2019-03-19  Alicia Boya Garc?a  <aboya@igalia.com>

        [MSE] Use tolerance in eraseBeginTime
        https://bugs.webkit.org/show_bug.cgi?id=195911

        Reviewed by Jer Noble.

        https://bugs.webkit.org/show_bug.cgi?id=190085 introduced tolerance
        when erasing frames during the Coded Frame Processing algorithm in
        such a way that, in files with less than perfect timestamps, a frame
        existing before after the current append is not erased accidentally
        due to small overlaps.

        This patch takes care of the opposite problem: we don't want an old
        frame being accidentally NOT erased by a new one with the same
        timestamps just because these overlaps make
        highestPresentationTimestamp very slightly higher than the frame PTS.

        This bug in practice causes some frames of the old quality to not be
        erased when the new quality is appended, resulting in some seemingly
        still frames from a different quality appearing at some points during
        WebM video in presence of quality changes.

        This bug can be reduced to this minimal test case that illustrates the
        timestamp imprecission of a typical WebM file:

        function sampleRun(generation) {
            return concatenateSamples([
                makeASample(     0,      0, 166667, 1000000, 1, SAMPLE_FLAG.SYNC, generation),
                makeASample(167000, 167000, 166667, 1000000, 1, SAMPLE_FLAG.NONE, generation),
                makeASample(333000, 333000, 166667, 1000000, 1, SAMPLE_FLAG.SYNC, generation), // overlaps previous frame
                makeASample(500000, 500000, 166667, 1000000, 1, SAMPLE_FLAG.NONE, generation),
            ]);
        }

        After appending this twice it would be expected that the second
        generation takes fully over the first, since the timestamps are
        completely the same. Due to the bug, sync frames with an overlap, like
        the third one in that list, actually persist from the first
        generation, due to lack of tolerance when comparing the start of a new
        frame with highestPresentationTimestamp.

        This patch introduces the tolerance in that case too to fix this
        problem.

        Test: media/media-source/media-source-append-twice-overlapping-sync-frame.html

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2018-12-10  Mark Lam  <mark.lam@apple.com>

        Cherry-pick r239062. rdar://problem/46603464

    2018-12-10  Mark Lam  <mark.lam@apple.com>

            PropertyAttribute needs a CustomValue bit.
            https://bugs.webkit.org/show_bug.cgi?id=191993
            <rdar://problem/46264467>

            Reviewed by Saam Barati.

            This patch revealed a bug in the CodeGenerator where a constructor property is
            set with a ReadOnly attribute.  This conflicts with the WebIDL link (see clause
            12 in https://heycam.github.io/webidl/#interface-prototype-object) which states
            that it should be [Writable].  The ReadOnly attribute is now removed.

            On the WebCore side, this change is covered by existing tests.

            * bindings/scripts/CodeGeneratorJS.pm:
            (GenerateImplementation):
            * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
            (WebCore::jsTestCustomConstructorWithNoInterfaceObjectConstructor):

2018-12-05  Alan Coon  <alancoon@apple.com>

        Apply patch. rdar://problem/46085280

    2018-12-05  Brent Fulgham  <bfulgham@apple.com>

            Lifetime of HTMLMediaElement is not properly handled in asynchronous actions
            https://bugs.webkit.org/show_bug.cgi?id=192087
            <rdar://problem/45975230>

            Reviewed by Dean Jackson.

            The HTMLMediaElement performs operations that allow arbitrary JavaScript to run. We need to make
            sure the active media element is protected until those calls complete.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::didFinishInsertingNode):
            (WebCore::HTMLMediaElement::exitFullscreen):
            (WebCore::HTMLMediaElement::markCaptionAndSubtitleTracksAsUnconfigured):
            (WebCore::HTMLMediaElement::scheduleConfigureTextTracks):
            (WebCore::HTMLMediaElement::scheduleMediaEngineWasUpdated):
            (WebCore::HTMLMediaElement::scheduleUpdatePlayState):
            (WebCore::HTMLMediaElement::scheduleUpdateMediaState):
            
2018-11-16  Jiewen Tan  <jiewen_tan@apple.com>

        Disallow loading webarchives as iframes
        https://bugs.webkit.org/show_bug.cgi?id=191728
        <rdar://problem/45524528>

        Reviewed by Youenn Fablet.

        Disallow loading webarchives as iframes. We don't allow loading remote webarchives.
        Now, this policy is hardened to disallow loading webarchives as iframes for local
        documents as well.

        To allow old tests still be able to run, a flag is added to always allow loading local
        webarchives in document. The flag can be set via window.internals.

        Tests: webarchive/loading/test-loading-archive-subresource.html
               webarchive/loading/test-loading-top-archive.html

        * dom/Document.h:
        (WebCore::Document::setAlwaysAllowLocalWebarchive):
        (WebCore::Document::alwaysAllowLocalWebarchive):
        * loader/DocumentLoader.cpp:
        (WebCore::disallowWebArchive):
        (WebCore::DocumentLoader::continueAfterContentPolicy):
        (WebCore::isRemoteWebArchive): Deleted.
        * testing/Internals.cpp:
        (WebCore::Internals::setAlwaysAllowLocalWebarchive const):
        * testing/Internals.h:
        * testing/Internals.idl:

2016-10-13  Alex Christensen  <achristensen@webkit.org>

        Fix API test after r207318.
        https://bugs.webkit.org/show_bug.cgi?id=162951

        This fixes the API test WebKit2.PendingAPIRequestURL which asserted when trying to hash a null String.

        * loader/DocumentLoader.cpp:
        (WebCore::isRemoteWebArchive):
        If the mimeType is a null String, it is not in the set webArchiveMIMETypes, so return false instead of hashing it.

2016-10-13  Andy Estes  <aestes@apple.com>

        [iOS] Support Web Archive previews generated by QuickLook
        https://bugs.webkit.org/show_bug.cgi?id=162951
        <rdar://problem/28607920>

        Reviewed by Brady Eidson.

        QuickLook might generate a Web Archive preview for some resource types, but WebKit would
        refuse to load it due to the prohibition on loading remote Web Archives. Even though the
        original resource might be from a remote origin, the QuickLook-generated preview is a
        trusted local resource, so allow it to be loaded.

        No test possible.

        * loader/DocumentLoader.cpp:
        (WebCore::isRemoteWebArchive): Added. Moved the remote web archive check from
        continueAfterContentPolicy() to here, and added a check for responses containing the
        QuickLook preview protocol.
        (WebCore::DocumentLoader::continueAfterContentPolicy): Called isRemoteWebArchive().

2018-10-18  Jer Noble  <jer.noble@apple.com>

        [MSE] timestampOffset can introduce floating-point rounding errors to incoming samples
        https://bugs.webkit.org/show_bug.cgi?id=190590
        <rdar://problem/45275626>

        Reviewed by Eric Carlson.

        Test: media/media-source/media-source-timestampoffset-rounding-error.html

        SourceBuffer.timestampOffset is a double property, which, when added to a MediaTime will
        result in a double-backed MediaTime as PTS & DTS. This can introduce rounding errors when
        these samples are appended as overlapping existing samples. Rather than converting a MediaTime
        to double-backed when adding the timestampOffset, convert the offset to a multiple of the
        sample's timeBase.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::setTimestampOffset):
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2018-10-27  Charlie Turner  <cturner@igalia.com>

        Fix release build with -DLOG_DISABLED=0
        https://bugs.webkit.org/show_bug.cgi?id=190866

        Reviewed by Xabier Rodriguez-Calvar.

        No new tests since no functionality changed.

        * platform/graphics/Font.cpp:
        * platform/graphics/Font.h:
        * platform/graphics/FontPlatformData.h:
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        * platform/graphics/freetype/FontPlatformDataFreeType.cpp:
        * platform/graphics/win/FontPlatformDataWin.cpp:

2018-10-15  Yoshiaki Jitsukawa  <yoshiaki.jitsukawa@sony.com>

        [Cairo] Incorrect rendering for 135-deg skews
        https://bugs.webkit.org/show_bug.cgi?id=190513

        Compensation value to zero the the translation components
        of the transformation matrix is incorrect if the matrix
        has a shear factor.

        Reviewed by ?an Dober?ek.

        Tests: fast/transforms/skew-x-135deg-with-gradient.html
               fast/transforms/skew-y-135deg-with-gradient.html

        * platform/graphics/cairo/CairoUtilities.cpp:
        (WebCore::drawPatternToCairoContext):

2018-09-20  Zalan Bujtas  <zalan@apple.com>

        Release assert under RenderView::pageOrViewLogicalHeight
        https://bugs.webkit.org/show_bug.cgi?id=189798
        <rdar://problem/43659749>

        Reviewed by Simon Fraser.

        Only the mainframe's render view is sized to the page while printing.
        Use the matching check (see RenderView::layout) when accessing m_pageLogicalSize.

