[webkit-changes] [WebKit/WebKit] b91749: Branch WebKitGTK for 2.28

[Michael Catanzaro]

  Branch: refs/heads/webkitgtk/2.28
  Home:   https://github.com/WebKit/WebKit
  Commit: b91749d85f52e3afb2a608e856590baed2b5c1f9
      https://github.com/WebKit/WebKit/commit/b91749d85f52e3afb2a608e856590baed2b5c1f9
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-02-04 (Tue, 04 Feb 2020)

  Changed paths:

  Log Message:
  -----------
  Branch WebKitGTK for 2.28


  Commit: 2921112c793951ae9dfa1c4e0c47afbf5728e168
      https://github.com/WebKit/WebKit/commit/2921112c793951ae9dfa1c4e0c47afbf5728e168
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-02-04 (Tue, 04 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp

  Log Message:
  -----------
  Unreviewed. [GTK] Add an env var to force single process model

WEBKIT_USE_SINGLE_WEB_PROCESS=1 can be used to force the single process model when PSON is disabled. This is a
temporary solution for applications still depending on the single process mode behavior. It will be only
available in 2.28 series.

* UIProcess/API/glib/WebKitWebContext.cpp:
(webkitWebContextConstructed):


  Commit: 5dab639578eab40b4b5434f0edfff4e85b2fd962
      https://github.com/WebKit/WebKit/commit/5dab639578eab40b4b5434f0edfff4e85b2fd962
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    M LayoutTests/fullscreen/full-screen-enabled-expected.txt
    M LayoutTests/fullscreen/full-screen-enabled-prefixed-expected.txt
    M LayoutTests/fullscreen/full-screen-iframe-not-allowed-expected.txt
    M LayoutTests/fullscreen/full-screen-iframe-without-allow-attribute-allowed-from-parent-expected.txt
    M LayoutTests/fullscreen/full-screen-restrictions-expected.txt
    M LayoutTests/http/tests/fullscreen/fullscreen-feature-policy-expected.txt
    M LayoutTests/http/tests/media/media-stream/enumerate-devices-iframe-allow-attribute-expected.txt
    M LayoutTests/http/tests/media/media-stream/get-display-media-iframe-allow-attribute-expected.txt
    M LayoutTests/http/tests/media/media-stream/get-display-media-iframe-allow-attribute.html
    M LayoutTests/http/tests/ssl/media-stream/get-user-media-different-host-expected.txt
    M LayoutTests/http/tests/ssl/media-stream/get-user-media-nested-expected.txt
    A LayoutTests/http/tests/webrtc/enumerateDevicesInFrames-expected.txt
    A LayoutTests/http/tests/webrtc/enumerateDevicesInFrames.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-default-feature-policy.https-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/mediacapture-streams/MediaStream-feature-policy-none.https-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediastream/MediaDevices.cpp
    M Source/WebCore/Modules/mediastream/MediaDevices.h
    M Source/WebCore/Modules/mediastream/UserMediaController.cpp
    M Source/WebCore/Modules/mediastream/UserMediaController.h
    M Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
    M Source/WebCore/html/FeaturePolicy.cpp
    M Source/WebCore/html/FeaturePolicy.h
    M Source/WebCore/page/DOMWindow.cpp
    M Source/WebCore/page/DOMWindow.h

  Log Message:
  -----------
  Merge r255668 - MediaDevices should handle changes of iframe allow attribute value
https://bugs.webkit.org/show_bug.cgi?id=207112

Reviewed by Eric Carlson.

LayoutTests/imported/w3c:

* web-platform-tests/mediacapture-streams/MediaStream-default-feature-policy.https-expected.txt:
* web-platform-tests/mediacapture-streams/MediaStream-feature-policy-none.https-expected.txt:

Source/WebCore:

MediaDevices was computing whether it could access camera or microphone at creation time.
Since the iframe allow attribute can be modified, we cannot do that.
Instead, we get the feature policy everytime this is needed.

Refactor code to use the newly added routine to check for feature policy.
Update logging to give origin and allow attribute value of the frame that fail the feature policy check.

Test: http/tests/webrtc/enumerateDevicesInFrames.html

* Modules/mediastream/MediaDevices.cpp:
(WebCore::MediaDevices::MediaDevices):
(WebCore::MediaDevices::refreshDevices):
(WebCore::MediaDevices::enumerateDevices):
(WebCore::MediaDevices::listenForDeviceChanges):
* Modules/mediastream/MediaDevices.h:
* Modules/mediastream/UserMediaController.cpp:
(WebCore::UserMediaController::logGetUserMediaDenial):
(WebCore::UserMediaController::logGetDisplayMediaDenial):
(WebCore::UserMediaController::logEnumerateDevicesDenial):
* Modules/mediastream/UserMediaController.h:
* Modules/mediastream/UserMediaRequest.cpp:
(WebCore::UserMediaRequest::start):
* html/FeaturePolicy.cpp:
(WebCore::policyTypeName):
(WebCore::isFeaturePolicyAllowedByDocumentAndAllOwners):
* html/FeaturePolicy.h:
* page/DOMWindow.cpp:
(WebCore::DOMWindow::printErrorMessage const):
* page/DOMWindow.h:

LayoutTests:

* TestExpectations:
* fullscreen/full-screen-enabled-expected.txt:
* fullscreen/full-screen-enabled-prefixed-expected.txt:
* fullscreen/full-screen-iframe-not-allowed-expected.txt:
* fullscreen/full-screen-iframe-without-allow-attribute-allowed-from-parent-expected.txt:
* fullscreen/full-screen-restrictions-expected.txt:
* http/tests/fullscreen/fullscreen-feature-policy-expected.txt:
* http/tests/media/media-stream/enumerate-devices-iframe-allow-attribute-expected.txt:
* http/tests/media/media-stream/get-display-media-iframe-allow-attribute-expected.txt:
* http/tests/ssl/media-stream/get-user-media-different-host-expected.txt:
* http/tests/ssl/media-stream/get-user-media-nested-expected.txt:
* http/tests/webrtc/enumerateDevicesInFrames-expected.txt: Added.
* http/tests/webrtc/enumerateDevicesInFrames.html: Added.


  Commit: 63170b17ef89a099807266a471c0fa2e99afa1db
      https://github.com/WebKit/WebKit/commit/63170b17ef89a099807266a471c0fa2e99afa1db
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    A LayoutTests/fast/css/many-rules-expected.html
    A LayoutTests/fast/css/many-rules.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/style/RuleData.h

  Log Message:
  -----------
  Merge r255671 - CSS Rules with the same selector from several large stylesheets are applied in the wrong order
https://bugs.webkit.org/show_bug.cgi?id=204687
<rdar://problem/57522566>

Reviewed by Zalan Bujtas.

Source/WebCore:

Original test by Anton Khlynovskiy.

Test: fast/css/many-rules.html

* style/RuleData.h:

We overflow the 18 bit m_position field with > 256k CSS rules, confusing the rule order.
Since we have unused bits it costs nothing to increase the field size to 22 bits.

4M rules should be enough for anybody.

LayoutTests:

* TestExpectations:
* fast/css/many-rules-expected.html: Added.
* fast/css/many-rules.html: Added.


  Commit: 03c7e32bf75f7db212b567f27ab14b99b9031787
      https://github.com/WebKit/WebKit/commit/03c7e32bf75f7db212b567f27ab14b99b9031787
  Author: Pablo Saavedra <psaavedra at igalia.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Page.cpp

  Log Message:
  -----------
  Merge r255673 - Build error with -DENABLE_VIDEO=OFF after r253923
https://bugs.webkit.org/show_bug.cgi?id=207101

Reviewed by Youenn Fablet.

No new tests, only build error fix up

* page/Page.cpp:
(WebCore::Page::forEachMediaElement):


  Commit: bbcd3758c0e9fa31f81d8ea6ecbd53fb91c6cead
      https://github.com/WebKit/WebKit/commit/bbcd3758c0e9fa31f81d8ea6ecbd53fb91c6cead
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/inspector/runtime/saveResult-expected.txt
    M LayoutTests/inspector/runtime/saveResult.html
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/inspector/InjectedScriptSource.js

  Log Message:
  -----------
  Merge r255675 - Web Inspector: REGRESSION(r248287): Console: function objects saved to a $n will be invoked instead of just referenced when evaluating in the Console
https://bugs.webkit.org/show_bug.cgi?id=207180
<rdar://problem/58860268>

Reviewed by Joseph Pecoraro.

Source/JavaScriptCore:

* inspector/InjectedScriptSource.js:
(CommandLineAPI):
Instead of deciding whether to wrap the value given for a `$n` getter based on if the value
is already a function, always wrap getter values in a function so that if the value being
stored in the getter is already a function, it isn't used as the callback for the getter and
therefore invoked when the getter is referenced.

LayoutTests:

* inspector/runtime/saveResult.html:
* inspector/runtime/saveResult-expected.txt:


  Commit: f52255ecfece013751efd0c8238d289a2d814b49
      https://github.com/WebKit/WebKit/commit/f52255ecfece013751efd0c8238d289a2d814b49
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r255677 - REGRESSION(r255595): page not closed after beforeunload handler returns true
https://bugs.webkit.org/show_bug.cgi?id=207189

Patch by Carlos Garcia Campos <cgarcia at igalia.com> on 2020-02-04
Reviewed by Chris Dumez.

We are assuming the try close did timeout in that case, because the timer is stopped before running the
beforeunload dialog.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::runBeforeUnloadConfirmPanel): Start the try close timer again when the beforeunload
dialog replies.


  Commit: d7d1cba0d52a6844f3c8e535486c1755795df2b7
      https://github.com/WebKit/WebKit/commit/d7d1cba0d52a6844f3c8e535486c1755795df2b7
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessPool.cpp

  Log Message:
  -----------
  Merge r255679 - Unreviewed, follow-up assertion fix after r255662.

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::initializeNewWebProcess):


  Commit: 485cf09e782df1c13bccf73d716adc8435631c7c
      https://github.com/WebKit/WebKit/commit/485cf09e782df1c13bccf73d716adc8435631c7c
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/notifications/notification-in-non-secure-context.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/notifications/Notification.cpp

  Log Message:
  -----------
  Merge r255680 - Check for callback being null in Notification.requestPermission
https://bugs.webkit.org/show_bug.cgi?id=207192
<rdar://problem/59130804>

Reviewed by Chris Dumez.

Source/WebCore:

Covered by updated test.

* Modules/notifications/Notification.cpp:
(WebCore::Notification::requestPermission):
Callback can be null if no function is given to requestPermission.
Check this before calling the callback.

LayoutTests:

* http/tests/notifications/notification-in-non-secure-context.html:


  Commit: 9ffbbd19caaf1c228d126e72f2a290cef0d94f7b
      https://github.com/WebKit/WebKit/commit/9ffbbd19caaf1c228d126e72f2a290cef0d94f7b
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/workers/service/context/SWContextManager.h
    M Source/WebCore/workers/service/server/SWServer.cpp
    M Source/WebCore/workers/service/server/SWServer.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.cpp
    M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.h
    M Source/WebKit/NetworkProcess/NetworkConnectionToWebProcess.messages.in
    M Source/WebKit/NetworkProcess/NetworkProcess.cpp
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.h
    M Source/WebKit/UIProcess/Network/NetworkProcessProxy.messages.in
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Source/WebKit/UIProcess/WebProcessPool.h
    M Source/WebKit/UIProcess/WebProcessProxy.cpp
    M Source/WebKit/UIProcess/WebProcessProxy.h
    M Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.cpp
    M Source/WebKit/WebProcess/Storage/WebSWContextManagerConnection.h
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Source/WebKit/WebProcess/WebProcess.h
    M Source/WebKit/WebProcess/WebProcess.messages.in

  Log Message:
  -----------
  Merge r255681 - NetworkProcess should be notified by UIProcess when its service worker process connection should be on
https://bugs.webkit.org/show_bug.cgi?id=207122
<rdar://problem/59089780>

Reviewed by Chris Dumez.

Source/WebCore:

Add a completion handler to the create context connection callback.
This is called when the context connection should have been created.
In case there is a context connection, completion handler does nothing.
Otherwise, SWServer will retry creating a context connection if needed.

The pending connection map entry is now removed in the completion handler instead of addContextConnection.
This ensures that only one connection request is sent by network process at a time.

Add extra logging to monitor creation of a context connection.

* workers/service/context/SWContextManager.h:
* workers/service/server/SWServer.cpp:
(WebCore::SWServer::addContextConnection):
(WebCore::SWServer::removeContextConnection):
(WebCore::SWServer::createContextConnectionFinished):
* workers/service/server/SWServer.h:

Source/WebKit:

Add completion handlers to the messaging from NetworkProcess -> UIProcess -> WebProcess -> NetworkProcess
used to create a service worker context connection.

This allows NetworkProcess to ask again for a connection if the connection is still needed but NetworkProcess did not find the context connection.

This is difficult to test since we would need for the process selected to host service workers to exit between the
time it is selected and the time it sends the message to Networking process.

To ensure that the context connection is created by WebProcess, WebProcessProxy takes a background assertion until WebProcess finishes
creating the context connection to Network process.

* NetworkProcess/NetworkConnectionToWebProcess.cpp:
(WebKit::NetworkConnectionToWebProcess::establishSWContextConnection):
* NetworkProcess/NetworkConnectionToWebProcess.h:
* NetworkProcess/NetworkConnectionToWebProcess.messages.in:
* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::swServerForSession):
* NetworkProcess/NetworkProcess.h:
* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::establishWorkerContextConnectionToNetworkProcess):
* UIProcess/Network/NetworkProcessProxy.h:
* UIProcess/Network/NetworkProcessProxy.messages.in:
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::establishWorkerContextConnectionToNetworkProcess):
* UIProcess/WebProcessPool.h:
* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::establishServiceWorkerContext):
* UIProcess/WebProcessProxy.h:
* WebProcess/Storage/WebSWContextManagerConnection.cpp:
(WebKit::m_userAgent):
(WebKit::WebSWContextManagerConnection::establishConnection):
* WebProcess/Storage/WebSWContextManagerConnection.h:
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::establishWorkerContextConnectionToNetworkProcess):
* WebProcess/WebProcess.h:
* WebProcess/WebProcess.messages.in:


  Commit: 7cbd2218b0526642f4e08622f997cffbc20702b1
      https://github.com/WebKit/WebKit/commit/7cbd2218b0526642f4e08622f997cffbc20702b1
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
    M Source/JavaScriptCore/Sources.txt
    M Source/JavaScriptCore/bytecode/BytecodeBasicBlock.cpp
    M Source/JavaScriptCore/bytecode/BytecodeBasicBlock.h
    M Source/JavaScriptCore/bytecode/BytecodeDumper.cpp
    M Source/JavaScriptCore/bytecode/BytecodeGeneratorification.cpp
    M Source/JavaScriptCore/bytecode/BytecodeGeneratorification.h
    M Source/JavaScriptCore/bytecode/BytecodeRewriter.h
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/CodeBlock.h
    M Source/JavaScriptCore/bytecode/HandlerInfo.h
    M Source/JavaScriptCore/bytecode/JumpTable.h
    M Source/JavaScriptCore/bytecode/PreciseJumpTargets.cpp
    M Source/JavaScriptCore/bytecode/PreciseJumpTargets.h
    M Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp
    M Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
    A Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.cpp
    A Source/JavaScriptCore/bytecode/UnlinkedCodeBlockGenerator.h
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
    M Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h
    M Source/JavaScriptCore/bytecompiler/BytecodeGeneratorBaseInlines.h
    M Source/JavaScriptCore/runtime/CachedTypes.cpp
    M Source/JavaScriptCore/wasm/WasmFunctionCodeBlock.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/RefCountedArray.h

  Log Message:
  -----------
  Merge r255687 - [JSC] Introduce UnlinkedCodeBlockGenerator and reduce sizeof(UnlinkedCodeBlock)
https://bugs.webkit.org/show_bug.cgi?id=207087

Reviewed by Tadeu Zagallo.

Source/JavaScriptCore:

While UnlinkedCodeBlock is immutable once it is created from BytecodeGenerator, it has many mutable Vectors.
This is because we are using UnlinkedCodeBlock as a builder of UnlinkedCodeBlock itself too in BytecodeGenerator.
Since Vector takes 16 bytes to allow efficient expansions, it is nice if we can use RefCountedArray instead when
we know this Vector is immutable.

In this patch, we introduce UnlinkedCodeBlockGenerator wrapper. BytecodeGenerator, BytecodeRewriter, BytecodeDumper,
and BytecodeGeneratorification interact with UnlinkedCodeBlockGenerator instead of UnlinkedCodeBlock. And UnlinkedCodeBlockGenerator
will generate the finalized UnlinkedCodeBlock. This design allows us to use RefCountedArray for data in UnlinkedCodeBlock,
which is (1) smaller and (2) doing shrinkToFit operation when creating it from Vector.

This patch reduces sizeof(UnlinkedCodeBlock) from 256 to 168, 88 bytes reduction.

* JavaScriptCore.xcodeproj/project.pbxproj:
* Sources.txt:
* bytecode/BytecodeBasicBlock.cpp:
(JSC::BytecodeBasicBlock::compute):
* bytecode/BytecodeBasicBlock.h:
* bytecode/BytecodeDumper.cpp:
* bytecode/BytecodeGeneratorification.cpp:
(JSC::BytecodeGeneratorification::BytecodeGeneratorification):
(JSC::GeneratorLivenessAnalysis::run):
(JSC::BytecodeGeneratorification::run):
(JSC::performGeneratorification):
* bytecode/BytecodeGeneratorification.h:
* bytecode/BytecodeRewriter.h:
(JSC::BytecodeRewriter::BytecodeRewriter):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
(JSC::CodeBlock::setConstantIdentifierSetRegisters):
(JSC::CodeBlock::setConstantRegisters):
(JSC::CodeBlock::handlerForIndex):
(JSC::CodeBlock::insertBasicBlockBoundariesForControlFlowProfiler):
* bytecode/CodeBlock.h:
(JSC::CodeBlock::numberOfSwitchJumpTables const):
(JSC::CodeBlock::numberOfStringSwitchJumpTables const):
(JSC::CodeBlock::addSwitchJumpTable): Deleted.
(JSC::CodeBlock::addStringSwitchJumpTable): Deleted.
* bytecode/HandlerInfo.h:
(JSC::HandlerInfoBase::handlerForIndex):
* bytecode/JumpTable.h:
(JSC::SimpleJumpTable::add): Deleted.
* bytecode/PreciseJumpTargets.cpp:
(JSC::computePreciseJumpTargets):
(JSC::recomputePreciseJumpTargets):
(JSC::findJumpTargetsForInstruction):
* bytecode/PreciseJumpTargets.h:
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
(JSC::UnlinkedCodeBlock::visitChildren):
(JSC::UnlinkedCodeBlock::dumpExpressionRangeInfo):
(JSC::UnlinkedCodeBlock::expressionRangeForBytecodeIndex const):
(JSC::UnlinkedCodeBlock::handlerForIndex):
(JSC::UnlinkedCodeBlock::addExpressionInfo): Deleted.
(JSC::UnlinkedCodeBlock::addTypeProfilerExpressionInfo): Deleted.
(JSC::UnlinkedCodeBlock::setInstructions): Deleted.
(JSC::UnlinkedCodeBlock::applyModification): Deleted.
(JSC::UnlinkedCodeBlock::shrinkToFit): Deleted.
(JSC::UnlinkedCodeBlock::addOutOfLineJumpTarget): Deleted.
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::expressionInfo):
(JSC::UnlinkedCodeBlock::setNumParameters):
(JSC::UnlinkedCodeBlock::numberOfIdentifiers const):
(JSC::UnlinkedCodeBlock::identifiers const):
(JSC::UnlinkedCodeBlock::bitVector):
(JSC::UnlinkedCodeBlock::constantRegisters):
(JSC::UnlinkedCodeBlock::constantsSourceCodeRepresentation):
(JSC::UnlinkedCodeBlock::constantIdentifierSets):
(JSC::UnlinkedCodeBlock::numberOfJumpTargets const):
(JSC::UnlinkedCodeBlock::numberOfSwitchJumpTables const):
(JSC::UnlinkedCodeBlock::numberOfStringSwitchJumpTables const):
(JSC::UnlinkedCodeBlock::numberOfFunctionDecls):
(JSC::UnlinkedCodeBlock::numberOfExceptionHandlers const):
(JSC::UnlinkedCodeBlock::opProfileControlFlowBytecodeOffsets const):
(JSC::UnlinkedCodeBlock::createRareDataIfNecessary):
(JSC::UnlinkedCodeBlock::addParameter): Deleted.
(JSC::UnlinkedCodeBlock::addIdentifier): Deleted.
(JSC::UnlinkedCodeBlock::addBitVector): Deleted.
(JSC::UnlinkedCodeBlock::addSetConstant): Deleted.
(JSC::UnlinkedCodeBlock::addConstant): Deleted.
(JSC::UnlinkedCodeBlock::addJumpTarget): Deleted.
(JSC::UnlinkedCodeBlock::addSwitchJumpTable): Deleted.
(JSC::UnlinkedCodeBlock::addStringSwitchJumpTable): Deleted.
(JSC::UnlinkedCodeBlock::addFunctionDecl): Deleted.
(JSC::UnlinkedCodeBlock::addFunctionExpr): Deleted.
(JSC::UnlinkedCodeBlock::addExceptionHandler): Deleted.
(JSC::UnlinkedCodeBlock::addOpProfileControlFlowBytecodeOffset): Deleted.
(JSC::UnlinkedCodeBlock::replaceOutOfLineJumpTargets): Deleted.
* bytecode/UnlinkedCodeBlockGenerator.cpp: Added.
(JSC::UnlinkedCodeBlockGenerator::getLineAndColumn const):
(JSC::UnlinkedCodeBlockGenerator::addExpressionInfo):
(JSC::UnlinkedCodeBlockGenerator::addTypeProfilerExpressionInfo):
(JSC::UnlinkedCodeBlockGenerator::finalize):
(JSC::UnlinkedCodeBlockGenerator::handlerForBytecodeIndex):
(JSC::UnlinkedCodeBlockGenerator::handlerForIndex):
(JSC::UnlinkedCodeBlockGenerator::applyModification):
(JSC::UnlinkedCodeBlockGenerator::addOutOfLineJumpTarget):
(JSC::UnlinkedCodeBlockGenerator::outOfLineJumpOffset):
(JSC::UnlinkedCodeBlockGenerator::dump const):
* bytecode/UnlinkedCodeBlockGenerator.h: Added.
(JSC::UnlinkedCodeBlockGenerator::UnlinkedCodeBlockGenerator):
(JSC::UnlinkedCodeBlockGenerator::vm):
(JSC::UnlinkedCodeBlockGenerator::isConstructor const):
(JSC::UnlinkedCodeBlockGenerator::constructorKind const):
(JSC::UnlinkedCodeBlockGenerator::superBinding const):
(JSC::UnlinkedCodeBlockGenerator::scriptMode const):
(JSC::UnlinkedCodeBlockGenerator::needsClassFieldInitializer const):
(JSC::UnlinkedCodeBlockGenerator::isStrictMode const):
(JSC::UnlinkedCodeBlockGenerator::usesEval const):
(JSC::UnlinkedCodeBlockGenerator::parseMode const):
(JSC::UnlinkedCodeBlockGenerator::isArrowFunction):
(JSC::UnlinkedCodeBlockGenerator::derivedContextType const):
(JSC::UnlinkedCodeBlockGenerator::evalContextType const):
(JSC::UnlinkedCodeBlockGenerator::isArrowFunctionContext const):
(JSC::UnlinkedCodeBlockGenerator::isClassContext const):
(JSC::UnlinkedCodeBlockGenerator::numCalleeLocals const):
(JSC::UnlinkedCodeBlockGenerator::numVars const):
(JSC::UnlinkedCodeBlockGenerator::numParameters const):
(JSC::UnlinkedCodeBlockGenerator::thisRegister const):
(JSC::UnlinkedCodeBlockGenerator::scopeRegister const):
(JSC::UnlinkedCodeBlockGenerator::wasCompiledWithDebuggingOpcodes const):
(JSC::UnlinkedCodeBlockGenerator::hasCheckpoints const):
(JSC::UnlinkedCodeBlockGenerator::hasTailCalls const):
(JSC::UnlinkedCodeBlockGenerator::setHasCheckpoints):
(JSC::UnlinkedCodeBlockGenerator::setHasTailCalls):
(JSC::UnlinkedCodeBlockGenerator::setNumCalleeLocals):
(JSC::UnlinkedCodeBlockGenerator::setNumVars):
(JSC::UnlinkedCodeBlockGenerator::setThisRegister):
(JSC::UnlinkedCodeBlockGenerator::setScopeRegister):
(JSC::UnlinkedCodeBlockGenerator::setNumParameters):
(JSC::UnlinkedCodeBlockGenerator::metadata):
(JSC::UnlinkedCodeBlockGenerator::addOpProfileControlFlowBytecodeOffset):
(JSC::UnlinkedCodeBlockGenerator::numberOfJumpTargets const):
(JSC::UnlinkedCodeBlockGenerator::addJumpTarget):
(JSC::UnlinkedCodeBlockGenerator::jumpTarget const):
(JSC::UnlinkedCodeBlockGenerator::lastJumpTarget const):
(JSC::UnlinkedCodeBlockGenerator::numberOfSwitchJumpTables const):
(JSC::UnlinkedCodeBlockGenerator::addSwitchJumpTable):
(JSC::UnlinkedCodeBlockGenerator::switchJumpTable):
(JSC::UnlinkedCodeBlockGenerator::numberOfStringSwitchJumpTables const):
(JSC::UnlinkedCodeBlockGenerator::addStringSwitchJumpTable):
(JSC::UnlinkedCodeBlockGenerator::stringSwitchJumpTable):
(JSC::UnlinkedCodeBlockGenerator::numberOfExceptionHandlers const):
(JSC::UnlinkedCodeBlockGenerator::exceptionHandler):
(JSC::UnlinkedCodeBlockGenerator::addExceptionHandler):
(JSC::UnlinkedCodeBlockGenerator::bitVector):
(JSC::UnlinkedCodeBlockGenerator::addBitVector):
(JSC::UnlinkedCodeBlockGenerator::numberOfConstantIdentifierSets const):
(JSC::UnlinkedCodeBlockGenerator::constantIdentifierSets):
(JSC::UnlinkedCodeBlockGenerator::addSetConstant):
(JSC::UnlinkedCodeBlockGenerator::constantRegister const):
(JSC::UnlinkedCodeBlockGenerator::constantRegisters):
(JSC::UnlinkedCodeBlockGenerator::getConstant const):
(JSC::UnlinkedCodeBlockGenerator::constantsSourceCodeRepresentation):
(JSC::UnlinkedCodeBlockGenerator::addConstant):
(JSC::UnlinkedCodeBlockGenerator::addFunctionDecl):
(JSC::UnlinkedCodeBlockGenerator::addFunctionExpr):
(JSC::UnlinkedCodeBlockGenerator::numberOfIdentifiers const):
(JSC::UnlinkedCodeBlockGenerator::identifier const):
(JSC::UnlinkedCodeBlockGenerator::addIdentifier):
(JSC::UnlinkedCodeBlockGenerator::outOfLineJumpOffset):
(JSC::UnlinkedCodeBlockGenerator::replaceOutOfLineJumpTargets):
(JSC::UnlinkedCodeBlockGenerator::metadataSizeInBytes):
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::generate):
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::initializeNextParameter):
(JSC::BytecodeGenerator::emitPushFunctionNameScope):
(JSC::prepareJumpTableForSwitch):
(JSC::ForInContext::finalize):
(JSC::StructureForInContext::finalize):
(JSC::IndexedForInContext::finalize):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/BytecodeGeneratorBaseInlines.h:
(JSC::BytecodeGeneratorBase<Traits>::newRegister):
(JSC::BytecodeGeneratorBase<Traits>::addVar):
* runtime/CachedTypes.cpp:
(JSC::CachedVector::encode):
(JSC::CachedVector::decode const):
* wasm/WasmFunctionCodeBlock.h:
(JSC::Wasm::FunctionCodeBlock::setNumVars):
(JSC::Wasm::FunctionCodeBlock::setNumCalleeLocals):

Source/WTF:

Add more useful methods for RefCountedArray.

* wtf/RefCountedArray.h:
(WTF::RefCountedArray::operator=):
(WTF::RefCountedArray::isEmpty const):
(WTF::RefCountedArray::front):
(WTF::RefCountedArray::front const):
(WTF::RefCountedArray::last):
(WTF::RefCountedArray::last const):


  Commit: 63b90b54833745fe22143515054c475c59fe6985
      https://github.com/WebKit/WebKit/commit/63b90b54833745fe22143515054c475c59fe6985
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/test262/expectations.yaml
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/yarr/YarrParser.h

  Log Message:
  -----------
  Merge r255689 - Quantifiers after lookahead assertions should be syntax errors in Unicode patterns only
https://bugs.webkit.org/show_bug.cgi?id=206988

Reviewed by Darin Adler and Ross Kirsling.

JSTests:

* test262/expectations.yaml: Mark 10 test cases as passing.

Source/JavaScriptCore:

This change adds SyntaxError for quantifiable assertions in Unicode patterns,
aligning JSC with V8 and SpiderMonkey.

Grammar: https://tc39.es/ecma262/#prod-annexB-Term
(/u flag precludes the use of QuantifiableAssertion)

Return value of parseParenthesesEnd() now matches with parseEscape() and
parseAtomEscape().

* yarr/YarrParser.h:
(JSC::Yarr::Parser::parseParenthesesBegin):
(JSC::Yarr::Parser::parseParenthesesEnd):
(JSC::Yarr::Parser::parseTokens):


  Commit: 8efbdbd5dbca88d8eeeafaab44f4ca64ef7c015a
      https://github.com/WebKit/WebKit/commit/8efbdbd5dbca88d8eeeafaab44f4ca64ef7c015a
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-load-error-events-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-load-error-events.https-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-01-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-limited-quirks-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-quirks-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/StyleSheetContents.cpp
    M Source/WebCore/css/StyleSheetContents.h
    M Source/WebCore/html/HTMLLinkElement.cpp
    M Source/WebCore/loader/cache/CachedCSSStyleSheet.cpp

  Log Message:
  -----------
  Merge r255693 - Tighten up stylesheet loading
https://bugs.webkit.org/show_bug.cgi?id=189913

Patch by Rob Buis <rbuis at igalia.com> on 2020-02-04
Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Update improved test results.

* web-platform-tests/html/semantics/document-metadata/the-link-element/link-load-error-events-expected.txt:
* web-platform-tests/html/semantics/document-metadata/the-link-element/link-load-error-events.https-expected.txt:
* web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-01-expected.txt:
* web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-limited-quirks-expected.txt:
* web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-quirks-expected.txt:

Source/WebCore:

Content-Type metadata for link stylesheet is determined using MIME
sniffing[1]. This can result in no Content-Type metadata.
If there is no Content-Type metadata, but the external resource link
type has a default type defined, then the user agent must assume that
the resource is of that type [2]. For link stylesheet the default is
text/css. This means invalid MIME type will default to text/css and
load and valid MIME types other than text/css will result in load error.

[1] https://mimesniff.spec.whatwg.org/
[2] https://html.spec.whatwg.org/multipage/semantics.html#fetch-and-process-the-linked-resource

Tests: imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-load-error-events.html
       imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-load-error-events.https.html
       imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-01.html
       imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-limited-quirks.html
       imported/w3c/web-platform-tests/html/semantics/document-metadata/the-link-element/link-style-error-quirks.html

* css/StyleSheetContents.cpp:
(WebCore::StyleSheetContents::parseAuthorStyleSheet):
* css/StyleSheetContents.h:
* html/HTMLLinkElement.cpp:
(WebCore::HTMLLinkElement::setCSSStyleSheet):
* loader/cache/CachedCSSStyleSheet.cpp:
(WebCore::CachedCSSStyleSheet::canUseSheet const):


  Commit: 9f9caff3c44e932a5e00a02b8b8131a44564f34d
      https://github.com/WebKit/WebKit/commit/9f9caff3c44e932a5e00a02b8b8131a44564f34d
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.h
    M Source/JavaScriptCore/runtime/CachedTypes.cpp
    M Source/JavaScriptCore/runtime/CodeCache.cpp

  Log Message:
  -----------
  Merge r255703 - [JSC] Use PackedRefPtr in UnlinkedCodeBlock
https://bugs.webkit.org/show_bug.cgi?id=207229

Reviewed by Mark Lam.

Use PackedRefPtr in UnlinkedCodeBlock to compact it from 168 to 160, which saves 16 bytes (10%) per UnlinkedCodeBlock since
we have 16 bytes alignment for GC cells.

* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::sourceURLDirective const):
(JSC::UnlinkedCodeBlock::sourceMappingURLDirective const):
(JSC::UnlinkedCodeBlock::setSourceURLDirective):
(JSC::UnlinkedCodeBlock::setSourceMappingURLDirective):
* runtime/CachedTypes.cpp:
(JSC::CachedCodeBlock::sourceURLDirective const):
(JSC::CachedCodeBlock::sourceMappingURLDirective const):
(JSC::CachedCodeBlock<CodeBlockType>::encode):
* runtime/CodeCache.cpp:
(JSC::CodeCache::getUnlinkedGlobalCodeBlock):


  Commit: 0f21c6f6e5cddf466ef194f94d7bc7621b98364d
      https://github.com/WebKit/WebKit/commit/0f21c6f6e5cddf466ef194f94d7bc7621b98364d
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessPool.cpp

  Log Message:
  -----------
  Merge r255705 - Unreviewed, follow-up assertion fix after r255662.

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::initializeNewWebProcess):


  Commit: 76b936ea70a2d753add6cc35835267dd9642f08a
      https://github.com/WebKit/WebKit/commit/76b936ea70a2d753add6cc35835267dd9642f08a
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebStorage/StorageAreaImpl.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageAreaImpl.h
    M Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageAreaMap.h
    M Source/WebKit/WebProcess/WebStorage/StorageNamespaceImpl.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageNamespaceImpl.h

  Log Message:
  -----------
  Merge r255706 - Partial revert of r248734 to fix leak of StorageAreaMaps
https://bugs.webkit.org/show_bug.cgi?id=207073

Reviewed by Alex Christensen.

Do a partial revert of r248734 so that the StorageNamespaceImpl no longer holds a strong
reference to its StorageAreaMap objects. The code for removing entries from
StorageNamespaceImpl::m_storageAreaMaps (StorageNamespaceImpl::didDestroyStorageAreaMap())
was dead code after r248734 and thus StorageAreaMap were never destroyed.

* WebProcess/WebStorage/StorageAreaImpl.cpp:
(WebKit::StorageAreaImpl::create):
(WebKit::StorageAreaImpl::StorageAreaImpl):
(WebKit::StorageAreaImpl::length):
(WebKit::StorageAreaImpl::key):
(WebKit::StorageAreaImpl::item):
(WebKit::StorageAreaImpl::setItem):
(WebKit::StorageAreaImpl::removeItem):
(WebKit::StorageAreaImpl::clear):
(WebKit::StorageAreaImpl::contains):
(WebKit::StorageAreaImpl::storageType const):
* WebProcess/WebStorage/StorageAreaImpl.h:
* WebProcess/WebStorage/StorageAreaMap.cpp:
(WebKit::StorageAreaMap::create):
(WebKit::StorageAreaMap::~StorageAreaMap):
* WebProcess/WebStorage/StorageAreaMap.h:
* WebProcess/WebStorage/StorageNamespaceImpl.cpp:
(WebKit::StorageNamespaceImpl::storageArea):
* WebProcess/WebStorage/StorageNamespaceImpl.h:


  Commit: bd43bb494a0ac2c2e76f63501a2f34d2f244ecc8
      https://github.com/WebKit/WebKit/commit/bd43bb494a0ac2c2e76f63501a2f34d2f244ecc8
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/PolyProtoAccessChain.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/SingleRootGraph.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/atk/AccessibilityObjectAtk.cpp
    M Source/WebCore/inspector/agents/InspectorAnimationAgent.cpp
    M Source/WebCore/style/MatchedDeclarationsCache.cpp

  Log Message:
  -----------
  Merge r255711 - Non-unified build fixes early February 2020 edition
https://bugs.webkit.org/show_bug.cgi?id=207227

Reviewed by Don Olmstead.

Source/JavaScriptCore:

* bytecode/PolyProtoAccessChain.h: Add missing inclusions of StructureIDTable.h and VM.h

Source/WebCore:

No new tests needed.

* accessibility/atk/AccessibilityObjectAtk.cpp: Add missing inclusion of WebKitAccessible.h
* inspector/agents/InspectorAnimationAgent.cpp: Add issing inclusions of JSExecState.h and
JavaScriptCore/InjectedScriptManager.h
* style/MatchedDeclarationsCache.cpp: Add missing inclusion of FontCascade.h

Source/WTF:

* wtf/SingleRootGraph.h: Add missing inclusion of wtf/StringPrintStream.h


  Commit: 6f6777b35c85a26fdd9ba1eb429ed77565af9c1a
      https://github.com/WebKit/WebKit/commit/6f6777b35c85a26fdd9ba1eb429ed77565af9c1a
  Author: James Darpinian <jdarpinian at chromium.org>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/ThirdParty/ANGLE/.gitattributes
    M Source/ThirdParty/ANGLE/.gitignore
    M Source/ThirdParty/ANGLE/ANGLE.plist
    M Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj
    M Source/ThirdParty/ANGLE/AUTHORS
    M Source/ThirdParty/ANGLE/BUILD.gn
    M Source/ThirdParty/ANGLE/CONTRIBUTORS
    M Source/ThirdParty/ANGLE/ChangeLog
    M Source/ThirdParty/ANGLE/Compiler.cmake
    M Source/ThirdParty/ANGLE/DEPS
    M Source/ThirdParty/ANGLE/GLESv2.cmake
    M Source/ThirdParty/ANGLE/PRESUBMIT.py
    M Source/ThirdParty/ANGLE/android/AndroidManifest.xml.jinja2
    M Source/ThirdParty/ANGLE/android/angle_apk.gni
    M Source/ThirdParty/ANGLE/build_overrides/angle.gni
    M Source/ThirdParty/ANGLE/build_overrides/vulkan_loader.gni
    M Source/ThirdParty/ANGLE/changes.diff
    M Source/ThirdParty/ANGLE/doc/CaptureAndReplay.md
    M Source/ThirdParty/ANGLE/doc/ContributingCode.md
    M Source/ThirdParty/ANGLE/doc/DebuggingTips.md
    M Source/ThirdParty/ANGLE/doc/DevSetup.md
    M Source/ThirdParty/ANGLE/doc/dEQP.md
    M Source/ThirdParty/ANGLE/extensions/ANGLE_webgl_compatibility.txt
    A Source/ThirdParty/ANGLE/extensions/EGL_ANGLE_device_eagl.txt
    R Source/ThirdParty/ANGLE/extensions/EGL_CHROMIUM_get_sync_values.txt
    A Source/ThirdParty/ANGLE/extensions/EGL_CHROMIUM_sync_control.txt
    M Source/ThirdParty/ANGLE/gni/angle.gni
    M Source/ThirdParty/ANGLE/include/EGL/eglext.h
    M Source/ThirdParty/ANGLE/include/EGL/eglext_angle.h
    M Source/ThirdParty/ANGLE/include/GLES/glext_explicit_context_autogen.inc
    M Source/ThirdParty/ANGLE/include/GLES2/gl2ext_angle.h
    M Source/ThirdParty/ANGLE/include/GLES2/gl2ext_explicit_context_autogen.inc
    M Source/ThirdParty/ANGLE/include/GLES3/gl31ext_explicit_context_autogen.inc
    M Source/ThirdParty/ANGLE/include/GLES3/gl32ext_explicit_context_autogen.inc
    M Source/ThirdParty/ANGLE/include/GLES3/gl3ext_explicit_context_autogen.inc
    M Source/ThirdParty/ANGLE/include/GLSLANG/ShaderLang.h
    M Source/ThirdParty/ANGLE/include/GLSLANG/ShaderVars.h
    M Source/ThirdParty/ANGLE/include/platform/FeaturesD3D.h
    M Source/ThirdParty/ANGLE/include/platform/FeaturesGL.h
    M Source/ThirdParty/ANGLE/include/platform/FeaturesMtl.h
    M Source/ThirdParty/ANGLE/include/platform/FeaturesVk.h
    M Source/ThirdParty/ANGLE/include/platform/Platform.h
    M Source/ThirdParty/ANGLE/infra/ANGLEWrangling.md
    M Source/ThirdParty/ANGLE/infra/README.md
    M Source/ThirdParty/ANGLE/infra/config/global/commit-queue.cfg
    M Source/ThirdParty/ANGLE/infra/config/global/cr-buildbucket.cfg
    M Source/ThirdParty/ANGLE/infra/config/global/luci-milo.cfg
    M Source/ThirdParty/ANGLE/infra/config/global/luci-scheduler.cfg
    M Source/ThirdParty/ANGLE/samples/BUILD.gn
    M Source/ThirdParty/ANGLE/samples/sample_util/SampleApplication.cpp
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/ANGLE_load_functions_table.json
    A Source/ThirdParty/ANGLE/scripts/code_generation_hashes/ANGLE_shader_preprocessor.json
    A Source/ThirdParty/ANGLE/scripts/code_generation_hashes/ANGLE_shader_translator.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/GL_CTS_(dEQP)_build_files.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/GL_EGL_WGL_loader.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/GL_EGL_entry_points.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/GL_copy_conversion_table.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/GL_format_map.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/GLenum_value_to_string_map.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/Metal_format_table.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/OpenGL_dispatch_table.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/Static_builtins.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/Vulkan_format.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/Vulkan_internal_shader_programs.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/Vulkan_mandatory_format_support_table.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/packed_enum.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/proc_table.json
    M Source/ThirdParty/ANGLE/scripts/code_generation_hashes/uniform_type.json
    M Source/ThirdParty/ANGLE/scripts/egl_angle_ext.xml
    M Source/ThirdParty/ANGLE/scripts/entry_point_packed_gl_enums.json
    M Source/ThirdParty/ANGLE/scripts/export_targets.py
    M Source/ThirdParty/ANGLE/scripts/gen_vk_gl_cts_build.py
    R Source/ThirdParty/ANGLE/scripts/generate_vulkan_layers_json.py
    M Source/ThirdParty/ANGLE/scripts/gl.xml
    M Source/ThirdParty/ANGLE/scripts/registry_xml.py
    M Source/ThirdParty/ANGLE/scripts/roll_deps.py
    M Source/ThirdParty/ANGLE/scripts/run_code_generation.py
    M Source/ThirdParty/ANGLE/src/common/FastVector.h
    M Source/ThirdParty/ANGLE/src/common/MemoryBuffer.cpp
    M Source/ThirdParty/ANGLE/src/common/MemoryBuffer.h
    M Source/ThirdParty/ANGLE/src/common/Optional.h
    M Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.cpp
    M Source/ThirdParty/ANGLE/src/common/PackedEGLEnums_autogen.h
    M Source/ThirdParty/ANGLE/src/common/PackedEnums.cpp
    M Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.cpp
    M Source/ThirdParty/ANGLE/src/common/PackedGLEnums_autogen.h
    M Source/ThirdParty/ANGLE/src/common/angleutils.h
    M Source/ThirdParty/ANGLE/src/common/debug.cpp
    M Source/ThirdParty/ANGLE/src/common/debug.h
    M Source/ThirdParty/ANGLE/src/common/gen_uniform_type_table.py
    M Source/ThirdParty/ANGLE/src/common/mathutil.h
    M Source/ThirdParty/ANGLE/src/common/packed_egl_enums.json
    M Source/ThirdParty/ANGLE/src/common/packed_gl_enums.json
    M Source/ThirdParty/ANGLE/src/common/platform.h
    M Source/ThirdParty/ANGLE/src/common/system_utils.h
    M Source/ThirdParty/ANGLE/src/common/system_utils_posix.cpp
    M Source/ThirdParty/ANGLE/src/common/system_utils_win.cpp
    A Source/ThirdParty/ANGLE/src/common/system_utils_win32.cpp
    M Source/ThirdParty/ANGLE/src/common/system_utils_winuwp.cpp
    M Source/ThirdParty/ANGLE/src/common/uniform_type_info_autogen.cpp
    M Source/ThirdParty/ANGLE/src/common/utilities.cpp
    M Source/ThirdParty/ANGLE/src/common/utilities.h
    M Source/ThirdParty/ANGLE/src/compiler.gni
    M Source/ThirdParty/ANGLE/src/compiler/fuzz/translator_fuzzer.cpp
    A Source/ThirdParty/ANGLE/src/compiler/generate_parser_tools.py
    R Source/ThirdParty/ANGLE/src/compiler/preprocessor/64bit-tokenizer-safety.patch
    R Source/ThirdParty/ANGLE/src/compiler/preprocessor/ExpressionParser.cpp
    R Source/ThirdParty/ANGLE/src/compiler/preprocessor/ExpressionParser.y
    R Source/ThirdParty/ANGLE/src/compiler/preprocessor/Tokenizer.cpp
    R Source/ThirdParty/ANGLE/src/compiler/preprocessor/Tokenizer.l
    A Source/ThirdParty/ANGLE/src/compiler/preprocessor/generate_parser.py
    R Source/ThirdParty/ANGLE/src/compiler/preprocessor/generate_parser.sh
    A Source/ThirdParty/ANGLE/src/compiler/preprocessor/preprocessor.l
    A Source/ThirdParty/ANGLE/src/compiler/preprocessor/preprocessor.y
    A Source/ThirdParty/ANGLE/src/compiler/preprocessor/preprocessor_lex_autogen.cpp
    A Source/ThirdParty/ANGLE/src/compiler/preprocessor/preprocessor_tab_autogen.cpp
    R Source/ThirdParty/ANGLE/src/compiler/translator/64bit-lexer-safety.patch
    M Source/ThirdParty/ANGLE/src/compiler/translator/BaseTypes.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/CollectVariables.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/CollectVariables.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/Common.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/Compiler.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/Compiler.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/ExtensionBehavior.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ExtensionBehavior.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/HashNames.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ImmutableString_ESSL_autogen.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ImmutableString_autogen.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/InfoSink.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/Initialize.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/Initialize.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/IntermNode.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/IntermNode.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/Operator.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/Operator.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputESSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputESSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputGLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputGLSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputGLSLBase.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputGLSLBase.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputHLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputHLSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputTree.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputVulkanGLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputVulkanGLSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputVulkanGLSLForMetal.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/OutputVulkanGLSLForMetal.mm
    M Source/ThirdParty/ANGLE/src/compiler/translator/ParseContext.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ParseContext.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/ParseContext_ESSL_autogen.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/ParseContext_complete_autogen.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/QualifierTypes.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/QualifierTypes.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/ResourcesHLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ResourcesHLSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/ShaderLang.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ShaderStorageBlockOutputHLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ShaderVars.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/StaticType.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/StructureHLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/StructureHLSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/SymbolTable_ESSL_autogen.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/SymbolTable_autogen.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/SymbolTable_autogen.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/TextureFunctionHLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/TranslatorESSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/TranslatorGLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/TranslatorHLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/TranslatorHLSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/TranslatorMetal.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/TranslatorMetal.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/TranslatorVulkan.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/TranslatorVulkan.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/Types.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/Types.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/UtilsHLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/UtilsHLSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/ValidateAST.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ValidateVaryingLocations.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/ValidateVaryingLocations.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/VersionGLSL.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/VersionGLSL.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/blocklayout.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/blocklayout.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/builtin_function_declarations.txt
    M Source/ThirdParty/ANGLE/src/compiler/translator/gen_builtin_symbols.py
    A Source/ThirdParty/ANGLE/src/compiler/translator/generate_parser.py
    R Source/ThirdParty/ANGLE/src/compiler/translator/generate_parser.sh
    M Source/ThirdParty/ANGLE/src/compiler/translator/glslang.l
    M Source/ThirdParty/ANGLE/src/compiler/translator/glslang.y
    R Source/ThirdParty/ANGLE/src/compiler/translator/glslang_lex.cpp
    A Source/ThirdParty/ANGLE/src/compiler/translator/glslang_lex_autogen.cpp
    R Source/ThirdParty/ANGLE/src/compiler/translator/glslang_tab.cpp
    R Source/ThirdParty/ANGLE/src/compiler/translator/glslang_tab.h
    A Source/ThirdParty/ANGLE/src/compiler/translator/glslang_tab_autogen.cpp
    A Source/ThirdParty/ANGLE/src/compiler/translator/glslang_tab_autogen.h
    A Source/ThirdParty/ANGLE/src/compiler/translator/span_unittest.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/EmulatePrecision.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/EmulatePrecision.h
    R Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/NameNamelessUniformBuffers.cpp
    R Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/NameNamelessUniformBuffers.h
    A Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RemoveInactiveInterfaceVariables.cpp
    A Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RemoveInactiveInterfaceVariables.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RemoveInvariantDeclaration.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RewriteAtomicCounters.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RewriteRowMajorMatrices.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RewriteStructSamplers.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RewriteStructSamplersOld.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_util/BuiltIn_ESSL_autogen.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_util/BuiltIn_complete_autogen.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_util/IntermTraverse.cpp
    M Source/ThirdParty/ANGLE/src/compiler/translator/tree_util/IntermTraverse.h
    M Source/ThirdParty/ANGLE/src/compiler/translator/util.cpp
    M Source/ThirdParty/ANGLE/src/gpu_info_util/SystemInfo.cpp
    M Source/ThirdParty/ANGLE/src/gpu_info_util/SystemInfo.h
    M Source/ThirdParty/ANGLE/src/gpu_info_util/SystemInfo_android.cpp
    A Source/ThirdParty/ANGLE/src/gpu_info_util/SystemInfo_fuchsia.cpp
    M Source/ThirdParty/ANGLE/src/gpu_info_util/SystemInfo_ios.cpp
    A Source/ThirdParty/ANGLE/src/gpu_info_util/SystemInfo_vulkan.cpp
    A Source/ThirdParty/ANGLE/src/gpu_info_util/SystemInfo_vulkan.h
    M Source/ThirdParty/ANGLE/src/image_util/imageformats.cpp
    M Source/ThirdParty/ANGLE/src/image_util/imageformats.h
    M Source/ThirdParty/ANGLE/src/image_util/loadimage.cpp
    M Source/ThirdParty/ANGLE/src/image_util/loadimage.h
    M Source/ThirdParty/ANGLE/src/libANGLE/BinaryStream.h
    M Source/ThirdParty/ANGLE/src/libANGLE/BinaryStream_unittest.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/BlobCache_unittest.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Buffer.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Caps.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Caps.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Compiler.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Config.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Config.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Constants.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Context.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_1_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_1_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_1_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_1_3_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_1_4_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_1_5_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_2_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_2_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_3_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_3_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_3_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_3_3_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_4_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_4_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_4_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_4_3_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_4_4_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_4_5_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gl_4_6_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gles_1_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gles_2_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gles_3_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gles_3_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gles_3_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Context_gles_ext_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Display.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Display.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Fence.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Fence.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Fence_unittest.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/FrameCapture.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/FrameCapture.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Framebuffer.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Framebuffer.h
    M Source/ThirdParty/ANGLE/src/libANGLE/ImageIndex.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/MemoryObject.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/MemoryProgramCache.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/MemoryProgramCache.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Program.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Program.h
    M Source/ThirdParty/ANGLE/src/libANGLE/ProgramLinkedResources.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/ProgramLinkedResources.h
    M Source/ThirdParty/ANGLE/src/libANGLE/ProgramPipeline.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Query.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Query.h
    M Source/ThirdParty/ANGLE/src/libANGLE/RefCountObject.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Renderbuffer.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/ResourceManager.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Sampler.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Semaphore.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Shader.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Shader.h
    M Source/ThirdParty/ANGLE/src/libANGLE/State.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/State.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Surface.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Surface.h
    M Source/ThirdParty/ANGLE/src/libANGLE/Surface_unittest.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Texture.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/TransformFeedback.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Uniform.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/Uniform.h
    M Source/ThirdParty/ANGLE/src/libANGLE/VaryingPacking.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/VaryingPacking.h
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_1_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_1_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_2_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_2_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_2_0_params.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_3_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_3_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_3_0_params.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_3_1_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_3_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_3_2_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_3_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_3_2_params.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_ext_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_ext_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/capture_gles_ext_params.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/entry_points_enum_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/entry_points_enum_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/formatutils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/formatutils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/frame_capture_replay_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/frame_capture_utils_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/frame_capture_utils_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/gen_copy_conversion_table.py
    M Source/ThirdParty/ANGLE/src/libANGLE/gen_format_map.py
    M Source/ThirdParty/ANGLE/src/libANGLE/gl_enum_utils_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/gl_enum_utils_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/queryconversions.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/queryutils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/ContextImpl.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/ContextImpl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/FenceNVImpl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/GLImplFactory.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/SurfaceImpl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/TransformFeedbackImpl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DisplayD3D.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/DynamicHLSL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/FramebufferD3D.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/ProgramD3D.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/ProgramD3D.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/RendererD3D.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/ShaderD3D.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/ShaderD3D.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/SurfaceD3D.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/TextureD3D.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/TextureD3D.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Buffer11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Context11.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Context11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Fence11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Framebuffer11.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Image11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/PixelTransfer11.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/PixelTransfer11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/Renderer11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/ResourceManager11.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/ResourceManager11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/ShaderExecutable11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/StateManager11.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/TextureStorage11.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/TransformFeedback11.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/renderer11_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/renderer11_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/winrt/CoreWindowNativeWindow.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/winrt/InspectableNativeWindow.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/winrt/NativeWindow11WinRT.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d11/winrt/SwapChainPanelNativeWindow.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Context9.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Context9.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Fence9.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/IndexBuffer9.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/Renderer9.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/d3d/d3d9/renderer9_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/driver_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/driver_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gen_load_functions_table.py
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/ContextGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/ContextGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/FenceNVGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/FramebufferGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/FramebufferGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/RendererGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/ShaderGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/StateManagerGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/SurfaceGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/SurfaceGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/TextureGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/cgl/IOSurfaceSurfaceCGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/ContextEAGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/ContextEAGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/DeviceEAGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/DeviceEAGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/DisplayEAGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/DisplayEAGL.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/IOSurfaceSurfaceEAGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/IOSurfaceSurfaceEAGL.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/PbufferSurfaceEAGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/PbufferSurfaceEAGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/RendererEAGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/RendererEAGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/WindowSurfaceEAGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/eagl/WindowSurfaceEAGL.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/DisplayEGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/egl/WindowSurfaceEGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/formatutilsgl.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/formatutilsgl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/FunctionsGLX.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/FunctionsGLX.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/WindowSurfaceGLX.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/glx/WindowSurfaceGLX.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/glslang_wrapper_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/glslang_wrapper_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/load_functions_data.json
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/load_functions_table_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/BufferMtl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/BufferMtl.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ContextMtl.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/DisplayMtl.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/FrameBufferMtl.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ProgramMtl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ProgramMtl.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/SurfaceMtl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/SurfaceMtl.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/TextureMtl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/TextureMtl.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/VertexArrayMtl.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/VertexArrayMtl.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/gen_mtl_format_table.py
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_command_buffer.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_command_buffer.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_common.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_format_map.json
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_format_table_autogen.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_format_utils.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_glslang_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_glslang_utils.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_render_utils.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_resources.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_resources.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_state_cache.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/mtl_state_cache.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/null/ContextNULL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/null/ContextNULL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/null/FenceNVNULL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/null/FramebufferNULL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/null/SurfaceNULL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/null/SurfaceNULL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/renderer_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/renderer_utils.h
    A Source/ThirdParty/ANGLE/src/libANGLE/renderer/serial_utils.h
    A Source/ThirdParty/ANGLE/src/libANGLE/renderer/serial_utils_unittest.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/BUILD.gn
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/BufferVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/BufferVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/CommandGraph.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/CommandGraph.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ContextVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ContextVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/DisplayVk.cpp
    A Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/DisplayVk_api.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/FenceNVVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/FenceNVVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/FramebufferVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/FramebufferVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/GlslangWrapperVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/GlslangWrapperVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/MemoryObjectVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ProgramVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ProgramVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RenderTargetVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RenderTargetVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RenderbufferVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/RendererVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/SamplerVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/SecondaryCommandBuffer.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/SecondaryCommandBuffer.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/SemaphoreVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ShaderVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/SurfaceVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/SurfaceVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/SyncVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/TextureVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/TextureVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/TransformFeedbackVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/TransformFeedbackVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/UtilsVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/VertexArrayVk.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/android/DisplayVkAndroid.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/doc/ShaderModuleCompilation.md
    A Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/doc/TransformFeedbackViaExtension.md
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/fuchsia/DisplayVkFuchsia.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/fuchsia/WindowSurfaceVkFuchsia.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/gen_vk_format_table.py
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ggp/DisplayVkGGP.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/ggp/WindowSurfaceVkGGP.cpp
    A Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/mac/DisplayVkMac.h
    A Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/mac/DisplayVkMac.mm
    A Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/mac/WindowSurfaceVkMac.h
    A Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/mac/WindowSurfaceVkMac.mm
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000000.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000001.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000002.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000003.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000004.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000005.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000006.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000007.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000008.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000009.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000000A.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000000B.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000000C.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000000D.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000000E.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000000F.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000010.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000011.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000012.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000013.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000014.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000015.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000016.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000017.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000018.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000019.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000001A.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000001B.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000001C.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000001D.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000001E.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.0000001F.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000020.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000021.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000022.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000023.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000024.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000025.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000026.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000027.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000028.inc
    R Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/gen/ConvertVertex.comp.00000029.inc
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/src/ConvertVertex.comp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/shaders/src/ConvertVertex.comp.json
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_cache_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_cache_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_caps_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_caps_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_ext_provoking_vertex.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_format_map.json
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_format_table_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_format_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_format_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_helpers.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_helpers.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_internal_shaders_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_internal_shaders_autogen.gni
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_internal_shaders_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_mandatory_format_support_table_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_utils.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_utils.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/vk_wrapper.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/win32/DisplayVkWin32.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/vulkan/xcb/DisplayVkXcb.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationEGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES1.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES1_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES2.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES2_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES3.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES31.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES31_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES32.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES32_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationES3_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationESEXT.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationESEXT_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL11_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL12_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL13_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL14_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL15_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL1_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL21_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL2_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL31_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL32.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL32_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL33_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL3_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL41_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL42_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL43_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL44_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL45_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL46_autogen.h
    M Source/ThirdParty/ANGLE/src/libANGLE/validationGL4_autogen.h
    M Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libEGL/egl_loader_autogen.h
    M Source/ThirdParty/ANGLE/src/libEGL/libEGL.cpp
    M Source/ThirdParty/ANGLE/src/libEGL/libEGL.def
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_1_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_2_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_3_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_3_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_4_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_4_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_5_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_1_5_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_2_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_2_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_2_1_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_2_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_3_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_3_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_3_1_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_3_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_3_2_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_3_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_3_3_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_3_3_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_1_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_2_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_3_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_3_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_4_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_4_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_5_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_5_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_6_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/entry_points_gl_4_6_autogen.h
    M Source/ThirdParty/ANGLE/src/libGL/libGL_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGL/libGL_autogen.def
    M Source/ThirdParty/ANGLE/src/libGL/proc_table_wgl_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2.gni
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_egl_ext.h
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_1_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_1_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_2_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_2_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_3_0_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_3_0_autogen.h
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_3_1_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_3_1_autogen.h
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_3_2_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_3_2_autogen.h
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_ext_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/entry_points_gles_ext_autogen.h
    M Source/ThirdParty/ANGLE/src/libGLESv2/global_state.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/libGLESv2_autogen.cpp
    M Source/ThirdParty/ANGLE/src/libGLESv2/libGLESv2_autogen.def
    M Source/ThirdParty/ANGLE/src/libGLESv2/libGLESv2_no_capture_autogen.def
    M Source/ThirdParty/ANGLE/src/libGLESv2/libGLESv2_with_capture_autogen.def
    M Source/ThirdParty/ANGLE/src/libGLESv2/proc_table_egl_autogen.cpp
    M Source/ThirdParty/ANGLE/src/tests/BUILD.gn
    M Source/ThirdParty/ANGLE/src/tests/angle_deqp_tests_main.cpp
    M Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests.gni
    M Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests_main.cpp
    M Source/ThirdParty/ANGLE/src/tests/angle_perftests.gni
    M Source/ThirdParty/ANGLE/src/tests/angle_perftests_main.cpp
    M Source/ThirdParty/ANGLE/src/tests/angle_unittest_main.cpp
    M Source/ThirdParty/ANGLE/src/tests/angle_unittests.gni
    M Source/ThirdParty/ANGLE/src/tests/angle_white_box_tests.gni
    M Source/ThirdParty/ANGLE/src/tests/angle_white_box_tests_main.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/ARB_texture_rectangle_test.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/BufferVariables_test.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/EmulateGLBaseVertexBaseInstance_test.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/EmulateGLDrawID_test.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/ImmutableString_test_ESSL_autogen.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/ImmutableString_test_autogen.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/OVR_multiview2_test.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/OVR_multiview_test.cpp
    A Source/ThirdParty/ANGLE/src/tests/compiler_tests/SamplerVideoWEBGL_test.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/ShaderImage_test.cpp
    M Source/ThirdParty/ANGLE/src/tests/compiler_tests/ShaderValidation_test.cpp
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/BUILD.gn
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/angle_deqp_gtest.cpp
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/deqp_data_autogen.gni
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/deqp_egl_TestExpectations
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/deqp_gles2_TestExpectations
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/deqp_gles31_TestExpectations
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/deqp_gles3_TestExpectations
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/deqp_khr_gles31_TestExpectations
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/tcuANGLEPlatform.cpp
    M Source/ThirdParty/ANGLE/src/tests/deqp_support/tes31Context_override.cpp
    A Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLAndroidFrameBufferTargetTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLChooseConfigTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLContextSharingTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLPrintEGLinfoTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLStreamTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/egl_tests/EGLSurfaceTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/AtomicCounterBufferTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/BlendFuncExtendedTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/BlendMinMaxTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/ClearTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/ComputeShaderTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/ContextLostTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/CopyTexImageTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/DepthStencilFormatsTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/DrawBaseVertexBaseInstanceTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/DrawBuffersTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/ErrorMessages.cpp
    A Source/ThirdParty/ANGLE/src/tests/gl_tests/FormatPrintTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/FramebufferTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/GLSLTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/IndexBufferOffsetTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/IndexedPointsTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/InstancingTest.cpp
    A Source/ThirdParty/ANGLE/src/tests/gl_tests/MatrixTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/MemorySizeTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/MipmapTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/MultisampleTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/MultithreadingTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/MultiviewDrawTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/PackUnpackTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/PbufferTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/PointSpritesTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/RenderbufferMultisampleTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/ShaderStorageBufferTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/SimpleOperationTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/StateChangeTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/TextureTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/TextureUploadFormatTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/TransformFeedbackTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/UniformBufferTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/VertexAttributeTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/VulkanExternalImageTest.cpp
    A Source/ThirdParty/ANGLE/src/tests/gl_tests/WEBGLVideoTextureTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/gl_tests/WebGLCompatibilityTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/perf_tests/ANGLEPerfTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/perf_tests/ANGLEPerfTest.h
    M Source/ThirdParty/ANGLE/src/tests/perf_tests/DrawCallPerf.cpp
    M Source/ThirdParty/ANGLE/src/tests/perf_tests/EGLMakeCurrentPerf.cpp
    M Source/ThirdParty/ANGLE/src/tests/perf_tests/README.md
    A Source/ThirdParty/ANGLE/src/tests/perf_tests/TracePerfTest.cpp
    M Source/ThirdParty/ANGLE/src/tests/perf_tests/UniformsPerf.cpp
    M Source/ThirdParty/ANGLE/src/tests/perf_tests/VulkanPipelineCachePerf.cpp
    A Source/ThirdParty/ANGLE/src/tests/perf_tests/restricted_traces/RestrictedTraceTests.md
    A Source/ThirdParty/ANGLE/src/tests/perf_tests/restricted_traces/angle_trace_perf_tests.gni
    A Source/ThirdParty/ANGLE/src/tests/perf_tests/restricted_traces/trex_1300_1310.tar.gz.sha1
    A Source/ThirdParty/ANGLE/src/tests/perf_tests/restricted_traces/trex_200_210.tar.gz.sha1
    A Source/ThirdParty/ANGLE/src/tests/perf_tests/restricted_traces/trex_800_810.tar.gz.sha1
    A Source/ThirdParty/ANGLE/src/tests/perf_tests/restricted_traces/trex_900_910.tar.gz.sha1
    M Source/ThirdParty/ANGLE/src/tests/test_expectations/GPUTestConfig.cpp
    M Source/ThirdParty/ANGLE/src/tests/test_utils/ANGLETest.cpp
    M Source/ThirdParty/ANGLE/src/tests/test_utils/ANGLETest.h
    M Source/ThirdParty/ANGLE/src/tests/test_utils/VulkanExternalHelper.cpp
    M Source/ThirdParty/ANGLE/src/tests/test_utils/VulkanExternalHelper.h
    M Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.cpp
    M Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_configs.h
    M Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_instantiate.cpp
    M Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_instantiate.h
    A Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_platform.cpp
    A Source/ThirdParty/ANGLE/src/tests/test_utils/angle_test_platform.h
    M Source/ThirdParty/ANGLE/src/tests/test_utils/draw_call_perf_utils.cpp
    M Source/ThirdParty/ANGLE/src/tests/test_utils/draw_call_perf_utils.h
    A Source/ThirdParty/ANGLE/src/tests/test_utils/runner/README.md
    A Source/ThirdParty/ANGLE/src/tests/test_utils/runner/TestSuite.cpp
    A Source/ThirdParty/ANGLE/src/tests/test_utils/runner/TestSuite.h
    A Source/ThirdParty/ANGLE/src/tests/test_utils/runner/TestSuite_unittest.cpp
    M Source/ThirdParty/ANGLE/src/tests/test_utils/third_party/vulkan_command_buffer_utils.cpp
    M Source/ThirdParty/ANGLE/src/tests/test_utils/third_party/vulkan_command_buffer_utils.h
    M Source/ThirdParty/ANGLE/src/third_party/khronos/GL/wglext.h
    A Source/ThirdParty/ANGLE/src/third_party/volk/BUILD.gn
    A Source/ThirdParty/ANGLE/src/third_party/volk/LICENSE.md
    A Source/ThirdParty/ANGLE/src/third_party/volk/README.chromium
    A Source/ThirdParty/ANGLE/src/third_party/volk/README.md
    A Source/ThirdParty/ANGLE/src/third_party/volk/volk.c
    A Source/ThirdParty/ANGLE/src/third_party/volk/volk.h
    M Source/ThirdParty/ANGLE/third_party/libpng/BUILD.gn
    M Source/ThirdParty/ANGLE/third_party/rapidjson/BUILD.gn
    R Source/ThirdParty/ANGLE/third_party/vulkan-loader/BUILD.gn
    A Source/ThirdParty/ANGLE/tools/angle_tools.py
    A Source/ThirdParty/ANGLE/tools/flex-bison/README.md
    A Source/ThirdParty/ANGLE/tools/flex-bison/linux/bison.sha1
    A Source/ThirdParty/ANGLE/tools/flex-bison/linux/flex.sha1
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/.gitattributes
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/m4sugar/LICENSE
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/m4sugar/README.chromium
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/m4sugar/foreach.m4
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/m4sugar/m4sugar.m4
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/LICENSE
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/README.chromium
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/bison.m4
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/c-like.m4
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/c.m4
    A Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/yacc.c
    A Source/ThirdParty/ANGLE/tools/flex-bison/update_flex_bison_binaries.py
    A Source/ThirdParty/ANGLE/tools/flex-bison/windows/bison.exe.sha1
    A Source/ThirdParty/ANGLE/tools/flex-bison/windows/flex.exe.sha1
    A Source/ThirdParty/ANGLE/tools/flex-bison/windows/m4.exe.sha1
    A Source/ThirdParty/ANGLE/tools/flex-bison/windows/msys-2.0.dll.sha1
    A Source/ThirdParty/ANGLE/tools/flex-bison/windows/msys-iconv-2.dll.sha1
    A Source/ThirdParty/ANGLE/tools/flex-bison/windows/msys-intl-8.dll.sha1
    M Source/ThirdParty/ANGLE/tools/glslang/README.md
    M Source/ThirdParty/ANGLE/tools/glslang/update_glslang_binary.py
    M Source/ThirdParty/ANGLE/update-angle.sh
    A Source/ThirdParty/ANGLE/util/BUILD.gn
    M Source/ThirdParty/ANGLE/util/EGLPlatformParameters.h
    M Source/ThirdParty/ANGLE/util/EGLWindow.cpp
    M Source/ThirdParty/ANGLE/util/Timer.h
    M Source/ThirdParty/ANGLE/util/egl_loader_autogen.cpp
    M Source/ThirdParty/ANGLE/util/egl_loader_autogen.h
    M Source/ThirdParty/ANGLE/util/fuchsia/ScenicWindow.cpp
    M Source/ThirdParty/ANGLE/util/fuchsia/ScenicWindow.h
    M Source/ThirdParty/ANGLE/util/gles_loader_autogen.cpp
    M Source/ThirdParty/ANGLE/util/gles_loader_autogen.h
    M Source/ThirdParty/ANGLE/util/posix/crash_handler_posix.cpp
    M Source/ThirdParty/ANGLE/util/test_utils.h
    M Source/ThirdParty/ANGLE/util/test_utils_unittest_helper.cpp
    M Source/ThirdParty/ANGLE/util/test_utils_unittest_helper.h
    M Source/ThirdParty/ANGLE/util/util.gni
    M Source/ThirdParty/ANGLE/util/util_export.h
    M Source/ThirdParty/ANGLE/util/windows/test_utils_win.cpp
    A Source/ThirdParty/ANGLE/util/windows/test_utils_winuwp.cpp
    M Source/ThirdParty/ANGLE/util/windows/wgl_loader_autogen.cpp
    M Source/ThirdParty/ANGLE/util/windows/wgl_loader_autogen.h
    M Source/ThirdParty/ANGLE/util/windows/win32/test_utils_win32.cpp

  Log Message:
  -----------
  Merge r255782 - Update ANGLE
https://bugs.webkit.org/show_bug.cgi?id=206318

Several important changes to fix layout test failures and timeouts in this update.
- Made expensive validation non-default in debug mode to reduce timeouts.
- Optimize disabling ARB_texture_rectangle to make shader compilation much faster.
- Flush before texture deletion to work around Mac Intel driver bug.

