b60d822c634b1434275fb9853d4df9d4ba498c46
  Author: Tim Horton <thorton at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/Scripts/generate-unified-source-bundles.rb

  Log Message:
  -----------
  Merge r235336 - Improve unified source generator script logging and error messages
https://bugs.webkit.org/show_bug.cgi?id=188932

Reviewed by Simon Fraser.

* Scripts/generate-unified-source-bundles.rb:
Add the ability to explain why you're getting usage() instead of just printing it.
Capitalize log messages, and improve the wording in a few places.


  Commit: 7bad169338bf067d5a229afa20e3ace8dba3dc38
      https://github.com/WebKit/WebKit/commit/7bad169338bf067d5a229afa20e3ace8dba3dc38
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/IDBCursor.cpp
    M Source/WebCore/Modules/indexeddb/IDBCursor.h
    M Source/WebCore/Modules/indexeddb/IDBCursor.idl
    M Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
    M Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h
    M Source/WebCore/Modules/indexeddb/IDBCursorWithValue.idl
    M Source/WebCore/Modules/indexeddb/IDBRequest.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequest.h
    M Source/WebCore/Modules/indexeddb/IDBTransaction.cpp

  Log Message:
  -----------
  Merge r235344 - IDBCursor does not need to be an ActiveDOMObject
https://bugs.webkit.org/show_bug.cgi?id=188937

Reviewed by Alex Christensen.

Remove ActiveDOMObject from IDBCursor IDL.
Update constructors and call sites accordingly.
This allows removing m_outstandingRequestCount and related code in IDBRequest.

Covered by existing tests.

* Modules/indexeddb/IDBCursor.cpp:
(WebCore::IDBCursor::create):
(WebCore::IDBCursor::IDBCursor):
(WebCore::IDBCursor::update):
(WebCore::IDBCursor::uncheckedIterateCursor):
(WebCore::IDBCursor::deleteFunction):
(WebCore::IDBCursor::activeDOMObjectName const): Deleted.
(WebCore::IDBCursor::canSuspendForDocumentSuspension const): Deleted.
(WebCore::IDBCursor::hasPendingActivity const): Deleted.
(WebCore::IDBCursor::decrementOutstandingRequestCount): Deleted.
* Modules/indexeddb/IDBCursor.h:
* Modules/indexeddb/IDBCursor.idl:
* Modules/indexeddb/IDBCursorWithValue.cpp:
(WebCore::IDBCursorWithValue::create):
(WebCore::IDBCursorWithValue::IDBCursorWithValue):
* Modules/indexeddb/IDBCursorWithValue.h:
* Modules/indexeddb/IDBCursorWithValue.idl:
* Modules/indexeddb/IDBRequest.cpp:
(WebCore::IDBRequest::setSource):
(WebCore::IDBRequest::dispatchEvent):
(WebCore::IDBRequest::willIterateCursor):
(WebCore::IDBRequest::didOpenOrIterateCursor):
* Modules/indexeddb/IDBRequest.h:
* Modules/indexeddb/IDBTransaction.cpp:
(WebCore::IDBTransaction::requestOpenCursor):
* WebCore.xcodeproj/project.pbxproj:


  Commit: ffff014ed71cec87a186a2938d991e14da2383ae
      https://github.com/WebKit/WebKit/commit/ffff014ed71cec87a186a2938d991e14da2383ae
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/IDBCursor.cpp
    M Source/WebCore/Modules/indexeddb/IDBCursor.h
    M Source/WebCore/Modules/indexeddb/IDBRequest.h

  Log Message:
  -----------
  Merge r235345 - Make IDBCursor::m_request a WeakPtr
https://bugs.webkit.org/show_bug.cgi?id=188938

Reviewed by Alex Christensen.

Make m_request a WeakPtr so that if m_request is destroyed, the related cursor will not use the invalid pointer.

Covered by existing tests.

* Modules/indexeddb/IDBCursor.cpp:
(WebCore::IDBCursor::continuePrimaryKey): Other continue and advance methods that are calling uncheckedIterateCursor do check for m_request.
Apply the same check for continuePrimaryKey.
(WebCore::IDBCursor::uncheckedIterateCursor):
* Modules/indexeddb/IDBCursor.h:
(WebCore::IDBCursor::setRequest):
(WebCore::IDBCursor::clearRequest):
(WebCore::IDBCursor::request):
* Modules/indexeddb/IDBRequest.h:


  Commit: 0865e23362fbcfa11c8d45c82f390ec35ccf06d5
      https://github.com/WebKit/WebKit/commit/0865e23362fbcfa11c8d45c82f390ec35ccf06d5
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/text/StringBuilder.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/xml/XMLHttpRequest.cpp
    M Source/WebCore/xml/XMLHttpRequest.h
    M Source/WebCore/xml/XMLHttpRequestProgressEventThrottle.cpp
    M Source/WebCore/xml/XMLHttpRequestProgressEventThrottle.h

  Log Message:
  -----------
  Merge r235355 - Shrink size of XMLHttpRequest
https://bugs.webkit.org/show_bug.cgi?id=188944

Reviewed by Saam Barati.

Source/WebCore:

Shrink the size of XMLHttpRequest by packing bits and reordering members.
It reduces the size from 1248 to 1176.

No behavior change.

* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::XMLHttpRequest):
(WebCore::XMLHttpRequest::responseText):
(WebCore::XMLHttpRequest::createResponseBlob):
(WebCore::XMLHttpRequest::createResponseArrayBuffer):
(WebCore::XMLHttpRequest::setResponseType):
(WebCore::XMLHttpRequest::changeState):
(WebCore::XMLHttpRequest::callReadyStateChangeListener):
(WebCore::XMLHttpRequest::setWithCredentials):
(WebCore::XMLHttpRequest::open):
(WebCore::XMLHttpRequest::prepareToSend):
(WebCore::XMLHttpRequest::createRequest):
(WebCore::XMLHttpRequest::abort):
(WebCore::XMLHttpRequest::overrideMimeType):
(WebCore::XMLHttpRequest::setRequestHeader):
(WebCore::XMLHttpRequest::getAllResponseHeaders const):
(WebCore::XMLHttpRequest::getResponseHeader const):
(WebCore::XMLHttpRequest::status const):
(WebCore::XMLHttpRequest::statusText const):
(WebCore::XMLHttpRequest::didFinishLoading):
(WebCore::XMLHttpRequest::createDecoder const):
(WebCore::XMLHttpRequest::didReceiveData):
(WebCore::XMLHttpRequest::didReachTimeout):
(WebCore::XMLHttpRequest::readyState const): Deleted.
* xml/XMLHttpRequest.h:
(WebCore::XMLHttpRequest::responseType const):
(WebCore::XMLHttpRequest::readyState const):
* xml/XMLHttpRequestProgressEventThrottle.cpp:
(WebCore::XMLHttpRequestProgressEventThrottle::XMLHttpRequestProgressEventThrottle):
* xml/XMLHttpRequestProgressEventThrottle.h:

Source/WTF:

StringBuilder is included in XMLHttpRequest. We reduce the size of StringBuilder too
by reordering members.

* wtf/text/StringBuilder.h:
(WTF::StringBuilder::StringBuilder):


  Commit: 733bbe9ced30531db64c4150a6e847411ca4b24f
      https://github.com/WebKit/WebKit/commit/733bbe9ced30531db64c4150a6e847411ca4b24f
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-09-17 (Mon, 17 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/reverse-with-immutable-butterfly.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/ArrayPrototype.cpp
    M Source/JavaScriptCore/runtime/JSArray.cpp
    M Source/JavaScriptCore/runtime/JSArrayInlines.h
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/JSObject.h

  Log Message:
  -----------
  [JSC] Array.prototype.reverse modifies JSImmutableButterfly
https://bugs.webkit.org/show_bug.cgi?id=188794

Reviewed by Saam Barati.

JSTests:

* stress/reverse-with-immutable-butterfly.js: Added.
(shouldBe):
(reverseInt):
(reverseDouble):
(reverseContiguous):

Source/JavaScriptCore:

While Array.prototype.reverse modifies the butterfly of the given Array,
it does not account JSImmutableButterfly case. So it accidentally modifies
the content of JSImmutableButterfly.
This patch converts CoW arrays to writable arrays before reversing.

* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncReverse):
* runtime/JSObject.h:
(JSC::JSObject::ensureWritable):


  Commit: 7bce957b120e96bf50f20b30fc1ba825c5766859
      https://github.com/WebKit/WebKit/commit/7bce957b120e96bf50f20b30fc1ba825c5766859
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLCollection.cpp
    M Source/WebCore/html/HTMLCollection.h

  Log Message:
  -----------
  Merge r235357 - Shrink size of HTMLCollection
https://bugs.webkit.org/show_bug.cgi?id=188945

Reviewed by Darin Adler.

Shrink the size of HTMLCollection by reordering members.

No behavior change.

* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::HTMLCollection):
* html/HTMLCollection.h:


  Commit: 27d1b1c3bdb38fd4e39b8fc02c023ba1212829c6
      https://github.com/WebKit/WebKit/commit/27d1b1c3bdb38fd4e39b8fc02c023ba1212829c6
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/setrequestheader-content-type-expected.txt
    M LayoutTests/platform/gtk/imported/w3c/web-platform-tests/XMLHttpRequest/setrequestheader-content-type-expected.txt
    M LayoutTests/platform/ios/imported/w3c/web-platform-tests/XMLHttpRequest/setrequestheader-content-type-expected.txt
    M LayoutTests/platform/wpe/imported/w3c/web-platform-tests/XMLHttpRequest/setrequestheader-content-type-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/xml/XMLHttpRequest.cpp

  Log Message:
  -----------
  Merge r235360 - XMLHTTPRequest.send for Document should have same Content-Type processing rules as String
https://bugs.webkit.org/show_bug.cgi?id=188953

Patch by Rob Buis <rbuis at igalia.com> on 2018-08-27
Reviewed by Darin Adler.

LayoutTests/imported/w3c:

* web-platform-tests/xhr/setrequestheader-content-type-expected.txt:

Source/WebCore:

Processing rules for Content-Type have been implemented for send with String as parameter, but
not for Document, but both should be treated the same according to the spec [1]. This patch
implements this.

Behavior matches Firefox.

[1] https://xhr.spec.whatwg.org/#the-send()-method

Test: web-platform-tests/XMLHttpRequest/setrequestheader-content-type.htm

* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::send):

LayoutTests:

* platform/gtk/imported/w3c/web-platform-tests/xhr/setrequestheader-content-type-expected.txt:
* platform/ios/imported/w3c/web-platform-tests/xhr/setrequestheader-content-type-expected.txt:
* platform/wpe/imported/w3c/web-platform-tests/xhr/setrequestheader-content-type-expected.txt:


  Commit: 26286b644224e7083b4577a57abc42e3905f52a6
      https://github.com/WebKit/WebKit/commit/26286b644224e7083b4577a57abc42e3905f52a6
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp
    M Source/WebKit/NetworkProcess/cache/NetworkCacheSpeculativeLoad.h
    M Source/WebKit/Shared/Authentication/AuthenticationManager.cpp

  Log Message:
  -----------
  Merge r235400 - Pass webPageID and webFrameID to NetworkLoad for speculative loads
https://bugs.webkit.org/show_bug.cgi?id=188682

Reviewed by Youenn Fablet.

This also removes an authentication shortcut I introduced in r234941

* NetworkProcess/cache/NetworkCacheSpeculativeLoad.cpp:
(WebKit::NetworkCache::SpeculativeLoad::SpeculativeLoad):
(WebKit::NetworkCache::SpeculativeLoad::didReceiveResponse):
* Shared/Authentication/AuthenticationManager.cpp:
(WebKit::AuthenticationManager::didReceiveAuthenticationChallenge):


  Commit: 789c47bd222d61d547d4de3b8f0e2a16103c4a7e
      https://github.com/WebKit/WebKit/commit/789c47bd222d61d547d4de3b8f0e2a16103c4a7e
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/IndexedDB/collect-IDB-objects.https-expected.txt
    A LayoutTests/http/tests/IndexedDB/collect-IDB-objects.https.html
    A LayoutTests/http/tests/IndexedDB/resources/myidbframe.htm
    A LayoutTests/http/tests/IndexedDB/resources/support.js
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/IDBIndex.cpp
    M Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequest.cpp
    M Source/WebCore/Modules/indexeddb/IDBTransaction.cpp

  Log Message:
  -----------
  Merge r235410 - Various IndexDB tests abandon documents
https://bugs.webkit.org/show_bug.cgi?id=188728
<rdar://problem/43651095>

Reviewed by Alex Christensen.

Source/WebCore:

Some IDB objects implement hasPendingActivity but there are some possibilities that they continue returning true after being stopped.
This is the case for requests that get stopped while still waiting for some pending activity.
This is also the case for requests that emits upgradeneeded or blocked events.

Enforce that these objects return false to hasPendingActivity once being stopped.
This ensures that they can be garbage collected once their context is preparing for destruction like in Document::prepareForDestruction.

Test: http/tests/IndexedDB/collect-IDB-objects.https.html

* Modules/indexeddb/IDBIndex.cpp:
(WebCore::IDBIndex::hasPendingActivity const):
* Modules/indexeddb/IDBObjectStore.cpp:
(WebCore::IDBObjectStore::hasPendingActivity const):
* Modules/indexeddb/IDBRequest.cpp:
(WebCore::IDBRequest::hasPendingActivity const):
(WebCore::IDBRequest::enqueueEvent):
* Modules/indexeddb/IDBTransaction.cpp:
(WebCore::IDBTransaction::notifyDidAbort):
In case the context is stopped, IDBTransaction should not ask IDBRequest to fire an event.

LayoutTests:

* http/tests/IndexedDB/collect-IDB-objects.https-expected.txt: Added.
* http/tests/IndexedDB/collect-IDB-objects.https.html: Added.
* http/tests/IndexedDB/resources/myidbframe.htm: Added.
* http/tests/IndexedDB/resources/support.js: Added.


  Commit: bf0c9e98521609cef98cef71be3ada0164937555
      https://github.com/WebKit/WebKit/commit/bf0c9e98521609cef98cef71be3ada0164937555
  Author: Myles C. Maxfield <mmaxfield at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/rtl-justification-expected.html
    A LayoutTests/fast/text/rtl-justification.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/WidthIterator.cpp

  Log Message:
  -----------
  Merge r235416 - Null pointer deref in WidthIterator
https://bugs.webkit.org/show_bug.cgi?id=188993

Reviewed by Brent Fulgham.

Source/WebCore:

Test: fast/text/rtl-justification.html

We simply need to guard glyphBuffer like we do in the rest of the function.

* platform/graphics/WidthIterator.cpp:
(WebCore::WidthIterator::advanceInternal):

LayoutTests:

* fast/text/rtl-justification-expected.html: Added.
* fast/text/rtl-justification.html: Added.


  Commit: 64ea4f669fa91e78f1868838ee7acfa060e1dcae
      https://github.com/WebKit/WebKit/commit/64ea4f669fa91e78f1868838ee7acfa060e1dcae
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediastream/MediaDevices.cpp
    M Source/WebCore/dom/ActiveDOMObject.cpp
    M Source/WebCore/dom/ActiveDOMObject.h

  Log Message:
  -----------
  Merge r235438 - MediaDevices should be collectable as soon as its document is stopped
https://bugs.webkit.org/show_bug.cgi?id=189021

Reviewed by Eric Carlson.

Source/WebCore:

Introduce ActiveDOMObject::isContextStopped to check whether the context is stopped.
Use this check in MediaDevices::hasPendingActivity so that it returns false as soon as active dom objects are stopped.

Test: http/tests/media/collect-media-devices.https.html

* Modules/mediastream/MediaDevices.cpp:
(WebCore::MediaDevices::hasPendingActivity const):
* dom/ActiveDOMObject.cpp:
(WebCore::ActiveDOMObject::hasPendingActivity const):
(WebCore::ActiveDOMObject::isContextStopped const):
* dom/ActiveDOMObject.h:

LayoutTests:

* http/tests/media/media-stream/collect-media-devices.https-expected.txt: Added.
* http/tests/media/media-stream/collect-media-devices.https.html: Added.
* http/tests/media/media-stream/resources/mymediadevicesframe.htm: Added.


  Commit: 782f2921fc9ca45c5332be86e86b83b8cfe7018f
      https://github.com/WebKit/WebKit/commit/782f2921fc9ca45c5332be86e86b83b8cfe7018f
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/IDBDatabase.cpp

  Log Message:
  -----------
  Merge r235456 - IDBDatabase should not return true to hasPendingActivity after being stopped
https://bugs.webkit.org/show_bug.cgi?id=189073

Reviewed by Darin Adler.

There is a chance that IDBDatabase::hasPendingActivity returns true.
The case that might happen is when stop() is called but there are still some active/being committed transactions.
In that case, hasPendingActivity will return true until these transactions get finalized.
While these transactions will probably be finalized at some point, it delays GC for no good reason.
And we might want in a follow-up patch to assert that ActiveDOMObject are GC-able whenever their context is stopped.
For that purpose, make sure hasPendingActivity returns false when context is stopped.

* Modules/indexeddb/IDBDatabase.cpp:
(WebCore::IDBDatabase::hasPendingActivity const):


  Commit: efd0c5dd61d49d1d8422fd9a19628e5f81040a6a
      https://github.com/WebKit/WebKit/commit/efd0c5dd61d49d1d8422fd9a19628e5f81040a6a
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/spatial-navigation/snav-display-contents-crash-expected.txt
    A LayoutTests/fast/spatial-navigation/snav-display-contents-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/SpatialNavigation.cpp

  Log Message:
  -----------
  Merge r235457 - Check for null renderer in canBeScrolledIntoView
https://bugs.webkit.org/show_bug.cgi?id=188935

Reviewed by Simon Fraser.

Source/WebCore:

Test: fast/spatial-navigation/snav-display-contents-crash.html

* page/SpatialNavigation.cpp:
(WebCore::canBeScrolledIntoView):

LayoutTests:

* fast/spatial-navigation/snav-display-contents-crash-expected.txt: Added.
* fast/spatial-navigation/snav-display-contents-crash.html: Added.


  Commit: 7c6afcb48b3a05832bb30b050c0b92d5a9618ba5
      https://github.com/WebKit/WebKit/commit/7c6afcb48b3a05832bb30b050c0b92d5a9618ba5
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/text-combine-surroundContents-crash-expected.txt
    A LayoutTests/fast/text/text-combine-surroundContents-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/InlineTextBox.cpp

  Log Message:
  -----------
  Merge r235485 - REGRESSION (r226138): WebCore::subdivide() may return an empty vector; Web process can crash when performing find in Epiphany
https://bugs.webkit.org/show_bug.cgi?id=184390
<rdar://problem/41804994>
And
<rdar://problem/39771867>

Reviewed by Simon Fraser.

Source/WebCore:

Speculative fix for Epiphany.

In theory, WebCore::subdivide() should never return an empty vector - no subdivisions - as such a
result represents a programmer error. In practice, InlineTextBox can invoke WebCore::subdivide()
such that it returns an empty vector. One way this can happen is when subdividing an empty inline
text box associated with combined text (RenderCombineText). For now we add a check to bail out of
resolving the style of subdivisions when WebCore::subdivide() returns no subdivisions. In a
subsequent patch we will look to assert that WebCore::subdivide() always returns subdivisions.

Test: fast/text/text-combine-surroundContents-crash.html

* rendering/InlineTextBox.cpp:
(WebCore::InlineTextBox::subdivideAndResolveStyle):

LayoutTests:

Add a test to ensure that we do not crash when painting an empty inline text box associated
with combined text.

* fast/text/text-combine-surroundContents-crash-expected.txt: Added.
* fast/text/text-combine-surroundContents-crash.html: Added.


  Commit: b5488ad7f176a1e46c049b649cddec1f0d4e77c9
      https://github.com/WebKit/WebKit/commit/b5488ad7f176a1e46c049b649cddec1f0d4e77c9
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189132.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSCJSValueInlines.h
    M Source/JavaScriptCore/runtime/JSString.cpp

  Log Message:
  -----------
  Merge r235491 - Add some missing exception checks in JSRopeString::resolveRopeToAtomicString().
https://bugs.webkit.org/show_bug.cgi?id=189132
<rdar://problem/42513068>

Reviewed by Saam Barati.

JSTests:

* stress/regress-189132.js: Added.

Source/JavaScriptCore:

* runtime/JSCJSValueInlines.h:
(JSC::JSValue::toPropertyKey const):
* runtime/JSString.cpp:
(JSC::JSRopeString::resolveRopeToAtomicString const):


  Commit: caf6d29e3c83a61e56f6d551e79a9932655712d4
      https://github.com/WebKit/WebKit/commit/caf6d29e3c83a61e56f6d551e79a9932655712d4
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/function-to-string.js
    M JSTests/test262/expectations.yaml
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/FunctionPrototype.cpp

  Log Message:
  -----------
  Merge r235514 - output of toString() of Generator is wrong
https://bugs.webkit.org/show_bug.cgi?id=188952

Reviewed by Saam Barati.

JSTests:

* stress/function-to-string.js: Added.
(shouldBe):
(shouldBe.test):
(test):
(shouldBe.async.test):
(async.test):
(shouldBe.async):
(async):
* test262/expectations.yaml:

Source/JavaScriptCore:

Function#toString does not respect generator and async generator.
This patch fixes them and supports all the function types.

* runtime/FunctionPrototype.cpp:
(JSC::functionProtoFuncToString):


  Commit: 387a3d7b9567e03e8cfc3b65743a0c443b5f1294
      https://github.com/WebKit/WebKit/commit/387a3d7b9567e03e8cfc3b65743a0c443b5f1294
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/microbenchmarks/dataview-cse.js
    A JSTests/stress/dataview-get-cse.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGHeapLocation.cpp
    M Source/JavaScriptCore/dfg/DFGHeapLocation.h

  Log Message:
  -----------
  Merge r235515 - CSE DataViewGet* DFG nodes
https://bugs.webkit.org/show_bug.cgi?id=188768

Reviewed by Yusuke Suzuki.

JSTests:

* microbenchmarks/dataview-cse.js: Added.
(assert):
(test):
* stress/dataview-get-cse.js: Added.
(assert):
(test1.foo):
(test1):
(test2.foo):
(test2):
(test3.foo):
(test3):
(test4.foo):
(test4):
(test5.foo):
(test5):
(test6.foo):
(test6):

Source/JavaScriptCore:

This patch makes it so that we CSE DataViewGet* accesses. To do this,
I needed to add a third descriptor to HeapLocation to represent the
isLittleEndian child. This patch is neutral on compile time benchmarks,
and is a 50% speedup on a trivial CSE microbenchmark that I added.

* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGHeapLocation.h:
(JSC::DFG::HeapLocation::HeapLocation):
(JSC::DFG::HeapLocation::hash const):
(JSC::DFG::HeapLocation::operator== const):
(JSC::DFG::indexedPropertyLocForResultType):


  Commit: 221b86348ffb0e7950636d575ba36ab31bc8390b
      https://github.com/WebKit/WebKit/commit/221b86348ffb0e7950636d575ba36ab31bc8390b
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssembler.h
    M Source/JavaScriptCore/assembler/MacroAssemblerARM64.h
    M Source/JavaScriptCore/bytecode/AccessCase.cpp
    M Source/JavaScriptCore/bytecode/BytecodeDumper.cpp
    M Source/JavaScriptCore/bytecode/InlineAccess.cpp
    M Source/JavaScriptCore/bytecode/InlineAccess.h
    M Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp
    M Source/JavaScriptCore/bytecode/StructureStubInfo.cpp
    M Source/JavaScriptCore/bytecode/StructureStubInfo.h
    M Source/JavaScriptCore/jit/Repatch.cpp

  Log Message:
  -----------
  Merge r235517 - InlineAccess should do StringLength
https://bugs.webkit.org/show_bug.cgi?id=158911

Reviewed by Yusuke Suzuki.

This patch extends InlineAccess to support StringLength. This patch also
fixes AccessCase::fromStructureStubInfo to support ArrayLength and StringLength.
I forgot to implement this for ArrayLength in the initial InlineAccess
implementation.  Supporting StringLength is a natural extension of the
InlineAccess machinery.

* assembler/MacroAssembler.h:
(JSC::MacroAssembler::patchableBranch8):
* assembler/MacroAssemblerARM64.h:
(JSC::MacroAssemblerARM64::patchableBranch8):
* bytecode/AccessCase.cpp:
(JSC::AccessCase::fromStructureStubInfo):
* bytecode/BytecodeDumper.cpp:
(JSC::BytecodeDumper<Block>::printGetByIdCacheStatus):
* bytecode/InlineAccess.cpp:
(JSC::InlineAccess::dumpCacheSizesAndCrash):
(JSC::InlineAccess::generateSelfPropertyAccess):
(JSC::getScratchRegister):
(JSC::InlineAccess::generateSelfPropertyReplace):
(JSC::InlineAccess::generateArrayLength):
(JSC::InlineAccess::generateSelfInAccess):
(JSC::InlineAccess::generateStringLength):
* bytecode/InlineAccess.h:
* bytecode/PolymorphicAccess.cpp:
(JSC::PolymorphicAccess::regenerate):
* bytecode/StructureStubInfo.cpp:
(JSC::StructureStubInfo::initStringLength):
(JSC::StructureStubInfo::deref):
(JSC::StructureStubInfo::aboutToDie):
(JSC::StructureStubInfo::propagateTransitions):
* bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::baseGPR const):
* jit/Repatch.cpp:
(JSC::tryCacheGetByID):


  Commit: 409c6b273f8f03dd2fc668c3b0a2b20f31286b41
      https://github.com/WebKit/WebKit/commit/409c6b273f8f03dd2fc668c3b0a2b20f31286b41
  Author: Tim Horton <thorton at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/Scripts/generate-unified-source-bundles.rb
    M Source/WTF/wtf/Platform.h
    M Source/WTF/wtf/text/StringBuffer.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/cache/WorkerCacheStorageConnection.cpp
    M Source/WebCore/Modules/mediastream/RTCController.cpp
    M Source/WebCore/Modules/paymentrequest/PaymentRequestUpdateEvent.cpp
    M Source/WebCore/Modules/webvr/VRDisplay.cpp
    M Source/WebCore/PAL/pal/crypto/gcrypt/Utilities.h
    M Source/WebCore/SourcesCocoa.txt
    M Source/WebCore/SourcesGTK.txt
    M Source/WebCore/crypto/algorithms/CryptoAlgorithmECDSA.cpp
    M Source/WebCore/crypto/gcrypt/GCryptUtilities.h
    M Source/WebCore/dom/Document.h
    M Source/WebCore/html/parser/HTMLTreeBuilder.cpp
    M Source/WebCore/loader/appcache/ApplicationCacheResourceLoader.h
    M Source/WebCore/page/AlternativeTextClient.h
    M Source/WebCore/platform/Pasteboard.h
    M Source/WebCore/platform/audio/mac/AudioSessionMac.cpp
    M Source/WebCore/platform/graphics/DisplayRefreshMonitor.cpp
    M Source/WebCore/platform/graphics/FontFamilySpecificationNull.cpp
    M Source/WebCore/platform/graphics/FontGenericFamilies.h
    M Source/WebCore/platform/graphics/FontTaggedSettings.cpp
    M Source/WebCore/platform/graphics/cairo/FontCairo.cpp
    M Source/WebCore/platform/graphics/cocoa/WebGLLayer.mm
    M Source/WebCore/platform/graphics/cocoa/WebGPULayer.mm
    M Source/WebCore/platform/graphics/metal/GPUCommandQueueMetal.mm
    M Source/WebCore/platform/mac/PasteboardMac.mm
    M Source/WebCore/platform/mediastream/mac/DisplayCaptureManagerCocoa.cpp
    M Source/WebCore/platform/network/ResourceRequestBase.cpp
    M Source/WebCore/platform/network/soup/SoupNetworkSession.h
    M Source/WebCore/platform/text/TextCodecUTF8.cpp
    M Source/WebCore/platform/text/TextCodecUTF8.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderFormControls.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderInline.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderRuby.cpp
    M Source/WebCore/rendering/updating/RenderTreeUpdater.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/APIWebArchive.mm
    M Source/WebKit/Shared/APIWebArchiveResource.mm
    M Source/WebKit/Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm
    M Source/WebKit/Shared/Plugins/Netscape/mac/PluginInformationMac.mm
    M Source/WebKit/SourcesCocoa.txt
    M Source/WebKit/SourcesGTK.txt
    M Source/WebKit/UIProcess/API/APIAutomationSessionClient.h
    M Source/WebKit/UIProcess/Cocoa/LegacyCustomProtocolManagerClient.mm
    M Source/WebKit/UIProcess/Plugins/PluginProcessProxy.cpp
    M Source/WebKit/UIProcess/RemoteLayerTree/ios/ScrollingTreeScrollingNodeDelegateIOS.mm
    M Source/WebKit/UIProcess/Storage/StorageProcessProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h

  Log Message:
  -----------
  Merge r235521 - Bundle unified sources more tightly in projects with deep directory structures
https://bugs.webkit.org/show_bug.cgi?id=189009

Reviewed by Simon Fraser.

* Scripts/generate-unified-source-bundles.rb:
It turns out our plan to switch unified source bundle every time the directory
changes is not a good fit for projects like WebKit2 with many small directories.
It leaves many unified source bundles with only a single source file,
achieving only ~40% density.

Instead, switch unified source bundles every time the top-level directory changes.
This still achieves the goal of *usually* only rebuilding the one top-level
directory you touched, and increases source bundle density wildly, to ~95%.

Fix a variety of unification errors due to reshuffling the bundles.

* Modules/mediastream/RTCController.cpp:
* SourcesCocoa.txt:
* WebCore.xcodeproj/project.pbxproj:
* crypto/algorithms/CryptoAlgorithmECDSA.cpp:
(WebCore::CryptoAlgorithmECDSA::importKey):
* dom/Document.h:
* html/parser/HTMLTreeBuilder.cpp:
* loader/appcache/ApplicationCacheResourceLoader.h:
* page/AlternativeTextClient.h:
* platform/Pasteboard.h:
* platform/graphics/DisplayRefreshMonitor.cpp:
* platform/graphics/FontFamilySpecificationNull.cpp:
* platform/graphics/cocoa/WebGLLayer.mm:
(-[WebGLLayer initWithGraphicsContext3D:]):
(-[WebGLLayer copyImageSnapshotWithColorSpace:]):
(-[WebGLLayer display]):
(-[WebGLLayer allocateIOSurfaceBackingStoreWithSize:usingAlpha:]):
* platform/graphics/cocoa/WebGPULayer.mm:
(-[WebGPULayer initWithGPUDevice:]):
* platform/graphics/metal/GPUCommandQueueMetal.mm:
* platform/mac/PasteboardMac.mm:
* platform/mediastream/mac/DisplayCaptureManagerCocoa.cpp:
* platform/network/ResourceRequestBase.cpp:
* rendering/updating/RenderTreeBuilderBlockFlow.cpp:
* rendering/updating/RenderTreeBuilderInline.cpp:

* Shared/APIWebArchive.mm:
* Shared/APIWebArchiveResource.mm:
* Shared/Plugins/Netscape/mac/NetscapePluginModuleMac.mm:
* Shared/Plugins/Netscape/mac/PluginInformationMac.mm:
* SourcesCocoa.txt:
* SourcesGTK.txt:
* UIProcess/API/APIAutomationSessionClient.h:
(API::AutomationSessionClient::sessionIdentifier const):
(API::AutomationSessionClient::messageOfCurrentJavaScriptDialogOnPage):
(API::AutomationSessionClient::setUserInputForCurrentJavaScriptPromptOnPage):
* UIProcess/Cocoa/LegacyCustomProtocolManagerClient.mm:
(-[WKCustomProtocolLoader initWithLegacyCustomProtocolManagerProxy:customProtocolID:request:]):
(-[WKCustomProtocolLoader connection:didFailWithError:]):
(-[WKCustomProtocolLoader connection:didReceiveResponse:]):
* UIProcess/Plugins/PluginProcessProxy.cpp:
(WebKit::generatePluginProcessCallbackID):
(WebKit::PluginProcessProxy::fetchWebsiteData):
(WebKit::PluginProcessProxy::deleteWebsiteData):
(WebKit::PluginProcessProxy::deleteWebsiteDataForHostNames):
(WebKit::generateCallbackID): Deleted.
* UIProcess/RemoteLayerTree/ios/ScrollingTreeScrollingNodeDelegateIOS.mm:
(-[WKScrollingNodeScrollViewDelegate scrollViewWillEndDragging:withVelocity:targetContentOffset:]):
* UIProcess/Storage/StorageProcessProxy.cpp:
(WebKit::generateStorageProcessCallbackID):
(WebKit::StorageProcessProxy::fetchWebsiteData):
(WebKit::StorageProcessProxy::deleteWebsiteData):
(WebKit::StorageProcessProxy::deleteWebsiteDataForOrigins):
(WebKit::generateCallbackID): Deleted.
* WebKit.xcodeproj/project.pbxproj:
* WebProcess/Plugins/PDF/PDFPlugin.mm:
(-[WKPDFPluginAccessibilityObject accessibilityPerformAction:]):
(-[WKPDFPluginAccessibilityObject accessibilityFocusedUIElement]):
(-[WKPDFPluginAccessibilityObject accessibilityAssociatedControlForAnnotation:]):
(-[WKPDFPluginAccessibilityObject accessibilityHitTest:]):
(-[WKPDFLayerControllerDelegate updateScrollPosition:]):
(WebKit::PDFPlugin::updateCursor):
(WebKit::coreCursor):
(appendValuesInPDFNameSubtreeToVector): Deleted.
(getAllValuesInPDFNameTree): Deleted.
(getAllScriptsInPDFDocument): Deleted.


  Commit: 509a77c75bce10bff8f944c4777a8d37c937137f
      https://github.com/WebKit/WebKit/commit/509a77c75bce10bff8f944c4777a8d37c937137f
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/AccessCase.cpp
    M Source/JavaScriptCore/bytecode/GetterSetterAccessCase.cpp
    M Source/JavaScriptCore/bytecode/InlineAccess.cpp
    M Source/JavaScriptCore/bytecode/PolymorphicAccess.cpp
    M Source/JavaScriptCore/bytecode/StructureStubInfo.h
    M Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp

  Log Message:
  -----------
  Merge r235527 - Switch int8_t to GPRReg in StructureStubInfo because sizeof(GPRReg) == sizeof(int8_t)
https://bugs.webkit.org/show_bug.cgi?id=189166

Reviewed by Mark Lam.

* bytecode/AccessCase.cpp:
(JSC::AccessCase::generateImpl):
* bytecode/GetterSetterAccessCase.cpp:
(JSC::GetterSetterAccessCase::emitDOMJITGetter):
* bytecode/InlineAccess.cpp:
(JSC::getScratchRegister):
* bytecode/PolymorphicAccess.cpp:
(JSC::PolymorphicAccess::regenerate):
* bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::valueRegs const):
* jit/JITInlineCacheGenerator.cpp:
(JSC::JITByIdGenerator::JITByIdGenerator):
(JSC::JITGetByIdWithThisGenerator::JITGetByIdWithThisGenerator):
(JSC::JITInstanceOfGenerator::JITInstanceOfGenerator):


  Commit: b389177af50c30c9c132fb8b762bc16ae078ed21
      https://github.com/WebKit/WebKit/commit/b389177af50c30c9c132fb8b762bc16ae078ed21
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/counters/crash-when-cloning-body-expected.txt
    A LayoutTests/fast/css/counters/crash-when-cloning-body.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderCounter.cpp

  Log Message:
  -----------
  Merge r235537 - CounterMaps should hold a unique_ptr of CounterMap.
https://bugs.webkit.org/show_bug.cgi?id=189174
<rdar://problem/43686458>

Reviewed by Ryosuke Niwa.

Source/WebCore:

In certain cases calls to CounterMaps might lead to unexpected deletion of the CounterMap object.

Test: fast/css/counters/crash-when-cloning-body.html

* rendering/RenderCounter.cpp:
(WebCore::makeCounterNode):
(WebCore::destroyCounterNodeWithoutMapRemoval):
(WebCore::RenderCounter::destroyCounterNodes):
(WebCore::RenderCounter::destroyCounterNode):
(WebCore::updateCounters):
(showCounterRendererTree):

LayoutTests:

* fast/css/counters/crash-when-cloning-body-expected.txt: Added.
* fast/css/counters/crash-when-cloning-body.html: Added.


  Commit: 143118ca7891788f9f9e880f6af26775bd85efc2
      https://github.com/WebKit/WebKit/commit/143118ca7891788f9f9e880f6af26775bd85efc2
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/may-exit-should-be-false-regexp-constant-folding.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGNode.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGStrengthReductionPhase.cpp

  Log Message:
  -----------
  Merge r235538 - convertToRegExpMatchFastGlobal must use KnownString as the child use kind
https://bugs.webkit.org/show_bug.cgi?id=189173
<rdar://problem/43501645>

Reviewed by Michael Saboff.