        Test: printing/crash-while-formatting-subframe-for-printing.html

        * rendering/RenderView.cpp:
        (WebCore::RenderView::pageOrViewLogicalHeight const):

2018-10-31  Alicia Boya Garc?a  <aboya@igalia.com>

        [MSE] Use tolerance when growing the coded frame group
        https://bugs.webkit.org/show_bug.cgi?id=190085

        Reviewed by Jer Noble.

        Test: media/media-source/media-source-append-acb-tolerance.html

        This patch introduces a millisecond tolerance in the range of
        potential frames that should be erased frame from the track buffer
        when the coded frame group is growing.

        This is necessary because some files have imprecise overlapping
        timestamps (especially WebM files).

        This fixes a stall when seeking back and forth in YouTube with WebM
        video.

        A test case simulating the problem with video/mock using timestamps
        similar to those of a typical 30 fps WebM video is also added.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2018-09-27  Alicia Boya Garc?a  <aboya@igalia.com>

        [MSE] Fix unwanted sample erase from the decode queue
        https://bugs.webkit.org/show_bug.cgi?id=180643

        Reviewed by Jer Noble.

        Test: media/media-source/media-source-append-acb-no-frame-lost.html

        This bug reproduced when unordered appends were made. For instance, if
        the application appended [0, 10) and then [20, 30), the frame at 20
        would be wrongly discarded from the decode queue.

        Later the application could append [10, 20) and the gap at [20, 21)
        would persist in the decode queue, even if the frame remained in the
        track buffer table.

        Thanks to Daniel Zhang for reporting the issue.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::provideMediaData):

2018-09-21  Alicia Boya Garcia  <aboya@igalia.com>

        [MSE] Fix comparsion with uninitialized greatestDecodeDuration
        https://bugs.webkit.org/show_bug.cgi?id=189805

        Reviewed by Michael Catanzaro.

        This bug was causing greatestDecodeDuration to never be initialized,
        which in turned caused unintended frame erase as distant appends where
        not being recognized as distinct coded frame groups.

        A test reproducing the sequence of appends that caused unintended
        frame deletion has also been added (media-source-append-out-of-order.html).

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2018-09-20  Alicia Boya Garcia  <aboya@igalia.com>

        [MSE] Use some tolerance when deciding whether a frame should be appended to the decode queue
        https://bugs.webkit.org/show_bug.cgi?id=189782

        Reviewed by Xabier Rodriguez-Calvar.

        Ideally, container formats should use exact timestamps and frames
        should not overlap. Unfortunately, there are lots of files out there
        where this is not always the case.

        This is particularly a problem in WebM, where timestamps are expressed
        in a power of 10 timescale, which forces some rounding.

        This patch makes SourceBuffer allow frames with a small overlaps
        (<=1ms) as those usually found in WebM. 1 ms is chosen because it's
        the default time scale of WebM files.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2018-07-29  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r234329. rdar://problem/42721126

    [WK1] ASSERTION FAILED: renderer().repaintLayoutRects().m_repaintRect == renderer().clippedOverflowRectForRepaint(renderer().containerForRepaint()) in WebCore::RenderLayer::updateLayerPositionsAfterScroll
    https://bugs.webkit.org/show_bug.cgi?id=188122
    <rdar://problem/42584790>
    
    Reviewed by Simon Fraser.
    
    Source/WebCore:
    
    When ScrollView's m_paintsEntireContents flag flips due to layer backing changes, the repaint area transitions from
    visual to layout overflow. When this happens the cached repaint rects become invalid and they need to be recomputed.
    Currently there's no mechanism to trigger repaint cache invalidation from ScrollView.
    Skip assertion for now on WK1 (see webkit.org/b/188121)
    
    * rendering/RenderLayer.cpp:
    (WebCore::RenderLayer::updateLayerPositionsAfterScroll):
    
    LayoutTests:
    
    * platform/mac-wk1/TestExpectations:
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234329 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-27  Zalan Bujtas  <zalan@apple.com>

            [WK1] ASSERTION FAILED: renderer().repaintLayoutRects().m_repaintRect == renderer().clippedOverflowRectForRepaint(renderer().containerForRepaint()) in WebCore::RenderLayer::updateLayerPositionsAfterScroll
            https://bugs.webkit.org/show_bug.cgi?id=188122
            <rdar://problem/42584790>

            Reviewed by Simon Fraser.

            When ScrollView's m_paintsEntireContents flag flips due to layer backing changes, the repaint area transitions from
            visual to layout overflow. When this happens the cached repaint rects become invalid and they need to be recomputed.
            Currently there's no mechanism to trigger repaint cache invalidation from ScrollView.
            Skip assertion for now on WK1 (see webkit.org/b/188121)

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::updateLayerPositionsAfterScroll):

2018-07-12  Zalan Bujtas  <zalan@apple.com>

        Newly added float should trigger full layout on the block.
        https://bugs.webkit.org/show_bug.cgi?id=187251
        <rdar://problem/41726137>

        Reviewed by David Kilzer.

        RenderBlockFlow::determineStartPosition() is one of the places where we decide the extent of the line layout for the current block.
        In here we try to figure out the first line in the block that requires layout. In certain cases when floats are present,
        (due to their intrusive behavior) we just trigger a full layout on the entire block.
        One of the special cases is when a new float is added to the block. determineStartPosition() checks for such floats (floats inserted
        after the "last known float") and marks the block for full layout. However it missed the case when other, unrelated mutations happened
        in addition to this newly inserted float. This patch fixes this case by checking if the floats after the "last know float" actually need layout.

        Test: fast/inline/new-float-needs-layout-when-line-is-dirty.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::determineStartPosition):

2016-10-12  Zalan Bujtas  <zalan@apple.com>

        Refactor LineLayoutState's float box handling.
        https://bugs.webkit.org/show_bug.cgi?id=163286

        Reviewed by David Hyatt.
        
        We keep track of float boxes both per line (RootInlineBox::m_floats) and
        per flow block (LineLayoutState::m_floats) during layout.
        As we lay out the lines and iterate through RootInlineBox::m_floats, we
        increment LineLayoutState::m_floatIndex. This LineLayoutState::m_floatIndex is
        later used to find the matching float box in the per-block-flow float list.
        This logic works fine as long as the lists and the index manipulation are tightly coded.
        However due to the complexity of the line/float layout code, this is no longer the case.

        This patch makes float box handling more secure by changing this index based setup
        to a list iterator. It helps to eliminate potential vector overflow issues.

        LineLayoutState::FloatList (new class) keeps track of all the floats for the block flow.
        It groups the float box related functions/members and provides an iterator interface to ensure safer
        syncing between this and the line based floats.

        No change in functionality.

        * rendering/RenderBlockFlow.h:
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::appendFloatingObjectToLastLine):
        (WebCore::repaintDirtyFloats):
        (WebCore::RenderBlockFlow::layoutRunsAndFloats):
        (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange):
        (WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
        (WebCore::RenderBlockFlow::layoutLineBoxes):
        (WebCore::RenderBlockFlow::checkFloatInCleanLine):
        (WebCore::RenderBlockFlow::determineStartPosition):
        (WebCore::RenderBlockFlow::determineEndPosition):
        (WebCore::RenderBlockFlow::repaintDirtyFloats): Deleted.
        (WebCore::RenderBlockFlow::checkFloatsInCleanLine): Deleted.
        * rendering/line/LineLayoutState.h:
        (WebCore::FloatWithRect::create):
        (WebCore::FloatWithRect::renderer):
        (WebCore::FloatWithRect::rect):
        (WebCore::FloatWithRect::everHadLayout):
        (WebCore::FloatWithRect::adjustRect):
        (WebCore::FloatWithRect::FloatWithRect):
        (WebCore::LineLayoutState::FloatList::append):
        (WebCore::LineLayoutState::FloatList::setLastFloat):
        (WebCore::LineLayoutState::FloatList::lastFloat):
        (WebCore::LineLayoutState::FloatList::setLastCleanFloat):
        (WebCore::LineLayoutState::FloatList::lastCleanFloat):
        (WebCore::LineLayoutState::FloatList::floatWithRect):
        (WebCore::LineLayoutState::FloatList::begin):
        (WebCore::LineLayoutState::FloatList::end):
        (WebCore::LineLayoutState::FloatList::find):
        (WebCore::LineLayoutState::FloatList::isEmpty):
        (WebCore::LineLayoutState::LineLayoutState):
        (WebCore::LineLayoutState::floatList):
        (WebCore::LineLayoutState::lastFloat): Deleted.
        (WebCore::LineLayoutState::setLastFloat): Deleted.
        (WebCore::LineLayoutState::floats): Deleted.
        (WebCore::LineLayoutState::floatIndex): Deleted.
        (WebCore::LineLayoutState::setFloatIndex): Deleted.