Patch by James Darpinian <jdarpinian at chromium.org> on 2020-02-04
Reviewed by Dean Jackson.

* ANGLE.plist: update commit hash
* ANGLE.xcodeproj/project.pbxproj: Add/remove files
* Compiler.cmake: Translated from compiler.gni
* GLESv2.cmake: Translated from libGLESv2.gni
* changes.diff: Now lists all changes from upstream.
* update-angle.sh: Diff command was wrong.
* Plus a whole lot of changes from upstream.


  Commit: 21ed13a0cea52000f11430ed6e721e6ec64521cf
      https://github.com/WebKit/WebKit/commit/21ed13a0cea52000f11430ed6e721e6ec64521cf
  Author: Darin Adler <darin at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Headers.cmake
    M Source/WebCore/Sources.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/css/CSSPrimitiveValue.cpp
    M Source/WebCore/css/CSSPrimitiveValue.h
    M Source/WebCore/css/DeprecatedCSSOMPrimitiveValue.cpp
    M Source/WebCore/css/DeprecatedCSSOMRGBColor.h
    R Source/WebCore/css/RGBColor.cpp
    R Source/WebCore/css/RGBColor.h
    M Source/WebCore/css/StyleColor.cpp
    M Source/WebCore/editing/cocoa/HTMLConverter.mm
    M Source/WebCore/inspector/InspectorOverlay.cpp
    M Source/WebCore/page/cocoa/ResourceUsageOverlayCocoa.mm
    M Source/WebCore/platform/graphics/Color.cpp
    M Source/WebCore/platform/graphics/Color.h
    M Source/WebCore/platform/graphics/ImageBackingStore.h
    M Source/WebCore/platform/graphics/ImageFrame.h
    M Source/WebCore/platform/graphics/ImageSource.h
    M Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
    M Source/WebCore/platform/graphics/cg/ColorCG.cpp
    M Source/WebCore/platform/graphics/mac/ColorMac.mm
    M Source/WebCore/platform/graphics/win/ColorDirect2D.cpp
    M Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
    M Source/WebCore/platform/mock/MockRealtimeMediaSourceCenter.cpp
    M Source/WebCore/platform/mock/MockRealtimeVideoSource.cpp
    M Source/WebCore/platform/mock/ScrollbarThemeMock.cpp
    M Source/WebCore/rendering/RenderObject.cpp
    M Source/WebCore/rendering/RenderTheme.cpp
    M Source/WebCore/rendering/RenderThemeMac.mm
    M Source/WebCore/rendering/RenderTreeAsText.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/WebCoreArgumentCoders.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/PDFSnapshot.mm

  Log Message:
  -----------
  Merge r255785 - Replace RGBA32 typedef with a class to improve type safety
https://bugs.webkit.org/show_bug.cgi?id=206862

Reviewed by Sam Weinig.

Source/WebCore:

* Headers.cmake: Remove RGBColor.h.
* Sources.txt: Remove RBGColor.cpp.
* WebCore.xcodeproj/project.pbxproj: Remove RGBColor.h and RGBColor.cpp.

* css/CSSPrimitiveValue.cpp: Removed include of RGBColor.h.
(WebCore::CSSPrimitiveValue::getCounterValue const): Deleted.
(WebCore::CSSPrimitiveValue::getRectValue const): Deleted.
(WebCore::CSSPrimitiveValue::getRGBColorValue const): Deleted.
* css/CSSPrimitiveValue.h: Updated for the above.

* css/DeprecatedCSSOMPrimitiveValue.cpp:
(WebCore::DeprecatedCSSOMPrimitiveValue::getCounterValue const): Use
CSSPrimitiveValue::counterValue.
(WebCore::DeprecatedCSSOMPrimitiveValue::getRectValue const): Use
CSSPrimitiveValue::rectValue.
(WebCore::DeprecatedCSSOMPrimitiveValue::getRGBColorValue const): USe
CSSPrimitiveValue::isRGBColor and CSSPrimitiveValue::color.

* css/DeprecatedCSSOMRGBColor.h: Store a Color instead of an RGBA32.
Take a Color argument instead of a RGBColor argument. Refactored to
use a createWrapper template function member to tighten the code.

* css/RGBColor.cpp: Removed.
* css/RGBColor.h: Removed.

* css/StyleColor.cpp:
(WebCore::StyleColor::colorFromKeyword): Explicitly convert to SimpleColor
rather than relying on initializing a Color from an integer ARGB value.

* editing/cocoa/HTMLConverter.mm: Removed include of RGBColor.h.

* inspector/InspectorOverlay.cpp:
(WebCore::drawOutlinedQuadWithClip): Use the Color constructor instead of
Color::createUnchecked.

* page/cocoa/ResourceUsageOverlayCocoa.mm:
(WebCore::HistoricMemoryCategoryInfo::HistoricMemoryCategoryInfo): Use
explicit SimpleColor rather than relying on initializing a Color from an
integer ARGB value.

* platform/graphics/Color.cpp: Use constexpr for constant colors.
(WebCore::makeRGB): Implement by calling makeRGBA.
(WebCore::makeRGBA): Use an explicit argument list to call the
SimpleColor constructor.
(WebCore::makeRGBA32FromFloats): Implement by calling makeRGBA.
(WebCore::colorWithOverrideAlpha): Use an explicit argument list to call
the SimpleColor constructor.
(WebCore::parseHexColorInternal): Ditto.
(WebCore::Color::Color): Removed unneeded code to set the color
to invalid, since that's already the default for a new Color object.
Also tweak the logic a bit and add explicit argument list for the
SimpleColor constructor.
(WebCore::SimpleColor::serializationForHTML const): Added. Factored out of
the Color::serialized function.
(WebCore::Color::serialized const): Changed to call serializationForHTML.
(WebCore::fractionDigitsForFractionalAlphaValue): Renamed slightly shorter.
(WebCore::SimpleColor::serializationForCSS const): Added. Factored out of
the Color::cssText function.
(WebCore::Color::cssText const): Changed to call serializationForCSS.
(WebCore::RGBA32::serializationForRenderTreeAsText const): Added.
Factored out of nameForRenderTreeAsText.
(WebCore::Color::nameForRenderTreeAsText const): Changed to call
serializationForRenderTreeAsText.
(WebCore::colorFromPremultipliedARGB): Updated to use the SimpleColor
member functions instead of the red/green/blue/alphaChannel functions.
(WebCore::blend): Use Color::transparent for blending where the old
code used 0 and relied on how that is converted to a Color.

* platform/graphics/Color.h: Replaced the RGBA32 typedef and the
RGBA class with a new class named SimpleColor. Deleted the four
red/green/blue/alphaChannel functions, the Color constructor that
takes and RGBA, and the Color::createUnchecked function. Changed
the color constants to all be constexpr. Moved the inline function
definitions until after everything is delcared.

* platform/graphics/ImageBackingStore.h:
(WebCore::ImageBackingStore::setSize): Use uint32_t instead of RGBA32.
(WebCore::ImageBackingStore::clear): Ditto.
(WebCore::ImageBackingStore::clearRect): Ditto.
(WebCore::ImageBackingStore::fillRect): Ditto.
(WebCore::ImageBackingStore::repeatFirstRow): Ditto.
(WebCore::ImageBackingStore::pixelAt const): Ditto.
(WebCore::ImageBackingStore::setPixel): Ditto.
(WebCore::ImageBackingStore::blendPixel): Ditto. Convert to and from
SimpleColor so we can use various functions that operate on that type.
Use the isVisible and red/green/blue/alphaComponent member functions.
(WebCore::ImageBackingStore::ImageBackingStore): Ditto.
(WebCore::ImageBackingStore::pixelValue const): Use Color::transparent
instead of returning a 0 and relying on how that is converted to a Color.

* platform/graphics/ImageFrame.h: Removed include of ImageBackingStore.h.
* platform/graphics/ImageSource.h: Added forward delaration of SharedBuffer.

* platform/graphics/cairo/ImageBufferCairo.cpp:
(WebCore::ImageBuffer::platformTransformColorSpace): Call value() to
convert RGBA32, which is now a class, to an 32-bit ARGB integer.

* platform/graphics/cg/ColorCG.cpp:
(WebCore::cachedCGColor): Use constexpr SimpleColor::value function to
switch on a SimpleColor.

* platform/graphics/mac/ColorMac.mm:
(WebCore::oldAquaFocusRingColor): Use an explicit SimpleColor to turn a
hex integer into a Color without relying on implicit conversion.

* platform/graphics/win/ColorDirect2D.cpp:
(WebCore::Color::operator D2D1_COLOR_F const): Use value() to get the color
integer, just to keep this working. Probably needs a better implementation
at some point.

* platform/image-decoders/png/PNGImageDecoder.cpp:
(WebCore::PNGImageDecoder::rowAvailable): Don't use makeRGB any more,
write the expression out here instead. More efficient anyway since these
are already single bytes.

* platform/mock/MockRealtimeMediaSourceCenter.cpp:
(WebCore::defaultDevices):  Use an explicit SimpleColor to turn a
hex integer into a Color without relying on implicit conversion.
* platform/mock/MockRealtimeVideoSource.cpp:
(WebCore::MockRealtimeVideoSource::drawBoxes): Ditto. Also use a modern
for loop instead of indexing.
* platform/mock/ScrollbarThemeMock.cpp:
(WebCore::ScrollbarThemeMock::paintTrackBackground): Ditto.
* rendering/RenderObject.cpp:
(WebCore::RenderObject::calculateBorderStyleColor): Ditto.
* rendering/RenderTheme.cpp:
(WebCore::RenderTheme::systemColor const): Ditto. Also used named colors.
* rendering/RenderThemeMac.mm:
(WebCore::RenderThemeMac::systemColor const): Ditto.

* rendering/RenderTreeAsText.cpp:
(WebCore::RenderTreeAsText::writeRenderObject): Added checks against
Color::transparent instead of converting to an integer and checking
against 0. Removed unneeded isValid checks, since invalid color's ARGB
value is Color::transparent.

Source/WebKit:

* Shared/WebCoreArgumentCoders.cpp:
(IPC::ArgumentCoder<Color>::encode): Use uint32_t explicitly to convert
the color value into a SimpleColor.
(IPC::ArgumentCoder<Color>::decode): Same thing, only the other direction.

Tools:

* TestWebKitAPI/Tests/WebKitCocoa/PDFSnapshot.mm:
(TestWebKitAPI::TEST): Use the Color constructor instead of Color::createUnchecked.


  Commit: f3e3004db3c2aa8765febd4868f31c9b34e4fffe
      https://github.com/WebKit/WebKit/commit/f3e3004db3c2aa8765febd4868f31c9b34e4fffe
  Author: Lauro Moura <lmoura at igalia.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations

  Log Message:
  -----------
  Merge r255787 - [GTK] Garden some wpt tests failing with harness timeout
https://bugs.webkit.org/show_bug.cgi?id=207247

Unreviewed test gardening.

* platform/gtk/TestExpectations:


  Commit: 008a946b8a8cec1b02b1ef17d1984e15e08b0f70
      https://github.com/WebKit/WebKit/commit/008a946b8a8cec1b02b1ef17d1984e15e08b0f70
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-05 (Wed, 05 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/Structure.h

  Log Message:
  -----------
  Merge r255788 - [JSC] Structure::setMaxOffset and setTransitionOffset are racy
https://bugs.webkit.org/show_bug.cgi?id=207249

Reviewed by Mark Lam.

We hit crash in JSTests/stress/array-slice-osr-exit-2.js. The situation is following.

    1. The mutator thread (A) is working.
    2. The concurrent collector (B) is working.
    3. A attempts to set m_maxOffset in StructureRareData by allocating it. First, A sets Structure::m_maxOffset to useRareDataFlag.
    3. B is in JSObject::visitButterflyImpl, and executing Structure::maxOffset().
    4. B detects that m_maxOffset is useRareDataFlag.
    5. B attempts to load rareData, but this is not a StructureRareData since A is just now setting up StructureRareData.
    6. B crashes.

Set useRareDataFlag after StructureRareData is set. Ensuring this store-order by using storeStoreFence.

* runtime/Structure.h:


  Commit: 0e1060afc06c1f90edd5285701cdf9e5b308d3c9
      https://github.com/WebKit/WebKit/commit/0e1060afc06c1f90edd5285701cdf9e5b308d3c9
  Author: Philippe Normand <philn at igalia.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r255790 - [GStreamer] Client-side video rendering doesn't fallback to internal compositing
https://bugs.webkit.org/show_bug.cgi?id=207208

Patch by Philippe Normand <philn at igalia.com> on 2020-02-05
Reviewed by Xabier Rodriguez-Calvar and Žan Doberšek.

Refactor the default video composition code into a self-contained
closure and invoke it if the video frame holder failed to export
the EGLImage to a valid DMABuf.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::GstVideoFrameHolder::GstVideoFrameHolder):
(WebCore::GstVideoFrameHolder::hasDMABuf const):
(WebCore::MediaPlayerPrivateGStreamer::pushTextureToCompositor):


  Commit: cd2c1a37003cc43ae2ecb0c62e91778d2b147f43
      https://github.com/WebKit/WebKit/commit/cd2c1a37003cc43ae2ecb0c62e91778d2b147f43
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/webanimations/accelerated-animation-canceled-before-commit-expected.html
    A LayoutTests/webanimations/accelerated-animation-canceled-before-commit.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/KeyframeEffect.cpp

  Log Message:
  -----------
  Merge r255810 - [Web Animations] Canceling an accelerated animation before it was committed does not prevent it from playing
https://bugs.webkit.org/show_bug.cgi?id=207253
<rdar://problem/59143624>

Reviewed by Antti Koivisto.

Source/WebCore:

Test: webanimations/accelerated-animation-canceled-before-commit.html

Merely checking whether an accelerated animation is running prior to enqueuing an action to cancel it is not sufficient
since there could be an uncommitted change to start it upon the next animation frame. The same logic would need to apply
in other situations where the playback state changes for a potentially in-flight animation.

* animation/KeyframeEffect.cpp:
(WebCore::KeyframeEffect::animationDidSeek):
(WebCore::KeyframeEffect::animationWasCanceled):
(WebCore::KeyframeEffect::willChangeRenderer):
(WebCore::KeyframeEffect::animationSuspensionStateDidChange):

LayoutTests:

Add a new test that checks that an accelerated animation that has been enqueued to start but has
not yet been committed is correctly canceled when the cancel() method is called. This test fails
prior to this source change.

* webanimations/accelerated-animation-canceled-before-commit-expected.html: Added.
* webanimations/accelerated-animation-canceled-before-commit.html: Added.


  Commit: e660be5d57eb0d84217f0057f18a18b5f55264e0
      https://github.com/WebKit/WebKit/commit/e660be5d57eb0d84217f0057f18a18b5f55264e0
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessPool.cpp

  Log Message:
  -----------
  Merge r255814 - Unreviewed, follow-up assertion fix after r255662.

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::initializeNewWebProcess):


  Commit: 4466f6efb7d154c75cb131c70ca60c0909c94556
      https://github.com/WebKit/WebKit/commit/4466f6efb7d154c75cb131c70ca60c0909c94556
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebStorage/StorageAreaImpl.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageAreaImpl.h
    M Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageAreaMap.h
    M Source/WebKit/WebProcess/WebStorage/StorageNamespaceImpl.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageNamespaceImpl.h

  Log Message:
  -----------
  Merge r255815 - Unreviewed, rolling out r255706.

Caused assertions in API tests

Reverted changeset:

"Partial revert of r248734 to fix leak of StorageAreaMaps"
https://bugs.webkit.org/show_bug.cgi?id=207073
https://trac.webkit.org/changeset/255706


  Commit: 38e392d3cd15ba385224d222d9cb7e90e26bf6a8
      https://github.com/WebKit/WebKit/commit/38e392d3cd15ba385224d222d9cb7e90e26bf6a8
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/resources/import-expectations.json
    M LayoutTests/imported/w3c/resources/resource-files.json
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/AnimationEffect-getComputedTiming.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-canceling.tentative.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-compositeOrder.tentative-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-compositeOrder.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-effect.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-finished.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-getCurrentTime.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-id.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-playState.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-ready.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSAnimation-startTime.tentative.html
    R LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSPseudoElement-getAnimations.tentative-expected.txt
    R LayoutTests/imported/w3c/web-platform-tests/css/css-animations/CSSPseudoElement-getAnimations.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/Document-getAnimations.tentative-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/Document-getAnimations.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/Element-getAnimations-dynamic-changes.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/Element-getAnimations.tentative-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/Element-getAnimations.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/KeyframeEffect-getKeyframes.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/KeyframeEffect-target.tentative.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-animations/animation-before-initial-box-construction-001-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-animations/animation-before-initial-box-construction-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/animationevent-interface.js
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/keyframes-remove-documentElement-crash.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-animations/support/empty-sheet.css
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/support/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-bottom-left-radius-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-bottom-right-radius-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-bottom-width-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-image-outset-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-image-slice-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-image-width-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-left-width-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-right-width-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-top-left-radius-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-top-right-radius-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-backgrounds/animations/border-top-width-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-fonts/animations/font-variation-settings-composition-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/AnimationEffect-getComputedTiming.tentative.html
    R LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSPseudoElement-getAnimations.tentative-expected.txt
    R LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSPseudoElement-getAnimations.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSTransition-canceling.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSTransition-currentTime.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSTransition-effect.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSTransition-finished.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSTransition-ready.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSTransition-startTime.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/Document-getAnimations.tentative-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/Document-getAnimations.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/Element-getAnimations.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/KeyframeEffect-getKeyframes.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/KeyframeEffect-target.tentative.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/README.md
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/text-shadow-composition-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/text-shadow-composition.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/text-shadow-interpolation-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/text-shadow-interpolation.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/vertical-align-composition-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/vertical-align-composition.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/vertical-align-interpolation-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/vertical-align-interpolation.html
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/w3c-import.log
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/z-index-interpolation-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/animations/z-index-interpolation.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/before-load-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/parsing/transition-timing-function-computed-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/parsing/transition-timing-function-computed.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/properties-value-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/properties-value-002.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/properties-value-003.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/properties-value-auto-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/properties-value-implicit-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/properties-value-inherit-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/properties-value-inherit-002.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/properties-value-inherit-003.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/pseudo-elements-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-delay-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-duration-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-property-001.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transition-property-002.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/transitionevent-interface.html
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/css/support/interpolation-testcommon.js
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/README.md
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/animation-model/animation-types/property-list.js
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/animation-model/combining-effects/applying-interpolated-transform-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/animation-model/combining-effects/applying-interpolated-transform.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/animation-model/combining-effects/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animatable/animate-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animatable/animate.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/commitStyles-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/commitStyles.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/onremove-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/onremove.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/pause.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/play.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/AnimationEffect/updateTiming.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/AnimationPlaybackEvent/w3c-import.log
    R LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Document/getAnimations-expected.txt
    R LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Document/getAnimations.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Document/w3c-import.log
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/DocumentOrShadowRoot/getAnimations-expected.txt
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/DocumentOrShadowRoot/getAnimations.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/DocumentOrShadowRoot/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/DocumentTimeline/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/constructor.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/processing-a-keyframes-argument-001.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/processing-a-keyframes-argument-002.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/setKeyframes.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/style-change-events-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/style-change-events.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/target-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/target.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/testcommon.js
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/finishing-an-animation-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/finishing-an-animation.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/pausing-an-animation-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/pausing-an-animation.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/playing-an-animation-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/playing-an-animation.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/reverse-running-animation-expected.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/reverse-running-animation.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/reversing-an-animation.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/setting-the-current-time-of-an-animation-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/setting-the-current-time-of-an-animation.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/setting-the-playback-rate-of-an-animation-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/setting-the-playback-rate-of-an-animation.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/setting-the-start-time-of-an-animation-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/setting-the-start-time-of-an-animation.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/sync-start-times-expected.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/sync-start-times.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/update-playback-rate-fast-expected.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/update-playback-rate-fast.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/update-playback-rate-slow-expected.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/update-playback-rate-slow.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/update-playback-rate-zero-expected.html
    A LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/update-playback-rate-zero.html
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/animations/w3c-import.log
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/w3c-import.log
    M LayoutTests/tests-options.json

  Log Message:
  -----------
  Merge r255821 - [Web Animations] Update snapshot of Web Animations, CSS Animations and CSS Transitions WPT tests
https://bugs.webkit.org/show_bug.cgi?id=207263

Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

* resources/import-expectations.json:
* resources/resource-files.json:
* web-platform-tests/css/css-animations/AnimationEffect-getComputedTiming.tentative.html:
* web-platform-tests/css/css-animations/CSSAnimation-canceling.tentative.html:
* web-platform-tests/css/css-animations/CSSAnimation-compositeOrder.tentative-expected.txt: Added.
* web-platform-tests/css/css-animations/CSSAnimation-compositeOrder.tentative.html: Added.
* web-platform-tests/css/css-animations/CSSAnimation-effect.tentative.html:
* web-platform-tests/css/css-animations/CSSAnimation-finished.tentative.html:
* web-platform-tests/css/css-animations/CSSAnimation-getCurrentTime.tentative.html:
* web-platform-tests/css/css-animations/CSSAnimation-id.tentative.html:
* web-platform-tests/css/css-animations/CSSAnimation-playState.tentative.html:
* web-platform-tests/css/css-animations/CSSAnimation-ready.tentative.html:
* web-platform-tests/css/css-animations/CSSAnimation-startTime.tentative.html:
* web-platform-tests/css/css-animations/CSSPseudoElement-getAnimations.tentative-expected.txt: Removed.
* web-platform-tests/css/css-animations/CSSPseudoElement-getAnimations.tentative.html: Removed.
* web-platform-tests/css/css-animations/Document-getAnimations.tentative-expected.txt:
* web-platform-tests/css/css-animations/Document-getAnimations.tentative.html:
* web-platform-tests/css/css-animations/Element-getAnimations-dynamic-changes.tentative.html:
* web-platform-tests/css/css-animations/Element-getAnimations.tentative-expected.txt:
* web-platform-tests/css/css-animations/Element-getAnimations.tentative.html:
* web-platform-tests/css/css-animations/KeyframeEffect-getKeyframes.tentative.html:
* web-platform-tests/css/css-animations/KeyframeEffect-target.tentative.html:
* web-platform-tests/css/css-animations/animation-before-initial-box-construction-001-expected.txt: Added.
* web-platform-tests/css/css-animations/animation-before-initial-box-construction-001.html: Added.
* web-platform-tests/css/css-animations/animationevent-interface.js:
(test):
* web-platform-tests/css/css-animations/keyframes-remove-documentElement-crash.html:
* web-platform-tests/css/css-animations/support/empty-sheet.css: Added.
* web-platform-tests/css/css-animations/support/w3c-import.log:
* web-platform-tests/css/css-animations/w3c-import.log:
* web-platform-tests/css/css-backgrounds/animations/border-bottom-left-radius-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-bottom-right-radius-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-bottom-width-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-image-outset-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-image-slice-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-image-width-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-left-width-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-right-width-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-top-left-radius-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-top-right-radius-composition-expected.txt:
* web-platform-tests/css/css-backgrounds/animations/border-top-width-composition-expected.txt:
* web-platform-tests/css/css-fonts/animations/font-variation-settings-composition-expected.txt:
* web-platform-tests/css/css-transitions/AnimationEffect-getComputedTiming.tentative.html:
* web-platform-tests/css/css-transitions/CSSPseudoElement-getAnimations.tentative-expected.txt: Removed.
* web-platform-tests/css/css-transitions/CSSPseudoElement-getAnimations.tentative.html: Removed.
* web-platform-tests/css/css-transitions/CSSTransition-canceling.tentative.html:
* web-platform-tests/css/css-transitions/CSSTransition-currentTime.tentative.html:
* web-platform-tests/css/css-transitions/CSSTransition-effect.tentative.html:
* web-platform-tests/css/css-transitions/CSSTransition-finished.tentative.html:
* web-platform-tests/css/css-transitions/CSSTransition-ready.tentative.html:
* web-platform-tests/css/css-transitions/CSSTransition-startTime.tentative.html:
* web-platform-tests/css/css-transitions/Document-getAnimations.tentative-expected.txt:
* web-platform-tests/css/css-transitions/Document-getAnimations.tentative.html:
* web-platform-tests/css/css-transitions/Element-getAnimations.tentative.html:
* web-platform-tests/css/css-transitions/KeyframeEffect-getKeyframes.tentative.html:
* web-platform-tests/css/css-transitions/KeyframeEffect-target.tentative.html:
* web-platform-tests/css/css-transitions/README.md:
* web-platform-tests/css/css-transitions/animations/text-shadow-composition-expected.txt: Added.
* web-platform-tests/css/css-transitions/animations/text-shadow-composition.html: Added.
* web-platform-tests/css/css-transitions/animations/text-shadow-interpolation-expected.txt: Added.
* web-platform-tests/css/css-transitions/animations/text-shadow-interpolation.html: Added.
* web-platform-tests/css/css-transitions/animations/vertical-align-composition-expected.txt: Added.
* web-platform-tests/css/css-transitions/animations/vertical-align-composition.html: Added.
* web-platform-tests/css/css-transitions/animations/vertical-align-interpolation-expected.txt: Added.
* web-platform-tests/css/css-transitions/animations/vertical-align-interpolation.html: Added.
* web-platform-tests/css/css-transitions/animations/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/web-animations/animation-model/combining-effects/w3c-import.log.
* web-platform-tests/css/css-transitions/animations/z-index-interpolation-expected.txt: Added.
* web-platform-tests/css/css-transitions/animations/z-index-interpolation.html: Added.
* web-platform-tests/css/css-transitions/before-load-001.html:
* web-platform-tests/css/css-transitions/parsing/transition-timing-function-computed-expected.txt:
* web-platform-tests/css/css-transitions/parsing/transition-timing-function-computed.html:
* web-platform-tests/css/css-transitions/properties-value-001.html:
* web-platform-tests/css/css-transitions/properties-value-002.html:
* web-platform-tests/css/css-transitions/properties-value-003.html:
* web-platform-tests/css/css-transitions/properties-value-auto-001.html:
* web-platform-tests/css/css-transitions/properties-value-implicit-001.html:
* web-platform-tests/css/css-transitions/properties-value-inherit-001.html:
* web-platform-tests/css/css-transitions/properties-value-inherit-002.html:
* web-platform-tests/css/css-transitions/properties-value-inherit-003.html:
* web-platform-tests/css/css-transitions/pseudo-elements-001.html:
* web-platform-tests/css/css-transitions/transition-001.html:
* web-platform-tests/css/css-transitions/transition-delay-001.html:
* web-platform-tests/css/css-transitions/transition-duration-001.html:
* web-platform-tests/css/css-transitions/transition-property-001.html:
* web-platform-tests/css/css-transitions/transition-property-002.html:
* web-platform-tests/css/css-transitions/transitionevent-interface.html:
* web-platform-tests/css/css-transitions/w3c-import.log:
* web-platform-tests/css/support/interpolation-testcommon.js:
(cssAnimationsInterpolation.isSupported):
(cssTransitionsInterpolation.isSupported):
(cssTransitionAllInterpolation.isSupported):
(webAnimationsInterpolation.isSupported):
(webAnimationsInterpolation.interpolateComposite):
(createInterpolationTestTargets):
(create_tests):
(test_interpolation):
* web-platform-tests/web-animations/README.md:
* web-platform-tests/web-animations/animation-model/animation-types/property-list.js:
(testAnimationSamplesWithAnyOrder):
* web-platform-tests/web-animations/animation-model/combining-effects/applying-interpolated-transform-expected.txt: Added.
* web-platform-tests/web-animations/animation-model/combining-effects/applying-interpolated-transform.html: Added.
* web-platform-tests/web-animations/animation-model/combining-effects/w3c-import.log:
* web-platform-tests/web-animations/interfaces/Animatable/animate-expected.txt:
* web-platform-tests/web-animations/interfaces/Animatable/animate.html:
* web-platform-tests/web-animations/interfaces/Animation/commitStyles-expected.txt:
* web-platform-tests/web-animations/interfaces/Animation/commitStyles.html:
* web-platform-tests/web-animations/interfaces/Animation/onremove-expected.txt: Added.
* web-platform-tests/web-animations/interfaces/Animation/onremove.html: Added.
* web-platform-tests/web-animations/interfaces/Animation/pause.html:
* web-platform-tests/web-animations/interfaces/Animation/play.html:
* web-platform-tests/web-animations/interfaces/Animation/w3c-import.log:
* web-platform-tests/web-animations/interfaces/AnimationEffect/updateTiming.html:
* web-platform-tests/web-animations/interfaces/AnimationPlaybackEvent/w3c-import.log:
* web-platform-tests/web-animations/interfaces/Document/getAnimations-expected.txt: Removed.
* web-platform-tests/web-animations/interfaces/Document/w3c-import.log:
* web-platform-tests/web-animations/interfaces/DocumentOrShadowRoot/getAnimations-expected.txt: Added.
* web-platform-tests/web-animations/interfaces/DocumentOrShadowRoot/getAnimations.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Document/getAnimations.html.
* web-platform-tests/web-animations/interfaces/DocumentOrShadowRoot/w3c-import.log: Copied from LayoutTests/imported/w3c/web-platform-tests/css/css-animations/support/w3c-import.log.
* web-platform-tests/web-animations/interfaces/DocumentTimeline/w3c-import.log:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/constructor.html:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/processing-a-keyframes-argument-001.html:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/processing-a-keyframes-argument-002.html:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/setKeyframes.html:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/style-change-events-expected.txt:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/style-change-events.html:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/target-expected.txt:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/target.html:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/w3c-import.log:
* web-platform-tests/web-animations/testcommon.js:
(cubicBezier): Deleted.
* web-platform-tests/web-animations/timing-model/animations/finishing-an-animation-expected.txt:
* web-platform-tests/web-animations/timing-model/animations/finishing-an-animation.html:
* web-platform-tests/web-animations/timing-model/animations/pausing-an-animation-expected.txt:
* web-platform-tests/web-animations/timing-model/animations/pausing-an-animation.html:
* web-platform-tests/web-animations/timing-model/animations/playing-an-animation-expected.txt:
* web-platform-tests/web-animations/timing-model/animations/playing-an-animation.html:
* web-platform-tests/web-animations/timing-model/animations/reverse-running-animation-expected.html: Added.
* web-platform-tests/web-animations/timing-model/animations/reverse-running-animation.html: Added.
* web-platform-tests/web-animations/timing-model/animations/reversing-an-animation.html:
* web-platform-tests/web-animations/timing-model/animations/setting-the-current-time-of-an-animation-expected.txt:
* web-platform-tests/web-animations/timing-model/animations/setting-the-current-time-of-an-animation.html:
* web-platform-tests/web-animations/timing-model/animations/setting-the-playback-rate-of-an-animation-expected.txt:
* web-platform-tests/web-animations/timing-model/animations/setting-the-playback-rate-of-an-animation.html:
* web-platform-tests/web-animations/timing-model/animations/setting-the-start-time-of-an-animation-expected.txt:
* web-platform-tests/web-animations/timing-model/animations/setting-the-start-time-of-an-animation.html:
* web-platform-tests/web-animations/timing-model/animations/sync-start-times-expected.html: Added.
* web-platform-tests/web-animations/timing-model/animations/sync-start-times.html: Added.
* web-platform-tests/web-animations/timing-model/animations/update-playback-rate-fast-expected.html: Added.
* web-platform-tests/web-animations/timing-model/animations/update-playback-rate-fast.html: Added.
* web-platform-tests/web-animations/timing-model/animations/update-playback-rate-slow-expected.html: Added.
* web-platform-tests/web-animations/timing-model/animations/update-playback-rate-slow.html: Added.
* web-platform-tests/web-animations/timing-model/animations/update-playback-rate-zero-expected.html: Added.
* web-platform-tests/web-animations/timing-model/animations/update-playback-rate-zero.html: Added.
* web-platform-tests/web-animations/timing-model/animations/w3c-import.log:
* web-platform-tests/web-animations/w3c-import.log:

LayoutTests:

* TestExpectations:
* tests-options.json:


  Commit: 2e16029e40afd81f9b78705ce9ccfbf5ed349060
      https://github.com/WebKit/WebKit/commit/2e16029e40afd81f9b78705ce9ccfbf5ed349060
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/SecurityOrigin.cpp

  Log Message:
  -----------
  Merge r255824 - [GTK] Cannot perform most local loads with sandbox enabled
https://bugs.webkit.org/show_bug.cgi?id=202071

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-02-05
Reviewed by Carlos Garcia Campos.

SecurityOrigin::canDisplay is improperly checking whether the target file URL points to a
file on the same "volume" (mount point) as the source file. That can't happen here because
this code is running in the web process, but only the network process has access to the
unsandboxed filesystem. This code can only check whether the target file exists within the
sandbox's mount namespace, but that's not what we want to do because we're not going to load
that file, we're going to ask the network process to load the file with the same path
outside the mount namespace.

We can probably live without this check. But if bringing it back is desired, it has to be
done someplace totally different, in network process code rather than web process code.

* page/SecurityOrigin.cpp:
(WebCore::SecurityOrigin::canDisplay const):


  Commit: 00791545c4d399d57546360a353f4c1598d64950
      https://github.com/WebKit/WebKit/commit/00791545c4d399d57546360a353f4c1598d64950
  Author: Diego Pino Garcia <dpino at igalia.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    A LayoutTests/platform/gtk/imported/w3c/web-platform-tests/css/css-color/animation/opacity-interpolation-expected.txt
    A LayoutTests/platform/gtk/inspector/css/shadow-scoped-style-expected.txt
    A LayoutTests/platform/gtk/webanimations/opacity-animation-yields-compositing-expected.txt
    A LayoutTests/platform/gtk/webanimations/partly-accelerated-transition-by-removing-property-expected.txt
    A LayoutTests/platform/gtk/webanimations/width-and-opacity-separate-animation-yields-compositing-expected.txt

  Log Message:
  -----------
  Merge r255830 - [GTK] Gardening, new baselines and update TestExpectations
https://bugs.webkit.org/show_bug.cgi?id=207259

Unreviewed gardening.

* platform/gtk/TestExpectations:
* platform/gtk/imported/w3c/web-platform-tests/css/css-color/animation/opacity-interpolation-expected.txt: Added.
* platform/gtk/inspector/css/shadow-scoped-style-expected.txt: Added.
* platform/gtk/webanimations/opacity-animation-yields-compositing-expected.txt: Added.
* platform/gtk/webanimations/partly-accelerated-transition-by-removing-property-expected.txt: Added.
* platform/gtk/webanimations/width-and-opacity-separate-animation-yields-compositing-expected.txt: Added.


  Commit: f00c876309d8962910d41c099a3bdea163d7c381
      https://github.com/WebKit/WebKit/commit/f00c876309d8962910d41c099a3bdea163d7c381
  Author: Xabier Rodriguez-Calvar <calvaris at igalia.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Tools/ChangeLog
    M Tools/gtk/jhbuild.modules
    A Tools/gtk/patches/xserver-gl-version.patch

  Log Message:
  -----------
  Merge r255831 - [GTK] Fix dependencies build
https://bugs.webkit.org/show_bug.cgi?id=207273

Reviewed by Carlos Garcia Campos.

* gtk/jhbuild.modules: Bumped wpebackend-fdo version to 1.4.1 and
added mesa as one of its deps. Added the xserver patch as well.
* gtk/patches/xserver-gl-version.patch: Added.


  Commit: 46fbf4a59bc1a0f03f82527ac3e45341cad2426c
      https://github.com/WebKit/WebKit/commit/46fbf4a59bc1a0f03f82527ac3e45341cad2426c
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/persistence/PersistentDecoder.cpp
    M Source/WTF/wtf/persistence/PersistentDecoder.h
    M Source/WTF/wtf/persistence/PersistentEncoder.cpp
    M Source/WTF/wtf/persistence/PersistentEncoder.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/ResourceResponseBase.cpp
    M Source/WebCore/platform/network/ResourceResponseBase.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.cpp
    M Source/WebKit/NetworkProcess/NetworkCORSPreflightChecker.h
    M Source/WebKit/NetworkProcess/NetworkDataTask.cpp
    M Source/WebKit/NetworkProcess/NetworkDataTask.h
    M Source/WebKit/NetworkProcess/NetworkDataTaskBlob.cpp
    M Source/WebKit/NetworkProcess/NetworkLoad.cpp
    M Source/WebKit/NetworkProcess/NetworkLoad.h
    M Source/WebKit/NetworkProcess/NetworkResourceLoader.h
    M Source/WebKit/NetworkProcess/PingLoad.cpp
    M Source/WebKit/NetworkProcess/PingLoad.h
    M Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h
    M Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.h
    M Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm
    M Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm
    M Source/WebKit/NetworkProcess/curl/NetworkDataTaskCurl.cpp
    M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp
    M Source/WebKit/UIProcess/PageLoadState.cpp
    M Source/WebKit/UIProcess/PageLoadState.h
    M Source/WebKit/UIProcess/ProvisionalPageProxy.cpp
    M Source/WebKit/UIProcess/ProvisionalPageProxy.h
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/UIProcess/WebPageProxy.messages.in
    M Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/Challenge.mm
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/TLSDeprecation.mm
    M Tools/TestWebKitAPI/cocoa/HTTPServer.h
    M Tools/TestWebKitAPI/cocoa/HTTPServer.mm

  Log Message:
  -----------
  Merge r255846 - Make WKWebView._negotiatedLegacyTLS accurate when loading main resouorce from network or cache
https://bugs.webkit.org/show_bug.cgi?id=207207

Reviewed by Chris Dumez.

Source/WebCore:

* platform/network/ResourceResponseBase.cpp:
(WebCore::ResourceResponseBase::includeCertificateInfo const):
* platform/network/ResourceResponseBase.h:
(WebCore::ResourceResponseBase::usedLegacyTLS const):
(WebCore::ResourceResponseBase::encode const):
(WebCore::ResourceResponseBase::decode):

Source/WebKit:

In PageLoadState::didCommitLoad, I was resetting the value of _negotiatedLegacyTLS to false.
That created a race condition when loading the main resource because the NetworkProcess would
message the UIProcess setting _negotiatedLegacyTLS to false, while the NetworkProcess would
message the WebProcess which would message the UIProcess to call PageLoadState::didCommitLoad
which would reset it to false.  Now it resets it to the correct value, whatever it is.

Updating the ResourceResponseBase serialization code has the desirable side effect that the disk
cache will remember whether legacy TLS was used to fetch each resource.  This will make it so
_negotiatedLegacyTLS is true if we read content from the disk cache that was originally fetched
using legacy TLS.

In order to not increase the memory footprint of ResourceResponse, I changed m_httpStatusCode from
an int to a short.  It just needs to be able to cover the values 0-600 or so, which really only needs 10 bits.

Covered by new API tests.

* NetworkProcess/NetworkCORSPreflightChecker.cpp:
(WebKit::NetworkCORSPreflightChecker::didReceiveResponse):
* NetworkProcess/NetworkCORSPreflightChecker.h:
* NetworkProcess/NetworkDataTask.cpp:
(WebKit::NetworkDataTask::didReceiveResponse):
(WebKit::NetworkDataTask::negotiatedLegacyTLS const): Deleted.
* NetworkProcess/NetworkDataTask.h:
(WebKit::NetworkDataTaskClient::negotiatedLegacyTLS const): Deleted.
* NetworkProcess/NetworkDataTaskBlob.cpp:
(WebKit::NetworkDataTaskBlob::dispatchDidReceiveResponse):
* NetworkProcess/NetworkLoad.cpp:
(WebKit::NetworkLoad::didReceiveResponse):
(WebKit::NetworkLoad::notifyDidReceiveResponse):
(WebKit::NetworkLoad::throttleDelayCompleted):
(WebKit::NetworkLoad::negotiatedLegacyTLS const): Deleted.
* NetworkProcess/NetworkLoad.h:
* NetworkProcess/NetworkResourceLoader.h:
* NetworkProcess/PingLoad.cpp:
(WebKit::PingLoad::didReceiveResponse):
* NetworkProcess/PingLoad.h:
* NetworkProcess/cocoa/NetworkDataTaskCocoa.h:
* NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTaskCocoa::didReceiveResponse):
* NetworkProcess/cocoa/NetworkSessionCocoa.mm:
(-[WKNetworkSessionDelegate URLSession:dataTask:didReceiveResponse:completionHandler:]):
* NetworkProcess/curl/NetworkDataTaskCurl.cpp:
(WebKit::NetworkDataTaskCurl::invokeDidReceiveResponse):
* NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::dispatchDidReceiveResponse):
* UIProcess/PageLoadState.cpp:
(WebKit::PageLoadState::didCommitLoad):
* UIProcess/PageLoadState.h:
* UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::didCommitLoadForFrame):
* UIProcess/ProvisionalPageProxy.h:
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::commitProvisionalPage):
(WebKit::WebPageProxy::didCommitLoadForFrame):
* UIProcess/WebPageProxy.h:
* UIProcess/WebPageProxy.messages.in:
* WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:
(WebKit::WebFrameLoaderClient::dispatchDidCommitLoad):

Source/WTF:

* wtf/persistence/PersistentDecoder.cpp:
(WTF::Persistence::Decoder::decode):
* wtf/persistence/PersistentDecoder.h:
* wtf/persistence/PersistentEncoder.cpp:
(WTF::Persistence::Encoder::encode):
* wtf/persistence/PersistentEncoder.h:

Tools:

HTTPServer now supports HTTPS. Tell your friends!

* TestWebKitAPI/Tests/WebKitCocoa/Challenge.mm:
(testCertificate):
(testIdentity):
(credentialWithIdentity):
* TestWebKitAPI/Tests/WebKitCocoa/TLSDeprecation.mm:
(TestWebKitAPI::webViewWithNavigationDelegate):
(TestWebKitAPI::TEST):
* TestWebKitAPI/cocoa/HTTPServer.h:
* TestWebKitAPI/cocoa/HTTPServer.mm:
(TestWebKitAPI::HTTPServer::HTTPServer):
(TestWebKitAPI::HTTPServer::request const):


  Commit: d6ba1a3ca37028e62b6ecdd16f8d8f2725bd0e78
      https://github.com/WebKit/WebKit/commit/d6ba1a3ca37028e62b6ecdd16f8d8f2725bd0e78
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngine.cpp

  Log Message:
  -----------
  Merge r255847 - [IPC Hardening] Protect against bad ClientOrigin under Engine::readCachesFromDisk()
https://bugs.webkit.org/show_bug.cgi?id=207280
<rdar://problem/59013832>

Reviewed by Geoffrey Garen.

Protect against bad ClientOrigin under Engine::readCachesFromDisk(), as it is coming from
IPC from the WebContent process.

* NetworkProcess/cache/CacheStorageEngine.cpp:
(WebKit::CacheStorage::Engine::readCachesFromDisk):


  Commit: 78d9f90a5f0728da710d126fccf8ff4ddd550f1d
      https://github.com/WebKit/WebKit/commit/78d9f90a5f0728da710d126fccf8ff4ddd550f1d
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessProxy.cpp

  Log Message:
  -----------
  Merge r255848 - [IPC Hardening] Protect against bad RegistrableDomain under WebProcessProxy::didCollectPrewarmInformation()
https://bugs.webkit.org/show_bug.cgi?id=207281
<rdar://problem/55318108>

Reviewed by Geoffrey Garen.

* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::didCollectPrewarmInformation):


  Commit: 9f9d2ab4800771ba30e808107d71a98db70e23dc
      https://github.com/WebKit/WebKit/commit/9f9d2ab4800771ba30e808107d71a98db70e23dc
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Inspector/WebInspectorProxy.cpp

  Log Message:
  -----------
  Merge r255849 - [IPC Hardening] Protect against m_inspectedPage / m_inspectorPage being null in WebInspectorProxy::resetState()
https://bugs.webkit.org/show_bug.cgi?id=207285
<rdar://problem/55420035>

Reviewed by David Kilzer.

* UIProcess/Inspector/WebInspectorProxy.cpp:
(WebKit::WebInspectorProxy::resetState):


  Commit: 9b9f2e057bbff3ee631296a4fb57522ce56a0baf
      https://github.com/WebKit/WebKit/commit/9b9f2e057bbff3ee631296a4fb57522ce56a0baf
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Inspector/WebInspectorProxy.cpp

  Log Message:
  -----------
  Merge r255850 - [IPC Hardening] Protect against m_inspectorPage being null in WebInspectorProxy::setAttachedWindowHeight() / setAttachedWindowWidth()
https://bugs.webkit.org/show_bug.cgi?id=207287
<rdar://problem/55422919>

Reviewed by Geoffrey Garen.

* UIProcess/Inspector/WebInspectorProxy.cpp:
(WebKit::WebInspectorProxy::setAttachedWindowHeight):
(WebKit::WebInspectorProxy::setAttachedWindowWidth):


  Commit: 0b2e48b2e4623bcb809fb48104ad703373f6060b
      https://github.com/WebKit/WebKit/commit/0b2e48b2e4623bcb809fb48104ad703373f6060b
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Inspector/WebInspectorProxy.cpp

  Log Message:
  -----------
  Merge r255851 - [IPC Hardening] Protect against null String under WebInspectorProxy::save() / WebInspectorProxy::append()
https://bugs.webkit.org/show_bug.cgi?id=207284
<rdar://problem/55271616>

Reviewed by David Kilzer.

* UIProcess/Inspector/WebInspectorProxy.cpp:
(WebKit::WebInspectorProxy::save):
(WebKit::WebInspectorProxy::append):


  Commit: f6ef243bb3387ef95ddc07bcd6e228835dc888fb
      https://github.com/WebKit/WebKit/commit/f6ef243bb3387ef95ddc07bcd6e228835dc888fb
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Inspector/WebInspectorProxy.cpp

  Log Message:
  -----------
  Merge r255854 - [IPC Hardening] Protect against m_inspectorPage being null in WebInspectorProxy::detach()
https://bugs.webkit.org/show_bug.cgi?id=207286
<rdar://problem/55422296>

Reviewed by David Kilzer.

* UIProcess/Inspector/WebInspectorProxy.cpp:
(WebKit::WebInspectorProxy::detach):


  Commit: 9bb6925d43c2b45982713ddb298f288243774b54
      https://github.com/WebKit/WebKit/commit/9bb6925d43c2b45982713ddb298f288243774b54
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Inspector/WebInspectorProxy.cpp

  Log Message:
  -----------
  Merge r255855 - [IPC hardening] Protect against m_inspectorPage being null inWebInspectorProxy::attach()
https://bugs.webkit.org/show_bug.cgi?id=207289
<rdar://problem/58419789>

Reviewed by David Kilzer.

* UIProcess/Inspector/WebInspectorProxy.cpp:
(WebKit::WebInspectorProxy::attach):


  Commit: ad26be72eeac6c59f036336bee44f2b38de03881
      https://github.com/WebKit/WebKit/commit/ad26be72eeac6c59f036336bee44f2b38de03881
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r255860 - [IPC Hardening] Protect against targetId String being invalid in WebPageProxy::createInspectorTarget() / destroyInspectorTarget()
https://bugs.webkit.org/show_bug.cgi?id=207288
<rdar://problem/57645953>

Reviewed by Geoffrey Garen.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::createInspectorTarget):
(WebKit::WebPageProxy::destroyInspectorTarget):


  Commit: 78aebe6b35bfc840da51de141444cf8e6a469dbc
      https://github.com/WebKit/WebKit/commit/78aebe6b35bfc840da51de141444cf8e6a469dbc
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r255864 - [IPC hardening] Protect against bad originIdentifier String in WebPageProxy::reachedApplicationCacheOriginQuota() / requestGeolocationPermissionForFrame()
https://bugs.webkit.org/show_bug.cgi?id=207292
<rdar://problem/58345601>

Reviewed by David Kilzer.

* UIProcess/WebPageProxy.cpp:


  Commit: b59cdaab0706672d9e34026cb17aa7224f711acd
      https://github.com/WebKit/WebKit/commit/b59cdaab0706672d9e34026cb17aa7224f711acd
  Author: Patrick Griffis <pgriffis at igalia.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

  Log Message:
  -----------
  Merge r255865 - [GTK][WPE] Add more fontconfig paths into the sandbox
https://bugs.webkit.org/show_bug.cgi?id=207293

Reviewed by Michael Catanzaro.

These paths were reported to be used on Debian.

* UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
(WebKit::bindFonts):


  Commit: 43f5939c1f8605b9ef337b163ad27c7c86b30394
      https://github.com/WebKit/WebKit/commit/43f5939c1f8605b9ef337b163ad27c7c86b30394
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/webrtc/NetworkRTCProvider.cpp

  Log Message:
  -----------
  Merge r255867 - [IPC hardening] Protect against bad parameters in NetworkRTCProvider::createResolver()
https://bugs.webkit.org/show_bug.cgi?id=207301
<rdar://problem/59011449>

Reviewed by Alex Christensen.

* NetworkProcess/webrtc/NetworkRTCProvider.cpp:
(WebKit::NetworkRTCProvider::createResolver):


  Commit: d2e55e4584eef4739bc9a55721cdd96f0eea6643
      https://github.com/WebKit/WebKit/commit/d2e55e4584eef4739bc9a55721cdd96f0eea6643
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngineConnection.cpp

  Log Message:
  -----------
  Merge r255868 - [IPC hardening] Protect against bad identifier in CacheStorageEngineConnection::reference() / dereference()
https://bugs.webkit.org/show_bug.cgi?id=207302
<rdar://problem/59016099>

Reviewed by Alex Christensen.

* NetworkProcess/cache/CacheStorageEngineConnection.cpp:
(WebKit::CacheStorageEngineConnection::reference):
(WebKit::CacheStorageEngineConnection::dereference):


  Commit: 38010a4bdcb2950101bb13a6021ad96d250cb408
      https://github.com/WebKit/WebKit/commit/38010a4bdcb2950101bb13a6021ad96d250cb408
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    A LayoutTests/http/tests/storage/resources/storage-map-leaking-iframe.html
    A LayoutTests/http/tests/storage/storage-map-leaking-expected.txt
    A LayoutTests/http/tests/storage/storage-map-leaking.html
    M LayoutTests/platform/wk2/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/storage/StorageNamespace.h
    M Source/WebCore/storage/StorageNamespaceProvider.h
    M Source/WebCore/testing/Internals.cpp
    M Source/WebCore/testing/Internals.h
    M Source/WebCore/testing/Internals.idl
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebStorage/StorageAreaImpl.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageAreaMap.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageAreaMap.h
    M Source/WebKit/WebProcess/WebStorage/StorageNamespaceImpl.cpp
    M Source/WebKit/WebProcess/WebStorage/StorageNamespaceImpl.h

  Log Message:
  -----------
  Merge r255875 - Regression(r248734) StorageAreaMap objects are getting leaked
https://bugs.webkit.org/show_bug.cgi?id=207073
<rdar://problem/59168065>

Reviewed by Darin Adler.

Source/WebCore:

Add test infrastructure for testing this change.

Test: http/tests/storage/storage-map-leaking.html

* storage/StorageNamespace.h:
(WebCore::StorageNamespace::storageAreaMapCountForTesting const):
* storage/StorageNamespaceProvider.h:
* testing/Internals.cpp:
(WebCore::Internals::storageAreaMapCount const):
* testing/Internals.h:
* testing/Internals.idl:

Source/WebKit:

Make sure that StorageAreaMap objects are getting removed from the HashMap
in StorageNamespaceImpl, once they no longer have any users.

* WebProcess/WebStorage/StorageAreaImpl.cpp:
(WebKit::StorageAreaImpl::StorageAreaImpl):
(WebKit::StorageAreaImpl::~StorageAreaImpl):
* WebProcess/WebStorage/StorageAreaMap.cpp:
(WebKit::StorageAreaMap::incrementUseCount):
(WebKit::StorageAreaMap::decrementUseCount):
* WebProcess/WebStorage/StorageAreaMap.h:
* WebProcess/WebStorage/StorageNamespaceImpl.cpp:
(WebKit::StorageNamespaceImpl::destroyStorageAreaMap):
(WebKit::StorageNamespaceImpl::didDestroyStorageAreaMap): Deleted.
* WebProcess/WebStorage/StorageNamespaceImpl.h:
(WebKit::StorageNamespaceImpl::storageType const): Deleted.
(WebKit::StorageNamespaceImpl::storageNamespaceID const): Deleted.
(WebKit::StorageNamespaceImpl::topLevelOrigin const): Deleted.
(WebKit::StorageNamespaceImpl::quotaInBytes const): Deleted.

LayoutTests:

Add layout test coverage.

* TestExpectations:
* http/tests/storage/resources/storage-map-leaking-iframe.html: Added.
* http/tests/storage/storage-map-leaking-expected.txt: Added.
* http/tests/storage/storage-map-leaking.html: Added.
* platform/wk2/TestExpectations:


  Commit: 08f76ce2118a9fc05c1486de9fed35a4fd02a52f
      https://github.com/WebKit/WebKit/commit/08f76ce2118a9fc05c1486de9fed35a4fd02a52f
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/ClientOrigin.h
    M Source/WebCore/page/SecurityOriginData.h
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngine.cpp

  Log Message:
  -----------
  Merge r255876 - [IPC hardening] Fail IPC decoding of invalid ClientOrigin objects
https://bugs.webkit.org/show_bug.cgi?id=207305
<rdar://problem/58797651>

Reviewed by Brent Fulgham.

Fail IPC decoding of invalid ClientOrigin objects (empty ClientOrigin or deleted value in a HashMap).

* page/ClientOrigin.h:
(WebCore::ClientOrigin::decode):
* page/SecurityOriginData.h:
(WebCore::SecurityOriginData::decode):


  Commit: 371ffd12c7f2555b05e05100348744c4aa14e799
      https://github.com/WebKit/WebKit/commit/371ffd12c7f2555b05e05100348744c4aa14e799
  Author: Andres Gonzalez <andresg_22 at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp
    M Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.h

  Log Message:
  -----------
  Merge r255884 - Check for null return from AXIsolatedTree::nodeForID.
https://bugs.webkit.org/show_bug.cgi?id=207300

Reviewed by Chris Fleizach.

- As the IsolatedTree is updated, AXIsolatedTree::nodeForID may return
nullptr for objects that have been removed from the tree. Thus,
IsolatedObjects must check the returned value when updating children
and any other operations involving cached IDs.
- Tidying up use of auto on for and if statements.

* accessibility/isolatedtree/AXIsolatedObject.cpp:
(WebCore::AXIsolatedObject::detachRemoteParts):
(WebCore::AXIsolatedObject::children):
(WebCore::AXIsolatedObject::accessibilityText const):
(WebCore::AXIsolatedObject::insertMathPairs):
(WebCore::AXIsolatedObject::objectAttributeValue const):
(WebCore::AXIsolatedObject::fillChildrenVectorForProperty const):
(WebCore::AXIsolatedObject::tree const): Deleted, moved inline to the header.
* accessibility/isolatedtree/AXIsolatedObject.h:


  Commit: 3a0d1c75f943be30f79f905054c8b18ca26163e7
      https://github.com/WebKit/WebKit/commit/3a0d1c75f943be30f79f905054c8b18ca26163e7
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/WebCoreJSClientData.cpp

  Log Message:
  -----------
  Merge r255885 - Web Inspector: ensure that `didClearWindowObjectInWorld` is dispatched for the main world first
https://bugs.webkit.org/show_bug.cgi?id=207232

Reviewed by Timothy Hatcher.

It is necessary to order the `DOMWrapperWorld`s because certain callers expect the main
world to be the first item in the list, as they use the main world as an indicator of when
the page is ready to start evaluating JavaScript. For example, Web Inspector waits for the
main world change to clear any injected scripts and debugger/breakpoint state.

* bindings/js/WebCoreJSClientData.cpp:
(WebCore::JSVMClientData::getAllWorlds):


  Commit: 912a483fa0ba0de271cb00950cee8787cb39033d
      https://github.com/WebKit/WebKit/commit/912a483fa0ba0de271cb00950cee8787cb39033d
  Author: Nikita Vasilyev <nvasilyev at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/BezierEditor.css
    M Source/WebInspectorUI/UserInterface/Views/BezierEditor.js

  Log Message:
  -----------
  Merge r255886 - Web Inspector: Bezier editor popover should be strictly LTR
https://bugs.webkit.org/show_bug.cgi?id=206968
<rdar://problem/59007065>

Reviewed by Timothy Hatcher.

- Don't mirror the coordinate system.
- Don't reverste the order of the cubic bezier values, e.g. `cubic-bezier(0, 0.5, 1, 0.5)`.

* UserInterface/Views/BezierEditor.css:
(90%):
(to):
(body[dir=ltr] .bezier-editor): Deleted.
(body[dir=rtl] .bezier-editor): Deleted.
(body[dir=rtl] .bezier-editor > .bezier-container): Deleted.
* UserInterface/Views/BezierEditor.js:


  Commit: 915c20cb496fb28c5b5cef3c3fb23eef82f6ecb6
      https://github.com/WebKit/WebKit/commit/915c20cb496fb28c5b5cef3c3fb23eef82f6ecb6
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/inspector/debugger/setPauseOnDebuggerStatements-expected.txt
    A LayoutTests/inspector/debugger/setPauseOnDebuggerStatements.html
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp
    M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
    M Source/JavaScriptCore/debugger/Debugger.cpp
    M Source/JavaScriptCore/debugger/Debugger.h
    M Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
    M Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.h
    M Source/JavaScriptCore/inspector/protocol/Debugger.json
    M Source/JavaScriptCore/interpreter/Interpreter.cpp
    M Source/JavaScriptCore/interpreter/Interpreter.h
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/Localizations/en.lproj/localizedStrings.js
    M Source/WebInspectorUI/UserInterface/Controllers/DebuggerManager.js
    A Source/WebInspectorUI/UserInterface/Images/DebuggerStatement.svg
    M Source/WebInspectorUI/UserInterface/Views/BreakpointTreeElement.css
    M Source/WebInspectorUI/UserInterface/Views/SourcesNavigationSidebarPanel.js

  Log Message:
  -----------
  Merge r255887 - Web Inspector: Sources: add a special breakpoint for controlling whether `debugger` statements pause
https://bugs.webkit.org/show_bug.cgi?id=206818

Reviewed by Timothy Hatcher.

Source/JavaScriptCore:

* inspector/protocol/Debugger.json:
* inspector/agents/InspectorDebuggerAgent.h:
* inspector/agents/InspectorDebuggerAgent.cpp:
(Inspector::InspectorDebuggerAgent::setPauseOnDebuggerStatements): Added.

* bytecompiler/NodesCodegen.cpp:
(JSC::DebuggerStatementNode::emitBytecode):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::dumpLineColumnEntry):
* interpreter/Interpreter.h:
* interpreter/Interpreter.cpp:
(JSC::Interpreter::debug):
(WTF::printInternal):
* debugger/Debugger.h:
(JSC::Debugger::setPauseOnDebuggerStatements): Added.
* debugger/Debugger.cpp:
(JSC::Debugger::didReachDebuggerStatement): Added.
(JSC::Debugger::didReachBreakpoint): Deleted.
Replace `DebugHookType::DidReachBreakpoint` with `DebugHookType::DidReachDebuggerStatement`,
as it is only actually used for `debugger;` statements, not breakpoints.

Source/WebInspectorUI:

* UserInterface/Controllers/DebuggerManager.js:
(WI.DebuggerManager):
(WI.DebuggerManager.prototype.async initializeTarget):
(WI.DebuggerManager.prototype.get debuggerStatementsBreakpoint): Added.
(WI.DebuggerManager.prototype.isBreakpointRemovable):
(WI.DebuggerManager.prototype._breakpointDisabledStateDidChange):

* UserInterface/Views/SourcesNavigationSidebarPanel.js:
(WI.SourcesNavigationSidebarPanel):
(WI.SourcesNavigationSidebarPanel.prototype._insertDebuggerTreeElement):
(WI.SourcesNavigationSidebarPanel.prototype._addBreakpoint):

* UserInterface/Views/BreakpointTreeElement.css:
(.breakpoint-debugger-statement-icon .icon): Added.
* UserInterface/Images/DebuggerStatement.svg: Added.

* Localizations/en.lproj/localizedStrings.js:

LayoutTests:

* inspector/debugger/setPauseOnDebuggerStatements.html: Added.
* inspector/debugger/setPauseOnDebuggerStatements-expected.txt: Added.


  Commit: b027d5135f8989cc2f9bf1b148cda1e288653ebc
      https://github.com/WebKit/WebKit/commit/b027d5135f8989cc2f9bf1b148cda1e288653ebc
  Author: Nikita Vasilyev <nvasilyev at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/BezierEditor.js

  Log Message:
  -----------
  Merge r255888 - Web Inspector: Dragging handles in the easing popover selects sidebar text
https://bugs.webkit.org/show_bug.cgi?id=207316

Reviewed by Timothy Hatcher.

* UserInterface/Views/BezierEditor.js:
(WI.BezierEditor.prototype._handleMousedown):


  Commit: bd01b9ec90e33fc6f74b10f2b4fec925b2e1c524
      https://github.com/WebKit/WebKit/commit/bd01b9ec90e33fc6f74b10f2b4fec925b2e1c524
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/resourceLoadStatistics/aggregate-sorted-data-no-storage-access-expected.txt
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashTable.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/HashSet.cpp

  Log Message:
  -----------
  Merge r255889 - [WTF] Try using 75% load factor for HashTable
https://bugs.webkit.org/show_bug.cgi?id=207183

Reviewed by Mark Lam.

Source/WTF:

We know that hash-table is one of the most memory consuming part in WebKit.
By analyzing many production hash-table implementations[1], I found that many
of them are using 75% load-factor while our one is 50%.

A/B test shows that 75% load-factor is performance-neutral in Speedometer2 and
JetStream2, while it offers 2~% improvement in Membuster. This means that we are
wasting too much memory for no-performance-improvement.

This patch changes the load-factor from 50% to 75%.

[1]: LLVM DenseMap, Abseil's, rust's, and so on.

* wtf/HashTable.h:
(WTF::HashTable::shouldExpand):
(WTF::HashTable::shouldExpand const):
(WTF::HashTableCapacityForSize::capacityForSize):
(WTF::KeyTraits>::computeBestTableSize):

Tools:

Fix load-factor assumption in existing tests.

* TestWebKitAPI/Tests/WTF/HashSet.cpp:
(TestWebKitAPI::testInitialCapacity):

LayoutTests:

It seems that this test is relying on hash-table's order.

* http/tests/resourceLoadStatistics/aggregate-sorted-data-no-storage-access-expected.txt:


  Commit: 70c29ba39d0a30c91fcbbc9d4f6254564a39e35f
      https://github.com/WebKit/WebKit/commit/70c29ba39d0a30c91fcbbc9d4f6254564a39e35f
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/TabBar.css
    M Source/WebInspectorUI/UserInterface/Views/Variables.css

  Log Message:
  -----------
  Merge r255890 - Web Inspector: increase the height of the tab bar to match other navigation bars
https://bugs.webkit.org/show_bug.cgi?id=207317

Reviewed by Timothy Hatcher.

* UserInterface/Views/Variables.css:
(:root):
Define `--tab-bar-height` in terms of `--navigation-bar-height` so they share the same value.

* UserInterface/Views/TabBar.css:
(.tab-bar > .tabs > .item):
(.tab-bar > .tabs > .item.pinned):
(.tab-bar > .tabs > .item.pinned.tab-picker): Deleted.
Increase the width to match the `--tab-bar-height` so that pinned tab bar items are square.


  Commit: 919e4e8ecdd14f295cf0f806b6efb321d689319c
      https://github.com/WebKit/WebKit/commit/919e4e8ecdd14f295cf0f806b6efb321d689319c
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/NetworkDetailView.css
    M Source/WebInspectorUI/UserInterface/Views/NetworkTableContentView.css
    M Source/WebInspectorUI/UserInterface/Views/Variables.css

  Log Message:
  -----------
  Merge r255892 - Web Inspector: Network: the resource detail view cuts off the bottom statistics bar
https://bugs.webkit.org/show_bug.cgi?id=207320

Reviewed by Timothy Hatcher.

* UserInterface/Views/Variables.css:
(:root):
Add a `--network-statistics-height` variable.

* UserInterface/Views/NetworkDetailView.css:
(.network-detail):
* UserInterface/Views/NetworkTableContentView.css:
(.network-table > .statistics):
Use the `--network-statistics-height` variable to make sure the statistics row and the
details view for the selected network entry don't overlap.
Drive-by: center the content of the statistics row to better match the system look/feel.


  Commit: 989051dd0659366e9ea9f0a9420fbfee7bdabb25
      https://github.com/WebKit/WebKit/commit/989051dd0659366e9ea9f0a9420fbfee7bdabb25
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Base/Main.js
    M Source/WebInspectorUI/UserInterface/Debug/Bootstrap.js

  Log Message:
  -----------
  Merge r255893 - Web Inspector: Tab Bar: move window management items to the left and don't show reload/download unless remotely inspecting
https://bugs.webkit.org/show_bug.cgi?id=207318

Reviewed by Timothy Hatcher.

Move the window management buttons to the left side to match the system look/feel.

Hide the reload/download buttons when inspecting locally, as there are other ways of
reloading the inspected page or downloading a Web Archive.

* UserInterface/Base/Main.js:
(WI.contentLoaded):
(WI._updateDockNavigationItems):
(WI._updateReloadTabBarButton):
(WI._updateDownloadTabBarButton):
(WI._updateInspectModeTabBarButton):
(WI._updateTabBarDividers): Added.
(WI._updateConsoleTabBarButtons):

* UserInterface/Debug/Bootstrap.js:
(updateDebugUI):
(WI.runBootstrapOperations):


  Commit: a26fa336bda4bc2d732fc68664bb09dbc1f905d5
      https://github.com/WebKit/WebKit/commit/a26fa336bda4bc2d732fc68664bb09dbc1f905d5
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/RadioButtonNavigationItem.css
    M Source/WebInspectorUI/UserInterface/Views/ScopeBar.css

  Log Message:
  -----------
  Merge r255894 - Web Inspector: slightly increase the horizontal padding around scope bar items
https://bugs.webkit.org/show_bug.cgi?id=207321

Reviewed by Timothy Hatcher.

* UserInterface/Views/ScopeBar.css:
(.scope-bar):
(body[dir=ltr] .scope-bar > li.multiple > select):
(body[dir=rtl] .scope-bar > li.multiple > select):
* UserInterface/Views/RadioButtonNavigationItem.css:
(.navigation-bar .item.radio.button.text-only):


  Commit: ee7c67a89f717fc87d343c95ae20a8bcc58e9e11
      https://github.com/WebKit/WebKit/commit/ee7c67a89f717fc87d343c95ae20a8bcc58e9e11
  Author: Nikita Vasilyev <nvasilyev at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/Localizations/en.lproj/localizedStrings.js
    M Source/WebInspectorUI/UserInterface/Views/CookieStorageContentView.js

  Log Message:
  -----------
  Merge r255896 - Web Inspector: Some cookie table column headers should not be localizable
https://bugs.webkit.org/show_bug.cgi?id=206920

Reviewed by Timothy Hatcher.

