<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[195710] branches/safari-601.1.46-branch</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/195710">195710</a></dd>
<dt>Author</dt> <dd>bshafiei@apple.com</dd>
<dt>Date</dt> <dd>2016-01-27 16:38:44 -0800 (Wed, 27 Jan 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merged <a href="http://trac.webkit.org/projects/webkit/changeset/195625">r195625</a>.  rdar://problem/24337780</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari601146branchLayoutTestsChangeLog">branches/safari-601.1.46-branch/LayoutTests/ChangeLog</a></li>
<li><a href="#branchessafari601146branchLayoutTestsTestExpectations">branches/safari-601.1.46-branch/LayoutTests/TestExpectations</a></li>
<li><a href="#branchessafari601146branchSourceWebCoreChangeLog">branches/safari-601.1.46-branch/Source/WebCore/ChangeLog</a></li>
<li><a href="#branchessafari601146branchSourceWebCorebindingsjsJSHistoryCustomcpp">branches/safari-601.1.46-branch/Source/WebCore/bindings/js/JSHistoryCustom.cpp</a></li>
<li><a href="#branchessafari601146branchSourceWebCorepageHistorycpp">branches/safari-601.1.46-branch/Source/WebCore/page/History.cpp</a></li>
<li><a href="#branchessafari601146branchSourceWebCorepageHistoryh">branches/safari-601.1.46-branch/Source/WebCore/page/History.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencyexpectedtxt">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-expected.txt</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencyiframeexpectedtxt">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe-expected.txt</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencyiframehtml">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe.html</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencywithusergestureexpectedtxt">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencywithusergesturehtml">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencyhtml">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency.html</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencyexpectedtxt">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-expected.txt</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencyiframeexpectedtxt">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe-expected.txt</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencyiframehtml">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe.html</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencywithusergestureexpectedtxt">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencywithusergesturehtml">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencyhtml">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency.html</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectsresourcespushstateiframehtml">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/resources/pushstate-iframe.html</a></li>
<li><a href="#branchessafari601146branchLayoutTestsfastloaderstateobjectsresourcesreplacestateiframehtml">branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/resources/replacestate-iframe.html</a></li>
<li>branches/safari-601.1.46-branch/LayoutTests/loader/stateobjects/</li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari601146branchLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/LayoutTests/ChangeLog (195709 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/ChangeLog        2016-01-28 00:37:00 UTC (rev 195709)
+++ branches/safari-601.1.46-branch/LayoutTests/ChangeLog        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -1,5 +1,43 @@
</span><span class="cx"> 2016-01-27  Babak Shafiei  &lt;bshafiei@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Merge r195625.
+
+    2016-01-26  Brady Eidson  &lt;beidson@apple.com&gt;
+
+            History.pushState causes intense memory pressure.
+            https://bugs.webkit.org/show_bug.cgi?id=153435
+
+            Reviewed by Sam Weinig, Oliver Hunt, and Geoff Garen.
+
+            * TestExpectations: Mark some of the new tests as slow.
+
+            * fast/loader/stateobjects/pushstate-frequency-expected.txt: Added.
+            * fast/loader/stateobjects/pushstate-frequency-iframe-expected.txt: Added.
+            * fast/loader/stateobjects/pushstate-frequency-iframe.html: Added.
+            * fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt: Added.
+            * fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html: Added.
+            * fast/loader/stateobjects/pushstate-frequency.html: Added.
+            * fast/loader/stateobjects/replacestate-frequency-expected.txt: Added.
+            * fast/loader/stateobjects/replacestate-frequency-iframe-expected.txt: Added.
+            * fast/loader/stateobjects/replacestate-frequency-iframe.html: Added.
+            * fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt: Added.
+            * fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html: Added.
+            * fast/loader/stateobjects/replacestate-frequency.html: Added.
+            * fast/loader/stateobjects/resources/pushstate-iframe.html: Added.
+            * fast/loader/stateobjects/resources/replacestate-iframe.html: Added.
+            * loader/stateobjects/pushstate-size-expected.txt: Added.
+            * loader/stateobjects/pushstate-size-iframe-expected.txt: Added.
+            * loader/stateobjects/pushstate-size-iframe.html: Added.
+            * loader/stateobjects/pushstate-size.html: Added.
+            * loader/stateobjects/replacestate-size-expected.txt: Added.
+            * loader/stateobjects/replacestate-size-iframe-expected.txt: Added.
+            * loader/stateobjects/replacestate-size-iframe.html: Added.
+            * loader/stateobjects/replacestate-size.html: Added.
+            * loader/stateobjects/resources/pushstate-iframe.html: Added.
+            * loader/stateobjects/resources/replacestate-iframe.html: Added.
+
+2016-01-27  Babak Shafiei  &lt;bshafiei@apple.com&gt;
+
</ins><span class="cx">         Merge r195671.
</span><span class="cx"> 
</span><span class="cx">     2016-01-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</span></span></pre></div>
<a id="branchessafari601146branchLayoutTestsTestExpectations"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/LayoutTests/TestExpectations (195709 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/TestExpectations        2016-01-28 00:37:00 UTC (rev 195709)
+++ branches/safari-601.1.46-branch/LayoutTests/TestExpectations        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -580,3 +580,9 @@
</span><span class="cx"> webkit.org/b/150183 fast/css/variables/test-suite/failures/161.html [ ImageOnlyFailure ]
</span><span class="cx"> webkit.org/b/150183 fast/css/variables/test-suite/failures/163.html [ ImageOnlyFailure ]
</span><span class="cx"> webkit.org/b/150183 fast/css/variables/test-suite/failures/169.html [ ImageOnlyFailure ]
</span><ins>+
+# These state object tests purposefully stress a resource limit, and take multiple seconds to run.
+loader/stateobjects/pushstate-size-iframe.html [ Slow ]
+loader/stateobjects/pushstate-size.html [ Slow ]
+loader/stateobjects/replacestate-size-iframe.html [ Slow ]
+loader/stateobjects/replacestate-size.html [ Slow ]
</ins><span class="cx">\ No newline at end of file
</span></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencyexpectedtxtfromrev195625trunkLayoutTestsfastloaderstateobjectspushstatefrequencyexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-expected.txt (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/pushstate-frequency-expected.txt) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-expected.txt                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-expected.txt        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,104 @@
</span><ins>+Test should complete quickly and not crash.