2018-05-23  Chris Dumez  <cdumez@apple.com>

        RenderLayer::scrollRectToVisible() should not propagate a subframe's scroll to its cross-origin parent
        https://bugs.webkit.org/show_bug.cgi?id=185664
        <rdar://problem/36185260>

        Reviewed by Simon Fraser.

        RenderLayer::scrollRectToVisible() should not propagate a subframe's scroll to its
        cross-origin parent. There was logic in FrameLoader::scrollToFragmentWithParentBoundary()
        to temporarily set the 'safeToPropagateScrollToParent' flag to false on the cross-origin
        ancestor frame during the call to FrameView::scrollToFragment(). This would correctly
        prevent RenderLayer::scrollRectToVisible() to propagate the scroll to the cross-origin
        ancestor frame when scrollRectToVisible() is called synchronously. However,
        scrollRectToVisible() can get called asynchronously in case of a dirty layout, as part
        of the post layout tasks.

        To address the issue, we get rid of the safeToPropagateScrollToParent flag on FrameView
        and instead update FrameView::safeToPropagateScrollToParent() to do the cross-origin
        check. FrameView::safeToPropagateScrollToParent() is called by RenderLayer::scrollRectToVisible()
        and this is a lot more robust than relying on a flag which gets temporarily set.

        Test: http/tests/navigation/fragment-navigation-cross-origin-subframe-no-scrolling-parent.html

        * dom/Document.cpp:
        * dom/Document.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::scrollToFragmentWithParentBoundary):
        * page/FrameView.cpp:
        (WebCore::FrameView::FrameView):
        (WebCore::FrameView::reset):
        (WebCore::FrameView::safeToPropagateScrollToParent const):
        * page/FrameView.h:

2017-01-18  Andreas Kling  <akling@apple.com>

        Document::securityOrigin() should return a reference.
        <https://webkit.org/b/167124>

        Reviewed by Sam Weinig.

        The security origin is always initialized by the Document constructor
        through Document::initSecurityContext(), so it's effectively always present.
        Make it return a reference and remove unnecessary null checks exposed by this.

        * Modules/applepay/ApplePaySession.cpp:
        (WebCore::canCallApplePaySessionAPIs):
        * Modules/encryptedmedia/CDM.cpp:
        (WebCore::CDM::getSupportedConfiguration):
        (WebCore::CDM::getConsentStatus):
        * Modules/encryptedmedia/legacy/WebKitMediaKeySession.cpp:
        (WebCore::WebKitMediaKeySession::mediaKeysStorageDirectory):
        * Modules/mediastream/UserMediaRequest.cpp:
        (WebCore::canCallGetUserMedia):
        * Modules/webdatabase/DOMWindowWebDatabase.cpp:
        (WebCore::DOMWindowWebDatabase::openDatabase):
        * Modules/webdatabase/DatabaseContext.cpp:
        (WebCore::DatabaseContext::allowDatabaseAccess):
        * Modules/websockets/WebSocketHandshake.cpp:
        (WebCore::WebSocketHandshake::clientOrigin):
        * bindings/js/JSDOMBinding.cpp:
        (WebCore::canAccessDocument):
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::collectIsolatedContexts):
        * css/CSSStyleSheet.cpp:
        (WebCore::CSSStyleSheet::canAccessRules):
        * css/RuleSet.cpp:
        (WebCore::RuleSet::addRulesFromSheet):
        * css/StyleRuleImport.cpp:
        (WebCore::StyleRuleImport::setCSSStyleSheet):
        * dom/Document.cpp:
        (WebCore::canAccessAncestor):
        (WebCore::Document::findUnsafeParentScrollPropagationBoundary):
        (WebCore::Document::cookie):
        (WebCore::Document::setCookie):
        (WebCore::Document::origin):
        (WebCore::Document::domain):
        (WebCore::Document::setDomain):
        (WebCore::Document::storageBlockingStateDidChange):
        (WebCore::Document::initSecurityContext):
        (WebCore::Document::initDNSPrefetch):
        (WebCore::Document::topOrigin):
        * dom/Document.h:
        (WebCore::Document::securityOrigin):
        * dom/SecurityContext.cpp:
        (WebCore::SecurityContext::isSecureTransitionTo):
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::handleClick):
        * html/HTMLAppletElement.cpp:
        (WebCore::HTMLAppletElement::canEmbedJava):
        * html/HTMLCanvasElement.cpp:
        (WebCore::HTMLCanvasElement::securityOrigin):
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::setCSSStyleSheet):
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::isSafeToLoadURL):
        (WebCore::HTMLMediaElement::mediaPlayerMediaKeysStorageDirectory):
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::allowedToLoadFrameURL):
        * inspector/InspectorDOMStorageAgent.cpp:
        (WebCore::InspectorDOMStorageAgent::storageId):
        (WebCore::InspectorDOMStorageAgent::findStorageArea):
        * inspector/InspectorIndexedDBAgent.cpp:
        (WebCore::InspectorIndexedDBAgent::requestDatabaseNames):
        (WebCore::InspectorIndexedDBAgent::requestDatabase):
        (WebCore::InspectorIndexedDBAgent::requestData):
        (WebCore::InspectorIndexedDBAgent::clearObjectStore):
        * inspector/InspectorPageAgent.cpp:
        (WebCore::InspectorPageAgent::findFrameWithSecurityOrigin):
        (WebCore::InspectorPageAgent::buildObjectForFrame):
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::commitData):
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::loadRequest):
        (WebCore::DocumentThreadableLoader::securityOrigin):
        * loader/DocumentWriter.cpp:
        (WebCore::canReferToParentFrameEncoding):
        * loader/EmptyClients.cpp:
        * loader/FrameLoadRequest.cpp:
        (WebCore::FrameLoadRequest::FrameLoadRequest):
        * loader/FrameLoadRequest.h:
        (WebCore::FrameLoadRequest::FrameLoadRequest):
        * loader/FrameLoader.cpp:
        (WebCore::shouldClearWindowName):
        (WebCore::FrameLoader::outgoingOrigin):
        (WebCore::FrameLoader::loadURL):
        (WebCore::FrameLoader::dispatchBeforeUnloadEvent):
        * loader/FrameLoaderClient.h:
        * loader/MixedContentChecker.cpp:
        (WebCore::MixedContentChecker::isMixedContent):
        (WebCore::MixedContentChecker::canDisplayInsecureContent):
        (WebCore::MixedContentChecker::canRunInsecureContent):
        (WebCore::MixedContentChecker::checkFormForMixedContent):
        * loader/MixedContentChecker.h:
        * loader/NavigationScheduler.cpp:
        (WebCore::NavigationScheduler::scheduleRedirect):
        (WebCore::NavigationScheduler::scheduleLocationChange):
        (WebCore::NavigationScheduler::scheduleRefresh):
        * loader/NavigationScheduler.h:
        * loader/PingLoader.cpp:
        (WebCore::PingLoader::loadImage):
        (WebCore::PingLoader::sendPing):
        (WebCore::PingLoader::sendViolationReport):
        * loader/ResourceLoadInfo.cpp:
        (WebCore::ResourceLoadInfo::isThirdParty):
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::init):
        (WebCore::ResourceLoader::isAllowedToAskUserForCredentials):
        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::pluginIsLoadable):
        (WebCore::SubframeLoader::createJavaAppletWidget):
        (WebCore::SubframeLoader::loadSubframe):
        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::selectCache):
        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
        (WebCore::ApplicationCacheGroup::update):
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::canRequest):
        (WebCore::CachedResourceLoader::canRequestAfterRedirection):
        (WebCore::CachedResourceLoader::canRequestInContentDispositionAttachmentSandbox):
        * loader/cache/CachedResourceRequest.cpp:
        (WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin):
        (WebCore::CachedResourceRequest::updateForAccessControl):
        * loader/cache/CachedResourceRequest.h:
        (WebCore::CachedResourceRequest::setOrigin):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::sessionStorage):
        (WebCore::DOMWindow::localStorage):
        (WebCore::DOMWindow::postMessage):
        (WebCore::DOMWindow::dispatchMessageEventWithOriginCheck):
        (WebCore::DOMWindow::isSameSecurityOriginAsMainFrame):
        (WebCore::DOMWindow::crossDomainAccessErrorMessage):
        (WebCore::DOMWindow::isInsecureScriptAccess):
        * page/DragController.cpp:
        (WebCore::DragController::dragExited):
        (WebCore::DragController::tryDocumentDrag):
        (WebCore::DragController::tryDHTMLDrag):
        (WebCore::DragController::startDrag):
        * page/History.cpp:
        (WebCore::History::stateObjectAdded):
        * page/Location.cpp:
        (WebCore::Location::ancestorOrigins):
        (WebCore::Location::reload):
        * page/Navigator.cpp:
        (WebCore::Navigator::javaEnabled):
        * page/Page.cpp:
        (WebCore::Page::showAllPlugins):
        * page/PerformanceResourceTiming.cpp:
        (WebCore::passesTimingAllowCheck):
        * page/SecurityOrigin.cpp:
        (WebCore::SecurityOrigin::canAccess):
        (WebCore::SecurityOrigin::canRequest):
        (WebCore::SecurityOrigin::canReceiveDragData):
        (WebCore::SecurityOrigin::canAccessStorage):
        (WebCore::SecurityOrigin::isSameOriginAs):
        (WebCore::SecurityOrigin::equal):
        (WebCore::SecurityOrigin::isSameSchemeHostPort):
        * page/SecurityOrigin.h:
        * page/SecurityOriginData.cpp:
        (WebCore::SecurityOriginData::fromFrame):
        * page/SecurityOriginHash.h:
        (WebCore::SecurityOriginHash::equal):
        * page/csp/ContentSecurityPolicy.cpp:
        (WebCore::stripURLForUseInReport):
        * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
        (WebCore::MediaPlayerPrivateAVFoundationCF::hasSingleSecurityOrigin):
        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
        (WebCore::MediaPlayerPrivateAVFoundationObjC::hasSingleSecurityOrigin):
        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
        (WebCore::MediaPlayerPrivateQTKit::hasSingleSecurityOrigin):
        * rendering/shapes/ShapeOutsideInfo.cpp:
        (WebCore::checkShapeImageOrigin):
        * replay/ReplayInputCreationMethods.cpp:
        (WebCore::InitialNavigation::createFromPage):
        * replay/ReplayInputDispatchMethods.cpp:
        (WebCore::InitialNavigation::dispatch):
        * storage/Storage.cpp:
        (WebCore::Storage::isDisabledByPrivateBrowsing):
        * storage/StorageEventDispatcher.cpp:
        (WebCore::StorageEventDispatcher::dispatchSessionStorageEvents):
        (WebCore::StorageEventDispatcher::dispatchLocalStorageEvents):
        * storage/StorageNamespaceProvider.cpp:
        (WebCore::StorageNamespaceProvider::localStorageArea):
        * testing/Internals.cpp:
        (WebCore::Internals::setApplicationCacheOriginQuota):
        * xml/XSLTProcessorLibxslt.cpp:
        (WebCore::docLoaderFunc):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::shouldAllowExternalLoad):