JSTests:

* stress/may-exit-should-be-false-regexp-constant-folding.js: Added.
(foo):
(bar):

Source/JavaScriptCore:

We were crashing during validation because mayExit returned true
at a point in the program when we weren't allowed to exit.

The issue was is in StrengthReduction: we end up emitting code that
had a StringUse on an edge after a node that did side effects and before
an ExitOK/bytecode number transition. However, StrenghReduction did the
right thing here and also emitted the type checks before the node with
side effects. It just did bad bookkeeping. The node we convert to needs
to use KnownStringUse instead of StringUse for the child edge.

* dfg/DFGNode.cpp:
(JSC::DFG::Node::convertToRegExpExecNonGlobalOrStickyWithoutChecks):
(JSC::DFG::Node::convertToRegExpMatchFastGlobalWithoutChecks):
(JSC::DFG::Node::convertToRegExpExecNonGlobalOrSticky): Deleted.
(JSC::DFG::Node::convertToRegExpMatchFastGlobal): Deleted.
* dfg/DFGNode.h:
* dfg/DFGStrengthReductionPhase.cpp:
(JSC::DFG::StrengthReductionPhase::handleNode):


  Commit: 9dc67c20120c91507ce971be2404f89deaa2cbed
      https://github.com/WebKit/WebKit/commit/9dc67c20120c91507ce971be2404f89deaa2cbed
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189184.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/ArrayPrototype.cpp

  Log Message:
  -----------
  Merge r235540 - Add missing exception check in arrayProtoFuncLastIndexOf().
https://bugs.webkit.org/show_bug.cgi?id=189184
<rdar://problem/39785959>

Reviewed by Yusuke Suzuki.

JSTests:

* stress/regress-189184.js: Added.

Source/JavaScriptCore:

* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncLastIndexOf):


  Commit: 337e1ac037497db82f9d56f3b674ff8ce1f27f27
      https://github.com/WebKit/WebKit/commit/337e1ac037497db82f9d56f3b674ff8ce1f27f27
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189186.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSDataView.cpp

  Log Message:
  -----------
  Merge r235554 - Fix exception check accounting in JSDataView::defineOwnProperty().
https://bugs.webkit.org/show_bug.cgi?id=189186
<rdar://problem/39786049>

Reviewed by Michael Saboff.

JSTests:

* stress/regress-189186.js: Added.

Source/JavaScriptCore:

* runtime/JSDataView.cpp:
(JSC::JSDataView::defineOwnProperty):


  Commit: 10a49dc90020bb8955a68eac14c3ee9efdae2e4f
      https://github.com/WebKit/WebKit/commit/10a49dc90020bb8955a68eac14c3ee9efdae2e4f
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssemblerARMv7.h

  Log Message:
  -----------
  Merge r235557 - Gardening: ARMv7 build fix.
https://bugs.webkit.org/show_bug.cgi?id=158911

Not reviewed.

* assembler/MacroAssemblerARMv7.h:
(JSC::MacroAssemblerARMv7::patchableBranch8):


  Commit: 68035b6edb4219a2fd958ca7d0cdf047f31dd9e9
      https://github.com/WebKit/WebKit/commit/68035b6edb4219a2fd958ca7d0cdf047f31dd9e9
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189185.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/wasm/js/JSWebAssemblyModule.cpp
    M Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorConstructor.cpp

  Log Message:
  -----------
  Merge r235558 - Fix exception check accounting in constructJSWebAssemblyCompileError().
https://bugs.webkit.org/show_bug.cgi?id=189185
<rdar://problem/39786007>

Reviewed by Michael Saboff.

JSTests:

* stress/regress-189185.js: Added.
(new.WebAssembly.CompileError.valueOf):

Source/JavaScriptCore:

Also add an exception check in JSWebAssemblyModule::createStub() so that we don't
inadvertently overwrite a pre-existing exception (if present).

* wasm/js/JSWebAssemblyModule.cpp:
(JSC::JSWebAssemblyModule::createStub):
* wasm/js/WebAssemblyCompileErrorConstructor.cpp:
(JSC::constructJSWebAssemblyCompileError):


  Commit: 66d0db85f6e1d7803662a0092dc3a25cc7e63376
      https://github.com/WebKit/WebKit/commit/66d0db85f6e1d7803662a0092dc3a25cc7e63376
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/EmptyClients.cpp
    M Source/WebCore/loader/EmptyFrameLoaderClient.h
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/loader/FrameLoaderClient.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebFormSubmissionListenerProxy.h
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h
    M Source/WebKit/WebProcess/WebPage/WebFrame.cpp
    M Source/WebKit/WebProcess/WebPage/WebFrame.h
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.h
    M Source/WebKitLegacy/mac/WebCoreSupport/WebFrameLoaderClient.mm
    M Source/WebKitLegacy/win/ChangeLog
    M Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.cpp
    M Source/WebKitLegacy/win/WebCoreSupport/WebFrameLoaderClient.h

  Log Message:
  -----------
  Merge r235562 - Assertion hit in ~CompletionHandler() from ~WebFrame()
https://bugs.webkit.org/show_bug.cgi?id=189199
<rdar://problem/42657233>

Reviewed by Youenn Fablet.

Source/WebCore:

The issue was caused by WebFrame::m_willSubmitFormCompletionHandlers implicitly containing
CompletionHandlers (wrapped in WTF::Functions) and not calling them upon WebFrame
destruction.

No new tests, covered by fast/frames/iframe-target.html.

* loader/EmptyClients.cpp:
(WebCore::EmptyFrameLoaderClient::dispatchWillSubmitForm):
* loader/EmptyFrameLoaderClient.h:
* loader/FrameLoaderClient.h:

Source/WebKit:

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchWillSubmitForm):
* WebProcess/WebCoreSupport/WebFrameLoaderClient.h:
* WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::~WebFrame):
(WebKit::WebFrame::setUpWillSubmitFormListener):
(WebKit::WebFrame::invalidatePolicyListener):
* WebProcess/WebPage/WebFrame.h:

Source/WebKitLegacy/mac:

* WebCoreSupport/WebFrameLoaderClient.h:
* WebCoreSupport/WebFrameLoaderClient.mm:
(WebFrameLoaderClient::dispatchWillSubmitForm):

Source/WebKitLegacy/win:

* WebCoreSupport/WebFrameLoaderClient.cpp:
(WebFrameLoaderClient::dispatchWillSubmitForm):
* WebCoreSupport/WebFrameLoaderClient.h:


  Commit: aacb214280b69c3a3dde5f3388b1acb1425eb3c3
      https://github.com/WebKit/WebKit/commit/aacb214280b69c3a3dde5f3388b1acb1425eb3c3
  Author: John Wilander <wilander at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from-prevalent-domain-with-user-interaction-and-access-from-right-frame-expected.txt
    M LayoutTests/http/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from-prevalent-domain-with-user-interaction-and-access-from-right-frame.html
    A LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-cross-site-should-not-have-access-expected.txt
    A LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-cross-site-should-not-have-access.html
    A LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-same-site-should-have-access-expected.txt
    A LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-same-site-should-have-access.html
    R LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-should-not-have-access-expected.txt
    R LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-should-not-have-access.html
    M LayoutTests/http/tests/storageAccess/resources/get-cookies.php
    M LayoutTests/http/tests/storageAccess/resources/self-navigating-frame-after-granted-access.html
    M LayoutTests/platform/mac-wk2/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.h
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/loader/FrameLoaderClient.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.h

  Log Message:
  -----------
  Merge r235569 - Storage Access API: Maintain access through same-site navigations
https://bugs.webkit.org/show_bug.cgi?id=188564
<rdar://problem/43445160>

Reviewed by Alex Christensen.

Source/WebCore:

Tests: http/tests/storageAccess/request-and-grant-access-then-navigate-cross-site-should-not-have-access.html
       http/tests/storageAccess/request-and-grant-access-then-navigate-same-site-should-have-access.html

* dom/Document.h:
    Removed unused member variable m_hasFrameSpecificStorageAccess.
* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::willSendRequest):
* loader/FrameLoaderClient.h:

Source/WebKit:

* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchWillChangeDocument):
    Now takes the current URL and the new URL as parameters
    and only clears out storage access if the navigation is
    cross-site, i.e. with differing eTLD+1s.
* WebProcess/WebCoreSupport/WebFrameLoaderClient.h:

LayoutTests:

* http/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from-prevalent-domain-with-user-interaction-and-access-from-right-frame-expected.txt:
* http/tests/storageAccess/request-and-grant-access-cross-origin-sandboxed-iframe-from-prevalent-domain-with-user-interaction-and-access-from-right-frame.html:
    Added both a same-site and a cross-site navigation to the sub frame to test maintained and cleared access.
* http/tests/storageAccess/request-and-grant-access-then-navigate-cross-site-should-not-have-access-expected.txt: Copied from LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-should-not-have-access-expected.txt.
* http/tests/storageAccess/request-and-grant-access-then-navigate-cross-site-should-not-have-access.html: Copied from LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-should-not-have-access.html.
* http/tests/storageAccess/request-and-grant-access-then-navigate-same-site-should-have-access-expected.txt: Renamed from LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-should-not-have-access-expected.txt.
* http/tests/storageAccess/request-and-grant-access-then-navigate-same-site-should-have-access.html: Renamed from LayoutTests/http/tests/storageAccess/request-and-grant-access-then-navigate-should-not-have-access.html.
* http/tests/storageAccess/resources/get-cookies.php:
    Support for the new test scenarios.
* http/tests/storageAccess/resources/self-navigating-frame-after-granted-access.html:
    Support for the new test scenarios.
* platform/mac-wk2/TestExpectations:
    Marked the new and the renamed tests as [ Pass ].


  Commit: 71b28d11f5b2b2c8f8d232a0575935ca56ee77e1
      https://github.com/WebKit/WebKit/commit/71b28d11f5b2b2c8f8d232a0575935ca56ee77e1
  Author: Jer Noble <jer.noble at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/FormData.cpp

  Log Message:
  -----------
  Merge r235573 - Compilation error in FormData.cpp: incomplete type 'WebCore::SharedBuffer'
https://bugs.webkit.org/show_bug.cgi?id=189207

Reviewed by Youenn Fablet.

If FormData.cpp is compiled alone (non-unified) or if it is the first file compiled in
a unified build, SharedBuffer.h is not included.

* platform/network/FormData.cpp:


  Commit: a3955f6af7e887c56fb0048eee88ea6f7a386490
      https://github.com/WebKit/WebKit/commit/a3955f6af7e887c56fb0048eee88ea6f7a386490
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/function-body-to-string-before-parameter-syntax-check.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/FunctionConstructor.cpp

  Log Message:
  -----------
  Merge r235582 - Function object should convert params to string before throw a parsing error
https://bugs.webkit.org/show_bug.cgi?id=188874

Reviewed by Darin Adler.

JSTests:

* stress/function-body-to-string-before-parameter-syntax-check.js: Added.
(shouldThrow):

Source/JavaScriptCore:

ToString operation onto the `body` of the Function constructor should be performed
before checking syntax correctness of the parameters.

* runtime/FunctionConstructor.cpp:
(JSC::constructFunctionSkippingEvalEnabledCheck):


  Commit: 5c46d6fb5a7b53eaf9e39a211c4fa247dbb29aa1
      https://github.com/WebKit/WebKit/commit/5c46d6fb5a7b53eaf9e39a211c4fa247dbb29aa1
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt
    A LayoutTests/fast/flexbox/crash-when-min-max-content-is-not-computed.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderFlexibleBox.cpp

  Log Message:
  -----------
  Merge r235590 - REGRESSION (r191336): RenderFlexibleBox::adjustChildSizeForMinAndMax crashes in std::optional<>::value()
https://bugs.webkit.org/show_bug.cgi?id=189232
<rdar://problem/43886373>

Reviewed by Brent Fulgham.

Source/WebCore:

It's not guaranteed that RenderFlexibleBox::computeMainAxisExtentForChild() always returns with a valid value.

Test: fast/flexbox/crash-when-min-max-content-is-not-computed.html

* rendering/RenderFlexibleBox.cpp:
(WebCore::RenderFlexibleBox::adjustChildSizeForMinAndMax):

LayoutTests:

* fast/flexbox/crash-when-min-max-content-is-not-computed-expected.txt: Added.
* fast/flexbox/crash-when-min-max-content-is-not-computed.html: Added.


  Commit: 5ff1dfa5bac73ea3f09f1145e9b72aadf46445b8
      https://github.com/WebKit/WebKit/commit/5ff1dfa5bac73ea3f09f1145e9b72aadf46445b8
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.h
    M Source/WebCore/loader/DocumentThreadableLoader.cpp
    M Source/WebCore/page/Frame.cpp
    M Source/WebCore/page/Page.h
    M Source/WebCore/testing/Internals.cpp

  Log Message:
  -----------
  Merge r235602 - REGRESSION: Layout Test http/tests/security/bypassing-cors-checks-for-extension-urls.html is Flaky
https://bugs.webkit.org/show_bug.cgi?id=187658
<rdar://problem/42306442>

Reviewed by Alexey Proskuryakov.

Source/WebCore:

Test is flaky as a previous test was setting the isRunningUserScripts state on the Page and it was never reset.
This patch moves this state to the topDocument so that it will be reset for every navigation.
Covered by existing test being no longer flaky.

* dom/Document.h:
(WebCore::Document::setAsRunningUserScripts):
(WebCore::Document::isRunningUserScripts const):
* loader/DocumentThreadableLoader.cpp:
(WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
* page/Frame.cpp:
(WebCore::Frame::injectUserScriptImmediately):
* page/Page.h:
(WebCore::Page::setAsRunningUserScripts): Deleted.
(WebCore::Page::isRunningUserScripts const): Deleted.
* testing/Internals.cpp:
(WebCore::Internals::setAsRunningUserScripts):

LayoutTests:

* platform/mac-wk2/TestExpectations:


  Commit: 774c69dfe7dc0a890d1af58aeeaf3ac25145dd22
      https://github.com/WebKit/WebKit/commit/774c69dfe7dc0a890d1af58aeeaf3ac25145dd22
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/interpreter/CallFrame.h
    M Source/JavaScriptCore/interpreter/Register.h

  Log Message:
  -----------
  Merge r235603 - CallFrame::unsafeCallee() should use an ASAN suppressed Register::asanUnsafePointer().
https://bugs.webkit.org/show_bug.cgi?id=189247

Reviewed by Saam Barati.

* interpreter/CallFrame.h:
(JSC::ExecState::unsafeCallee const):
* interpreter/Register.h:
(JSC::Register::asanUnsafePointer const):
(JSC::Register::unsafePayload const):


  Commit: 7f5a05f479806cae3a24f6d9148d75a2294e0b2e
      https://github.com/WebKit/WebKit/commit/7f5a05f479806cae3a24f6d9148d75a2294e0b2e
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189227-watchdog-on-infinite-loop.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/VMTraps.cpp

  Log Message:
  -----------
  Merge r235605 - The watchdog sometimes fails to terminate a script.
https://bugs.webkit.org/show_bug.cgi?id=189227
<rdar://problem/39932857>

Reviewed by Saam Barati.

JSTests:

* stress/regress-189227-watchdog-on-infinite-loop.js: Added.

Source/JavaScriptCore:

Consider the following scenario:

1. We have an infinite loop bytecode sequence as follows:

    [  13] loop_hint
    [  14] check_traps
    [  15] jmp               -2(->13)

2. The VM tiers up from LLInt -> BaselineJIT -> DFG -> FTL.

   Note that op_check_traps is represented as a CheckTraps node in the DFG and FTL.
   When we're not using pollingTraps (JSC_usePollingTraps is false by default),
   we emit no code for CheckTraps, but only record an InvalidationPoint there.

3. The watchdog fires, and invalidates all InvalidationPoints in the FTL CodeBlock.

   InvalidationPoints OSR exits to the next instruction by design.  In this case,
   that means the VM will resumes executing at the op_jmp, which jumps to the
   op_loop_hint opcode.  At the loop_hint, the VM discovers that the function is
   already hot, and attempts to tier up.  It immediately discovers that a replacement
   CodeBlock is available because we still haven't jettisoned the DFG CodeBlock
   nor the FTL CodeBlock that was previously compiled for this function.

   Note that jettisoning a CodeBlock necessarily means the VM will invalidate
   its InvalidationPoints (if the CodeBlock is DFG/FTL).  However, the reverse
   is not true: merely invalidating the InvalidationPoints does not necessarily
   mean that the CodeBlock is jettisoned.

   VMTraps::tryInstallTrapBreakpoints() runs from a separate thread.  Hence,
   it is only safe for it to invalidate a CodeBlock's InvalidationPoints.  It
   is not safe for the CodeBlock to be jettisoned from another thread.  Instead,
   the VMTraps mechanism relies on the script thread running to an op_check_traps
   in the baseline JIT code where it will do the necessary jettisoning of optimized
   CodeBlocks.

Since the op_check_traps never get executed, the VM will perpetually tier up in
the op_loop_hint, OSR exit to the op_jmp, jump to the op_loop_hint, and repeat.
Consequently, the watchdog fails to terminate this script.

In this patch, we fix this by making the DFG BytecodeParser emit an InvalidationPoint
node directly (when the VM is not configured to use polling traps).  This ensures
that the check traps invalidation point will OSR exit to the op_check_traps opcode
in the baseline JIT.

In this patch, we also change VMTraps::tryInstallTrapBreakpoints() to use
CallFrame::unsafeCodeBlock() instead of CallFrame::codeBlock().  This is because
we don't really know if the frame is properly set up.  We're just conservatively
probing the stack.  ASAN does not like this probing.  Using unsafeCodeBlock() here
will suppress the false positive ASAN complaint.

* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileCheckTraps):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
* runtime/VMTraps.cpp:
(JSC::VMTraps::tryInstallTrapBreakpoints):


  Commit: e1e37a1d3191fade1b4a8c4540ad543dfdb4975f
      https://github.com/WebKit/WebKit/commit/e1e37a1d3191fade1b4a8c4540ad543dfdb4975f
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/API/glib/JSCContext.h
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Merge r235612 - [WPE][GTK] Add more unused result warnings to JSC API
https://bugs.webkit.org/show_bug.cgi?id=189243

Reviewed by Carlos Garcia Campos.

The jsc_context_evaluate() family of functions has a (transfer full) return value, but the
caller may be tempted to not inspect it if uninterested in the return value. This would be
an error, because it must be freed.

* API/glib/JSCContext.h:


  Commit: 235b3f3f308d133fec2c064bfd3a649a5e585afe
      https://github.com/WebKit/WebKit/commit/235b3f3f308d133fec2c064bfd3a649a5e585afe
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/text/text-combine-surroundContents-crash-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/InlineTextBox.cpp
    M Source/WebCore/rendering/InlineTextBox.h
    M Source/WebCore/rendering/RenderBlockLineLayout.cpp
    M Source/WebCore/rendering/RenderText.cpp

  Log Message:
  -----------
  Merge r235615 - Remove redundant inline text boxes for empty combined text
https://bugs.webkit.org/show_bug.cgi?id=189119

Reviewed by Zalan Bujtas.

Source/WebCore:

We should consider inline text boxes that have a combined text renderer (RenderCombineText)
whose composed string is empty as "redundant" just as we do for inline text boxes that have
a non-combined text renderer that have zero length so that we remove them. Such boxes are
visibly empty and do not take up space visually. By removing them we reduce memory and make
it easier to reason about the line box tree.

Currently RenderBlockFlow::computeBlockDirectionPositionsForLine() tests if an inline text
box is empty by checking if it has a zero length (InlineTextBox::len()). However an inline
text box associated with a RenderCombineText always has length 1 regardless of whether the
composed string it represents is the empty string. Instead we should expose a way to check
if an inline text box is visually empty and have RenderBlockFlow::computeBlockDirectionPositionsForLine()
query the inline text box for this answer.

* rendering/InlineTextBox.cpp:
(WebCore::InlineTextBox::hasTextContent const): Added. Returns whether an inline text box
has text content. We do not need to consider hypenation since hypens are an embellishment (i.e.
they are not part of the markup of the page).
(WebCore::InlineTextBox::paint): Write in terms of hasTextContent().
(WebCore::InlineTextBox::subdivideAndResolveStyle): Assert that WebCore::subdivide() always
returns a non-empty list of subdivisions. A non-empty text box should always have at least
one subdivision, say for the unmarked text. I left the existing conditonal (though marked
it as UNLIKELY()) so as to be forgiving and avoid a bad user experience should WebCore::subdivide()
return an empty vector in a non-debug build.
* rendering/InlineTextBox.h:
* rendering/RenderBlockLineLayout.cpp:
(WebCore::RenderBlockFlow::computeBlockDirectionPositionsForLine): Write in terms of InlineTextBox::hasTextContent()
so that we remove empty inline text boxes associated with combined text.
* rendering/RenderText.cpp:
(WebCore::RenderText::positionLineBox): Write in terms of InlineTextBox::hasTextContent().

LayoutTests:

Update expected result now that we do not create an inline text box associated with combined text
when we do not have any combined text to render.

* fast/text/text-combine-surroundContents-crash-expected.txt:


  Commit: 07edf5827287437180f9203f9fdb000245533d27
      https://github.com/WebKit/WebKit/commit/07edf5827287437180f9203f9fdb000245533d27
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/InlineTextBox.cpp

  Log Message:
  -----------
  Merge r235621 - Attempt to fix failing tests following r235615 (https://bugs.webkit.org/show_bug.cgi?id=187925)

An inline text box that does not have combined text and contains a single character
should be considered as having text content.

* rendering/InlineTextBox.cpp:
(WebCore::InlineTextBox::hasTextContent const):


  Commit: 8d592cce717126f54bfbb1209121108c6fed8e8c
      https://github.com/WebKit/WebKit/commit/8d592cce717126f54bfbb1209121108c6fed8e8c
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-18 (Tue, 18 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189292.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/parser/ParserModes.h

  Log Message:
  -----------
  Merge r235662 - isAsyncGeneratorMethodParseMode() should check for SourceParseMode::AsyncGeneratorWrapperMethodMode.
https://bugs.webkit.org/show_bug.cgi?id=189292
<rdar://problem/38907433>

Reviewed by Saam Barati.

JSTests:

* stress/regress-189292.js: Added.

Source/JavaScriptCore:

Previously, isAsyncGeneratorMethodParseMode() was checking for AsyncGeneratorWrapperFunctionMode
instead of AsyncGeneratorWrapperMethodMode.  This patch fixes it
to check for AsyncGeneratorWrapperMethodMode (to match what is expected as indicated
in the name isAsyncGeneratorMethodParseMode).

* parser/ParserModes.h:
(JSC::isAsyncGeneratorMethodParseMode):


  Commit: 47253e311df3a2c6dc98f4f337ea8b341d04531f
      https://github.com/WebKit/WebKit/commit/47253e311df3a2c6dc98f4f337ea8b341d04531f
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/DeferredCompilationCallback.cpp
    M Source/JavaScriptCore/bytecode/DeferredSourceDump.cpp
    M Source/JavaScriptCore/bytecode/DeferredSourceDump.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

  Log Message:
  -----------
  Merge r235684 - Fix DeferredSourceDump to capture the caller bytecodeIndex instead of CodeOrigin.
https://bugs.webkit.org/show_bug.cgi?id=189300
<rdar://problem/39681779>

Reviewed by Saam Barati.

At the time a DeferredSourceDump is instantiated, it captures a CodeOrigin value
which points to a InlineCallFrame in the DFG::Plan's m_inlineCallFrames set.  The
DeferredSourceDump is later used to dump source even if the compilation fails.
This is intentional so that we can use this tool to see what source fails to
compile as well.

The DFG::Plan may have been destructed by then, and since the compilation failed,
the InlineCallFrame is also destructed.  This means DeferredSourceDump::dump()
may be end up accessing freed memory.

DeferredSourceDump doesn't really need a CodeOrigin.  All it wants is the caller
bytecodeIndex for the call to an inlined function.  Hence, we can fix this issue
by changing DeferredSourceDump to capture the caller bytecodeIndex instead.

In this patch, we also change DeferredSourceDump's m_codeBlock and m_rootCodeBlock
to be Strong references to ensure that the CodeBlocks are kept alive until they
can be dumped.

* bytecode/DeferredCompilationCallback.cpp:
(JSC::DeferredCompilationCallback::dumpCompiledSourcesIfNeeded):
* bytecode/DeferredSourceDump.cpp:
(JSC::DeferredSourceDump::DeferredSourceDump):
(JSC::DeferredSourceDump::dump):
* bytecode/DeferredSourceDump.h:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseCodeBlock):


  Commit: b8dc4d9893f134ce1f22aff7a560e39373b7fb41
      https://github.com/WebKit/WebKit/commit/b8dc4d9893f134ce1f22aff7a560e39373b7fb41
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/heap/MarkedSpace.cpp
    M Source/JavaScriptCore/heap/MarkedSpace.h
    M Source/JavaScriptCore/jit/AssemblyHelpers.cpp
    M Source/JavaScriptCore/runtime/JSArrayBufferView.cpp

  Log Message:
  -----------
  Merge r235685 - RELEASE_ASSERT at ../../Source/JavaScriptCore/heap/MarkedSpace.h:83
https://bugs.webkit.org/show_bug.cgi?id=188917

Reviewed by Mark Lam.

Our allocators should be able to handle allocating a zero-sized object.
Zero-sized objects will be allocated into the smallest size class.

* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewTypedArrayWithSize):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::allocatorForSize):
* heap/MarkedSpace.h:
(JSC::MarkedSpace::sizeClassToIndex):
(JSC::MarkedSpace::indexToSizeClass):
* jit/AssemblyHelpers.cpp:
(JSC::AssemblyHelpers::emitAllocateVariableSized):
* runtime/JSArrayBufferView.cpp:
(JSC::JSArrayBufferView::ConstructionContext::ConstructionContext):


  Commit: 555efcd64680450d4e6f494af694a4f4004db7f0
      https://github.com/WebKit/WebKit/commit/555efcd64680450d4e6f494af694a4f4004db7f0
  Author: Ross Kirsling <ross.kirsling at sony.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/stress/symbol-description.js
    M JSTests/test262/config.yaml
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/Symbol.cpp
    M Source/JavaScriptCore/runtime/SymbolPrototype.cpp

  Log Message:
  -----------
  Merge r235712 - [ESNext] Symbol.prototype.description
https://bugs.webkit.org/show_bug.cgi?id=186686

Reviewed by Keith Miller.

JSTests:

* stress/symbol-description.js:
Add tests for empty and null symbol cases.

* test262/config.yaml:
Enable Symbol.prototype.description tests.

Source/JavaScriptCore:

Symbol.prototype.description was implemented in r232404, but has one small bug:
It should return undefined for a null symbol.

* runtime/Symbol.cpp:
(JSC::Symbol::description const):
* runtime/SymbolPrototype.cpp:
(JSC::symbolProtoGetterDescription):
Address the null symbol case.


  Commit: eca9e08f58b2beb8af99e696f29740688842cf4d
      https://github.com/WebKit/WebKit/commit/eca9e08f58b2beb8af99e696f29740688842cf4d
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189124.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp

  Log Message:
  -----------
  Merge r235715 - JSPropertyNameEnumerator::visitChildren() needs to visit its m_cachedStructureID.
https://bugs.webkit.org/show_bug.cgi?id=189124
<rdar://problem/43863605>

Reviewed by Filip Pizlo.

JSTests:

* stress/regress-189124.js: Added.

Source/JavaScriptCore:

It is assumed that the Structure for the m_cachedStructureID will remain alive
while the m_cachedStructureID is in use.  This prevents the structureID from being
re-used for a different Structure.

* runtime/JSPropertyNameEnumerator.cpp:
(JSC::JSPropertyNameEnumerator::visitChildren):


  Commit: dd761a32c5f67f6ba3196828caf8643c92bb8f64
      https://github.com/WebKit/WebKit/commit/dd761a32c5f67f6ba3196828caf8643c92bb8f64
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/null-string-textrun-expected.txt
    A LayoutTests/fast/text/null-string-textrun.html
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/text/WTFString.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/FontCascade.cpp
    M Source/WebCore/platform/graphics/TextRun.h
    M Source/WebCore/rendering/RenderListBox.cpp

  Log Message:
  -----------
  Merge r235721 - The width of an empty or nullptr TextRun should be zero
https://bugs.webkit.org/show_bug.cgi?id=189154
<rdar://problem/43685926>

Reviewed by Zalan Bujtas.

If a page has an empty TextRun and attempts to paint it we can crash with a nullptr.

This patch recognizes that an empty TextRun should always produce a zero width, rather than
attempt to compute this value from font data. It also prevents ListBox from attempting to
paint a null string.

Test: fast/text/null-string-textrun.html

* platform/graphics/FontCascade.cpp:
(WebCore::FontCascade::widthOfTextRange const): An empty TextRun has zero width.
(WebCore::FontCascade::width const): Ditto.
* platform/graphics/TextRun.h:
(WebCore::TextRun::TextRun): ASSERT that the supplied String is non-null.
(WebCore::TextRun::setText): Ditto.
* rendering/RenderListBox.cpp:
(WebCore::RenderListBox::paintItemForeground): Don't attempt to paint a null string.

Source/WTF:
The width of an empty or nullptr TextRun should be zero
https://bugs.webkit.org/show_bug.cgi?id=189154
<rdar://problem/43685926>

Reviewed by Zalan Bujtas.

Most accessors in WTFString.cpp, such as isAllASCII(), hash(), etc., perform a nullptr check
before using m_impl, but is8Bit() does not.

This patch adds a check in the is8Bit() implementation to be consistent with other methods,
and to address a small number of crashes observed in testing.

* wtf/text/WTFString.h:
(WTF::String::is8Bit const):

LayoutTests:
The width of a nullptr TextRun should be zero
https://bugs.webkit.org/show_bug.cgi?id=189154
<rdar://problem/43685926>

Reviewed by Zalan Bujtas.

* fast/text/null-string-textrun-expected.txt: Added.
* fast/text/null-string-textrun.html: Added.


  Commit: 6dbbb309d0a371c876da6f02a596e499b1931c42
      https://github.com/WebKit/WebKit/commit/6dbbb309d0a371c876da6f02a596e499b1931c42
  Author: Tomáš Popela <tpopela at redhat.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/RegisterState.h

  Log Message:
  -----------
  Merge r235740 - [JSC] Build broken after r234975 on s390x, ppc64le, armv7hl
https://bugs.webkit.org/show_bug.cgi?id=189078

Reviewed by Mark Lam.

Caused by the GCC bug - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70124.
Using the ternary operator instead of std::max() fixes it.

* heap/RegisterState.h:


  Commit: 7e512313d9c7a5c4fad4708ac2af8f50d64d22c6
      https://github.com/WebKit/WebKit/commit/7e512313d9c7a5c4fad4708ac2af8f50d64d22c6
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp

  Log Message:
  -----------
  Merge r235742 - Gardening: only visit m_cachedStructureID if it's not null.
https://bugs.webkit.org/show_bug.cgi?id=189124
<rdar://problem/43863605>

Not reviewed.

* runtime/JSPropertyNameEnumerator.cpp:
(JSC::JSPropertyNameEnumerator::visitChildren):


  Commit: ed571cc23354b69b5907fd49dda4e61b60528151
      https://github.com/WebKit/WebKit/commit/ed571cc23354b69b5907fd49dda4e61b60528151
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/math-pow-nan-to-zero-spec-type.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/SpeculatedType.cpp

  Log Message:
  -----------
  Merge r235765 - Improper speculation type for Math.pow(NaN, 0) in Abstract Interpreter
https://bugs.webkit.org/show_bug.cgi?id=189380

Reviewed by Saam Barati.

JSTests:

New test.

* stress/math-pow-nan-to-zero-spec-type.js: Added.
(func):
(test):

Source/JavaScriptCore:

Account for the case where in Math.pow(NaN, y) where y could be 0.

* bytecode/SpeculatedType.cpp:
(JSC::typeOfDoublePow):


  Commit: 8448250e63a7f98eebc9b4d814833e3c2a0eca32
      https://github.com/WebKit/WebKit/commit/8448250e63a7f98eebc9b4d814833e3c2a0eca32
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/ArgList.h
    M Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp

  Log Message:
  -----------
  Merge r235778 - [WebAssembly] Optimize JS to Wasm call by removing Vector allocation
https://bugs.webkit.org/show_bug.cgi?id=189353

Reviewed by Mark Lam.

JS to Wasm call always allocates Vector for the arguments. This is really costly if the wasm function is small.
This patch adds an initial size parameter to the Vector to avoid allocations for small sized arguments.

* runtime/ArgList.h:
* wasm/js/WebAssemblyFunction.cpp:
(JSC::callWebAssemblyFunction):


  Commit: b146f75189e94eb9cdc6a8eb754c062425fdad7a
      https://github.com/WebKit/WebKit/commit/b146f75189e94eb9cdc6a8eb754c062425fdad7a
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/llint/LLIntThunks.cpp
    M Source/JavaScriptCore/llint/LLIntThunks.h
    M Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

  Log Message:
  -----------
  Merge r235785 - [JSC] Put .throwStackOverflow code after the fast path in LLInt doVMEntry
https://bugs.webkit.org/show_bug.cgi?id=189410

Reviewed by Mark Lam.

Put .throwStackOverflow code after the fast path in LLInt doVMEntry to
make doVMEntry code tight.

* llint/LLIntThunks.cpp:
(JSC::vmEntryToWasm): Deleted.
* llint/LLIntThunks.h:
(JSC::vmEntryToWasm):
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:


  Commit: 245bd18e3d7b52ce264fe2bc80753fd2ebad28d2
      https://github.com/WebKit/WebKit/commit/245bd18e3d7b52ce264fe2bc80753fd2ebad28d2
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/microbenchmarks/string-object-to-string.js
    A JSTests/microbenchmarks/string-object-value-of.js
    A JSTests/stress/string-to-string-error.js
    A JSTests/stress/string-to-string.js
    A JSTests/stress/string-value-of-error.js
    A JSTests/stress/string-value-of.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGOperations.cpp
    M Source/JavaScriptCore/dfg/DFGOperations.h
    M Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSafeToExecute.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
    M Source/JavaScriptCore/ftl/FTLCapabilities.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
    M Source/JavaScriptCore/runtime/StringConstructor.cpp
    M Source/JavaScriptCore/runtime/StringConstructor.h

  Log Message:
  -----------
  Merge r235790 - [DFG] DFG should handle String#toString
https://bugs.webkit.org/show_bug.cgi?id=189151

Reviewed by Saam Barati.

JSTests:

The error message in String#toString and String#valueOf is poor, which will be
handled in a separate bug[1].

[1]: https://bugs.webkit.org/show_bug.cgi?id=189357

* microbenchmarks/string-object-to-string.js: Added.
(test):
* microbenchmarks/string-object-value-of.js: Added.
(test):
* stress/string-to-string-error.js: Added.
(shouldThrow):
(test):
* stress/string-to-string.js: Added.
(shouldBe):
(test1):
(test2):
(test3):
* stress/string-value-of-error.js: Added.
(shouldThrow):
(test):
* stress/string-value-of.js: Added.
(shouldBe):
(test1):
(test2):
(test3):

Source/JavaScriptCore:

We handle String#toString and String#valueOf in DFG by introducing StringValueOf node.
In the fixup phase, we attempt to lower StringValueOf to the existing ToString or Identity
nodes. If we fail to lower it, we have StringValueOf(UntypedUse), which may raise an error
if an argument is neither String nor StringObject. The error message in String#toString and
String#valueOf is poor, which will be handled in a separate bug[1].

It improves simple microbenchmarks by 53.4 - 67.6%.

                                      baseline                  patched

    string-object-to-string       21.7308+-3.3147     ^     12.9655+-0.0527        ^ definitely 1.6760x faster
    string-object-value-of        20.1122+-0.0691     ^     13.1134+-0.2482        ^ definitely 1.5337x faster

[1]: https://bugs.webkit.org/show_bug.cgi?id=189357

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::fixupStringValueOf):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToToString):
* dfg/DFGNodeType.h:
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGPredictionPropagationPhase.cpp:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructorOrStringValueOf):
(JSC::DFG::SpeculativeJIT::compileToStringOrCallStringConstructor): Deleted.
* dfg/DFGSpeculativeJIT.h:
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileNode):
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructorOrStringValueOf):
(JSC::FTL::DFG::LowerDFGToB3::compileToStringOrCallStringConstructor): Deleted.


  Commit: f12ebc3033a158393ade4da4b6a3c8747211315a
      https://github.com/WebKit/WebKit/commit/f12ebc3033a158393ade4da4b6a3c8747211315a
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AXObjectCache.h

  Log Message:
  -----------
  Merge r235804 - [AX] Fix compile error in AXObjectCache constructor when !HAVE(ACCESSIBILITY)
https://bugs.webkit.org/show_bug.cgi?id=189423
<rdar://problem/44231775>

Reviewed by Yusuke Suzuki.

No new tests. Compilation fix.