Keep headers that match cookie directives always in English.

* Localizations/en.lproj/localizedStrings.js:
* UserInterface/Views/CookieStorageContentView.js:
(WI.CookieStorageContentView.prototype.initialLayout):


  Commit: 4a29d1ec5363ab030b3e3bb51902c7723f407f28
      https://github.com/WebKit/WebKit/commit/4a29d1ec5363ab030b3e3bb51902c7723f407f28
  Author: Justin Michaud <justin_michaud at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/microbenchmarks/delete-property-from-prototype-chain.js
    A JSTests/microbenchmarks/delete-property-keeps-cacheable-structure.js
    M JSTests/stress/cache-put-by-id-different-attributes.js
    M JSTests/stress/cache-put-by-id-different-offset.js
    M JSTests/stress/cache-put-by-id-poly-proto.js
    A JSTests/stress/delete-property-check-structure-transition.js
    M JSTests/stress/flatten-object-zero-unused-inline-properties.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/HeapInlines.h
    M Source/JavaScriptCore/runtime/JSObject.cpp
    M Source/JavaScriptCore/runtime/OptionsList.h
    M Source/JavaScriptCore/runtime/PropertyMapHashTable.h
    M Source/JavaScriptCore/runtime/Structure.cpp
    M Source/JavaScriptCore/runtime/Structure.h
    M Source/JavaScriptCore/runtime/StructureInlines.h
    M Source/JavaScriptCore/runtime/StructureTransitionTable.h
    M Source/JavaScriptCore/tools/JSDollarVM.cpp

  Log Message:
  -----------
  Merge r255897 - Deleting a property should not turn structures into uncacheable dictionaries
https://bugs.webkit.org/show_bug.cgi?id=206430

Reviewed by Yusuke Suzuki.

JSTests:

* microbenchmarks/delete-property-from-prototype-chain.js: Added.
(assert):
(noInline.assert.getZ):
(noInline.getZ.C):
(doTest):
(delete.C.prototype.z):
* microbenchmarks/delete-property-keeps-cacheable-structure.js: Added.
(assert):
(C):
(doTest):
* stress/cache-put-by-id-different-attributes.js:
(makePrototypeDict):
(set x):
* stress/cache-put-by-id-different-offset.js:
(makePrototypeDict):
(set x):
* stress/cache-put-by-id-poly-proto.js:
(makePrototypeDict):
(set _):
* stress/delete-property-check-structure-transition.js: Added.
(assert):
(assert_eq):
(assert_neq):
(sd):
(sid):
(testDeleteIsNotUncacheable):
(testCanMaterializeDeletes):
(testCanFlatten):
(testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo):
(testDeleteWithInlineCache.noInline.doTest):
(testDeleteWithInlineCache):
* stress/flatten-object-zero-unused-inline-properties.js:

Source/JavaScriptCore:

Right now, deleteProperty/removePropertyTransition causes a structure transition to uncacheable dictionary. Instead, we should allow it to transition to a new regular structure like adding a property does. This means that we have to:

1) Break the assumption that structure transition offsets increase monotonically

We add a new flag to tell that a structure has deleted its property, and update materializePropertyTable to use it.

2) Add a new transition map and transition kind for deletes

We cache the delete transition. We will not transition back to a previous structure if you add then immediately remove a property.

3) Find some heuristic for when we should actually transition to uncacheable dictionary.

Since deleting properties is expected to be rare, we just walk the structure list and count its size on removal.

This patch also fixes a related bug in addProperty, where we did not use a GCSafeConcurrentJSLocker, and adds an option to trigger the bug. Finally, we add some helper methods to dollarVM to test.

This gives a 24x speedup on delete-property-keeps-cacheable-structure.js, and is neutral on delete-property-from-prototype-chain.js (which was already generating code using the inline cache).

* heap/HeapInlines.h:
(JSC::Heap::decrementDeferralDepthAndGCIfNeeded):
* runtime/JSObject.cpp:
(JSC::JSObject::deleteProperty):
* runtime/OptionsList.h:
* runtime/PropertyMapHashTable.h:
(JSC::PropertyTable::get):
(JSC::PropertyTable::add):
(JSC::PropertyTable::addDeletedOffset):
(JSC::PropertyTable::reinsert):
* runtime/Structure.cpp:
(JSC::StructureTransitionTable::contains const):
(JSC::StructureTransitionTable::get const):
(JSC::StructureTransitionTable::add):
(JSC::Structure::Structure):
(JSC::Structure::materializePropertyTable):
(JSC::Structure::addNewPropertyTransition):
(JSC::Structure::removePropertyTransition):
(JSC::Structure::removePropertyTransitionFromExistingStructure):
(JSC::Structure::removeNewPropertyTransition):
(JSC::Structure::toUncacheableDictionaryTransition):
(JSC::Structure::remove):
(JSC::Structure::visitChildren):
* runtime/Structure.h:
* runtime/StructureInlines.h:
(JSC::Structure::forEachPropertyConcurrently):
(JSC::Structure::add):
(JSC::Structure::remove):
(JSC::Structure::removePropertyWithoutTransition):
* runtime/StructureTransitionTable.h:
(JSC::StructureTransitionTable::Hash::hash):
* tools/JSDollarVM.cpp:
(JSC::JSDollarVMHelper::functionGetStructureTransitionList):
(JSC::functionGetConcurrently):
(JSC::JSDollarVM::finishCreation):


  Commit: 0bf78a0bd3a9d383ac186de68d8a7271e40d3de0
      https://github.com/WebKit/WebKit/commit/0bf78a0bd3a9d383ac186de68d8a7271e40d3de0
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/storage/StorageNamespaceProvider.h

  Log Message:
  -----------
  Merge r255898 - Unreviewed build fix for Windows ports since r255875
https://bugs.webkit.org/show_bug.cgi?id=207073
<rdar://problem/59168065>

WEBCORE_TESTSUPPORT_EXPORT should be used only for WebCoreTestSupport, not for WebCore
See also Bug 203876.

* storage/StorageNamespaceProvider.h: Replaced WEBCORE_TESTSUPPORT_EXPORT with WEBCORE_EXPORT.


  Commit: f2da5f25361bc9b830825b28733c2468b296c7ca
      https://github.com/WebKit/WebKit/commit/f2da5f25361bc9b830825b28733c2468b296c7ca
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AccessibilityObject.h
    M Source/WebCore/layout/blockformatting/BlockFormattingContextGeometry.cpp
    M Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/NetworkDataTaskBlob.cpp
    M Source/WebKit/UIProcess/Downloads/DownloadProxyMap.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/PlatformWebView.h

  Log Message:
  -----------
  Merge r255899 - [PlayStation] Miscellaneous build fixes February 2020 edition
https://bugs.webkit.org/show_bug.cgi?id=207312

Unreviewed build fix.

Source/WebCore:

* accessibility/AccessibilityObject.h: Add missing definition for !ENABLE(ACCESSIBILITY)
(WebCore::AccessibilityObject::detachPlatformWrapper):
* layout/blockformatting/BlockFormattingContextGeometry.cpp:
* platform/graphics/cairo/ImageBufferCairo.cpp: Add missing include

Source/WebKit:

* NetworkProcess/NetworkDataTaskBlob.cpp: Add missing include.
* UIProcess/Downloads/DownloadProxyMap.h: Add missing forward declaration.

Tools:

* TestWebKitAPI/PlatformWebView.h: Remove #elif guard and just use #else


  Commit: 9e7d1faa0054a023d4903e4622ca775d1285308d
      https://github.com/WebKit/WebKit/commit/9e7d1faa0054a023d4903e4622ca775d1285308d
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Base/Main.js
    M Source/WebInspectorUI/UserInterface/Views/Variables.css

  Log Message:
  -----------
  Merge r255901 - Web Inspector: the height of the undocked title area shouldn't change when zoomed
https://bugs.webkit.org/show_bug.cgi?id=207228

Reviewed by Timothy Hatcher.

* UserInterface/Base/Main.js:
(WI.contentLoaded):
(WI.contentLoaded.updateZoomFactorCSSVariable): Added.
Save the zoom factor as a number in a CSS variable on the `<body>`.

* UserInterface/Views/Variables.css:
(body.mac-platform:not(.docked)): Added.
(body:not(.docked)): Deleted.
Divide the default `22px` by the current zoom factor so that it cancels out when rendered.
Make it so that the undocked title area is only shown on macOS <https://webkit.org/b/204627#c47>


  Commit: f13dab0a13cac687786afa8b0e3e49cfb33657a6
      https://github.com/WebKit/WebKit/commit/f13dab0a13cac687786afa8b0e3e49cfb33657a6
  Author: David Kilzer <ddkilzer at webkit.org>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/PrintContext.cpp

  Log Message:
  -----------
  Merge r255908 - Crash when printing at WebCore: WebCore::FrameView::paintContents
<https://webkit.org/b/207313>
<rdar://problem/56675778>

Reviewed by Brent Fulgham.

* page/PrintContext.cpp:
(WebCore::PrintContext::spoolPage):
(WebCore::PrintContext::spoolRect):
- Add nullptr check for frame.view().  This matches similar
  checks in other methods.


  Commit: aaa73020e8d8d5c2018e6bad5c95123a680199a2
      https://github.com/WebKit/WebKit/commit/aaa73020e8d8d5c2018e6bad5c95123a680199a2
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-06 (Thu, 06 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/workers/service/SWClientConnection.cpp
    M Source/WebCore/workers/service/SWClientConnection.h
    M Source/WebCore/workers/service/ServiceWorkerProvider.cpp
    M Source/WebCore/workers/service/ServiceWorkerProvider.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Source/WebKit/WebProcess/WebProcess.h
    M Source/WebKit/WebProcess/WebProcess.messages.in

  Log Message:
  -----------
  Merge r255909 - ServiceWorkerProvider::registerServiceWorkerClients is no longer needed
https://bugs.webkit.org/show_bug.cgi?id=207193

Reviewed by Chris Dumez.

Source/WebCore:

registerServiceWorkerClients is no longer needed since we moved service worker handling to network process.
We no longer have to optimize creating a sw server connection since we piggy back on the webprocess to network process connection.

As can be seen from DocumentLoader, we register service worker clients in DocumentLoader::commitData.
The only documents we do not register are documents for which we exit early due to creatingInitialEmptyDocument check.

registerServiceWorkerClients was used initially when starting the first service worker process.
This is obsolete since now we split service workers according sessionID and registrable domains.

No observable change of behavior if network process does not crash.
Covered by existing service worker tests crashing network process in the middle of processing.

* workers/service/SWClientConnection.cpp:
(WebCore::SWClientConnection::registerServiceWorkerClients):
* workers/service/SWClientConnection.h:
* workers/service/ServiceWorkerProvider.cpp:
* workers/service/ServiceWorkerProvider.h:

Source/WebKit:

Remove the request from WebProcessPool to register all service worker clients at launch of the first service worker process.
This is no longer needed and does not scale since our service workers are launched in different processes nowadays.

In case network process crashes, WebProcess will need to reregister their service worker clients.
This is lazily done when WebProcess tries to reconnect to the Network Process.

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::establishWorkerContextConnectionToNetworkProcess):
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::ensureNetworkProcessConnection):
* WebProcess/WebProcess.h:
* WebProcess/WebProcess.messages.in:


  Commit: a053a8bc76ac6de7854d741f1bfc2fbaed4bc73a
      https://github.com/WebKit/WebKit/commit/a053a8bc76ac6de7854d741f1bfc2fbaed4bc73a
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/GradientCairo.cpp

  Log Message:
  -----------
  Merge r255911 - [Cairo] Do not use old-style GNU field initializers
https://bugs.webkit.org/show_bug.cgi?id=207309

Reviewed by Carlos Garcia Campos.

No new tests needed.

* platform/graphics/cairo/GradientCairo.cpp:
(WebCore::addConicSector): Use the standard named field initializer syntax instead.


  Commit: 33dc147f252bac4b4e500f7b9197b61b36cb7a2c
      https://github.com/WebKit/WebKit/commit/33dc147f252bac4b4e500f7b9197b61b36cb7a2c
  Author: Antoine Quint <graouts at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/DocumentTimeline.cpp
    M Source/WebCore/dom/Document.cpp

  Log Message:
  -----------
  Merge r255953 - [Web Animations] Ensure all timelines are detached from their document
https://bugs.webkit.org/show_bug.cgi?id=207331
<rdar://problem/59210306>

Patch by Antoine Quint <graouts at apple.com> on 2020-02-06
Reviewed by Dean Jackson.

We recently added a WeakHashSet<DocumentTimeline> m_timelines member to Document and added code to ~DocumentTimeline
to remove themselves from their Document's m_timelines. However, Document::prepareForDestruction() would call
DocumentTimeline::detachFromDocument() only for the main timeline and neglect to do the same for any additional
timelines that may have been created with the DocumentTimeline constructor.

We now cleanly call DocumentTimeline::detachFromDocument() for all items in a Document's m_timelines, which has the
effect of clearing the Document <> DocumentTimeline relationship since DocumentTimeline::detachFromDocument() now
calls Document::removeTimeline().

Finally, we now call DocumentTimeline::detachFromDocument() from the DocumentTimeline destructor to ensure that timelines
that were created purely in JS but got garbage-collected are no longer referenced from the Document still.

* animation/DocumentTimeline.cpp:
(WebCore::DocumentTimeline::~DocumentTimeline):
(WebCore::DocumentTimeline::detachFromDocument):
(WebCore::DocumentTimeline::cacheCurrentTime):
* dom/Document.cpp:
(WebCore::Document::prepareForDestruction):


  Commit: fc6c8fa4410a2f0e127646072c94d88229853674
      https://github.com/WebKit/WebKit/commit/fc6c8fa4410a2f0e127646072c94d88229853674
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/DocumentTimeline.cpp

  Log Message:
  -----------
  Merge r256017 - REGRESSION (r255953): [ iOS Mac ] imported/w3c/web-platform-tests/web-animations/timing-model/timelines/update-and-send-events.html is crashing
https://bugs.webkit.org/show_bug.cgi?id=207342
<rdar://problem/59227960>

Reviewed by Youenn Fablet.

DocumentTimeline::detachFromDocument() may remove the last reference to WebAnimation objects that may, in return, remove the last reference of this
DocumentTimeline. As such, this method should make a strong reference to itself for the span of this method. However, we should not be calling it
from the destructor where the only thing matters is removing the weak reference from the Document to the DocumentTimeline.

* animation/DocumentTimeline.cpp:
(WebCore::DocumentTimeline::~DocumentTimeline):
(WebCore::DocumentTimeline::detachFromDocument):


  Commit: 04614e7b81c17a6c56f2a9edcc29f20837fb543b
      https://github.com/WebKit/WebKit/commit/04614e7b81c17a6c56f2a9edcc29f20837fb543b
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r255954 - [IPC Hardening] Protect against bad identifier in WebPageProxy::DidInsertAttachmentWithIdentifier()
https://bugs.webkit.org/show_bug.cgi?id=207311
<rdar://problem/58632517>

Reviewed by Alex Christensen.

* UIProcess/WebPageProxy.cpp:


  Commit: 8bb2c7add08881822735be0c3c4c868612c56448
      https://github.com/WebKit/WebKit/commit/8bb2c7add08881822735be0c3c4c868612c56448
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/loader/data-url-frame-allowed-expected.txt
    A LayoutTests/fast/loader/data-url-frame-allowed.html
    A LayoutTests/fast/loader/data-url-load-denied-expected.txt
    A LayoutTests/fast/loader/data-url-load-denied.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/DocumentLoader.cpp
    M Source/WebCore/loader/DocumentLoader.h
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/page/Settings.yaml
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/WebPreferences.yaml
    M Source/WebKit/UIProcess/API/C/WKPreferences.cpp
    M Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h
    M Source/WebKit/UIProcess/API/Cocoa/WKPreferences.mm
    M Source/WebKit/UIProcess/API/Cocoa/WKPreferencesPrivate.h
    M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
    M Source/WebKit/UIProcess/API/Cocoa/WKWebViewConfiguration.mm
    M Source/WebKit/UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h
    M Source/WebKit/UIProcess/Inspector/mac/WKInspectorViewController.mm
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebCoreSupport/WebInspectorClient.mm
    M Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h
    M Source/WebKitLegacy/mac/WebView/WebPreferences.mm
    M Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h
    M Source/WebKitLegacy/mac/WebView/WebView.mm
    M Source/WebKitLegacy/win/ChangeLog
    M Source/WebKitLegacy/win/Interfaces/IWebPreferences.idl
    M Source/WebKitLegacy/win/Interfaces/IWebPreferencesPrivate.idl
    M Source/WebKitLegacy/win/Interfaces/WebKit.idl
    M Source/WebKitLegacy/win/WebPreferenceKeysPrivate.h
    M Source/WebKitLegacy/win/WebPreferences.cpp
    M Source/WebKitLegacy/win/WebPreferences.h
    M Source/WebKitLegacy/win/WebView.cpp
    M Source/cmake/OptionsAppleWin.cmake
    M Tools/ChangeLog
    M Tools/DumpRenderTree/TestOptions.cpp
    M Tools/DumpRenderTree/TestOptions.h
    M Tools/DumpRenderTree/mac/DumpRenderTree.mm
    M Tools/DumpRenderTree/win/DumpRenderTree.cpp
    M Tools/DumpRenderTree/win/TestRunnerWin.cpp
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/Download.mm
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/Navigation.mm
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm
    M Tools/WebKitTestRunner/TestController.cpp
    M Tools/WebKitTestRunner/TestOptions.h
    M Tools/WebKitTestRunner/cocoa/TestControllerCocoa.mm

  Log Message:
  -----------
  Merge r255961 - Prevent navigating top level frames to Data URLs
https://bugs.webkit.org/show_bug.cgi?id=206962
<rdar://problem/56770676>

Source/WebCore:

Reviewed by Youenn Fablet.

Revise our loading behavior to match Chrome and Firefox by blocking
top level frame navigations to Data URLs.

Test: fast/loader/data-url-frame-allowed.html, fast/loader/data-url-load-denied.html

* loader/DocumentLoader.cpp:
(WebCore::DocumentLoader::disallowDataRequest const): Added,
(WebCore::DocumentLoader::continueAfterContentPolicy): Validate whether the load should
continue if it is a Data URL.
* loader/DocumentLoader.h:
(WebCore::DocumentLoader::setAllowsDataURLForMainFrame): Added.
(WebCore::DocumentLoader::allowsDataURLForMainFrame const): Added.
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::load): If the main frame loader as triggered by user action, or
direct call to the client API, allow top-frame navigation to Data URLs.
(WebCore::FrameLoader::reload): If the original load allowed top-frame navigation to Data
URLs, continue to do so in the reload.
* loader/FrameLoader.h:

Source/WebKit:

Reviewed by Youenn Fablet.

Expose a new off-by-default preference to allow top-level navigation to Data URIs.

Tests:  fast/loader/data-url-frame-allowed.html, fast/loader/data-url-load-denied.html

* Shared/WebPreferences.yaml:
* UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetTopNavigationToDataURLsAllowed):
(WKPreferencesGetTopNavigationToDataURLsAllowed):
* UIProcess/API/C/WKPreferencesRefPrivate.h:
* UIProcess/API/Cocoa/WKPreferences.mm:
(-[WKPreferences _setTopNavigationToDataURLsAllowed:]):
(-[WKPreferences _topNavigationToDataURLsAllowed]):
* UIProcess/API/Cocoa/WKPreferencesPrivate.h:
* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView _setupPageConfiguration:]):
* UIProcess/API/Cocoa/WKWebViewConfiguration.mm:
(-[WKWebViewConfiguration init]):
(-[WKWebViewConfiguration copyWithZone:]):
(-[WKWebViewConfiguration _allowTopNavigationToDataURLs]):
(-[WKWebViewConfiguration _setAllowTopNavigationToDataURLs:]):
* UIProcess/API/Cocoa/WKWebViewConfigurationPrivate.h:
* UIProcess/Inspector/mac/WKInspectorViewController.mm:
(-[WKInspectorViewController configuration]):

Source/WebKitLegacy/mac:

Reviewed by Youenn Fablet.

Expose a new off-by-default preference to allow top-level navigation to Data URIs.

Tests:  fast/loader/data-url-frame-allowed.html, fast/loader/data-url-load-denied.html

* WebCoreSupport/WebInspectorClient.mm:
(-[WebInspectorWindowController init]):
* WebView/WebPreferenceKeysPrivate.h:
* WebView/WebPreferences.mm:
(+[WebPreferences initialize]):
(-[WebPreferences allowTopNavigationToDataURLs]):
(-[WebPreferences setAllowTopNavigationToDataURLs:]):
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(-[WebView _preferencesChanged:]):

Source/WebKitLegacy/win:

Reviewed by Youenn Fablet.

Expose a new off-by-default preference to allow top-level navigation to Data URIs.

* Interfaces/WebKit.idl: Touch file to trigger a build.
* Interfaces/IWebPreferences.idl: Ditto.
* Interfaces/IWebPreferencesPrivate.idl: Expose new API version to avoid breaking shipping binaries.
* WebPreferenceKeysPrivate.h:
* WebPreferences.cpp:
(WebPreferences::initializeDefaultSettings): Update for new setting.
(WebPreferences::QueryInterface): Add support for IWebPreferencesPrivate8 interface.
(WebPreferences::allowTopNavigationToDataURLs): Added.
(WebPreferences::setAllowTopNavigationToDataURLs): Added.
* WebPreferences.h:
* WebView.cpp:
(WebView::notifyPreferencesChanged): Update to handle Data URL setting.

Tools:

Reviewed by Youenn Fablet.

Revise test running code to allow data URL navigations by default, since they are so frequently
used in testing. However, provide a flag to turn this off in tests so we can confirm proper
function.

* DumpRenderTree/TestOptions.cpp:
(TestOptions::TestOptions):
* DumpRenderTree/TestOptions.h:
* DumpRenderTree/mac/DumpRenderTree.mm:
(setWebPreferencesForTestOptions):
* TestWebKitAPI/Tests/WebKitCocoa/Download.mm:
(DownloadAttributeDoesNotStartDownloads): Revise configuration to allow script navigation of the main frame to a Data URL.
(StartDownloadWithDownloadAttribute): Ditto.
* TestWebKitAPI/Tests/WebKitCocoa/Navigation.mm:
(WebViewWillPerformClientRedirect): Ditto.
(WebViewDidCancelClientRedirect): Ditto.
* TestWebKitAPI/Tests/WebKitCocoa/ProcessSwapOnNavigation.mm:
(NavigateToDataURLThenBack): Ditto.
(ContentExtensionBlocksMainLoadThenReloadWithoutExtensions): Ditto.
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::resetPreferencesToConsistentValues):
(WTR::updateTestOptionsFromTestHeader):
* WebKitTestRunner/TestOptions.h:
(WTR::TestOptions::hasSameInitializationOptions const):
* WebKitTestRunner/cocoa/TestControllerCocoa.mm:
(WTR::initializeWebViewConfiguration):
(WTR::TestController::platformCreateWebView):

LayoutTests:

Reviewed by Youenn Fablet."

Revise our loading behavior to match Chrome and Firefox by blocking
top level frame navigations to Data URLs.

* fast/loader/data-url-frame-allowed.html: Added.
* fast/loader/data-url-frame-allowed-expected.txt : Added.
* fast/loader/data-url-load-denied.html: Added.
* fast/loader/data-url-load-denied-expected.txt: Added.


  Commit: 5103dd59595ca9f7161b517b1ade295fc1b0ac02
      https://github.com/WebKit/WebKit/commit/5103dd59595ca9f7161b517b1ade295fc1b0ac02
  Author: Lauro Moura <lmoura at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitSettings.cpp
    M Source/WebKit/UIProcess/API/gtk/WebKitSettings.h
    M Source/WebKit/UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt
    M Source/WebKit/UIProcess/API/wpe/WebKitSettings.h
    M Source/WebKit/UIProcess/API/wpe/docs/wpe-1.0-sections.txt
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestUIClient.cpp
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestWebKitSettings.cpp

  Log Message:
  -----------
  Merge r256109 - [GTK][WPE] Expose allowTopNavigationToDataURL
https://bugs.webkit.org/show_bug.cgi?id=207384

Patch by Lauro Moura <lmoura at igalia.com> on 2020-02-09
Reviewed by Adrian Perez de Castro.

Source/WebKit:

This patch exposes the new property "allow-top-navigation-to-data-urls"
from r255961 to the glib-based APIs.

* UIProcess/API/glib/WebKitSettings.cpp:
(webKitSettingsSetProperty): Set new property.
(webKitSettingsGetProperty): Get new property.
(webkit_settings_class_init): Register new property.
(webkit_settings_get_allow_top_navigation_to_data_urls): Added.
(webkit_settings_set_allow_top_navigation_to_data_urls): Added.
* UIProcess/API/gtk/WebKitSettings.h:
* UIProcess/API/gtk/docs/webkit2gtk-4.0-sections.txt:
* UIProcess/API/wpe/WebKitSettings.h:
* UIProcess/API/wpe/docs/wpe-1.0-sections.txt:

Tools:

Updates with new "allow-top-navigation-to-data-urls" property.

* TestWebKitAPI/Tests/WebKitGLib/TestUIClient.cpp:
(testWebViewAllowModalDialogs): This test requires this property to be
set.
* TestWebKitAPI/Tests/WebKitGLib/TestWebKitSettings.cpp:
(testWebKitSettings): Added tests for getter/setter.


  Commit: 525ea94ce786497d9e10cfa9607db96846a14c5e
      https://github.com/WebKit/WebKit/commit/525ea94ce786497d9e10cfa9607db96846a14c5e
  Author: Patrick Griffis <pgriffis at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/SourcesGTK.txt
    M Source/WebKit/SourcesWPE.txt
    A Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.cpp
    A Source/WebKit/UIProcess/Launcher/glib/FlatpakLauncher.h
    M Source/WebKit/UIProcess/Launcher/glib/ProcessLauncherGLib.cpp

  Log Message:
  -----------
  Merge r255969 - [GTK][WPE] Re-add flatpak sandbox support
https://bugs.webkit.org/show_bug.cgi?id=204732

Reviewed by Michael Catanzaro.

This brings back the Flatpak based sandbox now that upstream has added
features to their spawn portal to accomodate our needs.

* SourcesGTK.txt:
* SourcesWPE.txt:
* UIProcess/Launcher/glib/FlatpakLauncher.cpp: Added.
(WebKit::flatpakSpawn):
* UIProcess/Launcher/glib/FlatpakLauncher.h: Added.
* UIProcess/Launcher/glib/ProcessLauncherGLib.cpp:
(WebKit::isFlatpakSpawnUsable):
(WebKit::isInsideFlatpak):
(WebKit::ProcessLauncher::launchProcess):


  Commit: 57b1424c9316173254e73e1df434f44fff46a197
      https://github.com/WebKit/WebKit/commit/57b1424c9316173254e73e1df434f44fff46a197
  Author: Ali Juma <ajuma at chromium.org>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/tables/table-col-indent-crash-expected.txt
    A LayoutTests/tables/table-col-indent-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeUpdater.cpp

  Log Message:
  -----------
  Merge r255971 - Crash in RenderTableCol::willBeRemovedFromTree()
https://bugs.webkit.org/show_bug.cgi?id=207031

Reviewed by Antti Koivisto.

Source/WebCore:

A RenderTableCol's table() can be null during willBeRemovedFromTree. This can
happen when the RenderTableCol's table is an ancestor rather than a direct
parent. If RenderTreeBuilder::destroy is then called on an ancestor of the
the RenderTableCol's table, RenderTreeBuilder::destroy proceeds down the ancestor
chain, detaching each node along the way. By the time the RenderTableCol is
reached, the table (a non-parent ancestor) has already been detached, so
table() is null and we crash while trying to use it.

The underlying bug is that RenderTreeBuilder::destroyAndCleanUpAnonymousWrappers
is getting called on the RenderTableCol's ancestor before its descendants (including
the RenderTableCol) are destroyed.

Fix this by changing the order of operations in RenderTreeUpdater::tearDownRenderers
so that tearDownLeftoverShadowHostChildren happens before destroyAndCleanUpAnonymousWrappers.
This ensures that the RenderTableCol is destroyed before destroyAndCleanUpAnonymousWrappers is
called on its ancestor.

Test: tables/table-col-indent-crash.html

* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::tearDownRenderers):

LayoutTests:

* tables/table-col-indent-crash-expected.txt: Added.
* tables/table-col-indent-crash.html: Added.


  Commit: b83d505f94326ade1d9dd55efb2dba97f0d613bb
      https://github.com/WebKit/WebKit/commit/b83d505f94326ade1d9dd55efb2dba97f0d613bb
  Author: Alexey Shvayka <ashvayka at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/regress-187947.js
    M LayoutTests/ChangeLog
    M LayoutTests/js/dom/regexp-range-out-of-order-expected.txt
    M LayoutTests/js/dom/script-tests/regexp-range-out-of-order.js
    M LayoutTests/js/regexp-unicode-expected.txt
    M LayoutTests/js/script-tests/regexp-extended-characters-match.js
    M LayoutTests/js/script-tests/regexp-unicode.js

  Log Message:
  -----------
  Merge r255975 - JavaScript string corruption using RegExp with unicode character
https://bugs.webkit.org/show_bug.cgi?id=187947

Reviewed by Yusuke Suzuki.

JSTests:

This change adds regression test for string corruption that occured after
non-BMP character was removed by String.prototype.replace.
The issue was fixed in https://trac.webkit.org/changeset/253648/webkit.

Also, this patch brings back:
1. An out-of-order character class range test.
2. Dangling and combined surrogates tests (as webkit.org/b/154863 is now resolved).

* stress/regress-187947.js: Added.

LayoutTests:

Besides adding a regression test, this patch brings back:
1. An out-of-order character class range test.
2. Dangling and combined surrogates tests (as webkit.org/b/154863 is now resolved).

* js/dom/regexp-range-out-of-order-expected.txt:
* js/dom/script-tests/regexp-range-out-of-order.js:
* js/regexp-unicode-expected.txt:
* js/script-tests/regexp-extended-characters-match.js:
* js/script-tests/regexp-unicode.js:


  Commit: 614f722a04e297ccf64c94fcdfd8388a06d6e916
      https://github.com/WebKit/WebKit/commit/614f722a04e297ccf64c94fcdfd8388a06d6e916
  Author: Jack Lee <shihchieh_lee at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/css/counters/findPlaceForCounter-pseudo-element-display-content-host-crash-expected.txt
    A LayoutTests/fast/css/counters/findPlaceForCounter-pseudo-element-display-content-host-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderCounter.cpp

  Log Message:
  -----------
  Merge r255976 - Nullptr crash in WebCore::findPlaceForCounter with pseudo element that has display:contents host.
https://bugs.webkit.org/show_bug.cgi?id=207241

When the pseudo element's host element does not initiate a renderer
(e.g. display: contents) we need to look further in the DOM tree
for a previous-sibling-or-parent-element candidate.

Patch by Jack Lee <shihchieh_lee at apple.com> on 2020-02-06
Reviewed by Zalan Bujtas.

Source/WebCore:

Test: fast/css/counters/findPlaceForCounter-pseudo-element-display-content-host-crash.html

* rendering/RenderCounter.cpp:
(WebCore::previousSiblingOrParentElement):

LayoutTests:

* fast/css/counters/findPlaceForCounter-pseudo-element-display-content-host-crash-expected.txt: Added.
* fast/css/counters/findPlaceForCounter-pseudo-element-display-content-host-crash.html: Added.


  Commit: 86bb3bad7b1ac89d68de63b5c4a971190324478a
      https://github.com/WebKit/WebKit/commit/86bb3bad7b1ac89d68de63b5c4a971190324478a
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Inspector/gtk/WebInspectorProxyGtk.cpp

  Log Message:
  -----------
  Merge r256112 - [GTK][WebInspector] Always allow data:// URIs for inspector views
https://bugs.webkit.org/show_bug.cgi?id=207454

Reviewed by Carlos Garcia Campos.

No new tests needed.

* UIProcess/Inspector/gtk/WebInspectorProxyGtk.cpp:
(WebKit::WebInspectorProxy::platformCreateFrontendPage): The Web
Inspector may use navigation to data:// URLs, so always allow it.


  Commit: 464b99f4fd72d0cbe0a702ee004e640bc876c003
      https://github.com/WebKit/WebKit/commit/464b99f4fd72d0cbe0a702ee004e640bc876c003
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/TabBrowser.js

  Log Message:
  -----------
  Merge r255980 - Web Inspector: REGRESSION(?): Search: selecting a DOM node search result switches to the Elements Tab
https://bugs.webkit.org/show_bug.cgi?id=207322

Reviewed by Timothy Hatcher.

* UserInterface/Views/TabBrowser.js:
(WI.TabBrowser.prototype._tabBarItemSelected):
The Search Tab is marked such that it isn't saved to `WI._openTabsSetting`, as otherwise
more than one Search Tab could be added to the tab bar (one from the setting and one from
the default pinned tab). It is also marked as being pinned, however, meaning that we know it
will always be in the tab bar, even if we also know it won't be in `WI._openTabsSetting`. As
such, we should update it's position in the `_recentTabContentViews` list so that we can use
it when showing represented objects (if able) via `bestTabContentViewForRepresentedObject`.


  Commit: 4ed62cbce2a853e4e23be39d68fd643fe262d3c7
      https://github.com/WebKit/WebKit/commit/4ed62cbce2a853e4e23be39d68fd643fe262d3c7
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/inspector/formatting/resources/html-tests/attributes-expected.html
    M LayoutTests/inspector/formatting/resources/html-tests/attributes.html
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Workers/Formatter/HTMLParser.js

  Log Message:
  -----------
  Merge r255982 - Web Inspector: REGRESSION(r249831): Sources: endless spinner when trying to view a resource
https://bugs.webkit.org/show_bug.cgi?id=207346
<rdar://problem/59209016>

Reviewed by Timothy Hatcher.

Source/WebInspectorUI:

* UserInterface/Workers/Formatter/HTMLParser.js:
(HTMLParser.prototype._parseAttr):
Attributes are allowed to contain "/".
https://html.spec.whatwg.org/multipage/parsing.html#before-attribute-value-state

LayoutTests:

* inspector/formatting/resources/html-tests/attributes.html:
* inspector/formatting/resources/html-tests/attributes-expected.html:


  Commit: 50cd11297a76eb5ca8cf7f44edb0c8b7cac6ca6a
      https://github.com/WebKit/WebKit/commit/50cd11297a76eb5ca8cf7f44edb0c8b7cac6ca6a
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/inspector/worker/worker-create-and-terminate.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/inspector/WebInjectedScriptHost.cpp
    M Source/WebCore/workers/Worker.h

  Log Message:
  -----------
  Merge r255986 - Web Inspector: show JavaScript Worker terminated state as an internal property
https://bugs.webkit.org/show_bug.cgi?id=207347

Reviewed by Brian Burg.

Source/WebCore:

Test: inspector/worker/worker-create-and-terminate.html

* inspector/WebInjectedScriptHost.cpp:
(WebCore::WebInjectedScriptHost::getInternalProperties):

* workers/Worker.h:
(WebCore::Worker::wasTerminated): Added.

LayoutTests:

* inspector/worker/worker-create-and-terminate.html:
Add assertions throughout the test to check that the `terminated` value matches what the
frontend knows.


  Commit: f6d9c299bc7e28d9df0250371eec5c4338bdb5ee
      https://github.com/WebKit/WebKit/commit/f6d9c299bc7e28d9df0250371eec5c4338bdb5ee
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessPool.cpp

  Log Message:
  -----------
  Merge r255989 - REGRESSION (r254706): Crash under WebProcessPool::terminateServiceWorkerProcess()
https://bugs.webkit.org/show_bug.cgi?id=207354
<rdar://problem/59184818>

Reviewed by Geoffrey Garen.

No new tests, not easily testable AFAIK since this happens on failure to send sync IPC to
the service worker when terminating it.

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::terminateServiceWorkerProcess):
'auto' resolved to 'WeakPtr<WebProcessProxy>' in this method and the call to
disableServiceWorkers() could cause the process to get destroyed. We would then
do a null dereference on the next line.


  Commit: 1b6f44b7b2f451dcd453f33bbd1b9b0f470baa85
      https://github.com/WebKit/WebKit/commit/1b6f44b7b2f451dcd453f33bbd1b9b0f470baa85
  Author: James Darpinian <jdarpinian at chromium.org>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/angle/GraphicsContextGLANGLE.cpp

  Log Message:
  -----------
  Merge r255990 - webgl/1.0.3/conformance/glsl/misc/shader-with-reserved-words.html is timing out on some hardware configurations
https://bugs.webkit.org/show_bug.cgi?id=205739

Patch by James Darpinian <jdarpinian at chromium.org> on 2020-02-06
Reviewed by Dean Jackson.

Optimize disabling ANGLE_texture_rectangle.

* platform/graphics/angle/GraphicsContextGLANGLE.cpp:
(WebCore::GraphicsContextGLOpenGL::compileShader):


  Commit: f71fe2eec42755293b042f20585a96f7fbb0770f
      https://github.com/WebKit/WebKit/commit/f71fe2eec42755293b042f20585a96f7fbb0770f
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/webanimations/accelerated-animation-slot-invalidation-expected.html
    A LayoutTests/webanimations/accelerated-animation-slot-invalidation.html

  Log Message:
  -----------
  Merge r255996 - Add slot based test for the accelerated animations freezing bug (201048)
https://bugs.webkit.org/show_bug.cgi?id=207359

Reviewed by Ryosuke Niwa.

201048 had a simpler test case but it is good to add one for the original problem too.

Based on the original test by Tim Guan-tin Chien.

* webanimations/accelerated-animation-slot-invalidation-expected.html: Added.
* webanimations/accelerated-animation-slot-invalidation.html: Added.


  Commit: 1770ea294ef922210c5d9dd50dae026d369ab541
      https://github.com/WebKit/WebKit/commit/1770ea294ef922210c5d9dd50dae026d369ab541
  Author: Robin Morisset <rmorisset at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/b3/B3CheckSpecial.cpp
    M Source/JavaScriptCore/b3/B3CheckSpecial.h
    M Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp
    M Source/JavaScriptCore/b3/B3MemoryValue.h
    M Source/JavaScriptCore/b3/B3PatchpointSpecial.cpp
    M Source/JavaScriptCore/b3/B3PatchpointSpecial.h
    M Source/JavaScriptCore/b3/B3StackmapGenerationParams.cpp
    M Source/JavaScriptCore/b3/B3StackmapGenerationParams.h
    M Source/JavaScriptCore/b3/B3StackmapValue.h
    M Source/JavaScriptCore/b3/air/AirAllocateRegistersAndStackAndGenerateCode.h
    M Source/JavaScriptCore/b3/air/AirCCallSpecial.cpp
    M Source/JavaScriptCore/b3/air/AirCCallSpecial.h
    M Source/JavaScriptCore/b3/air/AirCode.cpp
    M Source/JavaScriptCore/b3/air/AirCode.h
    M Source/JavaScriptCore/b3/air/AirCustom.cpp
    M Source/JavaScriptCore/b3/air/AirCustom.h
    M Source/JavaScriptCore/b3/air/AirDisassembler.cpp
    M Source/JavaScriptCore/b3/air/AirDisassembler.h
    M Source/JavaScriptCore/b3/air/AirGenerationContext.h
    M Source/JavaScriptCore/b3/air/AirInst.h
    M Source/JavaScriptCore/b3/air/AirPhaseScope.cpp
    M Source/JavaScriptCore/b3/air/AirPrintSpecial.cpp
    M Source/JavaScriptCore/b3/air/AirPrintSpecial.h
    M Source/JavaScriptCore/b3/air/AirSpecial.h
    M Source/JavaScriptCore/b3/air/AirValidate.cpp
    M Source/JavaScriptCore/b3/air/opcode_generator.rb

  Log Message:
  -----------
  Merge r256003 - Most of B3 and Air does not need to include CCallHelpers.h
https://bugs.webkit.org/show_bug.cgi?id=206975

Reviewed by Mark Lam.

They only do to use CCallHelpers::Jump or CCallHelpers::Label.
But CCallHelpers inherit those from MacroAssembler. And MacroAssembler.h is dramatically cheaper to include (since CCallHelpers includes AssemblyHelpers which includes CodeBlock.h which includes roughly the entire runtime).

* b3/B3CheckSpecial.cpp:
* b3/B3CheckSpecial.h:
* b3/B3LowerMacros.cpp:
* b3/B3PatchpointSpecial.cpp:
(JSC::B3::PatchpointSpecial::generate):
* b3/B3PatchpointSpecial.h:
* b3/B3StackmapGenerationParams.cpp:
(JSC::B3::StackmapGenerationParams::successorLabels const):
* b3/B3StackmapGenerationParams.h:
* b3/air/AirAllocateRegistersAndStackAndGenerateCode.h:
* b3/air/AirCCallSpecial.cpp:
* b3/air/AirCCallSpecial.h:
* b3/air/AirCode.cpp:
* b3/air/AirCode.h:
(JSC::B3::Air::Code::entrypointLabel const):
* b3/air/AirCustom.cpp:
(JSC::B3::Air::CCallCustom::generate):
(JSC::B3::Air::ShuffleCustom::generate):
(JSC::B3::Air::WasmBoundsCheckCustom::generate):
* b3/air/AirCustom.h:
(JSC::B3::Air::PatchCustom::generate):
(JSC::B3::Air::EntrySwitchCustom::generate):
* b3/air/AirDisassembler.cpp:
(JSC::B3::Air::Disassembler::addInst):
* b3/air/AirDisassembler.h:
* b3/air/AirGenerationContext.h:
* b3/air/AirInst.h:
* b3/air/AirPrintSpecial.cpp:
(JSC::B3::Air::PrintSpecial::generate):
* b3/air/AirPrintSpecial.h:
* b3/air/AirSpecial.h:
* b3/air/AirValidate.cpp:
* b3/air/opcode_generator.rb:


  Commit: f665b8a5bc23d70da4a85fa375d4d30ef74bc8b6
      https://github.com/WebKit/WebKit/commit/f665b8a5bc23d70da4a85fa375d4d30ef74bc8b6
  Author: Fujii Hironori <Hironori.Fujii at sony.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/LogContentView.js

  Log Message:
  -----------
  Merge r256006 - [Web Inspector][WinCairo] Selecting an error message in Console causes "TypeError:​ selection.focusNode.closest is not a function."
https://bugs.webkit.org/show_bug.cgi?id=207248

Reviewed by Devin Rousso.

r242174 replaced Node.enclosingNodeOrSelfWithClass with
Element.closest. However, selection.focusNode isn't necessarily an
Element, but can be a Text node.

* UserInterface/Views/LogContentView.js:
(WI.LogContentView.prototype._mousemove): Use selection.focusNode.parentElement.closest
if selection.focusNode is not a instance of Element.


  Commit: f0ae7d9e0c253c0b1abeffb0008cf44e7d543302
      https://github.com/WebKit/WebKit/commit/f0ae7d9e0c253c0b1abeffb0008cf44e7d543302
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashTable.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/HashSet.cpp

  Log Message:
  -----------
  Merge r256011 - Unreviewed, revert 75% load-factor because of JetStream2/string-unpack-code-SP regression
https://bugs.webkit.org/show_bug.cgi?id=207183

Source/WTF:

* wtf/HashTable.h:
(WTF::HashTable::shouldExpand const):
(WTF::KeyTraits>::computeBestTableSize):
(WTF::HashTable::shouldExpand): Deleted.
(WTF::HashTableCapacityForSize::capacityForSize): Deleted.

Tools:

* TestWebKitAPI/Tests/WTF/HashSet.cpp:
(TestWebKitAPI::testInitialCapacity):


  Commit: 5729fa3791bac2de09b75ba7c39341f3af389647
      https://github.com/WebKit/WebKit/commit/5729fa3791bac2de09b75ba7c39341f3af389647
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/fetch/api/policies/referrer-origin-when-cross-origin-worker-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/fetch/api/policies/referrer-origin-worker-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/fetch/FetchLoader.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/ScriptExecutionContext.h
    M Source/WebCore/workers/DedicatedWorkerGlobalScope.cpp
    M Source/WebCore/workers/DedicatedWorkerGlobalScope.h
    M Source/WebCore/workers/DedicatedWorkerThread.cpp
    M Source/WebCore/workers/DedicatedWorkerThread.h
    M Source/WebCore/workers/Worker.cpp
    M Source/WebCore/workers/WorkerGlobalScope.cpp
    M Source/WebCore/workers/WorkerGlobalScope.h
    M Source/WebCore/workers/WorkerGlobalScopeProxy.h
    M Source/WebCore/workers/WorkerMessagingProxy.cpp
    M Source/WebCore/workers/WorkerMessagingProxy.h
    M Source/WebCore/workers/WorkerThread.cpp
    M Source/WebCore/workers/WorkerThread.h
    M Source/WebCore/workers/service/ServiceWorkerGlobalScope.cpp
    M Source/WebCore/workers/service/ServiceWorkerGlobalScope.h
    M Source/WebCore/workers/service/context/ServiceWorkerThread.cpp
    M Source/WebCore/workers/service/context/ServiceWorkerThread.h
    M Source/WebCore/worklets/WorkletGlobalScope.cpp
    M Source/WebCore/worklets/WorkletGlobalScope.h

  Log Message:
  -----------
  Merge r256012 - Fix fetch/api/policies/referrer-origin-worker.html
https://bugs.webkit.org/show_bug.cgi?id=206520

Patch by Rob Buis <rbuis at igalia.com> on 2020-02-07
Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Updated improved test result.

* web-platform-tests/fetch/api/policies/referrer-origin-when-cross-origin-worker-expected.txt:
* web-platform-tests/fetch/api/policies/referrer-origin-worker-expected.txt:

Source/WebCore:

Expose referrer policy as part of the worker global scope [1] through
the new ScriptExecutionContext::referrerPolicy method.
Call it as environment settings object when starting a fetch in case
the FetchRequestInit has no referrerPolicy set [2].

Test: imported/w3c/web-platform-tests/fetch/api/policies/referrer-origin-worker.html

[1] https://html.spec.whatwg.org/multipage/workers.html#set-up-a-worker-environment-settings-object
[2] https://fetch.spec.whatwg.org/#ref-for-concept-main-fetch①  (Step 2.5)

* Modules/fetch/FetchLoader.cpp:
(WebCore::FetchLoader::start):
* dom/Document.h:
(WebCore::Document::referrerPolicy const): Deleted.
* dom/ScriptExecutionContext.h:
* workers/DedicatedWorkerGlobalScope.cpp:
(WebCore::DedicatedWorkerGlobalScope::create):
(WebCore::DedicatedWorkerGlobalScope::DedicatedWorkerGlobalScope):
* workers/DedicatedWorkerGlobalScope.h:
* workers/DedicatedWorkerThread.cpp:
(WebCore::DedicatedWorkerThread::DedicatedWorkerThread):
(WebCore::DedicatedWorkerThread::createWorkerGlobalScope):
* workers/DedicatedWorkerThread.h:
* workers/Worker.cpp:
(WebCore::Worker::notifyFinished):
* workers/WorkerGlobalScope.cpp:
(WebCore::WorkerGlobalScope::WorkerGlobalScope):
(WebCore::WorkerGlobalScope::referrerPolicy const):
* workers/WorkerGlobalScope.h:
* workers/WorkerGlobalScopeProxy.h:
* workers/WorkerMessagingProxy.cpp:
(WebCore::WorkerMessagingProxy::startWorkerGlobalScope):
* workers/WorkerMessagingProxy.h:
* workers/WorkerThread.cpp:
(WebCore::WorkerParameters::isolatedCopy const):
(WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
(WebCore::WorkerThread::WorkerThread):
(WebCore::WorkerThread::workerThread):
* workers/WorkerThread.h:
* workers/service/ServiceWorkerGlobalScope.cpp:
(WebCore::ServiceWorkerGlobalScope::create):
(WebCore::ServiceWorkerGlobalScope::ServiceWorkerGlobalScope):
* workers/service/ServiceWorkerGlobalScope.h:
* workers/service/context/ServiceWorkerThread.cpp:
(WebCore::ServiceWorkerThread::ServiceWorkerThread):
(WebCore::ServiceWorkerThread::createWorkerGlobalScope):
* workers/service/context/ServiceWorkerThread.h:
* worklets/WorkletGlobalScope.cpp:
(WebCore::WorkletGlobalScope::referrerPolicy const):
* worklets/WorkletGlobalScope.h:


  Commit: 8ff961b02cd1903f447230d7fcdb1dc9127a3b96
      https://github.com/WebKit/WebKit/commit/8ff961b02cd1903f447230d7fcdb1dc9127a3b96
  Author: Patrick Griffis <pgriffis at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M LayoutTests/platform/wpe/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/HTTPParsers.cpp
    M Source/WebCore/platform/network/HTTPParsers.h
    M Source/WebCore/platform/network/SameSiteInfo.cpp
    M Source/WebCore/platform/network/SameSiteInfo.h
    M Source/WebCore/platform/network/soup/CookieSoup.cpp
    M Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp
    M Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp
    M Tools/ChangeLog
    M Tools/gtk/jhbuild.modules
    M Tools/wpe/jhbuild.modules

  Log Message:
  -----------
  Merge r256013 - [GTK][WPE] Add same-site cookie support
https://bugs.webkit.org/show_bug.cgi?id=204137

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Implements same-site cookie support in the soup backend.

* platform/network/HTTPParsers.cpp:
(WebCore::isSafeMethod):
* platform/network/HTTPParsers.h:
* platform/network/SameSiteInfo.cpp:
(WebCore::SameSiteInfo::create):
* platform/network/SameSiteInfo.h:
(WebCore::SameSiteInfo::encode const):
(WebCore::SameSiteInfo::decode):
* platform/network/soup/CookieSoup.cpp:
(WebCore::coreSameSitePolicy):
(WebCore::soupSameSitePolicy):
(WebCore::Cookie::Cookie):
(WebCore::Cookie::toSoupCookie const):
* platform/network/soup/NetworkStorageSessionSoup.cpp:
(WebCore::NetworkStorageSession::getRawCookies const):
(WebCore::cookiesForSession):
(WebCore::NetworkStorageSession::cookiesForDOM const):
(WebCore::NetworkStorageSession::cookieRequestHeaderFieldValue const):
* platform/network/soup/ResourceRequestSoup.cpp:
(WebCore::ResourceRequest::updateSoupMessageMembers const):
(WebCore::ResourceRequest::updateFromSoupMessage):

Source/WebKit:

Implements same-site cookie support in the soup backend.

* NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::continueHTTPRedirection):

Tools:

Update libsoup to 2.69.90 in JHBuild.

* gtk/jhbuild.modules:
* wpe/jhbuild.modules:

LayoutTests:

Updated GTK/WPE test expectations to pass most same-site cookie tests
matching the Apple ports.

* platform/gtk/TestExpectations:
* platform/wpe/TestExpectations:


  Commit: 07139f4e2a66a7b719ca983a98227325e7217743
      https://github.com/WebKit/WebKit/commit/07139f4e2a66a7b719ca983a98227325e7217743
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/CodeBlock.cpp
    M Source/JavaScriptCore/bytecode/CodeBlock.h
    M Source/JavaScriptCore/dfg/DFGJITCompiler.cpp
    M Source/JavaScriptCore/dfg/DFGJITFinalizer.cpp
    M Source/JavaScriptCore/dfg/DFGPlan.cpp
    M Source/JavaScriptCore/jit/JIT.cpp
    M Source/JavaScriptCore/jit/JIT.h
    M Source/JavaScriptCore/jit/JITInlines.h

  Log Message:
  -----------
  Merge r256015 - [JSC] CodeBlock::shrinkToFit should shrink m_constantRegisters and m_constantsSourceCodeRepresentation in 64bit architectures
https://bugs.webkit.org/show_bug.cgi?id=207356

Reviewed by Mark Lam.

Only 32bit architectures are using m_constantRegisters's address. 64bit architectures are not relying on m_constantRegisters's address.
This patches fixes the thing so that CodeBlock::shrinkToFit will shrink m_constantRegisters and m_constantsSourceCodeRepresentation
regardless of whether this is EarlyShrink or not. We also move DFG/FTL's LateShrink call to the place after calling DFGCommon reallyAdd
since they can add more constant registers.

Relanding it by fixing dead-lock.

* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::shrinkToFit):
* bytecode/CodeBlock.h:
* dfg/DFGJITCompiler.cpp:
(JSC::DFG::JITCompiler::compile):
(JSC::DFG::JITCompiler::compileFunction):
* dfg/DFGJITFinalizer.cpp:
(JSC::DFG::JITFinalizer::finalizeCommon):
* dfg/DFGPlan.cpp:
(JSC::DFG::Plan::compileInThreadImpl):
(JSC::DFG::Plan::finalizeWithoutNotifyingCallback):
* jit/JIT.cpp:
(JSC::JIT::link):
* jit/JIT.h:
* jit/JITInlines.h:
(JSC::JIT::emitLoadDouble):
(JSC::JIT::emitLoadInt32ToDouble): Deleted.


  Commit: 579f4b0dfe1e4dee78552feebaafb52209bf03eb
      https://github.com/WebKit/WebKit/commit/579f4b0dfe1e4dee78552feebaafb52209bf03eb
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessPool.cpp

  Log Message:
  -----------
  Merge r256022 - Address post-landing review comments from Darin on r255989.

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::terminateServiceWorkerProcess):


  Commit: a062a80cf2ac81ec03a96d57f3d5f25eb49c73a3
      https://github.com/WebKit/WebKit/commit/a062a80cf2ac81ec03a96d57f3d5f25eb49c73a3
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/BackgroundProcessResponsivenessTimer.cpp

  Log Message:
  -----------
  Merge r256023 - BackgroundProcessResponsivenessTimer should not be active if running active pages and service workers
https://bugs.webkit.org/show_bug.cgi?id=207264

Reviewed by Chris Dumez.

In case a service worker is running, the process might still be foreground if a page is running in the same process.
Not observable.

* UIProcess/BackgroundProcessResponsivenessTimer.cpp:
(WebKit::BackgroundProcessResponsivenessTimer::shouldBeActive const):


  Commit: a81db1f7cdf02dc32e184a6ba3e6f3038258d1d1
      https://github.com/WebKit/WebKit/commit/a81db1f7cdf02dc32e184a6ba3e6f3038258d1d1
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/mediastream/screencapture-user-gesture.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/mediastream/MediaDevices.cpp
    M Source/WebCore/Modules/mediastream/MediaDevices.h
    M Source/WebCore/Modules/mediastream/MediaDevices.idl

  Log Message:
  -----------
  Merge r256034 - Align getDisplayMedia() with spec
https://bugs.webkit.org/show_bug.cgi?id=207191
<rdar://problem/59151017>

Reviewed by Eric Carlson.

Source/WebCore:

Update WebIDL as per spec to have the correct default values for getDisplayMedia.
Covered by updated test.

* Modules/mediastream/MediaDevices.cpp:
(WebCore::MediaDevices::getDisplayMedia):
* Modules/mediastream/MediaDevices.h:
* Modules/mediastream/MediaDevices.idl:

LayoutTests:

* fast/mediastream/screencapture-user-gesture.html:


  Commit: b3bf7980de97fb4a5838895dec403268c602d5a5
      https://github.com/WebKit/WebKit/commit/b3bf7980de97fb4a5838895dec403268c602d5a5
  Author: Timothy Hatcher <timothy at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/WebFrame.cpp

  Log Message:
  -----------
  Merge r256068 - Crash under WKBundleFrameForJavaScriptContext dereferencing a NULL WebCore::Frame.
https://bugs.webkit.org/show_bug.cgi?id=207407
rdar://problem/59206599

Reviewed by Tim Horton.

* WebProcess/WebPage/WebFrame.cpp:
(WebKit::WebFrame::frameForContext): Add a null check for the coreFrame.


  Commit: 37d46ca87d4dcf380cd603efeff3010ecb3e9967
      https://github.com/WebKit/WebKit/commit/37d46ca87d4dcf380cd603efeff3010ecb3e9967
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/geolocation/Geolocation.cpp
    M Source/WebCore/Modules/geolocation/Geolocation.h
    M Source/WebCore/Modules/geolocation/GeolocationClient.h
    M Source/WebCore/Modules/geolocation/GeolocationController.cpp
    M Source/WebCore/Modules/geolocation/GeolocationController.h
    M Source/WebCore/platform/mock/GeolocationClientMock.cpp
    M Source/WebCore/platform/mock/GeolocationClientMock.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/GeolocationPermissionRequestManagerProxy.cpp
    M Source/WebKit/UIProcess/GeolocationPermissionRequestManagerProxy.h
    M Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp
    M Source/WebKit/UIProcess/WebGeolocationManagerProxy.h
    M Source/WebKit/UIProcess/WebGeolocationManagerProxy.messages.in
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Source/WebKit/UIProcess/WebPageProxy.h
    M Source/WebKit/UIProcess/WebPageProxy.messages.in
    M Source/WebKit/WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp
    M Source/WebKit/WebProcess/Geolocation/GeolocationPermissionRequestManager.h
    M Source/WebKit/WebProcess/Geolocation/WebGeolocationManager.cpp
    M Source/WebKit/WebProcess/Geolocation/WebGeolocationManager.h
    M Source/WebKit/WebProcess/WebCoreSupport/WebGeolocationClient.cpp
    M Source/WebKit/WebProcess/WebCoreSupport/WebGeolocationClient.h
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.h
    M Source/WebKit/WebProcess/WebPage/WebPage.messages.in
    M Source/WebKitLegacy/ios/WebCoreSupport/WebGeolocation.mm
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebCoreSupport/WebGeolocationClient.h
    M Source/WebKitLegacy/mac/WebCoreSupport/WebGeolocationClient.mm
    M Source/WebKitLegacy/win/ChangeLog
    M Source/WebKitLegacy/win/WebCoreSupport/WebGeolocationClient.cpp
    M Source/WebKitLegacy/win/WebCoreSupport/WebGeolocationClient.h
    M Source/WebKitLegacy/win/WebGeolocationPolicyListener.cpp

  Log Message:
  -----------
  Merge r256075 - [Hardening] Validate Geolocation access permission on UIProcess side
https://bugs.webkit.org/show_bug.cgi?id=207393
<rdar://problem/56816051>

Reviewed by Brent Fulgham.

Source/WebCore:

Validate Geolocation access permission on UIProcess side, instead of only relying solely on the WebProcess for this.

The workflow is as follows:
- The Geolocation objects request for permission to access location data
- The UIProcess shows a prompt
- If the user accepts, the UIProcess sends an authorization token (a UUID
  string) to the Geolocation object.
- When the Geolocation object later asks for location updates from the UIProcess, the UIProcess validates
  that this is a valid authorization token (one that it previously issued for this page)
- When the Geolocation objects gets destroyed (or resets its permission), the authorization token gets
  revoked so that it is no longer valid.

No new tests, no Web-facing behavior change, merely hardening.

* Modules/geolocation/Geolocation.cpp:
(WebCore::Geolocation::~Geolocation):
(WebCore::Geolocation::resumeTimerFired):
(WebCore::Geolocation::resetAllGeolocationPermission):
(WebCore::Geolocation::stop):
(WebCore::Geolocation::setIsAllowed):
(WebCore::Geolocation::revokeAuthorizationTokenIfNecessary):
(WebCore::Geolocation::resetIsAllowed):
* Modules/geolocation/Geolocation.h:
* Modules/geolocation/GeolocationClient.h:
(WebCore::GeolocationClient::revokeAuthorizationToken):
* Modules/geolocation/GeolocationController.cpp:
(WebCore::GeolocationController::addObserver):
(WebCore::GeolocationController::revokeAuthorizationToken):
(WebCore::GeolocationController::activityStateDidChange):
* Modules/geolocation/GeolocationController.h:
* platform/mock/GeolocationClientMock.cpp:
(WebCore::GeolocationClientMock::permissionTimerFired):
(WebCore::GeolocationClientMock::startUpdating):
* platform/mock/GeolocationClientMock.h:

Source/WebKit:

* UIProcess/GeolocationPermissionRequestManagerProxy.cpp:
(WebKit::GeolocationPermissionRequestManagerProxy::didReceiveGeolocationPermissionDecision):
(WebKit::GeolocationPermissionRequestManagerProxy::isValidAuthorizationToken const):
(WebKit::GeolocationPermissionRequestManagerProxy::revokeAuthorizationToken):
* UIProcess/GeolocationPermissionRequestManagerProxy.h:
* UIProcess/WebGeolocationManagerProxy.cpp:
(WebKit::WebGeolocationManagerProxy::startUpdating):
* UIProcess/WebGeolocationManagerProxy.h:
* UIProcess/WebGeolocationManagerProxy.messages.in:
* UIProcess/WebPageProxy.cpp:
* UIProcess/WebPageProxy.h:
(WebKit::WebPageProxy::geolocationPermissionRequestManager):
* UIProcess/WebPageProxy.messages.in:
* WebProcess/Geolocation/GeolocationPermissionRequestManager.cpp:
(WebKit::GeolocationPermissionRequestManager::startRequestForGeolocation):
(WebKit::GeolocationPermissionRequestManager::revokeAuthorizationToken):
(WebKit::GeolocationPermissionRequestManager::didReceiveGeolocationPermissionDecision):
* WebProcess/Geolocation/GeolocationPermissionRequestManager.h:
* WebProcess/Geolocation/WebGeolocationManager.cpp:
(WebKit::WebGeolocationManager::registerWebPage):
* WebProcess/Geolocation/WebGeolocationManager.h:
* WebProcess/WebCoreSupport/WebGeolocationClient.cpp:
(WebKit::WebGeolocationClient::startUpdating):
(WebKit::WebGeolocationClient::revokeAuthorizationToken):
* WebProcess/WebCoreSupport/WebGeolocationClient.h:
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::didReceiveGeolocationPermissionDecision):
* WebProcess/WebPage/WebPage.h:
* WebProcess/WebPage/WebPage.messages.in:

Source/WebKitLegacy/mac:

* WebCoreSupport/WebGeolocationClient.h:
* WebCoreSupport/WebGeolocationClient.mm:
(WebGeolocationClient::startUpdating):
(WebGeolocationClient::requestPermission):
(-[WebGeolocationPolicyListener allow]):
(-[WebGeolocationPolicyListener deny]):

Source/WebKitLegacy/win:

* WebCoreSupport/WebGeolocationClient.cpp:
(WebGeolocationClient::startUpdating):
* WebCoreSupport/WebGeolocationClient.h:


  Commit: 067549e747b634055b23c3f67702973eff85d3e0
      https://github.com/WebKit/WebKit/commit/067549e747b634055b23c3f67702973eff85d3e0
  Author: Kenneth Russell <kbr at chromium.org>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/ThirdParty/ANGLE/ChangeLog
    M Source/ThirdParty/ANGLE/include/platform/FeaturesGL.h
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/StateManagerGL.cpp
    M Source/ThirdParty/ANGLE/src/libANGLE/renderer/gl/renderergl_utils.cpp

  Log Message:
  -----------
  Merge r256076 - Try adding glBindFramebuffer flush workaround to ANGLE as remedy for flaky WebGL tests
https://bugs.webkit.org/show_bug.cgi?id=206625

Patch by Kenneth Russell <kbr at chromium.org> on 2020-02-07
Reviewed by Dean Jackson.

* include/platform/FeaturesGL.h:
* src/libANGLE/renderer/gl/StateManagerGL.cpp:
(rx::StateManagerGL::bindFramebuffer):
* src/libANGLE/renderer/gl/renderergl_utils.cpp:
(rx::nativegl_gl::InitializeFeatures):


  Commit: 72b362939d3f99cbfaa043536b31df96ef59e565
      https://github.com/WebKit/WebKit/commit/72b362939d3f99cbfaa043536b31df96ef59e565
  Author: Jack Lee <shihchieh_lee at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/FontCache.h

  Log Message:
  -----------
  Merge r256077 - Nullptr crash in WebCore::FontFamilySpecificationCoreText::fontRanges
https://bugs.webkit.org/show_bug.cgi?id=207236
<rdar://problem/57214193>

Patch by Jack Lee <shihchieh_lee at apple.com> on 2020-02-07
Reviewed by Ryosuke Niwa.

Add a state variable in FontDescriptionKey for tracking hash entry deletion.

* platform/graphics/FontCache.h:
(WebCore::FontDescriptionKey::FontDescriptionKey):
(WebCore::FontDescriptionKey::operator== const):
(WebCore::FontDescriptionKey::isHashTableDeletedValue const):


  Commit: 3c42cc0c29b2edad9d659b041eb5cd46068d4582
      https://github.com/WebKit/WebKit/commit/3c42cc0c29b2edad9d659b041eb5cd46068d4582
  Author: Alex Christensen <achristensen at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashCountedSet.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/ArgumentCoders.h

  Log Message:
  -----------
  Merge r256081 - Harden HashTable IPC decoders
https://bugs.webkit.org/show_bug.cgi?id=207415

Reviewed by Chris Dumez.

Source/WebKit:

* Platform/IPC/ArgumentCoders.h:

Source/WTF:

* wtf/HashCountedSet.h:


  Commit: 63e951aed0166e36e0fef1a6dd25849be8566e6b
      https://github.com/WebKit/WebKit/commit/63e951aed0166e36e0fef1a6dd25849be8566e6b
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Plugins/PluginProcessManager.cpp
    M Source/WebKit/UIProcess/Plugins/PluginProcessManager.h
    M Source/WebKit/UIProcess/WebProcessProxy.cpp

  Log Message:
  -----------
  Merge r256084 - [IPC Hardening] Protect against bad parameters in WebProcessProxy::getPluginProcessConnection()
https://bugs.webkit.org/show_bug.cgi?id=207416
<rdar://problem/58617244>

Reviewed by David Kilzer.