2018-09-05  Brent Fulgham  <bfulgham@apple.com>

        The width of an empty or nullptr TextRun should be zero
        https://bugs.webkit.org/show_bug.cgi?id=189154
        <rdar://problem/43685926>

        Reviewed by Zalan Bujtas.

        If a page has an empty TextRun and attempts to paint it we can crash with a nullptr.

        This patch recognizes that an empty TextRun should always produce a zero width, rather than
        attempt to compute this value from font data. It also prevents ListBox from attempting to
        paint a null string.

        Test: fast/text/null-string-textrun.html

        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::widthOfTextRange const): An empty TextRun has zero width.
        (WebCore::FontCascade::width const): Ditto.
        * platform/graphics/TextRun.h:
        (WebCore::TextRun::TextRun): ASSERT that the supplied String is non-null.
        (WebCore::TextRun::setText): Ditto.
        * rendering/RenderListBox.cpp:
        (WebCore::RenderListBox::paintItemForeground): Don't attempt to paint a null string.

2018-04-20  Chris Dumez  <cdumez@apple.com>

        Update cross-origin SecurityError messages to not include the target origin
        https://bugs.webkit.org/show_bug.cgi?id=184803
        <rdar://problem/39547724>

        Reviewed by Sam Weinig.

        No new tests, rebaselined existing tests.

        * bindings/js/JSDOMBindingSecurity.cpp:
        (WebCore::canAccessDocument):
        (WebCore::BindingSecurity::shouldAllowAccessToFrame):
        (WebCore::BindingSecurity::shouldAllowAccessToDOMWindow):
        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::crossDomainAccessErrorMessage):
        (WebCore::DOMWindow::isInsecureScriptAccess):
        * page/DOMWindow.h:
        * page/Location.cpp:
        (WebCore::Location::reload):

2018-06-20  Said Abou-Hallawa  <sabouhallawa@apple.com>

        RenderSVGInline has to be inline always regardless of its css display value
        https://bugs.webkit.org/show_bug.cgi?id=186656

        Reviewed by Zalan Bujtas.

        According to https://www.w3.org/TR/SVG2/text.html#TextLayout, the <text>
        element has to be laid out as if it were a block element and any <tspan>,
        <textPath>, <a> and <tref> descendants were inline elements.

        If a css rule, which contains the property "display: block;", is applied
        to any of children of a <text> element, this property has to be ignored.

        We currently ignore this property in RenderSVGInline::updateFromStyle()
        by forcing setInline(true). But we do not do the same thing in 
        RenderTreeBuilder::normalizeTreeAfterStyleChange(). In fact we allow
        making the children of the <text> element to be non-inline. This puts
        the render tree in weired state and causes many assertions to fire while
        laying out RenderSVGText. 

        Test: svg/dom/svg-inline-text-display-block-crash.html

        * rendering/updating/RenderTreeBuilder.cpp:
        (WebCore::RenderTreeBuilder::normalizeTreeAfterStyleChange):

2018-07-10  Zalan Bujtas  <zalan@apple.com>

        FragmentInterval, FragmentIntervalTree and FragmentSearchAdapter should hold not hold raw pointers to renderers.
        https://bugs.webkit.org/show_bug.cgi?id=187249
        <rdar://problem/41725869>

        Reviewed by Simon Fraser.

        Test: fast/multicol/crash-in-vertical-writing-mode.html

        * rendering/RenderFragmentedFlow.cpp:
        (WebCore::RenderFragmentedFlow::updateFragmentsFragmentedFlowPortionRect):
        * rendering/RenderFragmentedFlow.h:
        (WTF::ValueToString<WeakPtr<WebCore::RenderFragmentContainer>>::string):

2018-06-25  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Infinite loop if a <use> element references its ancestor and the DOMNodeInserted event handler of one its ancestor's descents updates the document style
        https://bugs.webkit.org/show_bug.cgi?id=186925

        Reviewed by Antti Koivisto.

        This patches fixes two issues:
        -- SVGTRefTargetEventListener should not assume it has to be attached to
        target when its handleEvent() is called.
        Because SVGTRefTargetEventListener::handleEvent() references the target
        element, we just return if the listener is detached.

        -- The <use> element should not clone its shadow tree if it references one
        of its ancestors. The DOMNodeInserted of any node in the target element
        tree may issue a document command. This document command will cause the 
        shadow tree to be re-cloned so this will cause infinite loop to happen.

        Test: svg/dom/svg-use-infinite-loop-cloning.html

        * svg/SVGTRefElement.cpp:
        (WebCore::SVGTRefTargetEventListener::handleEvent):
        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::updateShadowTree):

2018-06-18  Said Abou-Hallawa  <sabouhallawa@apple.com>

        Document should not be mutated under SMILTimeContainer::updateAnimations()
        https://bugs.webkit.org/show_bug.cgi?id=186658

        Reviewed by Simon Fraser.

        To update the animation of an SVG <animate> element, we call
        SVGAnimateElementBase::resetAnimatedType(). It ensures the pointer m_animator
        is valid. If it animates a css property, it calls computeCSSPropertyValue()
        which calls resolveStyle() via other calls. resolveStyle() may call delayed
        callbacks through the destructor of PostResolutionCallbackDisabler. These
        callbacks may fire events. These events may execute JS event handlers.
        If one of these event handlers deletes the same SVG <animate> we animate,
        we will end up calling SVGAnimateElementBase::resetAnimatedPropertyType()
        of the same <animate> element. This function  will delete the same m_animator
        which resetAnimatedType() still holds and will use later. This code
        re-entrance is unexpected and unwanted.

        The fix is to disable mutating the DOM while updating the SVG animations.

        Test: svg/dom/css-animate-input-foucs-crash.html

        * svg/animation/SMILTimeContainer.cpp:
        (WebCore::SMILTimeContainer::updateAnimations):

2018-07-12  Daniel Bates  <dabates@apple.com>

        JavaScript URL gives incorrect result when frame is navigated
        https://bugs.webkit.org/show_bug.cgi?id=187203
        <rdar://problem/41438443>

        Reviewed by David Kilzer.

        * loader/SubframeLoader.cpp:
        (WebCore::SubframeLoader::requestFrame):

2017-02-16  Miguel Gomez  <magomez@igalia.com>

        [GTK] scroll with transparent background not repainted after scrollY >= 32768
        https://bugs.webkit.org/show_bug.cgi?id=154283

        Reviewed by Carlos Garcia Campos.

        Due to a limitation of the pixman backend, which uses 16 bits to hold signed integers, cairo is
        not able to draw anything when using transformation matrices with values bigger than 32768. When
        drawing patterns into large pages, the matrices values can overflow those 16 bits, so cairo doesn't
        draw anything in, which causes the reported transparent backgrounds.