* accessibility/AXObjectCache.h:
(WebCore::AXObjectCache::AXObjectCache):


  Commit: 7a980bfd774700d2ec3763b835cb9f19e8aa5271
      https://github.com/WebKit/WebKit/commit/7a980bfd774700d2ec3763b835cb9f19e8aa5271
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/open-url-bogus-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/open-url-multi-window-6-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/xml/XMLHttpRequest.cpp

  Log Message:
  -----------
  Merge r235808 - XMLHttpRequest: open() does not throw a SYNTAX_ERR exception if method is empty or url cannot be resolved
https://bugs.webkit.org/show_bug.cgi?id=46008

Patch by Rob Buis <rbuis at igalia.com> on 2018-09-07
Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

* web-platform-tests/xhr/open-url-bogus-expected.txt:
* web-platform-tests/xhr/open-url-multi-window-6-expected.txt:

Source/WebCore:

Check if passed URL is valid as specified here [1].

Test: web-platform-tests/xhr/open-url-bogus.htm

[1] https://xhr.spec.whatwg.org/#the-open()-method Step 7

* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::open):


  Commit: 81a0a4c1a2dff4ccc1fabe2041e01f9251d28475
      https://github.com/WebKit/WebKit/commit/81a0a4c1a2dff4ccc1fabe2041e01f9251d28475
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/url/failure-expected.txt

  Log Message:
  -----------
  Merge r235958 - Unreviewed, rebaseline imported/w3c/web-platform-tests/url/failure.html after r235808.

New checks are passing.

* web-platform-tests/url/failure-expected.txt:


  Commit: 3e52e29c04b28f4d397a5fafb4509308f909537c
      https://github.com/WebKit/WebKit/commit/3e52e29c04b28f4d397a5fafb4509308f909537c
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189317.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/JavaScriptCore/bytecode/ArrayProfile.cpp
    M Source/JavaScriptCore/bytecode/ArrayProfile.h
    A Source/JavaScriptCore/bytecode/OpcodeInlines.h
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/jit/JITCall.cpp
    M Source/JavaScriptCore/jit/JITCall32_64.cpp
    M Source/JavaScriptCore/jit/JITOpcodes.cpp
    M Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
    M Source/JavaScriptCore/jit/JITPropertyAccess.cpp
    M Source/JavaScriptCore/jit/JITPropertyAccess32_64.cpp
    M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
    M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

  Log Message:
  -----------
  Merge r235827 - Ensure that handleIntrinsicCall() is only applied on op_call shaped instructions.
https://bugs.webkit.org/show_bug.cgi?id=189317
<rdar://problem/44152198>

Reviewed by Filip Pizlo.

JSTests:

* stress/regress-189317.js: Added.
(testGetter):
(testSetter):

Source/JavaScriptCore:

handleIntrinsicCall() is normally used for checking if an op_call is a call to
an intrinsic function, and inlining it if it's a match.

However, getter and setter functions also does calls, and uses handleCall()
to implement the call.  handleCall() eventually calls handleIntrinsicCall() to
check for intrinsics.  This results in a bug because handleIntrinsicCall()
sometimes relies on the ArrayProfile* of the instruction, and is always assuming
that the instruction is op_call shaped.  This turns out to be not true: getters
and setters can get there with op_get_by_val and op_put_by_val instead.

Since the intrinsic functions handled by handleIntrinsicCall() are never
intended to be used as getter / setter functions anyway, we can prevent this
whole class of bugs by having handleIntrinsicCall() fail early if the
instruction is not op_call shaped.

To implement this fix, we did the following:

1. Introduced the OpcodeShape enum.
2. Introduced isOpcodeShape<OpcodeShape>() for testing if a instruction of the
   shape of the specified OpcodeShape.
3. Introduced arrayProfileFor<OpcodeShape>() for fetching the ArrayProfile* from
   the instruction given the OpcodeShape.

   Using this arrayProfileFor template has the following benefits:
   1. Centralizes the definition of which instructions has an ArrayProfile* operand.
   2. Centralizes the definition of which operand is the ArrayProfile*.
   3. Asserts that the instruction is of the expected shape when retrieving the
      ArrayProfile*.

4. Added ArrayProfile::m_typeName and ArrayProfile::s_typeName which are used
   in ArrayProfile::isValid() as a sanity check that a retrieved ArrayProfile*
   indeed does point to an ArrayProfile.

* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/ArrayProfile.cpp:
* bytecode/ArrayProfile.h:
(JSC::ArrayProfile::isValid const):
* bytecode/OpcodeInlines.h: Added.
(JSC::isOpcodeShape):
(JSC::arrayProfileFor):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
(JSC::DFG::ByteCodeParser::parseBlock):
* jit/JITCall.cpp:
(JSC::JIT::compileOpCall):
* jit/JITCall32_64.cpp:
(JSC::JIT::compileOpCall):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_has_indexed_property):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_has_indexed_property):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitGenericContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
(JSC::JIT::emitIntTypedArrayPutByVal):
(JSC::JIT::emitFloatTypedArrayPutByVal):
* jit/JITPropertyAccess32_64.cpp:
(JSC::JIT::emit_op_get_by_val):
(JSC::JIT::emit_op_put_by_val):
(JSC::JIT::emitGenericContiguousPutByVal):
(JSC::JIT::emitArrayStoragePutByVal):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::getByVal):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):


  Commit: 833ca1dd3e6d95ff6d776a09436edb511324ef71
      https://github.com/WebKit/WebKit/commit/833ca1dd3e6d95ff6d776a09436edb511324ef71
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/cssjit/SelectorCompiler.cpp

  Log Message:
  -----------
  Merge r235829 - [CSSJIT] Use lshiftPtr instead of mul32
https://bugs.webkit.org/show_bug.cgi?id=189451

Reviewed by Sam Weinig.

Use `value << 4` instead of `value * 16`. In 64bit environment, sizeof(Style::Relation) is 16,
so that we can use `value << 4` in CSS JIT.

No behavior change.

* cssjit/SelectorCompiler.cpp:
(WebCore::SelectorCompiler::SelectorCodeGenerator::generateAddStyleRelation):


  Commit: 4e936953ce658e58d7216929334ecfdf147ed5d7
      https://github.com/WebKit/WebKit/commit/4e936953ce658e58d7216929334ecfdf147ed5d7
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/win/TestExpectations
    A LayoutTests/webanimations/accelerated-transition-interrupted-on-composited-element-expected.html
    A LayoutTests/webanimations/accelerated-transition-interrupted-on-composited-element.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/KeyframeEffectReadOnly.cpp

  Log Message:
  -----------
  Merge r235843 - [Web Animations] Interrupting an accelerated CSS transition on a composited element in flight fails
https://bugs.webkit.org/show_bug.cgi?id=189405
<rdar://problem/43342639>

Reviewed by Simon Fraser.

Source/WebCore:

Test: webanimations/accelerated-transition-interrupted-on-composited-element.html

If we interrupt an animation on an element that is composited also outside of the duration of the animation,
the "stop" accelerated action would fail to be performed because we no longer had a resolved current time and
the accelerated animation applied to the layer would never be removed.

However, having a resolved current time is not necessary to stop an animation, only for the other types of
actions (play, pause and seek). So we now simply default to a 0s time for an unresolved current time for a
simple fix to this issue.

* animation/KeyframeEffectReadOnly.cpp:
(WebCore::KeyframeEffectReadOnly::applyPendingAcceleratedActions):

LayoutTests:

Add a new test that checks that interrupting a CSS transition targeting an accelerated property for an element
that is composited outside the duration of the transition correctly interrupts the animation and jumps straight
to the target value.

* platform/win/TestExpectations:
* webanimations/accelerated-transition-interrupted-on-composited-element-expected.html: Added.
* webanimations/accelerated-transition-interrupted-on-composited-element.html: Added.


  Commit: 142d69180efba726b29a98ad440f09677f6738b5
      https://github.com/WebKit/WebKit/commit/142d69180efba726b29a98ad440f09677f6738b5
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-overridemimetype-content-type-header-expected.txt
    M LayoutTests/http/tests/xmlhttprequest/xmlhttprequest-overridemimetype-content-type-header.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/XMLHttpRequest/overridemimetype-invalid-mime-type-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/xml/XMLHttpRequest.cpp

  Log Message:
  -----------
  Merge r235844 - XMLHttpRequest: overrideMimeType should not update the response's "Content-Type" header
https://bugs.webkit.org/show_bug.cgi?id=189465

Patch by Rob Buis <rbuis at igalia.com> on 2018-09-10
Reviewed by Frédéric Wang.

LayoutTests/imported/w3c:

* web-platform-tests/xhr/overridemimetype-invalid-mime-type-expected.txt:

Source/WebCore:

The xhr spec changed [1, 2] so that overrideMimeType should not update the
response's "Content-Type" header anymore.

Behavior matches Firefox and Chrome.

[1] https://xhr.spec.whatwg.org/#dom-xmlhttprequest-overridemimetype
[2] https://github.com/whatwg/xhr/issues/157

Tests: http/tests/xmlhttprequest/xmlhttprequest-overridemimetype-content-type-header.html
       web-platform-tests/xhr/overridemimetype-invalid-mime-type.htm

* xml/XMLHttpRequest.cpp:
(WebCore::XMLHttpRequest::didReceiveResponse):

LayoutTests:

Change existing test to reflect new behavior.

* http/tests/xmlhttprequest/xmlhttprequest-overridemimetype-content-type-header-expected.txt:
* http/tests/xmlhttprequest/xmlhttprequest-overridemimetype-content-type-header.html:


  Commit: 3a357e40465d95ef4a3797cbf52b5ff1999212ec
      https://github.com/WebKit/WebKit/commit/3a357e40465d95ef4a3797cbf52b5ff1999212ec
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h

  Log Message:
  -----------
  Merge r235846 - [GStreamer] Several media related tests timing out around the same revision
https://bugs.webkit.org/show_bug.cgi?id=189349

Reviewed by Carlos Garcia Campos.

Source/WebCore:

The timeouts were happening because the `ended` event was no
longer properly emitted. The change in playbackPosition also
ensures `timeupdate` event remains emitted in a... timely manner.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::playbackPosition const):
Reduce the position cache threshold to 200ms, which is a value
slightly lower than the 250ms defined in HTMLMediaElement.
(WebCore::MediaPlayerPrivateGStreamer::didEnd): Reset the cached
position value to ensure the following query will most likely
return the same value as reported by the duration query.

LayoutTests:

* platform/gtk/TestExpectations: Unflag Timeout from now-unaffected tests.


  Commit: 9724dd31780cd71b2b81503cecd31e2cf3d06b7e
      https://github.com/WebKit/WebKit/commit/9724dd31780cd71b2b81503cecd31e2cf3d06b7e
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r235848 - [GStreamer] Fix overflow in buffered ranges
https://bugs.webkit.org/show_bug.cgi?id=189419

Reviewed by Philippe Normand.

Scale operations on big numbers (like media timestamps or durations)
should be made with GStreamer utility functions to avoid overflows.

This fixes an assertion when a 24 hour long fragmented MP4 file is
played.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::buffered const):


  Commit: 605af8e3ca1907bb65b6d1158891c997849605f5
      https://github.com/WebKit/WebKit/commit/605af8e3ca1907bb65b6d1158891c997849605f5
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSFontSelector.cpp
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/platform/Logging.h
    M Source/WebCore/platform/graphics/FontCache.cpp
    M Source/WebCore/svg/SVGFontFaceElement.cpp
    M Source/WebCore/svg/SVGFontFaceElement.h

  Log Message:
  -----------
  Merge r235862 - svg/W3C-SVG-1.1/render-groups-03-t.svg and some other SVG tests leak documents
https://bugs.webkit.org/show_bug.cgi?id=189147

Reviewed by Dean Jackson.

Document::removedLastRef() needs to clean up m_fontSelector, because it can reference
CSSFontFaceSources that keep SVGFontFaceElements alive, and they in turn will keep
the Document alive.

Also add the beginnings of a Fonts log channel.

This will be tested by world leak testing (webkit.org/b/189332).

* css/CSSFontSelector.cpp:
(WebCore::CSSFontSelector::CSSFontSelector):
(WebCore::CSSFontSelector::~CSSFontSelector):
* dom/Document.cpp:
(WebCore::Document::removedLastRef):
* platform/Logging.h:
* platform/graphics/FontCache.cpp:
(WebCore::FontCache::purgeInactiveFontDataIfNeeded):
(WebCore::FontCache::purgeInactiveFontData):
* svg/SVGFontFaceElement.cpp:
(WebCore::SVGFontFaceElement::SVGFontFaceElement):
(WebCore::SVGFontFaceElement::~SVGFontFaceElement):
* svg/SVGFontFaceElement.h:


  Commit: 7e323820afd786ecfd2b5d5ef0ab5a6786ddfc05
      https://github.com/WebKit/WebKit/commit/7e323820afd786ecfd2b5d5ef0ab5a6786ddfc05
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  Merge r235863 - Many textarea tests leak documents because Document::removeFocusNavigationNodeOfSubtree() can trigger a Document retain cycle
https://bugs.webkit.org/show_bug.cgi?id=188722

Reviewed by Ryosuke Niwa.

Fix a retain cycle created when Document::adjustFocusNavigationNodeOnNodeRemoval() sets
m_focusNavigationStartingNode to itself. m_focusNavigationStartingNode is a Node* (not sure why it's not an Element*),
making it possible to assign the Document to it, which creates a reference to the document which prevents
Document::removedLastRef() ever running and doing the necessary cleanup.

Fix by setting m_focusNavigationStartingNode to null if code tries to set it to the Document. This can happen
when an element is focused and the page calls document.write(), which removes all children.

Will be tested by future leak testing. Fixes the document leak in at least the following tests:
  fast/forms/append-children-during-form-submission.html
  fast/forms/empty-textarea-toggle-disabled.html
  fast/forms/textarea-paste-newline.html
  fast/forms/textarea-trailing-newline.html

* dom/Document.cpp:
(WebCore::Document::setFocusNavigationStartingNode):
(WebCore::Document::adjustFocusNavigationNodeOnNodeRemoval):


  Commit: 6e5406248cbd4dddef961003f7b2c530226efad5
      https://github.com/WebKit/WebKit/commit/6e5406248cbd4dddef961003f7b2c530226efad5
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp

  Log Message:
  -----------
  Merge r235932 - Unreviewed WPE build fix.

* platform/network/soup/SocketStreamHandleImplSoup.cpp:
Add extra header inclusions to get this code building after the unified
sources system shifted it into a different translation unit.


  Commit: e9689cbae2c491fb7e6d439eb69cbbe6fd1f1571
      https://github.com/WebKit/WebKit/commit/e9689cbae2c491fb7e6d439eb69cbbe6fd1f1571
  Author: Pablo Saavedra <psaavedra at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/GStreamer.cmake
    M Source/WebCore/platform/SourcesGLib.txt
    M Source/WebCore/platform/mediastream/libwebrtc/LibWebRTCProviderGlib.cpp

  Log Message:
  -----------
  Merge r235933 - Linking against libWPEWebKit-0.1.so is not posible when WPE is build with ENABLE_VIDEO=OFF and ENABLE_WEB_AUDIO=OFF
https://bugs.webkit.org/show_bug.cgi?id=189540

Patch by Pablo Saavedra <psaavedra at igalia.com> on 2018-09-12
Reviewed by Philippe Normand.

Related issues:

This issue is related with changes in https://bugs.webkit.org/show_bug.cgi?id=183080
This issue is introduced in https://bugs.webkit.org/show_bug.cgi?id=186547

No new tests, no changes in the functionality.

* platform/GStreamer.cmake:
* platform/SourcesGLib.txt:
* platform/mediastream/libwebrtc/LibWebRTCProviderGlib.cpp:
(WebCore::LibWebRTCProvider::webRTCAvailable):


  Commit: 8e44a25c99d46c60e49f196133efee505491d927
      https://github.com/WebKit/WebKit/commit/8e44a25c99d46c60e49f196133efee505491d927
  Author: Ms2ger <Ms2ger at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/glib/KeyedEncoderGlib.cpp

  Log Message:
  -----------
  Merge r235982 - [GLib] Fix format string in KeyedEncoderGlib::beginObject().
https://bugs.webkit.org/show_bug.cgi?id=189585

Reviewed by Michael Catanzaro.

This appears to fix the following assertion locally:

GLib-CRITICAL **: g_variant_builder_add_value: assertion '!GVSB(builder)->expected_type || g_variant_is_of_type (value, GVSB(builder)->expected_type)' failed

Covered by existing tests.

* platform/glib/KeyedEncoderGlib.cpp:
(WebCore::KeyedEncoderGlib::beginObject):


  Commit: f0bab6d2d6b44ed9ecf66205b3914d8030dcbd1a
      https://github.com/WebKit/WebKit/commit/f0bab6d2d6b44ed9ecf66205b3914d8030dcbd1a
  Author: Keith Rollin <krollin at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r235992 - WebPageProxy::reportPageLoadResult can crash on some code paths
https://bugs.webkit.org/show_bug.cgi?id=189568

Reviewed by Chris Dumez.

WebPageProxy::reportPageLoadResult (which is called from
WebPageProxy::didFinishLoadForFrame) can sometimes crash when
accessing m_pageLoadStart (a std::optional) in its unloaded state.
Normally, m_pageLoadStart is initialized in
WebPageProxy::didStartProvisionalLoadForFrame, which one would expect
would be called before WebPageProxy::didFinishLoadForFrame. But that
turns out to not always be the case. It's not apparent under what
conditions didStartProvisionalLoadForFrame will not be called, but
it's happening in the wild, leading to crashes now that std::optional
asserts in release builds on bad accesses (see
https://bugs.webkit.org/show_bug.cgi?id=189568).

Fix this by checking m_pageLoadState on entry to reportPageLoadResult.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
(WebKit::WebPageProxy::didFinishLoadForFrame):
(WebKit::WebPageProxy::didFailLoadForFrame):
(WebKit::WebPageProxy::reportPageLoadResult):


  Commit: c8f3f5a7b711b85a94ae266cb91384a14a97a3cb
      https://github.com/WebKit/WebKit/commit/c8f3f5a7b711b85a94ae266cb91384a14a97a3cb
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/verbose-failure-dont-graph-dump-availability-already-freed.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGGraph.cpp

  Log Message:
  -----------
  Merge r236022 - Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
https://bugs.webkit.org/show_bug.cgi?id=189628
<rdar://problem/39481690>

Reviewed by Mark Lam.

JSTests:

* stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
(foo):

Source/JavaScriptCore:

An Availability may point to a Node. And that Node may be removed from
the graph, e.g, it's freed and its memory is no longer owned by Graph.
This patch makes it so we no longer dump this metadata by default. If
this metadata is interesting to you, you'll need to go in and change
Graph::dump to dump the needed metadata.

* dfg/DFGGraph.cpp:
(JSC::DFG::Graph::dump):


  Commit: d36f883fe5c279f0bec01e8d0002d667a1a98f86
      https://github.com/WebKit/WebKit/commit/d36f883fe5c279f0bec01e8d0002d667a1a98f86
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/files/xhr-response-blob-expected.txt
    M LayoutTests/fast/files/xhr-response-blob.html
    M LayoutTests/imported/w3c/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/xml/XMLHttpRequest.cpp

  Log Message:
  -----------
  Merge r236031 - XMLHttpRequest::createResponseBlob() should create a Blob with type for empty response
        https://bugs.webkit.org/show_bug.cgi?id=189627

        Reviewed by Alexey Proskuryakov.

        Right now we return an empty Blob without type when the response is empty, but
        it should always include the type [1].

        Test: web-platform-tests/xhr/overridemimetype-blob.html

        [1] https://xhr.spec.whatwg.org/#blob-response

        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createResponseBlob):


  Commit: 1b5a2ed447969915d4eba384898a537e681397db
      https://github.com/WebKit/WebKit/commit/1b5a2ed447969915d4eba384898a537e681397db
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/typeProfiler/check-structure-or-empty-in-fixup.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNode.h

  Log Message:
  -----------
  Merge r236089 - We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
https://bugs.webkit.org/show_bug.cgi?id=189676
<rdar://problem/39682897>

Reviewed by Michael Saboff.

JSTests:

* typeProfiler/check-structure-or-empty-in-fixup.js: Added.
(A):
(K):
(i.catch):

Source/JavaScriptCore:

Because the incoming value may be TDZ, CheckStructure may end up crashing.
Since the Type Profile does not currently record TDZ values in any of its
data structures, this is not a semantic change in how it will show you data.
It just fixes crashes when we emit a CheckStructure and the incoming value
is TDZ.

* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToCheckStructureOrEmpty):


  Commit: 5be08a8fcbfe74ae36dfdd6f4a1a614ffa24f7aa
      https://github.com/WebKit/WebKit/commit/5be08a8fcbfe74ae36dfdd6f4a1a614ffa24f7aa
  Author: Claudio Saavedra <csaavedra at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/wpe/WebEventFactory.cpp
    M Tools/ChangeLog
    M Tools/WebKitTestRunner/wpe/EventSenderProxyWPE.cpp

  Log Message:
  -----------
  Merge r236124 - [WPE] Implement mouse event modifiers
https://bugs.webkit.org/show_bug.cgi?id=189697

Reviewed by Carlos Garcia Campos.

Source/WebKit:

Only "CapsLocks" is missing, as WPE doesn't support that modifier.
* Shared/wpe/WebEventFactory.cpp:
(WebKit::modifiersForEventModifiers):
(WebKit::WebEventFactory::createWebKeyboardEvent):
(WebKit::WebEventFactory::createWebMouseEvent):
(WebKit::modifiersForEvent): Deleted.

Tools:

* WebKitTestRunner/wpe/EventSenderProxyWPE.cpp:
(WTR::wkEventModifiersToWPE):
(WTR::EventSenderProxy::mouseDown):
(WTR::EventSenderProxy::mouseUp):


  Commit: 67023d676f349123ca21bf122dec2fd5fcc5236b
      https://github.com/WebKit/WebKit/commit/67023d676f349123ca21bf122dec2fd5fcc5236b
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/history/CachedFrame.cpp
    M Source/WebCore/page/FrameView.cpp
    M Source/WebCore/page/FrameView.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKit/LayoutMilestonesWithAllContentInFrame.cpp

  Log Message:
  -----------
  Merge r236142 - "DidFirstVisuallyNonEmptyLayout" callback does not get called when restoring a page from PageCache
https://bugs.webkit.org/show_bug.cgi?id=189681
<rdar://problem/44526171>

Reviewed by Alex Christensen and Zalan Bujtas.

Source/WebCore:

The "DidFirstVisuallyNonEmptyLayout" callback was not getting called when restoring a page from PageCache
because the FrameView is restored from PageCache and we would fail to restore its flags (such as
m_firstVisuallyNonEmptyLayoutCallbackPending) when entering Page Cache. We now call reset those flags that
are related to layout miletones when entering PageCache so that layout milestone events properly get sent
again when restoring from Page Cache.

* history/CachedFrame.cpp:
(WebCore::CachedFrame::CachedFrame):

Tools:

Add API test coverage.

* TestWebKitAPI/Tests/WebKit/LayoutMilestonesWithAllContentInFrame.cpp:
(TestWebKitAPI::didFinishNavigation):
(TestWebKitAPI::TEST):


  Commit: 0aedc09546e5720ab5b214f5328a52afb82ac809
      https://github.com/WebKit/WebKit/commit/0aedc09546e5720ab5b214f5328a52afb82ac809
  Author: Pablo Saavedra <psaavedra at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Page.cpp
    M Source/WebCore/page/Page.h

  Log Message:
  -----------
  Merge r235895 - playbackControlsManagerUpdateTimerFired and
m_playbackControlsManagerUpdateTimer must be
guarded with ENABLE(VIDEO), otherwise the following
error occurs with the VIDEO feature turned off:

  error: 'MediaElementSession' has not been declared

Add missing #if ENABLE(VIDEO) Page.cpp and Page.h
https://bugs.webkit.org/show_bug.cgi?id=189500

Patch by Pablo Saavedra <psaavedra at igalia.com> on 2018-09-11
Reviewed by Anders Carlsson.

* page/Page.cpp:
(WebCore::Page::Page):
(WebCore::Page::schedulePlaybackControlsManagerUpdate):
* page/Page.h:


  Commit: 13d809ecc1f29b5bc3fd9330b36d2552adb55db1
      https://github.com/WebKit/WebKit/commit/13d809ecc1f29b5bc3fd9330b36d2552adb55db1
  Author: Pablo Saavedra <psaavedra at igalia.com>
  Date:   2018-09-19 (Wed, 19 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/FullScreen/WebFullScreenManager.cpp

  Log Message:
  -----------
  Merge r235906 - Add missing #if ENABLE(VIDEO) WebProcess/FullScreen/WebFullScreenManager.cpp
https://bugs.webkit.org/show_bug.cgi?id=189506

Patch by Pablo Saavedra <psaavedra at igalia.com> on 2018-09-11
Reviewed by Tim Horton.

m_pipStandbyElement is only defined in
WebKit/WebProcess/FullScreen/WebFullScreenManager.h
only when ENABLE(VIDEO) (see
https://bugs.webkit.org/show_bug.cgi?id=181338)

* WebProcess/FullScreen/WebFullScreenManager.cpp:
(WebKit::WebFullScreenManager::setPIPStandbyElement):


  Commit: f08a91a21d29575dcca79d03e0702fc482fd7b0e
      https://github.com/WebKit/WebKit/commit/f08a91a21d29575dcca79d03e0702fc482fd7b0e
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-20 (Thu, 20 Sep 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/multi-put-by-offset-must-filter-value-before-filtering-base.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

  Log Message:
  -----------
  Merge r236223 - AI rule for MultiPutByOffset executes its effects in the wrong order
https://bugs.webkit.org/show_bug.cgi?id=189757
<rdar://problem/43535257>

Reviewed by Michael Saboff.

JSTests:

* stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
(foo):
(Foo):
(g):

Source/JavaScriptCore:

The AI rule for MultiPutByOffset was executing effects in the wrong order.
It first executed the transition effects and the effects on the base, and
then executed the filtering effects on the value being stored. However, you
can end up with the wrong type when the base and the value being stored
are the same. E.g, in a program like `o.f = o`. These effects need to happen
in the opposite order, modeling what happens in the runtime executing of
MultiPutByOffset.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):


  Commit: 0225b5e96c44b8e8a0d8e695a8395c5053b6acac
      https://github.com/WebKit/WebKit/commit/0225b5e96c44b8e8a0d8e695a8395c5053b6acac
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-09-20 (Thu, 20 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

  Log Message:
  -----------
  Merge r236224 - CheckStructureOrEmpty should pass in a tempGPR to emitStructureCheck since it may jump over that code
https://bugs.webkit.org/show_bug.cgi?id=189703

Reviewed by Mark Lam.

This fixes a crash that a TypeProfiler change revealed.

* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):


  Commit: 6766b90f0727f16aa5db5b172a5d5ff14d9d0f62
      https://github.com/WebKit/WebKit/commit/6766b90f0727f16aa5db5b172a5d5ff14d9d0f62
  Author: Tomáš Popela <tpopela at redhat.com>
  Date:   2018-09-20 (Thu, 20 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp

  Log Message:
  -----------
  Merge r236245 - [GTK] Always prints in portrait when landscape is requested
https://bugs.webkit.org/show_bug.cgi?id=189543

Patch by Tomas Popela <tpopela at redhat.com> on 2018-09-20
Reviewed by Michael Catanzaro.

We have to change the surface size based on the requested orientation.
Otherwise only portrait will be printed as it's hardcoded.

* WebProcess/WebPage/gtk/WebPrintOperationGtk.cpp:


  Commit: 6dffa0b18dc68e0e04ce06323920d93f3a161dbd
      https://github.com/WebKit/WebKit/commit/6dffa0b18dc68e0e04ce06323920d93f3a161dbd
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2018-09-20 (Thu, 20 Sep 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.22.1 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.22.1.


  Commit: a512fb17c38386e9fecb4630fe2c30c9b8e7e537
      https://github.com/WebKit/WebKit/commit/a512fb17c38386e9fecb4630fe2c30c9b8e7e537
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-09-21 (Fri, 21 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediasource/SourceBuffer.cpp

  Log Message:
  -----------
  Merge r236258 - [MSE] Use some tolerance when deciding whether a frame should be appended to the decode queue
https://bugs.webkit.org/show_bug.cgi?id=189782

Reviewed by Xabier Rodriguez-Calvar.

Ideally, container formats should use exact timestamps and frames
should not overlap. Unfortunately, there are lots of files out there
where this is not always the case.

This is particularly a problem in WebM, where timestamps are expressed
in a power of 10 timescale, which forces some rounding.

This patch makes SourceBuffer allow frames with a small overlaps
(<=1ms) as those usually found in WebM. 1 ms is chosen because it's
the default time scale of WebM files.

* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):


  Commit: e714dfb91b70f3d3a903b191d25aaae370335195
      https://github.com/WebKit/WebKit/commit/e714dfb91b70f3d3a903b191d25aaae370335195
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-09-21 (Fri, 21 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaSampleGStreamer.cpp

  Log Message:
  -----------
  Merge r236264 - [GStreamer][MSE] Add a default sample duration
https://bugs.webkit.org/show_bug.cgi?id=189788

Some WebM files don't provide sample durations, so we need to provide
a safe default in order for them to be playable.

Reviewed by Michael Catanzaro.

* platform/graphics/gstreamer/MediaSampleGStreamer.cpp:
(WebCore::MediaSampleGStreamer::MediaSampleGStreamer):


  Commit: a38835d8e158998478fc091f22ce269232f194a0
      https://github.com/WebKit/WebKit/commit/a38835d8e158998478fc091f22ce269232f194a0
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-09-21 (Fri, 21 Sep 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/wpe/backends/CMakeLists.txt

  Log Message:
  -----------
  Merge r236275 - [WPE] fails to build on ARM arches complaining about undefined reference to `epoxy_eglMakeCurrent'
https://bugs.webkit.org/show_bug.cgi?id=189556

Reviewed by Konstantin Tokarev.

This is only a speculative build fix as I didn't attempt to reproduce. Explicitly link to
libepoxy.

* wpe/backends/CMakeLists.txt:


  Commit: 4f46b8c4775c8d5464289e75b83de4ca054c03d4
      https://github.com/WebKit/WebKit/commit/4f46b8c4775c8d5464289e75b83de4ca054c03d4
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-09-21 (Fri, 21 Sep 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/wpe/backends/CMakeLists.txt

  Log Message:
  -----------
  Merge r236309 - [WPE] Built RPM of WPE webkit fails to install with "nothing provides libWPEToolingBackends.so()"
https://bugs.webkit.org/show_bug.cgi?id=189797

Reviewed by Žan Doberšek.

* wpe/backends/CMakeLists.txt: Make libWPEToolingBackends a static library to avoid
the need for installing it. This works fine because the library only contains utility
code intended to be reused from other various components (MiniBrowser, WebKitTestRunner).


  Commit: a00936a6cdd1e1cd7c83836e5410439d8de42d56
      https://github.com/WebKit/WebKit/commit/a00936a6cdd1e1cd7c83836e5410439d8de42d56
  Author: Tomáš Popela <tpopela at redhat.com>
  Date:   2018-09-21 (Fri, 21 Sep 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssemblerARM.h

  Log Message:
  -----------
  Merge r236315 - [ARM] Build broken on armv7hl after r235517
https://bugs.webkit.org/show_bug.cgi?id=189831

Reviewed by Yusuke Suzuki.

Add missing implementation of patchebleBranch8() for traditional ARM.

* assembler/MacroAssemblerARM.h:
(JSC::MacroAssemblerARM::patchableBranch8):


  Commit: d7a54563e151ec54f64a6eda31e8e6605ce43ee7
      https://github.com/WebKit/WebKit/commit/d7a54563e151ec54f64a6eda31e8e6605ce43ee7
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-09-21 (Fri, 21 Sep 2018)

  Changed paths:
    A LayoutTests/media/media-source/media-source-append-out-of-order-expected.txt
    A LayoutTests/media/media-source/media-source-append-out-of-order.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediasource/SourceBuffer.cpp

  Log Message:
  -----------
  Merge r236314 - [MSE] Fix comparsion with uninitialized greatestDecodeDuration
https://bugs.webkit.org/show_bug.cgi?id=189805

Reviewed by Michael Catanzaro.

This bug was causing greatestDecodeDuration to never be initialized,
which in turned caused unintended frame erase as distant appends where
not being recognized as distinct coded frame groups.

A test reproducing the sequence of appends that caused unintended
frame deletion has also been added (media-source-append-out-of-order.html).

* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):


  Commit: 8c8ded28176b43f078eab307ff6acbaf7ef3fbdc
      https://github.com/WebKit/WebKit/commit/8c8ded28176b43f078eab307ff6acbaf7ef3fbdc
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-09-21 (Fri, 21 Sep 2018)

  Changed paths:
    M Source/ThirdParty/ANGLE/ChangeLog
    M Source/ThirdParty/ANGLE/changes.diff
    M Source/ThirdParty/ANGLE/include/EGL/eglplatform.h

  Log Message:
  -----------
  Merge r236349 - [GTK] ANGLE's eglplatform.h does not support Wayland-only builds
https://bugs.webkit.org/show_bug.cgi?id=189844

Reviewed by Michael Catanzaro.

This makes it possible to build WebKitGTK+ after r225340 when the
build is configured to support only Wayland, and the X11 headers
are not present.

* changes.diff: Updated.
* include/EGL/eglplatform.h: Include the X11 headers only when
ANGLE_USE_X11 is defined and, for consistency with Mesa's version
of the header, when MESA_EGL_NO_X11_HEADERS is not defined.


  Commit: 2ebe3d0aa6f32fed6004433f0c9a73f3a816558d
      https://github.com/WebKit/WebKit/commit/2ebe3d0aa6f32fed6004433f0c9a73f3a816558d
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-09-21 (Fri, 21 Sep 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.22.1 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.22.2.


  Commit: d9ce1e35c727cad31d612892fa35127beb3fc514
      https://github.com/WebKit/WebKit/commit/d9ce1e35c727cad31d612892fa35127beb3fc514
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-09-25 (Tue, 25 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cpu/arm/filters/FELightingNEON.h

  Log Message:
  -----------
  Merge r236391 - [ARM] Building FELightingNEON.cpp fails due to missing lightVector member
https://bugs.webkit.org/show_bug.cgi?id=189890

Reviewed by Darin Adler.

No new tests needed.

* platform/graphics/cpu/arm/filters/FELightingNEON.h:
(WebCore::FELighting::platformApplyNeon): Adapt to new layout of "struct PaintingData" after r225122.


  Commit: 4994418726df64b9d99aba0b9576285c3c149aec
      https://github.com/WebKit/WebKit/commit/4994418726df64b9d99aba0b9576285c3c149aec
  Author: Ross Kirsling <ross.kirsling at sony.com>
  Date:   2018-09-25 (Tue, 25 Sep 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/filters/PointLightSource.cpp

  Log Message:
  -----------
  Merge r235536 - Speculative build fix for WPE after r235531.

* platform/graphics/filters/PointLightSource.cpp:
Add missing include.


  Commit: e5dd8a89da906a11f176b9d719b2851516111853
      https://github.com/WebKit/WebKit/commit/e5dd8a89da906a11f176b9d719b2851516111853
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-09-25 (Tue, 25 Sep 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/webkitglib-symbols.map

  Log Message:
  -----------
  Merge r236482 - [WPE] Export jsc_ symbols
https://bugs.webkit.org/show_bug.cgi?id=189964

Patch by Philippe Normand <pnormand at igalia.com> on 2018-09-25
Reviewed by Michael Catanzaro.

* webkitglib-symbols.map: Keep jsc_* symbols as visible so they
can be used by applications depending on WPE.


  Commit: 398b3e0927f5c8bc0e967245449482af813ee826
      https://github.com/WebKit/WebKit/commit/398b3e0927f5c8bc0e967245449482af813ee826
  Author: Enrique Ocaña González <eocanha at igalia.com>
  Date:   2018-10-01 (Mon, 01 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp

  Log Message:
  -----------
  Merge r236395 - [MSE][GStreamer] Don't update duration when it was not previously NaN
https://bugs.webkit.org/show_bug.cgi?id=189869

Reviewed by Xabier Rodriguez-Calvar.

This is what the spec mandates. The spec doesn't say anything about
updating duration when it had been previously set, even if the new
init segment says that the duration is growing.

This fixes MSE YTTV 2018 69.MediaSourceDurationVP9.

* platform/graphics/gstreamer/mse/AppendPipeline.cpp:
(WebCore::AppendPipeline::connectDemuxerSrcPadToAppsink):


  Commit: 69c715376d23e0a61630f35959099af0d75231ee
      https://github.com/WebKit/WebKit/commit/69c715376d23e0a61630f35959099af0d75231ee
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-01 (Mon, 01 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaSampleGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.h

  Log Message:
  -----------
  Merge r236409 - [MSE][GStreamer] Pull demuxed samples in batches
https://bugs.webkit.org/show_bug.cgi?id=189871

Reviewed by Xabier Rodriguez-Calvar.