* UIProcess/Plugins/PluginProcessManager.cpp:
(WebKit::PluginProcessManager::getPluginProcessConnection):
* UIProcess/Plugins/PluginProcessManager.h:
* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::getPluginProcessConnection):


  Commit: ea237efbd71c2311418deaf4e6dd00d63b3d4ab6
      https://github.com/WebKit/WebKit/commit/ea237efbd71c2311418deaf4e6dd00d63b3d4ab6
  Author: Jon Lee <jonlee at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/en.lproj/Localizable.strings
    M Source/WebCore/inspector/InspectorFrontendClient.h
    M Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
    M Source/WebCore/inspector/InspectorFrontendClientLocal.h
    M Source/WebCore/inspector/InspectorFrontendHost.cpp
    M Source/WebCore/inspector/InspectorFrontendHost.h
    M Source/WebCore/inspector/InspectorFrontendHost.idl
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/Localizations/en.lproj/localizedStrings.js
    M Source/WebInspectorUI/UserInterface/Base/Main.js
    M Source/WebInspectorUI/UserInterface/Base/Setting.js
    M Source/WebInspectorUI/UserInterface/Controllers/ConsoleManager.js
    M Source/WebInspectorUI/UserInterface/Debug/Bootstrap.js
    A Source/WebInspectorUI/UserInterface/Images/NewTab.svg
    A Source/WebInspectorUI/UserInterface/Images/NewTabPlus.svg
    M Source/WebInspectorUI/UserInterface/Images/Origin.svg
    A Source/WebInspectorUI/UserInterface/Images/SearchResults.svg
    R Source/WebInspectorUI/UserInterface/Images/SourcesPaused.svg
    M Source/WebInspectorUI/UserInterface/Main.html
    A Source/WebInspectorUI/UserInterface/Models/DebuggerDashboard.js
    A Source/WebInspectorUI/UserInterface/Models/DefaultDashboard.js
    A Source/WebInspectorUI/UserInterface/Views/ActivateButtonToolbarItem.js
    M Source/WebInspectorUI/UserInterface/Views/AuditTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/ButtonNavigationItem.css
    M Source/WebInspectorUI/UserInterface/Views/ButtonNavigationItem.js
    A Source/WebInspectorUI/UserInterface/Views/ButtonToolbarItem.css
    A Source/WebInspectorUI/UserInterface/Views/ButtonToolbarItem.js
    M Source/WebInspectorUI/UserInterface/Views/ConsoleTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/ContentBrowserTabContentView.js
    A Source/WebInspectorUI/UserInterface/Views/ControlToolbarItem.css
    A Source/WebInspectorUI/UserInterface/Views/ControlToolbarItem.js
    M Source/WebInspectorUI/UserInterface/Views/DOMTreeContentView.css
    A Source/WebInspectorUI/UserInterface/Views/DashboardContainerView.css
    A Source/WebInspectorUI/UserInterface/Views/DashboardContainerView.js
    A Source/WebInspectorUI/UserInterface/Views/DashboardView.js
    A Source/WebInspectorUI/UserInterface/Views/DebuggerDashboardView.css
    A Source/WebInspectorUI/UserInterface/Views/DebuggerDashboardView.js
    A Source/WebInspectorUI/UserInterface/Views/DefaultDashboardView.css
    A Source/WebInspectorUI/UserInterface/Views/DefaultDashboardView.js
    M Source/WebInspectorUI/UserInterface/Views/DividerNavigationItem.css
    M Source/WebInspectorUI/UserInterface/Views/ElementsTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/FlexibleSpaceNavigationItem.css
    M Source/WebInspectorUI/UserInterface/Views/GeneralTabBarItem.js
    M Source/WebInspectorUI/UserInterface/Views/GraphicsTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/GroupNavigationItem.js
    M Source/WebInspectorUI/UserInterface/Views/LayersTabContentView.js
    A Source/WebInspectorUI/UserInterface/Views/LegacyTabBar.js
    M Source/WebInspectorUI/UserInterface/Views/Main.css
    M Source/WebInspectorUI/UserInterface/Views/NavigationBar.js
    M Source/WebInspectorUI/UserInterface/Views/NetworkDetailView.css
    M Source/WebInspectorUI/UserInterface/Views/NetworkTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/NetworkTableContentView.css
    M Source/WebInspectorUI/UserInterface/Views/NetworkTableContentView.js
    A Source/WebInspectorUI/UserInterface/Views/NewTabContentView.css
    A Source/WebInspectorUI/UserInterface/Views/NewTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/PinnedTabBarItem.js
    M Source/WebInspectorUI/UserInterface/Views/QuickConsole.js
    M Source/WebInspectorUI/UserInterface/Views/RenderingFrameTimelineOverviewGraph.css
    M Source/WebInspectorUI/UserInterface/Views/SearchTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/SettingsTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/Sidebar.js
    A Source/WebInspectorUI/UserInterface/Views/SizesToFitNavigationBar.js
    M Source/WebInspectorUI/UserInterface/Views/SourcesTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/StorageTabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/TabBar.css
    M Source/WebInspectorUI/UserInterface/Views/TabBar.js
    M Source/WebInspectorUI/UserInterface/Views/TabBarItem.js
    M Source/WebInspectorUI/UserInterface/Views/TabBrowser.js
    M Source/WebInspectorUI/UserInterface/Views/TabContentView.js
    M Source/WebInspectorUI/UserInterface/Views/TimelineOverview.css
    M Source/WebInspectorUI/UserInterface/Views/TimelineRecordFrame.css
    M Source/WebInspectorUI/UserInterface/Views/TimelineRuler.css
    M Source/WebInspectorUI/UserInterface/Views/TimelineTabContentView.js
    A Source/WebInspectorUI/UserInterface/Views/Toolbar.css
    A Source/WebInspectorUI/UserInterface/Views/Toolbar.js
    M Source/WebInspectorUI/UserInterface/Views/Variables.css
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Inspector/RemoteWebInspectorProxy.cpp
    M Source/WebKit/UIProcess/Inspector/RemoteWebInspectorProxy.h
    M Source/WebKit/UIProcess/Inspector/RemoteWebInspectorProxy.messages.in
    M Source/WebKit/UIProcess/Inspector/WebInspectorProxy.cpp
    M Source/WebKit/UIProcess/Inspector/WebInspectorProxy.h
    M Source/WebKit/UIProcess/Inspector/WebInspectorProxy.messages.in
    M Source/WebKit/UIProcess/Inspector/gtk/RemoteWebInspectorProxyGtk.cpp
    M Source/WebKit/UIProcess/Inspector/gtk/WebInspectorProxyGtk.cpp
    M Source/WebKit/UIProcess/Inspector/mac/RemoteWebInspectorProxyMac.mm
    M Source/WebKit/UIProcess/Inspector/mac/WebInspectorProxyMac.mm
    M Source/WebKit/UIProcess/Inspector/win/RemoteWebInspectorProxyWin.cpp
    M Source/WebKit/UIProcess/Inspector/win/WebInspectorProxyWin.cpp
    M Source/WebKit/WebProcess/Inspector/RemoteWebInspectorUI.cpp
    M Source/WebKit/WebProcess/Inspector/RemoteWebInspectorUI.h
    M Source/WebKit/WebProcess/Inspector/WebInspectorUI.cpp
    M Source/WebKit/WebProcess/Inspector/WebInspectorUI.h
    M Source/WebKitLegacy/ios/ChangeLog
    M Source/WebKitLegacy/ios/WebCoreSupport/WebInspectorClientIOS.mm
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebCoreSupport/WebInspectorClient.h
    M Source/WebKitLegacy/mac/WebCoreSupport/WebInspectorClient.mm

  Log Message:
  -----------
  Merge r256086 - Web Inspector: Revert slim toolbar
https://bugs.webkit.org/show_bug.cgi?id=207422

Reviewed by Timothy Hatcher.

The slim toolbar needs a little more work before landing.

This patch reverts r255547, r255557, r255890, r255892, r255893, r255901, r255980.

Source/WebCore:

* en.lproj/Localizable.strings:
* inspector/InspectorFrontendClient.h:
* inspector/InspectorFrontendClientLocal.cpp:
* inspector/InspectorFrontendClientLocal.h:
* inspector/InspectorFrontendHost.cpp:
* inspector/InspectorFrontendHost.h:
* inspector/InspectorFrontendHost.idl:

Source/WebInspectorUI:

* Localizations/en.lproj/localizedStrings.js:
* UserInterface/Base/Main.js:
* UserInterface/Base/Setting.js:
* UserInterface/Controllers/ConsoleManager.js:
* UserInterface/Debug/Bootstrap.js:
* UserInterface/Images/NewTab.svg: Added.
* UserInterface/Images/NewTabPlus.svg: Added.
* UserInterface/Images/Origin.svg:
* UserInterface/Images/SearchResults.svg: Added.
* UserInterface/Images/SourcesPaused.svg: Removed.
* UserInterface/Main.html:
* UserInterface/Models/DebuggerDashboard.js: Copied from Source/WebInspectorUI/UserInterface/Views/FlexibleSpaceNavigationItem.css.
* UserInterface/Models/DefaultDashboard.js: Added.
* UserInterface/Views/ActivateButtonToolbarItem.js: Copied from Source/WebInspectorUI/UserInterface/Views/FlexibleSpaceNavigationItem.css.
* UserInterface/Views/AuditTabContentView.js:
* UserInterface/Views/ButtonNavigationItem.css:
* UserInterface/Views/ButtonNavigationItem.js:
* UserInterface/Views/ButtonToolbarItem.css: Copied from Source/WebInspectorUI/UserInterface/Views/DividerNavigationItem.css.
* UserInterface/Views/ButtonToolbarItem.js: Copied from Source/WebInspectorUI/UserInterface/Views/FlexibleSpaceNavigationItem.css.
* UserInterface/Views/ConsoleTabContentView.js:
* UserInterface/Views/ContentBrowserTabContentView.js:
* UserInterface/Views/ControlToolbarItem.css: Copied from Source/WebInspectorUI/UserInterface/Views/DividerNavigationItem.css.
* UserInterface/Views/ControlToolbarItem.js: Copied from Source/WebInspectorUI/UserInterface/Views/DividerNavigationItem.css.
* UserInterface/Views/DOMTreeContentView.css:
* UserInterface/Views/DashboardContainerView.css: Added.
* UserInterface/Views/DashboardContainerView.js: Added.
* UserInterface/Views/DashboardView.js: Copied from Source/WebInspectorUI/UserInterface/Views/PinnedTabBarItem.js.
* UserInterface/Views/DebuggerDashboardView.css: Added.
* UserInterface/Views/DebuggerDashboardView.js: Added.
* UserInterface/Views/DefaultDashboardView.css: Added.
* UserInterface/Views/DefaultDashboardView.js: Added.
* UserInterface/Views/DividerNavigationItem.css:
* UserInterface/Views/ElementsTabContentView.js:
* UserInterface/Views/FlexibleSpaceNavigationItem.css:
* UserInterface/Views/GeneralTabBarItem.js:
* UserInterface/Views/GraphicsTabContentView.js:
* UserInterface/Views/GroupNavigationItem.js:
* UserInterface/Views/LayersTabContentView.js:
* UserInterface/Views/LegacyTabBar.js: Copied from Source/WebInspectorUI/UserInterface/Views/TabBar.js.
* UserInterface/Views/Main.css:
* UserInterface/Views/NavigationBar.js:
* UserInterface/Views/NetworkDetailView.css:
* UserInterface/Views/NetworkTabContentView.js:
* UserInterface/Views/NetworkTableContentView.css:
* UserInterface/Views/NetworkTableContentView.js:
* UserInterface/Views/NewTabContentView.css: Copied from Source/WebInspectorUI/UserInterface/Views/RenderingFrameTimelineOverviewGraph.css.
* UserInterface/Views/NewTabContentView.js: Added.
* UserInterface/Views/PinnedTabBarItem.js:
* UserInterface/Views/QuickConsole.js:
* UserInterface/Views/RenderingFrameTimelineOverviewGraph.css:
* UserInterface/Views/SearchTabContentView.js:
* UserInterface/Views/SettingsTabContentView.js:
* UserInterface/Views/Sidebar.js:
* UserInterface/Views/SizesToFitNavigationBar.js: Copied from Source/WebInspectorUI/UserInterface/Views/FlexibleSpaceNavigationItem.css.
* UserInterface/Views/SourcesTabContentView.js:
* UserInterface/Views/StorageTabContentView.js:
* UserInterface/Views/TabBar.css:
* UserInterface/Views/TabBar.js:
* UserInterface/Views/TabBarItem.js:
* UserInterface/Views/TabBrowser.js:
* UserInterface/Views/TabContentView.js:
* UserInterface/Views/TimelineOverview.css:
* UserInterface/Views/TimelineRecordFrame.css:
* UserInterface/Views/TimelineRuler.css:
* UserInterface/Views/TimelineTabContentView.js:
* UserInterface/Views/Toolbar.css: Added.
* UserInterface/Views/Toolbar.js: Added.
* UserInterface/Views/Variables.css:

Source/WebKit:

* UIProcess/Inspector/RemoteWebInspectorProxy.cpp:
* UIProcess/Inspector/RemoteWebInspectorProxy.h:
* UIProcess/Inspector/RemoteWebInspectorProxy.messages.in:
* UIProcess/Inspector/WebInspectorProxy.cpp:
* UIProcess/Inspector/WebInspectorProxy.h:
* UIProcess/Inspector/WebInspectorProxy.messages.in:
* UIProcess/Inspector/gtk/RemoteWebInspectorProxyGtk.cpp:
* UIProcess/Inspector/gtk/WebInspectorProxyGtk.cpp:
* UIProcess/Inspector/mac/RemoteWebInspectorProxyMac.mm:
* UIProcess/Inspector/mac/WebInspectorProxyMac.mm:
* UIProcess/Inspector/win/RemoteWebInspectorProxyWin.cpp:
* UIProcess/Inspector/win/WebInspectorProxyWin.cpp:
* WebProcess/Inspector/RemoteWebInspectorUI.cpp:
* WebProcess/Inspector/RemoteWebInspectorUI.h:
* WebProcess/Inspector/WebInspectorUI.cpp:
* WebProcess/Inspector/WebInspectorUI.h:

Source/WebKitLegacy/ios:

* WebCoreSupport/WebInspectorClientIOS.mm:

Source/WebKitLegacy/mac:

* WebCoreSupport/WebInspectorClient.h:
* WebCoreSupport/WebInspectorClient.mm:


  Commit: 616a4f4c10644939f90efa7179a14a7417f958fc
      https://github.com/WebKit/WebKit/commit/616a4f4c10644939f90efa7179a14a7417f958fc
  Author: Robin Morisset <rmorisset at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/CommonSlowPaths.cpp
    M Source/JavaScriptCore/runtime/DirectArguments.cpp
    M Source/JavaScriptCore/runtime/DirectArguments.h
    M Source/JavaScriptCore/runtime/GenericArguments.h
    M Source/JavaScriptCore/runtime/GenericArgumentsInlines.h
    M Source/JavaScriptCore/runtime/ScopedArguments.cpp
    M Source/JavaScriptCore/runtime/ScopedArguments.h

  Log Message:
  -----------
  Merge r256087 - Throw OutOfMemory exception instead of crashing if DirectArguments/ScopedArguments can't be created
https://bugs.webkit.org/show_bug.cgi?id=207423

Reviewed by Mark Lam.

AllocationFailureMode::Assert is problematic because fuzzers keep producing spurious error reports when they generate code that tries allocating infinite amount of memory.
The right approach is to use AllocationFailureMode::ReturnNull, and throw a JS exception upon receiving null.

In this patch I fixed two functions that were using AllocationFailureMode::Assert:
    DirectArguments::DirectArguments::overrideThings
    GenericArguments<Type>::initModifiedArgumentsDescriptor

No test added, because the only test we have is highly non-deterministic/flaky (only triggers about 10 to 20% of the time even before the fix).

* runtime/DirectArguments.h:
* runtime/GenericArguments.h:
* runtime/GenericArgumentsInlines.h:
(JSC::GenericArguments<Type>::deletePropertyByIndex):
(JSC::GenericArguments<Type>::defineOwnProperty):
(JSC::GenericArguments<Type>::initModifiedArgumentsDescriptor):
(JSC::GenericArguments<Type>::initModifiedArgumentsDescriptorIfNecessary):
(JSC::GenericArguments<Type>::setModifiedArgumentDescriptor):
* runtime/ScopedArguments.h:


  Commit: 597e3d5492a76f23756436468023496c3a7e76c8
      https://github.com/WebKit/WebKit/commit/597e3d5492a76f23756436468023496c3a7e76c8
  Author: Basuke Suzuki <basuke.suzuki at sony.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/bmalloc/CMakeLists.txt
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc.xcodeproj/project.pbxproj
    M Source/bmalloc/bmalloc/Heap.cpp
    M Source/bmalloc/bmalloc/Heap.h
    R Source/bmalloc/bmalloc/VMHeap.cpp
    R Source/bmalloc/bmalloc/VMHeap.h

  Log Message:
  -----------
  Merge r256088 - [bmalloc] VMHeap can be merge into Heap
https://bugs.webkit.org/show_bug.cgi?id=207410

Reviewed by Yusuke Suzuki.

VMHeap has only one member function in it and Heap is the only client of that.
No member variable is defined. It does nothing special with its context as a class.
It is safe to merge the function into Heap.

* CMakeLists.txt:
* bmalloc.xcodeproj/project.pbxproj:
* bmalloc/Heap.cpp:
(bmalloc::Heap::allocateLarge):
(bmalloc::Heap::tryAllocateLargeChunk): Moved from VMHeap.
* bmalloc/Heap.h:
* bmalloc/VMHeap.cpp: Removed.
* bmalloc/VMHeap.h: Removed.


  Commit: 19d6d6955fa5e914c7c91d65671691605b8f7412
      https://github.com/WebKit/WebKit/commit/19d6d6955fa5e914c7c91d65671691605b8f7412
  Author: Doug Kelly <dougk at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/multicol/spanner-crash-when-finding-table-parent-expected.txt
    A LayoutTests/fast/multicol/spanner-crash-when-finding-table-parent.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp
    M Source/WebCore/rendering/updating/RenderTreeBuilderTable.cpp

  Log Message:
  -----------
  Merge r256089 - Crash in RenderTreeBuilder::Table::findOrCreateParentForChild with multicol spanner
https://bugs.webkit.org/show_bug.cgi?id=206917

Patch by Doug Kelly <dougk at apple.com> on 2020-02-08
Reviewed by Zalan Bujtas.

Source/WebCore:

During render tree construction, multi-column spanners are moved from their original tree position to
next to the enclosing anonymous fragmented flow and we mark their previous location with a spanner placeholder.
If we try to add a new renderer right before the spanner (beforeChild is the spanner renderer), we need to use
the spanner's original position as the insertion point.
This patch addresses the mismatching position issue by adjusting the spanner beforeChild right before
we start searching for the final insertion point.

Test: fast/multicol/spanner-crash-when-finding-table-parent.html

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::attach):
* rendering/updating/RenderTreeBuilderTable.cpp:
(WebCore::RenderTreeBuilder::Table::findOrCreateParentForChild):

LayoutTests:

* fast/multicol/spanner-crash-when-finding-table-parent-expected.txt: Added.
* fast/multicol/spanner-crash-when-finding-table-parent.html: Added.


  Commit: 399958ebc25aedf26ee02132b5b5d719a5673d4a
      https://github.com/WebKit/WebKit/commit/399958ebc25aedf26ee02132b5b5d719a5673d4a
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashTable.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/HashSet.cpp

  Log Message:
  -----------
  Merge r256093 - [WTF] Try using 75% load factor for HashTable
https://bugs.webkit.org/show_bug.cgi?id=207183

Reviewed by Mark Lam.

Source/WTF:

We know that hash-table is one of the most memory consuming part in WebKit.
By analyzing many production hash-table implementations[1], I found that many
of them are using 75% load-factor while our one is 50%.

This patch changes the load-factor from 50% to 75%. But we pick 75% only for
small tables which capacity is <= 1024 based on collected data by micro-benchmarking.
The collected data is telling that longer probe-length affects on performance if table
size gets larger.

[1]: LLVM DenseMap, Abseil's, rust's, and so on.

* wtf/HashTable.h:
(WTF::HashTableCapacityForSize::shouldExpand):
(WTF::HashTableCapacityForSize::capacityForSize):
(WTF::HashTable::shouldExpand const):
(WTF::KeyTraits>::computeBestTableSize):

Tools:

* TestWebKitAPI/Tests/WTF/HashSet.cpp:
(TestWebKitAPI::testInitialCapacity):


  Commit: 8c015d6a17cebc3eadb1b7d6d9a377c3f005761c
      https://github.com/WebKit/WebKit/commit/8c015d6a17cebc3eadb1b7d6d9a377c3f005761c
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/layouttree/LayoutBox.cpp

  Log Message:
  -----------
  Merge r256094 - [LFC][BFC] Box::isFloatAvoider should not check for isFloatingPositioned()
https://bugs.webkit.org/show_bug.cgi?id=207429
<rdar://problem/59288204>

Reviewed by Antti Koivisto.

Box::isFloatAvoider() already checks for establishesBlockFormattingContext() (and floats do establish BFCs).

* layout/layouttree/LayoutBox.cpp:
(WebCore::Layout::Box::isFloatAvoider const):


  Commit: 1d7b2de31da871ccda36cdf0aa2eb2f000899908
      https://github.com/WebKit/WebKit/commit/1d7b2de31da871ccda36cdf0aa2eb2f000899908
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/compositing/backing/backing-store-attachment-animating-outside-viewport-expected.txt
    A LayoutTests/compositing/backing/backing-store-attachment-animating-outside-viewport.html
    M LayoutTests/compositing/layer-creation/translate-animation-overlap-expected.txt
    M LayoutTests/compositing/layer-creation/translate-scale-animation-overlap-expected.txt
    A LayoutTests/legacy-animation-engine/compositing/backing/backing-store-attachment-animating-outside-viewport-expected.txt
    A LayoutTests/legacy-animation-engine/compositing/backing/backing-store-attachment-animating-outside-viewport.html
    M LayoutTests/legacy-animation-engine/compositing/layer-creation/translate-animation-overlap-expected.txt
    M LayoutTests/legacy-animation-engine/compositing/layer-creation/translate-scale-animation-overlap-expected.txt
    A LayoutTests/platform/ios-wk2/compositing/backing/backing-store-attachment-animating-outside-viewport-expected.txt
    A LayoutTests/platform/ios-wk2/legacy-animation-engine/compositing/backing/backing-store-attachment-animating-outside-viewport-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/KeyframeEffect.cpp
    M Source/WebCore/page/animation/KeyframeAnimation.cpp

  Log Message:
  -----------
  Merge r256095 - Extent of a composited animation should not include the untransformed position
https://bugs.webkit.org/show_bug.cgi?id=207434

Reviewed by Sam Weinig.
Source/WebCore:

To determine whether to create ("attach") backing store for layers with transform animations,
we compute the union of all the states of the animation as an "extent", and ask whether it intersects
the coverage rect in GraphicsLayerCA.

The non-Web Animations transition code did this correctly, just unioning the bounds transformed by
the start and end state.

The non-Web Animations keyframe code, and the Web Animations KeyframeEffect code (used for both CSS transitions
and animations) also unioned with the unanimated bounds, which could create overly large extents in some
cases, contributing to jetsams on iOS (rdar://problem/59020443).

Fix KeyframeAnimation and KeyframeEffect to not union with the untransformed bounds.

Tests: compositing/backing/backing-store-attachment-animating-outside-viewport.html
       legacy-animation-engine/compositing/backing/backing-store-attachment-animating-outside-viewport.html

* animation/KeyframeEffect.cpp:
(WebCore::KeyframeEffect::computeExtentOfTransformAnimation const):
* page/animation/KeyframeAnimation.cpp:
(WebCore::KeyframeAnimation::computeExtentOfTransformAnimation const):

LayoutTests:

New test that checks backing store attachment and overlap for an element which is positioned in-view,
but is move offscreen by the animation.

New baselines for overlap tests, since overlap no longer considers the unanimated position.

* compositing/backing/backing-store-attachment-animating-outside-viewport-expected.txt: Added.
* compositing/backing/backing-store-attachment-animating-outside-viewport.html: Added.
* compositing/layer-creation/translate-animation-overlap-expected.txt:
* compositing/layer-creation/translate-scale-animation-overlap-expected.txt:
* legacy-animation-engine/compositing/backing/backing-store-attachment-animating-outside-viewport-expected.txt: Added.
* legacy-animation-engine/compositing/backing/backing-store-attachment-animating-outside-viewport.html: Added.
* legacy-animation-engine/compositing/layer-creation/translate-animation-overlap-expected.txt:
* legacy-animation-engine/compositing/layer-creation/translate-scale-animation-overlap-expected.txt:
* platform/ios-wk2/compositing/backing/backing-store-attachment-animating-outside-viewport-expected.txt: Added.
* platform/ios-wk2/legacy-animation-engine/compositing/backing/backing-store-attachment-animating-outside-viewport-expected.txt: Added.


  Commit: 3ad6dcc0db78911e4978db60e46d4108904bf921
      https://github.com/WebKit/WebKit/commit/3ad6dcc0db78911e4978db60e46d4108904bf921
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/layouttree/LayoutBox.cpp

  Log Message:
  -----------
  Merge r256097 - [LFC][BFC] Adjust Box::isFloatAvoider() for Inline and Independent FCs.
https://bugs.webkit.org/show_bug.cgi?id=207430
<rdar://problem/59288236>

Reviewed by Antti Koivisto.

A block container box that establishes both BFC and IFC is not a float avoider (add support for independent formatting context too).

* layout/layouttree/LayoutBox.cpp:
(WebCore::Layout::Box::isFloatAvoider const):


  Commit: ec8eff5a5d93a175f5c942859606dcd7020ab0e0
      https://github.com/WebKit/WebKit/commit/ec8eff5a5d93a175f5c942859606dcd7020ab0e0
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/LayoutContext.cpp
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.cpp
    M Source/WebCore/layout/layouttree/LayoutBox.cpp
    M Source/WebCore/layout/layouttree/LayoutBox.h

  Log Message:
  -----------
  Merge r256098 - [LFC][BFC] Remove establishesBlockFormattingContextOnly and establishesInlineFormattingContextOnly
https://bugs.webkit.org/show_bug.cgi?id=207431
<rdar://problem/59288366>

Reviewed by Antti Koivisto.

The current caller of establishesInlineFormattingContextOnly is actually interested in whether the box is float avoider
(and the debug-only caller of establishesBlockFormattingContextOnly should instead check if the box also establishes an IFC).

* layout/LayoutContext.cpp:
(WebCore::Layout::LayoutContext::createFormattingContext):
* layout/blockformatting/BlockFormattingContext.cpp:
(WebCore::Layout::BlockFormattingContext::computeEstimatedVerticalPositionForFormattingRoot):
* layout/layouttree/LayoutBox.cpp:
(WebCore::Layout::Box::establishesInlineFormattingContextOnly const): Deleted.
(WebCore::Layout::Box::establishesBlockFormattingContextOnly const): Deleted.
* layout/layouttree/LayoutBox.h:


  Commit: a784c14f9143fe8199075820818ea36a73218a29
      https://github.com/WebKit/WebKit/commit/a784c14f9143fe8199075820818ea36a73218a29
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.cpp
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.h

  Log Message:
  -----------
  Merge r256099 - [LFC][BFC] Pre-compute vertical position only when we really need it.
https://bugs.webkit.org/show_bug.cgi?id=207432
<rdar://problem/59288539>

Reviewed by Antti Koivisto.

Instead of pre-computing the vertical position at computeStaticVerticalPosition, let's compute it when
1. we are about to layout a new non-float-avoider/float clear FC (e.g. so that intrusive floats can shrink the lines inside IFCs)
2. we are about to compute the non-static vertical position of a float avoider block level box.

* layout/blockformatting/BlockFormattingContext.cpp:
(WebCore::Layout::BlockFormattingContext::layoutInFlowContent):
(WebCore::Layout::BlockFormattingContext::computeStaticVerticalPosition):
(WebCore::Layout::BlockFormattingContext::computeEstimatedVerticalPositionForAncestors):
(WebCore::Layout::BlockFormattingContext::precomputeVerticalPositionForFormattingRoot):
(WebCore::Layout::BlockFormattingContext::computePositionToAvoidFloats):
(WebCore::Layout::BlockFormattingContext::computeVerticalPositionForFloatClear):
(WebCore::Layout::BlockFormattingContext::computeStaticPosition): Deleted.
(WebCore::Layout::BlockFormattingContext::computeEstimatedVerticalPositionForFormattingRoot): Deleted.
(WebCore::Layout::BlockFormattingContext::computeEstimatedVerticalPositionForFloatClear): Deleted.
(WebCore::Layout::BlockFormattingContext::hasPrecomputedMarginBefore const): Deleted.
(WebCore::Layout::BlockFormattingContext::computeFloatingPosition): Deleted.
* layout/blockformatting/BlockFormattingContext.h:


  Commit: cb9070027de1796edea3ab4ceb5fb07fc012cbcc
      https://github.com/WebKit/WebKit/commit/cb9070027de1796edea3ab4ceb5fb07fc012cbcc
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/MarginTypes.h
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.cpp
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.h
    M Source/WebCore/layout/blockformatting/BlockMarginCollapse.cpp
    M Source/WebCore/layout/displaytree/DisplayBox.cpp
    M Source/WebCore/layout/displaytree/DisplayBox.h

  Log Message:
  -----------
  Merge r256100 - [LFC][BFC] Replace "estimated" term with "precomputed"
https://bugs.webkit.org/show_bug.cgi?id=207433
<rdar://problem/59288794>

Reviewed by Antti Koivisto.

The term "pre-computed" describes better what this value is.

* layout/MarginTypes.h:
(WebCore::Layout::EstimatedMarginBefore::usedValue const): Deleted.
* layout/blockformatting/BlockFormattingContext.cpp:
(WebCore::Layout::BlockFormattingContext::usedAvailableWidthForFloatAvoider const):
(WebCore::Layout::BlockFormattingContext::precomputeVerticalPosition):
(WebCore::Layout::BlockFormattingContext::precomputeVerticalPositionForAncestors):
(WebCore::Layout::BlockFormattingContext::precomputeVerticalPositionForFormattingRoot):
(WebCore::Layout::BlockFormattingContext::computePositionToAvoidFloats):
(WebCore::Layout::BlockFormattingContext::computeHeightAndMargin):
(WebCore::Layout::BlockFormattingContext::setPrecomputedMarginBefore):
(WebCore::Layout::BlockFormattingContext::hasPrecomputedMarginBefore const):
(WebCore::Layout::BlockFormattingContext::computeEstimatedVerticalPosition): Deleted.
(WebCore::Layout::BlockFormattingContext::computeEstimatedVerticalPositionForAncestors): Deleted.
(WebCore::Layout::BlockFormattingContext::setEstimatedMarginBefore): Deleted.
(WebCore::Layout::BlockFormattingContext::hasEstimatedMarginBefore const): Deleted.
* layout/blockformatting/BlockFormattingContext.h:
* layout/blockformatting/BlockMarginCollapse.cpp:
(WebCore::Layout::BlockFormattingContext::MarginCollapse::hasClearance const):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::updateMarginAfterForPreviousSibling):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::positiveNegativeValues const):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::precomputedMarginBefore):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::estimatedMarginBefore): Deleted.
* layout/displaytree/DisplayBox.cpp:
(WebCore::Display::Box::Box):
* layout/displaytree/DisplayBox.h:
(WebCore::Display::Box::setHasPrecomputedMarginBefore):
(WebCore::Display::Box::invalidatePrecomputedMarginBefore):
(WebCore::Display::Box::top const):
(WebCore::Display::Box::topLeft const):
(WebCore::Display::Box::setVerticalMargin):
(WebCore::Display::Box::setHasEstimatedMarginBefore): Deleted.
(WebCore::Display::Box::invalidateEstimatedMarginBefore): Deleted.


  Commit: 3345095d065ea3727446cecc4ac68b5a53ddeccb
      https://github.com/WebKit/WebKit/commit/3345095d065ea3727446cecc4ac68b5a53ddeccb
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.cpp
    M Source/WebCore/layout/floats/FloatingContext.cpp
    M Source/WebCore/layout/floats/FloatingContext.h
    M Source/WebCore/layout/inlineformatting/InlineFormattingContext.cpp

  Log Message:
  -----------
  Merge r256101 - [LFC] FloatingContext::constraints should take a vertical range instead of just vertical position.
https://bugs.webkit.org/show_bug.cgi?id=207440
<rdar://problem/59295022>

Reviewed by Antti Koivisto.

In an IFC, this covers the entire line when searching for intrusive float to shrink the available horizontal space.
(This fix is limited to content with fixed line height)

* layout/blockformatting/BlockFormattingContext.cpp:
(WebCore::Layout::BlockFormattingContext::usedAvailableWidthForFloatAvoider const):
* layout/floats/FloatingContext.cpp:
(WebCore::Layout::FloatingContext::constraints const):
* layout/floats/FloatingContext.h:
* layout/inlineformatting/InlineFormattingContext.cpp:
(WebCore::Layout::InlineFormattingContext::lineLayout):
(WebCore::Layout::InlineFormattingContext::constraintsForLine):


  Commit: 49be50b444bef5cb2ea7c3d96af1d08e01c656a0
      https://github.com/WebKit/WebKit/commit/49be50b444bef5cb2ea7c3d96af1d08e01c656a0
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/style/RenderStyle.cpp
    M Source/WebCore/rendering/style/RenderStyle.h
    M Source/WebCore/style/StyleChange.cpp

  Log Message:
  -----------
  Merge r256102 - Optimize Style::determineChange()
https://bugs.webkit.org/show_bug.cgi?id=207438

Reviewed by Antti Koivisto.

Style::determineChange() called RenderStyle::operator!=() before the testing some other
sets of properties for inequality.

It's faster to call inheritedEqual() etc before the full style compare. Also optimize
comparing alignItems() and justifyItems() by adding a helper function that first tests
for equality of the m_rareNonInheritedData pointer. These (added in r213480) return Inherit
because align-items and justify-items affect child layout.

This is a ~4% progression on some MotionMark subtests. Time under TreeResolver::createAnimatedElementUpdate()
drops from 2.4% to 0.9%.

* rendering/style/RenderStyle.cpp:
(WebCore::RenderStyle::descendantAffectingNonInheritedPropertiesEqual const):
* rendering/style/RenderStyle.h:
* style/StyleChange.cpp:
(WebCore::Style::determineChange):


  Commit: a18c167fc5ae27ce33ee6889337d4da687f0d4dd
      https://github.com/WebKit/WebKit/commit/a18c167fc5ae27ce33ee6889337d4da687f0d4dd
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.cpp
    M Source/WebCore/layout/blockformatting/BlockFormattingContext.h
    M Source/WebCore/layout/blockformatting/BlockMarginCollapse.cpp

  Log Message:
  -----------
  Merge r256106 - [LFC][BFC] Move updatePositiveNegativeMarginValues out of MarginCollapse class
https://bugs.webkit.org/show_bug.cgi?id=207445
<rdar://problem/59297879>

Reviewed by Antti Koivisto.

MarginCollapse::updatePositiveNegativeMarginValues is just a static helper.
Let's split this function so that it can be just a regular member function (move the state updating to the BlockFormattingContext caller).

* layout/blockformatting/BlockFormattingContext.cpp:
(WebCore::Layout::BlockFormattingContext::computeHeightAndMargin):
* layout/blockformatting/BlockFormattingContext.h:
* layout/blockformatting/BlockMarginCollapse.cpp:
(WebCore::Layout::BlockFormattingContext::MarginCollapse::resolvedPositiveNegativeMarginValues):
(WebCore::Layout::BlockFormattingContext::MarginCollapse::updatePositiveNegativeMarginValues): Deleted.


  Commit: 87ef4e79dd313f62c97ddba87a336c9a8a67a311
      https://github.com/WebKit/WebKit/commit/87ef4e79dd313f62c97ddba87a336c9a8a67a311
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/layout/floats/FloatingContext.cpp
    M Source/WebCore/layout/floats/FloatingContext.h
    M Source/WebCore/layout/floats/FloatingState.cpp
    M Source/WebCore/layout/floats/FloatingState.h
    M Source/WebCore/layout/integration/LayoutIntegrationLineLayout.cpp
    M Source/WebCore/layout/integration/LayoutIntegrationLineLayout.h

  Log Message:
  -----------
  Merge r256107 - [LFC][Integration] Support intruding floats
https://bugs.webkit.org/show_bug.cgi?id=207099

Reviewed by Zalan Bujtas.

Add support for for floats placed by the legacy render tree layout intruding to IFC flow.

This was the last frequently used feature supported by the simple line layout but not
the integrated LFC (pagination is the final missing piece).

* layout/floats/FloatingContext.cpp:
(WebCore::Layout::FloatingContext::remove): Deleted.
* layout/floats/FloatingContext.h:
* layout/floats/FloatingState.cpp:
(WebCore::Layout::FloatingState::FloatItem::FloatItem):
(WebCore::Layout::FloatingState::FloatingState):
(WebCore::Layout::FloatingState::remove): Deleted.

Delete some unused functions.

* layout/floats/FloatingState.h:
(WebCore::Layout::FloatingState::FloatItem::isLeftPositioned const):
(WebCore::Layout::FloatingState::clear):
(WebCore::Layout::FloatingState::FloatItem::operator== const): Deleted.
* layout/integration/LayoutIntegrationLineLayout.cpp:
(WebCore::LayoutIntegration::LineLayout::canUseFor):

Allow floats.

(WebCore::LayoutIntegration::LineLayout::layout):
(WebCore::LayoutIntegration::LineLayout::prepareLayoutState):
(WebCore::LayoutIntegration::LineLayout::prepareFloatingState):

Translate floats from render tree to IFC float structures.

* layout/integration/LayoutIntegrationLineLayout.h:


  Commit: 41b4cda422fe55ad86cd44495a99f2ed4cb36c1d
      https://github.com/WebKit/WebKit/commit/41b4cda422fe55ad86cd44495a99f2ed4cb36c1d
  Author: Basuke Suzuki <basuke.suzuki at sony.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/TextResourceDecoder.cpp

  Log Message:
  -----------
  Merge r256110 - Replace redundant functions with variadic template function.
https://bugs.webkit.org/show_bug.cgi?id=207413

Reviewed by Darin Adler.

No new tests. Covered by existing tests.

* loader/TextResourceDecoder.cpp:
(WebCore::bytesEqual):


  Commit: a9bb0a03cce7eb5faa5da41f32b248d47965ec85
      https://github.com/WebKit/WebKit/commit/a9bb0a03cce7eb5faa5da41f32b248d47965ec85
  Author: Diego Pino Garcia <dpino at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/wpe/TestExpectations
    M LayoutTests/platform/wpe/css3/selectors3/html/css3-modsel-161-expected.txt
    M LayoutTests/platform/wpe/css3/selectors3/xhtml/css3-modsel-161-expected.txt
    M LayoutTests/platform/wpe/css3/selectors3/xml/css3-modsel-161-expected.txt
    M LayoutTests/platform/wpe/fast/block/float/float-avoidance-expected.txt
    M LayoutTests/platform/wpe/fast/block/margin-collapse/103-expected.txt
    M LayoutTests/platform/wpe/fast/box-shadow/inset-box-shadow-radius-expected.txt
    M LayoutTests/platform/wpe/fast/css/text-transform-select-expected.txt
    M LayoutTests/platform/wpe/fast/html/keygen-expected.txt
    M LayoutTests/platform/wpe/fast/invalid/014-expected.txt
    M LayoutTests/platform/wpe/fast/parser/document-write-option-expected.txt
    M LayoutTests/platform/wpe/fast/replaced/replaced-breaking-expected.txt
    M LayoutTests/platform/wpe/fast/replaced/replaced-breaking-mixture-expected.txt
    M LayoutTests/platform/wpe/fast/replaced/three-selects-break-expected.txt
    M LayoutTests/platform/wpe/fast/replaced/width100percent-menulist-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/bugs/bug1188-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/bugs/bug18359-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/bugs/bug2479-3-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/bugs/bug2479-4-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/bugs/bug29326-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/bugs/bug33855-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/bugs/bug4382-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/bugs/bug96334-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/core/margins-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla/dom/tableDom-expected.txt
    M LayoutTests/platform/wpe/tables/mozilla_expected_failures/bugs/bug2479-5-expected.txt
    M LayoutTests/platform/wpe/transforms/2d/zoom-menulist-expected.txt

  Log Message:
  -----------
  Merge r256111 - [WPE] Gardening, update baselines and synchronize with GTK
https://bugs.webkit.org/show_bug.cgi?id=207442

Unreviewed gardening.

* platform/wpe/TestExpectations:
* platform/wpe/css3/selectors3/html/css3-modsel-161-expected.txt:
* platform/wpe/css3/selectors3/xhtml/css3-modsel-161-expected.txt:
* platform/wpe/css3/selectors3/xml/css3-modsel-161-expected.txt:
* platform/wpe/fast/block/float/float-avoidance-expected.txt:
* platform/wpe/fast/block/margin-collapse/103-expected.txt:
* platform/wpe/fast/box-shadow/inset-box-shadow-radius-expected.txt:
* platform/wpe/fast/css/text-transform-select-expected.txt:
* platform/wpe/fast/html/keygen-expected.txt:
* platform/wpe/fast/invalid/014-expected.txt:
* platform/wpe/fast/parser/document-write-option-expected.txt:
* platform/wpe/fast/replaced/replaced-breaking-expected.txt:
* platform/wpe/fast/replaced/replaced-breaking-mixture-expected.txt:
* platform/wpe/fast/replaced/three-selects-break-expected.txt:
* platform/wpe/fast/replaced/width100percent-menulist-expected.txt:
* platform/wpe/tables/mozilla/bugs/bug1188-expected.txt:
* platform/wpe/tables/mozilla/bugs/bug18359-expected.txt:
* platform/wpe/tables/mozilla/bugs/bug2479-3-expected.txt:
* platform/wpe/tables/mozilla/bugs/bug2479-4-expected.txt:
* platform/wpe/tables/mozilla/bugs/bug29326-expected.txt:
* platform/wpe/tables/mozilla/bugs/bug33855-expected.txt:
* platform/wpe/tables/mozilla/bugs/bug4382-expected.txt:
* platform/wpe/tables/mozilla/bugs/bug96334-expected.txt:
* platform/wpe/tables/mozilla/core/margins-expected.txt:
* platform/wpe/tables/mozilla/dom/tableDom-expected.txt:
* platform/wpe/tables/mozilla_expected_failures/bugs/bug2479-5-expected.txt:
* platform/wpe/transforms/2d/zoom-menulist-expected.txt:


  Commit: 6c3f83cc9da4d318221f1655922d09e4d83fe98a
      https://github.com/WebKit/WebKit/commit/6c3f83cc9da4d318221f1655922d09e4d83fe98a
  Author: Enrique Ocaña González <eocanha at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/gtk/PageClientImpl.cpp
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Merge r256113 - [GTK] Mouse pointer no longer hidden during fullscreen video playback
https://bugs.webkit.org/show_bug.cgi?id=197346

Reviewed by Adrian Perez de Castro.

.:

Enabled the CURSOR_VISIBILITY feature on the GTK port.

* Source/cmake/OptionsGTK.cmake:

Source/WebKit:

Covered by existing tests.

* UIProcess/API/gtk/PageClientImpl.cpp:
(WebKit::PageClientImpl::setCursorHiddenUntilMouseMoves): Added implementation.


  Commit: be913c0aa901a9a6187d7fea14ba557fe2a70216
      https://github.com/WebKit/WebKit/commit/be913c0aa901a9a6187d7fea14ba557fe2a70216
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Inspector/gtk/RemoteWebInspectorProxyGtk.cpp
    M Source/WebKit/UIProcess/Inspector/gtk/WebInspectorProxyGtk.cpp
    M Source/WebKit/UIProcess/Inspector/gtk/WebKitInspectorWindow.cpp
    M Source/WebKit/UIProcess/Inspector/gtk/WebKitInspectorWindow.h

  Log Message:
  -----------
  Merge r256114 - [GTK][WebInspector] Do not make Web Inspector windows transient
https://bugs.webkit.org/show_bug.cgi?id=207455

Reviewed by Carlos Garcia Campos.

Stop setting Web Inspector windows as transient for the window
containing the web view being inspected, to allow changing their
relative stacking order. No changes are needed for inspector windows
to continue being destroyed correctly when the corresponding web view
is destroyed because code for handling that was already present in
WebInspectorProxyGtk.cpp.

No new tests needed.

* UIProcess/Inspector/gtk/RemoteWebInspectorProxyGtk.cpp:
(WebKit::RemoteWebInspectorProxy::platformCreateFrontendPageAndWindow):
Do not pass a parent window parameter to webkitInspectorWindowNew().
* UIProcess/Inspector/gtk/WebInspectorProxyGtk.cpp:
(WebKit::WebInspectorProxy::platformCreateFrontendWindow): Remove code
to obtain the top level window of the WebKitWebView, which no longer
needs being passed to webkitInspectorWindowNew().
* UIProcess/Inspector/gtk/WebKitInspectorWindow.cpp:
(webkitInspectorWindowNew): Do not set the GtkWindow.transient-for
property for the Web Inspector window. Remove the parent window
parameter.
* UIProcess/Inspector/gtk/WebKitInspectorWindow.h: Remove the parent
window parameter for webkitInspectorWindowNew().


  Commit: e21c4386ff2184acb90f25544d49357dea1a4205
      https://github.com/WebKit/WebKit/commit/e21c4386ff2184acb90f25544d49357dea1a4205
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/GeolocationPermissionRequestManagerProxy.h
    M Source/WebKit/UIProcess/WebGeolocationManagerProxy.cpp

  Log Message:
  -----------
  Merged r256167 - [geolocation] Fix non-unified build issues
https://bugs.webkit.org/show_bug.cgi?id=207457

Unreviewed build fix.

No new tests needed.

* UIProcess/GeolocationPermissionRequestManagerProxy.h: Add missing includes.
* UIProcess/WebGeolocationManagerProxy.cpp: Ditto.


  Commit: 4fefccdda11701c4fbf11eac5609502d3e5ad4bb
      https://github.com/WebKit/WebKit/commit/4fefccdda11701c4fbf11eac5609502d3e5ad4bb
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-02-10 (Mon, 10 Feb 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.27.90 release

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.27.90.


  Commit: 8513022a783e8faad11fb4686f55faf26fc0a6ce
      https://github.com/WebKit/WebKit/commit/8513022a783e8faad11fb4686f55faf26fc0a6ce
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-11 (Tue, 11 Feb 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.27.90 release

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.27.90.


  Commit: 09a5b66f8c5e48383f5dbc36df0aa0a540e3e954
      https://github.com/WebKit/WebKit/commit/09a5b66f8c5e48383f5dbc36df0aa0a540e3e954
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/FormData.cpp

  Log Message:
  -----------
  Merge r256173 - Make FormDataElement::lengthInBytes() safe to call on a non-main thread
https://bugs.webkit.org/show_bug.cgi?id=207419
<rdar://problem/54386521>

Reviewed by Youenn Fablet.

Make FormDataElement::lengthInBytes() safe to call on a non-main thread by using the
ThreadableBlobRegistry. DOMCache code in workers may call this on worker threads for
example.

* platform/network/FormData.cpp:
(WebCore::FormDataElement::lengthInBytes const):


  Commit: 4d40124aa85134b28206e32ae9346f2d4133d7b6
      https://github.com/WebKit/WebKit/commit/4d40124aa85134b28206e32ae9346f2d4133d7b6
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/animations/stop-animation-on-suspend-expected.txt
    M LayoutTests/animations/stop-animation-on-suspend.html

  Log Message:
  -----------
  Merge r256177 - [Web Animations] Fix animations/stop-animation-on-suspend.html
https://bugs.webkit.org/show_bug.cgi?id=184580
<rdar://problem/39406014>

Reviewed by Simon Fraser.

The expectations of this test were incorrect. The test animates a transform from 0 to 400px across 400ms with a linear timing function. The test suspends
animations from 100ms to 300ms with timers, and polls animations at 200ms and 400ms. At 200ms, it expects a value of 100px, which is correct since the animation
is suspended and so the value at 100ms (when it was suspended) is expected.

However, the test expected the value at 400ms to be 200px, which leads me to think this test assumes that animations, when resumed, account for the time suspended
and subtracts it from the page time. This is incorrect: when animations resume, they resume at the current time, no matter how long they were suspended. So the expected
value should be 400px.

* animations/stop-animation-on-suspend-expected.txt:
* animations/stop-animation-on-suspend.html:


  Commit: e61bb0c51fdcf92c8258074e8194373a796d1389
      https://github.com/WebKit/WebKit/commit/e61bb0c51fdcf92c8258074e8194373a796d1389
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/webanimations/accelerated-animation-removal-upon-transition-completion.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/AnimationEffect.h
    M Source/WebCore/animation/KeyframeEffect.cpp
    M Source/WebCore/animation/KeyframeEffect.h
    M Source/WebCore/animation/WebAnimation.cpp

  Log Message:
  -----------
  Merge r256181 - There's an event loop cycle between an animation finishing, and it being removed from GraphicsLayerCA
https://bugs.webkit.org/show_bug.cgi?id=207361
<rdar://problem/59280370>

Reviewed by Simon Fraser.

Source/WebCore:

Animations should be removed from GraphicsLayersCAs in the same rendering update that changes the playState of the
animation to "finished", to avoid layer flush where a GraphicsLayersCAs has no extent set, but thinks there is
an active transform animation.

To do this, instead of enqueuing accelerated actions when resolving animations during style resolution, in
KeyframeAnimation::apply(), we enqueue them as soon as an animation's current time may have changed: in
WebAnimation::tick() and WebAnimation::play() with supporting functions newly exposed on AnimationEffect.

Now, accelerated animations are enqueued and applied during the "update animations and send events" procedure.

* animation/AnimationEffect.h:
* animation/KeyframeEffect.cpp:
(WebCore::KeyframeEffect::apply):
(WebCore::KeyframeEffect::updateAcceleratedActions):
(WebCore::KeyframeEffect::animationDidTick):
(WebCore::KeyframeEffect::animationDidPlay):
* animation/KeyframeEffect.h:
* animation/WebAnimation.cpp:
(WebCore::WebAnimation::play):
(WebCore::WebAnimation::tick):

LayoutTests:

Lower the number of frames to wait after an animation completes by one to check that the accelerated animation has been removed
to show that we enqueue accelerated actions as part of the "update animations and send events" procedure.

* webanimations/accelerated-animation-removal-upon-transition-completion.html: Added.


  Commit: 1a11ad38fa3d91962489aa7ccc94dd61efb758e2
      https://github.com/WebKit/WebKit/commit/1a11ad38fa3d91962489aa7ccc94dd61efb758e2
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/compositing/backing/transition-extent-expected.txt
    A LayoutTests/compositing/backing/transition-extent.html
    A LayoutTests/platform/ios-wk2/compositing/backing/transition-extent-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayerBacking.cpp

  Log Message:
  -----------
  Merge r256214 - WebContent jetsams on Sony lens webpage due to spike of IOSurfaces
https://bugs.webkit.org/show_bug.cgi?id=207493
rdar://problem/59020443

Reviewed by Zalan Bujtas.
Source/WebCore:

There were three issues that contributed to massive backing store allocation on
<https://www.sony.com/electronics/lenses/t/camera-lenses>.

The first, fixed in r256095, was that the Web Animations code unioned the untransitioning
bounds with the transitioning bounds, causing the computation of large extent rects.

The second, fixed in r256181, was that GraphicsLayerCA would keep hold of a transform
animation for an extra frame, causing a rendering update where
RenderLayerBacking::updateGeometry() would have cleared the extent, but GraphicsLayerCA
still thought transform was animating, causing GraphicsLayerCA::updateCoverage() to keep
backing store attached.

This patch is the final fix; when animations start and end, we need to ensure that
RenderLayerBacking::updateGeometry() is called so that we compute the animation extent in
the same frame that adds the animation.

Test: compositing/backing/transition-extent.html

* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::startAnimation):
(WebCore::RenderLayerBacking::animationFinished):

LayoutTests:

Test with an out-of-view transitioning element which should not get backing store.

* compositing/backing/transition-extent-expected.txt: Added.
* compositing/backing/transition-extent.html: Added.
* platform/ios-wk2/compositing/backing/transition-extent-expected.txt: Added.


  Commit: b7ef949aba452de1de1fe726263961250cb667ca
      https://github.com/WebKit/WebKit/commit/b7ef949aba452de1de1fe726263961250cb667ca
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessProxy.cpp

  Log Message:
  -----------
  Merge r256187 - Crash under WebProcessProxy::shouldSendPendingMessage()
https://bugs.webkit.org/show_bug.cgi?id=207464
<rdar://problem/59293825>

Reviewed by Alex Christensen.

I suspect the WebProcessProxy object is getting destroyed as we are iterating over the
pending messages in AuxiliaryProcessProxy::didFinishLaunching(), thus crashing when
calling WebProcessProxy::shouldSendPendingMessage() inside the loop. As a speculative
fix, protect |this| at the beginning of WebProcessProxy::didFinishLaunching().

* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::didFinishLaunching):


  Commit: fdde5633c0d8e3738b4b3aa5d406473ad0657bfe
      https://github.com/WebKit/WebKit/commit/fdde5633c0d8e3738b4b3aa5d406473ad0657bfe
  Author: Daniel Bates <dbates at webkit.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/url/relative-expected.txt
    M LayoutTests/fast/url/relative.html
    A LayoutTests/fast/url/relative2-expected.txt
    A LayoutTests/fast/url/relative2.html
    M LayoutTests/fast/url/resources/utilities.js
    M LayoutTests/fast/url/segments-from-data-url-expected.txt
    M LayoutTests/fast/url/segments-from-data-url.html
    A LayoutTests/fast/url/segments-from-data-url2-expected.txt
    A LayoutTests/fast/url/segments-from-data-url2.html
    M LayoutTests/fetch/fetch-url-serialization-expected.txt
    M LayoutTests/http/tests/plugins/navigation-during-load-embed.html
    M LayoutTests/http/tests/plugins/navigation-during-load.html
    A LayoutTests/http/tests/security/allowed-base-url-data-url-via-setting-expected.txt
    A LayoutTests/http/tests/security/allowed-base-url-data-url-via-setting.html
    A LayoutTests/http/tests/security/denied-base-url-data-url-expected.txt
    A LayoutTests/http/tests/security/denied-base-url-data-url.html
    A LayoutTests/http/tests/security/denied-base-url-javascript-url-expected.txt
    A LayoutTests/http/tests/security/denied-base-url-javascript-url.html
    M LayoutTests/imported/w3c/web-platform-tests/url/a-element-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/url/a-element-origin-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/url/a-element-origin-xhtml-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/url/a-element-xhtml-expected.txt
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/spi/darwin/dyldSPI.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/html/parser/HTMLPreloadScanner.cpp
    M Source/WebCore/html/parser/HTMLPreloadScanner.h
    M Source/WebCore/page/SecurityPolicy.cpp
    M Source/WebCore/page/SecurityPolicy.h
    M Source/WebCore/page/Settings.yaml
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/WebPreferences.yaml
    M Source/WebKit/UIProcess/API/Cocoa/WKWebView.mm
    M Source/WebKit/UIProcess/Cocoa/VersionChecks.h
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/Misc/WebKitVersionChecks.h
    M Source/WebKitLegacy/mac/WebView/WebView.mm

  Log Message:
  -----------
  Merge r256191 - Disallow setting base URL to a data or JavaScript URL
https://bugs.webkit.org/show_bug.cgi?id=207136

Source/WebCore:

Reviewed by Brent Fulgham.

Inspired by <https://bugs.chromium.org/p/chromium/issues/detail?id=679318>.

Block setting the base URL to a data URL or JavaScript URL as such usage is questionable.
This makes WebKit match the behavior of Chrome and Firefox and is in the spirit of the
discussion in <https://github.com/whatwg/html/issues/2249>.

On Mac and iOS, this restriction is applied only to apps linked against a future SDK to
avoid breaking shipped apps.

For all other ports, this restriction is enabled by default.

Tests: fast/url/relative2.html
       fast/url/segments-from-data-url2.html
       http/tests/security/allowed-base-url-data-url-via-setting.html
       http/tests/security/denied-base-url-data-url.html
       http/tests/security/denied-base-url-javascript-url.html

* dom/Document.cpp:
(WebCore::Document::processBaseElement): Condition updating the parsed
base URL on whether is has an allowed scheme, if restrictions are enabled. Otherwise,
do what we do now. If the scheme is disallowed then log a message to the console to
explain this to web developers.
* html/parser/HTMLPreloadScanner.cpp:
(WebCore::TokenPreloadScanner::scan): Pass whether to apply restrictons to the base URL
to updatePredictedBaseURL(). This depends on whether the setting is enabled or not.
(WebCore::TokenPreloadScanner::updatePredictedBaseURL): Modifed to take a boolean as to
whether to apply restrictions. If restrictions are not to be applied do what we do now.
Otherwise, only do what we do now if the scheme for the predicated base URL is allowed.
* html/parser/HTMLPreloadScanner.h:
* page/SecurityPolicy.cpp:
(WebCore::SecurityPolicy::isBaseURLSchemeAllowed): Added.
* page/SecurityPolicy.h:
* page/Settings.yaml: Add a setting to toggle restrictions on the base URL scheme.

Source/WebKit:

Reviewed by Brent Fulgham.

Apply base URL restrictions to apps linked to a future WebKit to avoid breaking existing apps.

* Shared/WebPreferences.yaml:
* UIProcess/API/Cocoa/WKWebView.mm:
(shouldRestrictBaseURLSchemes): Added.
(-[WKWebView _setupPageConfiguration:]): Update settings.
* UIProcess/Cocoa/VersionChecks.h:

Source/WebKitLegacy/mac:

Reviewed by Brent Fulgham.

Apply base URL restrictions to apps linked to a future WebKit to avoid breaking existing apps.

* Misc/WebKitVersionChecks.h:
* WebView/WebView.mm:
(shouldRestrictBaseURLSchemes): Added.
(-[WebView _commonInitializationWithFrameName:groupName:]): Update settings.

Source/WTF:

Reviewed by Brent Fulgham.

Add some more macro definitions.

* wtf/spi/darwin/dyldSPI.h:

LayoutTests:

RReviewed by Brent Fulgham.

Add some tests. Update others to toggle the setting to apply or unapply the new behavior.

The test denied-base-url-javascript-url.html is derived from the test base-url-javascript.html,
included in <https://chromium.googlesource.com/chromium/src.git/+/c133efa0b915430701930b76a7cfe35608b9a403>.

* fast/url/relative-expected.txt:
* fast/url/relative.html:
* fast/url/relative2-expected.txt: Copied from LayoutTests/fast/url/relative-expected.txt.
* fast/url/relative2.html: Copied from LayoutTests/fast/url/relative.html.
* fast/url/resources/utilities.js:
(setShouldEllipsizeFileURLPaths): Added. Toggles ellipsizing the path portion of a file URL to simplify matching.
Otherwise, file URLs could be machine-specific.
(canonicalizedPathname): Added.
(segments): Modified to optionally call canonicalizedPathname.
(canonicalize): Ditto.
* fast/url/segments-from-data-url-expected.txt:
* fast/url/segments-from-data-url.html:
* fast/url/segments-from-data-url2-expected.txt: Copied from LayoutTests/fast/url/segments-from-data-url-expected.txt.
* fast/url/segments-from-data-url2.html: Copied from LayoutTests/fast/url/segments-from-data-url.html.
* fetch/fetch-url-serialization-expected.txt:
* http/tests/plugins/navigation-during-load-embed.html:
* http/tests/plugins/navigation-during-load.html:
* http/tests/security/allowed-base-url-data-url-via-setting-expected.txt: Added.
* http/tests/security/allowed-base-url-data-url-via-setting.html: Added.
* http/tests/security/denied-base-url-data-url-expected.txt: Added.
* http/tests/security/denied-base-url-data-url.html: Added.
* http/tests/security/denied-base-url-javascript-url-expected.txt: Added.
* http/tests/security/denied-base-url-javascript-url.html: Added.


  Commit: 6745b8515111f5b95e7ad07207c4f66eda0361a9
      https://github.com/WebKit/WebKit/commit/6745b8515111f5b95e7ad07207c4f66eda0361a9
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/css3/shapes/shape-outside-path-no-crash-expected.txt
    A LayoutTests/css3/shapes/shape-outside-path-no-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/parser/CSSPropertyParser.cpp

  Log Message:
  -----------
  Merge r256192 - Unreachable code hit in WebCore::Shape::createShape
https://bugs.webkit.org/show_bug.cgi?id=207399

Reviewed by Darin Adler.

Source/WebCore:

CSS parser should not consume the 'shape-outside' property with type 'path'
since it has not been implemented yet. This will prevent an assertion in
the debug build and null dref in the release build.

Test: css3/shapes/shape-outside-path-no-crash.html

* css/parser/CSSPropertyParser.cpp:
(WebCore::consumeBasicShape):
(WebCore::consumeShapeOutside):

LayoutTests:

* css3/shapes/shape-outside-path-no-crash-expected.txt: Added.
* css3/shapes/shape-outside-path-no-crash.html: Added.


  Commit: 4a223d070c027c9864e703ee905bd7afac916e98
      https://github.com/WebKit/WebKit/commit/4a223d070c027c9864e703ee905bd7afac916e98
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashTable.h

  Log Message:
  -----------
  Merge r256194 - Unreviewed, fix build failure on watchOS simulator
https://bugs.webkit.org/show_bug.cgi?id=207183

* wtf/HashTable.h:
(WTF::HashTableCapacityForSize::capacityForSize):


  Commit: 18274ffa08aef79d878d2bd1b10a63c279dc860a
      https://github.com/WebKit/WebKit/commit/18274ffa08aef79d878d2bd1b10a63c279dc860a
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/missing-exception-check-in-GenericArguments-deletePropertyByIndex.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/GenericArgumentsInlines.h

  Log Message:
  -----------
  Merge r256198 - Missing exception check in GenericArguments<Type>::deletePropertyByIndex().
https://bugs.webkit.org/show_bug.cgi?id=207483
<rdar://problem/59302616>

Reviewed by Yusuke Suzuki.

JSTests:

* stress/missing-exception-check-in-GenericArguments-deletePropertyByIndex.js: Added.

Source/JavaScriptCore:

* runtime/GenericArgumentsInlines.h:
(JSC::GenericArguments<Type>::deletePropertyByIndex):


  Commit: d068c8ad663599f0533328f4ac33a006ad8e8d31
      https://github.com/WebKit/WebKit/commit/d068c8ad663599f0533328f4ac33a006ad8e8d31
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M ChangeLog
    M Source/cmake/WebKitCompilerFlags.cmake

  Log Message:
  -----------
  Merge r256200 - [CMake] Prepend -Wno-noexcept-type only to global CXX flags
https://bugs.webkit.org/show_bug.cgi?id=207468

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-02-10
Reviewed by Adrian Perez de Castro.

-Wno-noexcept-type is a C++-specific flag that should not be passed to the C compiler. This
causes a warning spam in GCC 10.

* Source/cmake/WebKitCompilerFlags.cmake:


  Commit: 73a803eb50e370288f0fade1d1ab7855f193559a
      https://github.com/WebKit/WebKit/commit/73a803eb50e370288f0fade1d1ab7855f193559a
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/placate-exception-check-validator-in-GenericArguments-put.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/GenericArgumentsInlines.h

  Log Message:
  -----------
  Merge r256202 - Placate exception check validator in GenericArguments<Type>::put().
https://bugs.webkit.org/show_bug.cgi?id=207485
<rdar://problem/59302535>

Reviewed by Robin Morisset.

JSTests:

* stress/placate-exception-check-validator-in-GenericArguments-put.js: Added.

Source/JavaScriptCore:

* runtime/GenericArgumentsInlines.h:
(JSC::GenericArguments<Type>::put):


  Commit: ecd720c46e06c28722c9b0dc15a34969c34b8e8e
      https://github.com/WebKit/WebKit/commit/ecd720c46e06c28722c9b0dc15a34969c34b8e8e
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashTable.h

  Log Message:
  -----------
  Merge r256203 - Unreviewed, speculative build fix on watchOS simulator
https://bugs.webkit.org/show_bug.cgi?id=207183

* wtf/HashTable.h:
(WTF::HashTableCapacityForSize::capacityForSize):


  Commit: c44fb0e9bc56aa7cab50c4814b0a255ec45cdebe
      https://github.com/WebKit/WebKit/commit/c44fb0e9bc56aa7cab50c4814b0a255ec45cdebe
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/textfieldselection/selection-not-application-textarea-expected.txt
    M LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt
    M LayoutTests/platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt
    M LayoutTests/platform/mac/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLTextFormControlElement.cpp

  Log Message:
  -----------
  Merge r256207 - Don't update selection when calling setSelectionRange on a disconnected input element
https://bugs.webkit.org/show_bug.cgi?id=207357

Reviewed by Antti Koivisto.

LayoutTests/imported/w3c:

Rebaselined the test that progressed a little. The test now passes offset checks but still fails direction check.

* web-platform-tests/html/semantics/forms/textfieldselection/selection-not-application-textarea-expected.txt:

Source/WebCore:

Don't update FrameSelection when the text form control element is disconnected from document.

* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::setSelectionRange):

LayoutTests:

Rebaselined the test that has progressed with this change.

* platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt:
* platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt:
* platform/mac/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/type-change-state-expected.txt:


  Commit: 9f8993efe58f3f0009b0f2780f1764fe16db049d
      https://github.com/WebKit/WebKit/commit/9f8993efe58f3f0009b0f2780f1764fe16db049d
  Author: Basuke Suzuki <basuke.suzuki at sony.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/SharedBuffer.h

  Log Message:
  -----------
  Merge r256223 - [WebCore] Shrink Vectors passed to SharedBuffer
https://bugs.webkit.org/show_bug.cgi?id=207503

Reviewed by Yusuke Suzuki.

Once SharedBuffer::DataSegment is created, the content won't change in its life cycle. Shrink the passed vector
before assigning to member variable to save space.

With the quick research, when displaying Apple's website, 1~3% RSS usage reduction on PlayStation port.

No new tests because there's no behavior change.

* platform/SharedBuffer.h:


  Commit: 2f02ec67f44ea56620510723c7ec88f7218b0773
      https://github.com/WebKit/WebKit/commit/2f02ec67f44ea56620510723c7ec88f7218b0773
  Author: Wenson Hsieh <wenson_hsieh at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Quirks.cpp

  Log Message:
  -----------
  Merge r256228 - [iOS] REGRESSION (r255592): The simulated mouse event dispatch quirk should not be on by default
https://bugs.webkit.org/show_bug.cgi?id=207513
<rdar://problem/59326119>

Reviewed by Tim Horton.

Turn `shouldDispatchSimulatedMouseEvents` back off by default (r255592 enabled it by default on all web pages).

* page/Quirks.cpp:
(WebCore::Quirks::shouldDispatchSimulatedMouseEvents const):


  Commit: 6c2c1c85190e8cbc4469d6a18beca427c9c8eac7
      https://github.com/WebKit/WebKit/commit/6c2c1c85190e8cbc4469d6a18beca427c9c8eac7
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/ResourceRequestSoup.cpp

  Log Message:
  -----------
  Merge r256301 - Unreviewed. Fix WPE build after r256298

It started to fail in r256298 because of unified builds, but the issue was introduced in r256013.

* platform/network/soup/ResourceRequestSoup.cpp: Add missing header include.


  Commit: 6a62824efb32148b62278d0bed4976333c850f39
      https://github.com/WebKit/WebKit/commit/6a62824efb32148b62278d0bed4976333c850f39
  Author: Nikita Vasilyev <nvasilyev at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Views/DOMTreeOutline.css

  Log Message:
  -----------
  Merge r256374 - Web Inspector RTL: Elements closing tag is reversed
https://bugs.webkit.org/show_bug.cgi?id=207214

Reviewed by Timothy Hatcher.

Wrap text nodes in `unicode-bidi: isolate-override`. From MDN:

isolate-override:
    This keyword applies the isolation behavior of the isolate
    keyword to the surrounding content and the override behavior
    of the bidi-override keyword to the inner content.

* UserInterface/Views/DOMTreeOutline.css:
(.tree-outline.dom li > span > .html-text-node):


  Commit: 8400cbd8ac87f1b5b354582cb4dcaf5e3517cdb4
      https://github.com/WebKit/WebKit/commit/8400cbd8ac87f1b5b354582cb4dcaf5e3517cdb4
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/workers/service/serviceworkerclients-claim.https-expected.txt
    M LayoutTests/http/tests/workers/service/serviceworkerclients-claim.https.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/local-url-inherit-controller.https-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/DocumentLoader.cpp

  Log Message:
  -----------
  Merge r256381 - Parent service worker controller should be used for child iframe as per https://w3c.github.io/ServiceWorker/#control-and-use-window-client
https://bugs.webkit.org/show_bug.cgi?id=207506

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

* web-platform-tests/service-workers/service-worker/local-url-inherit-controller.https-expected.txt:

Source/WebCore:

Instead of checking document URL protocol, implement the rules as per spec, in particular:
- If http/https, do not reuse controller
- If iframe has a unique origin, do not reuse controller
- If iframe does not have same origin as parent, do not reuse controller.

Covered by rebased test.

* loader/DocumentLoader.cpp:
(WebCore::isInheritingControllerFromParent):
(WebCore::DocumentLoader::commitData):
(WebCore::isLocalURL): Deleted.

LayoutTests:

* http/tests/workers/service/serviceworkerclients-claim.https-expected.txt:
Rebased test since now the frame is doing a fetch that is no longer intercepted by the service worker,
and is thus failing due to CORS.
* http/tests/workers/service/serviceworkerclients-claim.https.html:


  Commit: ba1d62bb1e55acd08062c20123da3675cee5dc66
      https://github.com/WebKit/WebKit/commit/ba1d62bb1e55acd08062c20123da3675cee5dc66
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/workers/service/serviceworkerclients-claim.https-expected.txt
    M LayoutTests/http/tests/workers/service/serviceworkerclients-claim.https.html

  Log Message:
  -----------
  Merge r256537 - REGRESSION: (256381) [ macOS ] http/tests/workers/service/serviceworkerclients-claim.https.html is flaky failing
https://bugs.webkit.org/show_bug.cgi?id=207653
<rdar://problem/59396225>

Reviewed by Chris Dumez.

console log message output was flaky.
Make sure to end the fetch and post a message so that the console log message will appear in the expected.txt reliably.

* http/tests/workers/service/serviceworkerclients-claim.https-expected.txt:
* http/tests/workers/service/serviceworkerclients-claim.https.html:


  Commit: 811333fd86ee49feee3ed84a98d69a6a5555a30c
      https://github.com/WebKit/WebKit/commit/811333fd86ee49feee3ed84a98d69a6a5555a30c
  Author: Rob Buis <rbuis at igalia.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/ParsedContentType.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebCore/ParsedContentType.cpp

  Log Message:
  -----------
  Merge r256395 - Bug 207424: Crash in WebCore::ParsedContentType::parseContentType when parsing invalid MIME type
<https://webkit.org/b/207424>
<rdar://problem/59250384>

Patch by Rob Buis <rbuis at igalia.com> and David Kilzer <ddkilzer at apple.com> on 2020-02-11
Reviewed by Rob Buis.