+Successfully added item: 0
+Successfully added item: 1
+Successfully added item: 2
+Successfully added item: 3
+Successfully added item: 4
+Successfully added item: 5
+Successfully added item: 6
+Successfully added item: 7
+Successfully added item: 8
+Successfully added item: 9
+Successfully added item: 10
+Successfully added item: 11
+Successfully added item: 12
+Successfully added item: 13
+Successfully added item: 14
+Successfully added item: 15
+Successfully added item: 16
+Successfully added item: 17
+Successfully added item: 18
+Successfully added item: 19
+Successfully added item: 20
+Successfully added item: 21
+Successfully added item: 22
+Successfully added item: 23
+Successfully added item: 24
+Successfully added item: 25
+Successfully added item: 26
+Successfully added item: 27
+Successfully added item: 28
+Successfully added item: 29
+Successfully added item: 30
+Successfully added item: 31
+Successfully added item: 32
+Successfully added item: 33
+Successfully added item: 34
+Successfully added item: 35
+Successfully added item: 36
+Successfully added item: 37
+Successfully added item: 38
+Successfully added item: 39
+Successfully added item: 40
+Successfully added item: 41
+Successfully added item: 42
+Successfully added item: 43
+Successfully added item: 44
+Successfully added item: 45
+Successfully added item: 46
+Successfully added item: 47
+Successfully added item: 48
+Successfully added item: 49
+Successfully added item: 50
+Successfully added item: 51
+Successfully added item: 52
+Successfully added item: 53
+Successfully added item: 54
+Successfully added item: 55
+Successfully added item: 56
+Successfully added item: 57
+Successfully added item: 58
+Successfully added item: 59
+Successfully added item: 60
+Successfully added item: 61
+Successfully added item: 62
+Successfully added item: 63
+Successfully added item: 64
+Successfully added item: 65
+Successfully added item: 66
+Successfully added item: 67
+Successfully added item: 68
+Successfully added item: 69
+Successfully added item: 70
+Successfully added item: 71
+Successfully added item: 72
+Successfully added item: 73
+Successfully added item: 74
+Successfully added item: 75
+Successfully added item: 76
+Successfully added item: 77
+Successfully added item: 78
+Successfully added item: 79
+Successfully added item: 80
+Successfully added item: 81
+Successfully added item: 82
+Successfully added item: 83
+Successfully added item: 84
+Successfully added item: 85
+Successfully added item: 86
+Successfully added item: 87
+Successfully added item: 88
+Successfully added item: 89
+Successfully added item: 90
+Successfully added item: 91
+Successfully added item: 92
+Successfully added item: 93
+Successfully added item: 94
+Successfully added item: 95
+Successfully added item: 96
+Successfully added item: 97
+Successfully added item: 98
+Successfully added item: 99
+Error: SecurityError: DOM Exception 18
+Test complete
+
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencyiframeexpectedtxtfromrev195625trunkLayoutTestsfastloaderstateobjectspushstatefrequencyiframeexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe-expected.txt (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe-expected.txt) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe-expected.txt                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe-expected.txt        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,111 @@
</span><ins>+Test should complete quickly and not crash.
+Test does pushStates both from the main frame and from an iframe and makes sure they both count against state object count limit.
+Click to test pushState through a user gesture
+Successfully added item: 0
+Successfully added item: 1
+Successfully added item: 2
+Successfully added item: 3
+Successfully added item: 4
+Successfully added item: 5
+Successfully added item: 6
+Successfully added item: 7
+Successfully added item: 8
+Successfully added item: 9
+Successfully added item: 10
+Successfully added item: 11
+Successfully added item: 12
+Successfully added item: 13
+Successfully added item: 14
+Successfully added item: 15
+Successfully added item: 16
+Successfully added item: 17
+Successfully added item: 18
+Successfully added item: 19
+Successfully added item: 20
+Successfully added item: 21
+Successfully added item: 22
+Successfully added item: 23
+Successfully added item: 24
+Successfully added item: 25
+Successfully added item: 26
+Successfully added item: 27
+Successfully added item: 28
+Successfully added item: 29
+Successfully added item: 30
+Successfully added item: 31
+Successfully added item: 32
+Successfully added item: 33
+Successfully added item: 34
+Successfully added item: 35
+Successfully added item: 36
+Successfully added item: 37
+Successfully added item: 38
+Successfully added item: 39
+Successfully added item: 40
+Successfully added item: 41
+Successfully added item: 42
+Successfully added item: 43
+Successfully added item: 44
+Successfully added item: 45
+Successfully added item: 46
+Successfully added item: 47
+Successfully added item: 48
+Successfully added item: 49
+Successfully added item: 50
+Successfully added item: 51
+Successfully added item: 52
+Successfully added item: 53
+Successfully added item: 54
+Successfully added item: 55
+Successfully added item: 56
+Successfully added item: 57
+Successfully added item: 58
+Successfully added item: 59
+Successfully added item: 60
+Successfully added item: 61
+Successfully added item: 62
+Successfully added item: 63
+Successfully added item: 64
+Successfully added item: 65
+Successfully added item: 66
+Successfully added item: 67
+Successfully added item: 68
+Successfully added item: 69
+Successfully added item: 70
+Successfully added item: 71
+Successfully added item: 72
+Successfully added item: 73
+Successfully added item: 74
+
+
+--------
+Frame: '&lt;!--framePath //&lt;!--frame0--&gt;--&gt;'
+--------
+Adding state objects in iframe
+Successfully added item: 0
+Successfully added item: 1
+Successfully added item: 2
+Successfully added item: 3
+Successfully added item: 4
+Successfully added item: 5
+Successfully added item: 6
+Successfully added item: 7
+Successfully added item: 8
+Successfully added item: 9
+Successfully added item: 10
+Successfully added item: 11
+Successfully added item: 12
+Successfully added item: 13
+Successfully added item: 14
+Successfully added item: 15
+Successfully added item: 16
+Successfully added item: 17
+Successfully added item: 18
+Successfully added item: 19
+Successfully added item: 20
+Successfully added item: 21
+Successfully added item: 22
+Successfully added item: 23
+Successfully added item: 24
+Expected exception: Error: SecurityError: DOM Exception 18
+
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencyiframehtmlfromrev195625trunkLayoutTestsfastloaderstateobjectspushstatefrequencyiframehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe.html (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe.html) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe.html                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-iframe.html        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,40 @@
</span><ins>+&lt;script&gt;
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.dumpChildFramesAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById(&quot;logger&quot;).innerHTML += msg + &quot;&lt;br&gt;&quot;;
+}
+
+window.onload = function()
+{
+    try {
+        for( var i = 0; i &lt; 75; ++i ) {
+            history.pushState(0, 0, i.toString());
+            log(&quot;Successfully added item: &quot; + i);
+        }
+    } catch (e) {
+        log(e);
+    }
+
+    openFrame();
+}
+
+function openFrame()
+{
+    var iframe = document.createElement('iframe');
+    iframe.src = 'resources/pushstate-iframe.html'
+    document.body.appendChild(iframe);
+}
+
+&lt;/script&gt;
+&lt;body&gt;
+Test should complete quickly and not crash.&lt;br&gt;
+Test does pushStates both from the main frame and from an iframe and makes sure they both count against state object count limit.&lt;br&gt;
+&lt;button id=&quot;button&quot; onclick=&quot;clicked();&quot;&gt;Click to test pushState through a user gesture&lt;/button&gt;
+&lt;div id=&quot;logger&quot;&gt;&lt;/div&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencywithusergestureexpectedtxtfromrev195625trunkLayoutTestsfastloaderstateobjectspushstatefrequencywithusergestureexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture-expected.txt        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,206 @@
</span><ins>+Test should complete quickly and not crash.