        The patch modifies the transformation matrices both from the current context and the pattern we
        are painting, to avoid them to hold values that cannot stored in 16 bits.

        There's still the possibility that this happens, but it would require using a pattern with a size
        bigger than 32768.

        Based on a previous patch by Gwang Yoon Hwang  <yoon@igalia.com>.

        Test: fast/backgrounds/background-repeat-long-scroll.html

        * platform/graphics/cairo/CairoUtilities.cpp:
        (WebCore::drawPatternToCairoContext):
        
2018-07-26  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r234291. rdar://problem/42650439

    [Fullscreen] Do not create composited layers for renderers unless they are part of the fullscreen subtree.
    https://bugs.webkit.org/show_bug.cgi?id=188087
    <rdar://problem/42632124>
    
    Reviewed by Simon Fraser.
    
    Source/WebCore:
    
    Sibling composited layers prevent battery lifetime optimizations when in fullscreen.
    
    Test: compositing/no-compositing-when-fulll-screen-is-present.html
    
    * rendering/RenderLayer.cpp:
    (WebCore::RenderLayer::isDescendantOf const):
    * rendering/RenderLayer.h:
    * rendering/RenderLayerCompositor.cpp:
    (WebCore::isDescendantOfFullScreenLayer):
    (WebCore::RenderLayerCompositor::requiresCompositingForWillChange const):
    (WebCore::RenderLayerCompositor::requiresCompositingForPosition const):
    
    LayoutTests:
    
    * compositing/no-compositing-when-fulll-screen-is-present-expected.txt: Added.
    * compositing/no-compositing-when-fulll-screen-is-present.html: Added.
    
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234291 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-26  Zalan Bujtas  <zalan@apple.com>

            [Fullscreen] Do not create composited layers for renderers unless they are part of the fullscreen subtree.
            https://bugs.webkit.org/show_bug.cgi?id=188087
            <rdar://problem/42632124>

            Reviewed by Simon Fraser.

            Sibling composited layers prevent battery lifetime optimizations when in fullscreen.

            Test: compositing/no-compositing-when-fulll-screen-is-present.html

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::isDescendantOf const):
            * rendering/RenderLayer.h:
            * rendering/RenderLayerCompositor.cpp:
            (WebCore::isDescendantOfFullScreenLayer):
            (WebCore::RenderLayerCompositor::requiresCompositingForWillChange const):
            (WebCore::RenderLayerCompositor::requiresCompositingForPosition const):

2017-09-28  Zan Dobersek  <zdobersek@igalia.com>

        [Cairo] Remove the cairo_glyph_t complexity from GlyphBuffer
        https://bugs.webkit.org/show_bug.cgi?id=177598

        Reviewed by Carlos Garcia Campos.

        Remove the decade-old use of cairo_glyph_t as the underlying type for
        Glyph. The former spans 24 bytes in size, while the latte is just 2
        bytes. The x and y coordinate attributes of cairo_glyph_t were only
        used in FontCascade::drawGlyphs() implementation, where they were
        overridden even if the same GlyphBuffer object was used here repeatedly.

        FontCascade::drawGlyphs() now creates a new Vector<cairo_glyph_t> object
        and fills it only with the glyph index and coordinates data for glyphs
        that will actually be drawn. This will likely in the future be leveraged
        to pack the necessary data and perform the drawing operations in
        parallelized tasks. GlyphBuffer usages that before required USE(CAIRO)
        special-casing can now be simplified.

        This also removes the need for <cairo.h> header inclusion in the
        GlyphBuffer.h header. This further removes Cairo header inclusion in
        roughly 600 build targets.

        No new tests -- no change in behavior.

        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::widthForSimpleText const):
        * platform/graphics/GlyphBuffer.h:
        (WebCore::GlyphBuffer::glyphAt const):
        (WebCore::GlyphBuffer::add):
        * platform/graphics/cairo/FontCairo.cpp:
        (WebCore::drawGlyphsToContext):
        (WebCore::drawGlyphsShadow):
        (WebCore::FontCascade::drawGlyphs):
        * platform/graphics/displaylists/DisplayListItems.cpp:
        (WebCore::DisplayList::DrawGlyphs::generateGlyphBuffer const):

2018-07-27  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r234318. rdar://problem/42467016

    [WIN] Crash when trying to access store pages
    https://bugs.webkit.org/show_bug.cgi?id=188032
    <rdar://problem/42467016>
    
    Reviewed by Brent Fulgham.
    
    The Windows implementation of GlyphBuffer has an additional member, m_offsets, which represents
    an additional offset to the position to paint each glyph. It also has two add() functions, one
    which appends to this vector, and one which doesn't. The one that doesn't append to the vector
    should never be called on Windows (because Windows requires this vector to be full).
    
    There were two situations where it was getting called:
    1) Inside ComplexTextController
    2) Inside display list playback
    
    Windows shouldn't be using ComplexTextController because the Windows implementation of this
    class isn't ready yet; instead it should be using UniscribeController. The display list playback
    code should be used on Windows.
    
    Rather than fix the function to append an offset, we actually don't need the m_offsets vector
    in the first place. Instead, we can do it the same way that the Cocoa ports do it, which is to
    bake the offsets into the glyph advances. This is possible because the GlyphBuffer doesn't need
    to distinguish between layout advances and paint advances, so we can bake them together and
    just put paint advances in the GlyphBuffer. This should be a small (probably within-the-noise)
    performance and memory improvement.
    
    * platform/graphics/ComplexTextController.cpp:
    (WebCore::ComplexTextController::ComplexTextController): Make sure that ComplexTextController
    isn't used on Windows.
    * platform/graphics/FontCascade.cpp:
    (WebCore::FontCascade::widthOfTextRange const): Switch from ComplexTextController to
    UniscribeController on Windows.
    (WebCore::FontCascade::drawGlyphBuffer const): After deleting the m_offsets vector, there's
    no reason to consult it when drawing.
    * platform/graphics/GlyphBuffer.h: Remove m_offsets
    (WebCore::GlyphBuffer::clear):
    (WebCore::GlyphBuffer::advanceAt const):
    (WebCore::GlyphBuffer::add):
    (WebCore::GlyphBuffer::expandLastAdvance):
    (WebCore::GlyphBuffer::shrink):
    (WebCore::GlyphBuffer::swap):
    (WebCore::GlyphBuffer::offsetAt const): Deleted.
    * platform/graphics/win/FontCGWin.cpp:
    (WebCore::FontCascade::drawGlyphs): After deleting the m_offsets vector, there's no reason
    to consult it when drawing.
    * platform/graphics/win/FontCascadeDirect2D.cpp:
    (WebCore::FontCascade::drawGlyphs): Ditto.
    * platform/graphics/win/UniscribeController.cpp:
    (WebCore::UniscribeController::shapeAndPlaceItem): Bake in the offsets into the glyph advances.
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234318 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-27  Myles C. Maxfield  <mmaxfield@apple.com>

            [WIN] Crash when trying to access store pages
            https://bugs.webkit.org/show_bug.cgi?id=188032
            <rdar://problem/42467016>

            Reviewed by Brent Fulgham.

            The Windows implementation of GlyphBuffer has an additional member, m_offsets, which represents
            an additional offset to the position to paint each glyph. It also has two add() functions, one
            which appends to this vector, and one which doesn't. The one that doesn't append to the vector
            should never be called on Windows (because Windows requires this vector to be full).

            There were two situations where it was getting called:
            1) Inside ComplexTextController
            2) Inside display list playback

            Windows shouldn't be using ComplexTextController because the Windows implementation of this
            class isn't ready yet; instead it should be using UniscribeController. The display list playback
            code should be used on Windows.

            Rather than fix the function to append an offset, we actually don't need the m_offsets vector
            in the first place. Instead, we can do it the same way that the Cocoa ports do it, which is to
            bake the offsets into the glyph advances. This is possible because the GlyphBuffer doesn't need
            to distinguish between layout advances and paint advances, so we can bake them together and
            just put paint advances in the GlyphBuffer. This should be a small (probably within-the-noise)
            performance and memory improvement.

            * platform/graphics/ComplexTextController.cpp:
            (WebCore::ComplexTextController::ComplexTextController): Make sure that ComplexTextController
            isn't used on Windows.
            * platform/graphics/FontCascade.cpp:
            (WebCore::FontCascade::widthOfTextRange const): Switch from ComplexTextController to
            UniscribeController on Windows.
            (WebCore::FontCascade::drawGlyphBuffer const): After deleting the m_offsets vector, there's
            no reason to consult it when drawing.
            * platform/graphics/GlyphBuffer.h: Remove m_offsets
            (WebCore::GlyphBuffer::clear):
            (WebCore::GlyphBuffer::advanceAt const):
            (WebCore::GlyphBuffer::add):
            (WebCore::GlyphBuffer::expandLastAdvance):
            (WebCore::GlyphBuffer::shrink):
            (WebCore::GlyphBuffer::swap):
            (WebCore::GlyphBuffer::offsetAt const): Deleted.
            * platform/graphics/win/FontCGWin.cpp:
            (WebCore::FontCascade::drawGlyphs): After deleting the m_offsets vector, there's no reason
            to consult it when drawing.
            * platform/graphics/win/FontCascadeDirect2D.cpp:
            (WebCore::FontCascade::drawGlyphs): Ditto.
            * platform/graphics/win/UniscribeController.cpp:
            (WebCore::UniscribeController::shapeAndPlaceItem): Bake in the offsets into the glyph advances.