Source/WebCore:

Return StringView directly rather than wrapping
it in Optional, since StringView's can be null tested.

Tests: TestWebKitAPI.ParsedContentType

* platform/network/ParsedContentType.cpp:
(WebCore::parseToken):
(WebCore::parseQuotedString):
(WebCore::ParsedContentType::parseContentType): Don't set type
parameter if parameterName is null string.  Remove unneeded
`parameterName` variable; use keyRange.toString() instead.

Tools:

* TestWebKitAPI/Tests/WebCore/ParsedContentType.cpp:
(TestWebKitAPI::TEST): Add more tests.


  Commit: d596f3bc3e3958af513e37277c1e5d79983c2b72
      https://github.com/WebKit/WebKit/commit/d596f3bc3e3958af513e37277c1e5d79983c2b72
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessPool.cpp
    M Source/WebKit/WebProcess/WebProcess.cpp
    M Source/WebKit/WebProcess/WebProcess.h
    M Source/WebKit/WebProcess/WebProcess.messages.in

  Log Message:
  -----------
  Merge r256396 - Unreviewed, revert r255662 as it seems to cause blank views in SVC.
https://bugs.webkit.org/show_bug.cgi?id=207144
<rdar://problem/59334011>

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::initializeNewWebProcess):
* WebProcess/WebProcess.cpp:
(WebKit::WebProcess::initializeWebProcess):
* WebProcess/WebProcess.h:
* WebProcess/WebProcess.messages.in:


  Commit: 378030273ca8b02cb0cb8115be4fdcf26050a93a
      https://github.com/WebKit/WebKit/commit/378030273ca8b02cb0cb8115be4fdcf26050a93a
  Author: Sihui Liu <sihui_liu at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/storage/indexeddb/cursor-update-while-iterating-expected.txt
    M LayoutTests/storage/indexeddb/resources/cursor-update-while-iterating.js
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.h

  Log Message:
  -----------
  Merge r256414 - IndexedDB: iteration of cursors skip records if deleted
https://bugs.webkit.org/show_bug.cgi?id=207437

Reviewed by Brady Eidson.

Source/WebCore:

When changes are made to records, cursors will dump cached records and set new key range for iteration.
The new range did not include key of current cursor record, which is wrong because two index records can have
the same key but different values.
r237590 tried fixing this issue by caching all the following records which have the same key as current record.
That is not quite right as there could be changes on the cached records, and the cached records were not
updated.

To correctly fix the issue, set the new key range to include key of current cursor record and exclude values
visited before. To not regress preformance, we complete this by making an extra statment and changing
IndexRecordsIndex index of table IndexRecords to cover value column.

Added test case in: storage/indexeddb/cursor-update-while-iterating.html
Index upgrade covered by existing API test: IndexedDB.IDBObjectStoreInfoUpgradeToV2

* Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
(WebCore::IDBServer::SQLiteIDBBackingStore::ensureValidIndexRecordsIndex):
* Modules/indexeddb/server/SQLiteIDBCursor.cpp:
(WebCore::IDBServer::buildPreIndexStatement):
(WebCore::IDBServer::SQLiteIDBCursor::objectStoreRecordsChanged):
(WebCore::IDBServer::SQLiteIDBCursor::resetAndRebindPreIndexStatementIfNecessary):
(WebCore::IDBServer::SQLiteIDBCursor::fetch):
(WebCore::IDBServer::SQLiteIDBCursor::fetchNextRecord):
(WebCore::IDBServer::SQLiteIDBCursor::internalFetchNextRecord):
* Modules/indexeddb/server/SQLiteIDBCursor.h:
(WebCore::IDBServer::SQLiteIDBCursor::isDirectionNext const):

LayoutTests:

* storage/indexeddb/cursor-update-while-iterating-expected.txt:
* storage/indexeddb/resources/cursor-update-while-iterating.js:
(populateObjectStore):
(onOpenSuccess.request.onsuccess):
(onOpenSuccess):
(prepareDatabase): Deleted.


  Commit: 2c31cbc6765d0459904cd6c133137722e3638390
      https://github.com/WebKit/WebKit/commit/2c31cbc6765d0459904cd6c133137722e3638390
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/StyleProperties.cpp
    M Source/WebCore/css/StyleProperties.h

  Log Message:
  -----------
  Merge r256423 - Compress ImmutableStyleProperties by using PackedPtr
https://bugs.webkit.org/show_bug.cgi?id=207604

Reviewed by Mark Lam.

ImmutableStyleProperties is kept so long and consumes enough memory.
We already attempted to compact it by storing CSSProperty's members separately.
But we can compact further by using PackedPtr. This patch makes,

    1. Use PackedPtr for CSSValue* in ImmutableStyleProperties so that we can cut some bytes
    2. Reorder CSSValue* and StylePropertyMetadata arrays since StylePropertyMetadata requires alignment while PackedPtr<CSSValue> is not.

No behavior change.

* css/StyleProperties.cpp:
(WebCore::sizeForImmutableStylePropertiesWithPropertyCount):
(WebCore::ImmutableStyleProperties::ImmutableStyleProperties):
(WebCore::ImmutableStyleProperties::~ImmutableStyleProperties):
(WebCore::ImmutableStyleProperties::findCustomPropertyIndex const):
* css/StyleProperties.h:
(WebCore::ImmutableStyleProperties::valueArray const):
(WebCore::ImmutableStyleProperties::metadataArray const):
(WebCore::ImmutableStyleProperties::propertyAt const):


  Commit: ba07ae5d660754209c3b1d22ed964700386ae990
      https://github.com/WebKit/WebKit/commit/ba07ae5d660754209c3b1d22ed964700386ae990
  Author: Sunny He <sunny_he at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/legacy-animation-engine/transitions/svg-bad-scale-crash-expected.txt
    A LayoutTests/legacy-animation-engine/transitions/svg-bad-scale-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/CSSTransition.cpp
    M Source/WebCore/animation/CSSTransition.h

  Log Message:
  -----------
  Merge r256427 - Fix crash due to uninitialized currentStyle in CSSTransition
https://bugs.webkit.org/show_bug.cgi?id=205959
<rdar://57073673>

Patch by Sunny He <sunny_he at apple.com> on 2020-02-12
Reviewed by Antoine Quint.

Source/WebCore:

Test: legacy-animation-engine/transitions/svg-bad-scale-crash.html

* animation/CSSTransition.cpp:
(WebCore::CSSTransition::create):
(WebCore::CSSTransition::CSSTransition):
* animation/CSSTransition.h:

LayoutTests:

Fix crash due to uninitialized currentStyle in CSSTransition

* legacy-animation-engine/transitions/svg-bad-scale-crash-expected.txt: Added.
* legacy-animation-engine/transitions/svg-bad-scale-crash.html: Added.


  Commit: 542b99081274f5a35a5fd18ecb4c380cbaec832a
      https://github.com/WebKit/WebKit/commit/542b99081274f5a35a5fd18ecb4c380cbaec832a
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebDriver/ChangeLog
    M Source/WebDriver/WebDriverService.cpp

  Log Message:
  -----------
  Merge r256430 - WebDriver: return invalidSessionID exception if the WebProcess doesn't respond (crashes)
https://bugs.webkit.org/show_bug.cgi?id=207565

Reviewed by Adrian Perez de Castro.

Report InvalidSessionID if the session connection its not connected.

* WebDriverService.cpp:
(WebDriver::WebDriverService::findSessionOrCompleteWithError):


  Commit: 40a6a7a265f993975eee1b2b72c8058058d54694
      https://github.com/WebKit/WebKit/commit/40a6a7a265f993975eee1b2b72c8058058d54694
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitCocoa/ServiceWorkerBasic.mm

  Log Message:
  -----------
  Merge r256432 - WebSWServerConnection::registerServiceWorkerClient is not sending IPC message to UIProcess when it should
https://bugs.webkit.org/show_bug.cgi?id=207537

Reviewed by Chris Dumez.

Source/WebKit:

Covered by added API test.

* NetworkProcess/ServiceWorker/WebSWServerConnection.cpp:
(WebKit::WebSWServerConnection::registerServiceWorkerClient):
Fix use after move so that we can get the context connection and send the IPC message to UIProcess as expected.

Tools:

* TestWebKitAPI/Tests/WebKitCocoa/ServiceWorkerBasic.mm:


  Commit: 84c407f37a5bacf77f0b1c04caa2b58c221667ca
      https://github.com/WebKit/WebKit/commit/84c407f37a5bacf77f0b1c04caa2b58c221667ca
  Author: Dean Jackson <dino at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/ThirdParty/ANGLE/ChangeLog
    M Source/ThirdParty/ANGLE/changes.diff
    R Source/ThirdParty/ANGLE/src/tests/perf_tests/glmark2Benchmark.cpp
    R Source/ThirdParty/ANGLE/third_party/glmark2/BUILD.gn
    R Source/ThirdParty/ANGLE/third_party/glmark2/README.angle
    R Source/ThirdParty/ANGLE/tools/flex-bison/README.md
    R Source/ThirdParty/ANGLE/tools/flex-bison/linux/bison.sha1
    R Source/ThirdParty/ANGLE/tools/flex-bison/linux/flex.sha1
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/.gitattributes
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/m4sugar/LICENSE
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/m4sugar/README.chromium
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/m4sugar/foreach.m4
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/m4sugar/m4sugar.m4
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/LICENSE
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/README.chromium
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/bison.m4
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/c-like.m4
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/c.m4
    R Source/ThirdParty/ANGLE/tools/flex-bison/third_party/skeletons/yacc.c
    R Source/ThirdParty/ANGLE/tools/flex-bison/update_flex_bison_binaries.py
    R Source/ThirdParty/ANGLE/tools/flex-bison/windows/bison.exe.sha1
    R Source/ThirdParty/ANGLE/tools/flex-bison/windows/flex.exe.sha1
    R Source/ThirdParty/ANGLE/tools/flex-bison/windows/m4.exe.sha1
    R Source/ThirdParty/ANGLE/tools/flex-bison/windows/msys-2.0.dll.sha1
    R Source/ThirdParty/ANGLE/tools/flex-bison/windows/msys-iconv-2.dll.sha1
    R Source/ThirdParty/ANGLE/tools/flex-bison/windows/msys-intl-8.dll.sha1

  Log Message:
  -----------
  Merge r256443 - ANGLE has unused bison and glmark2 code
https://bugs.webkit.org/show_bug.cgi?id=207597
rdar://59361460

Reviewed by Maciej Stachowiak.

Remove some unused files.

* changes.diff:
* src/tests/perf_tests/glmark2Benchmark.cpp: Removed.
* third_party/glmark2/BUILD.gn: Removed.
* third_party/glmark2/README.angle: Removed.
* tools/flex-bison/README.md: Removed.
* tools/flex-bison/linux/bison.sha1: Removed.
* tools/flex-bison/linux/flex.sha1: Removed.
* tools/flex-bison/third_party/.gitattributes: Removed.
* tools/flex-bison/third_party/m4sugar/LICENSE: Removed.
* tools/flex-bison/third_party/m4sugar/README.chromium: Removed.
* tools/flex-bison/third_party/m4sugar/foreach.m4: Removed.
* tools/flex-bison/third_party/m4sugar/m4sugar.m4: Removed.
* tools/flex-bison/third_party/skeletons/LICENSE: Removed.
* tools/flex-bison/third_party/skeletons/README.chromium: Removed.
* tools/flex-bison/third_party/skeletons/bison.m4: Removed.
* tools/flex-bison/third_party/skeletons/c-like.m4: Removed.
* tools/flex-bison/third_party/skeletons/c.m4: Removed.
* tools/flex-bison/third_party/skeletons/yacc.c: Removed.
* tools/flex-bison/update_flex_bison_binaries.py: Removed.
* tools/flex-bison/windows/bison.exe.sha1: Removed.
* tools/flex-bison/windows/flex.exe.sha1: Removed.
* tools/flex-bison/windows/m4.exe.sha1: Removed.
* tools/flex-bison/windows/msys-2.0.dll.sha1: Removed.
* tools/flex-bison/windows/msys-iconv-2.dll.sha1: Removed.
* tools/flex-bison/windows/msys-intl-8.dll.sha1: Removed.


  Commit: ef172fee7982eab18ba7094a8c77bc4a519b558b
      https://github.com/WebKit/WebKit/commit/ef172fee7982eab18ba7094a8c77bc4a519b558b
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/workers/service/ServiceWorkerContainer.cpp

  Log Message:
  -----------
  Merge r256447 - RELEASE_ASSERT() under WebSWClientConnection::didResolveRegistrationPromise()
https://bugs.webkit.org/show_bug.cgi?id=207637
<rdar://problem/59093490>

Reviewed by Youenn Fablet.

We were capturing data by reference in the notifyIfExitEarly ScopeExit lambda and then capturing it
in the task posted to the event loop, which was unsafe.

* workers/service/ServiceWorkerContainer.cpp:
(WebCore::ServiceWorkerContainer::jobResolvedWithRegistration):


  Commit: d49fe9f1ec7e12a7fa4f29d42929e1d38a34a71d
      https://github.com/WebKit/WebKit/commit/d49fe9f1ec7e12a7fa4f29d42929e1d38a34a71d
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/RegExpKey.h

  Log Message:
  -----------
  Merge r256467 - [JSC] Make RegExpCache small
https://bugs.webkit.org/show_bug.cgi?id=207619

Reviewed by Mark Lam.

We can compact RegExpKey by using PackedRefPtr, so that we can shrink memory consumption of RegExpCache.

* runtime/RegExpKey.h:


  Commit: ce999cce6bd4d14ddb5f62da1aca3d7d4e2d0a8e
      https://github.com/WebKit/WebKit/commit/ce999cce6bd4d14ddb5f62da1aca3d7d4e2d0a8e
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/Structure.cpp
    M Source/JavaScriptCore/runtime/Structure.h
    M Source/JavaScriptCore/runtime/StructureTransitionTable.h

  Log Message:
  -----------
  Merge r256468 - [JSC] Compact StructureTransitionTable
https://bugs.webkit.org/show_bug.cgi?id=207616

Reviewed by Mark Lam.

Some of StructureTransitionTable are shown as very large HashMap and we can compact it by encoding key.
We leverage 48bit pointers and 8byte alignment of UniquedStringImpl* to encode other parameters into it.

* runtime/Structure.cpp:
(JSC::StructureTransitionTable::contains const):
(JSC::StructureTransitionTable::get const):
(JSC::StructureTransitionTable::add):
* runtime/Structure.h:
* runtime/StructureTransitionTable.h:
(JSC::StructureTransitionTable::Hash::Key::Key):
(JSC::StructureTransitionTable::Hash::Key::isHashTableDeletedValue const):
(JSC::StructureTransitionTable::Hash::Key::impl const):
(JSC::StructureTransitionTable::Hash::Key::isAddition const):
(JSC::StructureTransitionTable::Hash::Key::attributes const):
(JSC::StructureTransitionTable::Hash::Key::operator==):
(JSC::StructureTransitionTable::Hash::Key::operator!=):
(JSC::StructureTransitionTable::Hash::hash):
(JSC::StructureTransitionTable::Hash::equal):


  Commit: 193ce532515d812712d4968fa124a58a0f4352a7
      https://github.com/WebKit/WebKit/commit/193ce532515d812712d4968fa124a58a0f4352a7
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/workers/service/ServiceWorkerContainer.cpp

  Log Message:
  -----------
  Merge r256470 - ServiceWorkerContainer::jobResolvedWithRegistration scopeExit should capture all lambda parameters by value
https://bugs.webkit.org/show_bug.cgi?id=207657

Reviewed by Chris Dumez.

shouldNotifyWhenResolved is captured by reference in the notifyIfExitEarly ScopeExit lambda.
The ScopeExit is not always called synchronously so it is unsafe to capture values by reference here.

* workers/service/ServiceWorkerContainer.cpp:
(WebCore::ServiceWorkerContainer::jobResolvedWithRegistration):


  Commit: cd3641758ebdf12d5f2c01a18efde90afcca6d76
      https://github.com/WebKit/WebKit/commit/cd3641758ebdf12d5f2c01a18efde90afcca6d76
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/Markable.h
    M Source/WTF/wtf/ObjectIdentifier.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FetchOptions.h
    M Source/WebCore/loader/ResourceLoaderOptions.h
    M Source/WebCore/loader/cache/CachedImage.cpp
    M Source/WebCore/loader/cache/CachedImage.h
    M Source/WebCore/loader/cache/CachedResource.cpp
    M Source/WebCore/loader/cache/CachedResource.h
    M Source/WebCore/page/csp/ContentSecurityPolicyResponseHeaders.h
    M Source/WebCore/platform/network/NetworkLoadMetrics.h
    M Source/WebCore/platform/network/ResourceLoadPriority.h
    M Source/WebCore/platform/network/ResourceRequestBase.h
    M Source/WebCore/platform/network/ResourceResponseBase.h
    M Source/WebCore/platform/network/StoredCredentialsPolicy.h

  Log Message:
  -----------
  Merge r256482 - Shrink CachedResource
https://bugs.webkit.org/show_bug.cgi?id=207618

Reviewed by Mark Lam.

Source/WebCore:

This patch shrinks sizeof(CachedResource) by 80 bytes by aggressively using bit-fields and Markable<>.
For each enum class, we define `bitsOfXXX` value, which indicates # of bits to represent it. And using
this value for bit-field's width.

No behavior change.

* loader/FetchOptions.h:
(WebCore::FetchOptions::encode const):
* loader/ResourceLoaderOptions.h:
(WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
(WebCore::ResourceLoaderOptions::loadedFromOpaqueSource):
* loader/cache/CachedImage.cpp:
(WebCore::CachedImage::CachedImage):
(WebCore::CachedImage::shouldDeferUpdateImageData const):
(WebCore::CachedImage::didUpdateImageData):
* loader/cache/CachedImage.h:
* loader/cache/CachedResource.cpp:
(WebCore::CachedResource::CachedResource):
(WebCore::CachedResource::load):
(WebCore::CachedResource::finish):
* loader/cache/CachedResource.h:
(WebCore::CachedResource::setStatus):
* page/csp/ContentSecurityPolicyResponseHeaders.h:
(WebCore::ContentSecurityPolicyResponseHeaders::MarkableTraits::isEmptyValue):
(WebCore::ContentSecurityPolicyResponseHeaders::MarkableTraits::emptyValue):
(WebCore::ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders):
* platform/network/NetworkLoadMetrics.h:
(WebCore::NetworkLoadMetrics::isolatedCopy const):
(WebCore::NetworkLoadMetrics::clearNonTimingData):
(WebCore::NetworkLoadMetrics::operator== const):
(WebCore::NetworkLoadMetrics::encode const):
(WebCore::NetworkLoadMetrics::decode):
* platform/network/ResourceLoadPriority.h:
* platform/network/ResourceRequestBase.h:
(WebCore::ResourceRequestBase::ResourceRequestBase):
* platform/network/ResourceResponseBase.h:
* platform/network/StoredCredentialsPolicy.h:

Source/WTF:

* wtf/Markable.h:
(WTF::Markable::asOptional const): Add helper method to get Optional easily from Markable.
* wtf/ObjectIdentifier.h:


  Commit: bae2a4618efadda566f66aaff090d1eb154ac1f6
      https://github.com/WebKit/WebKit/commit/bae2a4618efadda566f66aaff090d1eb154ac1f6
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/ThirdParty/ANGLE/ChangeLog
    M Source/ThirdParty/ANGLE/changes.diff
    M Source/ThirdParty/ANGLE/include/platform/Platform.h
    M Source/ThirdParty/ANGLE/src/common/PackedEnums.h

  Log Message:
  -----------
  Merge r256491 - Multiple GCC 10 build failures in ANGLE
https://bugs.webkit.org/show_bug.cgi?id=207365

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-02-12
Reviewed by Carlos Alberto Lopez Perez.

* changes.diff: Updated.
* include/platform/Platform.h: Add missing #include to get size_t.
* src/common/PackedEnums.h: Remove problematic const_casts.


  Commit: fcd006d658db5dda073f5832d32ada1e79ebac53
      https://github.com/WebKit/WebKit/commit/fcd006d658db5dda073f5832d32ada1e79ebac53
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSInheritedValue.h
    M Source/WebCore/css/CSSInitialValue.h
    M Source/WebCore/css/CSSPrimitiveValue.cpp
    M Source/WebCore/css/CSSPrimitiveValue.h
    M Source/WebCore/css/CSSRevertValue.h
    M Source/WebCore/css/CSSUnsetValue.h
    M Source/WebCore/css/CSSValue.cpp
    M Source/WebCore/css/CSSValue.h
    M Source/WebCore/css/CSSValuePool.cpp
    M Source/WebCore/css/CSSValuePool.h

  Log Message:
  -----------
  Merge r256494 - CSSValuePool's constant CSS values should not be allocated dynamically (and same for Vectors)
https://bugs.webkit.org/show_bug.cgi?id=207666

Reviewed by Mark Lam.

r252785 changes contents (CSSValues and Vectors) of CSSValuePool from static ones to
dynamically allocated ones. This was done since we would like to use static CSSValues
even in the other threads (workers etc.) for OffscreenCanvas feature.

But this causes memory regression in Membuster since we allocates many CSSValues and
large Vectors, and they are kept persistently.

This patch removes dynamic allocation part of r252785 to recover memory regression.
The key of this patch is introducing Static CSSValue feature. When incrementing / decrementing
m_refCount of CSSValue, we add / subtract by 0x2. And we put 0x1 as a static-flag. So, even if
this CSSValue is used by multiple threads, we never see that CSSValue gets 0 m_refCount if
it is marked as static (having 0x1). This is the same design to our static StringImpl.

No behavior change.

* css/CSSInheritedValue.h:
* css/CSSInitialValue.h:
* css/CSSPrimitiveValue.cpp:
(WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
* css/CSSPrimitiveValue.h:
* css/CSSRevertValue.h:
* css/CSSUnsetValue.h:
* css/CSSValue.cpp:
* css/CSSValue.h:
(WebCore::CSSValue::ref const):
(WebCore::CSSValue::hasOneRef const):
(WebCore::CSSValue::refCount const):
(WebCore::CSSValue::hasAtLeastOneRef const):
(WebCore::CSSValue::deref):
(WebCore::CSSValue::makeStatic):
* css/CSSValuePool.cpp:
(WebCore::StaticCSSValuePool::StaticCSSValuePool):
(WebCore::StaticCSSValuePool::init):
(WebCore::CSSValuePool::CSSValuePool):
(WebCore::CSSValuePool::singleton):
(WebCore::CSSValuePool::createIdentifierValue):
(WebCore::CSSValuePool::createColorValue):
(WebCore::CSSValuePool::createValue):
* css/CSSValuePool.h:
(WebCore::CSSValuePool::createInheritedValue):
(WebCore::CSSValuePool::createImplicitInitialValue):
(WebCore::CSSValuePool::createExplicitInitialValue):
(WebCore::CSSValuePool::createUnsetValue):
(WebCore::CSSValuePool::createRevertValue):


  Commit: fbfe5db3f4d7ee293bb5c1051d119bd56c05af15
      https://github.com/WebKit/WebKit/commit/fbfe5db3f4d7ee293bb5c1051d119bd56c05af15
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/JIT.cpp
    M Source/JavaScriptCore/jit/JITCodeMap.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/MallocPtr.h

  Log Message:
  -----------
  Merge r256498 - [JSC] Compact JITCodeMap by storing BytecodeIndex and CodeLocation separately
https://bugs.webkit.org/show_bug.cgi?id=207673

Reviewed by Mark Lam.

Source/JavaScriptCore:

While BytecodeIndex is 4 bytes, CodeLocation is 8 bytes. So the tuple of them "JITCodeMap::Entry"
becomes 16 bytes because it adds 4 bytes padding. We should store BytecodeIndex and CodeLocation separately
to avoid this padding.

This patch introduces JITCodeMapBuilder. We use this to build JITCodeMap data structure as a immutable final result.

* jit/JIT.cpp:
(JSC::JIT::link):
* jit/JITCodeMap.h:
(JSC::JITCodeMap::JITCodeMap):
(JSC::JITCodeMap::find const):
(JSC::JITCodeMap::operator bool const):
(JSC::JITCodeMap::codeLocations const):
(JSC::JITCodeMap::indexes const):
(JSC::JITCodeMapBuilder::append):
(JSC::JITCodeMapBuilder::finalize):
(JSC::JITCodeMap::Entry::Entry): Deleted.
(JSC::JITCodeMap::Entry::bytecodeIndex const): Deleted.
(JSC::JITCodeMap::Entry::codeLocation): Deleted.
(JSC::JITCodeMap::append): Deleted.
(JSC::JITCodeMap::finish): Deleted.

Source/WTF:

* wtf/MallocPtr.h:


  Commit: a423fbcd9890468d55ae8e527166854d51361b9f
      https://github.com/WebKit/WebKit/commit/a423fbcd9890468d55ae8e527166854d51361b9f
  Author: Said Abou-Hallawa <said at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/animation/css-animation-throttling-lowPowerMode.html
    M LayoutTests/fast/animation/request-animation-frame-throttle-subframe.html
    M LayoutTests/fast/animation/request-animation-frame-throttling-detached-iframe.html
    M LayoutTests/fast/animation/request-animation-frame-throttling-lowPowerMode-expected.txt
    M LayoutTests/fast/animation/request-animation-frame-throttling-lowPowerMode.html
    R LayoutTests/fast/animation/request-animation-frame-throttling-outside-viewport-expected.txt
    R LayoutTests/fast/animation/request-animation-frame-throttling-outside-viewport.html
    R LayoutTests/fast/animation/resources/frame-with-animation-2.html
    M LayoutTests/http/tests/frame-throttling/raf-throttle-in-cross-origin-subframe.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/Headers.cmake
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    M Source/WebCore/animation/DocumentTimeline.cpp
    M Source/WebCore/animation/DocumentTimeline.h
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/ScriptedAnimationController.cpp
    M Source/WebCore/dom/ScriptedAnimationController.h
    M Source/WebCore/page/FrameView.cpp
    M Source/WebCore/page/Page.cpp
    M Source/WebCore/page/Page.h
    M Source/WebCore/page/RenderingUpdateScheduler.cpp
    M Source/WebCore/page/RenderingUpdateScheduler.h
    M Source/WebCore/page/Settings.yaml
    M Source/WebCore/page/SettingsBase.cpp
    M Source/WebCore/page/SettingsBase.h
    R Source/WebCore/platform/graphics/AnimationFrameRate.h
    M Source/WebCore/platform/graphics/DisplayRefreshMonitor.h
    M Source/WebCore/platform/graphics/DisplayRefreshMonitorManager.cpp
    M Source/WebCore/platform/graphics/DisplayRefreshMonitorManager.h
    M Source/WebCore/platform/graphics/GraphicsLayerUpdater.cpp
    M Source/WebCore/platform/graphics/ios/DisplayRefreshMonitorIOS.mm
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/WebPreferences.yaml
    M Source/WebKit/UIProcess/API/C/WKPreferences.cpp
    M Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h
    M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.h
    M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.messages.in
    M Source/WebKit/UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDisplayRefreshMonitor.h
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDisplayRefreshMonitor.mm
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.h
    M Source/WebKit/WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm
    M Source/WebKitLegacy/mac/ChangeLog
    M Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h
    M Source/WebKitLegacy/mac/WebView/WebPreferences.mm
    M Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h
    M Source/WebKitLegacy/mac/WebView/WebView.mm
    M Source/WebKitLegacy/win/ChangeLog
    M Source/WebKitLegacy/win/Interfaces/IWebPreferencesPrivate.idl
    M Source/WebKitLegacy/win/WebPreferenceKeysPrivate.h
    M Source/WebKitLegacy/win/WebPreferences.cpp
    M Source/WebKitLegacy/win/WebPreferences.h
    M Source/WebKitLegacy/win/WebView.cpp
    M Tools/ChangeLog
    M Tools/DumpRenderTree/mac/DumpRenderTree.mm
    M Tools/DumpRenderTree/win/DumpRenderTree.cpp
    M Tools/WebKitTestRunner/TestController.cpp

  Log Message:
  -----------
  Merge r256512 - Unreviewed, rolling out r255158, 255405 and r255486

Caused test flakiness and PLT regression.

Patch by Said Abou-Hallawa <said at apple.com> on 2020-02-13

Source/WebCore:

* Headers.cmake:
* WebCore.xcodeproj/project.pbxproj:
* animation/DocumentTimeline.cpp:
(WebCore::DocumentTimeline::updateThrottlingState):
(WebCore::DocumentTimeline::animationInterval const):
* animation/DocumentTimeline.h:
* dom/Document.cpp:
(WebCore::Document::requestAnimationFrame):
(WebCore::Document::updateLastHandledUserGestureTimestamp):
* dom/ScriptedAnimationController.cpp:
(WebCore::ScriptedAnimationController::ScriptedAnimationController):
(WebCore::throttlingReasonToString):
(WebCore::throttlingReasonsToString):
(WebCore::ScriptedAnimationController::addThrottlingReason):
(WebCore::ScriptedAnimationController::removeThrottlingReason):
(WebCore::ScriptedAnimationController::isThrottled const):
(WebCore::ScriptedAnimationController::registerCallback):
(WebCore::ScriptedAnimationController::cancelCallback):
(WebCore::ScriptedAnimationController::serviceRequestAnimationFrameCallbacks):
(WebCore::ScriptedAnimationController::interval const):
(WebCore::ScriptedAnimationController::page const):
(WebCore::ScriptedAnimationController::scheduleAnimation):
(WebCore::ScriptedAnimationController::animationTimerFired):
(WebCore::ScriptedAnimationController::preferredScriptedAnimationInterval const): Deleted.
(WebCore::ScriptedAnimationController::isThrottledRelativeToPage const): Deleted.
(WebCore::ScriptedAnimationController::shouldRescheduleRequestAnimationFrame const): Deleted.
* dom/ScriptedAnimationController.h:
(WebCore::ScriptedAnimationController::addThrottlingReason): Deleted.
(WebCore::ScriptedAnimationController::removeThrottlingReason): Deleted.
* page/FrameView.cpp:
(WebCore::FrameView::updateScriptedAnimationsAndTimersThrottlingState):
* page/Page.cpp:
(WebCore::m_deviceOrientationUpdateProvider):
(WebCore::Page::isLowPowerModeEnabled const):
(WebCore::Page::setLowPowerModeEnabledOverrideForTesting):
(WebCore::updateScriptedAnimationsThrottlingReason):
(WebCore::Page::setIsVisuallyIdleInternal):
(WebCore::Page::handleLowModePowerChange):
(WebCore::Page::renderingUpdateThrottlingEnabled const): Deleted.
(WebCore::Page::renderingUpdateThrottlingEnabledChanged): Deleted.
(WebCore::Page::isRenderingUpdateThrottled const): Deleted.
(WebCore::Page::preferredRenderingUpdateInterval const): Deleted.
* page/Page.h:
(WebCore::Page::isLowPowerModeEnabled const): Deleted.
(WebCore::Page::canUpdateThrottlingReason const): Deleted.
* page/RenderingUpdateScheduler.cpp:
(WebCore::RenderingUpdateScheduler::scheduleTimedRenderingUpdate):
(WebCore::RenderingUpdateScheduler::startTimer):
(WebCore::RenderingUpdateScheduler::adjustFramesPerSecond): Deleted.
(WebCore::RenderingUpdateScheduler::adjustRenderingUpdateFrequency): Deleted.
* page/RenderingUpdateScheduler.h:
* page/Settings.yaml:
* page/SettingsBase.cpp:
(WebCore::SettingsBase::renderingUpdateThrottlingEnabledChanged): Deleted.
* page/SettingsBase.h:
* platform/graphics/AnimationFrameRate.h: Removed.
* platform/graphics/DisplayRefreshMonitor.h:
(WebCore::DisplayRefreshMonitor::setPreferredFramesPerSecond): Deleted.
* platform/graphics/DisplayRefreshMonitorManager.cpp:
(WebCore::DisplayRefreshMonitorManager::createMonitorForClient):
(WebCore::DisplayRefreshMonitorManager::registerClient):
(WebCore::DisplayRefreshMonitorManager::scheduleAnimation):
(WebCore::DisplayRefreshMonitorManager::windowScreenDidChange):
(WebCore::DisplayRefreshMonitorManager::monitorForClient): Deleted.
(WebCore::DisplayRefreshMonitorManager::setPreferredFramesPerSecond): Deleted.
* platform/graphics/DisplayRefreshMonitorManager.h:
(WebCore::DisplayRefreshMonitorManager::DisplayRefreshMonitorManager):
* platform/graphics/GraphicsLayerUpdater.cpp:
(WebCore::GraphicsLayerUpdater::GraphicsLayerUpdater):
* platform/graphics/ios/DisplayRefreshMonitorIOS.mm:
(-[WebDisplayLinkHandler setPreferredFramesPerSecond:]): Deleted.

Source/WebKit:

* Shared/WebPreferences.yaml:
* UIProcess/API/C/WKPreferences.cpp:
(WKPreferencesSetRenderingUpdateThrottlingEnabled): Deleted.
(WKPreferencesGetRenderingUpdateThrottlingEnabled): Deleted.
* UIProcess/API/C/WKPreferencesRefPrivate.h:
* UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.h:
* UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.messages.in:
* UIProcess/RemoteLayerTree/RemoteLayerTreeDrawingAreaProxy.mm:
(-[WKOneShotDisplayLinkHandler setPreferredFramesPerSecond:]): Deleted.
(WebKit::RemoteLayerTreeDrawingAreaProxy::setPreferredFramesPerSecond): Deleted.
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDisplayRefreshMonitor.h:
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDisplayRefreshMonitor.mm:
(WebKit::RemoteLayerTreeDisplayRefreshMonitor::setPreferredFramesPerSecond): Deleted.
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.h:
* WebProcess/WebPage/RemoteLayerTree/RemoteLayerTreeDrawingArea.mm:
(WebKit::RemoteLayerTreeDrawingArea::setPreferredFramesPerSecond): Deleted.

Source/WebKitLegacy/mac:

* WebView/WebPreferenceKeysPrivate.h:
* WebView/WebPreferences.mm:
(+[WebPreferences initialize]):
(-[WebPreferences renderingUpdateThrottlingEnabled]): Deleted.
(-[WebPreferences setRenderingUpdateThrottlingEnabled:]): Deleted.
* WebView/WebPreferencesPrivate.h:
* WebView/WebView.mm:
(-[WebView _preferencesChanged:]):

Source/WebKitLegacy/win:

* Interfaces/IWebPreferencesPrivate.idl:
* WebPreferenceKeysPrivate.h:
* WebPreferences.cpp:
(WebPreferences::initializeDefaultSettings):
(WebPreferences::renderingUpdateThrottlingEnabled): Deleted.
(WebPreferences::setRenderingUpdateThrottlingEnabled): Deleted.
* WebPreferences.h:
* WebView.cpp:
(WebView::notifyPreferencesChanged):

Tools:

* DumpRenderTree/mac/DumpRenderTree.mm:
(resetWebPreferencesToConsistentValues):
* DumpRenderTree/win/DumpRenderTree.cpp:
(enableExperimentalFeatures):
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::resetPreferencesToConsistentValues):

LayoutTests:

* fast/animation/css-animation-throttling-lowPowerMode.html:
* fast/animation/request-animation-frame-throttle-subframe.html:
* fast/animation/request-animation-frame-throttling-detached-iframe.html:
* fast/animation/request-animation-frame-throttling-lowPowerMode-expected.txt:
* fast/animation/request-animation-frame-throttling-lowPowerMode.html:
* fast/animation/request-animation-frame-throttling-outside-viewport-expected.txt: Removed.
* fast/animation/request-animation-frame-throttling-outside-viewport.html: Removed.
* fast/animation/resources/frame-with-animation-2.html: Removed.
* http/tests/frame-throttling/raf-throttle-in-cross-origin-subframe.html:
* platform/mac-wk2/TestExpectations:


  Commit: bb443112f7a79041ee518abd15b7f506d24b21b4
      https://github.com/WebKit/WebKit/commit/bb443112f7a79041ee518abd15b7f506d24b21b4
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/scrolling/programmatic-scroll-to-zero-zero-expected.html
    A LayoutTests/fast/scrolling/programmatic-scroll-to-zero-zero.html
    M LayoutTests/platform/ios/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/scrolling/ScrollingStateScrollingNode.cpp

  Log Message:
  -----------
  Merge r256513 - REGRESSION (r255037): Zooming in and out on Quip in macOS Safari can cause the content to be offset to the side
https://bugs.webkit.org/show_bug.cgi?id=207674
rdar://problem/59404866

Reviewed by Antti Koivisto.

Source/WebCore:

Remove the early return in ScrollingStateScrollingNode::setRequestedScrollData(); comparing
with the last m_requestedScrollData is wrong, because requested scroll positions are not "state"
in the scrolling tree, they are requests to scroll. Ideally, they would be represented in some
different way in the scrolling tree.

Test: fast/scrolling/programmatic-scroll-to-zero-zero.html

* page/scrolling/ScrollingStateScrollingNode.cpp:
(WebCore::ScrollingStateScrollingNode::setRequestedScrollData):

LayoutTests:

Test that does a programmatic scroll to 0,0, does a user scroll, then a second programmatic scroll to 0,0,
which is expected to work.

* fast/scrolling/programmatic-scroll-to-zero-zero-expected.html: Added.
* fast/scrolling/programmatic-scroll-to-zero-zero.html: Added.
* platform/ios/TestExpectations: Skip the new test on iOS (it relies on eventSender) and sort the grouping.


  Commit: 1cb40514aa2559726ec18612214f2a376904c9f3
      https://github.com/WebKit/WebKit/commit/1cb40514aa2559726ec18612214f2a376904c9f3
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/parser/HTMLPreloadScanner.cpp
    M Source/WebCore/rendering/InlineTextBox.cpp

  Log Message:
  -----------
  Merge r256514 - Non-unified build fixes mid February 2020 edition
https://bugs.webkit.org/show_bug.cgi?id=207693

Unreviewed build fix.

No new tests needed.

* html/parser/HTMLPreloadScanner.cpp: Add missing include.
* platform/wpe/ScrollbarThemeWPE.cpp: Ditto.
* rendering/InlineTextBox.cpp: Ditto.


  Commit: dd318549002abc762bb6f5c0c5a3fcff9d156b14
      https://github.com/WebKit/WebKit/commit/dd318549002abc762bb6f5c0c5a3fcff9d156b14
  Author: Caio Araujo Neponoceno de Lima <ticaiolima at gmail.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/big-int-as-property-name.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/parser/Parser.cpp
    M Source/JavaScriptCore/parser/ParserArena.cpp
    M Source/JavaScriptCore/parser/ParserArena.h

  Log Message:
  -----------
  Merge r256541 - [ESNext][BigInt] We don't support BigInt literal as PropertyName
https://bugs.webkit.org/show_bug.cgi?id=206888

Reviewed by Ross Kirsling.

JSTests:

* stress/big-int-as-property-name.js: Added.

Source/JavaScriptCore:

According to spec (https://tc39.es/ecma262/#prod-PropertyName),
BigInt literals are valid property names. Given that, we should not
throw a SyntaxError when using BigInt literals on destructuring
pattern, method declaration, object literals, etc.
This patch is adding BigInt literal as a valid syntax to PropertyName.

* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseDestructuringPattern):
(JSC::Parser<LexerType>::parseClass):
(JSC::Parser<LexerType>::parseInstanceFieldInitializerSourceElements):
(JSC::Parser<LexerType>::parseProperty):
(JSC::Parser<LexerType>::parseGetterSetter):
* parser/ParserArena.cpp:
(JSC::IdentifierArena::makeBigIntDecimalIdentifier):
* parser/ParserArena.h:


  Commit: d8d8fef2337e5f4be0601af03b2aae72aced2b0f
      https://github.com/WebKit/WebKit/commit/d8d8fef2337e5f4be0601af03b2aae72aced2b0f
  Author: Commit Queue <commit-queue at webkit.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AXObjectCache.cpp
    M Source/WebCore/accessibility/AccessibilityRenderObject.cpp
    M Source/WebCore/accessibility/atk/WebKitAccessibleHyperlink.cpp
    M Source/WebCore/accessibility/atk/WebKitAccessibleInterfaceText.cpp
    M Source/WebCore/accessibility/atk/WebKitAccessibleUtil.cpp
    M Source/WebCore/editing/ApplyStyleCommand.cpp
    M Source/WebCore/editing/CompositeEditCommand.cpp
    M Source/WebCore/editing/Editing.cpp
    M Source/WebCore/editing/Editing.h
    M Source/WebCore/editing/TextIterator.cpp
    M Source/WebCore/editing/TextIterator.h
    M Source/WebCore/editing/TextIteratorBehavior.h
    M Source/WebCore/editing/ios/DictationCommandIOS.cpp
    M Source/WebCore/html/HTMLTextFormControlElement.cpp
    M Source/WebCore/page/EventHandler.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/ios/WebPageIOS.mm

  Log Message:
  -----------
  Merge r256563 - Unreviewed, rolling out r254557.
https://bugs.webkit.org/show_bug.cgi?id=207725

The assert is correct, but unfortunately it will alwasy fail
since there is an existing bug in
HTMLTextFormControlElement::indexForPosition(). See bug

Reverted changeset:

"Enable the offset assertion in
HTMLTextFormControlElement::indexForPosition"
https://bugs.webkit.org/show_bug.cgi?id=205706
https://trac.webkit.org/changeset/254557


  Commit: ec74aec4f626cf5efb8802a6489525a924e2561c
      https://github.com/WebKit/WebKit/commit/ec74aec4f626cf5efb8802a6489525a924e2561c
  Author: Keith Rollin <krollin at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/SubresourceLoader.cpp

  Log Message:
  -----------
  Merge r256569 - Add missing call to completionHandler
https://bugs.webkit.org/show_bug.cgi?id=207720
<rdar://problem/59436915>

Reviewed by Chris Dumez.

Bug 179641 (r225702) updated
SubresourceLoader::willSendRequestInternal with a return call without
first calling the completionHandler. Address this by adding the call
to the completionHandler.

No new tests -- it's not possible to control execution into the
affected code path.

* loader/SubresourceLoader.cpp:
(WebCore::SubresourceLoader::willSendRequestInternal):


  Commit: a59c60e3c3cfcbfaff98295f967a4966eaf5d3c6
      https://github.com/WebKit/WebKit/commit/a59c60e3c3cfcbfaff98295f967a4966eaf5d3c6
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Settings.yaml
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/Cocoa/WKWebViewConfiguration.mm

  Log Message:
  -----------
  Merge r256571 - REGRESSION (r255961): Default state for data URL handling is incorrect
https://bugs.webkit.org/show_bug.cgi?id=207719
<rdar://problem/59334011>

Reviewed by Chris Dumez.

The default selected in r255961 breaks too many WebKit framework users. Switch from opt-out to opt-in
while we work through compatibility issues.

Source/WebCore:

Tested by existing test cases.

* page/Settings.yaml:

Source/WebKit:

* UIProcess/API/Cocoa/WKWebViewConfiguration.mm:
(-[WKWebViewConfiguration init]):


  Commit: be6b005c53ac1d722df3d84ac935d68f10b11a47
      https://github.com/WebKit/WebKit/commit/be6b005c53ac1d722df3d84ac935d68f10b11a47
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/ServiceWorker/WebSWServerConnection.cpp
    M Source/WebKit/WebProcess/Storage/WebSWClientConnection.cpp

  Log Message:
  -----------
  Merge r256578 - Protect WebSWServerConnection::scheduleJobInServer from bad scopeURL
https://bugs.webkit.org/show_bug.cgi?id=207722

Reviewed by Chris Dumez.

* NetworkProcess/ServiceWorker/WebSWServerConnection.cpp:
(WebKit::WebSWServerConnection::scheduleJobInServer):
In case of bad scope, fail the job early on.
* WebProcess/Storage/WebSWClientConnection.cpp:
(WebKit::WebSWClientConnection::scheduleJobInServer):
Remove the RELEASE_ASSERT from now since we defend in Network process.
We will add it back in ServiceWorkerRegistration::getOrCreate as a follow-up.


  Commit: 9ba2d2d0c05da729a77cf23b1a4112fd3936c54f
      https://github.com/WebKit/WebKit/commit/9ba2d2d0c05da729a77cf23b1a4112fd3936c54f
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Sources.txt
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj
    A Source/WebCore/animation/AnimationEventBase.cpp
    A Source/WebCore/animation/AnimationEventBase.h
    M Source/WebCore/animation/AnimationPlaybackEvent.cpp
    M Source/WebCore/animation/AnimationPlaybackEvent.h
    M Source/WebCore/animation/CSSAnimation.cpp
    M Source/WebCore/animation/CSSAnimation.h
    M Source/WebCore/animation/CSSTransition.cpp
    M Source/WebCore/animation/CSSTransition.h
    M Source/WebCore/animation/DeclarativeAnimation.cpp
    M Source/WebCore/animation/DeclarativeAnimation.h
    M Source/WebCore/animation/WebAnimation.cpp
    M Source/WebCore/dom/AnimationEvent.cpp
    M Source/WebCore/dom/AnimationEvent.h
    M Source/WebCore/dom/TransitionEvent.cpp
    M Source/WebCore/dom/TransitionEvent.h
    M Source/WebCore/page/animation/CSSAnimationController.cpp

  Log Message:
  -----------
  Merge r256610 - [Web Animations] Make all animation event types inherit from the same base class
https://bugs.webkit.org/show_bug.cgi?id=207629

Reviewed by Simon Fraser.

Currently we dispatch events CSS Transitions and CSS Animations events using a dedicated event queue on DeclarativeAnimation, while the events
added by the Web Animations specification (of type AnimationPlaybackEvent) are dispatched using a shared queue on the DocumentTimeline that is
processed during the "update animations and send events procedure". The Web Animations specification dictates that all events should be dispatched
during that procedure, which includes sorting of such events based on their timeline time and associated animation relative composite order.

In this patch, we prepare the work towards spec compliance for animation events dispatch by making all event types (AnimationPlaybackEvent,
TransitionEvent and AnimationEvent) inherit from a single AnimationEventBase interface. This will allow DocumentTimeline to enqueue, sort and
dispatch all such events with a single queue in a future patch.

Due to CSSAnimationController, we must make the "timeline time" and "animation" parameters optional. When we drop support for CSSAnimationController
we'll be able to enforce stronger requirements for these.

No new test since this should not introduce any behavior change.

* Sources.txt:
* WebCore.xcodeproj/project.pbxproj:
* animation/AnimationEventBase.cpp: Added.
(WebCore::AnimationEventBase::AnimationEventBase):
* animation/AnimationEventBase.h: Added.
(WebCore::AnimationEventBase::create):
(WebCore::AnimationEventBase::isAnimationPlaybackEvent const):
(WebCore::AnimationEventBase::isAnimationEvent const):
(WebCore::AnimationEventBase::isTransitionEvent const):
(WebCore::AnimationEventBase::timelineTime const):
(WebCore::AnimationEventBase::animation const):
* animation/AnimationPlaybackEvent.cpp:
(WebCore::AnimationPlaybackEvent::AnimationPlaybackEvent):
(WebCore::AnimationPlaybackEvent::bindingsTimelineTime const):
* animation/AnimationPlaybackEvent.h:
* animation/CSSAnimation.cpp:
(WebCore::CSSAnimation::createEvent):
* animation/CSSAnimation.h:
* animation/CSSTransition.cpp:
(WebCore::CSSTransition::createEvent):
* animation/CSSTransition.h:
* animation/DeclarativeAnimation.cpp:
(WebCore::DeclarativeAnimation::enqueueDOMEvent):
* animation/DeclarativeAnimation.h:
* animation/WebAnimation.cpp:
(WebCore::WebAnimation::enqueueAnimationPlaybackEvent):
* dom/AnimationEvent.cpp:
(WebCore::AnimationEvent::AnimationEvent):
* dom/AnimationEvent.h:
* dom/TransitionEvent.cpp:
(WebCore::TransitionEvent::TransitionEvent):
* dom/TransitionEvent.h:
* page/animation/CSSAnimationController.cpp:
(WebCore::CSSAnimationControllerPrivate::fireEventsAndUpdateStyle):


  Commit: 15c400b1a1a69eaa2a3b90fbbcff0825487d7ff3
      https://github.com/WebKit/WebKit/commit/15c400b1a1a69eaa2a3b90fbbcff0825487d7ff3
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/wpe/qt/WPEQtView.cpp
    M Source/WebKit/UIProcess/API/wpe/qt/WPEQtView.h

  Log Message:
  -----------
  Merge r256612 - [WPE] WPEQtView.h includes the uninstalled WPEQtViewBackend.h
https://bugs.webkit.org/show_bug.cgi?id=207765

Reviewed by Philippe Normand.

Do a forward declaration instead of including the header.

* UIProcess/API/wpe/qt/WPEQtView.cpp:
* UIProcess/API/wpe/qt/WPEQtView.h:


  Commit: 937f9b0d2cfc167c4a806e4dc1538a47ec02e361
      https://github.com/WebKit/WebKit/commit/937f9b0d2cfc167c4a806e4dc1538a47ec02e361
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    M LayoutTests/compositing/backing/animate-into-view.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/css/css-transitions/CSSTransition-startTime.tentative-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animatable/animate-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/style-change-events-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/style-change-events-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/timing-model/timelines/update-and-send-events-expected.txt
    M LayoutTests/webanimations/css-transition-in-flight-reversal-accelerated.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/CSSTransition.h
    M Source/WebCore/animation/DeclarativeAnimation.cpp
    M Source/WebCore/animation/DeclarativeAnimation.h
    M Source/WebCore/animation/DocumentTimeline.cpp
    M Source/WebCore/animation/DocumentTimeline.h
    M Source/WebCore/animation/WebAnimation.cpp
    M Source/WebCore/animation/WebAnimation.h

  Log Message:
  -----------
  Merge r256619 - [Web Animations] Ensure CSS Transition and CSS Animation events are queued, sorted and dispatched by their timeline
https://bugs.webkit.org/show_bug.cgi?id=207364
<rdar://problem/59370413>

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

There are some progressions but also some "regressions". The progressions are real, showing the delivery of all animation events at the correct
time. However, the regressions are misleading. The fact that the "style change" tests would work was due to a design issue in the test which would
only wait one frame to detect whether a CSS Transition was started after a change made through the Web Animations API. These would work because
events were queued in the next frame, but delivered later due to the dedicated per-animation queue used, which meant the test was fooled into
thinking the CSS Transition did not start, as expected. Changing those test to use more than one frame to test for the lack of a CSS Transition
would have shown the FAIL results.

However, in order to not regress our WPT score, the issue of "style change" events will be addressed in a follow-up patch.

* web-platform-tests/css/css-transitions/CSSTransition-startTime.tentative-expected.txt:
* web-platform-tests/web-animations/interfaces/Animatable/animate-expected.txt:
* web-platform-tests/web-animations/interfaces/Animation/style-change-events-expected.txt:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/style-change-events-expected.txt:
* web-platform-tests/web-animations/timing-model/timelines/update-and-send-events-expected.txt:

Source/WebCore:

Until now, AnimationPlaybackEvent events, which are new events introduced by the Web Animations spec, were enqueued in a shared queue on the DocumentTimeline
and dispatched during the "update animations and send events" procedure. However, AnimationEvent and TransitionEvent events, dispatched by CSS Animations
and CSS Transitions, were dispatched via a dedicated per-animation queue, which meant typically that those events were dispathed one runloop after the
AnimationPlaybackEvent events.

We now remove the dedicated per-animation queue and enqueue all events in the shared DocumentTimeline queue for dispatch during the "update animations and send
events" procedure. To do this correctly, we need to do a couple of other things that ensure we don't regress tests.

First, we update the DocumentTimeline::shouldRunUpdateAnimationsAndSendEventsIgnoringSuspensionState() to account for whether there are pending animation events,
guaranteeing that an animation update is scheduled should there be any.

Second, when animation events are enqueued in DocumentTimeline::enqueueAnimationEvent() we schedule an animation update if needed, since we know we now
have pending events that will need to be delivered in an upcoming update. We also maintain a flag between the start of the "update animations and send events"
procedure and the moment when the pending animation events queue is cleared prior to dispatching events so that events enqueued in the meantime do not
prematurely schedule animation resolution. The need for a new animation resolution will be checked at the end of the procedure.

Finally, declarative animations used to have a special suclass of WebAnimation::needsTick() that would check whether they had any pending events, ensuring
they would not be removed prematurely. We now reset a flag to false as WebAnimation::tick() is called (as part of the "update animations and send events"
procedure) and set it to true in case an animation is enqueued. This flag is then used in needsTick() to guarantee the animation is not removed before
the DocumentTimeline has had a chance to dispatch the enqueued event.

Note also that, for clarity, the DocumentTimeline::unscheduleAnimationResolution() was renamed to DocumentTimeline::clearTickScheduleTimer() since it wouldn't
actually cancel a previous animation resolution schedule.

* animation/CSSTransition.h: Fix a newly found build error due to the missing wtf/MonotonicTime.h header.
* animation/DeclarativeAnimation.cpp: Remove all code related to the dedicated per-animation queue and instead call the new WebAnimation::enqueueAnimationEvent()
method to enqueue events on the DocumentTimeline.
(WebCore::DeclarativeAnimation::DeclarativeAnimation):
(WebCore::DeclarativeAnimation::tick):
(WebCore::DeclarativeAnimation::enqueueDOMEvent):
* animation/DeclarativeAnimation.h:
* animation/DocumentTimeline.cpp:
(WebCore::DocumentTimeline::detachFromDocument): Ensure the pending events queue is cleared when the timeline is detached from a document, ensuring that there no
longer events that would cause a ref-cycle (DocumentTimeline -> AnimationPlaybackEvent -> WebAnimation -> DocumentTimeline).
(WebCore::DocumentTimeline::suspendAnimations):
(WebCore::DocumentTimeline::removeAnimation):
(WebCore::DocumentTimeline::scheduleAnimationResolution):
(WebCore::DocumentTimeline::clearTickScheduleTimer):
(WebCore::DocumentTimeline::shouldRunUpdateAnimationsAndSendEventsIgnoringSuspensionState const):
(WebCore::DocumentTimeline::updateCurrentTime):
(WebCore::DocumentTimeline::updateAnimationsAndSendEvents):
(WebCore::DocumentTimeline::internalUpdateAnimationsAndSendEvents):
(WebCore::DocumentTimeline::scheduleNextTick):
(WebCore::DocumentTimeline::animationAcceleratedRunningStateDidChange):
(WebCore::DocumentTimeline::enqueueAnimationEvent):
* animation/DocumentTimeline.h:
* animation/WebAnimation.cpp:
(WebCore::WebAnimation::enqueueAnimationPlaybackEvent):
(WebCore::WebAnimation::enqueueAnimationEvent):
(WebCore::WebAnimation::needsTick const):
(WebCore::WebAnimation::tick):
* animation/WebAnimation.h:

LayoutTests:

Fix a couple of tests that made some incorrect assumptions.

* TestExpectations: imported/w3c/web-platform-tests/web-animations/timing-model/timelines/update-and-send-events.html is no longer flaky.
* compositing/backing/animate-into-view.html: Because the "animationstart" event is now dispatched during the "update animations and send events" procedure, which happens
during page rendering _before_ rAF callbacks are serviced, we must remove the rAF callback used prior to adding the "animationstart" event listener or else we would never
get it and the test would time out.
* webanimations/css-transition-in-flight-reversal-accelerated.html: We must wait for the initial transition to start and then two frames before reversing the transition,
to be certain that the animation did start. Indeed, the "transitionstart" event will be fired right before the next rAF callback is called, as the animation starts in that
very same frame, and so progress will be 0 and the transition wouldn't be reversable until the next frame when the animation has progress > 0.


  Commit: 6708b5629077368bac6a805b01a19d95e54a68a2
      https://github.com/WebKit/WebKit/commit/6708b5629077368bac6a805b01a19d95e54a68a2
  Author: Sihui Liu <sihui_liu at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Headers.cmake
    M Source/WebCore/Modules/indexeddb/IDBCursor.cpp
    M Source/WebCore/Modules/indexeddb/IDBCursor.h
    M Source/WebCore/Modules/indexeddb/IDBGetResult.cpp
    M Source/WebCore/Modules/indexeddb/IDBGetResult.h
    M Source/WebCore/Modules/indexeddb/IDBRequest.cpp
    M Source/WebCore/Modules/indexeddb/IDBRequest.h
    M Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
    M Source/WebCore/Modules/indexeddb/IDBTransaction.h
    M Source/WebCore/Modules/indexeddb/IndexedDB.h
    M Source/WebCore/Modules/indexeddb/client/IDBConnectionProxy.cpp
    M Source/WebCore/Modules/indexeddb/client/TransactionOperation.cpp
    M Source/WebCore/Modules/indexeddb/client/TransactionOperation.h
    M Source/WebCore/Modules/indexeddb/server/IDBBackingStore.h
    M Source/WebCore/Modules/indexeddb/server/MemoryIDBBackingStore.h
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.h
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.cpp
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBCursor.h
    M Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.cpp
    M Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabase.h
    M Source/WebCore/Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp
    M Source/WebCore/Modules/indexeddb/shared/IDBCursorRecord.h
    M Source/WebCore/Modules/indexeddb/shared/IDBIterateCursorData.cpp
    M Source/WebCore/Modules/indexeddb/shared/IDBIterateCursorData.h
    M Source/WebCore/WebCore.xcodeproj/project.pbxproj

  Log Message:
  -----------
  Merge r256621 - IndexedDB: prefetch cursor records on client side
https://bugs.webkit.org/show_bug.cgi?id=207602
<rdar://problem/58483927>

Reviewed by Brady Eidson.

Cache cursor records on client side and use those records for iterate operations.

This makes cursor continue/advance tests in PerformanceTests/IndexedDB/basics ~3x faster.

* Headers.cmake:

* Modules/indexeddb/IDBCursor.cpp:
(WebCore::IDBCursor::setGetResult): Record the ID of TransactionOperation that updates cached record.
(WebCore::IDBCursor::iterateWithPrefetchedRecords): IDBCursor uses cached records for iterate opertaions if
there is no write operation between last cached records update and current iteration operation.
(WebCore::IDBCursor::clearPrefetchedRecords):
* Modules/indexeddb/IDBCursor.h:

* Modules/indexeddb/IDBGetResult.cpp:
(WebCore::IDBGetResult::isolatedCopy):
* Modules/indexeddb/IDBGetResult.h:
(WebCore::IDBGetResult::IDBGetResult):
(WebCore::IDBGetResult::prefetchedRecords const):
(WebCore::IDBGetResult::encode const):
(WebCore::IDBGetResult::decode):

* Modules/indexeddb/IDBRequest.cpp: Record corresponding TransactionOperation ID in request.
(WebCore::IDBRequest::didOpenOrIterateCursor):
* Modules/indexeddb/IDBRequest.h:
(WebCore::IDBRequest::pendingCursor const):
(WebCore::IDBRequest::setTransactionOperationID):

* Modules/indexeddb/IDBTransaction.cpp: If a cursor iterate request can be handled with cached records,
IDBClient does not need to send request to IDBServer and wait for response. But requests before that iterate
request may need to wait server to answer, and spec requires to handle requests in order. Therefore, we now keep
all the results in m_transactionOperationResultMap and handle them according to the ordering in
m_transactionOperationsInProgressQueue.
(WebCore::IDBTransaction::abortInProgressOperations):
(WebCore::IDBTransaction::removeRequest): Because result of a cursor request can be answered sooner, it is
possible that in finishedDispatchEventForRequest, m_currentlyCompletingRequest (which is a cursor request) is
set to nullptr, and then it is set back to the same cursor request in handleOperationsCompletedOnServer right
after. This happens in dispatchEvent of the cursor request, where request would remove itself from request list
of transaction at the end.
In this case, when request list becomes empty, transaction may commit automatically. But transaction should not
because that request is still valid as m_currentlyCompletingRequest and should not be removed from list.
(WebCore::IDBTransaction::scheduleOperation):
(WebCore::IDBTransaction::operationCompletedOnServer):
(WebCore::IDBTransaction::handleOperationsCompletedOnServer): All requests were sent to IDBServer and the
response/result ordering would naturally be the same as request order. Now that results can be created in both
IDBClient and IDBServer, we no longer handle requests using m_completedOnServerQueue.
(WebCore::IDBTransaction::createObjectStore): Mark as write operation to track last write operation.
(WebCore::IDBTransaction::renameObjectStore): Ditto.
(WebCore::IDBTransaction::createIndex): Ditto.
(WebCore::IDBTransaction::renameIndex): Ditto.
(WebCore::IDBTransaction::requestDeleteRecord): Ditto.
(WebCore::IDBTransaction::requestClearObjectStore): Ditto.
(WebCore::IDBTransaction::requestPutOrAdd): Ditto.
(WebCore::IDBTransaction::deleteObjectStore): Ditto.
(WebCore::IDBTransaction::deleteIndex): Ditto.
(WebCore::IDBTransaction::iterateCursorOnServer): Only use cached records if the request does not specify target
key. If cursor is iterated successfully with cache, send a message to IDBServer to notify about the progress.
Otherwise, fall back to depend on IDBServer to answer the request.
(WebCore::IDBTransaction::generateOperationID): TransactionOperation ID is unique in a transaction.
* Modules/indexeddb/IDBTransaction.h:

* Modules/indexeddb/IndexedDB.h:
* Modules/indexeddb/client/IDBConnectionProxy.cpp:
(WebCore::IDBClient::IDBConnectionProxy::iterateCursor): Don't track result of TransactionOperation in
IDBConnectionProxy if TransactionOperation does not need a reply from IDBServer.

* Modules/indexeddb/client/TransactionOperation.cpp:
(WebCore::IDBClient::TransactionOperation::TransactionOperation):
* Modules/indexeddb/client/TransactionOperation.h: Add ID to TransactionOperation.
(WebCore::IDBClient::TransactionOperation::operationID const):
(WebCore::IDBClient::TransactionOperation::TransactionOperation):

* Modules/indexeddb/server/IDBBackingStore.h: remove prefetchCursor as it is not used now.
* Modules/indexeddb/server/MemoryIDBBackingStore.h: Ditto. Also this patch only deals with prefetching in
persistent store.
* Modules/indexeddb/server/MemoryIDBBackingStore.h:
* Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
(WebCore::IDBServer::SQLiteIDBBackingStore::createIndex):
(WebCore::IDBServer::SQLiteIDBBackingStore::getAllIndexRecords):
(WebCore::IDBServer::SQLiteIDBBackingStore::getIndexRecord):
(WebCore::IDBServer::SQLiteIDBBackingStore::iterateCursor): Only prefetch at when request needs to be answered.
(WebCore::IDBServer::SQLiteIDBBackingStore::prefetchCursor): Deleted.
* Modules/indexeddb/server/SQLiteIDBBackingStore.h:

* Modules/indexeddb/server/SQLiteIDBCursor.cpp:
(WebCore::IDBServer::SQLiteIDBCursor::currentData): Provide an option to include prefetched records in result.
(WebCore::IDBServer::SQLiteIDBCursor::objectStoreRecordsChanged): Reset count to prefetch when there is a
change. This is used with increaseCountToPrefetch to make prefetch adaptive.
(WebCore::IDBServer::SQLiteIDBCursor::objectStoreRecordsChanged):
(WebCore::IDBServer::SQLiteIDBCursor::prefetchOneRecord):
(WebCore::IDBServer::SQLiteIDBCursor::increaseCountToPrefetch):
(WebCore::IDBServer::SQLiteIDBCursor::prefetch): Count to prefetch is decided by SQLiteCursor now.
(WebCore::IDBServer::SQLiteIDBCursor::internalFetchNextRecord):
(WebCore::IDBServer::SQLiteIDBCursor::currentValue const):
* Modules/indexeddb/server/SQLiteIDBCursor.h:

* Modules/indexeddb/server/UniqueIDBDatabase.cpp:
(WebCore::IDBServer::UniqueIDBDatabase::iterateCursor): Move call to prefetch cursor to SQLiteIDBBackingStore.
(WebCore::IDBServer::UniqueIDBDatabase::prefetchCursor): Deleted.
* Modules/indexeddb/server/UniqueIDBDatabase.h:
* Modules/indexeddb/server/UniqueIDBDatabaseTransaction.cpp:
(WebCore::IDBServer::UniqueIDBDatabaseTransaction::iterateCursor):

* Modules/indexeddb/shared/IDBCursorRecord.h: Stop using pointer for IDBValue for easier encoding and decoding.
(WebCore::IDBCursorRecord::size const):
(WebCore::IDBCursorRecord::isolatedCopy const):

* Modules/indexeddb/shared/IDBIterateCursorData.cpp:
(WebCore::IDBIterateCursorData::isolatedCopy const):
* Modules/indexeddb/shared/IDBIterateCursorData.h: Add an option to let IDBServer know whether it should answer
the cursor request.
(WebCore::IDBIterateCursorData::encode const):
(WebCore::IDBIterateCursorData::decode):

* WebCore.xcodeproj/project.pbxproj:


  Commit: c91c73ba9a31aa616071efd12281d0bcad61688e
      https://github.com/WebKit/WebKit/commit/c91c73ba9a31aa616071efd12281d0bcad61688e
  Author: Sunny He <sunny_he at apple.com>
  Date:   2020-02-25 (Tue, 25 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/webanimations/animation-null-effect-expected.txt
    A LayoutTests/webanimations/animation-null-effect.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/DocumentTimeline.cpp
    M Source/WebCore/animation/WebAnimation.cpp

  Log Message:
  -----------
  Merge r256623 - Ensure animations that lose their effect don't schedule an animation update
https://bugs.webkit.org/show_bug.cgi?id=207713
rdar://59174840

Patch by Sunny He <sunny_he at apple.com> on 2020-02-14
Reviewed by Antoine Quint.

Source/WebCore:
An active animation for which the effect is removed may be considered for
an upcoming animation resolution. However, WebAnimation::timeToNextTick()
expects a valid effect to be available to be able to determine timing.
We now check an animation is relevant before calling timeToNextTick() and
add an ASSERT() in that function to catch cases where an animation effect
might not be available.

Source/WebCore:

Test: webanimations/animation-null-effect.html

* animation/DocumentTimeline.cpp:
(WebCore::DocumentTimeline::scheduleNextTick):
* animation/WebAnimation.cpp:
(WebCore::WebAnimation::timeToNextTick const):

LayoutTests:

* webanimations/animation-null-effect-expected.txt: Added.
* webanimations/animation-null-effect.html: Added.


  Commit: 963a24858fd342c2707c3eea43b8245721cf4edb
      https://github.com/WebKit/WebKit/commit/963a24858fd342c2707c3eea43b8245721cf4edb
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animatable/animate-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/Animation/style-change-events-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/DocumentTimeline/style-change-events-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/web-animations/interfaces/KeyframeEffect/style-change-events-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/AnimationTimeline.cpp
    M Source/WebCore/animation/AnimationTimeline.h
    M Source/WebCore/animation/CSSAnimation.cpp
    M Source/WebCore/animation/CSSAnimation.h
    M Source/WebCore/animation/KeyframeEffect.cpp
    M Source/WebCore/animation/KeyframeEffect.h
    M Source/WebCore/style/StyleTreeResolver.cpp

  Log Message:
  -----------
  Merge r256627 - [Web Animations] Style changes due to Web Animations should not trigger CSS Transitions
https://bugs.webkit.org/show_bug.cgi?id=207760
<rdar://problem/59458111>

Reviewed by Simon Fraser.

LayoutTests/imported/w3c:

Mark Web Platform Tests progressions.

* web-platform-tests/web-animations/interfaces/Animatable/animate-expected.txt:
* web-platform-tests/web-animations/interfaces/Animation/style-change-events-expected.txt:
* web-platform-tests/web-animations/interfaces/DocumentTimeline/style-change-events-expected.txt:
* web-platform-tests/web-animations/interfaces/KeyframeEffect/style-change-events-expected.txt:

Source/WebCore:

While we would consider the unanimated style of CSS Animations specifically when considering what the "start" style values (before-change style in spec terminology)
should be when considering whether to start a CSS Transition during style resolution, we would not consider other types of animations, specifically JS-created Web
Animations. However, Web Platform Tests specifically test whether changes made using the Web Animations API may trigger transitions, and until now they would because
the RenderStyle used to determine the before-change style was the style from the previous resolution, which would include animated values.

To fix this, we make it so that KeyframeEffect objects now keep a copy of the unanimated style used when blending animated values for the very first time. That style
is cleared each time keyframes change, which is rare, but may happen through the Web Animations API. Then in AnimationTimeline::updateCSSTransitionsForElementAndProperty(),
we look for a KeyframeEffect currently affecting the property for which we're considering starting a CSS Transition, and use its unanimated style.