+Click to test pushState through a user gesture
+Successfully added item: 0
+Successfully added item: 1
+Successfully added item: 2
+Successfully added item: 3
+Successfully added item: 4
+Successfully added item: 5
+Successfully added item: 6
+Successfully added item: 7
+Successfully added item: 8
+Successfully added item: 9
+Successfully added item: 10
+Successfully added item: 11
+Successfully added item: 12
+Successfully added item: 13
+Successfully added item: 14
+Successfully added item: 15
+Successfully added item: 16
+Successfully added item: 17
+Successfully added item: 18
+Successfully added item: 19
+Successfully added item: 20
+Successfully added item: 21
+Successfully added item: 22
+Successfully added item: 23
+Successfully added item: 24
+Successfully added item: 25
+Successfully added item: 26
+Successfully added item: 27
+Successfully added item: 28
+Successfully added item: 29
+Successfully added item: 30
+Successfully added item: 31
+Successfully added item: 32
+Successfully added item: 33
+Successfully added item: 34
+Successfully added item: 35
+Successfully added item: 36
+Successfully added item: 37
+Successfully added item: 38
+Successfully added item: 39
+Successfully added item: 40
+Successfully added item: 41
+Successfully added item: 42
+Successfully added item: 43
+Successfully added item: 44
+Successfully added item: 45
+Successfully added item: 46
+Successfully added item: 47
+Successfully added item: 48
+Successfully added item: 49
+Successfully added item: 50
+Successfully added item: 51
+Successfully added item: 52
+Successfully added item: 53
+Successfully added item: 54
+Successfully added item: 55
+Successfully added item: 56
+Successfully added item: 57
+Successfully added item: 58
+Successfully added item: 59
+Successfully added item: 60
+Successfully added item: 61
+Successfully added item: 62
+Successfully added item: 63
+Successfully added item: 64
+Successfully added item: 65
+Successfully added item: 66
+Successfully added item: 67
+Successfully added item: 68
+Successfully added item: 69
+Successfully added item: 70
+Successfully added item: 71
+Successfully added item: 72
+Successfully added item: 73
+Successfully added item: 74
+Successfully added item: 75
+Successfully added item: 76
+Successfully added item: 77
+Successfully added item: 78
+Successfully added item: 79
+Successfully added item: 80
+Successfully added item: 81
+Successfully added item: 82
+Successfully added item: 83
+Successfully added item: 84
+Successfully added item: 85
+Successfully added item: 86
+Successfully added item: 87
+Successfully added item: 88
+Successfully added item: 89
+Successfully added item: 90
+Successfully added item: 91
+Successfully added item: 92
+Successfully added item: 93
+Successfully added item: 94
+Successfully added item: 95
+Successfully added item: 96
+Successfully added item: 97
+Successfully added item: 98
+Successfully added item: 99
+Error: SecurityError: DOM Exception 18
+Successfully added user gesture item: 0
+Successfully added user gesture item: 1
+Successfully added user gesture item: 2
+Successfully added user gesture item: 3
+Successfully added user gesture item: 4
+Successfully added user gesture item: 5
+Successfully added user gesture item: 6
+Successfully added user gesture item: 7
+Successfully added user gesture item: 8
+Successfully added user gesture item: 9
+Successfully added user gesture item: 10
+Successfully added user gesture item: 11
+Successfully added user gesture item: 12
+Successfully added user gesture item: 13
+Successfully added user gesture item: 14
+Successfully added user gesture item: 15
+Successfully added user gesture item: 16
+Successfully added user gesture item: 17
+Successfully added user gesture item: 18
+Successfully added user gesture item: 19
+Successfully added user gesture item: 20
+Successfully added user gesture item: 21
+Successfully added user gesture item: 22
+Successfully added user gesture item: 23
+Successfully added user gesture item: 24
+Successfully added user gesture item: 25
+Successfully added user gesture item: 26
+Successfully added user gesture item: 27
+Successfully added user gesture item: 28
+Successfully added user gesture item: 29
+Successfully added user gesture item: 30
+Successfully added user gesture item: 31
+Successfully added user gesture item: 32
+Successfully added user gesture item: 33
+Successfully added user gesture item: 34
+Successfully added user gesture item: 35
+Successfully added user gesture item: 36
+Successfully added user gesture item: 37
+Successfully added user gesture item: 38
+Successfully added user gesture item: 39
+Successfully added user gesture item: 40
+Successfully added user gesture item: 41
+Successfully added user gesture item: 42
+Successfully added user gesture item: 43
+Successfully added user gesture item: 44
+Successfully added user gesture item: 45
+Successfully added user gesture item: 46
+Successfully added user gesture item: 47
+Successfully added user gesture item: 48
+Successfully added user gesture item: 49
+Successfully added user gesture item: 50
+Successfully added user gesture item: 51
+Successfully added user gesture item: 52
+Successfully added user gesture item: 53
+Successfully added user gesture item: 54
+Successfully added user gesture item: 55
+Successfully added user gesture item: 56
+Successfully added user gesture item: 57
+Successfully added user gesture item: 58
+Successfully added user gesture item: 59
+Successfully added user gesture item: 60
+Successfully added user gesture item: 61
+Successfully added user gesture item: 62
+Successfully added user gesture item: 63
+Successfully added user gesture item: 64
+Successfully added user gesture item: 65
+Successfully added user gesture item: 66
+Successfully added user gesture item: 67
+Successfully added user gesture item: 68
+Successfully added user gesture item: 69
+Successfully added user gesture item: 70
+Successfully added user gesture item: 71
+Successfully added user gesture item: 72
+Successfully added user gesture item: 73
+Successfully added user gesture item: 74
+Successfully added user gesture item: 75
+Successfully added user gesture item: 76
+Successfully added user gesture item: 77
+Successfully added user gesture item: 78
+Successfully added user gesture item: 79
+Successfully added user gesture item: 80
+Successfully added user gesture item: 81
+Successfully added user gesture item: 82
+Successfully added user gesture item: 83
+Successfully added user gesture item: 84
+Successfully added user gesture item: 85
+Successfully added user gesture item: 86
+Successfully added user gesture item: 87
+Successfully added user gesture item: 88
+Successfully added user gesture item: 89
+Successfully added user gesture item: 90
+Successfully added user gesture item: 91
+Successfully added user gesture item: 92
+Successfully added user gesture item: 93
+Successfully added user gesture item: 94