After this patch, only the notifications of "new samples available"
(appsink-new-sample bus messages) travel from the streaming thread to
the main thread through the bus and the main thread is the responsible
of pulling as many samples as it can from appsink. Before, the samples
were pulled from appsink in the non-main thread and traveled to the
main thread through the bus one by one.

This reduces drastically the amount of context switches and waiting
time in the streaming thread, resulting in a noticeable performance
improvement.

This fixes stutter while loading YouTube videos.

* platform/graphics/gstreamer/MediaSampleGStreamer.cpp:
(WebCore::MediaSampleGStreamer::MediaSampleGStreamer):
* platform/graphics/gstreamer/mse/AppendPipeline.cpp:
(WebCore::AppendPipeline::AppendPipeline):
(WebCore::AppendPipeline::~AppendPipeline):
(WebCore::AppendPipeline::clearPlayerPrivate):
(WebCore::AppendPipeline::handleApplicationMessage):
(WebCore::AppendPipeline::appsinkNewSample):
(WebCore::AppendPipeline::consumeAppSinkAvailableSamples):
(WebCore::AppendPipeline::resetPipeline):
(WebCore::AppendPipeline::handleNewAppsinkSample):
* platform/graphics/gstreamer/mse/AppendPipeline.h:


  Commit: bbed884d7022fc3cef84d8b07184f43c07bdab73
      https://github.com/WebKit/WebKit/commit/bbed884d7022fc3cef84d8b07184f43c07bdab73
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-01 (Mon, 01 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/media/media-source/media-source-append-acb-no-frame-lost-expected.txt
    A LayoutTests/media/media-source/media-source-append-acb-no-frame-lost.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediasource/SourceBuffer.cpp

  Log Message:
  -----------
  Merge r236566 - [MSE] Fix unwanted sample erase from the decode queue
https://bugs.webkit.org/show_bug.cgi?id=180643

Reviewed by Jer Noble.

Source/WebCore:

Test: media/media-source/media-source-append-acb-no-frame-lost.html

This bug reproduced when unordered appends were made. For instance, if
the application appended [0, 10) and then [20, 30), the frame at 20
would be wrongly discarded from the decode queue.

Later the application could append [10, 20) and the gap at [20, 21)
would persist in the decode queue, even if the frame remained in the
track buffer table.

Thanks to Daniel Zhang for reporting the issue.

* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::provideMediaData):

LayoutTests:

Added a test case for the fixed bug.

* media/media-source/media-source-append-acb-no-frame-lost.html: Added.


  Commit: ff114ba67ee6fc76ef874b7e9d20c80022cf7eb9
      https://github.com/WebKit/WebKit/commit/ff114ba67ee6fc76ef874b7e9d20c80022cf7eb9
  Author: Olivier Blin <olivier.blin at softathome.com>
  Date:   2018-10-01 (Mon, 01 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/wpe/RenderThemeWPE.cpp

  Log Message:
  -----------
  Merge r236666 - [WPE] fix buffer over-read in RenderThemeWPE::mediaControlsStyleSheet()
https://bugs.webkit.org/show_bug.cgi?id=190139

Patch by Olivier Blin <olivier.blin at softathome.com> on 2018-10-01
Reviewed by Michael Catanzaro.

Like done upstream for EFL in r210213
https://bugs.webkit.org/show_bug.cgi?id=166622

This has been detected by a charactersAreAllASCII() assert failure.

This is because ASCIILiteral() is wrongly used in mediaControlsStyleSheet().
mediaControlsBaseUserAgentStyleSheet is a char array, not a null-terminated string.
It is thus incorrect to use StringImpl::createFromLiteral() that calls
strlen() to get the string length.

The String::ConstructFromLiteral constructor can not be used, since it
skips the last character.

* platform/wpe/RenderThemeWPE.cpp:
(WebCore::RenderThemeWPE::mediaControlsStyleSheet):
Explicitely pass the size to the String constructor.


  Commit: 6e46185fb1b4db6b52cd78e077c702074ac5d20c
      https://github.com/WebKit/WebKit/commit/6e46185fb1b4db6b52cd78e077c702074ac5d20c
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-01 (Mon, 01 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaSampleGStreamer.cpp

  Log Message:
  -----------
  Merge r236679 - [MSE][GStreamer] Set a minimum sample duration
https://bugs.webkit.org/show_bug.cgi?id=190125

Reviewed by Xabier Rodriguez-Calvar.

The last sample of the audio track in the asset used in this test
player has a tiny duration (100 ns):

http://orange-opensource.github.io/hasplayer.js/1.2.0/player.html?url=http://playready.directtaps.net/smoothstreaming/SSWSS720H264/SuperSpeedway_720.ism/Manifest

So small, we were truncating it to zero. We're not supposed to have
frames with zero duration. Instead, lets set a minimum frame duration
for those fringe cases.

* platform/graphics/gstreamer/MediaSampleGStreamer.cpp:
(WebCore::MediaSampleGStreamer::MediaSampleGStreamer):


  Commit: 8bdb5647de4b530d6198180508d455622341b33f
      https://github.com/WebKit/WebKit/commit/8bdb5647de4b530d6198180508d455622341b33f
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-01 (Mon, 01 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/media/media-source/media-source-append-acb-tolerance-expected.txt
    A LayoutTests/media/media-source/media-source-append-acb-tolerance.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediasource/SourceBuffer.cpp

  Log Message:
  -----------
  Merged patch for #190085 - [MSE] Use tolerance when growing the coded frame group
https://bugs.webkit.org/show_bug.cgi?id=190085

Patch by Alicia Boya García <aboya at igalia.com> on 2018-10-01
Reviewed by NOBODY (OOPS!).

build-releng/../LayoutTests:

A test simulating unordered appends with imprecise timestamps,
overlapping <1ms (replicating a typical WebM 30fps video file) is
added.

* media/media-source/media-source-append-acb-tolerance.html: Added.

build-releng/../Source/WebCore:

Test: media/media-source/media-source-append-acb-tolerance.html

This patch introduces a millisecond tolerance in the range of
potential frames that should be erased frame from the track buffer
when the coded frame group is growing.

This is necessary because some files have imprecise overlapping
timestamps (especially WebM files).

This fixes a stall when seeking back and forth in YouTube with WebM
video.

A test case simulating the problem with video/mock using timestamps
similar to those of a typical 30 fps WebM video is also added.

* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):


  Commit: ca681d9e42a5d7b64165e0b0ab7ba011b894f2b3
      https://github.com/WebKit/WebKit/commit/ca681d9e42a5d7b64165e0b0ab7ba011b894f2b3
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-01 (Mon, 01 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/media/media-source/content/test-48khz-manifest.json
    A LayoutTests/media/media-source/media-source-seek-redundant-append-expected.txt
    A LayoutTests/media/media-source/media-source-seek-redundant-append.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/PlaybackPipeline.cpp

  Log Message:
  -----------
  [MSE][GStreamer] Reset running time in PlaybackPipeline::flush()
https://bugs.webkit.org/show_bug.cgi?id=190076

Reviewed by Philippe Normand.

Source/WebCore:

Test: media/media-source/media-source-seek-redundant-append.html

PlaybackPipeline::flush() is called when already enqueued frames are
appended again. This may be caused by a quality change or just a
redundant append. Either way, the pipeline has to be flushed and
playback begin again, but without changing the player position by
much.

There are two kinds of time to consider here: stream time (i.e. the
time of a frame as written in the file, e.g. a frame may have stream
time 0:01:00), and running time (i.e. how much time since playback
started should pass before the frame should be played, e.g. if we
started playing at 0:00:59 that same frame would have a running time
of just 1 second).

Notice how running time depends on where and when playback starts.
Running time can also be optionally resetted after a flush. (This is
indeed done currently by most demuxers after a seek.)

Instead of resetting running time, PlaybackPipeline used to modify the
first GstSegment emitted after the flush. A GstSegment declares the
mapping between stream time and running time for the following frames.
There, PlaybackPipeline used to set `base` (the running time at which
the segment starts) to the position reported by a position query
(which is stream time).

This, of course, only worked when playback (or the last seek) started
at stream time 0:00:00, since that's the only case where running time
equals stream time. In other cases delays as long as the difference
between these timelines would appear. This is demonstrated in the
attached test, where seeks and appends are made in such an order that
the difference is more than 5 minutes, making the playback stall for
>5 minutes before playing 1 second of audio.

This patch fixes the problem by resetting running time with the flush
and not modifying GstSegment.base anymore (it will be left as zero,
which is now correct since the running time has been reset).

* platform/graphics/gstreamer/mse/PlaybackPipeline.cpp:
(WebCore::PlaybackPipeline::flush):
(WebCore::segmentFixerProbe): Deleted.

LayoutTests:

A test where a seek is followed by a redundant append is added. This
test timed out in the GStreamer MSE implementation before the
accompanying patch fixed it.

The MIME type declared in test-48khz-manifest.json has also been
changed, from non-standard `audio/x-m4a` to `audio/mp4;
codecs="mp4a.40.2"`, as implied by the MSE specs. This should not
affect other tests because no other tests were reading this type
string before.

* media/media-source/content/test-48khz-manifest.json:
* media/media-source/media-source-seek-redundant-append-expected.txt: Added.
* media/media-source/media-source-seek-redundant-append.html: Added.
* media/video-test.js:


  Commit: 66e4ea4a3df389b52c7afc26e960406076a95188
      https://github.com/WebKit/WebKit/commit/66e4ea4a3df389b52c7afc26e960406076a95188
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.h
    M Tools/ChangeLog
    M Tools/gstreamer/jhbuild.modules
    A Tools/gstreamer/patches/gst-plugins-good-0010-matroskademux-Emit-no-more-pads-after-parsing-Tracks.patch

  Log Message:
  -----------
  Merge r236399 - [MSE][GStreamer] Use no-more-pads event for noticing initialization segments
https://bugs.webkit.org/show_bug.cgi?id=189868

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

Fixes the following YTTV 2018 tests:
62.VideoDimensionVP9
63.PlaybackStateVP9

This removes the hack that was making supporting multiple tracks in
the same file in MSE impossible.

For WebM, this GStreamer patch is required:
https://bugzilla.gnome.org/show_bug.cgi?id=797187
"matroskademux: Emit no-more-pads after parsing Tracks"

* platform/graphics/gstreamer/mse/AppendPipeline.cpp:
(WebCore::AppendPipeline::AppendPipeline):
(WebCore::AppendPipeline::handleApplicationMessage):
(WebCore::AppendPipeline::demuxerNoMorePads):
(WebCore::AppendPipeline::appsinkCapsChanged):
(WebCore::AppendPipeline::connectDemuxerSrcPadToAppsink):
(WebCore::AppendPipeline::appendPipelineDemuxerNoMorePadsFromAnyThread):
(WebCore::appendPipelineDemuxerNoMorePads):
* platform/graphics/gstreamer/mse/AppendPipeline.h:

Tools:

Added patch from https://bugzilla.gnome.org/show_bug.cgi?id=797187

* gstreamer/jhbuild.modules:
* gstreamer/patches/gst-plugins-good-0010-matroskademux-Emit-no-more-pads-after-parsing-Tracks.patch: Added.


  Commit: 1942fdc97927df449bd61ec0f57a2a4c10aa2c6c
      https://github.com/WebKit/WebKit/commit/1942fdc97927df449bd61ec0f57a2a4c10aa2c6c
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.h

  Log Message:
  -----------
  Merge r236547 - [MSE][GStreamer] Use sentinel buffer to detect end of append
https://bugs.webkit.org/show_bug.cgi?id=189924

Reviewed by Philippe Normand.

This patch introduces a new mechanism to detect when an append has
been consumed completely by the demuxer. It takes advantage of the
fact that buffer pushing is synchronous: both the appsrc and the
demuxer live in the same streaming thread. When appsrc pushes a
buffer, it's actually making a qtdemux function call (it calls its
"chain" function). The demuxer will return from that call when it has
finished processing that buffer; only then the control returns to
appsrc, that can push the next buffer.

By pushing an additional buffer and capturing it in a probe we can
detect reliably when the previous buffer has been processed.
Because the pipeline only has one thread, at this point no more frames
can arrive to the appsink.

This replaces the old method of detecting end of append which relied
on the `need-data` event, which is more difficult to handle correctly
because it fires whenever the appsrc is empty (or below a given
level), which also happens when a buffer has not been pushed yet or
in response to a flush.

* platform/graphics/gstreamer/mse/AppendPipeline.cpp:
(WebCore::EndOfAppendMeta::init):
(WebCore::EndOfAppendMeta::transform):
(WebCore::EndOfAppendMeta::free):
(WebCore::AppendPipeline::staticInitialization):
(WebCore::AppendPipeline::AppendPipeline):
(WebCore::AppendPipeline::~AppendPipeline):
(WebCore::AppendPipeline::appsrcEndOfAppendCheckerProbe):
(WebCore::AppendPipeline::handleApplicationMessage):
(WebCore::AppendPipeline::handleEndOfAppend):
(WebCore::AppendPipeline::consumeAppsinkAvailableSamples):
(WebCore::AppendPipeline::resetPipeline):
(WebCore::AppendPipeline::pushNewBuffer):
(WebCore::AppendPipeline::handleAppsrcNeedDataReceived): Deleted.:
(WebCore::AppendPipeline::handleAppsrcAtLeastABufferLeft): Deleted.
(WebCore::AppendPipeline::checkEndOfAppend): Deleted.
(WebCore::AppendPipeline::setAppsrcDataLeavingProbe): Deleted.
(WebCore::AppendPipeline::removeAppsrcDataLeavingProbe): Deleted.
(WebCore::AppendPipeline::reportAppsrcAtLeastABufferLeft): Deleted.
(WebCore::AppendPipeline::reportAppsrcNeedDataReceived): Deleted.
(WebCore::appendPipelineAppsrcDataLeaving): Deleted.
(WebCore::appendPipelineAppsrcNeedData): Deleted.
* platform/graphics/gstreamer/mse/AppendPipeline.h:


  Commit: 2e2ba5a0703c6bbfd1f1464c2abcef9609ffc3ad
      https://github.com/WebKit/WebKit/commit/2e2ba5a0703c6bbfd1f1464c2abcef9609ffc3ad
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp

  Log Message:
  -----------
  Merge r236717 - [MSE][GStreamer] Make same thread assert non-release
https://bugs.webkit.org/show_bug.cgi?id=189924

Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/mse/AppendPipeline.cpp:
(WebCore::AppendPipeline::handleNewAppsinkSample):


  Commit: 920afee87e21afb76f4c7f21a8115d1664cea181
      https://github.com/WebKit/WebKit/commit/920afee87e21afb76f4c7f21a8115d1664cea181
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/GStreamerChecks.cmake

  Log Message:
  -----------
  Merge r236716 - [GStreamer][MSE] Ubuntu LTS build broken since r236409
https://bugs.webkit.org/show_bug.cgi?id=190036

Reviewed by Michael Catanzaro.

Interrupt the build if MSE is enabled but no supported (1.14)
GStreamer version was found.

* Source/cmake/GStreamerChecks.cmake:


  Commit: 2984191682d04c17e18467d3179f6c15c2e30a1a
      https://github.com/WebKit/WebKit/commit/2984191682d04c17e18467d3179f6c15c2e30a1a
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp

  Log Message:
  -----------
  Merge r236668 - [GStreamer] Fix abort in gst_sample_get_info()
https://bugs.webkit.org/show_bug.cgi?id=190135

Reviewed by Philippe Normand.

A flush can occur before any frame has finished decoding -- especially
in tests, where actions on the player often occur in quick succession.

Therefore, the code must not assume by the time a flush occurs any
frame has reached the sink. This patch fixes a case when such wrong
assumption was causing gst_sample_get_info() to abort (crashing
WebKit).

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamerBase.cpp:
(WebCore::MediaPlayerPrivateGStreamerBase::flushCurrentBuffer):
(WebCore::MediaPlayerPrivateGStreamerBase::createGLAppSink):


  Commit: c4c6c48334120493d26ab8945606632d80296fb8
      https://github.com/WebKit/WebKit/commit/c4c6c48334120493d26ab8945606632d80296fb8
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/AudioTrackPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/VideoTrackPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r236721 - [GStreamer][playbin3] Stream tag lists leaks
https://bugs.webkit.org/show_bug.cgi?id=190192

Reviewed by Xabier Rodriguez-Calvar.

The gst_stream_get_tags() result is transfer-full, so needs to be adopted to prevent a leak.
Also check the tags list pointer which might be NULL in some cases.

* platform/graphics/gstreamer/AudioTrackPrivateGStreamer.cpp:
(WebCore::AudioTrackPrivateGStreamer::AudioTrackPrivateGStreamer):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::naturalSize const):
* platform/graphics/gstreamer/VideoTrackPrivateGStreamer.cpp:
(WebCore::VideoTrackPrivateGStreamer::VideoTrackPrivateGStreamer):


  Commit: b3bdfde680bf4fbf287c69d6e5e9c9d5cb1a9fb1
      https://github.com/WebKit/WebKit/commit/b3bdfde680bf4fbf287c69d6e5e9c9d5cb1a9fb1
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/AppendPipeline.cpp

  Log Message:
  -----------
  Merge r236735 - [MSE][GStreamer] Add h264parse to accept MP4 without stss
https://bugs.webkit.org/show_bug.cgi?id=190143

Reviewed by Xabier Rodriguez-Calvar.

The MP4 file used in this URL does not contain a stss (Sync Sample
Box). In consequence, in acordance with the ISO BMFF spec, all samples
are assumed to be sync frames... But in this case that is not true,
it's just that the file is wrong (e.g. created with a buggy muxer).

http://orange-opensource.github.io/hasplayer.js/1.2.0/player.html?url=http://playready.directtaps.net/smoothstreaming/SSWSS720H264/SuperSpeedway_720.ism/Manifest

The way it works in other browsers is because instead of trusting the
MP4 stss table, they rely on parsing the h264 frames. We can do that
too.

This patch also changes RELEASE_ASSERT() when creating the parsers
to GLib criticals.

* platform/graphics/gstreamer/mse/AppendPipeline.cpp:
(WebCore::createOptionalParserForFormat):


  Commit: a966e37ddd26d924e77b2357279bf10dee4e081a
      https://github.com/WebKit/WebKit/commit/a966e37ddd26d924e77b2357279bf10dee4e081a
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  wip


  Commit: 5e68bfca79e0cee49aa223184a970bb7cb5533c3
      https://github.com/WebKit/WebKit/commit/5e68bfca79e0cee49aa223184a970bb7cb5533c3
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-02 (Tue, 02 Oct 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.22.0 release.

build-releng/..:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

build-releng/../Source/WebKit:

* wpe/NEWS: Add release notes for 2.22.0.


  Commit: f21625a301560759c7df24451acec227e9491278
      https://github.com/WebKit/WebKit/commit/f21625a301560759c7df24451acec227e9491278
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-27 (Sat, 27 Oct 2018)

  Changed paths:
    M JSTests/ChangeLog
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Merged r235177 - The DFG CFGSimplification phase shouldn’t jettison a block when it’s the target of both branch directions.
https://bugs.webkit.org/show_bug.cgi?id=188298
<rdar://problem/42888427>

Reviewed by Saam Barati.

JSTests:

* stress/bug-188298.js: Added.

Source/JavaScriptCore:

In the event that both targets of a Branch is the same block, then even if we'll
always take one path of the branch, the other target is not unreachable because
it is the same target as the one in the taken path.  Hence, it should not be
jettisoned.

* JavaScriptCore.xcodeproj/project.pbxproj:
- Added DFGCFG.h which is in use and should have been added to the project.
* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::run):


  Commit: 51448100518632c80b35cc06292bfe516dbd26c2
      https://github.com/WebKit/WebKit/commit/51448100518632c80b35cc06292bfe516dbd26c2
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/FormAssociatedElement.cpp

  Log Message:
  -----------
  Merged r235956 - imported/w3c/web-platform-tests/shadow-dom/form-control-form-attribute.html hits assertion
https://bugs.webkit.org/show_bug.cgi?id=189493

Reviewed by Alex Christensen.

Source/WebCore:

The debug assertion was caused by RefPtr in FormAssociatedElement::formOwnerRemovedFromTree introduced
by r224390 and r223644 ref'ing ShadowRoot while calling removeDetachedChildren inside ~ShadowRoot.
When a form (or any other) element has more than one ref inside removeDetachedChildren,
addChildNodesToDeletionQueue calls notifyChildNodeRemoved in the tree oreder.

However, when a form associated element of this form element appears later in the tree order,
FormAssociatedElement::formOwnerRemovedFromTree can traverse up ancestors including the ShadowRoot.

Fixed the bug by using raw pointers instead. Luckily, there is no DOM mutations or other non-trivial
operations happening in this function so this should be safe.

Test: imported/w3c/web-platform-tests/shadow-dom/form-control-form-attribute.html

* html/FormAssociatedElement.cpp:
(WebCore::FormAssociatedElement::formOwnerRemovedFromTree): Fixed the bug.

LayoutTests:

Unskip the test now that it doesn't hit a debug assertion.

* TestExpectations:


  Commit: 1b9a2dc8b1b639bdc97441c2dc177cdfc3a3bffd
      https://github.com/WebKit/WebKit/commit/1b9a2dc8b1b639bdc97441c2dc177cdfc3a3bffd
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189571.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
    M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
    M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

  Log Message:
  -----------
  Merged r236161 - Ensure that ForInContexts are invalidated if their loop local is over-written. https://bugs.webkit.org/show_bug.cgi?id=189571 <rdar://problem/44402277>

Reviewed by Saam Barati.

JSTests:

* stress/regress-189571.js: Added.

Source/JavaScriptCore:

Instead of hunting down every place in the BytecodeGenerator that potentially
needs to invalidate an enclosing ForInContext (if one exists), we simply iterate
the bytecode range of the loop body when the ForInContext is popped, and
invalidate the context if we ever find the loop temp variable over-written.

This has 2 benefits:
1. It ensures that every type of opcode that can write to the loop temp will be
   handled appropriately, not just the op_mov that we've hunted down.
2. It avoids us having to check the BytecodeGenerator's m_forInContextStack
   every time we emit an op_mov (or other opcodes that can write to a local)
   even when we're not inside a for-in loop.

JSC benchmarks show that that this change is performance neutral.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::pushIndexedForInScope):
(JSC::BytecodeGenerator::popIndexedForInScope):
(JSC::BytecodeGenerator::pushStructureForInScope):
(JSC::BytecodeGenerator::popStructureForInScope):
(JSC::ForInContext::finalize):
(JSC::StructureForInContext::finalize):
(JSC::IndexedForInContext::finalize):
(JSC::BytecodeGenerator::invalidateForInContextForLocal): Deleted.
* bytecompiler/BytecodeGenerator.h:
(JSC::ForInContext::ForInContext):
(JSC::ForInContext::bodyBytecodeStartOffset const):
(JSC::StructureForInContext::StructureForInContext):
(JSC::IndexedForInContext::IndexedForInContext):
* bytecompiler/NodesCodegen.cpp:
(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::EmptyLetExpression::emitBytecode):
(JSC::ForInNode::emitLoopHeader):
(JSC::ForOfNode::emitBytecode):
(JSC::BindingNode::bindValue const):
(JSC::AssignmentElementNode::bindValue const):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):


  Commit: 222bbe3bea3fc3d1b61361e5bf0f022d0b35159e
      https://github.com/WebKit/WebKit/commit/222bbe3bea3fc3d1b61361e5bf0f022d0b35159e
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/printing/crash-while-formatting-subframe-for-printing-expected.txt
    A LayoutTests/printing/crash-while-formatting-subframe-for-printing.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderView.cpp

  Log Message:
  -----------
  Merged r236288 - Release assert under RenderView::pageOrViewLogicalHeight
https://bugs.webkit.org/show_bug.cgi?id=189798
<rdar://problem/43659749>

Reviewed by Simon Fraser.

Source/WebCore:

Only the mainframe's render view is sized to the page while printing.
Use the matching check (see RenderView::layout) when accessing m_pageLogicalSize.

Test: printing/crash-while-formatting-subframe-for-printing.html

* rendering/RenderView.cpp:
(WebCore::RenderView::pageOrViewLogicalHeight const):

LayoutTests:

* printing/crash-while-formatting-subframe-for-printing-expected.txt: Added.
* printing/crash-while-formatting-subframe-for-printing.html: Added.


  Commit: b0f6ea183a5f563d0c2895124c90f3b4e290e347
      https://github.com/WebKit/WebKit/commit/b0f6ea183a5f563d0c2895124c90f3b4e290e347
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/cache/DOMCache.cpp

  Log Message:
  -----------
  Merged r236789 - Ref<FetchResponse> use-after-move in DOMCache::put()
https://bugs.webkit.org/show_bug.cgi?id=190239

Reviewed by Youenn Fablet.

Retrieve reference from the Ref<FetchResponse> object before it's
move-captured in the lambda that's passed to the
FetchResponse::consumeBodyReceivedByChunk() method that is invoked on
that very same object. This is a classic use-after-move bug that pops
up on compilers with different C++ calling convention.

* Modules/cache/DOMCache.cpp:
(WebCore::DOMCache::put):


  Commit: 0b3d31191c539e907e63f3a6143100d48bab5afa
      https://github.com/WebKit/WebKit/commit/0b3d31191c539e907e63f3a6143100d48bab5afa
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/unix/ConnectionUnix.cpp

  Log Message:
  -----------
  Merged r236928 - Validation in Connection::readBytesFromSocket() is too aggressive
https://bugs.webkit.org/show_bug.cgi?id=190281

Reviewed by Michael Catanzaro.

Since r217206 Connection::readBytesFromSocket() validates size of
control message. However, it compares cmsg_len with attachmentMaxAmount,
while Connection::sendOutgoingMessage() computes it as
CMSG_LEN(sizeof(int) * attachmentFDBufferLength) where
attachmentFDBufferLength <= attachmentMaxAmount. This mismatch between
sender and receiver leads to possibility of assertion failure with large
number of attachments, e.g. here 62 attachments have cmsg_length == 264.

* Platform/IPC/unix/ConnectionUnix.cpp:
(IPC::readBytesFromSocket):


  Commit: 11419f663e4307066f46d0bd366a85fed61d5997
      https://github.com/WebKit/WebKit/commit/11419f663e4307066f46d0bd366a85fed61d5997
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h

  Log Message:
  -----------
  Merged r236961 - [GStreamer] Stealing cross-origin video pixel with HLS
https://bugs.webkit.org/show_bug.cgi?id=190003

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

Report the SecurityOrigin of downloaded adaptivedemux (HLS, DASH,
SmoothStreaming) fragments as tainted if their origin differs from
the manifest SecurityOrigin. SecurityOrigins are stored in the
CachedResourceStreamingClient implemented in the internal
GStreamer HTTP(S) source element.

The implementation is not ideal yet because the fragments download
is performed by the WebProcess, until bug 189967 is fixed. When
this bug is fixed, the m_hasTaintedOrigin member variable should
be removed and all checks be done unconditionally to the
webkithttpsrc element which will manage the download of the
manifests and fragments.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::loadFull): Reset the m_hasTaintedOrigin value.
(WebCore::MediaPlayerPrivateGStreamer::handleMessage): Get the
fragment URL from the adaptivedemux stats message and check if its
origin is tainted.
(WebCore::MediaPlayerPrivateGStreamer::wouldTaintOrigin const):
Initial implementation by checking the m_hasTaintedOrigin member
variable value.
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(CachedResourceStreamingClient::responseReceived): Store the
resource origin internally so it can be checked later on by
webKitSrtcWouldTaintOrigin().
(webKitSrcWouldTaintOrigin): Check given origin against cached
origins. This implementation is similar to Cocoa's
WebCoreNSURLSession implementation.
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.h:

LayoutTests:

* platform/gtk/TestExpectations: Unflag now-passing test.


  Commit: 1de22d49ed5ce243750ff628a63c1a5b4ec8116f
      https://github.com/WebKit/WebKit/commit/1de22d49ed5ce243750ff628a63c1a5b4ec8116f
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/PlatformWPE.cmake
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake

  Log Message:
  -----------
  Mergeg r236975 - [WPE] Explicitly link against gmodule where used
https://bugs.webkit.org/show_bug.cgi?id=190398

Reviewed by Michael Catanzaro.

* PlatformWPE.cmake:


  Commit: 3d69c41c8d22f6713943d25b02cc1a9fd747449a
      https://github.com/WebKit/WebKit/commit/3d69c41c8d22f6713943d25b02cc1a9fd747449a
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp

  Log Message:
  -----------
  Merged r236985 - [WPE][GTK] Complex text crashes with harfbuzz 1.8.8
https://bugs.webkit.org/show_bug.cgi?id=190409

Reviewed by Žan Doberšek.

We discovered that harfbuzz 1.8.8 breaks WebKit by changing the ownership semantics of
hb_icu_get_unicode_funcs() from (transfer full) to (transfer none). Our code was actually
expecting (transfer none), so it's not immediately clear to me why it's crashing now, but
doesn't matter as Behdad recommends removing this line of code because it hasn't been
been needed for many years.

This should be covered by all our complex text tests if the bots were upgraded to the newer
harfbuzz.

* platform/graphics/harfbuzz/ComplexTextControllerHarfBuzz.cpp:
(WebCore::ComplexTextController::collectComplexTextRunsForCharacters):


  Commit: 8c49731026d2ba275e1f02c0f0f94ad074e30b38
      https://github.com/WebKit/WebKit/commit/8c49731026d2ba275e1f02c0f0f94ad074e30b38
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr-expected.txt
    A LayoutTests/svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/svg/SVGElement.h
    M Source/WebCore/svg/SVGGeometryElement.h
    M Source/WebCore/svg/SVGLangSpace.cpp

  Log Message:
  -----------
  Merged r236991 - REGRESSION(r234620): SVGLangSpace::svgAttributeChanged() should invalidate the renderer of the SVGGeometryElement descendant only
https://bugs.webkit.org/show_bug.cgi?id=190411

Reviewed by Simon Fraser.

Source/WebCore:

Test: svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html

When changing the attributes of the SVGLangSpace, we should invalidate
the renderer of the SVGGeometryElement descendant only. Renderer of other
elements, like SVGStopElement, should not be invalidated because they do
not have geometry and they can be used as resources for drawing another
SVGGeometryElement.

* svg/SVGElement.h:
(WebCore::SVGElement::isSVGGeometryElement const):
* svg/SVGGeometryElement.h:
(isType):
* svg/SVGLangSpace.cpp:
(WebCore::SVGLangSpace::svgAttributeChanged):

LayoutTests:

* svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr-expected.txt: Added.
* svg/dynamic-updates/SVGStopElement-dom-xml-lang-attrr.html: Added.


  Commit: 849be04112e7518fd24210de1c5c1130c3be1656
      https://github.com/WebKit/WebKit/commit/849be04112e7518fd24210de1c5c1130c3be1656
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/transforms/skew-x-135deg-with-gradient-expected.html
    A LayoutTests/fast/transforms/skew-x-135deg-with-gradient.html
    A LayoutTests/fast/transforms/skew-y-135deg-with-gradient-expected.html
    A LayoutTests/fast/transforms/skew-y-135deg-with-gradient.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/CairoUtilities.cpp

  Log Message:
  -----------
  Merged r237119 - [Cairo] Incorrect rendering for 135-deg skews
https://bugs.webkit.org/show_bug.cgi?id=190513

Source/WebCore:

Compensation value to zero the the translation components
of the transformation matrix is incorrect if the matrix
has a shear factor.

Reviewed by Žan Doberšek.

Tests: fast/transforms/skew-x-135deg-with-gradient.html
       fast/transforms/skew-y-135deg-with-gradient.html

* platform/graphics/cairo/CairoUtilities.cpp:
(WebCore::drawPatternToCairoContext):

LayoutTests:

Reviewed by Žan Doberšek.

* fast/transforms/skew-x-135deg-with-gradient-expected.html: Added.
* fast/transforms/skew-x-135deg-with-gradient.html: Added.
* fast/transforms/skew-y-135deg-with-gradient-expected.html: Added.
* fast/transforms/skew-y-135deg-with-gradient.html: Added.


  Commit: 722fe3f4a041da075dc8251468bdf0213e13e6b8
      https://github.com/WebKit/WebKit/commit/722fe3f4a041da075dc8251468bdf0213e13e6b8
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/stress/array-prototype-concat-of-long-spliced-arrays.js
    A JSTests/stress/slice-array-storage-with-holes.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSArray.cpp

  Log Message:
  -----------
  Merged r237129 - JSArray::shiftCountWithArrayStorage is wrong when an array has holes
https://bugs.webkit.org/show_bug.cgi?id=190262
<rdar://problem/44986241>

Reviewed by Mark Lam.

JSTests:

* stress/array-prototype-concat-of-long-spliced-arrays.js:
(test):
* stress/slice-array-storage-with-holes.js: Added.
(main):

Source/JavaScriptCore:

We would take the fast path for shiftCountWithArrayStorage when the array
hasHoles(). However, the code for this was wrong. It'd incorrectly update
ArrayStorage::m_numValuesInVector. Since the hasHoles() for ArrayStorage
path is never taken in JetStream 2, this patch just removes that from
the fast path. Instead, we just fallback to the slow path when hasHoles().
If we find evidence that this matters for real use cases, we can
figure out a way to make the fast path work.

* runtime/JSArray.cpp:
(JSC::JSArray::shiftCountWithArrayStorage):


  Commit: e018b688d6ab5a28e0fed70b6e7cd837866a4061
      https://github.com/WebKit/WebKit/commit/e018b688d6ab5a28e0fed70b6e7cd837866a4061
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitAutomationSession.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitAutomationSessionPrivate.h
    M Source/WebKit/UIProcess/RemoteWebInspectorProxy.cpp

  Log Message:
  -----------
  Merged r237191 - [GLib] Build error with RemoteInspector disabled
https://bugs.webkit.org/show_bug.cgi?id=190623

Reviewed by Michael Catanzaro.

Compilation guards added to ensure the build still works when the
Remote WebInspector has been disabled.

* UIProcess/API/glib/WebKitAutomationSession.cpp:
* UIProcess/API/glib/WebKitAutomationSessionPrivate.h:
* UIProcess/RemoteWebInspectorProxy.cpp:


  Commit: deef3f34777076e6ad3b4fa7613f051d30ac91b5
      https://github.com/WebKit/WebKit/commit/deef3f34777076e6ad3b4fa7613f051d30ac91b5
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp

  Log Message:
  -----------
  Merged r237215 - GetIndexedPropertyStorage can GC.
https://bugs.webkit.org/show_bug.cgi?id=190625
<rdar://problem/45309366>

Reviewed by Saam Barati.

This is because if the ArrayMode type is String, the DFG and FTL will be emitting
a call to operationResolveRope, and operationResolveRope can GC.  This patch
updates doesGC() to reflect this.

* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):


  Commit: 29f03dd953b37bde763e73fb507d855eaf716878
      https://github.com/WebKit/WebKit/commit/29f03dd953b37bde763e73fb507d855eaf716878
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/media/media-source/media-source-sequence-timestamps-expected.txt
    M LayoutTests/media/media-source/media-source-timeoffset-expected.txt
    A LayoutTests/media/media-source/media-source-timestampoffset-rounding-error-expected.txt
    A LayoutTests/media/media-source/media-source-timestampoffset-rounding-error.html
    M LayoutTests/media/media-source/mock-media-source.js
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediasource/SourceBuffer.cpp

  Log Message:
  -----------
  Merged r237274 - [MSE] timestampOffset can introduce floating-point rounding errors to incoming samples
https://bugs.webkit.org/show_bug.cgi?id=190590
<rdar://problem/45275626>

Reviewed by Eric Carlson.

Source/WebCore:

Test: media/media-source/media-source-timestampoffset-rounding-error.html

SourceBuffer.timestampOffset is a double property, which, when added to a MediaTime will
result in a double-backed MediaTime as PTS & DTS. This can introduce rounding errors when
these samples are appended as overlapping existing samples. Rather than converting a MediaTime
to double-backed when adding the timestampOffset, convert the offset to a multiple of the
sample's timeBase.

* Modules/mediasource/SourceBuffer.cpp:
(WebCore::SourceBuffer::setTimestampOffset):
(WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

LayoutTests:

* media/media-source/media-source-sequence-timestamps-expected.txt:
* media/media-source/media-source-timestampoffset-rounding-error-expected.txt: Added.
* media/media-source/media-source-timestampoffset-rounding-error.html: Added.
* media/media-source/mock-media-source.js:
(makeASample):


  Commit: 0ef65f2193505668212c74a8e8d6c30d6ec55ef3
      https://github.com/WebKit/WebKit/commit/0ef65f2193505668212c74a8e8d6c30d6ec55ef3
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/MediaTime.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/MediaTime.cpp

  Log Message:
  -----------
  Merged r237278 - [Media] Use nanoseconds as MaximumTimeScale
https://bugs.webkit.org/show_bug.cgi?id=190631

Source/WTF:

1e9 is a much more useful timescale than the previous one 2^31-1.
Unlike 2^31-1, which is a prime number, nanosecond scale is pretty
common among some formats like WebM and frameworks like GStreamer
where base 10 timescale is common... and it's those big timescales the
ones that are usually scaled up to MaximumTimeScale.