If that unanimated style has not been set yet, this is because the KeyframeEffect has not had a chance to apply itself with a non-null progress. In this case, the before-change
and after-change styles should be the same in order to prevent a transition from being triggered as the unanimated style for this keyframe effect will most likely be this
after-change style, or any future style change that may happen before the keyframe effect starts blending animated values.

Finally, tracking the unanimated style at the KeyframeEffect level means we no longer to track it specifically for CSSAnimation.

* animation/AnimationTimeline.cpp:
(WebCore::keyframeEffectForElementAndProperty):
(WebCore::AnimationTimeline::updateCSSTransitionsForElementAndProperty):
* animation/AnimationTimeline.h:
* animation/CSSAnimation.cpp:
(WebCore::CSSAnimation::create):
(WebCore::CSSAnimation::CSSAnimation):
* animation/CSSAnimation.h:
* animation/KeyframeEffect.cpp:
(WebCore::KeyframeEffect::animatesProperty const): Because the backing KeyframeList object may not have been created by the first time we query a KeyframeEffect during
CSS Transitions resolution, we provide a method that will check the values provided by the Web Animations API to determine whether it targets a given CSS property.
(WebCore::KeyframeEffect::clearBlendingKeyframes):
(WebCore::KeyframeEffect::computeDeclarativeAnimationBlendingKeyframes):
(WebCore::KeyframeEffect::computeCSSAnimationBlendingKeyframes):
(WebCore::KeyframeEffect::apply):
* animation/KeyframeEffect.h:
(WebCore::KeyframeEffect::unanimatedStyle const):
* style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::createAnimatedElementUpdate):

LayoutTests:

Mark that a couple of tests are no longer flaky.

* TestExpectations:


  Commit: f430866c025c239b6da96f804630a2ce92dabc06
      https://github.com/WebKit/WebKit/commit/f430866c025c239b6da96f804630a2ce92dabc06
  Author: Alex Christensen <achristensen at webkit.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/URLHelpers.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/cocoa/URLExtras.mm

  Log Message:
  -----------
  Merge r256629 - Allow UIDNAInfo.errors from uidna_nameToUnicode that would not cause URL parsing failures
https://bugs.webkit.org/show_bug.cgi?id=207360
<rdar://problem/57825317>

Patch by Alex Christensen <achristensen at webkit.org> on 2020-02-14
Reviewed by Ryosuke Niwa.

Source/WTF:

* wtf/URLHelpers.cpp:
(WTF::URLHelpers::mapHostName):

Tools:

* TestWebKitAPI/Tests/WTF/cocoa/URLExtras.mm:
(TestWebKitAPI::TEST):


  Commit: 4b6ebaf454bfe6d972ddbc24543fb14a2e98a62e
      https://github.com/WebKit/WebKit/commit/4b6ebaf454bfe6d972ddbc24543fb14a2e98a62e
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Frame.cpp

  Log Message:
  -----------
  Merge r256636 - [Web Animations] Missing call to DocumentTimeline::resumeAnimations() in Frame::resumeActiveDOMObjectsAndAnimations()
https://bugs.webkit.org/show_bug.cgi?id=207784
<rdar://problem/59251858>

Patch by Antoine Quint <graouts at webkit.org> on 2020-02-14
Reviewed by Dean Jackson.

After auditing the code, there was one call to CSSAnimationController::resumeAnimationsForDocument() that missed a matching DocumentTimeline::resumeAnimations()
call should the Web Animations flag be on.

* page/Frame.cpp:
(WebCore::Frame::resumeActiveDOMObjectsAndAnimations):


  Commit: 57a40f3057f83ffb76dd1514acd33e80a940dd0b
      https://github.com/WebKit/WebKit/commit/57a40f3057f83ffb76dd1514acd33e80a940dd0b
  Author: Nikolaos Mouchtaris <nmouchtaris at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/text/font-face-javascript-expected.txt
    M LayoutTests/fast/text/font-face-javascript.html
    M LayoutTests/fast/text/font-loading-global-keyword-expected.txt
    M LayoutTests/fast/text/font-loading-global-keyword.html
    M LayoutTests/fast/text/variations/font-loading-api-parse-ranges-expected.txt
    M LayoutTests/fast/text/variations/font-loading-api-parse-ranges.html
    A LayoutTests/http/tests/css/font-face-constructor-expected.txt
    A LayoutTests/http/tests/css/font-face-constructor.html
    M LayoutTests/imported/w3c/web-platform-tests/2dcontext/drawing-text-to-the-canvas/2d.text.measure.actualBoundingBox-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/2dcontext/drawing-text-to-the-canvas/2d.text.measure.advances-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/2dcontext/drawing-text-to-the-canvas/2d.text.measure.baselines-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/2dcontext/drawing-text-to-the-canvas/2d.text.measure.emHeights-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/2dcontext/drawing-text-to-the-canvas/2d.text.measure.fontBoundingBox-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/2dcontext/drawing-text-to-the-canvas/2d.text.measure.width.basic-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/2dcontext/drawing-text-to-the-canvas/2d.text.measure.width.empty-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/2dcontext/text-styles/2d.text.measure.width.space-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/WebIDL/current-realm-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-font-loading/fontfacesetloadevent-constructor-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/css/css-font-loading/idlharness.https-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSFontFace.cpp
    M Source/WebCore/css/CSSFontFace.h
    M Source/WebCore/css/CSSFontFaceSet.cpp
    M Source/WebCore/css/CSSSegmentedFontFace.cpp
    M Source/WebCore/css/FontFace.cpp
    M Source/WebCore/css/FontFace.h
    M Source/WebCore/css/FontFace.idl

  Log Message:
  -----------
  Merge r256659 - new FontFace() should not throw when failing to parse arguments
https://bugs.webkit.org/show_bug.cgi?id=205770

Patch by Nikos Mouchtaris <nmouchtaris at apple.com> on 2020-02-14
Reviewed by Myles Maxfield.

Source/WebCore:

Change FontFace constructor to conform to API specification:
https://drafts.csswg.org/css-font-loading/#dom-fontface-fontface.
No longer throws. For parsing failure, now rejects promise, sets
status to error, and sets FontFace members to default string.

Test: http/tests/css/font-face-constructor.html

* css/CSSFontFace.cpp:
(WebCore::CSSFontFace::setErrorState):
* css/CSSFontFace.h:
* css/CSSFontFaceSet.cpp:
(WebCore::CSSFontFaceSet::addToFacesLookupTable):
(WebCore::CSSFontFaceSet::remove):
(WebCore::CSSFontFaceSet::fontFace):
* css/CSSSegmentedFontFace.cpp:
(WebCore::CSSSegmentedFontFace::fontRanges):
* css/FontFace.cpp:
(WebCore::FontFace::setErrorState):
(WebCore::FontFace::create):
(WebCore::FontFace::family const):
(WebCore::FontFace::style const):
(WebCore::FontFace::weight const):
(WebCore::FontFace::stretch const):
(WebCore::FontFace::unicodeRange const):
(WebCore::FontFace::featureSettings const):
(WebCore::FontFace::display const):
(WebCore::FontFace::fontStateChanged):
* css/FontFace.h:
* css/FontFace.idl:

LayoutTests:

Tests that constructor doesn't throw, sets members to corresponding default strings.

* http/tests/css/font-face-constructor-expected.txt: Added.
* http/tests/css/font-face-constructor.html: Added.


  Commit: 80f7a2e0486cafd23accaf30872adb1a749edde9
      https://github.com/WebKit/WebKit/commit/80f7a2e0486cafd23accaf30872adb1a749edde9
  Author: Pavel Feldman <pfeldman at chromium.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/geoclue/GeoclueGeolocationProvider.cpp

  Log Message:
  -----------
  Merge r256703 - [Geoclue] Avoid usage of provider in callbacks after it has been destroyed
https://bugs.webkit.org/show_bug.cgi?id=207420

GeoclueGeolocationProvider was making non-cancelable g_dbus_proxy_call(s) with
bare |this| pointer.

Patch by Pavel Feldman <pavel.feldman at gmail.com> on 2020-02-15
Reviewed by Carlos Garcia Campos.

* UIProcess/geoclue/GeoclueGeolocationProvider.cpp:
(WebKit::GeoclueGeolocationProvider::start):
(WebKit::GeoclueGeolocationProvider::stop):
(WebKit::GeoclueGeolocationProvider::setupManager):
(WebKit::GeoclueGeolocationProvider::createClient):
(WebKit::GeoclueGeolocationProvider::startClient):
(WebKit::GeoclueGeolocationProvider::didFail):
* UIProcess/geoclue/GeoclueGeolocationProvider.h:


  Commit: 9a95f9a313053a9d635cc44003615955954a8eb6
      https://github.com/WebKit/WebKit/commit/9a95f9a313053a9d635cc44003615955954a8eb6
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/AnimationEventBase.cpp
    M Source/WebCore/animation/DeclarativeAnimation.cpp

  Log Message:
  -----------
  Merge r256705 - Unreviewed build fix for non-unified builds.

No new tests needed.

* animation/AnimationEventBase.cpp: Add missing include.
* animation/DeclarativeAnimation.cpp: Ditto.


  Commit: 715b5cd3ab7da80651911c1d24fcb8cd51400e90
      https://github.com/WebKit/WebKit/commit/715b5cd3ab7da80651911c1d24fcb8cd51400e90
  Author: Paulo Matos <pmatos at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/jit/GPRInfo.h

  Log Message:
  -----------
  Merge r256718 - Remove nonArgGPR1 for ARMv7 and ARM64 (unused)
https://bugs.webkit.org/show_bug.cgi?id=207753

Patch by Paulo Matos <pmatos at igalia.com> on 2020-02-16
Reviewed by Darin Adler.

Cleanup commit - nonArgGPR1 is unused for both ARMv7
and ARM64.

* jit/GPRInfo.h:


  Commit: e1faa1a855109399ea72fce5715f9465ae802600
      https://github.com/WebKit/WebKit/commit/e1faa1a855109399ea72fce5715f9465ae802600
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/Network/WebSocketChannel.cpp

  Log Message:
  -----------
  Merge r256719 - Log WebSocket failure in case of network crash
https://bugs.webkit.org/show_bug.cgi?id=207801

Reviewed by Darin Adler.

Covered by http/tests/websocket/tests/hybi/network-process-crash-error.html.

* WebProcess/Network/WebSocketChannel.cpp:
(WebKit::WebSocketChannel::didReceiveMessageError):
(WebKit::WebSocketChannel::networkProcessCrashed):
Add a console log message in case of error coming from network process.


  Commit: d002580b1f43946ecaffb68c0066e9b41d441631
      https://github.com/WebKit/WebKit/commit/d002580b1f43946ecaffb68c0066e9b41d441631
  Author: Yuchen Guo <egyc at live.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/zh_CN.po

  Log Message:
  -----------
  Merge r256723 - Updated Simplified Chinese translation
https://bugs.webkit.org/show_bug.cgi?id=207685

Patch by Yuchen Guo <egyc at live.com> on 2020-02-17
Rubber-stamped by Carlos Garcia Campos.

* zh_CN.po:


  Commit: 9ba02accb69ba4b2a7752a3b6b957a2963133a0e
      https://github.com/WebKit/WebKit/commit/9ba02accb69ba4b2a7752a3b6b957a2963133a0e
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/PlatformWPE.cmake
    M Tools/ChangeLog
    M Tools/Scripts/run-qt-wpe-minibrowser
    M Tools/glib/api_test_runner.py

  Log Message:
  -----------
  Merge r256727 - [WPE] Change the QML plugin install path
https://bugs.webkit.org/show_bug.cgi?id=207761

Reviewed by Philippe Normand.

Source/WebKit:

This way there's no need to set QML2_IMPORT_PATH manually.

* PlatformWPE.cmake:

Tools:

* Scripts/run-qt-wpe-minibrowser:
* glib/api_test_runner.py:
(TestRunner._run_test_qt):


  Commit: 16df9bc9c77833f2e67fe9794aeb9b9c62cd6c3e
      https://github.com/WebKit/WebKit/commit/16df9bc9c77833f2e67fe9794aeb9b9c62cd6c3e
  Author: Sihui Liu <sihui_liu at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp

  Log Message:
  -----------
  Merge r256738 - IndexedDB: index cursor iteration is slow when there are a lot of index records from different object stores
https://bugs.webkit.org/show_bug.cgi?id=207377
<rdar://problem/59288679>

Reviewed by Brady Eidson.

Make the Index of IndexRecords table include indexID since we always perform search with indexID.
This would let SQLite optimize the index statement in SQLiteCursor with Covering Index and fix the slowness.

* Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
(WebCore::IDBServer::SQLiteIDBBackingStore::ensureValidIndexRecordsIndex):
(WebCore::IDBServer::v1IndexRecordsIndexSchema): Deleted.


  Commit: 4ed583f0202bb938cfc58ad974488c8e138d3726
      https://github.com/WebKit/WebKit/commit/4ed583f0202bb938cfc58ad974488c8e138d3726
  Author: Pinki Gyanchandani <pgyanchandani at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/editing/selection/ignore-selection-range-on-input-style-change-expected.txt
    A LayoutTests/editing/selection/ignore-selection-range-on-input-style-change.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLTextFormControlElement.cpp

  Log Message:
  -----------
  Merge r256764 - Null Ptr Deref @ WebCore::Node::Treescope
https://bugs.webkit.org/show_bug.cgi?id=207748

Patch by Pinki Gyanchandani <pgyanchandani at apple.com> on 2020-02-17
Reviewed by Darin Adler.

Source/WebCore:

Added a check for isTextField after updateLayoutIgnorePendingStylesheets as that could cause modification of input element type.

Test: editing/selection/ignore-selection-range-on-input-style-change.html

* html/HTMLTextFormControlElement.cpp:
(WebCore::HTMLTextFormControlElement::setSelectionRange):

LayoutTests:

Added a regression test provided by Ryosuke Niwa to verify the fix.

* editing/selection/ignore-selection-range-on-input-style-change-expected.txt: Added.
* editing/selection/ignore-selection-range-on-input-style-change.html: Added.


  Commit: 22081f80e718f02f0e8c4d058d0244e50d687772
      https://github.com/WebKit/WebKit/commit/22081f80e718f02f0e8c4d058d0244e50d687772
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/navigation/process-swap-on-client-side-redirect-private-expected.txt
    A LayoutTests/http/tests/navigation/process-swap-on-client-side-redirect-private.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/HistoryController.cpp

  Log Message:
  -----------
  Merge r256831 - ASSERT_NOT_REACHED() under WebPageProxy::suspendCurrentPageIfPossible()
https://bugs.webkit.org/show_bug.cgi?id=207868
<rdar://problem/59464606>

Reviewed by John Wilander.

Source/WebCore:

Test: http/tests/navigation/process-swap-on-client-side-redirect-private.html

* loader/HistoryController.cpp:
(WebCore::HistoryController::updateForSameDocumentNavigation):
Methods in HistoryController avoids updating visited links and calling updateGlobalHistory()
on the FrameLoaderClient when in an ephemeral session. However, updateForSameDocumentNavigation()
was returning early in ephemeral sessions, which was overly aggressive and bypasses things we
really need to do, like updating the current HistoryItem's url.

LayoutTests:

Add layout test that was hitting the assertion before my change.

* http/tests/navigation/process-swap-on-client-side-redirect-private-expected.txt: Added.
* http/tests/navigation/process-swap-on-client-side-redirect-private.html: Added.


  Commit: 553fe8dc10c85c616a0bd17efa45d4742a3b7255
      https://github.com/WebKit/WebKit/commit/553fe8dc10c85c616a0bd17efa45d4742a3b7255
  Author: Paulo Matos <pmatos at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/llint/LowLevelInterpreter.asm

  Log Message:
  -----------
  Merge r256850 - Fix order (in MIPS) under which CS-registers are saved/restored
https://bugs.webkit.org/show_bug.cgi?id=207752

Patch by Paulo Matos <pmatos at igalia.com> on 2020-02-18
Reviewed by Keith Miller.

This has been causing several segfaults on MIPS with JIT enabled
because during an OSR to baseline, the order in which LLInt was
saving the registers was not in sync with the way baseline was
restoring them.

* llint/LowLevelInterpreter.asm:


  Commit: a69f9471455c53778f2b76502b722a543e200979
      https://github.com/WebKit/WebKit/commit/a69f9471455c53778f2b76502b722a543e200979
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/libwpe/WebEventFactory.cpp
    M Source/WebKit/UIProcess/API/wpe/ScrollGestureController.cpp
    M Source/WebKit/UIProcess/API/wpe/ScrollGestureController.h
    M Tools/ChangeLog
    M Tools/wpe/jhbuild.modules

  Log Message:
  -----------
  Merge r256913 - [WPE] Support 2D axis, smooth-motion events
https://bugs.webkit.org/show_bug.cgi?id=207881

Reviewed by Carlos Garcia Campos.

Source/WebKit:

WPE's WebEventFactory should also handle axis events that are capable
of providing information about axis change in both dimensions. In case
of smooth motion, the delta values should be preserved and not
transformed into line-steps.

Similarly, the ScrollGestureController should also adopt the 2D axis
event type, producing smooth-motion events when dispatching handling
a scroll gesture.

The changes are guarded and only enabled when building against at least
libwpe 1.5.0 since that's when the new API was added.

* Shared/libwpe/WebEventFactory.cpp:
(WebKit::WebEventFactory::createWebWheelEvent):
* UIProcess/API/wpe/ScrollGestureController.cpp:
(WebKit::ScrollGestureController::handleEvent):
* UIProcess/API/wpe/ScrollGestureController.h:
(WebKit::ScrollGestureController::axisEvent):

Tools:

* wpe/jhbuild.modules: Bump to a newer libwpe commit.


  Commit: f1bc0bbbeb9f9d83de41836bc9dea1e9495bc8a7
      https://github.com/WebKit/WebKit/commit/f1bc0bbbeb9f9d83de41836bc9dea1e9495bc8a7
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M ChangeLog
    M Source/cmake/WebKitCCache.cmake

  Log Message:
  -----------
  Merge r256917 - [GTK][WPE] Set ccache as compiler launcher, add opt-in sccache support
https://bugs.webkit.org/show_bug.cgi?id=207838

Reviewed by Carlos Alberto Lopez Perez.

This change allows for more granular control over the compiler
launcher configuration. The build host should no longer need to
set ccache symbolic links. Additionally optional support for
sccache is added, enabled when the WEBKIT_USE_SCCACHE environment
variable is set to YES.

* Source/cmake/WebKitCCache.cmake:


  Commit: 16d1c4ce8680cf462c39cdc8d9ec906ef7a51945
      https://github.com/WebKit/WebKit/commit/16d1c4ce8680cf462c39cdc8d9ec906ef7a51945
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Settings.yaml
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/Cocoa/WKWebViewConfiguration.mm
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp

  Log Message:
  -----------
  Merge r256925 - Re-disable top-level data URL navigations
https://bugs.webkit.org/show_bug.cgi?id=207917
<rdar://problem/59568037>

Reviewed by Darin Adler.

Source/WebCore:

Calls to WKPage and WKWebView API used to load data and strings directly should be recognized by
the loading code as being from client API calls. This brings these API behaviors into alignment
with similar API for loading URLs and URLRequests directly. This change also allows us to enforce
stricter handling of Data URLs, and to remove the need to explicitly permit top-level data URL
navigation when client APIs are used.

Tested by TestWebKitAPI Navigation tests.

* page/Settings.yaml:

Source/WebKit:

In Bug 207719 we allowed top-level navigations to data URLs by default. This
patch updates client loading API calls so that we can go back to a default
block of these loads without breaking WebKit clients.

* UIProcess/API/Cocoa/WKWebViewConfiguration.mm:
(-[WKWebViewConfiguration init]):
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::loadDataImpl): Recognize direct data loads started from client API.
* WebProcess/WebPage/WebPage.h:


  Commit: f758e4a64b26c4ad3a071ff0774f55b367ca1690
      https://github.com/WebKit/WebKit/commit/f758e4a64b26c4ad3a071ff0774f55b367ca1690
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessCache.cpp

  Log Message:
  -----------
  Merge r256932 - Disable the process cache when process-per-tab is disabled in the debug menu
https://bugs.webkit.org/show_bug.cgi?id=207949
<rdar://problem/57094837>

Reviewed by Geoffrey Garen.

Disable the process cache when process-per-tab is disabled in the debug menu. The process cache is a
process-swap-on-navigation optimization and process-swap-on-navigation is already disabled when
process-per-tab is disabled. The process cache is not useful with such configuration and actually
leads to crashes too.

* UIProcess/WebProcessCache.cpp:
(WebKit::WebProcessCache::updateCapacity):


  Commit: e08ce0444c4b7f923a8bac06eae677904c03f0e4
      https://github.com/WebKit/WebKit/commit/e08ce0444c4b7f923a8bac06eae677904c03f0e4
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/NetworkProcess.cpp
    M Source/WebKit/NetworkProcess/NetworkProcess.h
    M Source/WebKit/NetworkProcess/NetworkProcess.messages.in
    M Source/WebKit/NetworkProcess/cache/CacheStorageEngineCaches.cpp
    M Source/WebKit/NetworkProcess/cache/NetworkCache.cpp
    M Source/WebKit/NetworkProcess/cache/NetworkCache.h
    M Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.cpp
    M Source/WebKit/NetworkProcess/cache/NetworkCacheStorage.h
    M Source/WebKit/UIProcess/WebProcessPool.cpp

  Log Message:
  -----------
  Merge r256967 - Regression(r247567) HTTP Disk cache capacity is no longer set
https://bugs.webkit.org/show_bug.cgi?id=207959
<rdar://problem/59603972>

Reviewed by Alex Christensen.

NetworkProcess::initializeNetworkProcess() was setting the cache model, which
would iterate over all network sessions to update their network cache capacity.
The issue was that network sessions were not constructed yet at this point.
When the network session(s) would get created later on, they would construct
their NetworkCache and it would use the default capacity (i.e.
std::numeric_limits<size_t>::max()).

To make this safer, I have moved the capacity computation to the Cache::open()
method and now pass the capacity when constructing the network cache storage.

* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::initializeNetworkProcess):
(WebKit::NetworkProcess::setCacheModelSynchronouslyForTesting):
(WebKit::NetworkProcess::setCacheModel):
* NetworkProcess/NetworkProcess.h:
(WebKit::NetworkProcess::cacheModel const):
* NetworkProcess/NetworkProcess.messages.in:
* NetworkProcess/cache/CacheStorageEngineCaches.cpp:
(WebKit::CacheStorage::Caches::initialize):
* NetworkProcess/cache/NetworkCache.cpp:
(WebKit::NetworkCache::computeCapacity):
(WebKit::NetworkCache::Cache::open):
(WebKit::NetworkCache::Cache::capacity const):
(WebKit::NetworkCache::Cache::updateCapacity):
(WebKit::NetworkCache::Cache::setCapacity): Deleted.
* NetworkProcess/cache/NetworkCache.h:
* NetworkProcess/cache/NetworkCacheStorage.cpp:
(WebKit::NetworkCache::Storage::open):
(WebKit::NetworkCache::Storage::Storage):
(WebKit::NetworkCache::Storage::setCapacity):
* NetworkProcess/cache/NetworkCacheStorage.h:
* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::setCacheModel):


  Commit: d89f77b9aea28b3b23c1a53510cfb1b06e7af667
      https://github.com/WebKit/WebKit/commit/d89f77b9aea28b3b23c1a53510cfb1b06e7af667
  Author: Ryosuke Niwa <rniwa at webkit.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp

  Log Message:
  -----------
  Merge r257013 - Crash in WebPageProxy::didStartProvisionalLoadForFrameShared
https://bugs.webkit.org/show_bug.cgi?id=207973

Reviewed by Chris Dumez.

Use RefPtr to store Frame*.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didStartProvisionalLoadForFrameShared):


  Commit: 5e58e630d638d34e7ac3baf3d3ff1dddb173dfd0
      https://github.com/WebKit/WebKit/commit/5e58e630d638d34e7ac3baf3d3ff1dddb173dfd0
  Author: Sunny He <sunny_he at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/dom/Node/normalize-mutation-event-expected.txt
    A LayoutTests/fast/dom/Node/normalize-mutation-event.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Node.cpp

  Log Message:
  -----------
  Merge r257036 - Fix crash when Node::normalize() triggers mutation event that modifies child order
https://bugs.webkit.org/show_bug.cgi?id=207875
<rdar://58976682>

Patch by Sunny He <sunny_he at apple.com> on 2020-02-19
Reviewed by Ryosuke Niwa.

When Node::normalize() merges two text nodes, it calls appendData
before textNodesMerged. If there is a mutator event registered, it
will fire on the call to appendData, potentially changing the child
order and causing a nullptr crash due to incorrect sibling pointers.
Reverse the order of these calls to ensure order gets correctly
updated.

Source/WebCore:

Test: fast/dom/Node/normalize-mutation-event.html

* dom/Node.cpp:
(WebCore::Node::normalize):

LayoutTests:

* fast/dom/Node/normalize-mutation-event-expected.txt: Added.
* fast/dom/Node/normalize-mutation-event.html: Added.


  Commit: e5e9c259068ca709746fbc7d38a70d48597957c5
      https://github.com/WebKit/WebKit/commit/e5e9c259068ca709746fbc7d38a70d48597957c5
  Author: BJ Burg <bburg at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Automation/WebAutomationSession.cpp

  Log Message:
  -----------
  Merge r257042 - Web Automation: Automation.setWindowFrameOfBrowsingContext should accept negative x and y-origin values
https://bugs.webkit.org/show_bug.cgi?id=207974
<rdar://problem/59606705>

Reviewed by Darin Adler.

According to the spec, negative origin values are supported:

    https://w3c.github.io/webdriver/#set-window-rect

* UIProcess/Automation/WebAutomationSession.cpp:
(WebKit::WebAutomationSession::setWindowFrameOfBrowsingContext):


  Commit: 65b6e420622ec43862eb00a24934b3658524a65d
      https://github.com/WebKit/WebKit/commit/65b6e420622ec43862eb00a24934b3658524a65d
  Author: Jack Lee <shihchieh_lee at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/layers/geometry-map-saturated-offset-assert-expected.txt
    A LayoutTests/fast/layers/geometry-map-saturated-offset-assert.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/LayoutSize.h
    M Source/WebCore/rendering/RenderGeometryMap.cpp
    M Source/WebCore/rendering/RenderGeometryMap.h

  Log Message:
  -----------
  Merge r257046 - ASSERTION FAILED: roundedIntPoint(LayoutPoint(rendererMappedResult)) == result in WebCore::RenderGeometryMap::mapToContainer
https://bugs.webkit.org/show_bug.cgi?id=151030
<rdar://problem/27711142>

Patch by Jack Lee <shihchieh_lee at apple.com> on 2020-02-19
Reviewed by Darin Adler.

Track if m_accumulatedOffset ever becomes saturated, and if so, do not assert on unexpected rendererMappedResult.

Source/WebCore:

Test: fast/layers/geometry-map-saturated-offset-assert.html

* platform/graphics/LayoutSize.h:
(WebCore::LayoutSize::mightBeSaturated const):
* rendering/RenderGeometryMap.cpp:
(WebCore::RenderGeometryMap::mapToContainer const):
(WebCore::RenderGeometryMap::stepInserted):
(WebCore::RenderGeometryMap::stepRemoved):
* rendering/RenderGeometryMap.h:

LayoutTests:

* fast/layers/geometry-map-saturated-offset-assert-expected.txt: Added.
* fast/layers/geometry-map-saturated-offset-assert.html: Added.


  Commit: 07d1ecf299ec15e9703a4437f76423bcd3effb6a
      https://github.com/WebKit/WebKit/commit/07d1ecf299ec15e9703a4437f76423bcd3effb6a
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M ChangeLog
    M Source/cmake/WebKitCCache.cmake

  Log Message:
  -----------
  Merge r257067 - [GTK][WPE] Not set ccache compiler prefix if ccache its already the compiler binary in path.
https://bugs.webkit.org/show_bug.cgi?id=208007

Reviewed by Tim Horton.

Detect if the compiler binary already points to the ccache binary and in that case don't
set the ccache compiler prefix. Also export CCACHE_SLOPPINESS=time_macros if its not
defined to other thing on the environment and add a some logging of related messages.

* Source/cmake/WebKitCCache.cmake:


  Commit: 1d5c6a97f86139605e74c50a473bb5d60caf0496
      https://github.com/WebKit/WebKit/commit/1d5c6a97f86139605e74c50a473bb5d60caf0496
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebPageProxy.cpp
    M Tools/ChangeLog

  Log Message:
  -----------
  Merge r257077 - REGRESSION (r255677): Reloading tab with beforeunload prompt closes tab when asking to stay on page
https://bugs.webkit.org/show_bug.cgi?id=208015
<rdar://problem/59591630>

Reviewed by Geoffrey Garen.

Source/WebKit:

Make sure we only restart the tryClose timer after the beforeunload prompt if the timer was actually
active before the prompt (i.e. tryClose was actually called). On Reload, tryClose is not called
but beforeunload prompt may still happen.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::runBeforeUnloadConfirmPanel):

Tools:

Add API test coverage.

* TestWebKitAPI/Tests/WebKitCocoa/ModalAlerts.mm:
(TEST):


  Commit: 9027d75a5f5e48e34a887d1269a4739c7564ad72
      https://github.com/WebKit/WebKit/commit/9027d75a5f5e48e34a887d1269a4739c7564ad72
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/TextCombinerGStreamer.cpp

  Log Message:
  -----------
  Merge r257090 - [GStreamer] Fix race in TextCombinerGStreamer
https://bugs.webkit.org/show_bug.cgi?id=208001

Reviewed by Xabier Rodriguez-Calvar.

TextCombinerGStreamer uses the CAPS event to determine whether adding
a webvttenc between the text track pad and the funnel element used to
be able to display several subtitles at the same time.

The way this was done previously had a race though: all text track
pads were preemptively linked directly to the funnel, only adding the
webvttenc element later in the middle when receiving the CAPS event.

When two or more text tracks were present, it wasn't infrequent that
one track had its CAPS event processed (causing the webvttenc element
to be added) and propagated (fixating the funnel caps) before another
track attempted caps negotiation. Because the pads were connected to
the funnel preemptively, and because without the webvttenc element the
caps of the text pad don't match the funnel's, this causes a caps
mismatch error, stopping playback completely. The CAPS event is
therefore never sent.

To avoid this race, we must avoid linking elements until we get the
CAPS events, when we actually know where we should link them to,
therefore avoiding early caps negotiation errors.

* platform/graphics/gstreamer/TextCombinerGStreamer.cpp:
(webkitTextCombinerPadDispose):
(webkitTextCombinerPadEvent):
(webkitTextCombinerRequestNewPad):
(webkitTextCombinerReleasePad):
(webkit_text_combiner_class_init):
(webkitTextCombinerPadFinalize): Deleted.


  Commit: ae2f46d2a3bd84e7f0fe7e7e31cdf2e129d082b3
      https://github.com/WebKit/WebKit/commit/ae2f46d2a3bd84e7f0fe7e7e31cdf2e129d082b3
  Author: Sihui Liu <sihui_liu at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/IndexedDB/WebIDBServer.cpp

  Log Message:
  -----------
  Merge r257103 - WebIDBServer resume should return early if suspend does not happen
https://bugs.webkit.org/show_bug.cgi?id=208027
<rdar://problem/59617654>

Reviewed by Geoffrey Garen.

We should not try releasing a lock that is not held.

* NetworkProcess/IndexedDB/WebIDBServer.cpp:
(WebKit::WebIDBServer::resume):


  Commit: 3817acc97f51800c1b89ad03078ece52fae0a4ce
      https://github.com/WebKit/WebKit/commit/3817acc97f51800c1b89ad03078ece52fae0a4ce
  Author: Sunny He <sunny_he at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Page.cpp

  Log Message:
  -----------
  Merge r257123 - Fix crash in Page::updateRendering when document has no domWindow
https://bugs.webkit.org/show_bug.cgi?id=207975
<rdar://56999099>

Patch by Sunny He <sunny_he at apple.com> on 2020-02-20
Reviewed by Ryosuke Niwa.

When a subframe is navigated, a new document is created and
the window is transfered asynchronously. It is possible to have
a call to updateRendering in the middle of this process, resulting
in an attempt to update a document with no window. Add a check for
this case and skip such documents.

No test, since this crash relies on sensitive timing that cannot be
consistently replicated in a test case.

* page/Page.cpp:
(WebCore::Page::updateRendering):


  Commit: ed3508045b350d3cf6ca751347507973d610d3d8
      https://github.com/WebKit/WebKit/commit/ed3508045b350d3cf6ca751347507973d610d3d8
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp
    M Source/WebCore/platform/UserAgentQuirks.h
    M Source/WebCore/platform/glib/UserAgentGLib.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merge r257128 - [GTK] Improve user agent quirk for Google Docs and Google Drive
https://bugs.webkit.org/show_bug.cgi?id=206506

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-02-20
Reviewed by Carlos Garcia Campos.

Source/WebCore:

Stop using our macOS platform quirk for Google Docs and Google Drive. It is not successfully
suppressing the unsupported browser warnings that it was added to avoid. It is also
responsible for complaints from users who do not like seeing macOS-style shortcuts with
the Command key rather than Ctrl.

Replace it with a new Firefox browser quirk. We can avoid the unsupported browser warning in
Google Docs by using this quirk on accounts.youtube.com. There's no need for any other quirk
specific to Google Docs (although removing the macOS platform quirk means we'll instead
begin using the x86_64 Linux quirk that we send to other Google domains). Google Drive will
also use this new quirk.

Also, remove a stale comment instructing developers to test downloading the Hangouts browser
plugin. We no longer support NPAPI, so Google Hangouts is a lost cause until we get WebRTC
working.

* platform/UserAgentQuirks.cpp:
(WebCore::urlRequiresFirefoxBrowser):
(WebCore::urlRequiresMacintoshPlatform):
(WebCore::urlRequiresLinuxDesktopPlatform):
(WebCore::UserAgentQuirks::quirksForURL):
(WebCore::UserAgentQuirks::stringForQuirk):
* platform/UserAgentQuirks.h:
* platform/glib/UserAgentGLib.cpp:
(WebCore::buildUserAgentString):

Tools:

* TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:
(TestWebKitAPI::assertUserAgentForURLHasFirefoxBrowserQuirk):
(TestWebKitAPI::TEST):


  Commit: 3791128cae7bb644b1fc6c183962fe75901392c2
      https://github.com/WebKit/WebKit/commit/3791128cae7bb644b1fc6c183962fe75901392c2
  Author: Jack Lee <shihchieh_lee at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/TestExpectations
    A LayoutTests/fast/multicol/fragflow-gains-new-in-flow-descendant-crash-expected.txt
    A LayoutTests/fast/multicol/fragflow-gains-new-in-flow-descendant-crash.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilder.cpp

  Log Message:
  -----------
  Merge r257129 - Nullptr crash in RenderStyle::isFlippedBlocksWritingMode when fragment flow gains a new in-flow descendant
https://bugs.webkit.org/show_bug.cgi?id=207296
<rdar://problem/49687828>

Patch by Jack Lee <shihchieh_lee at apple.com> on 2020-02-21
Reviewed by Antti Koivisto.

When a multi-column fragment flow gains a new in-flow descendant, we need to call
multiColumnDescendantInserted so RenderMultiColumnSet would be created for the new
descendant.

Source/WebCore:

Test: fast/multicol/fragflow-gains-new-in-flow-descendant-crash.html

* rendering/updating/RenderTreeBuilder.cpp:
(WebCore::RenderTreeBuilder::childFlowStateChangesAndAffectsParentBlock):

LayoutTests:

* TestExpectations:
* fast/multicol/fragflow-gains-new-in-flow-descendant-crash-expected.txt: Added.
* fast/multicol/fragflow-gains-new-in-flow-descendant-crash.html: Added.


  Commit: d5eb65ddfb143849fa4628dc403eb53acdb29399
      https://github.com/WebKit/WebKit/commit/d5eb65ddfb143849fa4628dc403eb53acdb29399
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/forms/input-value-sanitization-expected.txt
    M LayoutTests/fast/forms/input-value-sanitization.html
    M LayoutTests/fast/forms/paste-multiline-text-input.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/valueMode-expected.txt
    M LayoutTests/platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/valueMode-expected.txt
    M LayoutTests/platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/valueMode-expected.txt
    M LayoutTests/platform/mac/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/valueMode-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/TextFieldInputType.cpp

  Log Message:
  -----------
  Merge r257132 - Value sanitization for input[type=text] should not truncate a value at a control character
https://bugs.webkit.org/show_bug.cgi?id=207900

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline the tests. Below its a summary of the number of FAIL and PASS lines changed for each test:

* web-platform-tests/encoding/legacy-mb-japanese/iso-2022-jp/iso2022jp-encode-form-csiso2022jp-expected.txt:
  FAIL from 7312 to 374
  PASS from 17 to 6955
* web-platform-tests/encoding/legacy-mb-japanese/iso-2022-jp/iso2022jp-encode-form-errors-han-expected.txt:
  FAIL from 21216 to 477
  PASS from 53 to 20792
* web-platform-tests/encoding/legacy-mb-japanese/iso-2022-jp/iso2022jp-encode-form-errors-hangul-expected.txt:
  FAIL from 11155 to 0
  PASS from 28 to 11183
* web-platform-tests/encoding/legacy-mb-japanese/iso-2022-jp/iso2022jp-encode-form-errors-misc-expected.txt:
  FAIL from 3422 to 46
  PASS from 9 to 3385
* web-platform-tests/encoding/legacy-mb-japanese/iso-2022-jp/iso2022jp-encode-form-expected.txt:
  FAIL from 7375 to 374
  PASS from 17 to 7018
* web-platform-tests/html/semantics/forms/the-input-element/valueMode-expected.txt:
  FAIL from 20 to 10
  PASS from 22 to 32

Source/WebCore:

Stop truncating value at a control character. The new behavior is compatible with Chrome and Firefox.
Inspired on Chromium patch https://codereview.chromium.org/189843008

Covered by existing tests: affected layout tests are modified to reflect the new behaviour.
This improves WPT pass-rate in around 49K new subtest passes for Japanesse encoding tests.

* html/TextFieldInputType.cpp:
(WebCore::limitLength):

LayoutTests:

Update layout tests to reflect the new behaviour.

* fast/forms/input-value-sanitization-expected.txt:
* fast/forms/input-value-sanitization.html:
* fast/forms/paste-multiline-text-input.html:
* platform/ios-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/valueMode-expected.txt:
* platform/mac-wk2/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/valueMode-expected.txt:
* platform/mac/imported/w3c/web-platform-tests/html/semantics/forms/the-input-element/valueMode-expected.txt:


  Commit: c536a99e76964051309a5edd979466f667e78e9b
      https://github.com/WebKit/WebKit/commit/c536a99e76964051309a5edd979466f667e78e9b
  Author: Lauro Moura <lmoura at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/TextCombinerGStreamer.cpp

  Log Message:
  -----------
  Merge r257133 - [GStreamer] TextCombinerGStreamer is failing to compile with Gst1.14
https://bugs.webkit.org/show_bug.cgi?id=208041

Reviewed by Xabier Rodriguez-Calvar.

Replace usage of gst_clear_object and gst_clear_tag_list with previous
*_unref functions. The clear versions were added in 1.16 while Ubuntu
18.04 (current LTS) and Debian stable uses 1.14.

* platform/graphics/gstreamer/TextCombinerGStreamer.cpp:
(webkitTextCombinerPadDispose):


  Commit: 1a3bd39c36ed3c6b3398da42bf4cbd511e47a4ec
      https://github.com/WebKit/WebKit/commit/1a3bd39c36ed3c6b3398da42bf4cbd511e47a4ec
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/animations/many-pseudo-animations-expected.txt
    A LayoutTests/animations/many-pseudo-animations.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/AnimationTimeline.cpp
    M Source/WebCore/animation/AnimationTimeline.h
    M Source/WebCore/animation/DeclarativeAnimation.cpp
    M Source/WebCore/animation/DeclarativeAnimation.h
    M Source/WebCore/dom/Element.cpp
    M Source/WebCore/dom/PseudoElement.cpp
    M Source/WebCore/rendering/updating/RenderTreeUpdater.cpp

  Log Message:
  -----------
  Merge r257138 - [Web Animations] Repeated animations on pseudo elements will fail to run after a while
https://bugs.webkit.org/show_bug.cgi?id=207993
Source/WebCore:

<rdar://problem/59428472>

Reviewed by Zalan Bujtas.

We failed to clear PseudoElement* from AnimationTimeline's various HashMaps on destruction,
causing animations to fail to run when those pointer addresses were reused.

Make DeclarativeAnimation::owningElement() be a WeakPtr<>.

Test: animations/many-pseudo-animations.html

* animation/AnimationTimeline.cpp:
(WebCore::AnimationTimeline::willDestoryRendererForElement):
(WebCore::AnimationTimeline::elementWasRemoved):
* animation/AnimationTimeline.h:
* animation/DeclarativeAnimation.cpp:
(WebCore::DeclarativeAnimation::DeclarativeAnimation):
(WebCore::DeclarativeAnimation::enqueueDOMEvent):
* animation/DeclarativeAnimation.h:
(WebCore::DeclarativeAnimation::owningElement const):
* dom/Element.cpp:
(WebCore::Element::removedFromAncestor):
* dom/PseudoElement.cpp:
(WebCore::PseudoElement::clearHostElement):
* rendering/updating/RenderTreeUpdater.cpp:
(WebCore::RenderTreeUpdater::tearDownRenderers):

LayoutTests:

Reviewed by Zalan Bujtas.

* animations/many-pseudo-animations-expected.txt: Added.
* animations/many-pseudo-animations.html: Added.


  Commit: 1616165278222d0209758ae2f256b3961651004e
      https://github.com/WebKit/WebKit/commit/1616165278222d0209758ae2f256b3961651004e
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merge r257139 - [WPE][GTK] googleapis.com is a public suffix, defeating isGoogle() check in UserAgentQuirks.cpp
https://bugs.webkit.org/show_bug.cgi?id=207984

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-02-21
Reviewed by Daniel Bates.

Source/WebCore:

Fix the check for googleapis.com. Since it's now a public suffix, we can no longer check the
URL's base domain here. Instead, we can check endsWith().

I considered switching to endsWith() for all the checks in this file, to make our user agent
quirks robust to future changes in the public suffix list, but checking the base domain is
nicer and it seems unnecessary. We can continue to adjust our quirks in the future as
necessary.

The public suffix list:
https://github.com/publicsuffix/list/blob/7922d7c20e246552be418e8f72e577899fd30d99/public_suffix_list.dat#L11922

* platform/UserAgentQuirks.cpp:
(WebCore::isGoogle):

Tools:

* TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:
(TestWebKitAPI::TEST):


  Commit: a3c3308a1814d6abbf63994bd19f6c7469fa422e
      https://github.com/WebKit/WebKit/commit/a3c3308a1814d6abbf63994bd19f6c7469fa422e
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r257202 - [GStreamer][WPE] Add GstGLMemoryEGL support for the video-plane-display
https://bugs.webkit.org/show_bug.cgi?id=208046

Reviewed by Žan Doberšek.

The glupload element might fill EGL memories in some cases, so for
the video sink we can then directly access the corresponding
EGLImage and export it to DMABuf, instead of using the more
general GLMemory code path.

With this patch we also ensure that both DMABuf FD and stride are valid.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::GstVideoFrameHolder::GstVideoFrameHolder):
(WebCore::GstVideoFrameHolder::handoffVideoDmaBuf):


  Commit: a75a0c69752f2615d914ac1701052ba63db264c5
      https://github.com/WebKit/WebKit/commit/a75a0c69752f2615d914ac1701052ba63db264c5
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayerBacking.cpp

  Log Message:
  -----------
  Merge r257207 - RenderLayerBacking::notifyAnimationStarted calls directly into the old animation controller
https://bugs.webkit.org/show_bug.cgi?id=207979

Reviewed by Simon Fraser.

Only call into CSSAnimationController if the "Web Animations for CSS Animations" flag is disabled.

* rendering/RenderLayerBacking.cpp:
(WebCore::RenderLayerBacking::notifyAnimationStarted):


  Commit: b5c5e459eb2953ed6acec95342df1d203d9e0094
      https://github.com/WebKit/WebKit/commit/b5c5e459eb2953ed6acec95342df1d203d9e0094
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessPool.cpp

  Log Message:
  -----------
  Merge r257222 - Protect WebProcessPool from null weak pointers in m_serviceWorkerProcesses map
https://bugs.webkit.org/show_bug.cgi?id=208143
rdar://problem/58285589

Reviewed by Alex Christensen.

* UIProcess/WebProcessPool.cpp:
(WebKit::WebProcessPool::createWebPage):
(WebKit::WebProcessPool::updateServiceWorkerUserAgent):
(WebKit::WebProcessPool::updateProcessAssertions):
When iterating through the map, make sure it does not have a null entry.


  Commit: 56ea2996880a6d9a696026334629529a8e018f63
      https://github.com/WebKit/WebKit/commit/56ea2996880a6d9a696026334629529a8e018f63
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/DocumentTimeline.cpp
    M Source/WebCore/animation/DocumentTimeline.h
    M Source/WebCore/animation/KeyframeEffect.cpp
    M Source/WebCore/animation/KeyframeEffect.h

  Log Message:
  -----------
  Merge r257235 - Document / DOMWindow objects get leaked on CNN.com due to CSSTransitions
https://bugs.webkit.org/show_bug.cgi?id=208145

Reviewed by Antoine Quint.

Break reference cycles using WeakPtr so that CSSTransitions can no longer cause whole document / DOM trees to
get leaked.

* animation/DocumentTimeline.cpp:
(WebCore::DocumentTimeline::DocumentTimeline):
* animation/DocumentTimeline.h:
* animation/KeyframeEffect.cpp:
(WebCore::KeyframeEffect::KeyframeEffect):
(WebCore::KeyframeEffect::setTarget):
* animation/KeyframeEffect.h:


  Commit: 971b39945c8ea28c78adfe77562b69047b1bfb8b
      https://github.com/WebKit/WebKit/commit/971b39945c8ea28c78adfe77562b69047b1bfb8b
  Author: ChangSeok Oh <changseok at webkit.org>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/accessibility/AXObjectCache.cpp

  Log Message:
  -----------
  Merge r257292 - PS-2019-006: [GTK] WebKit - AXObjectCache - m_deferredFocusedNodeChange - UaF
https://bugs.webkit.org/show_bug.cgi?id=204342

Reviewed by Carlos Garcia Campos.

m_deferredFocusedNodeChange keeps pairs of a old node and a new one
to update a focused node later. When a node is removed in the document,
it is also removed from the pair vector. The problem is only comparing
the new node in each pair with a removed node decides the removal.
In the case where the removed node lives in m_deferredFocusedNodeChange
as an old node, a crash happens while we get a renderer of the removed node
to handle focused elements. To fix this, we find all entries of which old node
is matched to the removed node, and set their first value null.

No new tests since no functionality changed.

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::remove):


  Commit: b0c6853598a80570bf94bb76aec1b017169363c2
      https://github.com/WebKit/WebKit/commit/b0c6853598a80570bf94bb76aec1b017169363c2
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/StackTrace.cpp

  Log Message:
  -----------
  Merge r257298 - [Linux] StackTrace symbols are not demangled
https://bugs.webkit.org/show_bug.cgi?id=207933

Reviewed by Yusuke Suzuki.

Demangle symbols provided by backtrace_symbols.

* wtf/StackTrace.cpp:
(WTF::StackTrace::dump const):


  Commit: 890fb50f9a35399cd782d3e255e1713146c01c9a
      https://github.com/WebKit/WebKit/commit/890fb50f9a35399cd782d3e255e1713146c01c9a
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/PlatformHave.h

  Log Message:
  -----------
  Merge r257304 - [WPE] Enable BACKTRACE_SYMBOLS
https://bugs.webkit.org/show_bug.cgi?id=208187

Reviewed by Žan Doberšek.

* wtf/PlatformHave.h: Enable backtrace_symbols, to be combined
with dladdr() the stacktrace dumps will be improved.


  Commit: 5cf9dc03d029863e41a10d21ff9a1d4ccb19a7ec
      https://github.com/WebKit/WebKit/commit/5cf9dc03d029863e41a10d21ff9a1d4ccb19a7ec
  Author: Sihui Liu <sihui_liu at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/indexeddb/server/SQLiteIDBBackingStore.cpp

  Log Message:
  -----------
  Merge r257361 - Assertion failed: currentSchema == createV1ObjectStoreInfoSchema(objectStoreInfoTableName) || currentSchema == createV1ObjectStoreInfoSchema(objectStoreInfoTableNameAlternate)
https://bugs.webkit.org/show_bug.cgi?id=208144

Reviewed by Ryosuke Niwa.

Change a release assertion to release error log to gather information about bug. This is also the pattern of
handling error during schema update in SQLiteIDBBackingStore.

* Modules/indexeddb/server/SQLiteIDBBackingStore.cpp:
(WebCore::IDBServer::SQLiteIDBBackingStore::ensureValidObjectStoreInfoTable):


  Commit: 6c518eec500c2b29fb549ab14bda5ee86f30cc9b
      https://github.com/WebKit/WebKit/commit/6c518eec500c2b29fb549ab14bda5ee86f30cc9b
  Author: Jack Lee <shihchieh_lee at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/lists/insert-list-user-modify-read-only-orphaned-li-expected.txt
    A LayoutTests/fast/lists/insert-list-user-modify-read-only-orphaned-li.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/InsertListCommand.cpp
    M Source/WebCore/editing/InsertListCommand.h

  Log Message:
  -----------
  Merge r257407 - Nullptr crash in CompositeEditCommand::splitTreeToNode
https://bugs.webkit.org/show_bug.cgi?id=208039
<rdar://problem/52011355>

Patch by Jack Lee <shihchieh_lee at apple.com> on 2020-02-25
Reviewed by Ryosuke Niwa.

When inserting a list (InsertListCommand) around orphaned list items, if unordered list is not editable, skip moving list items in function fixOrphanedListChild.

Source/WebCore:

Test: fast/lists/insert-list-user-modify-read-only-orphaned-li.html

* editing/InsertListCommand.cpp:
(WebCore::InsertListCommand::fixOrphanedListChild):
(WebCore::InsertListCommand::doApplyForSingleParagraph):
* editing/InsertListCommand.h:

LayoutTests:

* fast/lists/insert-list-user-modify-read-only-orphaned-li-expected.txt: Added.
* fast/lists/insert-list-user-modify-read-only-orphaned-li.html: Added.


  Commit: 7ca6b800ce2451ba499edb770e81d884679031bc
      https://github.com/WebKit/WebKit/commit/7ca6b800ce2451ba499edb770e81d884679031bc
  Author: Jack Lee <shihchieh_lee at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/lists/insert-list-user-modify-read-only-enclosed-li-expected.txt
    A LayoutTests/fast/lists/insert-list-user-modify-read-only-enclosed-li.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/InsertListCommand.cpp

  Log Message:
  -----------
  Merge r257408 - ASSERTION FAILURE in AppendNodeCommand::AppendNodeCommand when inserting list with read-only user-modify
https://bugs.webkit.org/show_bug.cgi?id=208045
<rdar://problem/39023383>

Patch by Jack Lee <shihchieh_lee at apple.com> on 2020-02-25
Reviewed by Ryosuke Niwa.

When inserting a list (InsertListCommand) around enclosed list items, if new list is not editable, skip moving list items in function doApplyForSingleParagraph.

Source/WebCore:

Test: fast/lists/insert-list-user-modify-read-only-enclosed-li.html

* editing/InsertListCommand.cpp:
(WebCore::InsertListCommand::doApplyForSingleParagraph):

LayoutTests:

* fast/lists/insert-list-user-modify-read-only-enclosed-li-expected.txt: Added.
* fast/lists/insert-list-user-modify-read-only-enclosed-li.html: Added.


  Commit: d044a40edd7686c3fce245644d27e3d7c8999878
      https://github.com/WebKit/WebKit/commit/d044a40edd7686c3fce245644d27e3d7c8999878
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/AnimationTimeline.h
    M Source/WebCore/animation/DocumentTimeline.h
    M Source/WebCore/animation/WebAnimation.cpp
    M Source/WebCore/animation/WebAnimation.h

  Log Message:
  -----------
  Merge r257417 - DocumentTimeline / CSSTransition objects are leaking on CNN.com
https://bugs.webkit.org/show_bug.cgi?id=208069
<rdar://problem/59680143>

Reviewed by Antoine Quint.

Break reference cycle between DocumentTimeline and WebAnimation by using WeakPtr.

* animation/AnimationTimeline.h:
* animation/DocumentTimeline.h:
* animation/WebAnimation.cpp:
(WebCore::WebAnimation::timeline const):
(WebCore::WebAnimation::setTimeline):
(WebCore::WebAnimation::setTimelineInternal):
(WebCore::WebAnimation::enqueueAnimationEvent):
(WebCore::WebAnimation::acceleratedStateDidChange):
* animation/WebAnimation.h:
(WebCore::WebAnimation::timeline const): Deleted.


  Commit: dfe78bb1d885709c63f914ab93662b4d5c9ec6a4
      https://github.com/WebKit/WebKit/commit/dfe78bb1d885709c63f914ab93662b4d5c9ec6a4
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/JSAnimationTimelineCustom.cpp

  Log Message:
  -----------
  Merge r257416 - Unreviewed build fix for non-unified builds.

* bindings/js/JSAnimationTimelineCustom.cpp: Add missing header include.


  Commit: c4e97721a1daa46a3b9c283c3bac8254b95e08ea
      https://github.com/WebKit/WebKit/commit/c4e97721a1daa46a3b9c283c3bac8254b95e08ea
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-26 (Wed, 26 Feb 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSImageSetValue.cpp

  Log Message:
  -----------
  Merge r257474 - Unreviewed build fix for non-unified builds with assertions enabled.

* css/CSSImageSetValue.cpp: Add missing include.


  Commit: 6d045de01c759cfb139d62276b8417906a270e90
      https://github.com/WebKit/WebKit/commit/6d045de01c759cfb139d62276b8417906a270e90
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2020-02-27 (Thu, 27 Feb 2020)

  Changed paths:
    M Source/JavaScriptCore/API/JSObjectRef.cpp
    M Source/JavaScriptCore/ChangeLog

  Log Message:
  -----------
  Merge r257529 - Enhance JSObjectGetProperty() to mitigate against null object pointers.
https://bugs.webkit.org/show_bug.cgi?id=208275
<rdar://problem/59826325>

Reviewed by Robin Morisset.

* API/JSObjectRef.cpp:
(JSObjectGetProperty):


  Commit: 0b5ef1a269566402611b443bcb0f07eaf81a7801
      https://github.com/WebKit/WebKit/commit/0b5ef1a269566402611b443bcb0f07eaf81a7801
  Author: Jack Lee <shihchieh_lee at apple.com>
  Date:   2020-02-27 (Thu, 27 Feb 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/lists/insert-list-uneditable-element-with-non-li-child-expected.txt
    A LayoutTests/fast/lists/insert-list-uneditable-element-with-non-li-child.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/InsertListCommand.cpp

  Log Message:
  -----------
  Merge r257536 - Nullptr crash in WebCore::canHaveChildrenForEditing via CompositeEditCommand::insertNode
https://bugs.webkit.org/show_bug.cgi?id=208115
<rdar://problem/56685655>

Patch by Jack Lee <shihchieh_lee at apple.com> on 2020-02-26
Reviewed by Ryosuke Niwa.

When inserting a list at an element with a non-list-item child, if the element is uneditable, skip creating list item for the child.

Source/WebCore:

Test: fast/lists/insert-list-uneditable-element-with-non-li-child.html

* editing/InsertListCommand.cpp:
(WebCore::InsertListCommand::listifyParagraph):

LayoutTests:

* fast/lists/insert-list-uneditable-element-with-non-li-child-expected.txt: Added.
* fast/lists/insert-list-uneditable-element-with-non-li-child.html: Added.


  Commit: b450c1138f4b7ea1b3745f9e521c3bfd5447b9e3
      https://github.com/WebKit/WebKit/commit/b450c1138f4b7ea1b3745f9e521c3bfd5447b9e3
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-02-27 (Thu, 27 Feb 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.27.91 release

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.27.91.


  Commit: a6497c0e3307d19c363c64329144b53be1c51e79
      https://github.com/WebKit/WebKit/commit/a6497c0e3307d19c363c64329144b53be1c51e79
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-02-27 (Thu, 27 Feb 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.27.91 release

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.27.91.


  Commit: bcc731303d7dbbe75d9420dab826922035c03a02
      https://github.com/WebKit/WebKit/commit/bcc731303d7dbbe75d9420dab826922035c03a02
  Author: Ting-Wei Lan <lantw44 at gmail.com>
  Date:   2020-03-02 (Mon, 02 Mar 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitProtocolHandler.cpp
    M Source/WebKit/UIProcess/API/glib/WebKitUIClient.cpp

  Log Message:
  -----------
  Merge r257700 - [GTK] Fix the build when Wayland target is disabled
https://bugs.webkit.org/show_bug.cgi?id=208407

Patch by Ting-Wei Lan <lantw44 at gmail.com> on 2020-03-01
Reviewed by Darin Adler.

Values in the enum WebCore::PlatformDisplay::Type are only defined when
their corresponding platform targets are enabled, so we need #if checks
around uses of them.

* UIProcess/API/glib/WebKitProtocolHandler.cpp:
(WebKit::WebKitProtocolHandler::handleGPU):
* UIProcess/API/glib/WebKitUIClient.cpp:
(UIClient::windowConfigureEventCallback):


  Commit: a6ffcaaa04fe94e5a27ce207db52e0260bcbcea3
      https://github.com/WebKit/WebKit/commit/a6ffcaaa04fe94e5a27ce207db52e0260bcbcea3
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-03-02 (Mon, 02 Mar 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r256706 - [GStreamer] Build failure with Clang/libc++ due to missing WallTime→float for std::isnan()
https://bugs.webkit.org/show_bug.cgi?id=207757

Unreviewed build fix.

No new tests needed.

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(CachedResourceStreamingClient::dataReceived): Add std:: namespace to overloaded
std::isnan() function call to ensure that the overloaded version for WTF::WallTime
is used.


  Commit: d02312c982303dc5b20382ceda037cf432b98349
      https://github.com/WebKit/WebKit/commit/d02312c982303dc5b20382ceda037cf432b98349
  Author: Charlie Turner <cturner at igalia.com>
  Date:   2020-03-02 (Mon, 02 Mar 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/NativeExecutable.cpp

  Log Message:
  -----------
  Merge r257695 - undefined reference to `JSC::ExecutableBase::hasJITCodeForCall() const'
https://bugs.webkit.org/show_bug.cgi?id=207890

Reviewed by Yusuke Suzuki.

Encountered on arm-buildroot-linux-gnueabihf with GCC 9.2.0.

* runtime/NativeExecutable.cpp: Inclusion of
ExecutableBaseInlines.h resolves the issue for me.


  Commit: 5886cb1941ddc5670e6869c5758462061389fa75
      https://github.com/WebKit/WebKit/commit/5886cb1941ddc5670e6869c5758462061389fa75
  Author: Caio Araujo Neponoceno de Lima <ticaiolima at gmail.com>
  Date:   2020-03-03 (Tue, 03 Mar 2020)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/microbenchmarks/memcpy-typed-loop.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/assembler/MacroAssemblerMIPS.cpp
    M Source/JavaScriptCore/llint/LowLevelInterpreter.asm
    M Source/JavaScriptCore/offlineasm/mips.rb

  Log Message:
  -----------
  Merge r257466 - [JSC][MIPS] Adding support to Checkpoints
https://bugs.webkit.org/show_bug.cgi?id=208196

Reviewed by Yusuke Suzuki.

JSTests:

* microbenchmarks/memcpy-typed-loop.js:

Source/JavaScriptCore:

This patch is adding changes to properly support OSR to
checkpoints on MIPS. It required fixes on JIT probe and some
adjustment on Offlineasm to correct generate `$gp` load when executing
`checkpoint_osr_exit_from_inlined_call_trampoline`.

* assembler/MacroAssemblerMIPS.cpp:

Probe trampoline needs to allocate 16 bytes for 4 arguments to
properly follow C calling conventions. This space is used by callee
when the JSC is compiled with `-O0` flags
(Check "DEFAULT C CALLING CONVENTION (O32)" section on
https://www.mips.com/downloads/mips32-instruction-set-quick-reference-v1-01).

* llint/LowLevelInterpreter.asm:

As we need to do on ARMv7, 64-bits arguments needs to be passed in
register pairs `$a1:$a0` or `$a3:$a2` (little-endian mode). Since `$a0`
contais `CallFrame*`, we need to pass `EncodedJSValue` on `$a3:$a2`
pair.

* offlineasm/mips.rb:

Following the same reason for return locations on OSR to LLInt, we
need to adjust `$gp` using `$ra` instead of `$t9` on
`checkpoint_osr_exit_from_inlined_call_trampoline`, given it is only
reachable through `ret` operations. For detailed explanation, check
ChangeLog of https://trac.webkit.org/changeset/252713.


  Commit: 046a3470ba0e1359b0d7ba8a53df3313abc51d71
      https://github.com/WebKit/WebKit/commit/046a3470ba0e1359b0d7ba8a53df3313abc51d71
  Author: Piotr Drąg <piotrdrag at gmail.com>
  Date:   2020-03-05 (Thu, 05 Mar 2020)

  Changed paths:
    M Source/WebCore/platform/gtk/po/ChangeLog
    M Source/WebCore/platform/gtk/po/pl.po

  Log Message:
  -----------
  Merge r257910 - [GTK][l10n] Updated Polish translation of WebKitGTK for 2.28
https://bugs.webkit.org/show_bug.cgi?id=208410

Patch by Piotr Drąg <piotrdrag at gmail.com> on 2020-03-05
Rubber-stamped by Carlos Garcia Campos.

* pl.po:


  Commit: b1bcbb09f66043ad6c66e60483d7ee87aacad804
      https://github.com/WebKit/WebKit/commit/b1bcbb09f66043ad6c66e60483d7ee87aacad804
  Author: Doug Kelly <dougk at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/hittest/svg-clip-path-child-element-expected.txt
    A LayoutTests/svg/hittest/svg-clip-path-child-element.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp

  Log Message:
  -----------
  Merge r257616 - Hit test with clipPath referencing parent element causes infinite recursion
https://bugs.webkit.org/show_bug.cgi?id=208279

Patch by Doug Kelly <dougk at apple.com> on 2020-02-27
Reviewed by Ryosuke Niwa.

Source/WebCore:

Add an early return for SVG hit tests which have a child element referencing a  parent clipPath.
This change breaks the cycle, although it unfortunately runs on every hit test, for each node which
is a child of the clipPath element.

Test: svg/hittest/svg-clip-path-child-element.html

* rendering/svg/RenderSVGResourceClipper.cpp:
(WebCore::RenderSVGResourceClipper::hitTestClipContent):

LayoutTests:

* svg/hittest/svg-clip-path-child-element-expected.txt: Added.
* svg/hittest/svg-clip-path-child-element.html: Added.


  Commit: 7f11bbdc0b1e11a90e4c0765b4537d3d9e4518b8
      https://github.com/WebKit/WebKit/commit/7f11bbdc0b1e11a90e4c0765b4537d3d9e4518b8
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r257635 - [GStreamer] Unreviewed. Fix build warning.

queueSize is of type size_t so it should use the proper format
specifier.

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(restartLoaderIfNeeded):
(stopLoaderIfNeeded):


  Commit: 01f12f399c7c157c4171f8772dd114f322d7e831
      https://github.com/WebKit/WebKit/commit/01f12f399c7c157c4171f8772dd114f322d7e831
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/NetworkStorageSessionSoup.cpp

  Log Message:
  -----------
  Merge r257638 - [SOUP] Unreviewed. Fix unused parameter warning

* platform/network/soup/NetworkStorageSessionSoup.cpp:
(WebCore::NetworkStorageSession::getRawCookies const):


  Commit: 6217659fadce9ca5b7801b11607081bf0d6bb5f9
      https://github.com/WebKit/WebKit/commit/6217659fadce9ca5b7801b11607081bf0d6bb5f9
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSFontFace.cpp
    M Source/WebCore/css/CSSFontFace.h

  Log Message:
  -----------
  Merge r257639 - Retain cycle between CSSFontSelector -> CSSFontFaceSet -> CSSFontFace -> CSSFontSelector
https://bugs.webkit.org/show_bug.cgi?id=196437
<rdar://problem/46598332>

Reviewed by Alex Christensen.

Break the reference cycle using a WeakPtr. The leak was reproducible by browsing CNN.com
and then navigating to about:blank (those objects would stay around, even after memory
pressure signal).

* css/CSSFontFace.cpp:
(WebCore::CSSFontFace::CSSFontFace):
(WebCore::CSSFontFace::fontLoadEventOccurred):
* css/CSSFontFace.h:


  Commit: d45fee355b4dc2c5be1bd151957fdbf3378347b4
      https://github.com/WebKit/WebKit/commit/d45fee355b4dc2c5be1bd151957fdbf3378347b4
  Author: Dean Jackson <dino at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/AnimationTimeline.cpp

  Log Message:
  -----------
  Merge r257640 - updateCSSTransitionsForElementAndProperty should clone RenderStyles
https://bugs.webkit.org/show_bug.cgi?id=208356
rdar://59869560

Reviewed by Antti Koivisto.

Make ownership of the local variable clear by cloning the RenderStyles
used in updateCSSTransitionsForElementAndProperty rather than referencing
different versions.

* animation/AnimationTimeline.cpp:
(WebCore::AnimationTimeline::updateCSSTransitionsForElementAndProperty):


  Commit: 980ada27efb72cfc80629776b97001a02ba21ab1
      https://github.com/WebKit/WebKit/commit/980ada27efb72cfc80629776b97001a02ba21ab1
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M ChangeLog
    M Source/cmake/WebKitCCache.cmake

  Log Message:
  -----------
  Merge r257649 - Fix issue in cmake build for checking ccache
https://bugs.webkit.org/show_bug.cgi?id=208377

Reviewed by Carlos Alberto Lopez Perez.

If either of the "readlink" or "which" commands fail when looking for the ccache prefix
the output variables will be empty and an invalid expression will be provided to CMake.
e.g. we will get something like:
if ("0" "EQUAL" "0" "AND" "1" "EQUAL" "0" "AND" "STREQUAL" "/usr/local/bin/ccache")

The fix is to wrap the output variables in the quotes when unboxing them in the if.

* Source/cmake/WebKitCCache.cmake:


  Commit: 3afa30c4770434d5bb263fc72f50727e13296435
      https://github.com/WebKit/WebKit/commit/3afa30c4770434d5bb263fc72f50727e13296435
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/text/font-promises-gc-expected.txt
    A LayoutTests/fast/text/font-promises-gc.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/CSSFontFace.cpp
    M Source/WebCore/css/CSSFontFace.h
    M Source/WebCore/css/FontFace.cpp
    M Source/WebCore/css/FontFace.h
    M Source/WebCore/css/FontFace.idl

  Log Message:
  -----------
  Merge r257676 - Garbage collection prevents FontFace.loaded promise from getting resolved
https://bugs.webkit.org/show_bug.cgi?id=208382

Reviewed by Ryosuke Niwa.

Source/WebCore:

Make sure the FontFace JS wrapper stays alive long enough to resolve the
loaded promise when it is observable by the page's script.

Test: fast/text/font-promises-gc.html

* css/CSSFontFace.cpp:
(WebCore::CSSFontFace::document const):
* css/CSSFontFace.h:
* css/FontFace.cpp:
(WebCore::FontFace::FontFace):
(WebCore::FontFace::fontStateChanged):
(WebCore::FontFace::loadForBindings):
(WebCore::FontFace::loadedForBindings):
(WebCore::FontFace::activeDOMObjectName const):
(WebCore::FontFace::hasPendingActivity const):
(WebCore::FontFace::load): Deleted.
* css/FontFace.h:
* css/FontFace.idl:

LayoutTests:

Add layout test coverage. Thanks to Alexey Proskuryakov for writing the test.

* fast/text/font-promises-gc-expected.txt: Added.
* fast/text/font-promises-gc.html: Added.


  Commit: 3fd65f576e34e07912ea4bee8940d36f941408cb
      https://github.com/WebKit/WebKit/commit/3fd65f576e34e07912ea4bee8940d36f941408cb
  Author: Chris Dumez <cdumez at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/Quirks.cpp

  Log Message:
  -----------
  Merge r257714 - Add quirk to disable to back/forward cache on docs.google.com
https://bugs.webkit.org/show_bug.cgi?id=208381
<rdar://problem/59893415>

Reviewed by Ryosuke Niwa.