+Successfully added user gesture item: 95
+Successfully added user gesture item: 96
+Successfully added user gesture item: 97
+Successfully added user gesture item: 98
+Successfully added user gesture item: 99
+User gesture: Error: SecurityError: DOM Exception 18
+Test complete
+
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencywithusergesturehtmlfromrev195625trunkLayoutTestsfastloaderstateobjectspushstatefrequencywithusergesturehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,51 @@
</span><ins>+&lt;script&gt;
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById(&quot;logger&quot;).innerHTML += msg + &quot;&lt;br&gt;&quot;;
+}
+
+window.onload = function()
+{
+    try {
+        for( var i = 0; i &lt; 100000; ++i ) {
+            history.pushState(0, 0, i);
+            log(&quot;Successfully added item: &quot; + i);
+        }
+    } catch (e) {
+        log(e);
+    }
+    
+    var button = document.getElementById(&quot;button&quot;);
+    eventSender.mouseMoveTo(button.offsetLeft + 5, button.offsetTop + 5);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+}
+
+function clicked()
+{
+    try {
+        for( var i = 0; i &lt; 100000; ++i ) {
+            history.pushState(0, 0, i);
+            log(&quot;Successfully added user gesture item: &quot; + i);
+        }
+    } catch (e) {
+        log(&quot;User gesture: &quot; + e);
+    }
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+
+    log(&quot;Test complete&quot;);
+}
+
+&lt;/script&gt;
+&lt;body&gt;
+Test should complete quickly and not crash.&lt;br&gt;
+&lt;button id=&quot;button&quot; onclick=&quot;clicked();&quot;&gt;Click to test pushState through a user gesture&lt;/button&gt;
+&lt;div id=&quot;logger&quot;&gt;&lt;/div&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectspushstatefrequencyhtmlfromrev195625trunkLayoutTestsfastloaderstateobjectspushstatefrequencyhtml"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency.html (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/pushstate-frequency.html) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency.html                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/pushstate-frequency.html        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,32 @@
</span><ins>+&lt;script&gt;
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById(&quot;logger&quot;).innerHTML += msg + &quot;&lt;br&gt;&quot;;
+}
+
+window.onload = function() {
+    try {
+        for( var i = 0; i &lt; 100000; ++i ) {
+            history.pushState(0, 0, i.toString());
+            log(&quot;Successfully added item: &quot; + i);
+        }
+    } catch (e) {
+        log(e);
+    }
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+
+    log(&quot;Test complete&quot;);
+}
+
+&lt;/script&gt;
+&lt;body&gt;
+Test should complete quickly and not crash.&lt;br&gt;
+&lt;div id=&quot;logger&quot;&gt;&lt;/div&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencyexpectedtxtfromrev195625trunkLayoutTestsfastloaderstateobjectsreplacestatefrequencyexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-expected.txt (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/replacestate-frequency-expected.txt) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-expected.txt                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-expected.txt        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,104 @@
</span><ins>+Test should complete quickly and not crash.
+Successfully added item: 0
+Successfully added item: 1
+Successfully added item: 2
+Successfully added item: 3
+Successfully added item: 4
+Successfully added item: 5
+Successfully added item: 6
+Successfully added item: 7
+Successfully added item: 8
+Successfully added item: 9
+Successfully added item: 10
+Successfully added item: 11
+Successfully added item: 12
+Successfully added item: 13
+Successfully added item: 14
+Successfully added item: 15
+Successfully added item: 16
+Successfully added item: 17
+Successfully added item: 18
+Successfully added item: 19
+Successfully added item: 20
+Successfully added item: 21
+Successfully added item: 22
+Successfully added item: 23
+Successfully added item: 24
+Successfully added item: 25
+Successfully added item: 26
+Successfully added item: 27
+Successfully added item: 28
+Successfully added item: 29
+Successfully added item: 30
+Successfully added item: 31
+Successfully added item: 32
+Successfully added item: 33
+Successfully added item: 34
+Successfully added item: 35
+Successfully added item: 36
+Successfully added item: 37
+Successfully added item: 38
+Successfully added item: 39
+Successfully added item: 40
+Successfully added item: 41
+Successfully added item: 42
+Successfully added item: 43
+Successfully added item: 44
+Successfully added item: 45
+Successfully added item: 46
+Successfully added item: 47
+Successfully added item: 48
+Successfully added item: 49
+Successfully added item: 50
+Successfully added item: 51
+Successfully added item: 52
+Successfully added item: 53
+Successfully added item: 54
+Successfully added item: 55
+Successfully added item: 56
+Successfully added item: 57
+Successfully added item: 58
+Successfully added item: 59
+Successfully added item: 60
+Successfully added item: 61
+Successfully added item: 62
+Successfully added item: 63
+Successfully added item: 64
+Successfully added item: 65
+Successfully added item: 66
+Successfully added item: 67
+Successfully added item: 68
+Successfully added item: 69
+Successfully added item: 70
+Successfully added item: 71
+Successfully added item: 72
+Successfully added item: 73
+Successfully added item: 74
+Successfully added item: 75
+Successfully added item: 76
+Successfully added item: 77
+Successfully added item: 78
+Successfully added item: 79
+Successfully added item: 80
+Successfully added item: 81
+Successfully added item: 82
+Successfully added item: 83
+Successfully added item: 84
+Successfully added item: 85
+Successfully added item: 86
+Successfully added item: 87
+Successfully added item: 88
+Successfully added item: 89
+Successfully added item: 90
+Successfully added item: 91
+Successfully added item: 92
+Successfully added item: 93
+Successfully added item: 94
+Successfully added item: 95
+Successfully added item: 96
+Successfully added item: 97
+Successfully added item: 98
+Successfully added item: 99
+Error: SecurityError: DOM Exception 18
+Test complete
+
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencyiframeexpectedtxtfromrev195625trunkLayoutTestsfastloaderstateobjectsreplacestatefrequencyiframeexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe-expected.txt (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe-expected.txt) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe-expected.txt                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe-expected.txt        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,111 @@
</span><ins>+Test should not crash.