2018-07-25  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r234111. rdar://problem/42604691

    WebResourceLoadStatisticsStore fails to unregister itself as a MessageReceiver in its destructor
    https://bugs.webkit.org/show_bug.cgi?id=187910
    <rdar://problem/42356526>
    
    Reviewed by Brent Fulgham.
    
    Source/WebCore:
    
    Add internals API that causes the ResourceLoadObserver to notify its observer, and avoid waiting
    for the 5 second delay.
    
    * testing/Internals.cpp:
    (WebCore::Internals::notifyResourceLoadObserver):
    * testing/Internals.h:
    * testing/Internals.idl:
    
    Source/WebKit:
    
    The WebResourceLoadStatisticsStore was only removing itself as a MessageReceiver from the WebProcessProxy
    and that WebProcessProxy's connection was getting closed. However, it is possible for the
    WebResourceLoadStatisticsStore to get destroyed before this happens. This would lead to crashes such as
    the one in <rdar://problem/42356526>.
    
    To address the issue, we let the WebsiteDataStore take care of registering / unregistering the
    WebResourceLoadStatisticsStore as a MessageReceiver with the WebProcessProxy. This is more reliable since
    the WebsiteDataStore is the one that subclasses WebProcessLifetimeObserver. Make sure the
    WebResourceLoadStatisticsStore is removed as a MessageReceiver whenever the WebsiteDataStore is destroyed
    or WebsiteDataStore::m_resourceLoadStatistics gets cleared.
    
    * UIProcess/WebResourceLoadStatisticsStore.cpp:
    * UIProcess/WebResourceLoadStatisticsStore.h:
    Drop logic to add / remove the WebResourceLoadStatisticsStore as a receiver now that the
    WebsiteDataStore takes care of it.
    
    * UIProcess/WebsiteData/WebsiteDataStore.cpp:
    (WebKit::WebsiteDataStore::~WebsiteDataStore):
    Make sure the WebResourceLoadStatisticsStore gets unregistered as a MessageReceiver from all associated
    WebProcessProxy objects when the WebsiteDataStore gets destroyed.
    
    (WebKit::WebsiteDataStore::webProcessWillOpenConnection):
    (WebKit::WebsiteDataStore::webProcessDidCloseConnection):
    Register / Unregister the WebResourceLoadStatisticsStore as a MessageReceiver with the WebProcessProxy.
    
    (WebKit::WebsiteDataStore::setResourceLoadStatisticsEnabled):
    Make sure we unregister the WebResourceLoadStatisticsStore as a MessageReceiver with all associated
    WebProcessProxy objects before we clear m_resourceLoadStatistics as this will causes the
    WebResourceLoadStatisticsStore to get destroyed.
    
    (WebKit::WebsiteDataStore::unregisterWebResourceLoadStatisticsStoreAsMessageReceiver):
    (WebKit::WebsiteDataStore::registerWebResourceLoadStatisticsStoreAsMessageReceiver):
    Add utility functions to register / unregister WebResourceLoadStatisticsStore as a MessageReceiver with
    all associated WebProcessProxy objects.
    
    (WebKit::WebsiteDataStore::enableResourceLoadStatisticsAndSetTestingCallback):
    Register the new WebResourceLoadStatisticsStore as a MessageReceiver with all associated WebProcessProxy
    objects in case setResourceLoadStatisticsEnabled(true) gets called *after* we've already started
    WebProcesses.
    
    * UIProcess/WebsiteData/WebsiteDataStore.h:
    
    Tools:
    
    Add API test coverage.
    
    * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
    * TestWebKitAPI/Tests/WebKitCocoa/ResourceLoadStatistics.mm:
    (-[DisableITPDuringNavigationDelegate webView:didCommitNavigation:]):
    (-[DisableITPDuringNavigationDelegate webView:didFinishNavigation:]):
    (TEST):
    * TestWebKitAPI/Tests/WebKitCocoa/notify-resourceLoadObserver.html: Added.
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234111 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-23  Chris Dumez  <cdumez@apple.com>

            WebResourceLoadStatisticsStore fails to unregister itself as a MessageReceiver in its destructor
            https://bugs.webkit.org/show_bug.cgi?id=187910
            <rdar://problem/42356526>

            Reviewed by Brent Fulgham.

            Add internals API that causes the ResourceLoadObserver to notify its observer, and avoid waiting
            for the 5 second delay.

            * testing/Internals.cpp:
            (WebCore::Internals::notifyResourceLoadObserver):
            * testing/Internals.h:
            * testing/Internals.idl:
            
2018-07-25  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r234222. rdar://problem/42612113

    Build fix after r234215. Unreviewed.
    
    * rendering/RenderTheme.cpp:
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234222 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-25  Zalan Bujtas  <zalan@apple.com>

            Build fix after r234215. Unreviewed.

            * rendering/RenderTheme.cpp:
            
2018-07-24  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r234158. rdar://problem/42551556

    [Cocoa] Stop crashing in lastResortFallbackFont()
    https://bugs.webkit.org/show_bug.cgi?id=187936
    
    Reviewed by Jon Lee.
    
    CoreText can get into a state where both Times and Lucida Grande are inaccessible.
    Instead of crashing, we should use the real LastResort, which is backed by a section
    in the .rodata of the CoreText dylib, and as such should always exist.
    
    * platform/graphics/FontCache.cpp:
    (WebCore::FontCache::fontForFamily):
    * platform/graphics/cocoa/FontCacheCoreText.cpp:
    (WebCore::FontCache::lastResortFallbackFont):
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234158 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-24  Myles C. Maxfield  <mmaxfield@apple.com>

            [Cocoa] Stop crashing in lastResortFallbackFont()
            https://bugs.webkit.org/show_bug.cgi?id=187936

            Reviewed by Jon Lee.

            CoreText can get into a state where both Times and Lucida Grande are inaccessible.
            Instead of crashing, we should use the real LastResort, which is backed by a section
            in the .rodata of the CoreText dylib, and as such should always exist.

            * platform/graphics/FontCache.cpp:
            (WebCore::FontCache::fontForFamily):
            * platform/graphics/cocoa/FontCacheCoreText.cpp:
            (WebCore::FontCache::lastResortFallbackFont):

2018-07-23  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r234073. rdar://problem/42451644

    Remove completed animations from GraphicsLayer, thus avoiding excessive backing store allocation
    https://bugs.webkit.org/show_bug.cgi?id=187844
    rdar://problem/40387294
    
    Reviewed by Dean Jackson.
    Source/WebCore:
    
    A keyframe animation which animates 3D transforms, and is fill-forwards, currently
    leaves the GraphicsLayer in a state where it has a "running" animation. However, the
    logic that computes animation extent in RenderLayerBacking::updateGeometry() only does
    so for running or paused animations. GraphicsLayer then thinks that it has an active
    transform animation with unknown extent, and refuses to detach its backing store.
    
    This triggers excessive layer creation on some sites (e.g. https://www.kqed.org).
    
    Fix by always removing animations from the GraphicsLayer when they finish, whether
    or not they fill forwards. This is done by having KeyframeAnimation::onAnimationEnd()
    always call endAnimation().
    
    This change only fixes the non-Web Animation code path. webkit.org/b/187845 exists
    to fix the other code path.
    
    Also improve some logging that would have revealed this problem sooner.
    
    Test: compositing/backing/backing-store-attachment-fill-forwards-animation.html
    
    * page/animation/AnimationBase.h:
    (WebCore::AnimationBase::endAnimation):
    * page/animation/ImplicitAnimation.cpp:
    (WebCore::ImplicitAnimation::endAnimation):
    * page/animation/ImplicitAnimation.h:
    * page/animation/KeyframeAnimation.cpp:
    (WebCore::KeyframeAnimation::endAnimation):
    (WebCore::KeyframeAnimation::onAnimationEnd):
    * page/animation/KeyframeAnimation.h:
    * platform/graphics/ca/GraphicsLayerCA.cpp:
    (WebCore::GraphicsLayerCA::addAnimation):
    (WebCore::GraphicsLayerCA::updateCoverage):
    
    LayoutTests:
    
    * compositing/backing/backing-store-attachment-fill-forwards-animation-expected.txt: Added.
    * compositing/backing/backing-store-attachment-fill-forwards-animation.html: Added.
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234073 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-19  Simon Fraser  <simon.fraser@apple.com>

            Remove completed animations from GraphicsLayer, thus avoiding excessive backing store allocation
            https://bugs.webkit.org/show_bug.cgi?id=187844
            rdar://problem/40387294

            Reviewed by Dean Jackson.