Google Docs used to bypass the back/forward cache by serving "Cache-Control: no-store"
over HTTPS. We started caching such content in r250437 but the Google Docs content
unfortunately is not currently compatible because it puts an overlay over the page and
starts an animation when navigating away and fails to remove those when coming back from
the back/forward cache (e.g. in 'pageshow' event handler).

* page/Quirks.cpp:
(WebCore::Quirks::shouldBypassBackForwardCache const):


  Commit: bf1518212f8f44c307bd087fb4ae470840992365
      https://github.com/WebKit/WebKit/commit/bf1518212f8f44c307bd087fb4ae470840992365
  Author: Doug Kelly <dougk at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/table/insert-cell-invisible-parent-expected.txt
    A LayoutTests/fast/table/insert-cell-invisible-parent.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderElement.cpp

  Log Message:
  -----------
  Merge r257720 - ASSERT(m_column != unsetColumnIndex) in RenderTable::cellBefore
https://bugs.webkit.org/show_bug.cgi?id=208397

Patch by Doug Kelly <dougk at apple.com> on 2020-03-02
Reviewed by Zalan Bujtas.

Source/WebCore:

When inserting a cell into a table row which is not visible, this can lead to attempting to compute the repaint
rects during tree building.  Instead, mark the layer as dirty using dirtyVisibleContentStatus(), and the visibility
will be recomputed at a later time.

Test: fast/table/insert-cell-invisible-parent.html

* rendering/RenderElement.cpp:
(WebCore::RenderElement::insertedIntoTree):

LayoutTests:

* fast/table/insert-cell-invisible-parent-expected.txt: Added.
* fast/table/insert-cell-invisible-parent.html: Added.


  Commit: 9c3960c24e8eedee16fac420c75569e3a5525ef9
      https://github.com/WebKit/WebKit/commit/9c3960c24e8eedee16fac420c75569e3a5525ef9
  Author: Paulo Matos <pmatos at igalia.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGOSRExit.cpp
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/HashTable.h

  Log Message:
  -----------
  Merge r257721 - Fix JSC 32bit alignment increase gcc warning
https://bugs.webkit.org/show_bug.cgi?id=208445

Patch by Paulo Matos <pmatos at igalia.com> on 2020-03-02
Reviewed by Yusuke Suzuki.

Use reinterpret_cast_ptr<>() instead of reinterpret_cast<>() to
avoid GCC warning about increase in alignment requirement for cast
target type.

Source/JavaScriptCore:

* dfg/DFGOSRExit.cpp:
(JSC::DFG::OSRExit::compileExit):

Source/WTF:

* wtf/HashTable.h:
(WTF::HashTable::tableSize const):
(WTF::HashTable::setTableSize const):
(WTF::HashTable::tableSizeMask const):
(WTF::HashTable::setTableSizeMask):
(WTF::HashTable::keyCount const):
(WTF::HashTable::setKeyCount const):
(WTF::HashTable::deletedCount const):
(WTF::HashTable::setDeletedCount const):
(WTF::KeyTraits>::allocateTable):
(WTF::KeyTraits>::deallocateTable):


  Commit: bd7e8b645e3c46cfb30d3feae09e8e5f4d57124f
      https://github.com/WebKit/WebKit/commit/bd7e8b645e3c46cfb30d3feae09e8e5f4d57124f
  Author: Doug Kelly <dougk at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/events/detached-svg-parent-window-events-expected.txt
    A LayoutTests/fast/events/detached-svg-parent-window-events.html
    A LayoutTests/fast/events/onerror-svg-symbol-expected.txt
    A LayoutTests/fast/events/onerror-svg-symbol.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/svg/SVGSVGElement.cpp

  Log Message:
  -----------
  Merge r257897 - Crash in SVGElement::removeEventListener with symbol element
https://bugs.webkit.org/show_bug.cgi?id=207920

Patch by Doug Kelly <dougk at apple.com> on 2020-03-04
Reviewed by Ryosuke Niwa.

Source/WebCore:

Resolves a crash in SVGElement::removeEventListener by only attaching the events to the window if the SVG element is both the outermost
SVG element, in addition to ensuring the SVG element is attached to the tree.  The symbol element's behavior when referenced by a use
tag actually creates an svg tag instead, so the SVGSVGElement's special behavior for copying attributes is vital.

Note that Chrome and Firefox have a similar behavior for detached SVG elements as to what this change creates: in both other browsers,
onerror is not fired for a detached svg element, and in Firefox, onresize is not fired for a detached svg element (it is however fired
in Chrome).

Tests: fast/events/detached-svg-parent-window-events.html
       fast/events/onerror-svg-symbol.html

* svg/SVGSVGElement.cpp:
(WebCore::SVGSVGElement::parseAttribute):

LayoutTests:

* fast/events/detached-svg-parent-window-events-expected.txt: Added.
* fast/events/detached-svg-parent-window-events.html: Added.
* fast/events/onerror-svg-symbol-expected.txt: Added.
* fast/events/onerror-svg-symbol.html: Added.


  Commit: b3500aab92e0059fc117e18a820aae02e7e2b771
      https://github.com/WebKit/WebKit/commit/b3500aab92e0059fc117e18a820aae02e7e2b771
  Author: Paulo Matos <pmatos at igalia.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/GCMemoryOperations.h

  Log Message:
  -----------
  Merge r257908 - [JSCOnly] 32-bits warning on memset of JSValue
https://bugs.webkit.org/show_bug.cgi?id=204411

Patch by Paulo Matos <pmatos at igalia.com> on 2020-03-05
Reviewed by Mark Lam.

Fixes warning on 32bit builds. This is required because GCC knows
it is not safe to use memset on non-POD types and warns against its use.

* heap/GCMemoryOperations.h:
(JSC::gcSafeZeroMemory):


  Commit: 3739483ba4e205523c0fbc6a6dd5a11d1741ebb9
      https://github.com/WebKit/WebKit/commit/3739483ba4e205523c0fbc6a6dd5a11d1741ebb9
  Author: Sihui Liu <sihui_liu at apple.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/WebProcessProxy.cpp

  Log Message:
  -----------
  Merge r257921 - Assertion failed: shouldBeActive() in BackgroundProcessResponsivenessTimer::responsivenessCheckTimerFired()
https://bugs.webkit.org/show_bug.cgi?id=208596

Reviewed by Chris Dumez.

Update state of BackgroundProcessResponsivenessTimer when ServiceWorker is enabled or disabled in web process.

* UIProcess/WebProcessProxy.cpp:
(WebKit::WebProcessProxy::disableServiceWorkers):
(WebKit::WebProcessProxy::enableServiceWorkers):


  Commit: 4939c510644f23ebe01e43133c24d045e7852d63
      https://github.com/WebKit/WebKit/commit/4939c510644f23ebe01e43133c24d045e7852d63
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merge r257972 - [WPE][GTK] Use Firefox user agent quirk more aggressively on Google Docs
https://bugs.webkit.org/show_bug.cgi?id=208647

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-06
Reviewed by Carlos Garcia Campos.

Source/WebCore:

I had previously determined that we need to send a Firefox user agent quirk to
accounts.youtube.com to avoid unsupported browser warnings on Google Docs. Either the user
agent check has since become more aggressive, or it somehow depends on factors I don't
understand, but as of today it's no longer enough. We now need the quirk for docs.google.com
as well.

* platform/UserAgentQuirks.cpp:
(WebCore::urlRequiresFirefoxBrowser):

Tools:

* TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:
(TestWebKitAPI::TEST):


  Commit: 8c0ffee0c93cef8e107d28bf2906b0ff2f9206bd
      https://github.com/WebKit/WebKit/commit/8c0ffee0c93cef8e107d28bf2906b0ff2f9206bd
  Author: Lauro Moura <lmoura at igalia.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M Tools/ChangeLog
    M Tools/MiniBrowser/wpe/main.cpp

  Log Message:
  -----------
  Merge r257973 - [WPE][WebDriver] MiniBrowser should react to close session commands
https://bugs.webkit.org/show_bug.cgi?id=207529

Reviewed by Carlos Garcia Campos.

Do not call g_object_unref on the first created view if it has already
been disposed in the "close" signal handler.

Based on original patch by Yury Semikhatsky.

* MiniBrowser/wpe/main.cpp:
(main):


  Commit: 8105c3afe09cefe12fc5f26a73ddd46d998d934a
      https://github.com/WebKit/WebKit/commit/8105c3afe09cefe12fc5f26a73ddd46d998d934a
  Author: Enrique Ocaña González <eocanha at igalia.com>
  Date:   2020-03-06 (Fri, 06 Mar 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/media/resources/serve-video.php
    A LayoutTests/http/tests/media/video-no-content-length-stall-expected.txt
    A LayoutTests/http/tests/media/video-no-content-length-stall.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r257977 - [GStreamer] Streaming aac/mp3 audio doesn't always work
https://bugs.webkit.org/show_bug.cgi?id=205801

Reviewed by Philippe Normand.

Source/WebCore:

Don't rely on response size to replace Content-Length. This may break streaming videos,
which should always have an Infinite duration.

This patch is based on the fix found by Philippe Normand <pnormand at igalia.com>

Test: http/tests/media/video-no-content-length-stall.html

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(CachedResourceStreamingClient::dataReceived):

LayoutTests:

The new test checks that end-of-stream (thus, end of playback) isn't triggered when a live
audio stream is being played. Live streams don't have Content-Length and are loaded as
they are generated (no future data is available immediately). This is simulated by omitting
Content-Length and artificially stalling the stream at a given offset.

* http/tests/media/resources/serve-video.php: Now the file continues to be served after
the stall when stallOffset/stallDuration are used.
* http/tests/media/video-no-content-length-stall-expected.txt: Added.
* http/tests/media/video-no-content-length-stall.html: Added.


  Commit: 34bdb671cc50fa4932089f2b3e064d27f56d42c2
      https://github.com/WebKit/WebKit/commit/34bdb671cc50fa4932089f2b3e064d27f56d42c2
  Author: Konstantin Tokarev <annulen at yandex.ru>
  Date:   2020-03-09 (Mon, 09 Mar 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/OffscreenCanvas.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitProtocolHandler.cpp

  Log Message:
  -----------
  Merge r258103 - [GTK] Fix compilation with disabled OpenGL
https://bugs.webkit.org/show_bug.cgi?id=208773

Reviewed by Yusuke Suzuki.

Source/WebCore:

* html/OffscreenCanvas.h:

Source/WebKit:

* UIProcess/API/glib/WebKitProtocolHandler.cpp:
(WebKit::WebKitProtocolHandler::handleGPU):


  Commit: 2b61ddca6b3e3b3e3daae2793c3fe8b1604b988c
      https://github.com/WebKit/WebKit/commit/2b61ddca6b3e3b3e3daae2793c3fe8b1604b988c
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-03-09 (Mon, 09 Mar 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/EditorState.cpp
    M Source/WebKit/Shared/EditorState.h
    M Source/WebKit/UIProcess/API/gtk/WebKitWebViewBase.cpp
    M Source/WebKit/UIProcess/API/wpe/WPEView.cpp
    M Source/WebKit/WebProcess/WebPage/WebPage.cpp
    M Source/WebKit/WebProcess/WebPage/glib/WebPageGLib.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestInputMethodContext.cpp

  Log Message:
  -----------
  Merge r258131 - [GTK][WPE] Surrounding text for input methods should not be limited to the current paragraph
https://bugs.webkit.org/show_bug.cgi?id=208706

Reviewed by Žan Doberšek.

Source/WebKit:

It should include all the text around the cursor position.

* Shared/EditorState.cpp:
(WebKit::EditorState::PostLayoutData::encode const): Rename paragraphContext* as surroundingContext*.
(WebKit::EditorState::PostLayoutData::decode): Ditto.
* Shared/EditorState.h:
* UIProcess/API/gtk/WebKitWebViewBase.cpp:
(webkitWebViewBaseUpdateTextInputState): Ditto.
* UIProcess/API/wpe/WPEView.cpp:
(WKWPE::View::selectionDidChange): Ditto.
* WebProcess/WebPage/WebPage.cpp:
(WebKit::WebPage::deleteSurrounding): Use content editable text as context instead of just paragraph.
* WebProcess/WebPage/glib/WebPageGLib.cpp:
(WebKit::WebPage::platformEditorState const): Ditto.

Tools:

Add test case to check surrounding text in multiline context.

* TestWebKitAPI/Tests/WebKitGLib/TestInputMethodContext.cpp:
(testWebKitInputMethodContextSurrounding):


  Commit: e4df3ad1ced59d4d243e87766c8706a46a37d45a
      https://github.com/WebKit/WebKit/commit/e4df3ad1ced59d4d243e87766c8706a46a37d45a
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2020-03-09 (Mon, 09 Mar 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/WebPreferencesDefaultValues.h

  Log Message:
  -----------
  Merge r258134 - [WPE] AsyncScrolling: scrolling with the mouse wheel over sub-scrollable areas scrolls the main frame
https://bugs.webkit.org/show_bug.cgi?id=208635

Reviewed by Carlos Garcia Campos.

Rework the default values for the async frame and overflow scrolling
so that the latter stays disabled for Nicosia-using ports as it
undergoes bigger changes.

* Shared/WebPreferencesDefaultValues.cpp:
(WebKit::defaultAsyncFrameAndOverflowScrollingEnabled):
(WebKit::defaultAsyncFrameScrollingEnabled):


  Commit: b4505f20a37dac179ee6425fe1347b85fb2ff71b
      https://github.com/WebKit/WebKit/commit/b4505f20a37dac179ee6425fe1347b85fb2ff71b
  Author: Mike Gorse <mgorse at suse.com>
  Date:   2020-03-10 (Tue, 10 Mar 2020)

  Changed paths:
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/BPlatform.h

  Log Message:
  -----------
  Merge r258142 - Build failure on ppc64le if __unix is undefined
https://bugs.webkit.org/show_bug.cgi?id=207906

Patch by Mike Gorse <mgorse at suse.com> on 2020-03-09
Reviewed by Yusuke Suzuki.

* bmalloc/BPlatform.h: Check for __unix__ along with __unix.


  Commit: b56a803a0a2c8ce9215f770c9feb196f8784f82c
      https://github.com/WebKit/WebKit/commit/b56a803a0a2c8ce9215f770c9feb196f8784f82c
  Author: Caio Araujo Neponoceno de Lima <ticaiolima at gmail.com>
  Date:   2020-03-10 (Tue, 10 Mar 2020)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/stress/tail-call-with-spilled-registers.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/bytecode/AccessCase.cpp

  Log Message:
  -----------
  Merge r258143 - Tail calls are broken on ARM_THUMB2 and MIPS
https://bugs.webkit.org/show_bug.cgi?id=197797

Reviewed by Yusuke Suzuki.

JSTests:

* stress/tail-call-with-spilled-registers.js: Added.

Source/JavaScriptCore:

`prepareForTailCall` operation expects that header size + parameters
size is aligned with stack (alignment is 16-bytes for every architecture).
This means that headerSizeInBytes + argumentsIncludingThisInBytes needs
to be multiple of 16. This was not being preserved during getter IC code
for 32-bits. The code generated was taking in account only
headerSizeInRegisters (it is 4 on 32-bits) and argumentsIncludingThis
(that is always 1 for getters) and allocating 32-bytes when applying
operation `(headerSize + argumentsIncludingThis) * 8 - sizeof(CallerFrameAndPC)`.
This results in a stack frame with size of 40 bytes (after we push
`lr` and `sp`). Since `prepareForTailCall` expects frames to be
16-bytes aligned, it will then calculate the top of such frame
considering it is 48 bytes, cloberring values of previous frame and
causing unexpected behavior. This patch is fixing how this IC code
calculates the stack frame using `roundArgumentCountToAlignFrame(numberOfParameters)`
aligning with what we do on code without IC installed.
This was not a problem for getter and setter IC on 64-bits because
`roundArgumentCountToAlignFrame(1) == 1` and `roundArgumentCountToAlignFrame(2) == 3`
while it is `roundArgumentCountToAlignFrame(1) == 2` and
`roundArgumentCountToAlignFrame(2) == 2` for MIPS and ARMv7.

* bytecode/AccessCase.cpp:
(JSC::AccessCase::generateImpl):


  Commit: 31554602c4074d1360269ae5fd9af07bb9ed0965
      https://github.com/WebKit/WebKit/commit/31554602c4074d1360269ae5fd9af07bb9ed0965
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-03-10 (Tue, 10 Mar 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.28.0 release

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.28.0.


  Commit: b359799658498c9276d8bbb1601d97e52b3e1f3e
      https://github.com/WebKit/WebKit/commit/b359799658498c9276d8bbb1601d97e52b3e1f3e
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-03-12 (Thu, 12 Mar 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.28.0 release

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.28.0.


  Commit: d88ca91293e2e6cbc78929187177d912049a7aff
      https://github.com/WebKit/WebKit/commit/d88ca91293e2e6cbc78929187177d912049a7aff
  Author: Philippe Normand <philn at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/VideoTextureCopierGStreamer.cpp
    M Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
    M Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
    M Source/WebCore/platform/graphics/texmap/TextureMapperGLHeaders.h
    M Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayerBuffer.cpp
    M Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayerBuffer.h
    M Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp
    M Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.h

  Log Message:
  -----------
  Merge r258197 - [GStreamer][GL] External OES textures rendering support
https://bugs.webkit.org/show_bug.cgi?id=208572

Patch by Philippe Normand <philn at igalia.com> on 2020-03-10
Reviewed by Žan Doberšek.

For hardware that contains native YUV samplers, some drivers may
only support external-oes import of YUV textures, so by supporting
this texture target in the MediaPlayer we can avoid some costly
operations in the pipeline.

* platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp:
(webKitGLVideoSinkSetMediaPlayerPrivate):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::GstVideoFrameHolder::GstVideoFrameHolder):
(WebCore::GstVideoFrameHolder::platformLayerBuffer):
(WebCore::MediaPlayerPrivateGStreamer::paint):
* platform/graphics/gstreamer/VideoTextureCopierGStreamer.cpp:
(WebCore::VideoTextureCopierGStreamer::copyVideoTextureToPlatformTexture):
* platform/graphics/texmap/TextureMapperGL.cpp:
(WebCore::TextureMapperGL::drawTexturedQuadWithProgram):
(WebCore::TextureMapperGL::drawTextureExternalOES):
* platform/graphics/texmap/TextureMapperGL.h:
* platform/graphics/texmap/TextureMapperPlatformLayerBuffer.cpp:
(WebCore::TextureMapperPlatformLayerBuffer::clone):
(WebCore::TextureMapperPlatformLayerBuffer::paintToTextureMapper):
* platform/graphics/texmap/TextureMapperPlatformLayerBuffer.h:
* platform/graphics/texmap/TextureMapperShaderProgram.cpp:
(WebCore::TextureMapperShaderProgram::create):
* platform/graphics/texmap/TextureMapperShaderProgram.h:


  Commit: 7ad4e09b1cf094a6c628649984a75e3ed4114bfb
      https://github.com/WebKit/WebKit/commit/7ad4e09b1cf094a6c628649984a75e3ed4114bfb
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r258199 - Unreviewed, !USE(GSTREAMER_GL) build fix after r258197.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::GstVideoFrameHolder::platformLayerBuffer):


  Commit: 8c524af1aa280cf1bc5e196fe67cb6b50ee852b5
      https://github.com/WebKit/WebKit/commit/8c524af1aa280cf1bc5e196fe67cb6b50ee852b5
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.h

  Log Message:
  -----------
  Merge r258542 - [GStreamer][MSE] Playback rate update support
https://bugs.webkit.org/show_bug.cgi?id=208454

Reviewed by Xabier Rodriguez-Calvar.

Implement playback rate update support for the MSE player. Also
includes drive-by logging cleanups.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::updatePlaybackRate):
(WebCore::MediaPlayerPrivateGStreamer::setRate):
(WebCore::MediaPlayerPrivateGStreamer::setPreservesPitch):
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
(WebCore::MediaPlayerPrivateGStreamer::pipeline const):
* platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:
(WebCore::MediaPlayerPrivateGStreamerMSE::seek):
(WebCore::MediaPlayerPrivateGStreamerMSE::doSeek):
(WebCore::MediaPlayerPrivateGStreamerMSE::maybeFinishSeek):
(WebCore::MediaPlayerPrivateGStreamerMSE::seekCompleted):
(WebCore::MediaPlayerPrivateGStreamerMSE::updatePlaybackRate): Deleted.
(WebCore::MediaPlayerPrivateGStreamerMSE::setRate): Deleted.
* platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.h:


  Commit: 7e730877887134ae2625b96d49d19dfb409a5ce6
      https://github.com/WebKit/WebKit/commit/7e730877887134ae2625b96d49d19dfb409a5ce6
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Tools/ChangeLog
    M Tools/gtkdoc/generate-gtkdoc

  Log Message:
  -----------
  Merge r258328 - [GTK] Use #!/usr/bin/python3 shebang to run generate-gtkdoc
https://bugs.webkit.org/show_bug.cgi?id=208970

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-12
Reviewed by Daniel Bates.

Fedora and Ubuntu are both patching generate-gtkdoc to use #!/usr/bin/python3 rather than

probably has similar rules.

Note this is the only script that attempts to use /usr/bin/python in tarball builds.
Everything else that does so is probably only used by webkit-build.

https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/#_multiple_python_runtimes

* gtkdoc/generate-gtkdoc:


  Commit: b561b398f705c94d82a970a98eec2c6b6cee6a7e
      https://github.com/WebKit/WebKit/commit/b561b398f705c94d82a970a98eec2c6b6cee6a7e
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M ChangeLog
    M Source/cmake/GtkDoc.cmake
    M Tools/ChangeLog
    M Tools/gtkdoc/generate-gtkdoc

  Log Message:
  -----------
  Merge r258808 - [GTK] Use ${PYTHON_EXECUTABLE} to run generate-gtkdoc
https://bugs.webkit.org/show_bug.cgi?id=208970

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-21
Reviewed by Konstantin Tokarev.

.:

There's no need to rely on shebangs when executing python scripts from CMake. This should
ensure the script always works even if the shebang does not.

* Source/cmake/GtkDoc.cmake:

Tools:

We are allowed to use /usr/bin/env in this script because it's not installed (so not
packaged). Therefore we can make the shebang compatible with FreeBSD in this particularl
case.

* gtkdoc/generate-gtkdoc:


  Commit: 8b0d64dae104f9c57cc3518d477b91da245793ed
      https://github.com/WebKit/WebKit/commit/8b0d64dae104f9c57cc3518d477b91da245793ed
  Author: ChangSeok Oh <changseok at webkit.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/fast/forms/textfield-onchange-without-focus-expected.html
    A LayoutTests/fast/forms/textfield-onchange-without-focus.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLTextAreaElement.cpp

  Log Message:
  -----------
  Merge r258532 - A change event gets dispatched when textarea gets changed without focus
https://bugs.webkit.org/show_bug.cgi?id=202144

Patch by ChangSeok Oh <changseok at webkit.org> on 2020-03-16
Reviewed by Ryosuke Niwa.

Source/WebCore:

A crash happens in WebCore::ValidationMessage::buildBubbleTree. An immediate reason
is that DOM tree is modified in buildBubbleTree triggered by a timer.
The function calls document.updateLayout() that causes a change event
for textarea to fire when something changed in the textarea.
This bug is not reproduced on Mac because buildBubbleTree is not called.
See ValidationMessage::setMessage.
On the other hand, the root cause of this issue is triggering the change event
for textarea even if it is not focused when a change is made. This behavior
is different to what Gecko and Chromium do. When loading the test, they do not
trigger the change event although the textarea is filled by the script
since the textarea is not focused. Only when we manually make a change (meaning
the textarea is focused by user input), the event gets dispatched. To fix it,
setChangedSinceLastFormControlChangeEvent(true) is moved below the focus check
in HTMLTextAreaElement::subtreeHasChanged();

Test: fast/forms/textfield-onchange-without-focus.html

* html/HTMLTextAreaElement.cpp:
(WebCore::HTMLTextAreaElement::subtreeHasChanged):

LayoutTests:

The test should be identical to the extected result without crash.

* fast/forms/textfield-onchange-without-focus-expected.html: Added.
* fast/forms/textfield-onchange-without-focus.html: Added.


  Commit: d4ed8004804b36d6d17370f7f7841f8e68bf55e2
      https://github.com/WebKit/WebKit/commit/d4ed8004804b36d6d17370f7f7841f8e68bf55e2
  Author: Eugene But <eugenebut at chromium.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/editing/pasteboard/insert-apple-style-span-after-timeout-expected.txt
    A LayoutTests/editing/pasteboard/insert-apple-style-span-after-timeout.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/editing/ReplaceSelectionCommand.cpp

  Log Message:
  -----------
  Merge r258662 - Fix ReplaceSelectionCommand::InsertedNodes::willRemoveNodePreservingChildren crash
https://bugs.webkit.org/show_bug.cgi?id=208312

Patch by Eugene But <eugenebut at chromium.org> on 2020-03-18
Reviewed by Ryosuke Niwa

ReplaceSelectionCommand::InsertedNodes::willRemoveNodePreservingChildren
was crashing on dereferencing m_firstNodeInserted pointer. Before the crash
ReplaceSelectionCommand::InsertedNodes object received the following calls:

respondToNodeInsertion() with node A, which set m_firstNodeInserted and m_lastNodeInserted to A
willRemoveNode() with node B, which left m_firstNodeInserted and m_lastNodeInserted unchanged (A)
(node A was destroyed setting m_firstNodeInserted and m_lastNodeInserted to null)
respondToNodeInsertion() with node C, which set m_firstNodeInserted and m_lastNodeInserted to C
willRemoveNodePreservingChildren() with node C, which set m_firstNodeInserted to null and crashed

This patch checks m_firstNodeInserted before dereferencing and sets m_lastNodeInserted to null if
m_firstNodeInserted became null. It seems like having non-null value for m_lastNodeInserted would
be an invalid state.

Test: editing/pasteboard/insert-apple-style-span-after-timeout.html

* editing/ReplaceSelectionCommand.cpp:
(WebCore::ReplaceSelectionCommand::InsertedNodes::willRemoveNodePreservingChildren):

LayoutTests:
Test for ReplaceSelectionCommand::InsertedNodes::willRemoveNodePreservingChildren crash fix
https://bugs.webkit.org/show_bug.cgi?id=208312

Patch by Eugene But <eugenebut at chromium.org> on 2020-03-18
Reviewed by Ryosuke Niwa

This test insers empty Apple-style-span after timeout to a non-empty document.

* editing/pasteboard/insert-apple-style-span-after-timeout.html:


  Commit: d64c6afa0320a37822feac533b83f640763d9265
      https://github.com/WebKit/WebKit/commit/d64c6afa0320a37822feac533b83f640763d9265
  Author: Tomáš Popela <tpopela at redhat.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/stress/dataview-get-cse.js
    M JSTests/stress/dataview-jit-get.js
    M JSTests/stress/dataview-jit-neuter.js
    M JSTests/stress/dataview-jit-set-nan.js
    M JSTests/stress/dataview-jit-set.js

  Log Message:
  -----------
  Merge r258710 - [JSC][BigEndians] Several JSC stress tests failing
https://bugs.webkit.org/show_bug.cgi?id=194007

Reviewed by Michael Catanzaro.

Adapt the DataView tests to be able to pass on little endian as well
as the big endian hardware. Do so by introducing method that determine
the endianess and based on its value it saves the expected results in
the right format.

* stress/dataview-get-cse.js:
(getIsLittleEndian):
(adjustForEndianess):
(test3.foo):
(test3):
* stress/dataview-jit-get.js:
(getIsLittleEndian):
(test1.adjustForEndianess):
(test1):
(test2.adjustForEndianess):
(test2):
(test3.adjustForEndianess):
(test3):
(adjustForEndianessUint32):
(test4):
(test5):
(test6):
(test7):
(test8):
* stress/dataview-jit-neuter.js:
(getIsLittleEndian):
(adjustForEndianess):
(test):
(test2):
* stress/dataview-jit-set-nan.js:
(getIsLittleEndian):
(adjustForEndianessFloat32):
(test):
* stress/dataview-jit-set.js:
(getIsLittleEndian):
(readHex):
(adjustForEndianessUint16):
(test):
(test2):
(adjustForEndianessUint32):
(test3):
(test4):
(adjustForEndianessFloat32):
(test5):
(adjustForEndianessFloat64):
(test6):
(isLittleEndian): Deleted.


  Commit: 1c4d77d7af5ca8e5e549499def0a223b6b51203a
      https://github.com/WebKit/WebKit/commit/1c4d77d7af5ca8e5e549499def0a223b6b51203a
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/llint/LowLevelInterpreter.asm

  Log Message:
  -----------
  Merge r258717 - sanitizeStackForVMImpl writes below stack pointer, triggers huge warning spam from valgrind
https://bugs.webkit.org/show_bug.cgi?id=199295

Reviewed by Mark Lam.

During sanitizeStackForVMImpl, we should not access to the region beyond the stack-pointer.
This patch changes stack-pointer while sanitizeStackForVMImpl is zero-filling the old stack region.

* llint/LowLevelInterpreter.asm:


  Commit: f3e7831a40303a11261816bf043324c639f63c75
      https://github.com/WebKit/WebKit/commit/f3e7831a40303a11261816bf043324c639f63c75
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/llint/LowLevelInterpreter.asm

  Log Message:
  -----------
  Merge r258719 - Unreviewed, build fix after r258717
https://bugs.webkit.org/show_bug.cgi?id=199295

* llint/LowLevelInterpreter.asm:


  Commit: fd868ea223c13b8f6613d90c39495165b112dcff
      https://github.com/WebKit/WebKit/commit/fd868ea223c13b8f6613d90c39495165b112dcff
  Author: Mike Gorse <mgorse at suse.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp

  Log Message:
  -----------
  Merge r258755 - Fix build with gstreamer 1.12
https://bugs.webkit.org/show_bug.cgi?id=209296

Patch by Mike Gorse <mgorse at suse.com> on 2020-03-20
Reviewed by Philippe Normand.

No new tests (build fix only).

* platform/graphics/gstreamer/GLVideoSinkGStreamer.cpp:
(webKitGLVideoSinkChangeState): Add GST_VERSION_CHECK around check for
GST_STATE_CHANGE_READY_TO_READY.


  Commit: d45ade203dc20238b4b7aee2d487d7dc6c180afb
      https://github.com/WebKit/WebKit/commit/d45ade203dc20238b4b7aee2d487d7dc6c180afb
  Author: Saam Barati <sbarati at apple.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/OptionsList.h
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/Gigacage.h

  Log Message:
  -----------
  Merge r257662 - Clean up code with how we choose Gigacage sizes and whether or not to use Wasm fast memory
https://bugs.webkit.org/show_bug.cgi?id=208392

Reviewed by Yusuke Suzuki.

Source/bmalloc:

* bmalloc/Gigacage.h:

Source/JavaScriptCore:

* runtime/OptionsList.h:


  Commit: 8c7e0aed885200ead406e94add11c35900b78ca7
      https://github.com/WebKit/WebKit/commit/8c7e0aed885200ead406e94add11c35900b78ca7
  Author: Saam Barati <sbarati at apple.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSCConfig.cpp
    M Source/JavaScriptCore/runtime/JSCConfig.h
    M Source/bmalloc/ChangeLog
    M Source/bmalloc/bmalloc/Gigacage.h

  Log Message:
  -----------
  Merge r258460 - configSizeToProtect should be 16KB
https://bugs.webkit.org/show_bug.cgi?id=209068

Reviewed by Keith Miller.

Source/bmalloc:

* bmalloc/Gigacage.h:

Source/JavaScriptCore:

* runtime/JSCConfig.h:


  Commit: f6857ff123b4a2a7aab6132d49841d4ece5a230b
      https://github.com/WebKit/WebKit/commit/f6857ff123b4a2a7aab6132d49841d4ece5a230b
  Author: Saam Barati <sbarati at apple.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/JSCConfig.h

  Log Message:
  -----------
  Merge r258463 - Unreviewed. Fix windows build by making configSizeToProtect stay 4KB.

* runtime/JSCConfig.h:


  Commit: 6fd596e3b2b18420c60ca28ae4779cdcdb76ce10
      https://github.com/WebKit/WebKit/commit/6fd596e3b2b18420c60ca28ae4779cdcdb76ce10
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/MarkedBlock.h
    M Source/JavaScriptCore/runtime/JSCConfig.cpp
    M Source/JavaScriptCore/runtime/JSCConfig.h
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/PageBlock.cpp
    M Source/WTF/wtf/PageBlock.h

  Log Message:
  -----------
  Merge r258857 - REGRESSION(r249808): [GTK] Crash in JSC Config::permanentlyFreeze() on architecture ppc64el
https://bugs.webkit.org/show_bug.cgi?id=209236

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-23
Reviewed by Mark Lam.

Source/JavaScriptCore:

* heap/MarkedBlock.h: Use new CeilingOnPageSize.
* runtime/JSCConfig.cpp:
(JSC::Config::permanentlyFreeze): Use pageSize instead of vmPageSize.
* runtime/JSCConfig.h: Use new CeilingOnPageSize.

Source/WTF:

Add new CeilingOnPageSize constants, for use in JSC, in order to centralize our compile-time
page size guessing into one place. Improve the implementation of pageSize() to
RELEASE_ASSERT() when CeilingOnPageSize is wrong, so we can detect and fix it if so. (It
will be even easier to detect if we change RELEASE_ASSERT_WITH_MESSAGE() to actually print
its message in release builds.) Change pageSize() to use sysconf(_SC_PAGESIZE), which is
specified by POSIX, instead of getpagesize(), which is nonstandard.

* wtf/PageBlock.cpp:
(WTF::systemPageSize):
(WTF::pageSize):
* wtf/PageBlock.h:


  Commit: 5adcb884c1fca1f93b8e50cbe1c0fa072a3e1b19
      https://github.com/WebKit/WebKit/commit/5adcb884c1fca1f93b8e50cbe1c0fa072a3e1b19
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/PageBlock.h

  Log Message:
  -----------
  Merge r259134 - REGRESSION(r258857): Broke aarch64 JSCOnly CI
https://bugs.webkit.org/show_bug.cgi?id=209670

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-27
Reviewed by Carlos Alberto Lopez Perez.

Change aarch64 to use 4 KB rather than 64 KB as the ceiling on page size.

This change is definitely incorrect, because it will break our internal aarch64 CI that uses
64 KB pages. But maybe it will fix the public aarch64 CI bot that is using 4 KB pages?
Further investigation is required, because 64 KB should have been a safe value for all
platforms, but first step is to commit this and see what happens.

* wtf/PageBlock.h:


  Commit: 802bb23be9378c0a4df89f0310307898f4b389b3
      https://github.com/WebKit/WebKit/commit/802bb23be9378c0a4df89f0310307898f4b389b3
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

  Log Message:
  -----------
  Merge r258923 - [GTK] Crash in WebKit::LayerTreeHost::LayerTreeHost with bubblewrap sandbox enabled
https://bugs.webkit.org/show_bug.cgi?id=209106

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-24
Reviewed by Adrian Perez de Castro.

The bubblewrap sandbox is blocking access to WebKit's nested Wayland compositor. Apparently
nobody has ever tested the nested Wayland compositor with the sandbox enabled until now.

* UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
(WebKit::bindWayland):


  Commit: f2605cdf4306ceba0794e03932cfa2516e0acb25
      https://github.com/WebKit/WebKit/commit/f2605cdf4306ceba0794e03932cfa2516e0acb25
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

  Log Message:
  -----------
  Merge r259044 - [GTK] Crash in WebKit::LayerTreeHost::LayerTreeHost with bubblewrap sandbox enabled
https://bugs.webkit.org/show_bug.cgi?id=209106

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-26
Reviewed by Carlos Garcia Campos.

Don't bind the WaylandCompositor socket unless we're running under Wayland and it's actually
started successfully.

* UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
(WebKit::bindWayland):


  Commit: 5b26e44b8ce707cf861625aa6c5304a44af5b9fc
      https://github.com/WebKit/WebKit/commit/5b26e44b8ce707cf861625aa6c5304a44af5b9fc
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merge r259110 - Update Chrome and Firefox versions in user agent quirks
https://bugs.webkit.org/show_bug.cgi?id=209631

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-27
Reviewed by Carlos Garcia Campos.

* platform/UserAgentQuirks.cpp:
(WebCore::UserAgentQuirks::stringForQuirk):


  Commit: 65279da329e90d31ac3cbdea80e8886e0ddd32f9
      https://github.com/WebKit/WebKit/commit/65279da329e90d31ac3cbdea80e8886e0ddd32f9
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/GStreamerCommon.h
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r259113 - [WPE] Unnecessary gl synchronization when using an OpenMAX video decoder and GLES2
https://bugs.webkit.org/show_bug.cgi?id=209647

Reviewed by Adrian Perez de Castro.

Don't perform the call to gst_gl_sync_meta_wait_cpu() when using an OpenMAX decoder,
as we don't need synchronization in that case and the internal call to glFinish()
casues an important fps drop.

* platform/graphics/gstreamer/GStreamerCommon.h:
* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::GstVideoFrameHolder::waitForCPUSync):
(WebCore::MediaPlayerPrivateGStreamer::createGSTPlayBin):


  Commit: ee542e0fdcfb58562d878631c61929fec7240897
      https://github.com/WebKit/WebKit/commit/ee542e0fdcfb58562d878631c61929fec7240897
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStore.cpp

  Log Message:
  -----------
  Merge r259380 - [GTK] [2.28.0] The Yelp build crashes if DISPLAY is not set
https://bugs.webkit.org/show_bug.cgi?id=209431

Reviewed by Carlos Alberto Lopez Perez.

Remove the assert when display is not X11 nor Wayland, and simply return false to ensure acceleration is not used.

* UIProcess/gtk/AcceleratedBackingStore.cpp:
(WebKit::AcceleratedBackingStore::checkRequirements):


  Commit: 2dde21d8ce783d9c2d986ca4fb438bc6de3e131b
      https://github.com/WebKit/WebKit/commit/2dde21d8ce783d9c2d986ca4fb438bc6de3e131b
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp

  Log Message:
  -----------
  Merge r259382 - [WPE][GTK] Public API should not allow trying to register a special URI scheme
https://bugs.webkit.org/show_bug.cgi?id=209900

Reviewed by Carlos Garcia Campos.

No new tests needed.

* UIProcess/API/glib/WebKitWebContext.cpp:
(webkit_web_context_register_uri_scheme): Use g_return_if_fail() to
check at the public API level whether the passed URI scheme is
special and bail out early.


  Commit: 479c7a3861a3f2b68d5004d82e59fa65bcfdd3fc
      https://github.com/WebKit/WebKit/commit/479c7a3861a3f2b68d5004d82e59fa65bcfdd3fc
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitWebContext.cpp

  Log Message:
  -----------
  Merge r259459 - Unreviewed fix after r259382

Rubber-stamped by Carlos Garcia Campos.

No new tests needed.

* UIProcess/API/glib/WebKitWebContext.cpp:
(webkit_web_context_register_uri_scheme): Change g_return_if_fail()
calls to actually check that the passed scheme is not one of the
special ones.


  Commit: c0bdc88177f8399baf351281d751ad34f2af7c10
      https://github.com/WebKit/WebKit/commit/c0bdc88177f8399baf351281d751ad34f2af7c10
  Author: Charlie Turner <cturner at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r259073 - [GStreamer] Fix missing NULL-check in setSyncOnClock
https://bugs.webkit.org/show_bug.cgi?id=209609

Unreviewed, simple fix.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::setSyncOnClock): Some systems are configured so that
audio sinks are not available. Make sure not to crash when asking
to sync with a NULL sink.


  Commit: 4420d3f8f4f86f9ba851707de4c7d49d441bd29a
      https://github.com/WebKit/WebKit/commit/4420d3f8f4f86f9ba851707de4c7d49d441bd29a
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/wpe/ScrollGestureController.cpp

  Log Message:
  -----------
  Merge r258831 - [WPE] AsyncScrolling: horizontal scrolling is inverted
https://bugs.webkit.org/show_bug.cgi?id=208638

Source/WebCore:

Patch by Carlos Garcia Campos <cgarcia at igalia.com> on 2020-03-23
Reviewed by Adrian Perez de Castro.

Scrolling down should scroll to the right and up to the left..

* page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.cpp:
(WebCore::ScrollingTreeFrameScrollingNodeNicosia::handleWheelEvent): Invert also the x axis.
* page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.cpp:
(WebCore::ScrollingTreeOverflowScrollingNodeNicosia::handleWheelEvent): Ditto.

Source/WebKit:

Patch by Chris Lord <clord at igalia.com> on 2020-03-23
Reviewed by Adrian Perez de Castro.

* UIProcess/API/wpe/ScrollGestureController.cpp:
(WebKit::ScrollGestureController::handleEvent):


  Commit: 2d50c33e8224f4ad2133135db4845ef2ae3c1236
      https://github.com/WebKit/WebKit/commit/2d50c33e8224f4ad2133135db4845ef2ae3c1236
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp

  Log Message:
  -----------
  Merge r259942 - [GTK][PSON] Crash in WaylandCompositor::Surface destructor with USE_WPE_RENDERER disabled
https://bugs.webkit.org/show_bug.cgi?id=209345

Reviewed by Michael Catanzaro.

In case of PSON the web page identifier can change fo the same web page proxy. When swapping processes the new
web page calls bindSurfaceToWebPage(), but we still have the web page proxy bound to the previous surface. We
just need to unbind the current surface before binding the new one.

* UIProcess/gtk/WaylandCompositor.cpp:
(WebKit::WaylandCompositor::bindSurfaceToWebPage):


  Commit: a301fa69dec1f19327861e486859350a96c84d2a
      https://github.com/WebKit/WebKit/commit/a301fa69dec1f19327861e486859350a96c84d2a
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/WaylandCompositor.cpp

  Log Message:
  -----------
  Merge r259943 - [GTK] Page is not drawn with PSON, hardware acceleration and address typed in URL bar
https://bugs.webkit.org/show_bug.cgi?id=208091

Reviewed by Michael Catanzaro.

This happens only when accelerated compositing mode policy is set to always. In this case, the
bindSurfaceToWebPage wayland message is received before the WebPageProxy has updated the web page identifier. We
should always check if there's a provisional page and get its web page identifier.

* UIProcess/gtk/WaylandCompositor.cpp:
(WebKit::WaylandCompositor::bindSurfaceToWebPage):


  Commit: 5beeedea8bc4147219231dc7d2029ce4654b06b4
      https://github.com/WebKit/WebKit/commit/5beeedea8bc4147219231dc7d2029ce4654b06b4
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/WebPopupMenuProxyGtk.cpp

  Log Message:
  -----------
  Merge r259944 - [GTK] Use gdk_window_move_to_rect() to position popup menus
https://bugs.webkit.org/show_bug.cgi?id=210069

Reviewed by Michael Catanzaro.

* UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
(WebKit::WebPopupMenuProxyGtk::showPopupMenu):


  Commit: cda82423923f3239b9c852575b8be443383261b1
      https://github.com/WebKit/WebKit/commit/cda82423923f3239b9c852575b8be443383261b1
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/NetworkProcess/cache/NetworkCache.cpp

  Log Message:
  -----------
  Merge r259712 - Ensure base cache path exists before calculating disk cache capacity
https://bugs.webkit.org/show_bug.cgi?id=209338

Reviewed by Adrian Perez de Castro.

The base cache path might not exist yet in Cache::open() since it's Storage::open() the one calling
FileSystem::makeAllDirectories() with the final cache directory. In such case, computeCapacity() fails because
FileSystem::getVolumeFreeSpace() needs an existing file.

* NetworkProcess/cache/NetworkCache.cpp:
(WebKit::NetworkCache::Cache::open):


  Commit: a1aca7b5b33cc63bebbb731b6c95d24811cccfc9
      https://github.com/WebKit/WebKit/commit/a1aca7b5b33cc63bebbb731b6c95d24811cccfc9
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Tools/ChangeLog
    M Tools/MiniBrowser/gtk/BrowserWindow.c

  Log Message:
  -----------
  Merge r259339 - [GTK] MiniBrowser: valgrind claims 'Invalid write of size 8' on close
https://bugs.webkit.org/show_bug.cgi?id=209471

Reviewed by Adrian Perez de Castro.

This is because we need to remove the weak pointer added in child windows to their parent.

* MiniBrowser/gtk/BrowserWindow.c:
(browserWindowDispose): Remove the parentWindow weak ref.
(browser_window_class_init): Add dispose.


  Commit: 854a20a9199ef904ebb1e63c51af3d0df69e483d
      https://github.com/WebKit/WebKit/commit/854a20a9199ef904ebb1e63c51af3d0df69e483d
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/GStreamerRegistryScanner.cpp

  Log Message:
  -----------
  Merge r258759 - [GStreamer] White-list vp09 in the codec registry
https://bugs.webkit.org/show_bug.cgi?id=209288

Reviewed by Xabier Rodriguez-Calvar.

* platform/graphics/gstreamer/GStreamerRegistryScanner.cpp:
(WebCore::GStreamerRegistryScanner::initialize):


  Commit: f3b48065933acaf26027aaa0d9137445c23cac17
      https://github.com/WebKit/WebKit/commit/f3b48065933acaf26027aaa0d9137445c23cac17
  Author: Žan Doberšek <zdobersek at igalia.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeFixedNode.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeOverflowScrollProxyNode.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreePositionedNode.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeStickyNode.cpp
    M Source/WebCore/platform/graphics/nicosia/NicosiaPlatformLayer.h
    M Source/WebCore/platform/graphics/nicosia/NicosiaSceneIntegration.cpp
    M Source/WebCore/platform/graphics/nicosia/NicosiaSceneIntegration.h
    M Source/WebCore/platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.h
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/LayerTreeHost.cpp
    M Source/WebKit/WebProcess/WebPage/CoordinatedGraphics/LayerTreeHost.h

  Log Message:
  -----------
  Merge r259284 - [GTK][WPE] Jumpy rendering of fixed-element layers while scrolling
https://bugs.webkit.org/show_bug.cgi?id=209466

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Avoid intermittent state application that can occur when asynchronous
scrolling is done on the dedicated thread while the general scene update
is being done in parallel on the composition thread, leading to partial
scrolling updates that visually present themselves as e.g. fixed
elements "jumping" around the view.

Instead of the staging state of a given Nicosia::CompositionLayer, the
scrolling nodes now update the base state with the given scrolling
change. At the end of the update, inside the UpdateScope descructor,
the updated states inside the scene are flushed into the staging phase
before they are adopted by the composition thread.

* page/scrolling/nicosia/ScrollingTreeFixedNode.cpp:
(WebCore::ScrollingTreeFixedNode::applyLayerPositions):
* page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.cpp:
(WebCore::ScrollingTreeFrameScrollingNodeNicosia::repositionScrollingLayers):
(WebCore::ScrollingTreeFrameScrollingNodeNicosia::repositionRelatedLayers):
* page/scrolling/nicosia/ScrollingTreeOverflowScrollProxyNode.cpp:
(WebCore::ScrollingTreeOverflowScrollProxyNode::applyLayerPositions):
* page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.cpp:
(WebCore::ScrollingTreeOverflowScrollingNodeNicosia::repositionScrollingLayers):
* page/scrolling/nicosia/ScrollingTreePositionedNode.cpp:
(WebCore::ScrollingTreePositionedNode::applyLayerPositions):
* page/scrolling/nicosia/ScrollingTreeStickyNode.cpp:
(WebCore::ScrollingTreeStickyNode::applyLayerPositions):
* platform/graphics/nicosia/NicosiaPlatformLayer.h:
(Nicosia::CompositionLayer::accessStaging): Deleted.
* platform/graphics/nicosia/NicosiaSceneIntegration.cpp:
(Nicosia::SceneIntegration::SceneIntegration):
(Nicosia::SceneIntegration::invalidate):
(Nicosia::SceneIntegration::UpdateScope::~UpdateScope):
* platform/graphics/nicosia/NicosiaSceneIntegration.h:
(Nicosia::SceneIntegration::create):
* platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:
(WebCore::CoordinatedGraphicsLayer::syncPosition):
Don't signal the related attribute delta flag since this change is now
strictly applied by the scrolling thread.
(WebCore::CoordinatedGraphicsLayer::syncBoundsOrigin): Ditto.

Source/WebKit:

Move the Nicosia::SceneIntegration ownership into the
CompositingCoordinator class, along with the SceneIntegration::Client
inheritance. LayerTreeHost in turn now implements the updateScene()
method that triggers a scene update when invoked.

* WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.cpp:
(WebKit::CompositingCoordinator::CompositingCoordinator):
(WebKit::CompositingCoordinator::invalidate):
(WebKit::CompositingCoordinator::attachLayer):
(WebKit::CompositingCoordinator::requestUpdate):
* WebProcess/WebPage/CoordinatedGraphics/CompositingCoordinator.h:
* WebProcess/WebPage/CoordinatedGraphics/LayerTreeHost.cpp:
(WebKit::LayerTreeHost::LayerTreeHost):
(WebKit::LayerTreeHost::~LayerTreeHost):
(WebKit::LayerTreeHost::updateScene):
(WebKit::LayerTreeHost::sceneIntegration): Deleted.
(WebKit::LayerTreeHost::requestUpdate): Deleted.
* WebProcess/WebPage/CoordinatedGraphics/LayerTreeHost.h:


  Commit: 667f1a04b549e5cb413df027be1433eb29bbdea4
      https://github.com/WebKit/WebKit/commit/667f1a04b549e5cb413df027be1433eb29bbdea4
  Author: Ting-Wei Lan <lantw44 at gmail.com>
  Date:   2020-04-12 (Sun, 12 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp
    M Source/WebCore/platform/glib/UserAgentGLib.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merge r258978 - [GTK] Add user agent quirk for auth.mayohr.com
https://bugs.webkit.org/show_bug.cgi?id=209378

Patch by Ting-Wei Lan <lantw44 at gmail.com> on 2020-03-25
Reviewed by Michael Catanzaro.

Source/WebCore:

This site blocks the login page completely and asks the user to download
Google Chrome when using our standard user agent. It only blocks the
login page. After logging in, it works fine without user agent quirks.

Note that it is required to hide Version/X from the user agent string
for the site to recognize it as a valid Chrome user agent. Since Chrome
itself does not use Version/X, it should be safe to modify the existing
quirk instead of adding a new one to handle it.

* platform/UserAgentQuirks.cpp:
(WebCore::urlRequiresChromeBrowser):
(WebCore::urlRequiresNoSafariVersion):
(WebCore::UserAgentQuirks::quirksForURL):
(WebCore::UserAgentQuirks::stringForQuirk):
* platform/UserAgentQuirks.h:
* platform/glib/UserAgentGLib.cpp:
(WebCore::buildUserAgentString):

Tools:

* TestWebKitAPI/Tests/WebCore/UserAgentQuirks.cpp:
(TestWebKitAPI::assertUserAgentForURLHasNoSafariVersionQuirk):
(TestWebKitAPI::TEST):


  Commit: abac6e8680f0dbf898072ff0ed5786533e7454a8
      https://github.com/WebKit/WebKit/commit/abac6e8680f0dbf898072ff0ed5786533e7454a8
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-04-13 (Mon, 13 Apr 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.28.1 release

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.28.1.


  Commit: 106f517e063b8bddeace328b2802ddfba553f7ae
      https://github.com/WebKit/WebKit/commit/106f517e063b8bddeace328b2802ddfba553f7ae
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-04-13 (Mon, 13 Apr 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.28.1 release

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.28.1.


  Commit: 21200803e7020cd41d4e4f20f69169bf56d70cb9
      https://github.com/WebKit/WebKit/commit/21200803e7020cd41d4e4f20f69169bf56d70cb9
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/PageBlock.h

  Log Message:
  -----------
  Merge r260179 - Unreviewed, set CeilingOnPageSize for MIPS64

This fixes a build failure ("Must set CeilingOnPageSize in
PageBlock.h").

* wtf/PageBlock.h:


  Commit: 8b9795ab0775451bf3c7c026b75b4489ee1bb317
      https://github.com/WebKit/WebKit/commit/8b9795ab0775451bf3c7c026b75b4489ee1bb317
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreWayland.cpp

  Log Message:
  -----------
  Merge r260244 - [GTK] UI process crash when entering compositing mode when WPE_RENDERER is enabled
https://bugs.webkit.org/show_bug.cgi?id=209118

Reviewed by Michael Catanzaro.

Check if EGL_WL_bind_wayland_display extension is available when using WPE_RENDERER, since we don't suport the
SHM interface.

* UIProcess/gtk/AcceleratedBackingStoreWayland.cpp:
(WebKit::AcceleratedBackingStoreWayland::checkRequirements): Return false if EGL_WL_bind_wayland_display is not present.


  Commit: ac0023e30d16cf39b1bba3db09cd0021836f91b0
      https://github.com/WebKit/WebKit/commit/ac0023e30d16cf39b1bba3db09cd0021836f91b0
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/WebPopupMenuProxyGtk.cpp

  Log Message:
  -----------
  Merge r260252 - [GTK][X11] REGRESSION(r259944): Wrong position of select popup menu in X11
https://bugs.webkit.org/show_bug.cgi?id=210603

Patch by Carlos Garcia Campos <cgarcia at igalia.com> on 2020-04-17
Reviewed by Michael Catanzaro.

gdk_window_move_to_rect expects the given rectangle in coordinates relative to the top-left corner of the window
that the popup window is transient for. We were using screen coordinates.

* UIProcess/gtk/WebPopupMenuProxyGtk.cpp:
(WebKit::WebPopupMenuProxyGtk::showPopupMenu): Translate widget coordinates to window coordinates before passing
the rectangle to gdk_window_move_to_rect().


  Commit: 7b7d9e490abbc43339bb278ee8af4743d0f719b3
      https://github.com/WebKit/WebKit/commit/7b7d9e490abbc43339bb278ee8af4743d0f719b3
  Author: Enrique Ocaña González <eocanha at igalia.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M LayoutTests/platform/wpe/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.h

  Log Message:
  -----------
  Merge r260506 - [GStreamer][MSE] Youtube 'live stream'/H264 URLs fail to play, VP8/9 URLs play OK
https://bugs.webkit.org/show_bug.cgi?id=209119

Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

The fix consists of removing the initial avoiding of seeking and just
issuing the proper segment instead of seeking (seeks in GStreamer can't
be done before prerolling anyway). Appsrc doesn't make easy to emit our
own custom segment, so what I did was to use a segment fixer probe to
modify the original [0, infinity] segment issued by appsrc and use
a [startTime, stopTime] with proper values depending on the seek target
and rate.

Covered by existing tests.

* platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.cpp:
(WebCore::checkShouldDelaySeek): Don't hold seeks on startup, when changing from READY to PAUSED.
(WebCore::MediaPlayerPrivateGStreamerMSE::doSeek): Refactored seek delay condition. Also, don't do a regular
gst_element_seek() for initial seeks, just proceed with a special case in that situation.
* platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.cpp:
(initialSeekSegmentFixerProbe): Probe that fixes the segment.
(webKitMediaSrcPrepareInitialSeek): Behave much like a regular seek, but also compute the right GstSegment, install
the segment fixer probe and setReadyForMoreSamples() on the SourceBufferPrivates.
* platform/graphics/gstreamer/mse/WebKitMediaSourceGStreamer.h:

LayoutTests:

Unskipped media/media-source/media-source-seek-redundant-append.html,
which passes now.

* platform/gtk/TestExpectations:
* platform/wpe/TestExpectations:


  Commit: caed9a9e8f3710e58230bd919004b3a7dc8aa8c3
      https://github.com/WebKit/WebKit/commit/caed9a9e8f3710e58230bd919004b3a7dc8aa8c3
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gtk/DisplayRefreshMonitorGtk.cpp

  Log Message:
  -----------
  Merge r260567 - [GTK] excessive wakeups/polling due to gdk_frame_clock_begin_updating
https://bugs.webkit.org/show_bug.cgi?id=210561

Reviewed by Žan Doberšek.

The problem is that we are destroying the display refresh monitor from the frame clock update callback, and GTK
schedules another update from the callback itself in some cases, which ends up happening forever. We were
assuming that destroying the window of immediately destroy the frame clock as well, but the paint source idle
keeps a reference of the frame clock. At the end of the source idle callback the source is scheduled again,
taking a new reference. We need to call gdk_frame_clock_end_updating() to ensure the idle is not scheduled
again.

* platform/graphics/gtk/DisplayRefreshMonitorGtk.cpp:
(WebCore::DisplayRefreshMonitorGtk::~DisplayRefreshMonitorGtk): Disconnect the update signal and call
gdk_frame_clock_end_updating().
(WebCore::DisplayRefreshMonitorGtk::requestRefreshCallback): Toplevel window should always have a frame clock,
so remove the early return and add an assert instead.


  Commit: 18ce569d43e84252cf97d9994643af7cd5655354
      https://github.com/WebKit/WebKit/commit/18ce569d43e84252cf97d9994643af7cd5655354
  Author: John Frankish <john.frankish at outlook.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/gtk/AcceleratedBackingStoreX11.cpp

  Log Message:
  -----------
  Merge r260570 - [GTK] Crash in cairo_surface_mark_dirty_rectangle() in accelerated compositing mode under X11
https://bugs.webkit.org/show_bug.cgi?id=210636

Patch by John Frankish <john.frankish at outlook.com> on 2020-04-23
Reviewed by Carlos Garcia Campos.

When cairo is configured to use xcb instead of xlib, it might use an image surface attached to the xlib one as
snapshot. In that case a flush is needed to detach that snapshot after we have drawn the surface in the
context.

* UIProcess/gtk/AcceleratedBackingStoreX11.cpp:
(WebKit::AcceleratedBackingStoreX11::paint): Call cairo_surface_flush() after drawing.


  Commit: b78eb1035d257c3070d0bf625e044ed225718a01
      https://github.com/WebKit/WebKit/commit/b78eb1035d257c3070d0bf625e044ed225718a01
  Author: Tadeu Zagallo <tzagallo at apple.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/wasm/regress/llint-callee-saves-with-fast-memory.js
    A JSTests/wasm/regress/llint-callee-saves-without-fast-memory.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/llint/WebAssembly.asm
    M Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp
    M Source/JavaScriptCore/wasm/WasmCallee.cpp
    M Source/JavaScriptCore/wasm/WasmCallingConvention.h
    M Source/JavaScriptCore/wasm/WasmLLIntPlan.cpp
    M Source/JavaScriptCore/wasm/WasmMemoryInformation.cpp

  Log Message:
  -----------
  Merge r256665 - [WASM] Wasm interpreter's calling convention doesn't match Wasm JIT's convention.
https://bugs.webkit.org/show_bug.cgi?id=207727

JSTests:

Reviewed by Mark Lam.

* wasm/regress/llint-callee-saves-with-fast-memory.js: Added.
* wasm/regress/llint-callee-saves-without-fast-memory.js: Added.

Source/JavaScriptCore:

Reviewed by Mark Lam.

The Wasm JIT has unusual calling conventions, which were further complicated by the addition
of the interpreter, and the interpreter did not correctly follow these conventions (by incorrectly
saving and restoring the callee save registers used for the memory base and size). Here's a summary
of the calling convention:

- When entering Wasm from JS, the wrapper must:
    - Preserve the base and size when entering LLInt regardless of the mode. (Prior to this
      patch we only preserved the base in Signaling mode)
    - Preserve the memory base in either mode, and the size for BoundsChecking.
- Both tiers must preserve every *other* register they use. e.g. the LLInt must preserve PB
  and wasmInstance, but must *not* preserve memoryBase and memorySize.
- Changes to memoryBase and memorySize are visible to the caller. This means that:
    - Intra-module calls can assume these registers are up-to-date even if the memory was
      resized. The only exception here is if the LLInt calls a signaling JIT, in which case
      the JIT will not update the size register, since it won't be using it.
    - Inter-module and JS calls require the caller to reload these registers. These calls may
      result in memory changes (e.g. the callee may call memory.grow).
    - A Signaling JIT caller must be aware that the LLInt may trash the size register, since
      it always bounds checks.

* llint/WebAssembly.asm:
* wasm/WasmAirIRGenerator.cpp:
(JSC::Wasm::AirIRGenerator::addCall):
* wasm/WasmB3IRGenerator.cpp:
(JSC::Wasm::B3IRGenerator::addCall):
* wasm/WasmCallee.cpp:
(JSC::Wasm::LLIntCallee::calleeSaveRegisters):
* wasm/WasmCallingConvention.h:
* wasm/WasmLLIntPlan.cpp:
(JSC::Wasm::LLIntPlan::didCompleteCompilation):
* wasm/WasmMemoryInformation.cpp:
(JSC::Wasm::PinnedRegisterInfo::get):
(JSC::Wasm::getPinnedRegisters): Deleted.


  Commit: 85464ac63305837876f3220c0589d923b7aef5c0
      https://github.com/WebKit/WebKit/commit/85464ac63305837876f3220c0589d923b7aef5c0
  Author: Tadeu Zagallo <tzagallo at apple.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M JSTests/ChangeLog
    M JSTests/wasm/regress/llint-callee-saves-with-fast-memory.js
    M JSTests/wasm/regress/llint-callee-saves-without-fast-memory.js

  Log Message:
  -----------
  Merge r256698 - Unreviewed: fix broken tests added in r256665
https://bugs.webkit.org/show_bug.cgi?id=207727

Our inline WAT doesn't seem to like named blocks/branch targets.

* wasm/regress/llint-callee-saves-with-fast-memory.js:
* wasm/regress/llint-callee-saves-without-fast-memory.js:


  Commit: a412e9c82b349a23ec7dbb3ab630a41dc63a4599
      https://github.com/WebKit/WebKit/commit/a412e9c82b349a23ec7dbb3ab630a41dc63a4599
  Author: Tadeu Zagallo <tzagallo at apple.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M JSTests/ChangeLog
    A JSTests/wasm/regress/regress-256665.js
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/wasm/js/WebAssemblyFunction.cpp

  Log Message:
  -----------
  Merge r256766 - [Wasm] REGRESSION(r256665): Wasm->JS call IC needs to save memory size register
https://bugs.webkit.org/show_bug.cgi?id=207849

Reviewed by Mark Lam.

JSTests:

* wasm/regress/regress-256665.js: Added.
(f):

Source/JavaScriptCore:

When generating the call IC, we should select the callee saves using BoundsChecking mode in order
to obey to the calling conventions described in r256665. Currently, we won't restore the memory size
register when calling the Wasm LLInt through the call IC.

* wasm/js/WebAssemblyFunction.cpp:
(JSC::WebAssemblyFunction::calleeSaves const):


  Commit: 536d4799f37e9218b9acbdb388418c8a1f3f000e
      https://github.com/WebKit/WebKit/commit/536d4799f37e9218b9acbdb388418c8a1f3f000e
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.28.2 release

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.28.2.


  Commit: 86bbab8b38550313bf4afbed47b722f0bb4cee01
      https://github.com/WebKit/WebKit/commit/86bbab8b38550313bf4afbed47b722f0bb4cee01
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-04-24 (Fri, 24 Apr 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.28.2 release

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.28.2.


  Commit: 34f4c35b4fc5c897155cadb962178a83c66d792f
      https://github.com/WebKit/WebKit/commit/34f4c35b4fc5c897155cadb962178a83c66d792f
  Author: Mark Lam <mark.lam at apple.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/ScriptController.cpp

  Log Message:
  -----------
  Merge r257746 - ScriptController::executeIfJavaScriptURL() uses wrong JSGlobalObject.
https://bugs.webkit.org/show_bug.cgi?id=208290
<rdar://problem/59839476>

Reviewed by Chris Dumez.

The call to executeScriptIgnoringException() may have changed the current global
object of the window.  We should be using the original global object that produced
the result string.

Also added a missing exception check needed after a potential rope resolution.

* bindings/js/ScriptController.cpp:
(WebCore::ScriptController::executeIfJavaScriptURL):


  Commit: ad5ca49ecfe626ef776cb51587624c44109cd913
      https://github.com/WebKit/WebKit/commit/ad5ca49ecfe626ef776cb51587624c44109cd913
  Author: Tadeu Zagallo <tzagallo at apple.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/dfg/DFGClobberize.h

  Log Message:
  -----------
  Merge r258452 - Missing arithMode for ArithAbs and ArithNegate in DFGClobberize
https://bugs.webkit.org/show_bug.cgi?id=208685
<rdar://problem/60115088>

Reviewed by Saam Barati.

In the pure case of ArithNegate and ArithAbs in DFGClobberize, their PureValues did not include their
respective ArithMode. That means that e.g. a CheckOverflow ArithNegate/Abs could be considered equivalent
to an Unchecked version of the same node.

Thanks to Samuel Groß of Google Project Zero for identifying this bug.

* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):


  Commit: 92691216d78c1a8e519871aae4c3942987ce96f2
      https://github.com/WebKit/WebKit/commit/92691216d78c1a8e519871aae4c3942987ce96f2
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/dom/SVGTransformList-anim-read-only-expected.txt
    A LayoutTests/svg/dom/SVGTransformList-anim-read-only.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/svg/SVGTransform.h
    M Source/WebCore/svg/properties/SVGProperty.h

  Log Message:
  -----------
  Merge r258459 - SVGMatrix should have the access right of its owner SVGTransform always
https://bugs.webkit.org/show_bug.cgi?id=207462

Reviewed by Simon Fraser.

Source/WebCore:

The SVGMatrix needs to be reattached to its owner SVGTransform when the
access right of this owner changes. The access right of the owner changes
when it gets attached to or detached from a higher level owner.

Test: svg/dom/SVGTransformList-anim-read-only.html

* svg/SVGTransform.h:
* svg/properties/SVGProperty.h:
(WebCore::SVGProperty::attach):
(WebCore::SVGProperty::detach):
(WebCore::SVGProperty::reattach):

LayoutTests:

* svg/dom/SVGTransformList-anim-read-only-expected.txt: Added.
* svg/dom/SVGTransformList-anim-read-only.html: Added.


  Commit: db9e362b6d2781f6207ac63de9cae1d6a97f7bbb
      https://github.com/WebKit/WebKit/commit/db9e362b6d2781f6207ac63de9cae1d6a97f7bbb
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/RenderLayer.h
    M Source/WebCore/rendering/RenderLayerFilters.cpp
    M Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp

  Log Message:
  -----------
  Merge r258278 - SVG filter triggers unstable layout.
https://bugs.webkit.org/show_bug.cgi?id=207444
rdar://problem/59297004

Reviewed by Simon Fraser.

SVG filter code marks DOM nodes dirty and schedules style recalc outside of the SVG root
while in layout. This could lead to unstable layout and cause battery drain.
(See webkit.org/b/208903)

* rendering/RenderLayer.cpp: Remove filterNeedsRepaint(). It's a dangerously misleading name and should
not be part of RenderLayer.
(WebCore::RenderLayer::calculateClipRects const):
* rendering/RenderLayer.h:
* rendering/RenderLayerFilters.cpp:
(WebCore::RenderLayerFilters::notifyFinished):
* rendering/svg/RenderSVGResourceContainer.cpp:
(WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
(WebCore::RenderSVGResourceContainer::markAllClientLayersForInvalidation):


  Commit: 634e819c252f83b92030352202958989504f7274
      https://github.com/WebKit/WebKit/commit/634e819c252f83b92030352202958989504f7274
  Author: David Kilzer <ddkilzer at webkit.org>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/http/tests/security/contentTypeOptions/nosniff-xml-external-entity-expected.txt
    A LayoutTests/http/tests/security/contentTypeOptions/nosniff-xml-external-entity.xhtml
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/MIMETypeRegistry.cpp
    M Source/WebCore/platform/MIMETypeRegistry.h
    M Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp

  Log Message:
  -----------
  Merge r258799 - Content-Type & Nosniff Ignored on XML External Entity Resources
<https://webkit.org/b/191171>
<rdar://problem/45763222>

Reviewed by Darin Adler.

Source/WebCore:

Test: http/tests/security/contentTypeOptions/nosniff-xml-external-entity.xhtml

* platform/MIMETypeRegistry.cpp:
(WebCore::MIMETypeRegistry::isXMLEntityMIMEType): Add.
* platform/MIMETypeRegistry.h:
(WebCore::MIMETypeRegistry::isXMLEntityMIMEType): Add.
- Checks for XML external entity MIME types.

* xml/parser/XMLDocumentParserLibxml2.cpp:
(WebCore::externalEntityMimeTypeAllowedByNosniff): Add.
- Checks whether the MIME type is valid based on the presence of
  the "X-Content-Type-Options: nosniff" header.
(WebCore::openFunc):
- Drop the contents of the resource that was returned and print
  an error message to the Web Inspector console if
  externalEntityMimeTypeAllowedByNosniff() says the MIME type is
  not allowed.