+Test does replaceStates both from the main frame and from an iframe and makes sure they both count against state object count limit.
+Click to test replaceState through a user gesture
+Successfully added item: 0
+Successfully added item: 1
+Successfully added item: 2
+Successfully added item: 3
+Successfully added item: 4
+Successfully added item: 5
+Successfully added item: 6
+Successfully added item: 7
+Successfully added item: 8
+Successfully added item: 9
+Successfully added item: 10
+Successfully added item: 11
+Successfully added item: 12
+Successfully added item: 13
+Successfully added item: 14
+Successfully added item: 15
+Successfully added item: 16
+Successfully added item: 17
+Successfully added item: 18
+Successfully added item: 19
+Successfully added item: 20
+Successfully added item: 21
+Successfully added item: 22
+Successfully added item: 23
+Successfully added item: 24
+Successfully added item: 25
+Successfully added item: 26
+Successfully added item: 27
+Successfully added item: 28
+Successfully added item: 29
+Successfully added item: 30
+Successfully added item: 31
+Successfully added item: 32
+Successfully added item: 33
+Successfully added item: 34
+Successfully added item: 35
+Successfully added item: 36
+Successfully added item: 37
+Successfully added item: 38
+Successfully added item: 39
+Successfully added item: 40
+Successfully added item: 41
+Successfully added item: 42
+Successfully added item: 43
+Successfully added item: 44
+Successfully added item: 45
+Successfully added item: 46
+Successfully added item: 47
+Successfully added item: 48
+Successfully added item: 49
+Successfully added item: 50
+Successfully added item: 51
+Successfully added item: 52
+Successfully added item: 53
+Successfully added item: 54
+Successfully added item: 55
+Successfully added item: 56
+Successfully added item: 57
+Successfully added item: 58
+Successfully added item: 59
+Successfully added item: 60
+Successfully added item: 61
+Successfully added item: 62
+Successfully added item: 63
+Successfully added item: 64
+Successfully added item: 65
+Successfully added item: 66
+Successfully added item: 67
+Successfully added item: 68
+Successfully added item: 69
+Successfully added item: 70
+Successfully added item: 71
+Successfully added item: 72
+Successfully added item: 73
+Successfully added item: 74
+
+
+--------
+Frame: '&lt;!--framePath //&lt;!--frame0--&gt;--&gt;'
+--------
+Adding state objects in iframe
+Successfully added item: 0
+Successfully added item: 1
+Successfully added item: 2
+Successfully added item: 3
+Successfully added item: 4
+Successfully added item: 5
+Successfully added item: 6
+Successfully added item: 7
+Successfully added item: 8
+Successfully added item: 9
+Successfully added item: 10
+Successfully added item: 11
+Successfully added item: 12
+Successfully added item: 13
+Successfully added item: 14
+Successfully added item: 15
+Successfully added item: 16
+Successfully added item: 17
+Successfully added item: 18
+Successfully added item: 19
+Successfully added item: 20
+Successfully added item: 21
+Successfully added item: 22
+Successfully added item: 23
+Successfully added item: 24
+Expected exception: Error: SecurityError: DOM Exception 18
+
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencyiframehtmlfromrev195625trunkLayoutTestsfastloaderstateobjectsreplacestatefrequencyiframehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe.html (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe.html) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe.html                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-iframe.html        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,40 @@
</span><ins>+&lt;script&gt;
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.dumpChildFramesAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById(&quot;logger&quot;).innerHTML += msg + &quot;&lt;br&gt;&quot;;
+}
+
+window.onload = function()
+{
+    try {
+        for( var i = 0; i &lt; 75; ++i ) {
+            history.replaceState(0, 0, i.toString());
+            log(&quot;Successfully added item: &quot; + i);
+        }
+    } catch (e) {
+        log(e);
+    }
+
+    openFrame();
+}
+
+function openFrame()
+{
+    var iframe = document.createElement('iframe');
+    iframe.src = 'resources/replaceState-iframe.html'
+    document.body.appendChild(iframe);
+}
+
+&lt;/script&gt;
+&lt;body&gt;
+Test should not crash.&lt;br&gt;
+Test does replaceStates both from the main frame and from an iframe and makes sure they both count against state object count limit.&lt;br&gt;
+&lt;button id=&quot;button&quot; onclick=&quot;clicked();&quot;&gt;Click to test replaceState through a user gesture&lt;/button&gt;
+&lt;div id=&quot;logger&quot;&gt;&lt;/div&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencywithusergestureexpectedtxtfromrev195625trunkLayoutTestsfastloaderstateobjectsreplacestatefrequencywithusergestureexpectedtxt"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture-expected.txt        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,206 @@
</span><ins>+Test should complete quickly and not crash.