Reviewed by Jer Noble.

* wtf/MediaTime.cpp:

Tools:

Rebased MediaTime tests covering timescales over the maximum.

Reviewed by Jer Noble.

* TestWebKitAPI/Tests/WTF/MediaTime.cpp:
(TestWebKitAPI::TEST):


  Commit: 88fdc00859bff91994f625c7546ec07db0a828d0
      https://github.com/WebKit/WebKit/commit/88fdc00859bff91994f625c7546ec07db0a828d0
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-190515.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractValue.cpp
    M Source/JavaScriptCore/dfg/DFGAbstractValue.h
    M Source/JavaScriptCore/dfg/DFGOSRExit.cpp
    M Source/JavaScriptCore/dfg/DFGRegisteredStructureSet.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

  Log Message:
  -----------
  Merged r237325 - DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
https://bugs.webkit.org/show_bug.cgi?id=190515
<rdar://problem/45222379>

Reviewed by Saam Barati.

JSTests:

* stress/regress-190515.js: Added.

Source/JavaScriptCore:

1. Fixes calls to asArrayModes() to take a structure's IndexingMode instead of
   IndexingType.

2. DFG's compileNewArrayBuffer()'s HaveABadTime case was previously using the
   node's indexingType (instead of indexingMode) to choose the array structure
   to use for creating an array buffer with.  This turns out to not be an issue
   because when the VM is in having a bad time, all the
   arrayStructureForIndexingTypeDuringAllocation structure pointers will point to
   the SlowPutArrayStorage structure anyway.  However, to be strictly correct,
   we'll fix it to use the structure for the node's indexingMode.

* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::set):
(JSC::DFG::AbstractValue::mergeOSREntryValue):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::validate const):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::executeOSRExit):
* dfg/DFGRegisteredStructureSet.cpp:
(JSC::DFG::RegisteredStructureSet::arrayModesFromStructures const):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileNewArrayBuffer):


  Commit: f80aa0a760127792868c44470cd693f4038c8d2c
      https://github.com/WebKit/WebKit/commit/f80aa0a760127792868c44470cd693f4038c8d2c
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/misc/resource-timing-navigation-in-restored-iframe-expected.txt
    A LayoutTests/http/tests/misc/resource-timing-navigation-in-restored-iframe.html
    A LayoutTests/http/tests/misc/resources/alert-then-back.html
    A LayoutTests/http/tests/misc/resources/navigate-on-message.html
    A LayoutTests/http/tests/misc/resources/post-message-to-parent.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/loader/FrameLoader.h
    M Source/WebCore/loader/ResourceTimingInformation.cpp

  Log Message:
  -----------
  Merged r237395 - Only report resource timing to parent frame for the first iframe load
https://bugs.webkit.org/show_bug.cgi?id=190498
<rdar://problem/44347398>

Reviewed by Youenn Fablet.

Source/WebCore:

Only the first iframe navigation or the first iframe navigation after about:blank should be reported.
https://www.w3.org/TR/resource-timing-2/#resources-included-in-the-performanceresourcetiming-interface

Test: http/tests/misc/resource-timing-navigation-in-restored-iframe.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadWithDocumentLoader):
* loader/FrameLoader.h:
(WebCore::FrameLoader::shouldReportResourceTimingToParentFrame):
(WebCore::FrameLoader::setShouldReportResourceTimingToParentFrame): Deleted.
* loader/ResourceTimingInformation.cpp:
(WebCore::ResourceTimingInformation::addResourceTiming):

LayoutTests:

The layout test is from Chromium change:
https://chromium-review.googlesource.com/c/chromium/src/+/1186215.

* http/tests/misc/resource-timing-navigation-in-restored-iframe-expected.txt: Added.
* http/tests/misc/resource-timing-navigation-in-restored-iframe.html: Added.
* http/tests/misc/resources/alert-then-back.html: Added.
* http/tests/misc/resources/navigate-on-message.html: Added.
* http/tests/misc/resources/post-message-to-parent.html: Added.


  Commit: e8f000f3f2b2f135368b58ea375c882f45c11375
      https://github.com/WebKit/WebKit/commit/e8f000f3f2b2f135368b58ea375c882f45c11375
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp
    M Source/WebKit/Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.h
    M Source/WebKit/WebProcess/WebPage/AcceleratedSurface.cpp
    M Source/WebKit/WebProcess/WebPage/AcceleratedSurface.h
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.h
    M Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceWayland.cpp
    M Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceWayland.h
    M Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceX11.cpp
    M Source/WebKit/WebProcess/WebPage/gtk/AcceleratedSurfaceX11.h
    M Source/WebKit/WebProcess/WebPage/wpe/AcceleratedSurfaceWPE.cpp
    M Source/WebKit/WebProcess/WebPage/wpe/AcceleratedSurfaceWPE.h

  Log Message:
  -----------
  Merged r237410 - [GTK][AC] Resizing the window doesn't always update the visible rect
https://bugs.webkit.org/show_bug.cgi?id=189743

Reviewed by Michael Catanzaro.

Disassociate resizing that can be done on an AcceleratedSurface object
between "host resizes" and "client resizes".

The former is done from ThreadedCoordinatedLayerTreeHost directly, and
is currently used only for GTK on X11, where a new pixmap object is
created on each resize, which affects the context ID that is based on
that pixmap object's address.

The latter is done from the composition thread. It's used for GTK on
Wayland and WPE. In both cases, the underlying window object does not
change on each resize, but it's necessary to perform the actual resize
on the composition thread.

So far it hasn't been performed there, which ended up pushing sizes of
the WebKit view and the underlying window object out of sync during
resizing, leaving parts of window unrendered.

* Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.cpp:
(WebKit::ThreadedCompositor::renderLayerTree):
* Shared/CoordinatedGraphics/threadedcompositor/ThreadedCompositor.h:
* WebProcess/WebPage/AcceleratedSurface.cpp:
(WebKit::AcceleratedSurface::hostResize):
(WebKit::AcceleratedSurface::resize): Deleted.
* WebProcess/WebPage/AcceleratedSurface.h:
(WebKit::AcceleratedSurface::clientResize):
* WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.cpp:
(WebKit::ThreadedCoordinatedLayerTreeHost::deviceOrPageScaleFactorChanged):
(WebKit::ThreadedCoordinatedLayerTreeHost::sizeDidChange):
* WebProcess/WebPage/CoordinatedGraphics/ThreadedCoordinatedLayerTreeHost.h:
* WebProcess/WebPage/gtk/AcceleratedSurfaceWayland.cpp:
(WebKit::AcceleratedSurfaceWayland::clientResize):
(WebKit::AcceleratedSurfaceWayland::resize): Deleted.
* WebProcess/WebPage/gtk/AcceleratedSurfaceWayland.h:
* WebProcess/WebPage/gtk/AcceleratedSurfaceX11.cpp:
(WebKit::AcceleratedSurfaceX11::hostResize):
(WebKit::AcceleratedSurfaceX11::resize): Deleted.
* WebProcess/WebPage/gtk/AcceleratedSurfaceX11.h:
* WebProcess/WebPage/wpe/AcceleratedSurfaceWPE.cpp:
(WebKit::AcceleratedSurfaceWPE::clientResize):
(WebKit::AcceleratedSurfaceWPE::resize): Deleted.
* WebProcess/WebPage/wpe/AcceleratedSurfaceWPE.h:


  Commit: 4e04db92f36256e05bc7f9035cb8d43ea2da7293
      https://github.com/WebKit/WebKit/commit/4e04db92f36256e05bc7f9035cb8d43ea2da7293
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/media/media-source/media-source-timestampoffset-then-zero-expected.txt
    A LayoutTests/media/media-source/media-source-timestampoffset-then-zero.html
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/MediaTime.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/MediaTime.cpp

  Log Message:
  -----------
  Merged r237450 - [MSE][WTF][Media] Invalid MediaTime should be falsy
https://bugs.webkit.org/show_bug.cgi?id=190893

Reviewed by Jer Noble.

Source/WTF:

This patch modifies the definition of MediaTime so that invalid times
are evaluated to false in the context of a boolean expression.

* wtf/MediaTime.cpp:
(WTF::MediaTime::operator! const):
(WTF::MediaTime::operator bool const):

Tools:

This patch adds additional API tests for the conversions from
MediaTime to boolean.

* TestWebKitAPI/Tests/WTF/MediaTime.cpp:
(TestWebKitAPI::TEST):

LayoutTests:

A test is added that replicates a bug fixed by this patch.

* media/media-source/media-source-timestampoffset-then-zero-expected.txt: Added.
* media/media-source/media-source-timestampoffset-then-zero.html: Added.


  Commit: aef0143da56f23e9fa7c54cf53c02e9b85052dc1
      https://github.com/WebKit/WebKit/commit/aef0143da56f23e9fa7c54cf53c02e9b85052dc1
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189028.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObject.h
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/JSObjectInlines.h
    M Source/JavaScriptCore/runtime/Structure.h
    M Source/JavaScriptCore/runtime/StructureInlines.h
    M Source/JavaScriptCore/tools/JSDollarVM.cpp

  Log Message:
  -----------
  Merged r237469 - Fix missing edge cases with JSGlobalObjects having a bad time.
https://bugs.webkit.org/show_bug.cgi?id=189028
<rdar://problem/45204939>

Reviewed by Saam Barati.

JSTests:

* stress/regress-189028.js: Added.

Source/JavaScriptCore:

Consider the following scenario:

    let object O1 (of global G1) have an indexing type that is not SlowPut.
    let global G2 have a bad time.
    let object O2 (of global G2) be set as the prototype of O1.
    let object O3 (of global G2) have indexed accessors.

In the existing code, if we set O3 as O2's prototype, we'll have a bug where
O1 will not be made aware that that there are indexed accessors in its prototype
chain.

In this patch, we solve this issue by introducing a new invariant:

    A prototype chain is considered to possibly have indexed accessors if any
    object in the chain belongs to a global object that is having a bad time.

We apply this invariant as follows:

1. Enhance JSGlobalObject::haveABadTime() to also check if other global objects are
   affected by it having a bad time.  If so, it also ensures that those affected
   global objects have a bad time.

   The original code for JSGlobalObject::haveABadTime() uses a ObjectsWithBrokenIndexingFinder
   to find all objects affected by the global object having a bad time.  We enhance
   ObjectsWithBrokenIndexingFinder to also check for the possibility that any global
   objects may be affected by other global objects having a bad time i.e.

        let g1 = global1
        let g2 = global2
        let o1 = an object in g1
        let o2 = an object in g2

        let g1 have a bad time
        g2 is affected if
            o1 is in the prototype chain of o2,
            and o2 may be a prototype.

   If the ObjectsWithBrokenIndexingFinder does find the possibility of other global
   objects being affected, it will abort its heap scan and let haveABadTime() take
   a slow path to do a more complete multi global object scan.

   The slow path works as follows:

   1. Iterate the heap and record the graph of all global object dependencies.

      For each global object, record the list of other global objects that are
      affected by it.

   2. Compute a list of global objects that need to have a bad time using the
      current global object dependency graph.

   3. For each global object in the list of affected global objects, fire their
      HaveABadTime watchpoint and convert all their array structures to the
      SlowPut alternatives.

   4. Re-run ObjectsWithBrokenIndexingFinder to find all objects that are affected
      by any of the globals in the list from (2).

2. Enhance Structure::mayInterceptIndexedAccesses() to also return true if the
   structure's global object is having a bad time.

Note: there are 3 scenarios that we need to consider:

    let g1 = global1
    let g2 = global2
    let o1 = an object in g1
    let o2 = an object in g2

    Scenario 1: o2 is a prototype, and
                g1 has a bad time after o1 is inserted into the o2's prototype chain.

    Scenario 2: o2 is a prototype, and
                o1 is inserted into the o2's prototype chain after g1 has a bad time.

    Scenario 3: o2 is NOT a prototype, and
                o1 is inserted into the o2's prototype chain after g1 has a bad time.

    For scenario 1, when g1 has a bad time, we need to also make sure g2 has
    a bad time.  This is handled by enhancement 1 above.

    For scenario 2, when o1 is inserted into o2's prototype chain, we need to check
    if o1's global object has a bad time.  If so, then we need to make sure o2's
    global also has a bad time (because o2 is a prototype) and convert o2's
    storage type to SlowPut.  This is handled by enhancement 2 above in conjunction
    with JSObject::setPrototypeDirect().

    For scenario 3, when o1 is inserted into o2's prototype chain, we need to check
    if o1's global object has a bad time.  If so, then we only need to convert o2's
    storage type to SlowPut (because o2 is NOT a prototype).  This is handled by
    enhancement 2 above.

3. Also add $vm.isHavingABadTime(), $vm.createGlobalObject() to enable us to
   write some tests for this issue.

* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::fireWatchpointAndMakeAllArrayStructuresSlowPut):
(JSC::JSGlobalObject::haveABadTime):
* runtime/JSGlobalObject.h:
* runtime/JSObject.h:
(JSC::JSObject::mayInterceptIndexedAccesses): Deleted.
* runtime/JSObjectInlines.h:
(JSC::JSObject::mayInterceptIndexedAccesses):
* runtime/Structure.h:
* runtime/StructureInlines.h:
(JSC::Structure::mayInterceptIndexedAccesses const):
* tools/JSDollarVM.cpp:
(JSC::functionHaveABadTime):
(JSC::functionIsHavingABadTime):
(JSC::functionCreateGlobalObject):
(JSC::JSDollarVM::finishCreation):


  Commit: 0fc29d871bb489f744dc0e2a89c75bf2516ffcd4
      https://github.com/WebKit/WebKit/commit/0fc29d871bb489f744dc0e2a89c75bf2516ffcd4
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Cocoa/WebPageProxyCocoa.mm
    M Source/WebKit/UIProcess/PageClient.h
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/UIProcess/gstreamer/WebPageProxyGStreamer.cpp
    M Source/WebKit/UIProcess/gtk/WebPageProxyGtk.cpp
    M Source/WebKit/UIProcess/ios/WebPageProxyIOS.mm
    M Source/WebKit/UIProcess/mac/WebPageProxyMac.mm
    M Source/WebKit/UIProcess/win/WebPageProxyWin.cpp
    M Source/WebKit/UIProcess/wpe/WebPageProxyWPE.cpp

  Log Message:
  -----------
  Merged r235903 - WebPageProxy should hold a WeakPtr to its PageClient
https://bugs.webkit.org/show_bug.cgi?id=188872

Reviewed by Ryosuke Niwa.

This ensures the PageClient reference is always valid when used.

* UIProcess/Cocoa/WebPageProxyCocoa.mm:
(WebKit::WebPageProxy::startDrag):
(WebKit::WebPageProxy::setDragCaretRect):
* UIProcess/PageClient.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::PageClientProtector::PageClientProtector):
(WebKit::PageClientProtector::~PageClientProtector):
(WebKit::WebPageProxy::WebPageProxy):
(WebKit::m_resetRecentCrashCountTimer):
(WebKit::WebPageProxy::pageClient const):
(WebKit::WebPageProxy::reattachToWebProcess):
(WebKit::WebPageProxy::initializeWebPage):
(WebKit::WebPageProxy::close):
(WebKit::WebPageProxy::didChangeBackForwardList):
(WebKit::WebPageProxy::willGoToBackForwardListItem):
(WebKit::WebPageProxy::shouldKeepCurrentBackForwardListItemInList):
(WebKit::WebPageProxy::setViewNeedsDisplay):
(WebKit::WebPageProxy::requestScroll):
(WebKit::WebPageProxy::viewScrollPosition const):
(WebKit::WebPageProxy::updateActivityState):
(WebKit::WebPageProxy::activityStateDidChange):
(WebKit::WebPageProxy::viewDidEnterWindow):
(WebKit::WebPageProxy::dispatchActivityStateChange):
(WebKit::WebPageProxy::layerHostingModeDidChange):
(WebKit::WebPageProxy::viewSize const):
(WebKit::WebPageProxy::startDrag):
(WebKit::WebPageProxy::didPerformDragOperation):
(WebKit::WebPageProxy::processNextQueuedMouseEvent):
(WebKit::WebPageProxy::findPlugin):
(WebKit::WebPageProxy::handleTouchEventSynchronously):
(WebKit::WebPageProxy::handleTouchEvent):
(WebKit::WebPageProxy::preferencesDidChange):
(WebKit::WebPageProxy::didCreateMainFrame):
(WebKit::WebPageProxy::didCreateSubframe):
(WebKit::WebPageProxy::didStartProgress):
(WebKit::WebPageProxy::didChangeProgress):
(WebKit::WebPageProxy::didFinishProgress):
(WebKit::WebPageProxy::didDestroyNavigation):
(WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
(WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
(WebKit::WebPageProxy::willPerformClientRedirectForFrame):
(WebKit::WebPageProxy::didCancelClientRedirectForFrame):
(WebKit::WebPageProxy::didChangeProvisionalURLForFrame):
(WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::didFinishDocumentLoadForFrame):
(WebKit::WebPageProxy::didFinishLoadForFrame):
(WebKit::WebPageProxy::didFailLoadForFrame):
(WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
(WebKit::WebPageProxy::didReceiveTitleForFrame):
(WebKit::WebPageProxy::didFirstVisuallyNonEmptyLayoutForFrame):
(WebKit::WebPageProxy::didReachLayoutMilestone):
(WebKit::WebPageProxy::didDisplayInsecureContentForFrame):
(WebKit::WebPageProxy::didRunInsecureContentForFrame):
(WebKit::WebPageProxy::frameDidBecomeFrameSet):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::decidePolicyForNewWindowAction):
(WebKit::WebPageProxy::decidePolicyForResponse):
(WebKit::WebPageProxy::unableToImplementPolicy):
(WebKit::WebPageProxy::didNavigateWithNavigationData):
(WebKit::WebPageProxy::didPerformClientRedirect):
(WebKit::WebPageProxy::didPerformServerRedirect):
(WebKit::WebPageProxy::didUpdateHistoryTitle):
(WebKit::WebPageProxy::closePage):
(WebKit::WebPageProxy::setWindowFrame):
(WebKit::WebPageProxy::getWindowFrame):
(WebKit::WebPageProxy::getWindowFrameWithCallback):
(WebKit::WebPageProxy::screenToRootView):
(WebKit::WebPageProxy::rootViewToScreen):
(WebKit::WebPageProxy::syncRootViewToScreen):
(WebKit::WebPageProxy::accessibilityScreenToRootView):
(WebKit::WebPageProxy::rootViewToAccessibilityScreen):
(WebKit::WebPageProxy::didChangeViewportProperties):
(WebKit::WebPageProxy::runOpenPanel):
(WebKit::WebPageProxy::showShareSheet):
(WebKit::WebPageProxy::handleDownloadRequest):
(WebKit::WebPageProxy::didChangeContentSize):
(WebKit::WebPageProxy::showColorPicker):
(WebKit::WebPageProxy::showDataListSuggestions):
(WebKit::WebPageProxy::compositionWasCanceled):
(WebKit::WebPageProxy::registerInsertionUndoGrouping):
(WebKit::WebPageProxy::canUndoRedo):
(WebKit::WebPageProxy::executeUndoRedo):
(WebKit::WebPageProxy::clearAllEditCommands):
(WebKit::WebPageProxy::setTextIndicator):
(WebKit::WebPageProxy::clearTextIndicator):
(WebKit::WebPageProxy::setTextIndicatorAnimationProgress):
(WebKit::WebPageProxy::showPopupMenu):
(WebKit::WebPageProxy::showContextMenu):
(WebKit::WebPageProxy::registerEditCommand):
(WebKit::WebPageProxy::canUndo):
(WebKit::WebPageProxy::canRedo):
(WebKit::WebPageProxy::setToolTip):
(WebKit::WebPageProxy::setCursor):
(WebKit::WebPageProxy::setCursorHiddenUntilMouseMoves):
(WebKit::WebPageProxy::didReceiveEvent):
(WebKit::WebPageProxy::resetState):
(WebKit::WebPageProxy::resetStateAfterProcessExited):
(WebKit::WebPageProxy::creationParameters):
(WebKit::WebPageProxy::enterAcceleratedCompositingMode):
(WebKit::WebPageProxy::exitAcceleratedCompositingMode):
(WebKit::WebPageProxy::updateAcceleratedCompositingMode):
(WebKit::WebPageProxy::requestGeolocationPermissionForFrame):
(WebKit::WebPageProxy::recommendedScrollbarStyleDidChange):
(WebKit::WebPageProxy::didChangeScrollOffsetPinningForMainFrame):
(WebKit::WebPageProxy::didFinishLoadingDataForCustomContentProvider):
(WebKit::WebPageProxy::updateBackingStoreDiscardableState):
(WebKit::WebPageProxy::showCorrectionPanel):
(WebKit::WebPageProxy::dismissCorrectionPanel):
(WebKit::WebPageProxy::dismissCorrectionPanelSoon):
(WebKit::WebPageProxy::recordAutocorrectionResponse):
(WebKit::WebPageProxy::useDarkAppearance const):
(WebKit::WebPageProxy::showDictationAlternativeUI):
(WebKit::WebPageProxy::removeDictationAlternatives):
(WebKit::WebPageProxy::dictationAlternatives):
(WebKit::WebPageProxy::setEditableElementIsFocused):
(WebKit::WebPageProxy::takeViewSnapshot):
(WebKit::WebPageProxy::wrapCryptoKey):
(WebKit::WebPageProxy::unwrapCryptoKey):
(WebKit::WebPageProxy::signedPublicKeyAndChallengeString):
(WebKit::WebPageProxy::navigationGestureDidBegin):
(WebKit::WebPageProxy::navigationGestureWillEnd):
(WebKit::WebPageProxy::navigationGestureDidEnd):
(WebKit::WebPageProxy::willRecordNavigationSnapshot):
(WebKit::WebPageProxy::navigationGestureSnapshotWasRemoved):
(WebKit::WebPageProxy::isPlayingMediaDidChange):
(WebKit::WebPageProxy::videoControlsManagerDidChange):
(WebKit::WebPageProxy::handleControlledElementIDResponse const):
(WebKit::WebPageProxy::didPerformImmediateActionHitTest):
(WebKit::WebPageProxy::immediateActionAnimationControllerForHitTestResult):
(WebKit::WebPageProxy::didHandleAcceptedCandidate):
(WebKit::WebPageProxy::addPlaybackTargetPickerClient):
(WebKit::WebPageProxy::removePlaybackTargetPickerClient):
(WebKit::WebPageProxy::showPlaybackTargetPicker):
(WebKit::WebPageProxy::playbackTargetPickerClientStateDidChange):
(WebKit::WebPageProxy::setMockMediaPlaybackTargetPickerEnabled):
(WebKit::WebPageProxy::setMockMediaPlaybackTargetPickerState):
(WebKit::WebPageProxy::didChangeBackgroundColor):
(WebKit::WebPageProxy::didRestoreScrollPosition):
(WebKit::WebPageProxy::userInterfaceLayoutDirection):
(WebKit::WebPageProxy::didInsertAttachment):
(WebKit::WebPageProxy::didRemoveAttachment):
* UIProcess/WebPageProxy.h:
* UIProcess/gstreamer/WebPageProxyGStreamer.cpp:
(WebKit::WebPageProxy::requestInstallMissingMediaPlugins):
* UIProcess/gtk/WebPageProxyGtk.cpp:
(WebKit::WebPageProxy::viewWidget):
(WebKit::WebPageProxy::editorStateChanged):
* UIProcess/ios/WebPageProxyIOS.mm:
(WebKit::WebPageProxy::computeCustomFixedPositionRect const):
(WebKit::WebPageProxy::overflowScrollViewWillStartPanGesture):
(WebKit::WebPageProxy::overflowScrollViewDidScroll):
(WebKit::WebPageProxy::overflowScrollWillStartScroll):
(WebKit::WebPageProxy::overflowScrollDidEndScroll):
(WebKit::WebPageProxy::didCommitLayerTree):
(WebKit::WebPageProxy::layerTreeCommitComplete):
(WebKit::WebPageProxy::didReceivePositionInformation):
(WebKit::WebPageProxy::saveImageToLibrary):
(WebKit::WebPageProxy::interpretKeyEvent):
(WebKit::WebPageProxy::registerWebProcessAccessibilityToken):
(WebKit::WebPageProxy::couldNotRestorePageState):
(WebKit::WebPageProxy::restorePageState):
(WebKit::WebPageProxy::restorePageCenterAndScale):
(WebKit::WebPageProxy::didGetTapHighlightGeometries):
(WebKit::WebPageProxy::startAssistingNode):
(WebKit::WebPageProxy::stopAssistingNode):
(WebKit::WebPageProxy::showInspectorHighlight):
(WebKit::WebPageProxy::hideInspectorHighlight):
(WebKit::WebPageProxy::showInspectorIndication):
(WebKit::WebPageProxy::hideInspectorIndication):
(WebKit::WebPageProxy::enableInspectorNodeSearch):
(WebKit::WebPageProxy::disableInspectorNodeSearch):
(WebKit::WebPageProxy::setAcceleratedCompositingRootLayer):
(WebKit::WebPageProxy::showPlaybackTargetPicker):
(WebKit::WebPageProxy::commitPotentialTapFailed):
(WebKit::WebPageProxy::didNotHandleTapAsClick):
(WebKit::WebPageProxy::didCompleteSyntheticClick):
(WebKit::WebPageProxy::disableDoubleTapGesturesDuringTapIfNecessary):
(WebKit::WebPageProxy::editorStateChanged):
(WebKit::WebPageProxy::showValidationMessage):
(WebKit::WebPageProxy::didHandleStartDataInteractionRequest):
(WebKit::WebPageProxy::didHandleAdditionalDragItemsRequest):
(WebKit::WebPageProxy::didConcludeEditDataInteraction):
(WebKit::WebPageProxy::didRequestPasswordForQuickLookDocumentInMainFrame):
* UIProcess/mac/WebPageProxyMac.mm:
(WebKit::WebPageProxy::windowAndViewFramesChanged):
(WebKit::WebPageProxy::insertDictatedTextAsync):
(WebKit::WebPageProxy::setPromisedDataForImage):
(WebKit::WebPageProxy::didPerformDictionaryLookup):
(WebKit::WebPageProxy::registerWebProcessAccessibilityToken):
(WebKit::WebPageProxy::makeFirstResponder):
(WebKit::WebPageProxy::assistiveTechnologyMakeFirstResponder):
(WebKit::WebPageProxy::colorSpace):
(WebKit::WebPageProxy::pluginFocusOrWindowFocusChanged):
(WebKit::WebPageProxy::setPluginComplexTextInputState):
(WebKit::WebPageProxy::executeSavedCommandBySelector):
(WebKit::WebPageProxy::intrinsicContentSizeDidChange):
(WebKit::WebPageProxy::setAcceleratedCompositingRootLayer):
(WebKit::WebPageProxy::acceleratedCompositingRootLayer const):
(WebKit::WebPageProxy::showPDFContextMenu):
(WebKit::WebPageProxy::showTelephoneNumberMenu):
(WebKit::WebPageProxy::boundsOfLayerInLayerBackedWindowCoordinates const):
(WebKit::WebPageProxy::editorStateChanged):
(WebKit::WebPageProxy::startWindowDrag):
(WebKit::WebPageProxy::platformWindow):
(WebKit::WebPageProxy::rootViewToWindow):
(WebKit::WebPageProxy::showValidationMessage):
(WebKit::WebPageProxy::inspectorAttachmentView):
(WebKit::WebPageProxy::remoteObjectRegistry):
* UIProcess/win/WebPageProxyWin.cpp:
(WebKit::WebPageProxy::viewWidget):
* UIProcess/wpe/WebPageProxyWPE.cpp:
(WebKit::WebPageProxy::viewBackend):


  Commit: 695ad787d5ec8844ddad17a2f584dce11eca0888
      https://github.com/WebKit/WebKit/commit/695ad787d5ec8844ddad17a2f584dce11eca0888
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/PageClient.h

  Log Message:
  -----------
  Merged r235907 - Unreviewed, fix build after r235903
https://bugs.webkit.org/show_bug.cgi?id=188872

This broke all ports except GTK. Need to add a missing header.

* UIProcess/PageClient.h:


  Commit: 76a25629b4971366d3d16b450bee740bd5e85b30
      https://github.com/WebKit/WebKit/commit/76a25629b4971366d3d16b450bee740bd5e85b30
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-28 (Sun, 28 Oct 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merged r235908 - Unreviewed, attempt to fix Apple builds after r235903
https://bugs.webkit.org/show_bug.cgi?id=188872

If it really needs to be inlined, it will need to move to the header....

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::pageClient const):


  Commit: 02694b82cc76863f522626f18d8154d5a895f4a0
      https://github.com/WebKit/WebKit/commit/02694b82cc76863f522626f18d8154d5a895f4a0
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-10-29 (Mon, 29 Oct 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.22.3 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.22.3.


  Commit: b3688020586ebe77d06f891205647c319dca2a19
      https://github.com/WebKit/WebKit/commit/b3688020586ebe77d06f891205647c319dca2a19
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-11-01 (Thu, 01 Nov 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediasource/VideoPlaybackQuality.cpp
    M Source/WebCore/Modules/mediasource/VideoPlaybackQuality.h
    M Source/WebCore/Modules/mediasource/VideoPlaybackQuality.idl
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/rendering/RenderThemeGtk.cpp
    M Tools/ChangeLog
    M Tools/MiniBrowser/gtk/main.c

  Log Message:
  -----------
  Merged r237677 - Fix build with VIDEO and WEB_AUDIO disabled
https://bugs.webkit.org/show_bug.cgi?id=191147

Reviewed by Philippe Normand.

Source/WebCore:

Supported or not, there were a few build fixes needed
to be able to build WebKit with media disabled. Mostly
low-hanging fruits.

* Modules/mediasource/VideoPlaybackQuality.cpp:
* Modules/mediasource/VideoPlaybackQuality.h:
* Modules/mediasource/VideoPlaybackQuality.idl:
* dom/Document.cpp:
(WebCore::Document::dispatchFullScreenChangeOrErrorEvent):
* inspector/agents/InspectorDOMAgent.cpp:
(WebCore::InspectorDOMAgent::InspectorDOMAgent):
(WebCore::InspectorDOMAgent::didCreateFrontendAndBackend):
* inspector/agents/InspectorDOMAgent.h:
* rendering/RenderThemeGtk.cpp:

Tools:

* MiniBrowser/gtk/main.c:
(main): Condition GST includes and calls


  Commit: 2b27b2753fb4b560df9aa82d9d1e4afebba1a810
      https://github.com/WebKit/WebKit/commit/2b27b2753fb4b560df9aa82d9d1e4afebba1a810
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-11-01 (Thu, 01 Nov 2018)

  Changed paths:
    M Tools/ChangeLog
    M Tools/MiniBrowser/wpe/main.cpp

  Log Message:
  -----------
  Merged r237680 - Fix build with VIDEO and WEB_AUDIO disabled
https://bugs.webkit.org/show_bug.cgi?id=191147
<rdar://problem/45726710>

Unreviewed build fix.

This adds the missing compilation guards in the WPE MiniBrowser.

* MiniBrowser/wpe/main.cpp:
(main): Condition GST includes and calls.


  Commit: 9fa08136c5c472b91e7b728ae7b7773e5dc9e574
      https://github.com/WebKit/WebKit/commit/9fa08136c5c472b91e7b728ae7b7773e5dc9e574
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-11-04 (Sun, 04 Nov 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

  Log Message:
  -----------
  [GTK] Cannot make debug builds of JSC using release 2.22.3
https://bugs.webkit.org/show_bug.cgi?id=191233

Unreviewed build fix.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitGetByVal):
Use context.asStructureForInContext() instead of explicit cast and
remove the unneeded assertion, which is already done in the helper
function.


  Commit: f2a40b870928d39413e60ed9eb8d26849359c8bf
      https://github.com/WebKit/WebKit/commit/f2a40b870928d39413e60ed9eb8d26849359c8bf
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-11-05 (Mon, 05 Nov 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/GStreamerDefinitions.cmake

  Log Message:
  -----------
  [WPE][GTK] Expose ENABLE_MEDIA_SOURCE as public option
https://bugs.webkit.org/show_bug.cgi?id=191223

Reviewed by Xabier Rodriguez-Calvar.

This option should be public because it needs to be disabled to build with GStreamer older
than 1.14.4.

* Source/cmake/GStreamerDefinitions.cmake:


  Commit: 5fc86de67534257d2f4405ad33a7f66a3aa2de48
      https://github.com/WebKit/WebKit/commit/5fc86de67534257d2f4405ad33a7f66a3aa2de48
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-11-06 (Tue, 06 Nov 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for 2.22.1 release.

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.22.1.


  Commit: 18685a4fd1a6dbdbd011b5c396436c02fde49b3b
      https://github.com/WebKit/WebKit/commit/18685a4fd1a6dbdbd011b5c396436c02fde49b3b
  Author: Eric Carlson <eric.carlson at apple.com>
  Date:   2018-11-16 (Fri, 16 Nov 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/mediastream/media-stream-track-interrupted-expected.txt
    A LayoutTests/fast/mediastream/media-stream-track-interrupted.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.h
    M Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.cpp
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/Internals.idl

  Log Message:
  -----------
  Merge r237837 - [MediaStream] An audio track should be muted when capture is interrupted by the OS.
Source/WebCore:

https://bugs.webkit.org/show_bug.cgi?id= 191283
 <rdar://problem/45773103>

Patch by Eric Carlson <eric.carlson at apple.com> on 2018-11-05
Reviewed by Jon Lee.

Test: fast/mediastream/media-stream-track-interrupted.html

* platform/mediastream/RealtimeMediaSource.cpp:
(WebCore::RealtimeMediaSource::setInterruptedForTesting):
* platform/mediastream/RealtimeMediaSource.h:
* platform/mediastream/mac/CoreAudioCaptureSource.cpp:
(WebCore::CoreAudioCaptureSource::beginInterruption):
(WebCore::CoreAudioCaptureSource::endInterruption):
* testing/Internals.cpp:
(WebCore::Internals::setMediaStreamSourceInterrupted):
* testing/Internals.h:
* testing/Internals.idl:

LayoutTests:

https://bugs.webkit.org/show_bug.cgi?id=191283
 <rdar://problem/45773103>

Patch by Eric Carlson <eric.carlson at apple.com> on 2018-11-05
Reviewed by Jon Lee.

* fast/mediastream/media-stream-track-interrupted-expected.txt: Added.
* fast/mediastream/media-stream-track-interrupted.html: Added.


  Commit: bf1fca3a20a07f47fc40470dd3b96d8e31bdc473
      https://github.com/WebKit/WebKit/commit/bf1fca3a20a07f47fc40470dd3b96d8e31bdc473
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2018-11-16 (Fri, 16 Nov 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/inline/marker-list-item-move-should-not-crash-expected.txt
    A LayoutTests/fast/inline/marker-list-item-move-should-not-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilder.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderBlock.h
    M Source/WebCore/rendering/updating/RenderTreeBuilderList.cpp

  Log Message:
  -----------
  Merge r238119 - Do not collapse the soon-to-be-parent anon block when we shuffle around the marker item renderer.
https://bugs.webkit.org/show_bug.cgi?id=191554
<rdar://problem/45825265>

Reviewed by Antti Koivisto.

Source/WebCore:

While moving the marker item renderer to its correct subtree, we accidentally remove the soon-to-be parent anonymous block.
Moving a renderer is a 2 step process:
1. Detach the renderer from its current parent
2. Attach it to its new parent.
During step #1, we check if there is a chance to collapse anonymous blocks. In this case the soon-to-be-parent is a sibling anonymous block which, after detaching the marker sibling
is not needed anymore (except we use it as the new parent).

Test: fast/inline/marker-list-item-move-should-not-crash.html

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::detach):
* rendering/updating/RenderTreeBuilder.h:
* rendering/updating/RenderTreeBuilderBlock.cpp:
(WebCore::RenderTreeBuilder::Block::detach):
* rendering/updating/RenderTreeBuilderBlock.h:
* rendering/updating/RenderTreeBuilderList.cpp:
(WebCore::RenderTreeBuilder::List::updateItemMarker):

LayoutTests:

* fast/inline/marker-list-item-move-should-not-crash-expected.txt: Added.
* fast/inline/marker-list-item-move-should-not-crash.html: Added.


  Commit: a8c60eeb8d63f622a8893cd49a0e40c31327ac96
      https://github.com/WebKit/WebKit/commit/a8c60eeb8d63f622a8893cd49a0e40c31327ac96
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-11-16 (Fri, 16 Nov 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/font-face-set-remove-safely-expected.txt
    A LayoutTests/fast/text/font-face-set-remove-safely.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSFontFaceSet.cpp

  Log Message:
  -----------
  Merge r238222 - Remove fonts from CSSFontFaceSet safely
https://bugs.webkit.org/show_bug.cgi?id=191676

Reviewed by Zalan Bujtas.