            A keyframe animation which animates 3D transforms, and is fill-forwards, currently
            leaves the GraphicsLayer in a state where it has a "running" animation. However, the
            logic that computes animation extent in RenderLayerBacking::updateGeometry() only does
            so for running or paused animations. GraphicsLayer then thinks that it has an active
            transform animation with unknown extent, and refuses to detach its backing store.

            This triggers excessive layer creation on some sites (e.g. https://www.kqed.org).

            Fix by always removing animations from the GraphicsLayer when they finish, whether
            or not they fill forwards. This is done by having KeyframeAnimation::onAnimationEnd()
            always call endAnimation().

            This change only fixes the non-Web Animation code path. webkit.org/b/187845 exists
            to fix the other code path.

            Also improve some logging that would have revealed this problem sooner.

            Test: compositing/backing/backing-store-attachment-fill-forwards-animation.html

            * page/animation/AnimationBase.h:
            (WebCore::AnimationBase::endAnimation):
            * page/animation/ImplicitAnimation.cpp:
            (WebCore::ImplicitAnimation::endAnimation):
            * page/animation/ImplicitAnimation.h:
            * page/animation/KeyframeAnimation.cpp:
            (WebCore::KeyframeAnimation::endAnimation):
            (WebCore::KeyframeAnimation::onAnimationEnd):
            * page/animation/KeyframeAnimation.h:
            * platform/graphics/ca/GraphicsLayerCA.cpp:
            (WebCore::GraphicsLayerCA::addAnimation):
            (WebCore::GraphicsLayerCA::updateCoverage):

2018-07-20  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r234002. rdar://problem/42432954

    REGRESSION(r233926): media/modern-media-controls/media-controller/media-controller-inline-to-fullscreen-to-pip-to-inline.html is a TIMEOUT failure
    https://bugs.webkit.org/show_bug.cgi?id=187813
    
    Reviewed by Jon Lee.
    
    In r233926, we changed the behavior of entering PiP to exit fullscreen only after entering PiP completes. The
    test in question will immediately request "inline" presentation mode once the PiP animation begins, and thus
    it's asking to "exit fullscreen" when both in standard fullscreen and also in PiP. The fix is not to bail out
    early if we're in standard (element) fullscreen, but to allow the remaining steps to complete and exit PiP as
    well.
    
    * html/HTMLMediaElement.cpp:
    (WebCore::HTMLMediaElement::exitFullscreen):
    
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@234002 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-19  Jer Noble  <jer.noble@apple.com>

            REGRESSION(r233926): media/modern-media-controls/media-controller/media-controller-inline-to-fullscreen-to-pip-to-inline.html is a TIMEOUT failure
            https://bugs.webkit.org/show_bug.cgi?id=187813

            Reviewed by Jon Lee.

            In r233926, we changed the behavior of entering PiP to exit fullscreen only after entering PiP completes. The
            test in question will immediately request "inline" presentation mode once the PiP animation begins, and thus
            it's asking to "exit fullscreen" when both in standard fullscreen and also in PiP. The fix is not to bail out
            early if we're in standard (element) fullscreen, but to allow the remaining steps to complete and exit PiP as
            well.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::exitFullscreen):
            
2018-07-18  Babak Shafiei  <bshafiei@apple.com>

        Cherry-pick r233865. rdar://problem/42343023

    Fullscreen requires active document.
    https://bugs.webkit.org/show_bug.cgi?id=186226
    rdar://problem/36187413
    
    Patch by Jeremy Jones <jeremyj@apple.com> on 2018-07-16
    Reviewed by Jer Noble.
    
    Source/WebCore:
    
    Test: media/no-fullscreen-when-hidden.html
    
    This change guarantees the document to be visible for both element fullscreen and video fullscreen.
    
    User gesture is not enough to guarantee that the document is visible when fullscreen is initiated
    because JavaScript can spin wait before initiating fullscreen. During that spin the page or window might
    be hidden.
    
    Document::hidden() can't be relied upon because it won't update while JavaScript spins.
    
    This change adds a sync call to the UI process to get the current UI visibility state.
    
    * dom/Document.cpp:
    (WebCore::Document::requestFullScreenForElement):
    * html/HTMLMediaElement.cpp:
    (WebCore::HTMLMediaElement::enterFullscreen):
    * page/ChromeClient.h:
    
    Source/WebKit:
    
    This change guarantees the document to be visible for both element fullscreen and video fullscreen.
    
    User gesture is not enough to guarantee that the document is visible when fullscreen is initiated
    because JavaScript can spin wait before initiating fullscreen. During that spin the page or window might
    be hidden.
    
    Document::hidden() can't be relied upon because it won't update while JavaScript spins.
    
    This change adds a sync call to the UI process to get the current UI visibility state.
    
    * UIProcess/WebPageProxy.cpp:
    (WebKit::WebPageProxy::getIsViewVisible):
    * UIProcess/WebPageProxy.h:
    * UIProcess/WebPageProxy.messages.in:
    * WebProcess/WebCoreSupport/WebChromeClient.cpp:
    (WebKit::WebChromeClient::isViewVisible):
    * WebProcess/WebCoreSupport/WebChromeClient.h:
    
    LayoutTests:
    
    This change guarantees the document to be visible for both element fullscreen and video fullscreen.
    
    User gesture is not enough to guarantee that the document is visible when fullscreen is initiated
    because JavaScript can spin wait before initiating fullscreen. During that spin the page or window might
    be hidden.
    
    Document::hidden() can't be relied upon because it won't update while JavaScript spins.
    
    This change adds a sync call to the UI process to get the current UI visibility state.
    
    * media/no-fullscreen-when-hidden.html: Added.
    * media/video-test.js:
    (eventName.string_appeared_here.thunk):
    (runWithKeyDown):
    * platform/ios-wk1/TestExpectations:
    * platform/mac-wk1/TestExpectations:
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233865 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-07-16  Jeremy Jones  <jeremyj@apple.com>

            Fullscreen requires active document.
            https://bugs.webkit.org/show_bug.cgi?id=186226
            rdar://problem/36187413

            Reviewed by Jer Noble.

            Test: media/no-fullscreen-when-hidden.html

            This change guarantees the document to be visible for both element fullscreen and video fullscreen.

            User gesture is not enough to guarantee that the document is visible when fullscreen is initiated
            because JavaScript can spin wait before initiating fullscreen. During that spin the page or window might
            be hidden.

            Document::hidden() can't be relied upon because it won't update while JavaScript spins.

            This change adds a sync call to the UI process to get the current UI visibility state.

            * dom/Document.cpp:
            (WebCore::Document::requestFullScreenForElement):
            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::enterFullscreen):
            * page/ChromeClient.h:
            
2018-05-02  Brent Fulgham  <bfulgham@apple.com>

        Widgets should hold a WeakPtr to their parents
        https://bugs.webkit.org/show_bug.cgi?id=185239
        <rdar://problem/39741250>

        Reviewed by Zalan Bujtas.

        * platform/ScrollView.h:
        (WebCore::ScrollView::weakPtrFactory): Added.
        * platform/Widget.cpp:
        (WebCore::Widget::init): Don't perform an unnecessary assignment.
        (WebCore::Widget::setParent): Grab a WeakPtr to the parent ScrollView.
        * platform/Widget.h:
        (WebCore::Widget::parent const): Change type to a WeakPtr.

2018-04-03  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r229830. rdar://problem/39155360

    Disconnect the SVGPathSegList items from their SVGPathElement before rebuilding a new list
    https://bugs.webkit.org/show_bug.cgi?id=183723
    <rdar://problem/38517871>
    
    Patch by Said Abou-Hallawa <sabouhallawa@apple.com> on 2018-03-21
    Reviewed by Daniel Bates.
    
    Source/WebCore:
    
    When setting the "d" attribute directly on a path, we rebuild the list
    of path segments held for creating the property tear off. The old path
    segments need to get disconnected from the path element. We already do
    that when a path segment is replaced or removed.
    