+Click to test replaceState through a user gesture
+Successfully added item: 0
+Successfully added item: 1
+Successfully added item: 2
+Successfully added item: 3
+Successfully added item: 4
+Successfully added item: 5
+Successfully added item: 6
+Successfully added item: 7
+Successfully added item: 8
+Successfully added item: 9
+Successfully added item: 10
+Successfully added item: 11
+Successfully added item: 12
+Successfully added item: 13
+Successfully added item: 14
+Successfully added item: 15
+Successfully added item: 16
+Successfully added item: 17
+Successfully added item: 18
+Successfully added item: 19
+Successfully added item: 20
+Successfully added item: 21
+Successfully added item: 22
+Successfully added item: 23
+Successfully added item: 24
+Successfully added item: 25
+Successfully added item: 26
+Successfully added item: 27
+Successfully added item: 28
+Successfully added item: 29
+Successfully added item: 30
+Successfully added item: 31
+Successfully added item: 32
+Successfully added item: 33
+Successfully added item: 34
+Successfully added item: 35
+Successfully added item: 36
+Successfully added item: 37
+Successfully added item: 38
+Successfully added item: 39
+Successfully added item: 40
+Successfully added item: 41
+Successfully added item: 42
+Successfully added item: 43
+Successfully added item: 44
+Successfully added item: 45
+Successfully added item: 46
+Successfully added item: 47
+Successfully added item: 48
+Successfully added item: 49
+Successfully added item: 50
+Successfully added item: 51
+Successfully added item: 52
+Successfully added item: 53
+Successfully added item: 54
+Successfully added item: 55
+Successfully added item: 56
+Successfully added item: 57
+Successfully added item: 58
+Successfully added item: 59
+Successfully added item: 60
+Successfully added item: 61
+Successfully added item: 62
+Successfully added item: 63
+Successfully added item: 64
+Successfully added item: 65
+Successfully added item: 66
+Successfully added item: 67
+Successfully added item: 68
+Successfully added item: 69
+Successfully added item: 70
+Successfully added item: 71
+Successfully added item: 72
+Successfully added item: 73
+Successfully added item: 74
+Successfully added item: 75
+Successfully added item: 76
+Successfully added item: 77
+Successfully added item: 78
+Successfully added item: 79
+Successfully added item: 80
+Successfully added item: 81
+Successfully added item: 82
+Successfully added item: 83
+Successfully added item: 84
+Successfully added item: 85
+Successfully added item: 86
+Successfully added item: 87
+Successfully added item: 88
+Successfully added item: 89
+Successfully added item: 90
+Successfully added item: 91
+Successfully added item: 92
+Successfully added item: 93
+Successfully added item: 94
+Successfully added item: 95
+Successfully added item: 96
+Successfully added item: 97
+Successfully added item: 98
+Successfully added item: 99
+Error: SecurityError: DOM Exception 18
+Successfully added user gesture item: 0
+Successfully added user gesture item: 1
+Successfully added user gesture item: 2
+Successfully added user gesture item: 3
+Successfully added user gesture item: 4
+Successfully added user gesture item: 5
+Successfully added user gesture item: 6
+Successfully added user gesture item: 7
+Successfully added user gesture item: 8
+Successfully added user gesture item: 9
+Successfully added user gesture item: 10
+Successfully added user gesture item: 11
+Successfully added user gesture item: 12
+Successfully added user gesture item: 13
+Successfully added user gesture item: 14
+Successfully added user gesture item: 15
+Successfully added user gesture item: 16
+Successfully added user gesture item: 17
+Successfully added user gesture item: 18
+Successfully added user gesture item: 19
+Successfully added user gesture item: 20
+Successfully added user gesture item: 21
+Successfully added user gesture item: 22
+Successfully added user gesture item: 23
+Successfully added user gesture item: 24
+Successfully added user gesture item: 25
+Successfully added user gesture item: 26
+Successfully added user gesture item: 27
+Successfully added user gesture item: 28
+Successfully added user gesture item: 29
+Successfully added user gesture item: 30
+Successfully added user gesture item: 31
+Successfully added user gesture item: 32
+Successfully added user gesture item: 33
+Successfully added user gesture item: 34
+Successfully added user gesture item: 35
+Successfully added user gesture item: 36
+Successfully added user gesture item: 37
+Successfully added user gesture item: 38
+Successfully added user gesture item: 39
+Successfully added user gesture item: 40
+Successfully added user gesture item: 41
+Successfully added user gesture item: 42
+Successfully added user gesture item: 43
+Successfully added user gesture item: 44
+Successfully added user gesture item: 45
+Successfully added user gesture item: 46
+Successfully added user gesture item: 47
+Successfully added user gesture item: 48
+Successfully added user gesture item: 49
+Successfully added user gesture item: 50
+Successfully added user gesture item: 51
+Successfully added user gesture item: 52
+Successfully added user gesture item: 53
+Successfully added user gesture item: 54
+Successfully added user gesture item: 55
+Successfully added user gesture item: 56
+Successfully added user gesture item: 57
+Successfully added user gesture item: 58
+Successfully added user gesture item: 59
+Successfully added user gesture item: 60
+Successfully added user gesture item: 61
+Successfully added user gesture item: 62
+Successfully added user gesture item: 63
+Successfully added user gesture item: 64
+Successfully added user gesture item: 65
+Successfully added user gesture item: 66
+Successfully added user gesture item: 67
+Successfully added user gesture item: 68
+Successfully added user gesture item: 69
+Successfully added user gesture item: 70
+Successfully added user gesture item: 71
+Successfully added user gesture item: 72
+Successfully added user gesture item: 73
+Successfully added user gesture item: 74
+Successfully added user gesture item: 75
+Successfully added user gesture item: 76
+Successfully added user gesture item: 77
+Successfully added user gesture item: 78
+Successfully added user gesture item: 79
+Successfully added user gesture item: 80
+Successfully added user gesture item: 81
+Successfully added user gesture item: 82
+Successfully added user gesture item: 83
+Successfully added user gesture item: 84
+Successfully added user gesture item: 85
+Successfully added user gesture item: 86
+Successfully added user gesture item: 87
+Successfully added user gesture item: 88
+Successfully added user gesture item: 89
+Successfully added user gesture item: 90
+Successfully added user gesture item: 91
+Successfully added user gesture item: 92
+Successfully added user gesture item: 93
+Successfully added user gesture item: 94
+Successfully added user gesture item: 95
+Successfully added user gesture item: 96
+Successfully added user gesture item: 97
+Successfully added user gesture item: 98
+Successfully added user gesture item: 99
+User gesture: Error: SecurityError: DOM Exception 18
+Test complete
+