LayoutTests:

* http/tests/security/contentTypeOptions/nosniff-xml-external-entity-expected.txt: Add.
* http/tests/security/contentTypeOptions/nosniff-xml-external-entity.xhtml: Add.


  Commit: a41e7b33cd7a3b507e965aeb29f5b6dd929994a3
      https://github.com/WebKit/WebKit/commit/a41e7b33cd7a3b507e965aeb29f5b6dd929994a3
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/runtime/StructureInlines.h
    M Source/WebCore/ChangeLog
    M Source/WebCore/bindings/js/JSDOMWindowProperties.h
    M Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
    M Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.h
    M Source/WebCore/bindings/scripts/test/JS/JSMapLike.h
    M Source/WebCore/bindings/scripts/test/JS/JSReadOnlyMapLike.h
    M Source/WebCore/bindings/scripts/test/JS/JSReadOnlySetLike.h
    M Source/WebCore/bindings/scripts/test/JS/JSSetLike.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestCallTracer.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestDOMJIT.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestEnabledBySetting.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestEnabledForContext.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestException.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestIterable.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterCallWith.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterThrowingException.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestNode.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestPluginInterface.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestPromiseRejectionEvent.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestSerializationIndirectInheritance.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestSerializationInherit.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestSerializationInheritFinal.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestStringifier.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestStringifierNamedOperation.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.h
    M Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h

  Log Message:
  -----------
  Merge r259355 - Bindings that override getOwnPropertySlotByIndex need to say they MayHaveIndexedAccessors
https://bugs.webkit.org/show_bug.cgi?id=209762

Reviewed by Darin Adler.

Source/JavaScriptCore:

Change indexingType to indexingModeIncludingHistory to more
clearly indicate the expected range of possible valid values.

* runtime/StructureInlines.h:
(JSC::Structure::create):

Source/WebCore:

There may be places where we rely on this for semantic
correctness. I couldn't find any right now but we might as
well be conservative since this isn't a performance regression.

* bindings/js/JSDOMWindowProperties.h:
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
* bindings/scripts/test/JS/JSInterfaceName.h:
(WebCore::JSInterfaceName::createStructure):
* bindings/scripts/test/JS/JSMapLike.h:
(WebCore::JSMapLike::createStructure):
* bindings/scripts/test/JS/JSReadOnlyMapLike.h:
(WebCore::JSReadOnlyMapLike::createStructure):
* bindings/scripts/test/JS/JSReadOnlySetLike.h:
(WebCore::JSReadOnlySetLike::createStructure):
* bindings/scripts/test/JS/JSSetLike.h:
(WebCore::JSSetLike::createStructure):
* bindings/scripts/test/JS/JSTestActiveDOMObject.h:
(WebCore::JSTestActiveDOMObject::createStructure):
* bindings/scripts/test/JS/JSTestCEReactions.h:
(WebCore::JSTestCEReactions::createStructure):
* bindings/scripts/test/JS/JSTestCEReactionsStringifier.h:
(WebCore::JSTestCEReactionsStringifier::createStructure):
* bindings/scripts/test/JS/JSTestCallTracer.h:
(WebCore::JSTestCallTracer::createStructure):
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
(WebCore::JSTestClassWithJSBuiltinConstructor::createStructure):
* bindings/scripts/test/JS/JSTestDOMJIT.h:
(WebCore::JSTestDOMJIT::createStructure):
* bindings/scripts/test/JS/JSTestEnabledBySetting.h:
(WebCore::JSTestEnabledBySetting::createStructure):
* bindings/scripts/test/JS/JSTestEnabledForContext.h:
(WebCore::JSTestEnabledForContext::createStructure):
* bindings/scripts/test/JS/JSTestEventConstructor.h:
(WebCore::JSTestEventConstructor::createStructure):
* bindings/scripts/test/JS/JSTestEventTarget.h:
(WebCore::JSTestEventTarget::createStructure):
* bindings/scripts/test/JS/JSTestException.h:
(WebCore::JSTestException::createStructure):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
(WebCore::JSTestGenerateIsReachable::createStructure):
* bindings/scripts/test/JS/JSTestGlobalObject.h:
(WebCore::JSTestGlobalObject::createStructure):
* bindings/scripts/test/JS/JSTestIndexedSetterNoIdentifier.h:
* bindings/scripts/test/JS/JSTestIndexedSetterThrowingException.h:
(WebCore::JSTestIndexedSetterThrowingException::createStructure):
* bindings/scripts/test/JS/JSTestIndexedSetterWithIdentifier.h:
* bindings/scripts/test/JS/JSTestInterface.h:
* bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.h:
(WebCore::JSTestInterfaceLeadingUnderscore::createStructure):
* bindings/scripts/test/JS/JSTestIterable.h:
(WebCore::JSTestIterable::createStructure):
* bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
(WebCore::JSTestJSBuiltinConstructor::createStructure):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
(WebCore::JSTestMediaQueryListListener::createStructure):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterNoIdentifier.h:
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterThrowingException.h:
(WebCore::JSTestNamedAndIndexedSetterThrowingException::createStructure):
* bindings/scripts/test/JS/JSTestNamedAndIndexedSetterWithIdentifier.h:
* bindings/scripts/test/JS/JSTestNamedConstructor.h:
(WebCore::JSTestNamedConstructor::createStructure):
* bindings/scripts/test/JS/JSTestNamedDeleterNoIdentifier.h:
* bindings/scripts/test/JS/JSTestNamedDeleterThrowingException.h:
(WebCore::JSTestNamedDeleterThrowingException::createStructure):
* bindings/scripts/test/JS/JSTestNamedDeleterWithIdentifier.h:
* bindings/scripts/test/JS/JSTestNamedDeleterWithIndexedGetter.h:
(WebCore::JSTestNamedDeleterWithIndexedGetter::createStructure):
* bindings/scripts/test/JS/JSTestNamedGetterCallWith.h:
(WebCore::JSTestNamedGetterCallWith::createStructure):
* bindings/scripts/test/JS/JSTestNamedGetterNoIdentifier.h:
* bindings/scripts/test/JS/JSTestNamedGetterWithIdentifier.h:
* bindings/scripts/test/JS/JSTestNamedSetterNoIdentifier.h:
* bindings/scripts/test/JS/JSTestNamedSetterThrowingException.h:
(WebCore::JSTestNamedSetterThrowingException::createStructure):
* bindings/scripts/test/JS/JSTestNamedSetterWithIdentifier.h:
* bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetter.h:
(WebCore::JSTestNamedSetterWithIndexedGetter::createStructure):
* bindings/scripts/test/JS/JSTestNamedSetterWithIndexedGetterAndSetter.h:
(WebCore::JSTestNamedSetterWithIndexedGetterAndSetter::createStructure):
* bindings/scripts/test/JS/JSTestNamedSetterWithOverrideBuiltins.h:
(WebCore::JSTestNamedSetterWithOverrideBuiltins::createStructure):
* bindings/scripts/test/JS/JSTestNamedSetterWithUnforgableProperties.h:
(WebCore::JSTestNamedSetterWithUnforgableProperties::createStructure):
* bindings/scripts/test/JS/JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins.h:
(WebCore::JSTestNamedSetterWithUnforgablePropertiesAndOverrideBuiltins::createStructure):
* bindings/scripts/test/JS/JSTestNode.h:
* bindings/scripts/test/JS/JSTestObj.h:
(WebCore::JSTestObj::createStructure):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
(WebCore::JSTestOverloadedConstructors::createStructure):
* bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.h:
(WebCore::JSTestOverloadedConstructorsWithSequence::createStructure):
* bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
(WebCore::JSTestOverrideBuiltins::createStructure):
* bindings/scripts/test/JS/JSTestPluginInterface.h:
(WebCore::JSTestPluginInterface::createStructure):
* bindings/scripts/test/JS/JSTestPromiseRejectionEvent.h:
(WebCore::JSTestPromiseRejectionEvent::createStructure):
* bindings/scripts/test/JS/JSTestSerialization.h:
(WebCore::JSTestSerialization::createStructure):
* bindings/scripts/test/JS/JSTestSerializationIndirectInheritance.h:
(WebCore::JSTestSerializationIndirectInheritance::createStructure):
* bindings/scripts/test/JS/JSTestSerializationInherit.h:
(WebCore::JSTestSerializationInherit::createStructure):
* bindings/scripts/test/JS/JSTestSerializationInheritFinal.h:
(WebCore::JSTestSerializationInheritFinal::createStructure):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
(WebCore::JSTestSerializedScriptValueInterface::createStructure):
* bindings/scripts/test/JS/JSTestStringifier.h:
(WebCore::JSTestStringifier::createStructure):
* bindings/scripts/test/JS/JSTestStringifierAnonymousOperation.h:
(WebCore::JSTestStringifierAnonymousOperation::createStructure):
* bindings/scripts/test/JS/JSTestStringifierNamedOperation.h:
(WebCore::JSTestStringifierNamedOperation::createStructure):
* bindings/scripts/test/JS/JSTestStringifierOperationImplementedAs.h:
(WebCore::JSTestStringifierOperationImplementedAs::createStructure):
* bindings/scripts/test/JS/JSTestStringifierOperationNamedToString.h:
(WebCore::JSTestStringifierOperationNamedToString::createStructure):
* bindings/scripts/test/JS/JSTestStringifierReadOnlyAttribute.h:
(WebCore::JSTestStringifierReadOnlyAttribute::createStructure):
* bindings/scripts/test/JS/JSTestStringifierReadWriteAttribute.h:
(WebCore::JSTestStringifierReadWriteAttribute::createStructure):
* bindings/scripts/test/JS/JSTestTypedefs.h:
(WebCore::JSTestTypedefs::createStructure):


  Commit: 2fdcb81e1e2e00389e44fdaf0e8da87d26187a37
      https://github.com/WebKit/WebKit/commit/2fdcb81e1e2e00389e44fdaf0e8da87d26187a37
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/updating/RenderTreeBuilderFirstLetter.cpp

  Log Message:
  -----------
  Merge r259798 - Use more WeakPtr in RenderTreeBuilder::FirstLetter
https://bugs.webkit.org/show_bug.cgi?id=210251
<rdar://problem/61180381>

Reviewed by Zalan Bujtas.

For safety.

* rendering/updating/RenderTreeBuilderFirstLetter.cpp:
(WebCore::RenderTreeBuilder::FirstLetter::createRenderers):


  Commit: 260ae71997826d2d1c36f9de3f671b543c878ccb
      https://github.com/WebKit/WebKit/commit/260ae71997826d2d1c36f9de3f671b543c878ccb
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

  Log Message:
  -----------
  Merge r262368 - [WPE][GTK] pthread_create() fails with EPERM in the second WebKitWebProcess with sandbox on
https://bugs.webkit.org/show_bug.cgi?id=212380

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-06-01
Reviewed by Adrian Perez de Castro.

Dereference scmp_arg_cmp before use.

* UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
(WebKit::setupSeccomp):


  Commit: 05714b29ce6c0a3f0b31e008f62a4bec53a64cec
      https://github.com/WebKit/WebKit/commit/05714b29ce6c0a3f0b31e008f62a4bec53a64cec
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Platform/IPC/unix/UnixMessage.h

  Log Message:
  -----------
  Merge r259037 - Syscall param sendmsg(msg.msg_iov[0]) points to uninitialised byte(s) in IPC::Connection::sendOutgoingMessage
https://bugs.webkit.org/show_bug.cgi?id=146729

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-03-26
Reviewed by Carlos Garcia Campos.

The entire MessageInfo is passed to write(), so we have to zero the padding bytes to avoid
writing uninitialized memory.

* Platform/IPC/unix/UnixMessage.h:
(IPC::MessageInfo::MessageInfo):


  Commit: d9e61f162c499f7f3e04a83426ad1b14cb6d70ac
      https://github.com/WebKit/WebKit/commit/d9e61f162c499f7f3e04a83426ad1b14cb6d70ac
  Author: Chris Lord <clord at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.cpp
    M Source/WebCore/page/scrolling/ScrollingTreeScrollingNode.h
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.h
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.h
    M Source/WebCore/platform/ScrollAnimationKinetic.cpp
    M Source/WebCore/platform/ScrollAnimationKinetic.h
    M Source/WebCore/platform/generic/ScrollAnimatorGeneric.cpp
    M Source/WebCore/platform/generic/ScrollAnimatorGeneric.h
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/NativeWebWheelEvent.h
    M Source/WebKit/Shared/WebEvent.h
    M Source/WebKit/Shared/WebWheelEvent.cpp
    M Source/WebKit/Shared/libwpe/NativeWebWheelEventLibWPE.cpp
    M Source/WebKit/Shared/libwpe/WebEventFactory.cpp
    M Source/WebKit/Shared/libwpe/WebEventFactory.h
    M Source/WebKit/UIProcess/API/wpe/PageClientImpl.cpp
    M Source/WebKit/UIProcess/API/wpe/ScrollGestureController.cpp
    M Source/WebKit/UIProcess/API/wpe/ScrollGestureController.h
    M Source/WebKit/UIProcess/API/wpe/WPEView.cpp

  Log Message:
  -----------
  Merge r259112 - [GTK][WPE] Enable kinetic scrolling with async rendering
https://bugs.webkit.org/show_bug.cgi?id=209230

Reviewed by Žan Doberšek.

Refactor ScrollAnimationKinetic so that it no longer depends on
ScrollableArea, uses RunLoop::Timer and is responsible for tracking
the history of scroll events. This allows it to be used in
ScrollingTree*ScrollingNodeNicosia to provide kinetic scrolling when
async scrolling is enabled, on GTK and WPE.

No new tests, this just enables existing functionality in more situations.

* page/scrolling/ScrollingTreeScrollingNode.cpp:
(WebCore::ScrollingTreeScrollingNode::scrollTo):
* page/scrolling/ScrollingTreeScrollingNode.h:
* page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.cpp:
(WebCore::ScrollingTreeFrameScrollingNodeNicosia::ScrollingTreeFrameScrollingNodeNicosia):
(WebCore::ScrollingTreeFrameScrollingNodeNicosia::handleWheelEvent):
(WebCore::ScrollingTreeFrameScrollingNodeNicosia::stopScrollAnimations):
* page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.h:
* page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.cpp:
(WebCore::ScrollingTreeOverflowScrollingNodeNicosia::ScrollingTreeOverflowScrollingNodeNicosia):
(WebCore::ScrollingTreeOverflowScrollingNodeNicosia::handleWheelEvent):
(WebCore::ScrollingTreeOverflowScrollingNodeNicosia::stopScrollAnimations):
* page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.h:
* platform/ScrollAnimationKinetic.cpp:
(WebCore::ScrollAnimationKinetic::ScrollAnimationKinetic):
(WebCore::ScrollAnimationKinetic::appendToScrollHistory):
(WebCore::ScrollAnimationKinetic::clearScrollHistory):
(WebCore::ScrollAnimationKinetic::computeVelocity):
(WebCore::ScrollAnimationKinetic::start):
* platform/ScrollAnimationKinetic.h:
* platform/generic/ScrollAnimatorGeneric.cpp:
(WebCore::ScrollAnimatorGeneric::ScrollAnimatorGeneric):
(WebCore::ScrollAnimatorGeneric::scrollToOffsetWithoutAnimation):
(WebCore::ScrollAnimatorGeneric::handleWheelEvent):
(WebCore::ScrollAnimatorGeneric::willEndLiveResize):
(WebCore::ScrollAnimatorGeneric::didAddVerticalScrollbar):
(WebCore::ScrollAnimatorGeneric::didAddHorizontalScrollbar):
* platform/generic/ScrollAnimatorGeneric.h:

Source/WebKit:
[GTK][WPE] Enable kinetic scrolling with async scrolling
https://bugs.webkit.org/show_bug.cgi?id=209230

Reviewed by Žan Doberšek.

Modify WPE mousewheel event delivery so that it includes the necessary
phases needed to infer press/release times and allow for kinetic
scrolling.

* Shared/NativeWebWheelEvent.h:
* Shared/WebEvent.h:
* Shared/WebWheelEvent.cpp:
(WebKit::WebWheelEvent::encode const):
(WebKit::WebWheelEvent::decode):
* Shared/libwpe/NativeWebWheelEventLibWPE.cpp:
(WebKit::NativeWebWheelEvent::NativeWebWheelEvent):
* Shared/libwpe/WebEventFactory.cpp:
(WebKit::WebEventFactory::createWebWheelEvent):
* Shared/libwpe/WebEventFactory.h:
* UIProcess/API/wpe/PageClientImpl.cpp:
(WebKit::PageClientImpl::doneWithTouchEvent):
* UIProcess/API/wpe/ScrollGestureController.cpp:
(WebKit::ScrollGestureController::handleEvent):
* UIProcess/API/wpe/ScrollGestureController.h:
(WebKit::ScrollGestureController::phase):
* UIProcess/API/wpe/WPEView.cpp:
(WKWPE::m_backend):


  Commit: 835a8b68cfc2d7d7397dddd0f01dc5e8df2f8a60
      https://github.com/WebKit/WebKit/commit/835a8b68cfc2d7d7397dddd0f01dc5e8df2f8a60
  Author: Don Olmstead <don.olmstead at sony.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/ScrollAnimationKinetic.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/WebEvent.h
    M Source/WebKit/Shared/WebWheelEvent.cpp

  Log Message:
  -----------
  Merge r259325 - [PlayStation] Fix build breaks after r259112
https://bugs.webkit.org/show_bug.cgi?id=209830

Unreviewed build fix.

Source/WebCore:

Add USE(GLIB) guards around RunLoopSourcePriority usage.

* platform/ScrollAnimationKinetic.cpp:
(WebCore::ScrollAnimationKinetic::ScrollAnimationKinetic):

Source/WebKit:

Replace PLATFORM(WPE) with USE(LIBWPE) within WebWheelEvent.

* Shared/WebEvent.h:
* Shared/WebWheelEvent.cpp:
(WebKit::WebWheelEvent::encode const):
(WebKit::WebWheelEvent::decode):


  Commit: f62d3fb42bf23beaf15b4dfacddce0798ed7f056
      https://github.com/WebKit/WebKit/commit/f62d3fb42bf23beaf15b4dfacddce0798ed7f056
  Author: Alexander Mikhaylenko <alexm at gnome.org>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.cpp
    M Source/WebCore/page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.cpp
    M Source/WebCore/platform/generic/ScrollAnimatorGeneric.cpp

  Log Message:
  -----------
  Merge r263838 - [GTK] Kinetic scrolling is still triggered if you wait before lifting fingers
https://bugs.webkit.org/show_bug.cgi?id=213789

Patch by Alexander Mikhaylenko <alexm at gnome.org> on 2020-07-02
Reviewed by Carlos Garcia Campos.

The intended behavior for kinetic scrolling is that it's possible to not trigger it by
stopping moving fingers before lifting them, as opposed to doing a fling/swipe. However,
right now it's broken and trying to do this triggers kinetic scrolling as well.

Currently, the last scroll event with (0, 0) deltas isn't added to the scroll history for
kinetic scrolling. However, this is wrong, because the last event, or rather the timespan
between it and the previous scroll event, actually determines the kinetic scrolling velocity:
if this event follows the previous one quickly, the velocity is large, but if there was a long
pause, the velocity would be close to 0.

See https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1902 and
https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/1903 for the equivalent GTK fixes.

* page/scrolling/nicosia/ScrollingTreeFrameScrollingNodeNicosia.cpp:
(WebCore::ScrollingTreeFrameScrollingNodeNicosia::handleWheelEvent):
* page/scrolling/nicosia/ScrollingTreeOverflowScrollingNodeNicosia.cpp:
(WebCore::ScrollingTreeOverflowScrollingNodeNicosia::handleWheelEvent):
* platform/generic/ScrollAnimatorGeneric.cpp:
(WebCore::ScrollAnimatorGeneric::handleWheelEvent):


  Commit: 5b18ab6c098c514a4836ca6b974b3a420f6e07b5
      https://github.com/WebKit/WebKit/commit/5b18ab6c098c514a4836ca6b974b3a420f6e07b5
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/DataMutex.h
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WTF/DataMutex.cpp

  Log Message:
  -----------
  Merge r259879 - [WTF] DataMutex: Add runUnlocked()
https://bugs.webkit.org/show_bug.cgi?id=209811

Reviewed by Xabier Rodriguez-Calvar.

Source/WTF:

This patch introduces a runUnlocked() method in WTF::DataMutex::LockedWrapper
to run a lambda function without the lock. This is intended to be used for
small sections of the code that need to be unlocked, in cases where using
scoping would prove non-ergonomic or where running the unlocked section is only
necessary or desired when a certain condition is met -- something that cannot
be done with C++ scoping.

Safety mechanisms are provided. First, because this is used with a lambda, all
variables to be used in the unlocked section have to be specified in the
capture (global capture is possible but not recommended to simplify analysis).
Second, additional checks have been added to DataMutex to detect unlocked
accesses among other conditions. This will detect among other things naive
access to protected members by means of capturing the LockedWrapper by
reference.

* wtf/DataMutex.h:
(WTF::OwnerAwareLockAdapter::lock):
(WTF::OwnerAwareLockAdapter::unlock):
(WTF::OwnerAwareLockAdapter::tryLock):
(WTF::OwnerAwareLockAdapter::isLocked const):
(WTF::DataMutex::LockedWrapper::operator->):
(WTF::DataMutex::LockedWrapper::operator*):
(WTF::DataMutex::LockedWrapper::mutex):
(WTF::DataMutex::LockedWrapper::lockHolder):
(WTF::DataMutex::LockedWrapper::runUnlocked):

Tools:

Tests for runUnlocked() and DataMutex checks are introduced.

* TestWebKitAPI/Tests/WTF/DataMutex.cpp:
(TestWebKitAPI::TEST):


  Commit: 6ecca11ff8f3eb00caab3cbf54d3493ce722cedf
      https://github.com/WebKit/WebKit/commit/6ecca11ff8f3eb00caab3cbf54d3493ce722cedf
  Author: Carlos Alberto Lopez Perez <clopez at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp
    M Source/WebCore/platform/gtk/PlatformScreenGtk.cpp
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/API/glib/WebKitUIClient.cpp
    M Tools/ChangeLog
    M Tools/TestWebKitAPI/Tests/WebKitGLib/TestUIClient.cpp

  Log Message:
  -----------
  Merge r260176 - [GTK] MiniBrowser opens new windows too small causing failures on some WPT tests
https://bugs.webkit.org/show_bug.cgi?id=210206

Reviewed by Carlos Garcia Campos.

Source/WebCore:

Some WPT tests (when executed with the WPT runner via WebDriver)
open new browser windows via JavaScript invoking Window.open()
and then run the test on this new window.
The size of the new window is not specified, and we were failing
to provide a default window size, so it was using the minimum of
100x100 which its just too small for some test that later call
document.elementFromPoint() on some coordinates
that are outside of that size.

To fix that provide the size of the default GTK window to WebCore
if the application sets one via gtk_window_set_default_size().
And if not, then use the size of the previous window.

Also change the way we position the new window to work better when
the system uses more than one monitor. Previously to get the default
coordinates of the new window we were using gdk_display_get_monitor()
with just the first monitor available.
This causes issues in the calculation of the available space when
using several monitors. Instead get the monitor in use by looking
at the current GDK root window.

Tests: TestWebKitAPI/WebKit2Gtk/TestUIClient:/webkit/WebKitWebView/open-window-default-size
and TestWebKitAPI/WebKit2Gtk/TestUIClient:/webkit/WebKitWebView/open-window-no-default-size

* loader/FrameLoader.cpp:
(WebCore::createWindow):
* platform/gtk/PlatformScreenGtk.cpp:
(WebCore::getCurrentScreenMonitor):
(WebCore::screenRect):
(WebCore::screenAvailableRect):

Source/WebKit:

Provide the size of the default window (if is set) when windowRect is called
before the window is shown.

* UIProcess/API/glib/WebKitUIClient.cpp:

Tools:

Add two API test to check that window.open() by default gets a size
request equal to the old window if there is no default window size,
or to the default window if there is a default window size.

A new function helper setCreateNewWebViewsInWindowsWithDefaultSize()
its added to create new webviews in new windows automatically, which
its needed to test the case of having a default window size.

* TestWebKitAPI/Tests/WebKitGLib/TestUIClient.cpp:
(testWebViewWindowProperties):
(testWebViewOpenWindowDefaultSize):
(testWebViewOpenWindowNoDefaultSize):
(beforeAll):


  Commit: 28230299e159034f990bffc4c468c452a461df0f
      https://github.com/WebKit/WebKit/commit/28230299e159034f990bffc4c468c452a461df0f
  Author: Alberto Garcia <berto at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/PlatformDisplay.cpp

  Log Message:
  -----------
  Merge r260750 - [GTK] [2.28.0] The Yelp build crashes if DISPLAY is not set
https://bugs.webkit.org/show_bug.cgi?id=209431

Reviewed by Carlos Garcia Campos.

Don't create a PlatformDisplayLibWPE as a fallback when using
Wayland or X11.

* platform/graphics/PlatformDisplay.cpp:
(WebCore::PlatformDisplay::createPlatformDisplay):


  Commit: fdb613e1c2dceae322452f69d67881feb08f1cc5
      https://github.com/WebKit/WebKit/commit/fdb613e1c2dceae322452f69d67881feb08f1cc5
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.h
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.h

  Log Message:
  -----------
  Merge r260755 - [GStreamer] Rework WebKitWebSrc threading
Source/WebCore:

https://bugs.webkit.org/show_bug.cgi?id=210284

Reviewed by Xabier Rodriguez-Calvar.

WebKitWebSrc as it is in master has a number of race conditions
leading to occasional starvation (due to cancelling the wrong request)
or data corruption (due to pushing data from a cancelled request).

The threading situation wasn't easy to follow, as it wasn't clear
access to what members should be protected by what mutex, in what
circumstances. Also, some parts of the design were also introducing
addicional complexity, such as the first request being sent from the
main thread whereas the rest were being sent from the streaming thread
or basesrc async start.

In response, this patch reworks all the locking in WebKitWebSrc to use
WTF::DataMutex. This ensures all accesses to its (now explicit)
protected members are locked. The two mutexes and condition variables
have been simplified into one, as there was no obvious need or benefit
for two of each in this case.

Requests have been numbered, which allows to safely and atomically
ignore results from cancelled requests, avoiding data corruption
races, and makes following them in debug logs much easier.

The conditions for making and cancelling requests have been simplified
to a simpler and safer model: There is at most only one active request
at anytime, flushes cancel the request, and the first create() call
always makes the new request (both at startup and after a flush).
Debug asserts and notes about the flow of operations during basesrc
seeks have been provided.

As this effort needed a review of the entire WebKitWebSrc, cleanups,
corrections and documentation comments have been provided where
appropriate.

This patch introduces no visible behavior changes, just stability
improvements.

* platform/graphics/gstreamer/GRefPtrGStreamer.h:
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(WebKitWebSrcPrivate::~WebKitWebSrcPrivate):
(webkit_web_src_class_init):
(webkitWebSrcReset):
(webKitWebSrcConstructed):
(webKitWebSrcSetProperty):
(webKitWebSrcGetProperty):
(webKitWebSrcSetContext):
(webKitWebSrcSendEvent):
(restartLoaderIfNeeded):
(stopLoaderIfNeeded):
(webKitWebSrcCreate):
(webKitWebSrcStart):
(webKitWebSrcMakeRequest):
(webKitWebSrcStop):
(webKitWebSrcGetSize):
(webKitWebSrcIsSeekable):
(webKitWebSrcDoSeek):
(webKitWebSrcQuery):
(webKitWebSrcUnLock):
(webKitWebSrcUnLockStop):
(webKitWebSrcSetUri):
(webKitWebSrcSetMediaPlayer):
(webKitSrcPassedCORSAccessCheck):
(CachedResourceStreamingClient::CachedResourceStreamingClient):
(CachedResourceStreamingClient::checkUpdateBlocksize):
(CachedResourceStreamingClient::responseReceived):
(CachedResourceStreamingClient::dataReceived):
(CachedResourceStreamingClient::accessControlCheckFailed):
(CachedResourceStreamingClient::loadFailed):
(CachedResourceStreamingClient::loadFinished):
(webKitSrcWouldTaintOrigin):
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.h:

LayoutTests:

https://bugs.webkit.org/show_bug.cgi?id=209811

Reviewed by Xabier Rodriguez-Calvar.

A test improved its status in TestExpectations from the changes made
in this patch.

* platform/gtk/TestExpectations:


  Commit: ad8114bea92b392fdcfbc6323b159e7cd9e14297
      https://github.com/WebKit/WebKit/commit/ad8114bea92b392fdcfbc6323b159e7cd9e14297
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r260938 - Unreviewed, GStreamer build warning fix after r260755.

* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcMakeRequest): There is no need to capture src in the
closure, its protector is used instead.


  Commit: 0ec9474fc9f6ebcd670d696d83b40936e33f77ec
      https://github.com/WebKit/WebKit/commit/0ec9474fc9f6ebcd670d696d83b40936e33f77ec
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r260886 - [GStreamer] Switch to audiointerleave
https://bugs.webkit.org/show_bug.cgi?id=211124

Patch by Philippe Normand <pnormand at igalia.com> on 2020-04-29
Reviewed by Xabier Rodriguez-Calvar.

The audiointerleave element is a drop-in replacement of
interleave. It should behave a bit better in live.

No new tests, existing webaudio tests cover this change.

* platform/audio/gstreamer/WebKitWebAudioSourceGStreamer.cpp:
(webKitWebAudioSrcConstructed):
(webKitWebAudioSrcChangeState):


  Commit: fb27f85c2f23ea80b997bfd8c865949675ba24fb
      https://github.com/WebKit/WebKit/commit/fb27f85c2f23ea80b997bfd8c865949675ba24fb
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/PlatformMediaResourceLoader.h
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r260892 - PlatformMediaResourceLoader should be destroyed on the main thread
https://bugs.webkit.org/show_bug.cgi?id=211155

Reviewed by Xabier Rodriguez-Calvar.

PlatformMediaResourceLoader is only safe to use from the main thread.
A tricky detail is this includes its destruction. The same is true for
PlatformMediaResource.

Both classes are ThreadSafeRefCounted<> classes and therefore
WTF::DestructionThread::Main can be used to ensure destruction is run
in the correct thread with no need for additional client code.

* platform/graphics/PlatformMediaResourceLoader.h:
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(WebKitWebSrcPrivate::StreamingMembers::~StreamingMembers):


  Commit: 5d5f4574a5733e0692435e269a6ceea9f0ce8114
      https://github.com/WebKit/WebKit/commit/5d5f4574a5733e0692435e269a6ceea9f0ce8114
  Author: Alicia Boya Garcia <aboya at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/platform/gtk/TestExpectations
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r261165 - [GStreamer] Video loops when ran in rr record --chaos
https://bugs.webkit.org/show_bug.cgi?id=211182

Reviewed by Philippe Normand.

Source/WebCore:

While trying to investigate a different bug, I ran the browser with
`rr record --chaos`, which makes it run very slowly and shuffles
thread scheduling to try to make existing race conditions more likely
to show up, also inevitably making the software run very slow.

Doing so I found something strange: the video kept looping even though
it didn't have the `loop` attribute set.

After some debugging I found that MediaPlayer decides if the video has
ended in part by checking `currentMediaTime()` is greater or equal to
the video duration, which was not guaranteed to be the case in
MediaPlayerPrivateGStreamer.

As a consequence of this patch, one new LayoutTest has passed.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::playbackPosition const):

LayoutTests:

imported/w3c/web-platform-tests/media-source/mediasource-getvideoplaybackquality.html
is now passing.

* platform/gtk/TestExpectations:


  Commit: bce483f3b150eeeba725713e832c0e3e2e69b7f7
      https://github.com/WebKit/WebKit/commit/bce483f3b150eeeba725713e832c0e3e2e69b7f7
  Author: Daniel Kolesa <daniel at octaforge.org>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/GCMemoryOperations.h

  Log Message:
  -----------
  Merge r261326 - REGRESSION(r251875): Crash in JSC::StructureIDTable::get on ppc64le: gcSafeMemcpy broken on JSVALUE64 platforms other than x86_64 and aarch64
https://bugs.webkit.org/show_bug.cgi?id=210685

Patch by Daniel Kolesa <daniel at octaforge.org> on 2020-05-07
Reviewed by Michael Catanzaro.

Fix gcSafeMemcpy on non-x86_64/aarch64 64-bit architectures.

We were hitting an incorrect x86_64 assertion on values larger than
mediumCutoff on JSVALUE64 architectures other than x86_64 and aarch64,
as the control flow is wrong.

* heap/GCMemoryOperations.h:
(JSC::gcSafeMemcpy):


  Commit: c1dbea863ee72b956fe32afdb78e83d96baa8f4e
      https://github.com/WebKit/WebKit/commit/c1dbea863ee72b956fe32afdb78e83d96baa8f4e
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/media/video-src-blob-replay-expected.txt
    A LayoutTests/media/video-src-blob-replay.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp

  Log Message:
  -----------
  Merge r261550 - [GStreamer] Audio messages in web.whatsapp.com only play once.
https://bugs.webkit.org/show_bug.cgi?id=211627

Patch by Philippe Normand <pnormand at igalia.com> on 2020-05-12
Reviewed by Xabier Rodriguez-Calvar.

Source/WebCore:

Test: media/video-src-blob-replay.html

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::updateDownloadBufferingFlag): Make sure on-disk
buffering is disabled for blob URIs, because it messes up the pipeline for replays, and it's
useless for that use-case anyway.

LayoutTests:

* media/video-src-blob-replay-expected.txt: Added.
* media/video-src-blob-replay.html: Added.


  Commit: 6f9cf7b0d2942a00a7a97211079d89b341b5ab06
      https://github.com/WebKit/WebKit/commit/6f9cf7b0d2942a00a7a97211079d89b341b5ab06
  Author: Philippe Normand <pnormand at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
    M Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp

  Log Message:
  -----------
  Merge r261680 - [GStreamer] Can't replay blob videos in web.whatsapp.com
https://bugs.webkit.org/show_bug.cgi?id=192540

Patch by Philippe Normand <pnormand at igalia.com> on 2020-05-14
Reviewed by Xabier Rodriguez-Calvar.

This is a variant of bug 211627 but I could reproduce it only for videos. Unfortunately I
wasn't able to write a reliable test for this.

* platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
(WebCore::MediaPlayerPrivateGStreamer::updateBufferingStatus): Prevent the fill timer from
running forever after buffering completed.
* platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
(webKitWebSrcMakeRequest): Don't buffer blobs, this doesn't seem useful as they're already
in memory anyway.


  Commit: c7cc4bcb37c084fa296dd9093d7c03ec80942d3a
      https://github.com/WebKit/WebKit/commit/c7cc4bcb37c084fa296dd9093d7c03ec80942d3a
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/glib/ArgumentCodersGLib.cpp

  Log Message:
  -----------
  Merge r262242 - [WPE][GTK] GVariant decoding must copy the serialized data
https://bugs.webkit.org/show_bug.cgi?id=212441

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-05-28
Reviewed by Carlos Garcia Campos.

I tracked this down to ArgumentCodersGLib.cpp. The problem is that we construct a GVariant
using g_variant_new_from_data(), which does not copy or take ownership of the data, so here
we accidentally create the GVariant using data we don't own. (Here, the data is owned by the
Decoder itself in its internal m_buffer.) Anyway, this is fixable by manually copying and
freeing it with the GDestroyNotify parameter, but it's easier to switch to
g_variant_new_from_bytes() because GBytes takes ownership when constructed.

* Shared/glib/ArgumentCodersGLib.cpp:
(IPC::decode):


  Commit: a7f439ad70902cec90ff6561340c933d00da7076
      https://github.com/WebKit/WebKit/commit/a7f439ad70902cec90ff6561340c933d00da7076
  Author: Lauro Moura <lmoura at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/Shared/glib/ArgumentCodersGLib.cpp

  Log Message:
  -----------
  Merge r262274 - [GTK][WPE] Buildfix after r262242

Unreviewed build fix.

* Shared/glib/ArgumentCodersGLib.cpp:
(IPC::decode):


  Commit: bd2a893180da73e355707fed2379aabf09a51a33
      https://github.com/WebKit/WebKit/commit/bd2a893180da73e355707fed2379aabf09a51a33
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

  Log Message:
  -----------
  Merge r263899 - [WPE][GTK] Bubblewrap sandbox should not attempt to bind empty paths
https://bugs.webkit.org/show_bug.cgi?id=202880

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-07-03
Reviewed by Carlos Garcia Campos.

If an empty path is set in LD_LIBRARY_PATH (e.g. /foo::/bar), we wind up passing
--ro-bind-try   --ro-bind-try to bwrap, where the second --ro-bind-try is treated as the
source path to mount, and the next flag we pass gets treated as the destination path. The
web process crashes with this confusing error:

bwrap: Can't create file at /.flatpak-info: Read-only file system

* UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
(WebKit::bindIfExists):


  Commit: af9fb89a4b3f4385bbf04071c47c1ae047ea3234
      https://github.com/WebKit/WebKit/commit/af9fb89a4b3f4385bbf04071c47c1ae047ea3234
  Author: Simon Fraser <simon.fraser at apple.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/clip-path/clip-path-on-overflowing-expected.html
    A LayoutTests/svg/clip-path/clip-path-on-overflowing.html
    M LayoutTests/svg/clip-path/mask-nested-clip-path-010-expected.svg
    M LayoutTests/svg/clip-path/mask-nested-clip-path-010.svg
    A LayoutTests/svg/clip-path/resource-clipper-multiple-repaints-expected.html
    A LayoutTests/svg/clip-path/resource-clipper-multiple-repaints.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/RenderLayer.cpp
    M Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp
    M Source/WebCore/rendering/svg/RenderSVGResourceClipper.h

  Log Message:
  -----------
  Merge r259137 - Hovering over countries at https://covidinc.io/ shows bizarre rendering artifacts
https://bugs.webkit.org/show_bug.cgi?id=209635
<rdar://problem/60935010>

Reviewed by Said Abou-Hallawa.
Source/WebCore:

RenderSVGResourceClipper::applyClippingToContext() cached an ImageBuffer per RenderObject
when using a image buffer mask. However, the function created and rendered into this image buffer
using repaintRect, which can change between invocations. Painting with different repaintRects
is very common when rendering into page tiles.

The buffer can only be re-used if the inputs used to create the buffer (objectBoundingBox, absoluteTransform)
are the same, so store those and compare them when determining when to use the cached buffer, and
don't use repaintRect when setting up the buffer.

This revealed another problem where renderers with visual overflow could be truncated by
the clipping, tested by imported/mozilla/svg/svg-integration/clipPath-html-03.xhtml, which occurred
because RenderLayer::setupClipPath() used the 'svgReferenceBox' for the clipping bounds, which
is the content box of the renderer excluding overflow. Fix this by using the bounds of the layer,
which includes the bounds of descendants.

Tests: svg/clip-path/clip-path-on-overflowing.html
       svg/clip-path/resource-clipper-multiple-repaints.html

* rendering/RenderLayer.cpp:
(WebCore::RenderLayer::setupClipPath):
* rendering/svg/RenderSVGResourceClipper.cpp:
(WebCore::RenderSVGResourceClipper::removeAllClientsFromCache):
(WebCore::RenderSVGResourceClipper::applyClippingToContext):
(WebCore::RenderSVGResourceClipper::drawContentIntoMaskImage):
(WebCore::RenderSVGResourceClipper::addRendererToClipper):
(WebCore::RenderSVGResourceClipper::resourceBoundingBox):
* rendering/svg/RenderSVGResourceClipper.h:

LayoutTests:

Ref test that exercises the code path by painting into a tiled compositing
layer.

* svg/clip-path/clip-path-on-overflowing-expected.html: Added.
* svg/clip-path/clip-path-on-overflowing.html: Added.
* svg/clip-path/mask-nested-clip-path-010-expected.svg:
* svg/clip-path/mask-nested-clip-path-010.svg: Copied from imported/mozilla/svg/svg-integration/clipPath-html-03.xhtml,
and modified to have a non-zero offset for better testing of the clipping bounds computation.
* svg/clip-path/resource-clipper-multiple-repaints-expected.html: Added.
* svg/clip-path/resource-clipper-multiple-repaints.html: Added.


  Commit: 86bfe8a7b63ee92a6b644a911058a60685898447
      https://github.com/WebKit/WebKit/commit/86bfe8a7b63ee92a6b644a911058a60685898447
  Author: Miguel Gomez <magomez at igalia.com>
  Date:   2020-07-08 (Wed, 08 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp

  Log Message:
  -----------
  Merge r262194 - [WPE] REGRESSION(r253675) Crash when using threaded rendering
https://bugs.webkit.org/show_bug.cgi?id=212404

Reviewed by Carlos Garcia Campos.

Check whether the GraphicsContext has a PlatformGraphicsContext before trying to paint with
it. If there's no PlatformGraphicsContext, paint using the GraphicsContext methods instead.

* platform/graphics/cairo/ImageBufferCairoBackend.cpp:
(WebCore::ImageBufferCairoBackend::draw):
(WebCore::ImageBufferCairoBackend::drawPattern):


  Commit: 609f2537ceef55f80667462cb8f184b76ee1c21c
      https://github.com/WebKit/WebKit/commit/609f2537ceef55f80667462cb8f184b76ee1c21c
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-07-09 (Thu, 09 Jul 2020)

  Changed paths:
    M Source/WTF/ChangeLog
    M Source/WTF/wtf/glib/RunLoopSourcePriority.h

  Log Message:
  -----------
  Merge r264015 - [GTK] WebProcess hangs when browsing GitHub
https://bugs.webkit.org/show_bug.cgi?id=213970

Reviewed by Sergio Villar Senin.

Use a lower priority for LayerFlushTimer and DisplayRefreshMonitorTimer. We were using a very high priority for
drawing with the idea of keeping a good rendering performance without being affected by other timers. The
problem is that animations can be controlled by timers, so we need to ensure that MainThreadSharedTimer has
higher priority than drawing.

* wtf/glib/RunLoopSourcePriority.h: Use 110 for LayerFlushTimer and DisplayRefreshMonitorTimer.


  Commit: 2e858505c23bace30b171499de4e541c771c1aa9
      https://github.com/WebKit/WebKit/commit/2e858505c23bace30b171499de4e541c771c1aa9
  Author: Alex Christensen <achristensen at webkit.org>
  Date:   2020-07-09 (Thu, 09 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-backslash-expected.txt
    M LayoutTests/fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-backslash.html
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Downloads/DownloadProxy.cpp

  Log Message:
  -----------
  Merge r258741 - Sanitize suggested download filename received from web process
https://bugs.webkit.org/show_bug.cgi?id=209300
<rdar://problem/59487723>

Patch by Alex Christensen <achristensen at webkit.org> on 2020-03-19
Reviewed by Chris Dumez.

Source/WebKit:

* UIProcess/Downloads/DownloadProxy.cpp:
(WebKit::DownloadProxy::decideDestinationWithSuggestedFilenameAsync):

LayoutTests:

* fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-backslash-expected.txt:
* fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-backslash.html:


  Commit: dc3e44d375bc15ff119b0d94d6b7b045ed6af201
      https://github.com/WebKit/WebKit/commit/dc3e44d375bc15ff119b0d94d6b7b045ed6af201
  Author: Carlos Garcia Campos <cgarcia at igalia.com>
  Date:   2020-07-09 (Thu, 09 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/platform/gtk/fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-backslash-expected.txt
    A LayoutTests/platform/gtk/fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-doublequote-expected.txt
    M LayoutTests/platform/gtk/fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-slashes-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/network/soup/ResourceResponseSoup.cpp

  Log Message:
  -----------
  Merge r263388 - REGRESSION(r258741): [GTK] anchor-file-blob-download-includes-backslash.html is failing
https://bugs.webkit.org/show_bug.cgi?id=209329

Reviewed by Adrian Perez de Castro.

Source/WebCore:

Sanitize the suggested filename. We replace characters that can be problematic in filenames with '_' to match
what Chromium and Firefox do.

* platform/network/soup/ResourceResponseSoup.cpp:
(WebCore::sanitizeFilename):
(WebCore::ResourceResponse::platformSuggestedFilename const):

LayoutTests:

Rebaseline tests.

* platform/gtk/TestExpectations:
* platform/gtk/fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-backslash-expected.txt: Added.
* platform/gtk/fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-doublequote-expected.txt: Added.
* platform/gtk/fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-slashes-expected.txt:


  Commit: a9cff41271108ca545965097fcc88347ef04f5d4
      https://github.com/WebKit/WebKit/commit/a9cff41271108ca545965097fcc88347ef04f5d4
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-07-09 (Thu, 09 Jul 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.28.3 release

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.28.3.


  Commit: 630bea4efd22ed6fd1458de740cfcb9e570530d1
      https://github.com/WebKit/WebKit/commit/630bea4efd22ed6fd1458de740cfcb9e570530d1
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-07-09 (Thu, 09 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/SourcesWPE.txt
    M Source/WebCore/rendering/RenderBlock.cpp
    M Source/WebCore/svg/SVGClipPathElement.cpp
    M Source/WebCore/workers/service/context/ServiceWorkerFetch.cpp
    M Source/WebCore/xml/parser/XMLDocumentParserLibxml2.cpp

  Log Message:
  -----------
  Unreviewed non-unified build fixes.

No new tests needed.

* SourcesWPE.txt: Add ScrollAnimationKinetic.cpp
* rendering/RenderBlock.cpp: Add missing inclusion of ImageBuffer.h
* svg/SVGClipPathElement.cpp: Ditto
* workers/service/context/ServiceWorkerFetch.cpp: Add missing inclusion of
ServiceWorkerThread.h
* xml/parser/XMLDocumentParserLibxml2.cpp: Add missinc inclusions of Page.h and
PageConsoleClient.h


  Commit: 9f1f65448c7afc67cba8c32cf874545ec8b0d5b7
      https://github.com/WebKit/WebKit/commit/9f1f65448c7afc67cba8c32cf874545ec8b0d5b7
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-07-09 (Thu, 09 Jul 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.28.3 release

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.28.3.


  Commit: 7ff5f509fd5960bea75aac86e852b1de1d49dbb2
      https://github.com/WebKit/WebKit/commit/7ff5f509fd5960bea75aac86e852b1de1d49dbb2
  Author: Devin Rousso <drousso at apple.com>
  Date:   2020-07-27 (Mon, 27 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/inspector/network/copy-as-curl-expected.txt
    M LayoutTests/http/tests/inspector/network/copy-as-curl.html
    M Source/WebInspectorUI/ChangeLog
    M Source/WebInspectorUI/UserInterface/Models/Resource.js

  Log Message:
  -----------
  Merge r259141 - Web Inspector: should also escape the method when Copy as cURL
https://bugs.webkit.org/show_bug.cgi?id=209665
<rdar://problem/58432154>

Reviewed by Joseph Pecoraro.

Source/WebInspectorUI:

* UserInterface/Models/Resource.js:
(WI.Resource.prototype.generateCURLCommand):
(WI.Resource.prototype.generateCURLCommand.escapeStringPosix):
The method could be maliciously crafted, so we should also escape it (if needed).

LayoutTests:

* http/tests/inspector/network/copy-as-curl.html:


  Commit: a2f3b0bff769a2c89f624e75bbec50014d7482cb
      https://github.com/WebKit/WebKit/commit/a2f3b0bff769a2c89f624e75bbec50014d7482cb
  Author: Antoine Quint <graouts at webkit.org>
  Date:   2020-07-27 (Mon, 27 Jul 2020)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/css/css-animations/Element-getAnimations.tentative-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/animation/DocumentTimeline.cpp
    M Source/WebCore/animation/KeyframeEffectStack.cpp
    M Source/WebCore/animation/WebAnimationUtilities.cpp

  Log Message:
  -----------
  Merge r261217 - Fix animation ordering to make imported/w3c/web-platform-tests/css/css-animations/Element-getAnimations.tentative.html pass
https://bugs.webkit.org/show_bug.cgi?id=211468
<rdar://problem/62732578>

Reviewed by David Kilzer.

LayoutTests/imported/w3c:

Mark the final two failures in imported/w3c/web-platform-tests/css/css-animations/Element-getAnimations.tentative.html as PASS.

* web-platform-tests/css/css-animations/Element-getAnimations.tentative-expected.txt:

Source/WebCore:

The "Animation composite order" section of the CSS Animations Level 2 specification (https://drafts.csswg.org/css-animations-2/#animation-composite-order)
defines the relative composite order of animations. We bake this into compareAnimationsByCompositeOrder(), but this function would not yield consistent
results if it is called in a non-stable sort, because if both CSSAnimation objects passed to this function have the same backing Animation object, they
would not return the same value if passed in a different order. The Web Animations spec always ensures that procedures that sort using the composite
order are called as part of a stable sort. So we change all call sites to use std::stable_sort and add an assertion in case we have two CSSAnimation
objects with the same backing Animation objects to catch cases like this in the future.

Finally, since we already know only relevant animations can find their way into the output of Document::getAnimations(), we also ensure we iterate over
m_animations (which holds only relevant animations) rather than m_allAnimations (which may not).

* animation/DocumentTimeline.cpp:
(WebCore::DocumentTimeline::getAnimations const):
* animation/KeyframeEffectStack.cpp:
(WebCore::KeyframeEffectStack::ensureEffectsAreSorted):
* animation/WebAnimationUtilities.cpp:
(WebCore::compareAnimationsByCompositeOrder):


  Commit: ef6d5d3dd59e454e33504b667c746974918bd591
      https://github.com/WebKit/WebKit/commit/ef6d5d3dd59e454e33504b667c746974918bd591
  Author: Alan Bujtas <zalan at apple.com>
  Date:   2020-07-27 (Mon, 27 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/html/HTMLAppletElement.cpp

  Log Message:
  -----------
  Merge r262594 - HTMLAppletElement::updateWidget should check for renderer after the overlapping test.
https://bugs.webkit.org/show_bug.cgi?id=212789
<rdar://problem/61854614>

Reviewed by Simon Fraser.

createJavaAppletWidget needs to check if the plugin(replacement) is obscured.
Since the overlapping test requires up-to-date geometry, it initiates a top level style recalc/layout.
We need to check if the apple element still has a renderer after the style recalc.

* html/HTMLAppletElement.cpp:
(WebCore::HTMLAppletElement::updateWidget):


  Commit: 8e09dfb308f9ec39a31242dab1b6ca2d0eb5bbd2
      https://github.com/WebKit/WebKit/commit/8e09dfb308f9ec39a31242dab1b6ca2d0eb5bbd2
  Author: Brent Fulgham <bfulgham at webkit.org>
  Date:   2020-07-27 (Mon, 27 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    M LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt
    A LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-self-blocked-expected.txt
    A LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-self-blocked.html
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/content-security-policy/form-action/form-action-src-blocked.sub-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/FrameLoader.cpp

  Log Message:
  -----------
  Merge r262870 - Improve CSP compliance under PSON
https://bugs.webkit.org/show_bug.cgi?id=212995
<rdar://problem/62996186>

Reviewed by Chris Dumez.

LayoutTests/imported/w3c:

Rebaseline an existing test, since CSP is now checked before any navigations performed by a form action.

* web-platform-tests/content-security-policy/form-action/form-action-src-blocked.sub-expected.txt:

Source/WebCore:

Tests: http/tests/security/contentSecurityPolicy/1.1/form-action-src-self-blocked.html

The form submission logic was only considering CSP if the form
action was a JavaScript URL. This is incorrect, as CSP might
apply to any URL.

This is also covered by the existing form-action CSP tests.

* loader/FrameLoader.cpp:
(WebCore::FrameLoader::submitForm): All URLs should be evaluted for
compliance with CSP.

LayoutTests:

Add a new test to confirm that CSP rules are honored for form-action operations during process swap.
This also rebaselines an existing test, since CSP is now checked before any navigations performed by
a form action.

* http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt: Rebaselined.
* http/tests/security/contentSecurityPolicy/1.1/form-action-src-self-blocked-expected.txt: Copied from LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-get-blocked-expected.txt.
* http/tests/security/contentSecurityPolicy/1.1/form-action-src-self-blocked.html: Added.


  Commit: 7a036dc5cb33bb7f387791614618fad7a9d663cf
      https://github.com/WebKit/WebKit/commit/7a036dc5cb33bb7f387791614618fad7a9d663cf
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2020-07-27 (Mon, 27 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/streams/ReadableStreamInternals.js

  Log Message:
  -----------
  Merge r262739 - Use usual promise in readableStreamTee
https://bugs.webkit.org/show_bug.cgi?id=212715

Reviewed by Mark Lam.

The spec[1] is organized to be OK to use usual promises here. This patch uses usual promises instead of internal ones.

[1]: https://streams.spec.whatwg.org/#readable-stream-tee

* Modules/streams/ReadableStreamInternals.js:
(readableStreamTee):


  Commit: 0a8595444170cfcb2271ade83854041ba01c16c4
      https://github.com/WebKit/WebKit/commit/0a8595444170cfcb2271ade83854041ba01c16c4
  Author: Youenn Fablet <youennf at gmail.com>
  Date:   2020-07-27 (Mon, 27 Jul 2020)

  Changed paths:
    M LayoutTests/imported/w3c/ChangeLog
    M LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/bad-underlying-sources-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/bad-underlying-sources.dedicatedworker-expected.txt
    M LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/bad-underlying-sources.serviceworker.https-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/Modules/streams/ReadableStream.js
    M Source/WebCore/Modules/streams/ReadableStreamInternals.js
    M Source/WebCore/Modules/streams/StreamInternals.js
    M Source/WebCore/bindings/js/WebCoreBuiltinNames.h

  Log Message:
  -----------
  Merge r263141 - Make ReadableStream robust against user code
https://bugs.webkit.org/show_bug.cgi?id=212915
<rdar://problem/64133221>

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

We now get pull/cancel only once from the source.

* web-platform-tests/streams/readable-streams/bad-underlying-sources-expected.txt:
* web-platform-tests/streams/readable-streams/bad-underlying-sources.dedicatedworker-expected.txt:
* web-platform-tests/streams/readable-streams/bad-underlying-sources.serviceworker.https-expected.txt:

Source/WebCore:

Create tee source with private slots instead of public ones.
When source has one of this private slot, we directly go to the creation of a ReadableStream.
Covered by existing tests.

* Modules/streams/ReadableStream.js:
(initializeReadableStream):
* Modules/streams/ReadableStreamInternals.js:
(setupReadableStreamDefaultController):
(readableStreamTee):
(readableStreamDefaultControllerCallPullIfNeeded):
(readableStreamDefaultControllerCancel):
* Modules/streams/StreamInternals.js:
(promiseInvokeOrNoopMethodNoCatch):
(promiseInvokeOrNoopNoCatch):
(promiseInvokeOrNoopMethod):
(promiseInvokeOrNoop):
* bindings/js/WebCoreBuiltinNames.h:


  Commit: 56bd75f3e5fdfd399bc593ddc7694e3ccb1b424b
      https://github.com/WebKit/WebKit/commit/56bd75f3e5fdfd399bc593ddc7694e3ccb1b424b
  Author: Antti Koivisto <koivisto at iki.fi>
  Date:   2020-07-27 (Mon, 27 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/style/StyleTreeResolver.cpp

  Log Message:
  -----------
  Merge r263455 - Style resolution sometimes fails to create all style resolvers for shadow trees.
https://bugs.webkit.org/show_bug.cgi?id=212946
<rdar://problem/60916215>>

Reviewed by Anders Carlsson.

This can cause problems later.

* style/StyleTreeResolver.cpp:
(WebCore::Style::TreeResolver::Scope::Scope):

Ensure all style resolvers are constructed before traversing.


  Commit: 3b0a10a14f7a23948f2732fe1e565187b1eea85d
      https://github.com/WebKit/WebKit/commit/3b0a10a14f7a23948f2732fe1e565187b1eea85d
  Author: Said Abou-Hallawa <sabouhallawa at apple.com>
  Date:   2020-07-28 (Tue, 28 Jul 2020)

  Changed paths:
    M LayoutTests/ChangeLog
    A LayoutTests/svg/in-html/inline-svg-resource-dynamic-update-expected.txt
    A LayoutTests/svg/in-html/inline-svg-resource-dynamic-update.html
    M Source/WebCore/ChangeLog
    M Source/WebCore/rendering/svg/RenderSVGResource.cpp
    M Source/WebCore/rendering/svg/RenderSVGRoot.cpp
    M Source/WebCore/rendering/svg/RenderSVGRoot.h

  Log Message:
  -----------
  Merge r264364 - When invalidating the clients of an SVG resource we should not go beyond the RenderSVGRoot
https://bugs.webkit.org/show_bug.cgi?id=211804
<rdar://problem/60308199>

Patch by Said Abou-Hallawa <sabouhallawa at apple.com> on 2020-07-14
Reviewed by Zalan Bujtas.

Source/WebCore:

ComplexLineLayout::layoutLineBoxes() walks through the renderers of a line.
The order of this walk may include a node and its children. For example
the layout of a RenderInline may be run first, then it is followed by the
layout for a RenderSVGRoot which happens to be a child of the RenderInline.

If the RenderSVGRoot has a dirty RenderSVGResource, e.g. RenderSVGResourceClipper,
this resource will call RenderSVGResource::markForLayoutAndParentResourceInvalidation()
which will invalidate its ancestors including RenderSVGRoot and RenderInline
by setting the normalChildNeedsLayoutBit() for each of them.

The layout of SVG is hierarchical which means RenderSVGRoot will finish
its layout after finishing the layout of all its descendants including
this RenderSVGResource. So dirtying the RenderSVGRoot is this scenario
is okay since RenderSVGRoot will do another SVGRenderSupport::layoutChildren()
and will clear its needsLayout bits before it returns.

The problem happens because we set normalChildNeedsLayoutBit for the containing
RenderInline and this leaves the render tree dirty. Later Document::resolveStyle()
may called to invalidate an SVG element e.g. RenderSVGPath. So setNeedsLayout()
is called for this object. Because the normalChildNeedsLayoutBit() is set
for the RenderInline, RenderObject::markContainingBlocksForLayout() stops
in the middle and do not mark the containing RenderBlock. So we end up
with a render tree like this:

    +  RenderView
    +    HTML RenderBlock
    +      BODY RenderBody
    -        RenderBlock
    +          ANY-ELEMENT RenderInline
    +           svg RenderSVGRoot
    -              clipPath RenderSVGResourceClipper
    +              polygon RenderSVGPath

where the '+' means needsLayout() is true and '-' means needsLayout() is
false.

So the layout will not run for RenderBlock with '-' sign. And we end up
with dirty RenderSVGPath or even worse RenderSVGPath with uninitialized
m_path. So a null pointer deref may happen.

The fix is to prevent mutating the render tree while running the layout
of the SVG resource. This can be done by making the RenderSVGResource not
dirtying any renderer beyond the RenderSVGRoot when it finishes its layout.
The SVG resource layout should not affect the intrinsic size of the SVG
if it is embedded in an HTML document.

In RenderObject::markContainingBlocksForLayout(), we do something similar
when we break if the ancestor is objectIsRelayoutBoundary().

Test: svg/in-html/inline-svg-resource-dynamic-update.html

* rendering/svg/RenderSVGResource.cpp:
(WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation):
* rendering/svg/RenderSVGRoot.cpp:
(WebCore::RenderSVGRoot::layout):
* rendering/svg/RenderSVGRoot.h:

LayoutTests:

* svg/in-html/inline-svg-resource-dynamic-update-expected.txt: Added.
* svg/in-html/inline-svg-resource-dynamic-update.html: Added.


  Commit: a692a671cef0e9c3fe3d6d9447a12b647a3476dd
      https://github.com/WebKit/WebKit/commit/a692a671cef0e9c3fe3d6d9447a12b647a3476dd
  Author: Pinki Gyanchandani <pgyanchandani at apple.com>
  Date:   2020-07-28 (Tue, 28 Jul 2020)

  Changed paths:
    M LayoutTests/fast/dom/move-detached-child-in-range-expected.txt
    M Source/WebCore/ChangeLog
    M Source/WebCore/dom/Document.cpp
    M Source/WebCore/dom/Document.h
    M Source/WebCore/dom/Node.cpp
    M Source/WebCore/dom/Range.cpp
    M Source/WebCore/dom/Range.h

  Log Message:
  -----------
  Merge r263302 - Crash in WebCore::Range::borderAndTextRects
https://bugs.webkit.org/show_bug.cgi?id=209379

Patch by Pinki Gyanchandani <pgyanchandani at apple.com> on 2020-06-19
Reviewed by Darin Adler.

When a parentless node is moved to a new document, then all ranges associated with this node and its children also should
be updated with new document information.

Test woould be submitted later.

* dom/Document.cpp:
(WebCore::Document::parentlessNodeMoveToNewDocument):
* dom/Document.h:
* dom/Node.cpp:
(WebCore::Node::moveNodeToNewDocument):
* dom/Range.cpp:
(WebCore::Range::parentlessNodeMoveToNewDocumentAffectsRange):
(WebCore::Range::updateRangeForParentlessNodeMoveToNewDocument):
* dom/Range.h:


  Commit: 6bf8f1296c50b163b0d88edce4d95ed82f4f50d1
      https://github.com/WebKit/WebKit/commit/6bf8f1296c50b163b0d88edce4d95ed82f4f50d1
  Author: Pinki Gyanchandani <pgyanchandani at apple.com>
  Date:   2020-07-28 (Tue, 28 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/css/StyleProperties.cpp

  Log Message:
  -----------
  Merge r261208 - Crash in match_constness<WebCore::CSSValue, WebCore::CSSPrimitiveValue>::type& WTF::downcast<WebCore::CSSPrimitiveValue, WebCore::CSSValue> -- ASAN
https://bugs.webkit.org/show_bug.cgi?id=211479

Patch by Pinki Gyanchandani <pgyanchandani at apple.com> on 2020-05-05
Reviewed by Geoffrey Garen.

Added check to downcast CSSValue to CSSPrimitiveValue, only if valid CSSPrimitveValue is associated with the property.

New test would be added to Internal repository.

* css/StyleProperties.cpp:
(WebCore::StyleProperties::pageBreakPropertyValue const):


  Commit: 150a5979abe1c92f53fb37d5cd22cb3502e1da14
      https://github.com/WebKit/WebKit/commit/150a5979abe1c92f53fb37d5cd22cb3502e1da14
  Author: Jack Lee <shihchieh_lee at apple.com>
  Date:   2020-07-28 (Tue, 28 Jul 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/loader/SubframeLoader.cpp
    M Source/WebCore/loader/SubframeLoader.h

  Log Message:
  -----------
  Merge r259525 - Protect contentFrame in SubframeLoader::loadOrRedirectSubframe with RefPtr.
https://bugs.webkit.org/show_bug.cgi?id=127096
<rdar://problem/61221941>

Reviewed by Alex Christensen.

ContentFrame is used throughout loadOrRedirectSubframe so it needs to be protected with RefPtr.
And if loader changes frame in SubframeLoader::loadSubframe, return nullptr to notify the caller.

No new tests, covered by existing test.

* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::loadOrRedirectSubframe):
(WebCore::SubframeLoader::loadSubframe):
* loader/SubframeLoader.h:


  Commit: ca3d1d111445ef10a6528c028f29285f0a6abf60
      https://github.com/WebKit/WebKit/commit/ca3d1d111445ef10a6528c028f29285f0a6abf60
  Author: Carlos Garcia Campos <carlosgc at webkit.org>
  Date:   2020-07-28 (Tue, 28 Jul 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/gtk/NEWS
    M Source/cmake/OptionsGTK.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsGTK.cmake and NEWS for 2.28.4 release

.:

* Source/cmake/OptionsGTK.cmake: Bump version numbers.

Source/WebKit:

* gtk/NEWS: Add release notes for 2.28.4.


  Commit: 194fca59608a8b10519b561c90aa5758abdb8b47
      https://github.com/WebKit/WebKit/commit/194fca59608a8b10519b561c90aa5758abdb8b47
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-07-28 (Tue, 28 Jul 2020)

  Changed paths:
    M ChangeLog
    M Source/WebKit/ChangeLog
    M Source/WebKit/wpe/NEWS
    M Source/cmake/OptionsWPE.cmake

  Log Message:
  -----------
  Unreviewed. Update OptionsWPE.cmake and NEWS for the 2.28.4 release

.:

* Source/cmake/OptionsWPE.cmake: Bump version numbers.

Source/WebKit:

* wpe/NEWS: Add release notes for 2.28.4.


  Commit: 7035331b15c3639a93cba38f09362879014f72bf
      https://github.com/WebKit/WebKit/commit/7035331b15c3639a93cba38f09362879014f72bf
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-08-15 (Sat, 15 Aug 2020)

  Changed paths:
    M Source/JavaScriptCore/ChangeLog
    M Source/JavaScriptCore/heap/RegisterState.h

  Log Message:
  -----------
  Merged r265692 - [ARMv7][JSC] Conservative GC is not considering `r7` as a root
https://bugs.webkit.org/show_bug.cgi?id=215512

Reviewed by Yusuke Suzuki.

Since `r7` is a callee-saved register on ARMv7
we need to consider it as a conservative root.

See the statement "A subroutine must preserve
the contents of the registers r4-r8, r10, r11
and SP (and r9 in PCS variants that designate
r9 as v6) form page 15 of
https://developer.arm.com/documentation/ihi0042/f/.

* heap/RegisterState.h:


  Commit: 7ae75bac3bb411bcd880cb73aa067198d5cd0561
      https://github.com/WebKit/WebKit/commit/7ae75bac3bb411bcd880cb73aa067198d5cd0561
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-08-15 (Sat, 15 Aug 2020)

  Changed paths:
    M Source/WebKit/ChangeLog
    M Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp

  Log Message:
  -----------
  Merged r265326 - [WPE][GTK] Wrong argument order for clone syscall seccomp filter on s390x
https://bugs.webkit.org/show_bug.cgi?id=215212

Reviewed by Michael Catanzaro.

Patch based on this Flatpak pull request:
https://github.com/flatpak/flatpak/pull/3777

No new tests needed.

* UIProcess/Launcher/glib/BubblewrapLauncher.cpp:
(WebKit::setupSeccomp): Add preprocessor guard to choose the correct
clone() system call argument on S390.


  Commit: 91c5c1621bb6ec9a04fb10446bc2da1568921de2
      https://github.com/WebKit/WebKit/commit/91c5c1621bb6ec9a04fb10446bc2da1568921de2
  Author: Adrian Perez de Castro <aperez at igalia.com>
  Date:   2020-08-15 (Sat, 15 Aug 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/graphics/egl/GLContextEGL.cpp

  Log Message:
  -----------
  Merged r264986 - [GTK] Crash in Nicosia::GC3DLayer::makeContextCurrent due to failure in EGL display creation
https://bugs.webkit.org/show_bug.cgi?id=201507

Reviewed by Carlos Garcia Campos.

Ensure that EGL context and display creation failures are always
logged using RELEASE_LOG_INFO(), even for intermediate failures for
which a fallback will be tried next, in order to ease diagnosis of
related issues. Failure to create contexts at the end of the public
methods ::createContext() and ::createSharingContext() is still
logged with WTFLogAlways() to write a notice to standard error, and
let users/developers know that something failed and checking the
complete logs (e.g. with "journalctl" on Linux) may reveal more
information.

This also replaces the chains of "if" statements with a single
"switch" on the PlatformDisplay::Type enum, which makes the code
easier to follow and should be more robust as well.

No new tests needed.

* platform/graphics/egl/GLContextEGL.cpp:
(WebCore::GLContextEGL::getEGLConfig):
(WebCore::GLContextEGL::createWindowContext):
(WebCore::GLContextEGL::createSurfacelessContext):
(WebCore::GLContextEGL::createContext):
(WebCore::GLContextEGL::createSharingContext):


  Commit: fb6aefc0dfce5aaea93f1cfae093ff77a73d5220
      https://github.com/WebKit/WebKit/commit/fb6aefc0dfce5aaea93f1cfae093ff77a73d5220
  Author: Michael Catanzaro <mcatanzaro at gnome.org>
  Date:   2020-08-15 (Sat, 15 Aug 2020)

  Changed paths:
    M Source/WebCore/ChangeLog
    M Source/WebCore/platform/UserAgentQuirks.cpp

  Log Message:
  -----------
  Merged r264676 - Update Chrome and Firefox versions in user agent quirks
https://bugs.webkit.org/show_bug.cgi?id=214595

Patch by Michael Catanzaro <mcatanzaro at gnome.org> on 2020-07-21
Reviewed by Adrian Perez de Castro.

* platform/UserAgentQuirks.cpp:
(WebCore::UserAgentQuirks::stringForQuirk):


Compare: https://github.com/WebKit/WebKit/compare/b91749d85f52%5E...fb6aefc0dfce