Source/WebCore:

Test: fast/text/font-face-set-remove-safely.html

* css/CSSFontFaceSet.cpp:
(WebCore::CSSFontFaceSet::remove):

LayoutTests:

* fast/text/font-face-set-remove-safely-expected.txt: Added.
* fast/text/font-face-set-remove-safely.html: Added.


  Commit: 3ce4ab89338c505f12b481649ee50b55a6d1827a
      https://github.com/WebKit/WebKit/commit/3ce4ab89338c505f12b481649ee50b55a6d1827a
  Author: Jer Noble <jer.noble at apple.com>
  Date:   2018-11-16 (Fri, 16 Nov 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/webaudio/AudioBufferSourceNode.cpp
    M Source/WebCore/Modules/webaudio/AudioScheduledSourceNode.cpp
    M Source/WebCore/Modules/webaudio/OscillatorNode.cpp

  Log Message:
  -----------
  Merge r238291 - An early return from updateSchedulingInfo can leave some variables uninitialized.
https://bugs.webkit.org/show_bug.cgi?id=191755
<rdar://problem/39910089>

Reviewed by Brent Fulgham.

* Modules/webaudio/AudioBufferSourceNode.cpp:
(WebCore::AudioBufferSourceNode::process):
* Modules/webaudio/AudioScheduledSourceNode.cpp:
(WebCore::AudioScheduledSourceNode::updateSchedulingInfo):
* Modules/webaudio/OscillatorNode.cpp:
(WebCore::OscillatorNode::process):


  Commit: 3f255b72a1ee2c94204ef429af85a7689bfae0d7
      https://github.com/WebKit/WebKit/commit/3f255b72a1ee2c94204ef429af85a7689bfae0d7
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2018-11-16 (Fri, 16 Nov 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/jit/JITOperations.h

  Log Message:
  -----------
  Merge r235198 - Eliminate dead code operationThrowDivideError() and operationThrowOutOfBoundsAccessError()
https://bugs.webkit.org/show_bug.cgi?id=188859

Rubber-stamped by Saam Barati.

Deleted these two functions.

* jit/JITOperations.cpp:
* jit/JITOperations.h:


  Commit: cd6b344738cdeabc3b578622546e8be0d7c17271
      https://github.com/WebKit/WebKit/commit/cd6b344738cdeabc3b578622546e8be0d7c17271
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-11-16 (Fri, 16 Nov 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-188577.js
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/misc/large-js-program-expected.txt
    M Source/JavaScriptCore/CMakeLists.txt
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/JavaScriptCore/Sources.txt
    M Source/JavaScriptCore/debugger/Debugger.cpp
    M Source/JavaScriptCore/interpreter/CallFrame.cpp
    M Source/JavaScriptCore/interpreter/CallFrame.h
    A Source/JavaScriptCore/interpreter/CallFrameInlines.h
    A Source/JavaScriptCore/interpreter/EntryFrame.h
    M Source/JavaScriptCore/interpreter/FrameTracers.h
    M Source/JavaScriptCore/interpreter/Interpreter.cpp
    M Source/JavaScriptCore/interpreter/Interpreter.h
    M Source/JavaScriptCore/interpreter/StackVisitor.cpp
    M Source/JavaScriptCore/interpreter/StackVisitor.h
    M Source/JavaScriptCore/interpreter/VMEntryRecord.h
    M Source/JavaScriptCore/jit/AssemblyHelpers.h
    M Source/JavaScriptCore/jit/JITExceptions.cpp
    M Source/JavaScriptCore/jit/JITExceptions.h
    M Source/JavaScriptCore/jit/JITOperations.cpp
    M Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
    M Source/JavaScriptCore/llint/LLIntSlowPaths.cpp
    M Source/JavaScriptCore/llint/LowLevelInterpreter.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
    M Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
    M Source/JavaScriptCore/runtime/CallData.cpp
    M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
    R Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.cpp
    R Source/JavaScriptCore/runtime/CommonSlowPathsExceptions.h
    M Source/JavaScriptCore/runtime/Completion.cpp
    M Source/JavaScriptCore/runtime/JSGeneratorFunction.h
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp
    M Source/JavaScriptCore/runtime/JSGlobalObject.h
    M Source/JavaScriptCore/runtime/VM.cpp
    M Source/JavaScriptCore/runtime/VM.h
    M Source/JavaScriptCore/runtime/VMInlines.h

  Log Message:
  -----------
  Merge r235419 - Fix exception throwing code so that topCallFrame and topEntryFrame stay true to their names.
https://bugs.webkit.org/show_bug.cgi?id=188577
<rdar://problem/42985684>

Reviewed by Saam Barati.

JSTests:

* stress/regress-188577.js: Added.

Source/JavaScriptCore:

1. Introduced CallFrame::convertToStackOverflowFrame() which converts the current
   (top) CallFrame (which may not have a valid callee) into a StackOverflowFrame.

   The StackOverflowFrame is a sentinel frame that the low level code (exception
   throwing code, stack visitor, and stack unwinding code) will know to skip
   over.  The StackOverflowFrame will also have a valid JSCallee so that client
   code can compute the globalObject or VM from this frame.

   As a result, client code that throws StackOverflowErrors no longer need to
   compute the caller frame to throw from: it just converts the top frame into
   a StackOverflowFrame and everything should *Just Work*.

2. NativeCallFrameTracerWithRestore is now obsolete.

   Instead, client code should always call convertToStackOverflowFrame() on the
   frame before instantiating a NativeCallFrameTracer with it.

   This means that topCallFrame will always point to the top CallFrame (which
   may be a StackOverflowFrame), and topEntryFrame will always point to the top
   EntryFrame.  We'll never temporarily point them to the previous EntryFrame
   (which we used to do with NativeCallFrameTracerWithRestore).

3. genericUnwind() and Interpreter::unwind() will now always unwind from the top
   CallFrame, and will know how to handle a StackOverflowFrame if they see one.

   This obsoletes the UnwindStart flag.

* CMakeLists.txt:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* debugger/Debugger.cpp:
(JSC::Debugger::pauseIfNeeded):
* interpreter/CallFrame.cpp:
(JSC::CallFrame::callerFrame const):
(JSC::CallFrame::unsafeCallerFrame const):
(JSC::CallFrame::convertToStackOverflowFrame):
(JSC::CallFrame::callerFrame): Deleted.
(JSC::CallFrame::unsafeCallerFrame): Deleted.
* interpreter/CallFrame.h:
(JSC::ExecState::iterate):
* interpreter/CallFrameInlines.h: Added.
(JSC::CallFrame::isStackOverflowFrame const):
(JSC::CallFrame::isWasmFrame const):
* interpreter/EntryFrame.h: Added.
(JSC::EntryFrame::vmEntryRecordOffset):
(JSC::EntryFrame::calleeSaveRegistersBufferOffset):
* interpreter/FrameTracers.h:
(JSC::NativeCallFrameTracerWithRestore::NativeCallFrameTracerWithRestore): Deleted.
(JSC::NativeCallFrameTracerWithRestore::~NativeCallFrameTracerWithRestore): Deleted.
* interpreter/Interpreter.cpp:
(JSC::Interpreter::unwind):
* interpreter/Interpreter.h:
* interpreter/StackVisitor.cpp:
(JSC::StackVisitor::StackVisitor):
* interpreter/StackVisitor.h:
(JSC::StackVisitor::visit):
(JSC::StackVisitor::topEntryFrameIsEmpty const):
* interpreter/VMEntryRecord.h:
(JSC::VMEntryRecord::callee const):
(JSC::EntryFrame::vmEntryRecordOffset): Deleted.
(JSC::EntryFrame::calleeSaveRegistersBufferOffset): Deleted.
* jit/AssemblyHelpers.h:
* jit/JITExceptions.cpp:
(JSC::genericUnwind):
* jit/JITExceptions.h:
* jit/JITOperations.cpp:
* llint/LLIntOffsetsExtractor.cpp:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/CallData.cpp:
* runtime/CommonSlowPaths.cpp:
(JSC::throwArityCheckStackOverflowError):
(JSC::SLOW_PATH_DECL):
* runtime/CommonSlowPathsExceptions.cpp: Removed.
* runtime/CommonSlowPathsExceptions.h: Removed.
* runtime/Completion.cpp:
(JSC::evaluateWithScopeExtension):
* runtime/JSGeneratorFunction.h:
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::stackOverflowFrameCallee const):
* runtime/VM.cpp:
(JSC::VM::throwException):
* runtime/VM.h:
* runtime/VMInlines.h:
(JSC::VM::topJSCallFrame const):

LayoutTests:

* http/tests/misc/large-js-program-expected.txt:


  Commit: 4350c034e3f81ee10bde37d65e767730b7e74672
      https://github.com/WebKit/WebKit/commit/4350c034e3f81ee10bde37d65e767730b7e74672
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-11-17 (Sat, 17 Nov 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/Font.cpp
    M Source/WebCore/platform/graphics/Font.h
    M Source/WebCore/platform/graphics/FontPlatformData.h
    M Source/WebCore/platform/graphics/cocoa/FontPlatformDataCocoa.mm
    M Source/WebCore/platform/graphics/freetype/FontPlatformDataFreeType.cpp
    M Source/WebCore/platform/graphics/win/FontPlatformDataWin.cpp

  Log Message:
  -----------
  Merged r237487 - Fix release build with -DLOG_DISABLED=0
https://bugs.webkit.org/show_bug.cgi?id=190866

Reviewed by Xabier Rodriguez-Calvar.

No new tests since no functionality changed.

* platform/graphics/Font.cpp:
* platform/graphics/Font.h:
* platform/graphics/FontPlatformData.h:
* platform/graphics/cocoa/FontPlatformDataCocoa.mm:
* platform/graphics/freetype/FontPlatformDataFreeType.cpp:
* platform/graphics/win/FontPlatformDataWin.cpp:


  Commit: 5359526f1f2f9f118732179e78d6d7f88056e396
      https://github.com/WebKit/WebKit/commit/5359526f1f2f9f118732179e78d6d7f88056e396
  Author: Jer Noble <jer.noble at apple.com>
  Date:   2018-11-18 (Sun, 18 Nov 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    R LayoutTests/fast/mediastream/media-stream-track-interrupted-expected.txt
    R LayoutTests/fast/mediastream/media-stream-track-interrupted.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.cpp
    M Source/WebCore/platform/mediastream/RealtimeMediaSource.h
    M Source/WebCore/platform/mediastream/mac/CoreAudioCaptureSource.cpp
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/Internals.idl

  Log Message:
  -----------
  Revert "Merge r237837 - [MediaStream] An audio track should be muted when capture is interrupted by the OS."

This reverts commit b8cbeaf8a2a641e7b2db25972dc6956778da8c2a.

This commit only affects Apple ports, so I shouldn't have backported it. It's harmless here and does not really need to be reverted, except this will serve as a useful reminder to myself that it was not needed here.


  Commit: de94f58bd1c8d14378ca81f08c6cce28575bb4a3
      https://github.com/WebKit/WebKit/commit/de94f58bd1c8d14378ca81f08c6cce28575bb4a3
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-11-18 (Sun, 18 Nov 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFace.h
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp

  Log Message:
  -----------
  Merge r238363 - HarfBuzzFace::CacheEntry should use 32-bit values in its HashMap
https://bugs.webkit.org/show_bug.cgi?id=191825

Patch by Zan Dobersek <zdobersek at igalia.com> on 2018-11-18
Reviewed by Michael Catanzaro.

The HashMap-based glyph cache contained in HarfBuzzFace::CacheEntry
objects is used to map given Unicode codepoints to corresponding
glyph indices (which occurs in the harfBuzzGetGlyph() function that's
invoked by HarfBuzz).

The 16-bit unsigned integer as the map's value type is not enough here
when the glyph index mapping is done through Freetype -- its API returns
32-bit glyph indices, and Cairo assigns this value to the 64-bit
unsigned index variable in the cairo_glyph_t struct. The value type is
thus bumped to 32 bits to match the unsigned type size of the index's
origin.

* platform/graphics/harfbuzz/HarfBuzzFace.h:
* platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:


  Commit: 3aff2c88ce51eb67a00f88df04008abac7586a31
      https://github.com/WebKit/WebKit/commit/3aff2c88ce51eb67a00f88df04008abac7586a31
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2018-11-20 (Tue, 20 Nov 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFace.h
    M Source/WebCore/platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp

  Log Message:
  -----------
  Segfaults on https://terminalizer.com/
https://bugs.webkit.org/show_bug.cgi?id=191805

Patch by Zan Dobersek <zdobersek at igalia.com> on 2018-11-20
Reviewed by Michael Catanzaro.

In HarfBuzzFace, the CacheEntry's HashMap object that caches Unicode
codepoints and their corresponding glyph indices should allow zero
values as valid keys since zero is a valid Unicode codepoint.

This change enables properly caching zero codepoints, avoiding
repetitive additions to the HashMap cache that end up in a crash.

* platform/graphics/harfbuzz/HarfBuzzFace.h: Move the elongated
GlyphCache type alias to the public section of HarfBuzzFace class
declaration, making it reusable in the helper HarfBuzzFontData struct.
* platform/graphics/harfbuzz/HarfBuzzFaceCairo.cpp:


  Commit: 029b22c9bb6aab9e8b67cd156bc30f543f15b880
      https://github.com/WebKit/WebKit/commit/029b22c9bb6aab9e8b67cd156bc30f543f15b880
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-11-21 (Wed, 21 Nov 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp

  Log Message:
  -----------
  [FreeType] Problem under WebCore::FontPlatformData::FontPlatformData
https://bugs.webkit.org/show_bug.cgi?id=191595

Unofficially reviewed stable branch commit.

Blacklist cairo 1.15 and 1.16.0 when setting FreeType memory allocation functions. These
broken versions of cairo free memory allocated by FreeType with system free. We can avoid
trouble by using the system allocator instead of bmalloc.

* platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
(WebCore::initializeFreeTypeLibrary):


  Commit: 8ead8dcd3ea131deef5632aeaa41d3fee7e03ef0
      https://github.com/WebKit/WebKit/commit/8ead8dcd3ea131deef5632aeaa41d3fee7e03ef0
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-11-21 (Wed, 21 Nov 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.22.4 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.22.4.


  Commit: ac3eedab3b000e2c74c7a2ef57578007cd0683c0
      https://github.com/WebKit/WebKit/commit/ac3eedab3b000e2c74c7a2ef57578007cd0683c0
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-11-21 (Wed, 21 Nov 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for 2.22.2 release.

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.22.2.


  Commit: d5cde6cdd8260ce540e1ba055fc0bf51a1dc665b
      https://github.com/WebKit/WebKit/commit/d5cde6cdd8260ce540e1ba055fc0bf51a1dc665b
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-190187.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/FunctionConstructor.cpp
    M Source/JavaScriptCore/runtime/JSString.h
    M Source/JavaScriptCore/runtime/JSStringInlines.h
    M Source/JavaScriptCore/runtime/Operations.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/text/StringConcatenate.h
    M Source/WTF/wtf/text/StringImpl.h
    M Source/WTF/wtf/text/WTFString.h

  Log Message:
  -----------
  Merge r236804 - Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
https://bugs.webkit.org/show_bug.cgi?id=190187
<rdar://problem/42512909>

Reviewed by Michael Saboff.

JSTests:

* stress/regress-190187.js: Added.

Source/JavaScriptCore:

Allowing different max string lengths at each level opens up opportunities for
bugs to creep in.  With 2 different max length values, it is more difficult to
keep the story straight on how we do overflow / bounds checks at each place in
the code.  It's also difficult to tell if a seemingly valid check at the WTF level
will have bad ramifications at the JSC level.  Also, it's also not meaningful to
support a max length > INT_MAX.  To eliminate this class of bugs, we'll
standardize on a MaxLength of INT_MAX at all levels.

We'll also standardize the way we do length overflow checks on using
CheckedArithmetic, and add some asserts to document the assumptions of the code.

* runtime/FunctionConstructor.cpp:
(JSC::constructFunctionSkippingEvalEnabledCheck):
- Fix OOM error handling which crashed a test after the new MaxLength was applied.
* runtime/JSString.h:
(JSC::JSString::finishCreation):
(JSC::JSString::createHasOtherOwner):
(JSC::JSString::setLength):
* runtime/JSStringInlines.h:
(JSC::jsMakeNontrivialString):
* runtime/Operations.h:
(JSC::jsString):

Source/WTF:

* wtf/text/StringConcatenate.h:
(WTF::tryMakeStringFromAdapters):
(WTF::sumWithOverflow): Deleted.
* wtf/text/StringImpl.h:
* wtf/text/WTFString.h:


  Commit: 0e1af67ac8bdea36f40d25459ce5f39ae2eed788
      https://github.com/WebKit/WebKit/commit/0e1af67ac8bdea36f40d25459ce5f39ae2eed788
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/text/StringConcatenate.h

  Log Message:
  -----------
  Merge r236969 - StringTypeAdapter constructor is not properly enforcing String::MaxLength.
https://bugs.webkit.org/show_bug.cgi?id=190392
<rdar://problem/45116210>

Reviewed by Saam Barati.

Previously, the StringTypeAdapter constructor for a UChar* string was summing the
unsigned length of the source string without an overflow check.  We now make that
length a size_t which removes this issue, and assert that it's within
String::MaxLength thereafter.

Also made the StringTypeAdapter constructor for a LChar* string behave in an
equivalent manner for consistency.  In both cases, we'll crash in a RELEASE_ASSERT
if the source string length exceeds String::MaxLength.

* wtf/text/StringConcatenate.h:


  Commit: 4aed2107d3247e01a8cb6f54ff132e963c167dce
      https://github.com/WebKit/WebKit/commit/4aed2107d3247e01a8cb6f54ff132e963c167dce
  Author: Jeff Miller <jeffm at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/API/APIDictionary.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
    A Tools/TestWebKitAPI/Tests/WebKitCocoa/WKNSDictionaryEmptyDictionaryCrash.mm

  Log Message:
  -----------
  Merge r238408 - Return nullptr immediately if the key doesn't exist in the HashMap.
https://bugs.webkit.org/show_bug.cgi?id=191841

Reviewed by Chris Dumez.
Source/WebKit:

* Shared/API/APIDictionary.h:

Tools:

Add a test that would crash prior to the fix for this bug.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKitCocoa/WKNSDictionaryEmptyDictionaryCrash.mm: Added.
(TestWebKitAPI::TEST):


  Commit: 3c5b915ec2cc4370b7314e8157b5c1190d2dbd17
      https://github.com/WebKit/WebKit/commit/3c5b915ec2cc4370b7314e8157b5c1190d2dbd17
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp

  Log Message:
  -----------
  Merge r238578 - [Re-landing] NaNs read from Wasm code needs to be be purified.
https://bugs.webkit.org/show_bug.cgi?id=191056
<rdar://problem/45660341>

Reviewed by Filip Pizlo.

* wasm/js/WebAssemblyModuleRecord.cpp:
(JSC::WebAssemblyModuleRecord::link):


  Commit: f35d8df79adc79820964b0e58ff11532ddc301d8
      https://github.com/WebKit/WebKit/commit/f35d8df79adc79820964b0e58ff11532ddc301d8
  Author: Darin Adler <darin at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/Encoder.cpp
    M Source/WebKit/UIProcess/mac/LegacySessionStateCoding.cpp

  Log Message:
  -----------
  Merge r238798 - Alignment padding needs to be zeroed out in IPC::Encoder
https://bugs.webkit.org/show_bug.cgi?id=192304

Reviewed by Chris Dumez.

Might be useful to make a regression test for this, but I couldn't find any
other tests for this code.

* Platform/IPC/Encoder.cpp:
(IPC::Encoder::grow): Use std::memset to zero-fill padding bytes.

* UIProcess/mac/LegacySessionStateCoding.cpp:
(WebKit::HistoryEntryDataEncoder::grow): Ditto.


  Commit: 521f8c3a77034845562265c40294e7674052f0bb
      https://github.com/WebKit/WebKit/commit/521f8c3a77034845562265c40294e7674052f0bb
  Author: Jiewen Tan <jiewen_tan at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/misc/resource-timing-navigation-in-restored-iframe-2-expected.txt
    A LayoutTests/http/tests/misc/resource-timing-navigation-in-restored-iframe-2.html
    M LayoutTests/http/tests/misc/resource-timing-navigation-in-restored-iframe.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp

  Log Message:
  -----------
  Merge r238877 - Don't report resource timing to parent frame for history items
https://bugs.webkit.org/show_bug.cgi?id=192273
<rdar://problem/45163764>

Reviewed by Youenn Fablet.

Source/WebCore:

We should not report history items to its parent frame as those are less
interested to its parent and might not be the first navigation in the iframes.

This change aligns the behavior when a cached document is not available for the
history item with the available case as we don't report resource timing for any
cached main document.

Test: http/tests/misc/resource-timing-navigation-in-restored-iframe-2.html

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::loadDifferentDocumentItem):

LayoutTests:

* http/tests/misc/resource-timing-navigation-in-restored-iframe-2-expected.txt: Added.
* http/tests/misc/resource-timing-navigation-in-restored-iframe-2.html: Copied from LayoutTests/http/tests/misc/resource-timing-navigation-in-restored-iframe.html.
* http/tests/misc/resource-timing-navigation-in-restored-iframe.html:


  Commit: 22ab8bf3a888469b5c2053974ca1d6d080a802e8
      https://github.com/WebKit/WebKit/commit/22ab8bf3a888469b5c2053974ca1d6d080a802e8
  Author: Filip Pizlo <fpizlo at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/big-wasm-memory-grow-no-max.js
    A JSTests/stress/big-wasm-memory-grow.js
    A JSTests/stress/big-wasm-memory.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/ArrayBuffer.cpp
    M Source/JavaScriptCore/runtime/ArrayBuffer.h
    M Source/JavaScriptCore/wasm/WasmMemory.cpp
    M Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp

  Log Message:
  -----------
  Merge r238326 - All users of ArrayBuffer should agree on the same max size
https://bugs.webkit.org/show_bug.cgi?id=191771

Reviewed by Mark Lam.

JSTests:

* stress/big-wasm-memory-grow-no-max.js: Added.
(foo):
(catch):
* stress/big-wasm-memory-grow.js: Added.
(foo):
(catch):
* stress/big-wasm-memory.js: Added.
(foo):
(catch):

Source/JavaScriptCore:

Array buffers cannot be larger than 0x7fffffff, because otherwise loading typedArray.length in the DFG/FTL would produce
a uint32 or would require a signedness check, neither of which sounds reasonable. It's better to just bound their max size
instead.

* runtime/ArrayBuffer.cpp:
(JSC::ArrayBufferContents::ArrayBufferContents):
(JSC::ArrayBufferContents::tryAllocate):
(JSC::ArrayBufferContents::transferTo):
(JSC::ArrayBufferContents::copyTo):
(JSC::ArrayBufferContents::shareWith):
* runtime/ArrayBuffer.h:
* wasm/WasmMemory.cpp:
(JSC::Wasm::Memory::tryCreate):
(JSC::Wasm::Memory::grow):
* wasm/WasmPageCount.h:


  Commit: 049eacca90b68481ea83508f3e14ae71a939da4e
      https://github.com/WebKit/WebKit/commit/049eacca90b68481ea83508f3e14ae71a939da4e
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-191731.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/builtins/RegExpPrototype.js
    M Source/JavaScriptCore/builtins/StringPrototype.js

  Log Message:
  -----------
  Merge r238267 - RegExp operations should not take fast patch if lastIndex is not numeric.
https://bugs.webkit.org/show_bug.cgi?id=191731
<rdar://problem/46017305>

Reviewed by Saam Barati.

JSTests:

* stress/regress-191731.js: Added.

Source/JavaScriptCore:

This is because if lastIndex is an object with a valueOf() method, it can execute
arbitrary code which may have side effects, and side effects are not permitted by
the RegExp fast paths.

* builtins/RegExpPrototype.js:
(globalPrivate.hasObservableSideEffectsForRegExpMatch):
(overriddenName.string_appeared_here.search):
(globalPrivate.hasObservableSideEffectsForRegExpSplit):
(intrinsic.RegExpTestIntrinsic.test):
* builtins/StringPrototype.js:
(globalPrivate.hasObservableSideEffectsForStringReplace):


  Commit: cb7d0f29bdac93349d297e203d0365a17e459d0b
      https://github.com/WebKit/WebKit/commit/cb7d0f29bdac93349d297e203d0365a17e459d0b
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    R JSTests/stress/regress-187006.js
    A JSTests/stress/regress-191730.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/RegExpObjectInlines.h

  Log Message:
  -----------
  Merge r238270 - RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
https://bugs.webkit.org/show_bug.cgi?id=191730
<rdar://problem/46048517>

Reviewed by Saam Barati.

JSTests:

* stress/regress-187006.js: Removed.
  - this test is invalid because its sole purpose is to test for the non-spec
    compliant behavior that we just fixed.

* stress/regress-191730.js: Added.

Source/JavaScriptCore:

According to the spec https://www.ecma-international.org/ecma-262/9.0/index.html#sec-regexp.prototype-@@match,
the RegExp match results are filled in using the spec's CreateDataProperty()
function which does not consult the prototype for setters.  JSArray:push()
consults the prototype for setters.  We should be using putDirectIndex() instead.

* runtime/RegExpObjectInlines.h:
(JSC::collectMatches):


  Commit: 8452f187556453a763f340b2895045dabb099fab
      https://github.com/WebKit/WebKit/commit/8452f187556453a763f340b2895045dabb099fab
  Author: Jiewen Tan <jiewen_tan at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/mac-wk1/webarchive/loading/test-loading-archive-subresource-expected.txt
    M LayoutTests/platform/mac/fast/loader/webarchive-encoding-respected.html
    M LayoutTests/webarchive/loading/cache-expired-subresource.html
    M LayoutTests/webarchive/loading/mainresource-null-mimetype-crash.html
    M LayoutTests/webarchive/loading/missing-data.html
    A LayoutTests/webarchive/loading/resources/top.webarchive
    A LayoutTests/webarchive/loading/test-loading-archive-subresource-expected.txt
    M LayoutTests/webarchive/loading/test-loading-archive-subresource-null-mimetype.html
    A LayoutTests/webarchive/loading/test-loading-archive-subresource.html
    M LayoutTests/webarchive/loading/test-loading-archive.html
    A LayoutTests/webarchive/loading/test-loading-top-archive-expected.txt
    A LayoutTests/webarchive/loading/test-loading-top-archive.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.h
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/loader/DocumentLoader.h
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/Internals.idl
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r238562 - Disallow loading webarchives as iframes
https://bugs.webkit.org/show_bug.cgi?id=191728
<rdar://problem/45524528>

Reviewed by Youenn Fablet.

Source/WebCore:

Disallow loading webarchives as iframes. We don't allow loading remote webarchives.
Now, this policy is hardened to disallow loading webarchives as iframes for local
documents as well.

To allow old tests still be able to run, a flag is added to always allow loading local
webarchives in document. The flag can be set via window.internals.

Tests: webarchive/loading/test-loading-archive-subresource.html
       webarchive/loading/test-loading-top-archive.html

* dom/Document.h:
(WebCore::Document::setAlwaysAllowLocalWebarchive):
(WebCore::Document::alwaysAllowLocalWebarchive):
* loader/DocumentLoader.cpp:
(WebCore::disallowWebArchive):
(WebCore::DocumentLoader::continueAfterContentPolicy):
(WebCore::isRemoteWebArchive): Deleted.
* testing/Internals.cpp:
(WebCore::Internals::setAlwaysAllowLocalWebarchive const):
* testing/Internals.h:
* testing/Internals.idl:

Source/WebKit:

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::unableToImplementPolicy):
Add a check to prevent null pointer dereference.

LayoutTests:

* platform/mac-wk1/webarchive/loading/test-loading-archive-subresource-expected.txt: Added.
* platform/mac/fast/loader/webarchive-encoding-respected.html:
* webarchive/loading/cache-expired-subresource.html:
* webarchive/loading/mainresource-null-mimetype-crash.html:
* webarchive/loading/missing-data.html:
* webarchive/loading/resources/test-loading-archive-main.webarchive: Copied from LayoutTests/webarchive/loading/test-loading-archive.html.
* webarchive/loading/test-loading-archive-subresource-expected.txt: Added.
* webarchive/loading/test-loading-archive-subresource-null-mimetype.html:
* webarchive/loading/test-loading-archive-subresource.html: Copied from LayoutTests/webarchive/loading/test-loading-archive.html.
* webarchive/loading/test-loading-archive.html:
* webarchive/loading/test-loading-top-archive-expected.txt: Added.
* webarchive/loading/test-loading-top-archive.html: Added.


  Commit: 8ec7e5eb6fb159d1e97cef9f37566cb0d8be9bc2
      https://github.com/WebKit/WebKit/commit/8ec7e5eb6fb159d1e97cef9f37566cb0d8be9bc2
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLMediaElement.cpp

  Log Message:
  -----------
  Merge r238788 - Lifetime of HTMLMediaElement is not properly handled in asynchronous actions
https://bugs.webkit.org/show_bug.cgi?id=192087
<rdar://problem/45975230>

Reviewed by Dean Jackson.

The HTMLMediaElement performs operations that allow arbitrary JavaScript to run. We need to make
sure the active media element is protected until those calls complete.

* html/HTMLMediaElement.cpp:
(WebCore::HTMLMediaElement::didFinishInsertingNode):
(WebCore::HTMLMediaElement::exitFullscreen):
(WebCore::HTMLMediaElement::markCaptionAndSubtitleTracksAsUnconfigured):
(WebCore::HTMLMediaElement::scheduleConfigureTextTracks):
(WebCore::HTMLMediaElement::scheduleMediaEngineWasUpdated):
(WebCore::HTMLMediaElement::scheduleUpdatePlayState):
(WebCore::HTMLMediaElement::scheduleUpdateMediaState):


  Commit: 498aecc19f482997ea5869b9b4d299e3e176fb07
      https://github.com/WebKit/WebKit/commit/498aecc19f482997ea5869b9b4d299e3e176fb07
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebNavigationState.cpp
    M Source/WebKit/UIProcess/WebNavigationState.h
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r236227 - Crash under WebPageProxy::decidePolicyForNavigationAction()
https://bugs.webkit.org/show_bug.cgi?id=189763
<rdar://problem/44597111>

Reviewed by Alex Christensen.

Update WebNavigationState::navigation() / WebNavigationState::takeNavigation()
to return a pointer instead of a reference as we have evidence that they can
return null. I kept the debug assertions to try and catch the cases where we
return null but at least we stop crashing in release builds.

* UIProcess/WebNavigationState.cpp:
(WebKit::WebNavigationState::navigation):
(WebKit::WebNavigationState::takeNavigation):
* UIProcess/WebNavigationState.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didStartProvisionalLoadForFrame):
(WebKit::WebPageProxy::didReceiveServerRedirectForProvisionalLoadForFrame):
(WebKit::WebPageProxy::didCommitLoadForFrame):
(WebKit::WebPageProxy::didFinishDocumentLoadForFrame):
(WebKit::WebPageProxy::didFinishLoadForFrame):
(WebKit::WebPageProxy::didFailLoadForFrame):
(WebKit::WebPageProxy::didSameDocumentNavigationForFrame):
(WebKit::WebPageProxy::decidePolicyForNavigationAction):
(WebKit::WebPageProxy::decidePolicyForResponse):


  Commit: 825fa2542bea4e086fa424940ae93c2a526f56b0
      https://github.com/WebKit/WebKit/commit/825fa2542bea4e086fa424940ae93c2a526f56b0
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Merge r235356 - [JSC] Array.prototype.reverse modifies JSImmutableButterfly
https://bugs.webkit.org/show_bug.cgi?id=188794

Reviewed by Saam Barati.

JSTests:

* stress/reverse-with-immutable-butterfly.js: Added.
(shouldBe):
(reverseInt):
(reverseDouble):
(reverseContiguous):

Source/JavaScriptCore:

While Array.prototype.reverse modifies the butterfly of the given Array,
it does not account JSImmutableButterfly case. So it accidentally modifies
the content of JSImmutableButterfly.
This patch converts CoW arrays to writable arrays before reversing.

* runtime/ArrayPrototype.cpp:
(JSC::arrayProtoFuncReverse):
* runtime/JSObject.h:
(JSC::JSObject::ensureWritable):


  Commit: 66575a09b5234ee90d525610314745bfc1ef061a
      https://github.com/WebKit/WebKit/commit/66575a09b5234ee90d525610314745bfc1ef061a
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    R JSTests/stress/regress-189571.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
    M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
    M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

  Log Message:
  -----------
  Revert "Merged r236161 - Ensure that ForInContexts are invalidated if their loop local is over-written. https://bugs.webkit.org/show_bug.cgi?id=189571 <rdar://problem/44402277>"

This reverts commit 3fec08985ee04d132fd0dfcbb77709e9a73c5477.

Going to try backporting this again after first backporting an older commit. The history is a bit difficult otherwise.


  Commit: fde1ec1020ff944c0e10a2a4e9369c4407706aeb
      https://github.com/WebKit/WebKit/commit/fde1ec1020ff944c0e10a2a4e9369c4407706aeb
  Author: Michael Catanzaro <mcatanzaro at igalia.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

  Log Message:
  -----------
  Revert "[GTK] Cannot make debug builds of JSC using release 2.22.3"

This reverts commit 4f5957964086375c1ada9728c533e7beb4ea3c86.

This was needed due to an error backporting the previous commit, which I am about to re-backport without conflicts.


  Commit: e7599feb481420c43fa3faad8060adddbc340e13
      https://github.com/WebKit/WebKit/commit/e7599feb481420c43fa3faad8060adddbc340e13
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

  Log Message:
  -----------
  Merge r236018 - Refactor some ForInContext code for better encapsulation.
https://bugs.webkit.org/show_bug.cgi?id=189626
<rdar://problem/44466415>

Reviewed by Keith Miller.

1. Add a ForInContext::m_type field to store the context type.  This does not
   increase the class size, but eliminates the need for a virtual call to get the
   type.

   Note: we still need a virtual destructor because we'll be mingling
   IndexedForInContexts and StructureForInContexts in the BytecodeGenerator::m_forInContextStack.

2. Add ForInContext::isIndexedForInContext() and ForInContext::isStructureForInContext()
   convenience methods.

3. Add ForInContext::asIndexedForInContext() and ForInContext::asStructureForInContext()
   to do the casting to the subclass types.  This ensures that we'll properly
   assert that the casting is legal.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::emitGetByVal):
(JSC::BytecodeGenerator::popIndexedForInScope):
(JSC::BytecodeGenerator::popStructureForInScope):
* bytecompiler/BytecodeGenerator.h:
(JSC::ForInContext::type const):
(JSC::ForInContext::isIndexedForInContext const):
(JSC::ForInContext::isStructureForInContext const):
(JSC::ForInContext::asIndexedForInContext):
(JSC::ForInContext::asStructureForInContext):
(JSC::ForInContext::ForInContext):
(JSC::StructureForInContext::StructureForInContext):
(JSC::IndexedForInContext::IndexedForInContext):
(JSC::ForInContext::~ForInContext): Deleted.


  Commit: 20b3178a2328245c5e6c6a0bd2bc740498af5c35
      https://github.com/WebKit/WebKit/commit/20b3178a2328245c5e6c6a0bd2bc740498af5c35
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-189571.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
    M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
    M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

  Log Message:
  -----------
  Merge r236161 - Ensure that ForInContexts are invalidated if their loop local is over-written.
https://bugs.webkit.org/show_bug.cgi?id=189571
<rdar://problem/44402277>

Reviewed by Saam Barati.

JSTests:

* stress/regress-189571.js: Added.

Source/JavaScriptCore:

Instead of hunting down every place in the BytecodeGenerator that potentially
needs to invalidate an enclosing ForInContext (if one exists), we simply iterate
the bytecode range of the loop body when the ForInContext is popped, and
invalidate the context if we ever find the loop temp variable over-written.

This has 2 benefits:
1. It ensures that every type of opcode that can write to the loop temp will be
   handled appropriately, not just the op_mov that we've hunted down.
2. It avoids us having to check the BytecodeGenerator's m_forInContextStack
   every time we emit an op_mov (or other opcodes that can write to a local)
   even when we're not inside a for-in loop.

JSC benchmarks show that that this change is performance neutral.

* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::pushIndexedForInScope):
(JSC::BytecodeGenerator::popIndexedForInScope):
(JSC::BytecodeGenerator::pushStructureForInScope):
(JSC::BytecodeGenerator::popStructureForInScope):
(JSC::ForInContext::finalize):
(JSC::StructureForInContext::finalize):
(JSC::IndexedForInContext::finalize):
(JSC::BytecodeGenerator::invalidateForInContextForLocal): Deleted.
* bytecompiler/BytecodeGenerator.h:
(JSC::ForInContext::ForInContext):
(JSC::ForInContext::bodyBytecodeStartOffset const):
(JSC::StructureForInContext::StructureForInContext):
(JSC::IndexedForInContext::IndexedForInContext):
* bytecompiler/NodesCodegen.cpp:
(JSC::PostfixNode::emitResolve):
(JSC::PrefixNode::emitResolve):
(JSC::ReadModifyResolveNode::emitBytecode):
(JSC::AssignResolveNode::emitBytecode):
(JSC::EmptyLetExpression::emitBytecode):
(JSC::ForInNode::emitLoopHeader):
(JSC::ForOfNode::emitBytecode):
(JSC::BindingNode::bindValue const):
(JSC::AssignmentElementNode::bindValue const):
* runtime/CommonSlowPaths.cpp:
(JSC::SLOW_PATH_DECL):


  Commit: 3b25f2f3713ccf512807f2151bd7fc110e1aa385
      https://github.com/WebKit/WebKit/commit/3b25f2f3713ccf512807f2151bd7fc110e1aa385
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/InlineAccess.cpp
    M Source/JavaScriptCore/bytecode/StructureStubInfo.h
    M Source/JavaScriptCore/jit/JITInlineCacheGenerator.cpp

  Log Message:
  -----------
  Merge r236584 - Don't use int offsets in StructureStubInfo
https://bugs.webkit.org/show_bug.cgi?id=190064
<rdar://problem/44784719>

Reviewed by Mark Lam.

* bytecode/InlineAccess.cpp:
(JSC::linkCodeInline):
* bytecode/StructureStubInfo.h:
(JSC::StructureStubInfo::slowPathCallLocation):
(JSC::StructureStubInfo::doneLocation):
(JSC::StructureStubInfo::slowPathStartLocation):
* jit/JITInlineCacheGenerator.cpp:
(JSC::JITInlineCacheGenerator::finalize):


  Commit: 2c245a6d99c702060c37ff80d2cc8b9f6f284ceb
      https://github.com/WebKit/WebKit/commit/2c245a6d99c702060c37ff80d2cc8b9f6f284ceb
  Author: Saam Barati <sbarati at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
    M Source/JavaScriptCore/dfg/DFGOSRExit.cpp
    M Source/JavaScriptCore/dfg/DFGOSRExit.h
    M Source/JavaScriptCore/dfg/DFGOSRExitCompilationInfo.h

  Log Message:
  -----------
  Merge r236585 - DFG::OSRExit::m_patchableCodeOffset should not be an int
https://bugs.webkit.org/show_bug.cgi?id=190066
<rdar://problem/39498244>

Reviewed by Mark Lam.

* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::linkOSRExits):
(JSC::DFG::JITCompiler::link):
* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::codeLocationForRepatch const):
(JSC::DFG::OSRExit::compileOSRExit):
(JSC::DFG::OSRExit::setPatchableCodeOffset): Deleted.
(JSC::DFG::OSRExit::getPatchableCodeOffsetAsJump const): Deleted.
(JSC::DFG::OSRExit::correctJump): Deleted.
* dfg/DFGOSRExit.h:
* dfg/DFGOSRExitCompilationInfo.h:


  Commit: ef7b49debc6cea9b04229dc5ddbb4c002dcb86f2
      https://github.com/WebKit/WebKit/commit/ef7b49debc6cea9b04229dc5ddbb4c002dcb86f2
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGJITCode.h
    M Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
    M Source/JavaScriptCore/dfg/DFGOSREntry.cpp
    M Source/JavaScriptCore/dfg/DFGOSREntry.h
    M Source/JavaScriptCore/runtime/JSCPtrTag.h

  Log Message:
  -----------
  Merge r236576 - DFG::OSREntry::m_machineCodeOffset should be a CodeLocation.
https://bugs.webkit.org/show_bug.cgi?id=190054
<rdar://problem/44803543>

Reviewed by Saam Barati.

* dfg/DFGJITCode.h:
(JSC::DFG::JITCode::appendOSREntryData):
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::noticeOSREntry):
* dfg/DFGOSREntry.cpp:
(JSC::DFG::OSREntryData::dumpInContext const):
(JSC::DFG::prepareOSREntry):
* dfg/DFGOSREntry.h:
* runtime/JSCPtrTag.h:


  Commit: 1a2c3d2b238bff8b0dafc62e44fa732380c37793
      https://github.com/WebKit/WebKit/commit/1a2c3d2b238bff8b0dafc62e44fa732380c37793
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/ByValInfo.h
    M Source/JavaScriptCore/jit/JIT.cpp
    M Source/JavaScriptCore/jit/JITOpcodes.cpp
    M Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
    M Source/JavaScriptCore/jit/JITPropertyAccess.cpp

  Log Message:
  -----------
  Merge r236587 - ByValInfo should not use integer offsets.
https://bugs.webkit.org/show_bug.cgi?id=190070
<rdar://problem/44803430>

Reviewed by Saam Barati.

Also moved some fields around to allow the ByValInfo struct to be more densely packed.

* bytecode/ByValInfo.h:
(JSC::ByValInfo::ByValInfo):
* jit/JIT.cpp:
(JSC::JIT::link):
* jit/JITOpcodes.cpp:
(JSC::JIT::privateCompileHasIndexedProperty):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::privateCompileHasIndexedProperty):
* jit/JITPropertyAccess.cpp:
(JSC::JIT::privateCompileGetByVal):
(JSC::JIT::privateCompileGetByValWithCachedId):
(JSC::JIT::privateCompilePutByVal):
(JSC::JIT::privateCompilePutByValWithCachedId):


  Commit: b2c19d2746e9c58c36debaa2040ce644b73b53dd
      https://github.com/WebKit/WebKit/commit/b2c19d2746e9c58c36debaa2040ce644b73b53dd
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/JITMathIC.h

  Log Message:
  -----------
  Merge r236554 - JITMathIC should not use integer offsets into machine code.
https://bugs.webkit.org/show_bug.cgi?id=190030
<rdar://problem/44803307>

Reviewed by Saam Barati.

We'll replace them with CodeLocation smart pointers instead.

* jit/JITMathIC.h:
(JSC::isProfileEmpty):


  Commit: 0c11bd3b1515ffc847489c5b650aecbf21bd5e39
      https://github.com/WebKit/WebKit/commit/0c11bd3b1515ffc847489c5b650aecbf21bd5e39
  Author: Carlos Eduardo Ramalho <cadubentzen at gmail.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/gtk/PlatformWheelEventGtk.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/WebEventConversion.cpp
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r238928 - REGRESSION(r231043): [GTK] Undefined references to WebCore::LayerRepresentation::* with -DENABLE_OPENGL=OFF builds
https://bugs.webkit.org/show_bug.cgi?id=191997

Patch by Carlos Eduardo Ramalho <cadubentzen at gmail.com> on 2018-12-06
Reviewed by Philippe Normand.

.:

Fix build with -DENABLE_OPENGL=OFF and -DENABLE_VIDEO=OFF

* Source/cmake/OptionsGTK.cmake: make ENABLE_ASYNC_SCROLLING depend on ENABLE_OPENGL

Source/WebCore:

Fix build with -DENABLE_OPENGL=OFF and -DENABLE_VIDEO=OFF.

No new tests required. Only fixing build.

* platform/gtk/PlatformWheelEventGtk.cpp:
(WebCore::PlatformWheelEvent::PlatformWheelEvent): add required #if ENABLE(ASYNC_SCROLLING)

Source/WebKit:

Fix build with -DENABLE_OPENGL=OFF and -DENABLE_VIDEO=OFF.

* Shared/WebEventConversion.cpp:
(WebKit::WebKit2PlatformWheelEvent::WebKit2PlatformWheelEvent): add required #if ENABLE(ASYNC_SCROLLING)


  Commit: 270dd4f498562df55c65ecfe631d19105a09443e
      https://github.com/WebKit/WebKit/commit/270dd4f498562df55c65ecfe631d19105a09443e
  Author: Carlos Eduardo Ramalho <cadubentzen at gmail.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp
    M Source/cmake/GStreamerDependencies.cmake
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r238929 - [GStreamer] -DENABLE_VIDEO=ON -DENABLE_OPENGL=OFF still tries to build GstreamerGL
https://bugs.webkit.org/show_bug.cgi?id=191998

Patch by Carlos Eduardo Ramalho <cadubentzen at gmail.com> on 2018-12-06
Reviewed by Philippe Normand.

Fix compilation with -DENABLE_VIDEO=ON and -DENABLE_OPENGL=OFF due to GStreamerGL.

.:

* Source/cmake/GStreamerDependencies.cmake: "DEFINED ENABLE_OPENGL" is always false because ENABLE_OPENGL
is not a CMake variable (WEBKIT_OPTION_DEFINE macro does not define ENABLE_OPENGL variable per se, but other
variables and appends it to a list).
* Source/cmake/OptionsGTK.cmake: GStreamerDefinitions.cmake was included twice by mistake. Second should be GStreamerDependencies.cmake.

Source/WebCore:

No new tests required. Only fixing the build with certain flags.

* Modules/mediastream/CanvasCaptureMediaStreamTrack.cpp:
(WebCore::CanvasCaptureMediaStreamTrack::Source::canvasChanged): add required #if ENABLE(WEBGL).


  Commit: 097beec49179bbee0e95e2a7cfa9075fa2db7f7a
      https://github.com/WebKit/WebKit/commit/097beec49179bbee0e95e2a7cfa9075fa2db7f7a
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Revert "Merge r235356 - [JSC] Array.prototype.reverse modifies JSImmutableButterfly"

This reverts commit 729388b8e4bc924eacddcb4e40e0e2ae41588085.

This commit had already been backported in r236061, but was missing the 'Merged' in the commit message so I failed to find it. All I managed to accomplish here was duplicating the ChangeLog entries.


  Commit: ef259c3727240ed02030ded8e566e2c30fb71803
      https://github.com/WebKit/WebKit/commit/ef259c3727240ed02030ded8e566e2c30fb71803
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/OptionsGTK.cmake
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Merge r238619 - [CMake] Automatically disable JIT and enable USE_SYSTEM_MALLOC on unfamiliar architectures
https://bugs.webkit.org/show_bug.cgi?id=186722

Reviewed by Žan Doberšek.

Time for part #2! This change was defeated for GTK and WPE by the code that makes the
options public. We have three options: (a) duplicate the architecture check currently in
WebKitFeatures.cmake in both OptionsGTK.cmake and OptionsWPE.cmake, (b) rely on the result
of that check in OptionsGTK.cmake and OptionsWPE.cmake by using ENABLE_JIT_DEFAULT and
USE_SYSTEM_MALLOC_DEFAULT, a fragile encapsulation violation, or (c) just make the options
private. They have been public up until now because they needed to be turned off on
unsupported architectures. But now they are off by default and enabled only for particular
whitelisted architectures, so they shouldn't be needed anymore.

Note we have to hide ENABLE_SAMPLING_PROFILER as well, since it needs to match the value of
ENABLE_JIT. Again, this is handled properly in WebKitFeatures.cmake, and defeated here in
OptionsGTK.cmake. (This is not a problem for WPE.)

* Source/cmake/OptionsGTK.cmake:
* Source/cmake/OptionsWPE.cmake:


  Commit: e08ee9dbe0b311c7f5fdbe481509b9a260eb0906
      https://github.com/WebKit/WebKit/commit/e08ee9dbe0b311c7f5fdbe481509b9a260eb0906
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/atk/WebKitAccessibleInterfaceComponent.cpp
    M Source/WebCore/accessibility/atk/WebKitAccessibleInterfaceText.cpp
    M Source/WebCore/accessibility/atk/WebKitAccessibleUtil.cpp

  Log Message:
  -----------
  Merge r238082 - [GTK] Silence ATK_XY_PARENT warnings
https://bugs.webkit.org/show_bug.cgi?id=191504

Reviewed by Carlos Garcia Campos.

* accessibility/atk/WebKitAccessibleInterfaceComponent.cpp:
(atkToContents):
* accessibility/atk/WebKitAccessibleInterfaceText.cpp:
(textExtents):
* accessibility/atk/WebKitAccessibleUtil.cpp:
(contentsRelativeToAtkCoordinateType):


  Commit: b02446ab2d5941a63647bf0b90b9118fc2344a0a
      https://github.com/WebKit/WebKit/commit/b02446ab2d5941a63647bf0b90b9118fc2344a0a
  Author: Charlie Turner <cturner at igalia.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M ChangeLog
    M Source/cmake/WebKitFeatures.cmake

  Log Message:
  -----------
  Merge r237491 - Make VIDEO enabled if ENCRYPTED_MEDIA is enabled.
https://bugs.webkit.org/show_bug.cgi?id=190983

Unreviewed build update.

* Source/cmake/WebKitFeatures.cmake:


  Commit: 580251b7319b0b13237f31f4d0662818b46c2705
      https://github.com/WebKit/WebKit/commit/580251b7319b0b13237f31f4d0662818b46c2705
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2018-12-08 (Sat, 08 Dec 2018)

  Changed paths:
    M ChangeLog
    M PerformanceTests/CMakeLists.txt
    M PerformanceTests/ChangeLog
    M Source/cmake/WebKitFeatures.cmake

  Log Message:
  -----------
  Merge r235253 - [CMake] Have checks are not getting set inside CMake properly
https://bugs.webkit.org/show_bug.cgi?id=188901

Reviewed by Michael Catanzaro.

.:

Make sure the variable's value is sent to SET_AND_EXPOSE_TO_BUILD
within the WEBKIT_CHECK_HAVE_* macros.

* Source/cmake/WebKitFeatures.cmake:

PerformanceTests:

Add notification that MallocBench is disabled.

* CMakeLists.txt:


  Commit: e04cebd7ead1e61a0b5c28c224b36a0c95401a4c
      https://github.com/WebKit/WebKit/commit/e04cebd7ead1e61a0b5c28c224b36a0c95401a4c
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-12-13 (Thu, 13 Dec 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake for the 2.22.5 release.

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.22.5.


  Commit: e57ea411aa2590606663083caa63ded1c41ca781
      https://github.com/WebKit/WebKit/commit/e57ea411aa2590606663083caa63ded1c41ca781
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2018-12-13 (Thu, 13 Dec 2018)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake for the 2.22.3 release.

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.22.3.


  Commit: 3f7b1c6e67f0129acec65ea18d3c701e599a2083
      https://github.com/WebKit/WebKit/commit/3f7b1c6e67f0129acec65ea18d3c701e599a2083
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-13 (Thu, 13 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-191993.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/GetByIdStatus.cpp
    M Source/JavaScriptCore/bytecode/InByIdStatus.cpp
    M Source/JavaScriptCore/bytecode/PropertyCondition.cpp
    M Source/JavaScriptCore/bytecode/PutByIdStatus.cpp
    M Source/JavaScriptCore/runtime/JSFunction.cpp
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/JSObject.h
    M Source/JavaScriptCore/runtime/JSObjectInlines.h
    M Source/JavaScriptCore/runtime/PropertyDescriptor.cpp
    M Source/JavaScriptCore/runtime/PropertySlot.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
    M Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp

  Log Message:
  -----------
  Merge r239062 - PropertyAttribute needs a CustomValue bit.
https://bugs.webkit.org/show_bug.cgi?id=191993
<rdar://problem/46264467>

Reviewed by Saam Barati.

JSTests:

* stress/regress-191993.js: Added.

Source/JavaScriptCore:

This is because GetByIdStatus needs to distinguish CustomValue properties from
other types, and its only means of doing so is via the property's attributes.
Previously, there's nothing in the property's attributes that can indicate that
the property is a CustomValue.

We fix this by doing the following:

1. Added a PropertyAttribute::CustomValue bit.
2. Added a PropertyAttribute::CustomAccessorOrValue convenience bit mask that is
   CustomAccessor | CustomValue.

3. Since CustomGetterSetter properties are only set via JSObject::putDirectCustomAccessor(),
   we added a check in JSObject::putDirectCustomAccessor() to see if the attributes
   bits include PropertyAttribute::CustomAccessor.  If not, then the property
   must be a CustomValue, and we'll add the PropertyAttribute::CustomValue bit
   to the attributes bits.

   This ensures that the property attributes is sufficient to tell us if the
   property contains a CustomGetterSetter.

4. Updated all checks for PropertyAttribute::CustomAccessor to check for
   PropertyAttribute::CustomAccessorOrValue instead if their intent is to check
   for the presence of a CustomGetterSetter as opposed to checking specifically
   for one that is used as a CustomAccessor.

   This includes all the Structure transition code that needs to capture the
   attributes change when a CustomValue has been added.

5. Filtered out the PropertyAttribute::CustomValue bit in PropertyDescriptor.
   The fact that we're using a CustomGetterSetter as a CustomValue should remain
   invisible to the descriptor.  This is because the descriptor should describe
   a CustomValue no differently from a plain value.

6. Added some asserts to ensure that property attributes are as expected, and to
   document some invariants.

* bytecode/GetByIdStatus.cpp:
(JSC::GetByIdStatus::computeFromLLInt):
(JSC::GetByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
(JSC::GetByIdStatus::computeFor):
* bytecode/InByIdStatus.cpp:
(JSC::InByIdStatus::computeForStubInfoWithoutExitSiteFeedback):
* bytecode/PropertyCondition.cpp:
(JSC::PropertyCondition::isStillValidAssumingImpurePropertyWatchpoint const):
* bytecode/PutByIdStatus.cpp:
(JSC::PutByIdStatus::computeFor):
* runtime/JSFunction.cpp:
(JSC::getCalculatedDisplayName):
* runtime/JSObject.cpp:
(JSC::JSObject::putDirectCustomAccessor):
(JSC::JSObject::putDirectNonIndexAccessor):
(JSC::JSObject::putDirectIndexSlowOrBeyondVectorLength):
* runtime/JSObject.h:
(JSC::JSObject::putDirectIndex):
(JSC::JSObject::fillCustomGetterPropertySlot):
(JSC::JSObject::putDirect):
* runtime/JSObjectInlines.h:
(JSC::JSObject::putDirectInternal):
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::setDescriptor):
(JSC::PropertyDescriptor::setCustomDescriptor):
(JSC::PropertyDescriptor::setAccessorDescriptor):
* runtime/PropertySlot.h:
(JSC::PropertySlot::setCustomGetterSetter):

Source/WebCore:

This patch revealed a bug in the CodeGenerator where a constructor property is
set with a ReadOnly attribute.  This conflicts with the WebIDL link (see clause
12 in https://heycam.github.io/webidl/#interface-prototype-object) which states
that it should be [Writable].  The ReadOnly attribute is now removed.

On the WebCore side, this change is covered by existing tests.

* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
(WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):


  Commit: df56c6dc1e3a89123817ac73dc66852f126f1d6f
      https://github.com/WebKit/WebKit/commit/df56c6dc1e3a89123817ac73dc66852f126f1d6f
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-18 (Tue, 18 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-192626.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/ScopedArguments.h

  Log Message:
  -----------
  Merge r239198 - Add a missing exception check.
https://bugs.webkit.org/show_bug.cgi?id=192626
<rdar://problem/46662163>

Reviewed by Keith Miller.

JSTests:

* stress/regress-192626.js: Added.

Source/JavaScriptCore:

* runtime/ScopedArguments.h:


  Commit: 42ddda4374af5410bab0f8218bfde6dd63240d07
      https://github.com/WebKit/WebKit/commit/42ddda4374af5410bab0f8218bfde6dd63240d07
  Author: Darin Adler <darin at apple.com>
  Date:   2018-12-18 (Tue, 18 Dec 2018)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/LiteralParser.cpp
    M Source/JavaScriptCore/runtime/LiteralParser.h

  Log Message:
  -----------
  Merge r239248 - LiteralParser has a bunch of uses of String::format with untrusted data
https://bugs.webkit.org/show_bug.cgi?id=108883
rdar://problem/13666409

Reviewed by Mark Lam.

* runtime/LiteralParser.cpp:
(JSC::LiteralParser<CharType>::Lexer::lex): Use makeString instead of String::format.
(JSC::LiteralParser<CharType>::Lexer::lexStringSlow): Ditto.
(JSC::LiteralParser<CharType>::parse): Ditto.

* runtime/LiteralParser.h:
(JSC::LiteralParser::getErrorMessage): Use string concatenation instead of
String::format.


  Commit: d3116e18f28021c359ea2ea24219b510db379805
      https://github.com/WebKit/WebKit/commit/d3116e18f28021c359ea2ea24219b510db379805
  Author: Darin Adler <darin at apple.com>
  Date:   2018-12-18 (Tue, 18 Dec 2018)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Gigacage.cpp

  Log Message:
  -----------
  Merge r239249 - Verify size is valid in USE_SYSTEM_MALLOC version of tryAllocateZeroedVirtualPages
https://bugs.webkit.org/show_bug.cgi?id=192738
rdar://problem/37502342

Reviewed by Mark Lam.

* wtf/Gigacage.cpp:
(Gigacage::tryAllocateZeroedVirtualPages): Added a RELEASE_ASSERT just
like the one in tryLargeZeroedMemalignVirtual in bmalloc.


  Commit: bfbca2c9e7f42b045fe97880106a903be49dafa6
      https://github.com/WebKit/WebKit/commit/bfbca2c9e7f42b045fe97880106a903be49dafa6
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2018-12-21 (Fri, 21 Dec 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/animations/view-dependency-crash-expected.txt
    A LayoutTests/svg/animations/view-dependency-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Sources.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/bindings/js/JSMicrotaskCallback.h
    A Source/WebCore/bindings/js/JSSVGViewSpecCustom.cpp
    M Source/WebCore/svg/SVGElement.h
    M Source/WebCore/svg/SVGPathElement.h
    M Source/WebCore/svg/SVGViewSpec.cpp
    M Source/WebCore/svg/SVGViewSpec.h
    M Source/WebCore/svg/SVGViewSpec.idl
    A Source/WebCore/svg/properties/SVGAttributeOwnerProxy.cpp
    M Source/WebCore/svg/properties/SVGAttributeOwnerProxy.h
    M Source/WebCore/svg/properties/SVGAttributeOwnerProxyImpl.h

  Log Message:
  -----------
  Merge r239070 - SVGViewSpec objects should mark relevant SVG elements
https://bugs.webkit.org/show_bug.cgi?id=192567
<rdar://problem/46491325>

Reviewed by Ryosuke Niwa.

Source/WebCore:

SVGViewSpec elements reflect the state of an underlying SVGElement. Teach the mark algorithm to
recognize the relevant SVGElement as active as long as the SVGViewSpec is active.

Update SVGElement so that it can vend WeakPtrs. I also noticed that SVGAttributeOwner used a bare
pointer to the SVGElement, so switched to a WeakPtr.

Test: svg/animations/view-dependency-crash.html

* Sources.txt: Add new files.
* WebCore.xcodeproj/project.pbxproj: Ditto.
* bindings/js/JSSVGViewSpecCustom.cpp: Added.
(WebCore::JSSVGViewSpec::visitAdditionalChildren):
* svg/SVGElement.h:
* svg/SVGPathElement.h:
* svg/SVGViewSpec.cpp:
(WebCore::SVGViewSpec::SVGViewSpec): Hold a weak pointer (rather than a bare pointer) to the underlying element.
* svg/SVGViewSpec.h:
* svg/SVGViewSpec.idl:
* svg/properties/SVGAttributeOwnerProxy.cpp: Added.
(WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Hold a weak pointer (rather than a bare pointer) to
the underling SVGElement.
(WebCore::SVGAttributeOwnerProxy::element const): Ditto.
* svg/properties/SVGAttributeOwnerProxy.h:
(WebCore::SVGAttributeOwnerProxy::SVGAttributeOwnerProxy): Move implementation to cpp file.
(WebCore::SVGAttributeOwnerProxy::element const): Ditto.
* svg/properties/SVGAttributeOwnerProxyImpl.h: Update for WeakPtr use.

LayoutTests:

* svg/animations/view-dependency-crash-expected.txt: Added.
* svg/animations/view-dependency-crash.html: Added.


  Commit: bcbe37942c23a495aa0fd6abc9574f5dfe0e7b43
      https://github.com/WebKit/WebKit/commit/bcbe37942c23a495aa0fd6abc9574f5dfe0e7b43
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2018-12-21 (Fri, 21 Dec 2018)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js
    A JSTests/stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.h

  Log Message:
  -----------
  Merge r239392 - JSPropertyNameEnumerator should cache the iterated object's structure only after getting its property names.
https://bugs.webkit.org/show_bug.cgi?id=192464
<rdar://problem/46519455>

Reviewed by Saam Barati.

JSTests:

This patch is about a 10% speed up on the new for-in-on-object-with-lazily-materialized-properties.js
microbenchmark.

* microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js: Added.
* stress/property-name-enumerator-should-cache-structure-after-getting-property-names.js: Added.

Source/JavaScriptCore:

This is because the process of getting its property names may cause some lazy
properties to be reified, and the structure will change.  This is needed in order
for get_direct_pname to work correctly.

* runtime/JSPropertyNameEnumerator.h:
(JSC::propertyNameEnumerator):


  Commit: 7a6562592ad86f547316d1324357c80ce3166c7f
      https://github.com/WebKit/WebKit/commit/7a6562592ad86f547316d1324357c80ce3166c7f
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2018-12-23 (Sun, 23 Dec 2018)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/printing/print-with-media-query-destory-expected.txt
    A LayoutTests/printing/print-with-media-query-destory.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/page/Frame.cpp
    M Source/WebCore/page/FrameView.cpp
    M Source/WebCore/page/PrintContext.cpp
    M Source/WebCore/page/PrintContext.h

  Log Message:
  -----------
  Merge r219121 - Synchronous media query evaluation could destroy current Frame/FrameView.
https://bugs.webkit.org/show_bug.cgi?id=192781
<rdar://problem/34416793>

Reviewed by Chris Dumez.

Source/WebCore:

Protect Frame and FrameView when coming back from printing and check if the current Frame/FrameView/FrameLoader objects are still valid.

Test: printing/print-with-media-query-destory.html

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::finishedLoading):
* page/Frame.cpp:
(WebCore::Frame::setPrinting):
* page/FrameView.cpp:
(WebCore::FrameView::forceLayoutForPagination):
* page/PrintContext.cpp:
(WebCore::PrintContext::PrintContext):
(WebCore::PrintContext::computePageRects):
(WebCore::PrintContext::computePageRectsWithPageSizeInternal):
(WebCore::PrintContext::begin):
(WebCore::PrintContext::computeAutomaticScaleFactor):
(WebCore::PrintContext::spoolPage):
(WebCore::PrintContext::spoolRect):
(WebCore::PrintContext::end):
* page/PrintContext.h:
(WebCore::PrintContext::frame const): Deleted.

LayoutTests:

* printing/print-with-media-query-destory-expected.txt: Added.
* printing/print-with-media-query-destory.html: Added.


  Commit: 2b22a29a87d97d8688d9fdb8815179758f617380
      https://github.com/WebKit/WebKit/commit/2b22a29a87d97d8688d9fdb8815179758f617380
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2019-01-14 (Mon, 14 Jan 2019)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/loader/comment-only-javascript-url-expected.txt
    A LayoutTests/fast/loader/comment-only-javascript-url.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/URLUtils.h

  Log Message:
  -----------
  Merge r239642 - Parsed protocol of javascript URLs with embedded newlines and carriage returns do not match parsed protocol in Chrome and Firefox
https://bugs.webkit.org/show_bug.cgi?id=193155
<rdar://problem/40230982>

Reviewed by Chris Dumez.

Source/WebCore:

Test: fast/loader/comment-only-javascript-url.html

Make a special case for URLs beginning with 'javascript:'. We should always
treat these as JS URLs, even if the content contained within the URL
string might match other parts of the URL parsing spec.

* html/URLUtils.h:
(WebCore::URLUtils<T>::protocol const):

LayoutTests:

* fast/loader/comment-only-javascript-url-expected.txt: Added.
* fast/loader/comment-only-javascript-url.html: Added.


  Commit: ba972e06c0d4bb7bd814c5bb854abc9084cfbcc5
      https://github.com/WebKit/WebKit/commit/ba972e06c0d4bb7bd814c5bb854abc9084cfbcc5
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2019-01-14 (Mon, 14 Jan 2019)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/WorkQueue.cpp

  Log Message:
  -----------
  Merge r239873 - WorkQueue::concurrentApply() passes a raw pointer to a temporary String to Thread::create().
https://bugs.webkit.org/show_bug.cgi?id=191350

Reviewed by Brent Fulgham.

The non COCOA version of WorkQueue::concurrentApply() creates a temporary
String for the threadName and passes the raw pointer of this String to
Thread::create(). After freeing this String, Thread::entryPoint() uses
the raw char pointer to internally initialize the thread.

The fix is to use a single literal string for all the threads' names since
they are created for a thread-pool.

* wtf/WorkQueue.cpp:
(WTF::WorkQueue::concurrentApply):


  Commit: 0ca9f959eb69c35bc7166f79e21543ef5e914f71
      https://github.com/WebKit/WebKit/commit/0ca9f959eb69c35bc7166f79e21543ef5e914f71
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2019-01-14 (Mon, 14 Jan 2019)

  Changed paths:
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/Gigacage.cpp

  Log Message:
  -----------
  Merge r239245 - Gigacage runway should immediately follow the primitive cage
https://bugs.webkit.org/show_bug.cgi?id=192733

Reviewed by Saam Barati.

This patch makes sure that the Gigacage runway is always
immediately after the primitive cage. Since writing outside the
primitive gigacage is likely to be more dangerous than the JSValue
cage. The ordering of the cages is still random however.

* bmalloc/Gigacage.cpp:
(Gigacage::ensureGigacage):


  Commit: cac2f6a2d945fe6206965fc6458287071debcac5
      https://github.com/WebKit/WebKit/commit/cac2f6a2d945fe6206965fc6458287071debcac5
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2019-01-14 (Mon, 14 Jan 2019)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/VM.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Gigacage.h
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/BAssert.h
    M Source/bmalloc/bmalloc/Gigacage.cpp
    M Source/bmalloc/bmalloc/Gigacage.h
    M Source/bmalloc/bmalloc/HeapKind.h

  Log Message:
  -----------
  Merge r239787 - Gigacage disabling checks should handle the GIGACAGE_ALLOCATION_CAN_FAIL case properly.
https://bugs.webkit.org/show_bug.cgi?id=193292
<rdar://problem/46485450>

Reviewed by Yusuke Suzuki.

Source/bmalloc:

Previously, when GIGACAGE_ALLOCATION_CAN_FAIL is true, we allow the Gigacage to
be disabled if we fail to allocate memory for it.  However, Gigacage::primitiveGigacageDisabled()
still always assumes that the Gigacage is always enabled after ensureGigacage() is
called.

This patch updates Gigacage::primitiveGigacageDisabled() to allow the Gigacage to
already be disabled if GIGACAGE_ALLOCATION_CAN_FAIL is true and wasEnabled() is
false.

In this patch, we also put the wasEnabled flag in the 0th slot of the
g_gigacageBasePtrs buffer to ensure that it is also protected against writes just
like the Gigacage base pointers.

To achieve this, we do the following:
1. Added a reservedForFlags field in struct BasePtrs.
2. Added a ReservedForFlagsAndNotABasePtr Gigacage::Kind.
3. Added assertions to ensure that the BasePtrs::primitive is at the offset
   matching the offset computed from Gigacage::Primitive.  Ditto for
   BasePtrs::jsValue and Gigacage::JSValue.
4. Added assertions to ensure that Gigacage::ReservedForFlagsAndNotABasePtr is not
   used for fetching a Gigacage base pointer.
5. Added RELEASE_BASSERT_NOT_REACHED() to implement such assertions in bmalloc.

No test added because this issue requires Gigacage allocation to fail in order to
manifest.  I've tested it manually by modifying the code locally to force an
allocation failure.

* bmalloc/BAssert.h:
* bmalloc/Gigacage.cpp:
(Gigacage::ensureGigacage):
(Gigacage::primitiveGigacageDisabled):
* bmalloc/Gigacage.h:
(Gigacage::wasEnabled):
(Gigacage::setWasEnabled):
(Gigacage::name):
(Gigacage::basePtr):
(Gigacage::size):
* bmalloc/HeapKind.h:
(bmalloc::heapKind):

Source/JavaScriptCore:

* runtime/VM.h:
(JSC::VM::gigacageAuxiliarySpace):

Source/WTF:

Update the USE_SYSTEM_MALLOC version of Gigacage.h to match the bmalloc version.

* wtf/Gigacage.h:


  Commit: 081ebcfec93b2163af04bf36a47dbb8d4a47e974
      https://github.com/WebKit/WebKit/commit/081ebcfec93b2163af04bf36a47dbb8d4a47e974
  Author: Ali Juma <ajuma at chromium.org>
  Date:   2019-01-18 (Fri, 18 Jan 2019)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/wpt/fetch/response-opaque-clone.html
    M LayoutTests/imported/w3c/ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/fetch/FetchResponse.cpp

  Log Message:
  -----------
  Merge r240158 - FetchResponse::url should return the empty string for tainted responses
https://bugs.webkit.org/show_bug.cgi?id=193553

Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

* web-platform-tests/fetch/api/basic/mode-no-cors.sub.any.js:
(fetchNoCors):

Source/WebCore:

Check whether the response is tainted in FetchResponse::url, to match
the behavior described in https://fetch.spec.whatwg.org/#concept-filtered-response-opaque.

* Modules/fetch/FetchResponse.cpp:
(WebCore::FetchResponse::url const):

LayoutTests:

* http/wpt/fetch/response-opaque-clone.html:


  Commit: 3ef5923f0c1b3da62262623d603725fd8a2ec83f
      https://github.com/WebKit/WebKit/commit/3ef5923f0c1b3da62262623d603725fd8a2ec83f
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2019-01-28 (Mon, 28 Jan 2019)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/glx/GLContextGLX.cpp

  Log Message:
  -----------
  Merge r239869 - [GTK] Garbled rendering on Youtube while scrolling under X11.
https://bugs.webkit.org/show_bug.cgi?id=192982

Reviewed by Carlos Garcia Campos.

When creating a GLX window context, try to get a GLXFBConfig that has depth and stencil buffers for
the default framebuffer.

* platform/graphics/glx/GLContextGLX.cpp:
(WebCore::compatibleVisuals):
(WebCore::GLContextGLX::createWindowContext):


  Commit: 6831679a12b4f7de08df1ece1e169e349ccf3fb0
      https://github.com/WebKit/WebKit/commit/6831679a12b4f7de08df1ece1e169e349ccf3fb0
  Author: Carlos Eduardo Ramalho <cadubentzen at gmail.com>
  Date:   2019-01-28 (Mon, 28 Jan 2019)

  Changed paths:
    M ChangeLog
    M Source/WebCore/ChangeLog
    M Source/WebKit/ChangeLog

  Log Message:
  -----------
  Merge r238928: REGRESSION(r231043): [GTK] Undefined references to WebCore::LayerRepresentation::* with -DENABLE_OPENGL=OFF builds
https://bugs.webkit.org/show_bug.cgi?id=191997

Patch by Carlos Eduardo Ramalho <cadubentzen at gmail.com> on 2018-12-06
Reviewed by Philippe Normand.

.:

Fix build with -DENABLE_OPENGL=OFF and -DENABLE_VIDEO=OFF

* Source/cmake/OptionsGTK.cmake: make ENABLE_ASYNC_SCROLLING depend on ENABLE_OPENGL

Source/WebCore:

Fix build with -DENABLE_OPENGL=OFF and -DENABLE_VIDEO=OFF.

No new tests required. Only fixing build.

* platform/gtk/PlatformWheelEventGtk.cpp:
(WebCore::PlatformWheelEvent::PlatformWheelEvent): add required #if ENABLE(ASYNC_SCROLLING)

Source/WebKit:

Fix build with -DENABLE_OPENGL=OFF and -DENABLE_VIDEO=OFF.

* Shared/WebEventConversion.cpp:
(WebKit::WebKit2PlatformWheelEvent::WebKit2PlatformWheelEvent): add required #if ENABLE(ASYNC_SCROLLING)


  Commit: 5edc818d1c3eaee278a5d2be41299ff3307eb90f
      https://github.com/WebKit/WebKit/commit/5edc818d1c3eaee278a5d2be41299ff3307eb90f
  Author: Alexander Mikhaylenko <alexm at gnome.org>
  Date:   2019-01-31 (Thu, 31 Jan 2019)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/ScrollAnimationKinetic.cpp

  Log Message:
  -----------
  Merge r240789 - [GTK] Momentum scrolling stops abruptly before websites end
https://bugs.webkit.org/show_bug.cgi?id=193350

Patch by Alexander Mikhaylenko <exalm7659 at gmail.com> on 2019-01-31
Reviewed by Carlos Garcia Campos.

Don't immediately set velocity to 0 when position reaches upper or bottom limit.
Instead, set it to the overshot distance, so that position exactly matches upper
or lower limit on the next frame, and then clamp velocity to 0 using the existing
mechanism.

* platform/ScrollAnimationKinetic.cpp:
(WebCore::ScrollAnimationKinetic::PerAxisData::animateScroll):


  Commit: cf696be1c3456c57c451a7b397ce84340d06f5e5
      https://github.com/WebKit/WebKit/commit/cf696be1c3456c57c451a7b397ce84340d06f5e5
  Author: Claudio Saavedra <csaavedra at igalia.com>
  Date:   2019-02-01 (Fri, 01 Feb 2019)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/scrolling/ScrollingThread.cpp

  Log Message:
  -----------
  Merge r240841 - Race-condition during scrolling thread creation
https://bugs.webkit.org/show_bug.cgi?id=194016

Reviewed by Saam Barati.