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencywithusergesturehtmlfromrev195625trunkLayoutTestsfastloaderstateobjectsreplacestatefrequencywithusergesturehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,51 @@
</span><ins>+&lt;script&gt;
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById(&quot;logger&quot;).innerHTML += msg + &quot;&lt;br&gt;&quot;;
+}
+
+window.onload = function()
+{
+    try {
+        for( var i = 0; i &lt; 100000; ++i ) {
+            history.replaceState(0, 0, i);
+            log(&quot;Successfully added item: &quot; + i);
+        }
+    } catch (e) {
+        log(e);
+    }
+    
+    var button = document.getElementById(&quot;button&quot;);
+    eventSender.mouseMoveTo(button.offsetLeft + 5, button.offsetTop + 5);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+}
+
+function clicked()
+{
+    try {
+        for( var i = 0; i &lt; 100000; ++i ) {
+            history.replaceState(0, 0, i);
+            log(&quot;Successfully added user gesture item: &quot; + i);
+        }
+    } catch (e) {
+        log(&quot;User gesture: &quot; + e);
+    }
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+
+    log(&quot;Test complete&quot;);
+}
+
+&lt;/script&gt;
+&lt;body&gt;
+Test should complete quickly and not crash.&lt;br&gt;
+&lt;button id=&quot;button&quot; onclick=&quot;clicked();&quot;&gt;Click to test replaceState through a user gesture&lt;/button&gt;
+&lt;div id=&quot;logger&quot;&gt;&lt;/div&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectsreplacestatefrequencyhtmlfromrev195625trunkLayoutTestsfastloaderstateobjectsreplacestatefrequencyhtml"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency.html (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/replacestate-frequency.html) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency.html                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/replacestate-frequency.html        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,32 @@
</span><ins>+&lt;script&gt;
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById(&quot;logger&quot;).innerHTML += msg + &quot;&lt;br&gt;&quot;;
+}
+
+window.onload = function() {
+    try {
+        for( var i = 0; i &lt; 100000; ++i ) {
+            history.replaceState(0, 0, i.toString());
+            log(&quot;Successfully added item: &quot; + i);
+        }
+    } catch (e) {
+        log(e);
+    }
+
+    if (window.testRunner)
+        testRunner.notifyDone();
+
+    log(&quot;Test complete&quot;);
+}
+
+&lt;/script&gt;
+&lt;body&gt;
+Test should complete quickly and not crash.&lt;br&gt;
+&lt;div id=&quot;logger&quot;&gt;&lt;/div&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectsresourcespushstateiframehtmlfromrev195625trunkLayoutTestsfastloaderstateobjectsresourcespushstateiframehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/resources/pushstate-iframe.html (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/resources/pushstate-iframe.html) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/resources/pushstate-iframe.html                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/resources/pushstate-iframe.html        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,30 @@
</span><ins>+&lt;script&gt;
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById(&quot;logger&quot;).innerHTML += msg + &quot;&lt;br&gt;&quot;;
+}
+
+window.onload = function()
+{
+    log(&quot;Adding state objects in iframe&quot;);
+    try {
+        for( var i = 0; i &lt; 75; ++i ) {
+            history.pushState(0, 0, i.toString());
+            log(&quot;Successfully added item: &quot; + i);
+        }
+    } catch (e) {
+        log(&quot;Expected exception: &quot; + e);
+        if (window.testRunner)
+            testRunner.notifyDone();    
+    }
+}
+
+&lt;/script&gt;
+&lt;body&gt;
+&lt;div id=&quot;logger&quot;&gt;&lt;/div&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="branchessafari601146branchLayoutTestsfastloaderstateobjectsresourcesreplacestateiframehtmlfromrev195625trunkLayoutTestsfastloaderstateobjectsresourcesreplacestateiframehtml"></a>
<div class="copfile"><h4>Copied: branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/resources/replacestate-iframe.html (from rev 195625, trunk/LayoutTests/fast/loader/stateobjects/resources/replacestate-iframe.html) (0 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/resources/replacestate-iframe.html                                (rev 0)
+++ branches/safari-601.1.46-branch/LayoutTests/fast/loader/stateobjects/resources/replacestate-iframe.html        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -0,0 +1,30 @@
</span><ins>+&lt;script&gt;
+
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById(&quot;logger&quot;).innerHTML += msg + &quot;&lt;br&gt;&quot;;
+}
+
+window.onload = function()
+{
+    log(&quot;Adding state objects in iframe&quot;);
+    try {
+        for( var i = 0; i &lt; 75; ++i ) {
+            history.replaceState(0, 0, i.toString());
+            log(&quot;Successfully added item: &quot; + i);
+        }
+    } catch (e) {
+        log(&quot;Expected exception: &quot; + e);
+        if (window.testRunner)
+            testRunner.notifyDone();    
+    }
+}
+
+&lt;/script&gt;
+&lt;body&gt;
+&lt;div id=&quot;logger&quot;&gt;&lt;/div&gt;
+&lt;/body&gt;
</ins></span></pre></div>
<a id="branchessafari601146branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/ChangeLog (195709 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/ChangeLog        2016-01-28 00:37:00 UTC (rev 195709)
+++ branches/safari-601.1.46-branch/Source/WebCore/ChangeLog        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -1,5 +1,38 @@
</span><span class="cx"> 2016-01-27  Babak Shafiei  &lt;bshafiei@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Merge r195625.
+
+    2016-01-26  Brady Eidson  &lt;beidson@apple.com&gt;
+
+            History.pushState causes intense memory pressure.
+            https://bugs.webkit.org/show_bug.cgi?id=153435
+
+            Reviewed by Sam Weinig, Oliver Hunt, and Geoff Garen.
+
+            Tests: fast/loader/stateobjects/pushstate-frequency-iframe.html
+                   fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html
+                   fast/loader/stateobjects/pushstate-frequency.html
+                   fast/loader/stateobjects/replacestate-frequency-iframe.html
+                   fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html
+                   fast/loader/stateobjects/replacestate-frequency.html
+                   loader/stateobjects/pushstate-size-iframe.html
+                   loader/stateobjects/pushstate-size.html
+                   loader/stateobjects/replacestate-size-iframe.html
+                   loader/stateobjects/replacestate-size.html
+
+            Add restrictions on how frequently push/replaceState can be called,
+            as well as how much of a cumulative payload they can deliver.
+
+            * bindings/js/JSHistoryCustom.cpp:
+            (WebCore::JSHistory::pushState):
+            (WebCore::JSHistory::replaceState):
+
+            * page/History.cpp:
+            (WebCore::History::stateObjectAdded):
+            * page/History.h:
+
+2016-01-27  Babak Shafiei  &lt;bshafiei@apple.com&gt;
+
</ins><span class="cx">         Merge r195671.
</span><span class="cx"> 
</span><span class="cx">     2016-01-26  Jer Noble  &lt;jer.noble@apple.com&gt;
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCorebindingsjsJSHistoryCustomcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/bindings/js/JSHistoryCustom.cpp (195709 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/bindings/js/JSHistoryCustom.cpp        2016-01-28 00:37:00 UTC (rev 195709)
+++ branches/safari-601.1.46-branch/Source/WebCore/bindings/js/JSHistoryCustom.cpp        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -139,7 +139,7 @@
</span><span class="cx">             return jsUndefined();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    ExceptionCode ec = 0;
</del><ins>+    ExceptionCode ec;
</ins><span class="cx">     impl().stateObjectAdded(historyState.release(), title, url, History::StateObjectType::Push, ec);
</span><span class="cx">     setDOMException(exec, ec);
</span><span class="cx"> 
</span><span class="lines">@@ -168,7 +168,7 @@
</span><span class="cx">             return jsUndefined();
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    ExceptionCode ec = 0;
</del><ins>+    ExceptionCode ec;
</ins><span class="cx">     impl().stateObjectAdded(historyState.release(), title, url, History::StateObjectType::Replace, ec);
</span><span class="cx">     setDOMException(exec, ec);
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCorepageHistorycpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/page/History.cpp (195709 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/page/History.cpp        2016-01-28 00:37:00 UTC (rev 195709)
+++ branches/safari-601.1.46-branch/Source/WebCore/page/History.cpp        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -34,9 +34,12 @@
</span><span class="cx"> #include &quot;FrameLoaderClient.h&quot;
</span><span class="cx"> #include &quot;HistoryController.h&quot;
</span><span class="cx"> #include &quot;HistoryItem.h&quot;
</span><ins>+#include &quot;MainFrame.h&quot;
</ins><span class="cx"> #include &quot;Page.h&quot;
</span><ins>+#include &quot;ScriptController.h&quot;
</ins><span class="cx"> #include &quot;SecurityOrigin.h&quot;
</span><span class="cx"> #include &quot;SerializedScriptValue.h&quot;
</span><ins>+#include &lt;wtf/CheckedArithmetic.h&gt;
</ins><span class="cx"> #include &lt;wtf/MainThread.h&gt;
</span><span class="cx"> 
</span><span class="cx"> namespace WebCore {
</span><span class="lines">@@ -138,15 +141,77 @@
</span><span class="cx"> 
</span><span class="cx"> void History::stateObjectAdded(PassRefPtr&lt;SerializedScriptValue&gt; data, const String&amp; title, const String&amp; urlString, StateObjectType stateObjectType, ExceptionCode&amp; ec)
</span><span class="cx"> {
</span><ins>+    // Each unique main-frame document is only allowed to send 64mb of state object payload to the UI client/process.
+    static uint32_t totalStateObjectPayloadLimit = 0x4000000;
+    static unsigned perUserGestureStateObjectLimit = 100;
+
</ins><span class="cx">     if (!m_frame || !m_frame-&gt;page())
</span><span class="cx">         return;
</span><del>-    
</del><ins>+
</ins><span class="cx">     URL fullURL = urlForState(urlString);
</span><span class="cx">     if (!fullURL.isValid() || !m_frame-&gt;document()-&gt;securityOrigin()-&gt;canRequest(fullURL)) {
</span><span class="cx">         ec = SECURITY_ERR;
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    Document* mainDocument = m_frame-&gt;page()-&gt;mainFrame().document();
+    History* mainHistory = nullptr;
+    if (mainDocument) {
+        if (auto* mainDOMWindow = mainDocument-&gt;domWindow())
+            mainHistory = mainDOMWindow-&gt;history();
+    }
+
+    if (!mainHistory)
+        return;
+
+    bool processingUserGesture = ScriptController::processingUserGesture();
+    if (!processingUserGesture &amp;&amp; mainHistory-&gt;m_nonUserGestureObjectsAdded &gt;= perUserGestureStateObjectLimit) {
+        ec = SECURITY_ERR;
+        return;
+    }
+
+    double userGestureTimestamp = mainDocument-&gt;lastHandledUserGestureTimestamp();
+    if (processingUserGesture) {
+        if (mainHistory-&gt;m_currentUserGestureTimestamp &lt; userGestureTimestamp) {
+            mainHistory-&gt;m_currentUserGestureTimestamp = userGestureTimestamp;
+            mainHistory-&gt;m_currentUserGestureObjectsAdded = 0;
+        }
+
+        if (mainHistory-&gt;m_currentUserGestureObjectsAdded &gt;= perUserGestureStateObjectLimit) {
+            ec = SECURITY_ERR;
+            return;
+        }
+    }
+
+    Checked&lt;unsigned&gt; titleSize = title.length();
+    titleSize *= 2;
+
+    Checked&lt;unsigned&gt; urlSize = fullURL.string().length();
+    urlSize *= 2;
+
+    Checked&lt;uint64_t&gt; payloadSize = titleSize;
+    payloadSize += urlSize;
+    payloadSize += data ? data-&gt;data().size() : 0;
+
+    Checked&lt;uint64_t&gt; newTotalUsage = mainHistory-&gt;m_totalStateObjectUsage;
+
+    if (stateObjectType == StateObjectType::Replace)
+        newTotalUsage -= m_mostRecentStateObjectUsage;
+    newTotalUsage += payloadSize;
+
+    if (newTotalUsage &gt; totalStateObjectPayloadLimit) {
+        ec = QUOTA_EXCEEDED_ERR;
+        return;
+    }
+
+    m_mostRecentStateObjectUsage = payloadSize.unsafeGet();
+
+    mainHistory-&gt;m_totalStateObjectUsage = newTotalUsage.unsafeGet();
+    if (processingUserGesture)
+        ++mainHistory-&gt;m_currentUserGestureObjectsAdded;
+    else
+        ++mainHistory-&gt;m_nonUserGestureObjectsAdded;
+
</ins><span class="cx">     if (!urlString.isEmpty())
</span><span class="cx">         m_frame-&gt;document()-&gt;updateURLForPushOrReplaceState(fullURL);
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari601146branchSourceWebCorepageHistoryh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1.46-branch/Source/WebCore/page/History.h (195709 => 195710)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1.46-branch/Source/WebCore/page/History.h        2016-01-28 00:37:00 UTC (rev 195709)
+++ branches/safari-601.1.46-branch/Source/WebCore/page/History.h        2016-01-28 00:38:44 UTC (rev 195710)
</span><span class="lines">@@ -71,6 +71,16 @@
</span><span class="cx">     PassRefPtr&lt;SerializedScriptValue&gt; stateInternal() const;
</span><span class="cx"> 
</span><span class="cx">     RefPtr&lt;SerializedScriptValue&gt; m_lastStateObjectRequested;
</span><ins>+
+    unsigned m_nonUserGestureObjectsAdded { 0 };
+    unsigned m_currentUserGestureObjectsAdded { 0 };
+    double m_currentUserGestureTimestamp { 0 };
+
+    // For the main frame's History object to keep track of all state object usage.
+    uint64_t m_totalStateObjectUsage { 0 };
+
+    // For each individual History object to keep track of the most recent state object added.
+    uint64_t m_mostRecentStateObjectUsage { 0 };
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore
</span></span></pre>
</div>
</div>

</body>
</html>