There is a threading issue during the initialization
of the scrolling thread caused by createThreadIfNeeded
locking only on the creation of the thread but not on
the initialization of the main loop, making it possible
for a thread to try to spin the main loop before it's
created.

Fix this by unconditionally waiting on the main loop
being created. This makes it necessary to always hold
the lock, even when the thread is already created.

* page/scrolling/ScrollingThread.cpp:
(WebCore::ScrollingThread::createThreadIfNeeded):


  Commit: 7abc340532d25356ee0df54c9712ed168484e0d6
      https://github.com/WebKit/WebKit/commit/7abc340532d25356ee0df54c9712ed168484e0d6
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2019-02-01 (Fri, 01 Feb 2019)

  Changed paths:
    M Source/WebDriver/ChangeLog
    M Source/WebDriver/glib/SessionHostGlib.cpp

  Log Message:
  -----------
  Merge r240778 - [GLIB] WebDriver: race condition when session starts
https://bugs.webkit.org/show_bug.cgi?id=194086

Reviewed by Philippe Normand.

This is causing flakiness in the bots, I can only reproduce it locally when my CPUs are at 100%. The thing
is that sometimes we receive an empty target list right after the connection is established because
RemoteInspector::setClient() calls pushListingsSoon() before a target has been registered. Most of the times the
target is registered before the listing is pushed, but it can happen that when pushed, the listing is still
empty. After the target is registered an empty target list means the connection was lost, so we clear the
connection and target. We need to ensure we do that only after the target has been registered.

* glib/SessionHostGlib.cpp:


  Commit: d7547f4da6b5898450a8b58f010811028b4bc503
      https://github.com/WebKit/WebKit/commit/d7547f4da6b5898450a8b58f010811028b4bc503
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2019-02-01 (Fri, 01 Feb 2019)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake
    M Source/WebKit/SourcesGTK.txt
    M Source/WebKit/SourcesWPE.txt
    A Source/WebKit/UIProcess/API/glib/WebKitVersion.cpp
    R Source/WebKit/UIProcess/API/gtk/WebKitVersion.cpp
    A Source/WebKit/UIProcess/API/wpe/WebKitVersion.h.in
    M Source/WebKit/UIProcess/API/wpe/webkit.h
    M Tools/ChangeLog
    M Tools/MiniBrowser/wpe/main.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestAutomationSession.cpp

  Log Message:
  -----------
  Merge r237541 - [WPE] Add the WebKitVersion.h header
https://bugs.webkit.org/show_bug.cgi?id=191015

Reviewed by Michael Catanzaro.

Source/WebKit:

Add the WebKitVersion.h API header for the WPE port. As with other
headers providing the GLib API, we have to provide a WPE-specific
version, but the implementation file can be shared with the GTK port,
and is moved under the UIProcess/API/glib/ directory accordingly.

* PlatformWPE.cmake:
* SourcesWPE.txt:
* UIProcess/API/glib/WebKitVersion.cpp: Renamed from Source/WebKit/UIProcess/API/gtk/WebKitVersion.cpp.
* UIProcess/API/wpe/WebKitVersion.h.in: Added.
* UIProcess/API/wpe/webkit.h:

Tools:

* MiniBrowser/wpe/main.cpp:
(automationStartedCallback): Remove the FIXME and finally enable the
webkit_application_info_set_version() call.
* TestWebKitAPI/Tests/WebKitGLib/TestAutomationSession.cpp: Remove
this FIXME as well and remove the custom WEBKIT_*_VERSION macros.


  Commit: ba0c31f7fc01e85132dafa7124722bd6547ee6c6
      https://github.com/WebKit/WebKit/commit/ba0c31f7fc01e85132dafa7124722bd6547ee6c6
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2019-02-01 (Fri, 01 Feb 2019)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp
    M Source/WebKit/UIProcess/API/gtk/WebKitWebViewBasePrivate.h
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStore.h
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.h
    M Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp
    M Source/WebKit/UIProcess/gtk/WaylandCompositor.h
    M Source/WebKit/UIProcess/gtk/WebPageProxyGtk.cpp

  Log Message:
  -----------
  Merge r240712 - [GTK] gdk_cairo_draw_from_gl() in AcceleratedBackingStoreWayland fails in GtkInspector's magnifier
https://bugs.webkit.org/show_bug.cgi?id=193903

Reviewed by Michael Catanzaro.

The problem is that the GL context used by WaylandCompositor can't share resources with the one used by GTK+
when painting with gdk_cairo_draw_from_gl(). Accelerated compositing in Wayland works only because
WaylandCompositor makes the context current only once on initialization. So, when we render the first frame on
accelerated compositing mode, GTK+ is rendering in non-GL mode, and switches to the GL mode when
gdk_cairo_draw_from_gl() is called. Since GTK+ didn't have a GL context yet, the first frame is always rendered
by GTK+ using the software fallback (glReadPixels). The thing is that the first time gdk_cairo_draw_from_gl() is
called, GTK+ creates a GL context for painting that is made current, and it will remain the current one
forever. The first frame fails to render with "GL_INVALID_OPERATION in glBindTexture(non-gen name)" because the
texture created in WaylandCompositor GL context can't be accessed from GTK+ GL context. The following frames are
handled with the GTK+ GL context. I would say this works by casuality and it could be the cause of other
accelerated compositing issues in Wayland.

We need to create our own GdkGLContext for the WebView, and use that in the WaylandCompositor. When the
GdkGLContext is created, the GTK+ GL context for painting is used as a shared context, ensuring that resources
created in the new context will be accessible from the painting one.

* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseMakeGLContextCurrent): Call AcceleratedBackingStore::makeContextCurrent().
* UIProcess/API/gtk/WebKitWebViewBasePrivate.h:
* UIProcess/WebPageProxy.h:
* UIProcess/gtk/AcceleratedBackingStore.h:
(WebKit::AcceleratedBackingStore::makeContextCurrent): New virtual method only implemented by Wayland backend.
* UIProcess/gtk/AcceleratedBackingStoreWayland.cpp:
(WebKit::AcceleratedBackingStoreWayland::tryEnsureGLContext): Try to create a GL context with
gdk_window_create_gl_context(), falling back to a WebCore::GLContext if it fails or GTK+ version is not new enough.
(WebKit::AcceleratedBackingStoreWayland::makeContextCurrent): Make the GL context current.
(WebKit::AcceleratedBackingStoreWayland::paint): Check if we have a GdkGLContext before trying to use gdk_cairo_draw_from_gl().
(WebKit::AcceleratedBackingStoreWayland::canGdkUseGL const): Deleted.
* UIProcess/gtk/AcceleratedBackingStoreWayland.h:
* UIProcess/gtk/WaylandCompositor.cpp:
(WebKit::WaylandCompositor::Surface::Surface): Move the texture creation to setWebPage(), since we need the
WebView GL context.
(WebKit::WaylandCompositor::Surface::~Surface): Move the code to destroy GL resources to setWebPage().
(WebKit::WaylandCompositor::Surface::setWebPage): Create the texture when a new page is set and destroy GL
resources when unset.
(WebKit::WaylandCompositor::Surface::prepareTextureForPainting): Make WebView GL context current.
(WebKit::WaylandCompositor::Surface::commit): Ditto.
(WebKit::WaylandCompositor::initializeEGL): Use a temporary GLContext.
* UIProcess/gtk/WaylandCompositor.h:
* UIProcess/gtk/WebPageProxyGtk.cpp:
(WebKit::WebPageProxy::makeGLContextCurrent): Call webkitWebViewBaseMakeGLContextCurrent().


  Commit: fb05ef2bbb26c4a41745f0313f348dd54a28d818
      https://github.com/WebKit/WebKit/commit/fb05ef2bbb26c4a41745f0313f348dd54a28d818
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2019-02-01 (Fri, 01 Feb 2019)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp

  Log Message:
  -----------
  Merge r240723 - [GTK][Wayland] REGRESSION(r240712): Clear the GL context if it's the current one on dispose
https://bugs.webkit.org/show_bug.cgi?id=194024

Patch by Carlos Garcia Campos <cgarcia at igalia.com> on 2019-01-30
Reviewed by Michael Catanzaro.

Fixes a crash in gdk_gl_context_dispose().

* UIProcess/gtk/AcceleratedBackingStoreWayland.cpp:
(WebKit::AcceleratedBackingStoreWayland::~AcceleratedBackingStoreWayland):


  Commit: 2de9a60e58f62e4cb1967f1bc00200ac27631fcf
      https://github.com/WebKit/WebKit/commit/2de9a60e58f62e4cb1967f1bc00200ac27631fcf
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-08 (Fri, 08 Feb 2019)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsGTK.cmake
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Release WebKitGTK+ 2.22.6 and WPE WebKit 2.22.4

.:

* Source/cmake/OptionsGTK.cmake: Bump version to 2.22.6
* Source/cmake/OptionsWPE.cmake: Bump version to 2.22.4

Source/WebKit:

* gtk/NEWS: Add release notes for 2.22.6
* wpe/NEWS: Add release notes for 2.22.4


  Commit: 793d4ed1e1df0c82ec01067b251ad3eee30c5a77
      https://github.com/WebKit/WebKit/commit/793d4ed1e1df0c82ec01067b251ad3eee30c5a77
  Author: Pablo Saavedra <psaavedra at igalia.com>
  Date:   2019-02-16 (Sat, 16 Feb 2019)

  Changed paths:
    M Tools/ChangeLog
    A Tools/gstreamer/patches/gst-plugins-good-0007-matroskademux-Allow-Matroska-headers-to-be-read-more.patch
    A Tools/gstreamer/patches/gst-plugins-good-0008-matroskademux-Refactor-track-parsing-out-from-adding.patch
    A Tools/gstreamer/patches/gst-plugins-good-0009-matroskademux-Parse-successive-Tracks-elements.patch
    M Tools/gstreamer/patches/gst-plugins-good-0010-matroskademux-Emit-no-more-pads-after-parsing-Tracks.patch

  Log Message:
  -----------
  [GTK] Update-webkitgtk-libs for Webkit GTK 2.22 can not be generated anymore
https://bugs.webkit.org/show_bug.cgi?id=194744

Patch by Pablo Saavedra <psaavedra at igalia.com> on 2019-02-16
Reviewed by Philippe Normand.

* gstreamer/patches/gst-plugins-good-0007-matroskademux-Allow-Matroska-headers-to-be-read-more.patch: Added.
* gstreamer/patches/gst-plugins-good-0008-matroskademux-Refactor-track-parsing-out-from-adding.patch: Added.
* gstreamer/patches/gst-plugins-good-0009-matroskademux-Parse-successive-Tracks-elements.patch: Added.


  Commit: d401f62e975f2ff095ea14e11ded7c71122df137
      https://github.com/WebKit/WebKit/commit/d401f62e975f2ff095ea14e11ded7c71122df137
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-22 (Fri, 22 Feb 2019)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGDoesGC.cpp

  Log Message:
  -----------
  Merged r241753 - Fix DFG doesGC() for CompareEq/Less/LessEq/Greater/GreaterEq and CompareStrictEq nodes.
https://bugs.webkit.org/show_bug.cgi?id=194800
<rdar://problem/48183773>

Reviewed by Yusuke Suzuki.

Fix doesGC() for the following nodes:

    CompareEq:
    CompareLess:
    CompareLessEq:
    CompareGreater:
    CompareGreaterEq:
    CompareStrictEq:
        Only return false (i.e. does not GC) for child node use kinds that have
        been vetted to not do anything that can GC.  For all other use kinds
        (including StringUse and BigIntUse), we return true (i.e. does GC).

* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):


  Commit: 79f9a90fc3b272c8e9211e9c6eba1d4e73b28d15
      https://github.com/WebKit/WebKit/commit/79f9a90fc3b272c8e9211e9c6eba1d4e73b28d15
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-22 (Fri, 22 Feb 2019)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/FontCairoHarfbuzzNG.cpp

  Log Message:
  -----------
  Merged r241402 - [FreeType] Unable to render some Hebrew characters
https://bugs.webkit.org/show_bug.cgi?id=194498

Reviewed by Michael Catanzaro.

We are failing to find a font for some of the combining character sequences because normalization is failing due
to overflow error. In case of overflow, normalize returns the required length for the normalized characters, so
we should handle that case to resize the output buffer and try again.

* platform/graphics/cairo/FontCairoHarfbuzzNG.cpp:
(WebCore::FontCascade::fontForCombiningCharacterSequence const):


  Commit: eed44b42d741c2d6ff6839bc25f88d76a3ec2019
      https://github.com/WebKit/WebKit/commit/eed44b42d741c2d6ff6839bc25f88d76a3ec2019
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/check-in-bounds-should-be-a-child-use.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h
    M Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
    M Source/JavaScriptCore/dfg/DFGClobberize.h
    M Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp
    M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
    M Source/JavaScriptCore/dfg/DFGIntegerCheckCombiningPhase.cpp
    M Source/JavaScriptCore/dfg/DFGIntegerRangeOptimizationPhase.cpp
    M Source/JavaScriptCore/dfg/DFGNodeType.h
    M Source/JavaScriptCore/dfg/DFGSSALoweringPhase.cpp
    M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
    M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

  Log Message:
  -----------
  Merged r241228 - Nodes that rely on being dominated by CheckInBounds should have a child edge to it
https://bugs.webkit.org/show_bug.cgi?id=194334
<rdar://problem/47844327>

Reviewed by Mark Lam.

JSTests:

* stress/check-in-bounds-should-be-a-child-use.js: Added.
(func):

Source/JavaScriptCore:

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGArgumentsEliminationPhase.cpp:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGConstantFoldingPhase.cpp:
(JSC::DFG::ConstantFoldingPhase::foldConstants):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
(JSC::DFG::FixupPhase::convertToHasIndexedProperty):
* dfg/DFGIntegerCheckCombiningPhase.cpp:
(JSC::DFG::IntegerCheckCombiningPhase::handleBlock):
* dfg/DFGIntegerRangeOptimizationPhase.cpp:
* dfg/DFGNodeType.h:
* dfg/DFGSSALoweringPhase.cpp:
(JSC::DFG::SSALoweringPhase::lowerBoundsCheck):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileHasIndexedProperty):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCheckInBounds):
(JSC::FTL::DFG::LowerDFGToB3::compileHasIndexedProperty):


  Commit: b81156ce92c9332b0527af29366cc8ce4b37db8b
      https://github.com/WebKit/WebKit/commit/b81156ce92c9332b0527af29366cc8ce4b37db8b
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/accessibility/aria-hidden-update.html
    M LayoutTests/accessibility/aria-hidden-updates-alldescendants.html
    M LayoutTests/accessibility/image-load-on-delay.html
    M LayoutTests/accessibility/mac/aria-hidden-changes-for-non-ignored-elements.html
    M LayoutTests/accessibility/removed-anonymous-block-child-causes-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/accessibility/AXObjectCache.h
    M Source/WebCore/accessibility/AccessibilityObject.cpp
    M Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperBase.mm

  Log Message:
  -----------
  Merged r241289 - AXObjectCache::childrenChanged shouldn't update layout or style during another style recalc
https://bugs.webkit.org/show_bug.cgi?id=182280
<rdar://problem/37018386>

Reviewed by Alan Bujtas.

Source/WebCore:

Remove the possibility that changing children calls back into updating layout by
handling children changes in a deferred manner.

This follows the same architecture as many other deferred changes, but also requires us to check deferred changes
in updateBackingStore, because things like aria-hidden changes won't trigger a layout, but will require us to update children.

A few tests had to be modified to no longer change the tree and then check the children immediately.

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::remove):
(WebCore::AXObjectCache::childrenChanged):
(WebCore::AXObjectCache::prepareForDocumentDestruction):
(WebCore::AXObjectCache::performDeferredCacheUpdate):
* accessibility/AXObjectCache.h:
* accessibility/AccessibilityObject.cpp:
(WebCore::AccessibilityObject::updateBackingStore):
* accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
(convertToNSArray):
(-[WebAccessibilityObjectWrapperBase updateObjectBackingStore]):

LayoutTests:

* accessibility/aria-hidden-update.html:
* accessibility/aria-hidden-updates-alldescendants.html:
* accessibility/image-load-on-delay.html:
* accessibility/mac/aria-hidden-changes-for-non-ignored-elements.html:
* accessibility/removed-anonymous-block-child-causes-crash.html:


  Commit: 18ab8999e947213c05f2b9e883ee5b54d714ffd9
      https://github.com/WebKit/WebKit/commit/18ab8999e947213c05f2b9e883ee5b54d714ffd9
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/mac/fast/loader/webarchive-encoding-respected.html
    M LayoutTests/webarchive/loading/cache-expired-subresource.html
    M LayoutTests/webarchive/loading/javascript-url-iframe-crash.html
    M LayoutTests/webarchive/loading/mainresource-null-mimetype-crash.html
    M LayoutTests/webarchive/loading/missing-data.html
    M LayoutTests/webarchive/loading/object.html
    M LayoutTests/webarchive/loading/test-loading-archive-subresource-null-mimetype.html
    M LayoutTests/webarchive/loading/test-loading-archive-subresource.html
    M LayoutTests/webarchive/loading/test-loading-archive.html
    M LayoutTests/webarchive/loading/test-loading-top-archive.html
    M LayoutTests/webarchive/loading/video-in-webarchive.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.h
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/loader/DocumentLoader.h
    M Source/WebCore/loader/FrameLoadRequest.h
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/loader/FrameLoader.h
    M Source/WebCore/page/DragController.cpp
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/Internals.idl
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
    A Tools/TestWebKitAPI/Tests/mac/LoadWebArchive.mm
    A Tools/TestWebKitAPI/Tests/mac/helloworld.webarchive
    A Tools/TestWebKitAPI/Tests/mac/load-web-archive-1.html
    A Tools/TestWebKitAPI/Tests/mac/load-web-archive-2.html
    M Tools/TestWebKitAPI/cocoa/DragAndDropSimulator.h
    M Tools/TestWebKitAPI/ios/DragAndDropSimulatorIOS.mm
    M Tools/TestWebKitAPI/mac/DragAndDropSimulatorMac.mm

  Log Message:
  -----------
  Merged r241480 - Further restricting webarchive loads
https://bugs.webkit.org/show_bug.cgi?id=194567
<rdar://problem/47610130>

Reviewed by Youenn Fablet.

Source/WebCore:

This patch futher restricts main frame webarchive loads to the followings:
1) loaded by clients;
2) loaded by drag;
3) reloaded from any of the previous two.

It moves setAlwaysAllowLocalWebarchive, which is used for testing only, from Document
to FrameLoader such that the option is remembered during redirections.

Covered by API tests.

* dom/Document.h:
(WebCore::Document::setAlwaysAllowLocalWebarchive): Deleted.
(WebCore::Document::alwaysAllowLocalWebarchive const): Deleted.
* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::disallowWebArchive const):
* loader/DocumentLoader.h:
(WebCore::DocumentLoader::setAllowsWebArchiveForMainFrame):
(WebCore::DocumentLoader::allowsWebArchiveForMainFrame):
* loader/FrameLoadRequest.h:
(WebCore::FrameLoadRequest::setIsRequestFromClientOrUserInput):
(WebCore::FrameLoadRequest::isRequestFromClientOrUserInput):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::load):
(WebCore::FrameLoader::reload):
* loader/FrameLoader.h:
(WebCore::FrameLoader::setAlwaysAllowLocalWebarchive):
(WebCore::FrameLoader::alwaysAllowLocalWebarchive const):
* page/DragController.cpp:
(WebCore::DragController::performDragOperation):
* testing/Internals.cpp:
(WebCore::Internals::setAlwaysAllowLocalWebarchive const):
* testing/Internals.h:
* testing/Internals.idl:

Source/WebKit:

* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::loadRequest):
Set a flag to indicate a load is started from clients.

Tools:

Besides adding API tests, this patch also enhances DragAndDropSimulator to allow
navigations on drop.

* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/mac/LoadWebArchive.mm: Added.
(-[TestLoadWebArchiveNavigationDelegate webView:didFinishNavigation:]):
(-[TestLoadWebArchiveNavigationDelegate webView:didFailProvisionalNavigation:withError:]):
(-[TestLoadWebArchiveNavigationDelegate webView:createWebViewWithConfiguration:forNavigationAction:windowFeatures:]):
(TestWebKitAPI::TEST):
* TestWebKitAPI/Tests/mac/helloworld.webarchive: Added.
* TestWebKitAPI/Tests/mac/load-web-archive-1.html: Added.
* TestWebKitAPI/Tests/mac/load-web-archive-2.html: Added.
* TestWebKitAPI/cocoa/DragAndDropSimulator.h:
* TestWebKitAPI/mac/DragAndDropSimulatorMac.mm:
(-[DragAndDropSimulator initWithWebViewFrame:configuration:]):
(-[DragAndDropSimulator _webView:dragDestinationActionMaskForDraggingInfo:]):

LayoutTests:

* platform/mac/fast/loader/webarchive-encoding-respected.html:
* webarchive/loading/cache-expired-subresource.html:
* webarchive/loading/javascript-url-iframe-crash.html:
* webarchive/loading/mainresource-null-mimetype-crash.html:
* webarchive/loading/missing-data.html:
* webarchive/loading/object.html:
* webarchive/loading/test-loading-archive-subresource-null-mimetype.html:
* webarchive/loading/test-loading-archive-subresource.html:
* webarchive/loading/test-loading-archive.html:
* webarchive/loading/test-loading-top-archive.html:
* webarchive/loading/video-in-webarchive.html:


  Commit: 785db0b79fb069072fc80c877a2e4c80042638ce
      https://github.com/WebKit/WebKit/commit/785db0b79fb069072fc80c877a2e4c80042638ce
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/platform/ThreadTimers.cpp
    M Source/WebCore/platform/ThreadTimers.h
    M Source/WebCore/platform/Timer.cpp
    M Source/WebCore/platform/Timer.h

  Log Message:
  -----------
  Merged r239814 - ThreadTimers should not store a raw pointer in its heap
https://bugs.webkit.org/show_bug.cgi?id=192975
<rdar://problem/46893946>

Reviewed by Geoffrey Garen.

Right now, ThreadTimers's heap data structure stores a raw pointer to TimerBase. In order to harden the timer code,
this patch replaces it with ThreadTimerHeapItem, a newly introduced struct, which effectively acks like
WeakReference<TimerBase*> as the timer heap and TimerBase both store RefPtr to it, and TimerBase's destructor clears
the raw pointer back to TimerBase*.

This approach was taken instead of an out-right adoptation of WeakPtr since the heap data structure requires each node
in the heap to have a fixed "priority" yet WeakPtr with no valid pointer back to TimerBase would effectively lose its
"priority" thereby corrupting the heap data structure. That is, each item in the heap must remember its fire time and
insertion order even when the underlying TimerBase had gone away (this should never happen but the whole point of this
hardening is to make it work even in the precense of such a bug).

This patch also moves the heap index in TimerBase to ThreadTimerHeapItem, and replaces the pointer to the heap vector
in TimerBase by a reference to ThreadTimers in ThreadTimerHeapItem. Note that ThreadTimers is a per-thread singleton.

The correctness of this hardening was tested by commenting out the call to stop() and !isInHeap() assertion in
TimerBase::~TimerBase() as well as the !isInHeap() assertion in ThreadTimerHeapItem::clearTimer() and observing that
layout tests run successfully without hitting any debug assertions.

No new tests since there should be no observable behavior difference.

* WebCore.xcodeproj/project.pbxproj: Export ThreadTimers.h as a private header since it's now included in Timer.h
* platform/ThreadTimers.cpp:
(WebCore::ThreadTimers::updateSharedTimer): Delete ThreadTimerHeapItem's with nullptr TimerBase* (TimerBase had
already been deleted). This should only happen when TimerBase's destructor failed to remove itself from the timer heap,
which should never happen.
(WebCore::ThreadTimers::sharedTimerFiredInternal): Ditto. Also removed the redundant code which had removed the timer
from the heap since setNextFireTime does the removal already.
* platform/ThreadTimers.h: Outdented the whole file.
(WebCore::ThreadTimers::timerHeap): We use Vector<RefPtr<ThreadTimerHeapItem>> instead of Vector<Ref<~>> since Ref<~>
doesn't have a copy constructor which is used by std::push_heap.
(WebCore::ThreadTimerHeapItem): Added.
(WebCore::ThreadTimerHeapItem::hasTimer const): Added.
(WebCore::ThreadTimerHeapItem::setNotInHeap): Added. ThreadTimerHeapItem uses unsigned -1 as the single value which
signifies the item not being in the heap instead of all negative values as in the old code in TimerBase.
(WebCore::ThreadTimerHeapItem::isInHeap const): Added.
(WebCore::ThreadTimerHeapItem::isFirstInHeap const): Added.
(WebCore::ThreadTimerHeapItem::timer): Added.
(WebCore::ThreadTimerHeapItem::clearTimer): Added.
(WebCore::ThreadTimerHeapItem::heapIndex const): Added.
(WebCore::ThreadTimerHeapItem::setHeapIndex): Added.
(WebCore::ThreadTimerHeapItem::timerHeap const): Added.
* platform/Timer.cpp:
(WebCore::threadGlobalTimerHeap): This function is now only used in assertions.
(WebCore::ThreadTimerHeapItem::ThreadTimerHeapItem): Added.
(WebCore::ThreadTimerHeapItem::create): Added.
(WebCore::TimerHeapPointer::TimerHeapPointer):
(WebCore::TimerHeapPointer::operator-> const):
(WebCore::TimerHeapReference::TimerHeapReference): Added a copy constructor.
(WebCore::TimerHeapReference::copyRef const): Added.
(WebCore::TimerHeapReference::operator RefPtr<ThreadTimerHeapItem>& const):
(WebCore::TimerHeapPointer::operator* const):
(WebCore::TimerHeapReference::operator=): Use move assignment operator.
(WebCore::TimerHeapReference::swapWith):
(WebCore::TimerHeapReference::updateHeapIndex): Extracted to share code between two verions of operator=.
(WebCore::swap):
(WebCore::TimerHeapIterator::TimerHeapIterator):
(WebCore::TimerHeapIterator::operator-> const):
(WebCore::TimerHeapLessThanFunction::compare): Added variants which take RefPtr<ThreadTimerHeapItem>.
(WebCore::TimerHeapLessThanFunction::operator() const):
(WebCore::TimerBase::TimerBase):
(WebCore::TimerBase::~TimerBase):Clear the raw pointer in ThreadTimerHeapItem.
(WebCore::TimerBase::stop):
(WebCore::TimerBase::nextFireInterval const):
(WebCore::TimerBase::checkHeapIndex const): Added the consistency check for other items in the heap.
(WebCore::TimerBase::checkConsistency const):
(WebCore::TimerBase::heapDecreaseKey):
(WebCore::TimerBase::heapDelete):
(WebCore::TimerBase::heapDeleteMin):
(WebCore::TimerBase::heapIncreaseKey):
(WebCore::TimerBase::heapInsert):
(WebCore::TimerBase::heapPop):
(WebCore::TimerBase::heapPopMin):
(WebCore::TimerBase::heapDeleteNullMin): Added. Used to delete ThreadTimerHeapItem which no longer has a valid TimerBase.
(WebCore::parentHeapPropertyHolds):
(WebCore::childHeapPropertyHolds):
(WebCore::TimerBase::hasValidHeapPosition const):
(WebCore::TimerBase::updateHeapIfNeeded): Tweaked the heap index assertion as heapIndex() itself would assert when called
on an item with an invalid (-1) heap index.
(WebCore::TimerBase::setNextFireTime): Create ThreadTimerHeapItem. Note m_heapItem is never cleared until this TimerBase
is deleted.
(WebCore::TimerHeapReference::operator TimerBase* const): Deleted.
* platform/Timer.h:
(WebCore::TimerBase): Replaced m_nextFireTime, m_heapIndex, m_heapInsertionOrder, and m_cachedThreadGlobalTimerHeap
by m_heapItem, RefPtr to an ThreadTimerHeapItem.
(WebCore::TimerBase::augmentFireInterval):
(WebCore::TimerBase::inHeap const):
(WebCore::TimerBase::nextFireTime const):
(WebCore::TimerBase::isActive const):
(WebCore::TimerBase:: const): Deleted.


  Commit: d1e98f7c1a9b23ee65c0383e78e567724de96fae
      https://github.com/WebKit/WebKit/commit/d1e98f7c1a9b23ee65c0383e78e567724de96fae
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/Timer.cpp

  Log Message:
  -----------
  Merged r227934 - Add a release assertion to ensure timers are deleted in the right thread
https://bugs.webkit.org/show_bug.cgi?id=182351

Reviewed by David Kilzer.

Added a relese assertion in ~TimerBase that the current thread is the one in which the timer was created.

We use canAccessThreadLocalDataForThread for this purpose since the condition is more complicated
when WebThread is being used.

* platform/Timer.cpp:
(WebCore::TimerBase::~TimerBase): Added the assertion.
* platform/Timer.h:
(WebCore::TimerBase::m_thread): Always store the current thread in a timer.


  Commit: dcbe24dcc409b900205ecfac60a57e51b5e8170f
      https://github.com/WebKit/WebKit/commit/dcbe24dcc409b900205ecfac60a57e51b5e8170f
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/dom/timer-destruction-during-firing-expected.txt
    A LayoutTests/fast/dom/timer-destruction-during-firing.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/DOMTimer.cpp

  Log Message:
  -----------
  Merged r241499 - Crash in DOMTimer::fired
https://bugs.webkit.org/show_bug.cgi?id=194638

Reviewed by Brent Fulgham.

Source/WebCore:

This patch continues the saga of hunting down timer related crashes after r239814, r225985, r227934.

The crash was caused by the bug that we don't remove a DOMTimer from NestedTimersMap if a DOMTimer
is created & installed inside another DOMTimer's callback (via execute call in DOMTimer::fired).

Fixed the crash by using a Ref in NestedTimersMap. This will keep the timer alive until we exit
from DOMTimer::fired. Because DOMTimer::fired always calls stopTracking() which clears the map
we would not leak these DOM timers.

We could, alternatively, use WeakPtr in NestedTimersMap but that would unnecessarily increase the
size of DOMTimer for a very marginal benefit of DOMTimer objcets being deleted slightly earlier.
Deleting itself in DOMTimer's destructor involves more logic & house keeping in the timer code,
and is no longer the preferred approach when dealing with these classes of bugs in WebKit.

Test: fast/dom/timer-destruction-during-firing.html

* page/DOMTimer.cpp:
(WebCore::NestedTimersMap::add):
(WebCore::DOMTimer::install):
(WebCore::DOMTimer::fired):

LayoutTests:

Added a regression test. It needs debug assertions without the fix.

* fast/dom/timer-destruction-during-firing-expected.txt: Added.
* fast/dom/timer-destruction-during-firing.html: Added.


  Commit: 147ce9ab84e751f63e9f15156aa54ba14b8e6928
      https://github.com/WebKit/WebKit/commit/147ce9ab84e751f63e9f15156aa54ba14b8e6928
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/ios/DragAndDropSimulatorIOS.mm

  Log Message:
  -----------
  Merged r241553 - Unreviewed, build fix after r241480

* TestWebKitAPI/ios/DragAndDropSimulatorIOS.mm:
(-[DragAndDropSimulator initWithWebViewFrame:configuration:]):
(-[DragAndDropSimulator initWithWebView:]):


  Commit: 38c436ccaa52f41834e421edee1aa8aa6116f7fe
      https://github.com/WebKit/WebKit/commit/38c436ccaa52f41834e421edee1aa8aa6116f7fe
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regexp-replace-double-watchpoint.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/dfg/DFGCommonData.cpp
    M Source/JavaScriptCore/dfg/DFGCommonData.h

  Log Message:
  -----------
  Merged r241613 - [JSC] CodeBlock::jettison should clear related watchpoints
https://bugs.webkit.org/show_bug.cgi?id=194544

Reviewed by Mark Lam.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::jettison):
* dfg/DFGCommonData.h:
(JSC::DFG::CommonData::clearWatchpoints): Added.
* dfg/CommonData.cpp:
(JSC::DFG::CommonData::clearWatchpoints): Added.


  Commit: e39de49c36fb55f865bac39e9d84ad98e00e5810
      https://github.com/WebKit/WebKit/commit/e39de49c36fb55f865bac39e9d84ad98e00e5810
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js
    A JSTests/stress/type-profiler-with-double-quote-in-constructor-name.js
    A JSTests/stress/type-profiler-with-double-quote-in-field-name.js
    A JSTests/stress/type-profiler-with-double-quote-in-optional-field-name.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/SamplingProfiler.cpp
    M Source/JavaScriptCore/runtime/TypeSet.cpp

  Log Message:
  -----------
  Merged r241615 - SamplingProfiler::stackTracesAsJSON() should escape strings.
https://bugs.webkit.org/show_bug.cgi?id=194649
<rdar://problem/48072386>

Reviewed by Saam Barati.

JSTests:

* stress/sampling-profiler-stack-trace-with-double-quote-in-function-name.js: Added.
* stress/type-profiler-with-double-quote-in-constructor-name.js: Added.
* stress/type-profiler-with-double-quote-in-field-name.js: Added.
* stress/type-profiler-with-double-quote-in-optional-field-name.js: Added.

Source/JavaScriptCore:

Ditto for TypeSet::toJSONString() and TypeSet::toJSONString().

* runtime/SamplingProfiler.cpp:
(JSC::SamplingProfiler::stackTracesAsJSON):
* runtime/TypeSet.cpp:
(JSC::TypeSet::toJSONString const):
(JSC::StructureShape::toJSONString const):


  Commit: e508d654979d6ccd44bae0f9cead62836c5fd5d2
      https://github.com/WebKit/WebKit/commit/e508d654979d6ccd44bae0f9cead62836c5fd5d2
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/mac-wk1/TestExpectations
    A LayoutTests/plugins/unsupported-plugin-with-replacement-in-iframe-crash-expected.txt
    A LayoutTests/plugins/unsupported-plugin-with-replacement-in-iframe-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLPlugInElement.cpp

  Log Message:
  -----------
  Merged r241626 - Crash in the hit testing code via HTMLPlugInElement::isReplacementObscured()
https://bugs.webkit.org/show_bug.cgi?id=194691

Reviewed by Simon Fraser.

Source/WebCore:

The crash was caused by HTMLPlugInElement::isReplacementObscured updating the document
without updating the layout of ancestor documents (i.e. documents in which frame owner
elements appear) even though it hit-tests against the top-level document's RenderView.

Fixed the bug by updating the layout of the top-level document as needed.

Test: plugins/unsupported-plugin-with-replacement-in-iframe-crash.html

* html/HTMLPlugInElement.cpp:
(WebCore::HTMLPlugInElement::isReplacementObscured):

LayoutTests:

Added a regression test. It hits the newly added debug assertion without the fix.

* platform/mac-wk1/TestExpectations: Skip the test since DumpRenderTree doesn't support
testRunner.setPluginSupportedMode.
* plugins/unsupported-plugin-with-replacement-in-iframe-crash-expected.txt: Added.
* plugins/unsupported-plugin-with-replacement-in-iframe-crash.html: Added.


  Commit: 3b4bc225f65f4bd4d5544fda8ce484220287056a
      https://github.com/WebKit/WebKit/commit/3b4bc225f65f4bd4d5544fda8ce484220287056a
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-02-24 (Sun, 24 Feb 2019)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regexp-unicode-within-string.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/yarr/YarrJIT.cpp

  Log Message:
  -----------
  Merged r241634 - RELEASE_ASSERT at com.apple.JavaScriptCore: JSC::jsSubstringOfResolved
https://bugs.webkit.org/show_bug.cgi?id=194558

Reviewed by Saam Barati.

JSTests:

New regression test.

* stress/regexp-unicode-within-string.js: Added.

Source/JavaScriptCore:

Added an in bounds check before the read of the next character for Unicode regular expressions
for pattern generation that didn't already have such checks.

* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
(JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
(JSC::Yarr::YarrGenerator::generateCharacterClassOnce):
(JSC::Yarr::YarrGenerator::generateCharacterClassFixed):


  Commit: fbdd684ccf115a9829f4a00dc9c79e96bdaa8a7f
      https://github.com/WebKit/WebKit/commit/fbdd684ccf115a9829f4a00dc9c79e96bdaa8a7f
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2019-03-01 (Fri, 01 Mar 2019)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsGTK.cmake
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Release WebKitGTK 2.22.7 and WPE WebKit 2.22.5

.:

* Source/cmake/OptionsGTK.cmake: Bump version to 2.22.7
* Source/cmake/OptionsWPE.cmake: Bump version to 2.22.5

Source/WebKit:

* gtk/NEWS: Add release notes for 2.22.7
* wpe/NEWS: Add release notes for 2.22.5


Compare: https://github.com/WebKit/WebKit/compare/fc77c1dc99ea%5E...fbdd684ccf11


More information about the webkit-changes mailing list