    Test: svg/dom/reuse-pathseg-after-changing-d.html
    
    * svg/SVGPathElement.cpp:
    (WebCore::SVGPathElement::svgAttributeChanged):
    * svg/SVGPathSegList.cpp:
    (WebCore::SVGPathSegList::clear): SVGPathSegListValues::clearContextAndRoles()
    will now be called from SVGPathSegListValues::clear() via SVGListProperty::clearValues().
    (WebCore::SVGPathSegList::replaceItem):
    (WebCore::SVGPathSegList::removeItem):
    (WebCore::SVGPathSegList::clearContextAndRoles): Deleted.
    * svg/SVGPathSegList.h: SVGPathSegListValues::clearContextAndRoles() will
    now be called from SVGPathSegListValues::clear() via SVGListProperty::initializeValues().
    * svg/SVGPathSegListValues.cpp:
    (WebCore::SVGPathSegListValues::clearItemContextAndRole):
    (WebCore::SVGPathSegListValues::clearContextAndRoles):
    * svg/SVGPathSegListValues.h:
    (WebCore::SVGPathSegListValues::operator=):
    (WebCore::SVGPathSegListValues::clear):
    
    LayoutTests:
    
    * svg/dom/reuse-pathseg-after-changing-d-expected.txt: Added.
    * svg/dom/reuse-pathseg-after-changing-d.html: Added.
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229830 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-03-21  Said Abou-Hallawa  <sabouhallawa@apple.com>

            Disconnect the SVGPathSegList items from their SVGPathElement before rebuilding a new list
            https://bugs.webkit.org/show_bug.cgi?id=183723
            <rdar://problem/38517871>

            Reviewed by Daniel Bates.

            When setting the "d" attribute directly on a path, we rebuild the list
            of path segments held for creating the property tear off. The old path
            segments need to get disconnected from the path element. We already do
            that when a path segment is replaced or removed.

            Test: svg/dom/reuse-pathseg-after-changing-d.html

            * svg/SVGPathElement.cpp:
            (WebCore::SVGPathElement::svgAttributeChanged):
            * svg/SVGPathSegList.cpp:
            (WebCore::SVGPathSegList::clear): SVGPathSegListValues::clearContextAndRoles()
            will now be called from SVGPathSegListValues::clear() via SVGListProperty::clearValues().
            (WebCore::SVGPathSegList::replaceItem):
            (WebCore::SVGPathSegList::removeItem):
            (WebCore::SVGPathSegList::clearContextAndRoles): Deleted.
            * svg/SVGPathSegList.h: SVGPathSegListValues::clearContextAndRoles() will
            now be called from SVGPathSegListValues::clear() via SVGListProperty::initializeValues().
            * svg/SVGPathSegListValues.cpp:
            (WebCore::SVGPathSegListValues::clearItemContextAndRole):
            (WebCore::SVGPathSegListValues::clearContextAndRoles):
            * svg/SVGPathSegListValues.h:
            (WebCore::SVGPathSegListValues::operator=):
            (WebCore::SVGPathSegListValues::clear):

2017-12-11  Zalan Bujtas  <zalan@apple.com>

        FloatingObjects/FloatingObject classes should hold weak references to renderers
        https://bugs.webkit.org/show_bug.cgi?id=180627
        <rdar://problem/35954069>

        Reviewed by Antti Koivisto.

        * rendering/FloatingObjects.cpp:
        (WebCore::FloatingObject::FloatingObject):
        (WebCore::ComputeFloatOffsetAdapter::ComputeFloatOffsetAdapter):
        (WebCore::ComputeFloatOffsetForFloatLayoutAdapter::ComputeFloatOffsetForFloatLayoutAdapter):
        (WebCore::ComputeFloatOffsetForLineLayoutAdapter::ComputeFloatOffsetForLineLayoutAdapter):
        (WebCore::FindNextFloatLogicalBottomAdapter::FindNextFloatLogicalBottomAdapter):
        (WebCore::FindNextFloatLogicalBottomAdapter::collectIfNeeded):
        (WebCore::FloatingObjects::findNextFloatLogicalBottomBelow):
        (WebCore::FloatingObjects::findNextFloatLogicalBottomBelowForBlock):
        (WebCore::FloatingObjects::FloatingObjects):
        (WebCore::FloatingObjects::clearLineBoxTreePointers):
        (WebCore::FloatingObjects::logicalLeftOffsetForPositioningFloat):
        (WebCore::FloatingObjects::logicalRightOffsetForPositioningFloat):
        (WebCore::FloatingObjects::logicalLeftOffset):
        (WebCore::FloatingObjects::logicalRightOffset):
        (WebCore::ComputeFloatOffsetForFloatLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
        (WebCore::ComputeFloatOffsetForFloatLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
        (WebCore::ComputeFloatOffsetForFloatLayoutAdapter<FloatTypeValue>::heightRemaining const):
        (WebCore::ComputeFloatOffsetAdapter<FloatTypeValue>::collectIfNeeded):
        (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatLeft>::updateOffsetIfNeeded):
        (WebCore::ComputeFloatOffsetForLineLayoutAdapter<FloatingObject::FloatRight>::updateOffsetIfNeeded):
        * rendering/FloatingObjects.h:
        (WebCore::FloatingObject::renderer const):
        (WebCore::FloatingObjects::renderer const):

2018-03-09  Nan Wang  <n_wang@apple.com>

        AX: AOM: More accessibility events support
        https://bugs.webkit.org/show_bug.cgi?id=183023
        <rdar://problem/37764380>

        Reviewed by Chris Fleizach.

        The test is crashing when we call updateBackingStore when 
        the AXObjectCache object is gone. Added a check to fix that.

        Modified the test by using the right format of setTimeout and extended the delay.

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::updateBackingStore):

2018-02-19  Fujii Hironori  <Hironori.Fujii@sony.com>

        null m_lastNodeInserted dereference at ReplaceSelectionCommand::InsertedNodes::lastLeafInserted
        https://bugs.webkit.org/show_bug.cgi?id=161947

        Reviewed by Ryosuke Niwa.

        InsertedNodes happened to be empty if the inserted nodes were
        removed. Add more checks if InsertedNodes is empty.

        No new tests (Covered by existing tests).

        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply): Return early if InsertedNodes becomes empty.
        * editing/ReplaceSelectionCommand.h:
        (WebCore::ReplaceSelectionCommand::InsertedNodes::isEmpty): New method.
        (WebCore::ReplaceSelectionCommand::InsertedNodes::lastLeafInserted const):
        Assert m_lastNodeInserted is not null.
        (WebCore::ReplaceSelectionCommand::InsertedNodes::pastLastLeaf const): Ditto.

2018-02-13  Chris Dumez  <cdumez@apple.com>

        REGRESSION (r228299): Broke reader mode in Safari
        https://bugs.webkit.org/show_bug.cgi?id=182697
        <rdar://problem/37399012>

        Reviewed by Ryosuke Niwa.

        Rework the fix for r228299 to be more targeted. I moved the policy check
        cencelation from FrameLoader::stopLoading() to NavigationScheduler::schedule()
        when a pending load is cancelled by another load. I have verified that the
        sites fixed by r228299 still work with this more limited change. However,
        reader mode is now working again.

        The issue seems to be that we tell CFNetwork to continue with the load after
        receiving the response, even if the client has not responded to the
        decidePolicyForNavigationResponse delegate yet. As a result, CFNetwork sends
        us the resource data and we may commit the provisional load before receiving
        the policy response from the client. When the provisional load is committed,
        we call FrameLoader::stopLoading() which after r228299 cancelled pending
        policy checks. Because we did not wait for the policy check response to
        commit the load, we would cancel it which would make the load fail.

        The real fix here would be to make not tell CFNetwork to continue until after
        we've received the policy delegate response. However, this is a larger and
        riskier change at this point. I will follow-up on this issue.

        Covered by new API test.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::stopLoading):
        * loader/NavigationScheduler.cpp:
        (WebCore::NavigationScheduler::schedule):

2018-05-09  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r231516. rdar://problem/40096750

    Unreviewed build fix; add missing function definition.
    
    * html/HTMLMediaElement.h:
    (WebCore::HTMLMediaElement::didPassCORSAccessCheck const):
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@231516 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-05-08  Jer Noble  <jer.noble@apple.com>

            Unreviewed build fix; add missing function definition.

            * html/HTMLMediaElement.h:
            (WebCore::HTMLMediaElement::didPassCORSAccessCheck const):

2018-05-08  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r231236. rdar://problem/40050705

    Source/WebCore:
    Prevent Debug ASSERT when changing forms
    https://bugs.webkit.org/show_bug.cgi?id=185173
    <rdar://problem/39738669>
    
    Reviewed by Ryosuke Niwa.
    
    Form submission could trigger a debug assertion during validation when
    a form is changed during an input submission. Fix this by cleaning up
    the event handling logic and make it more consistent with modern WebKit
    coding style.
    
    Test: fast/forms/form-submission-crash-3.html
    
    * html/HTMLButtonElement.cpp:
    (WebCore::HTMLButtonElement::defaultEventHandler): Make sure layout runs before
    attempting to perform event handling.
    * html/HTMLFormElement.cpp:
    (WebCore::HTMLFormElement::reportValidity): Ditto.
    (WebCore::HTMLFormElement::validateInteractively): Remove call to perform layout here,
    since we expect this to happen earlier in the layout pass. Add an assertion that the
    tree is not dirty.
    * html/ImageInputType.cpp:
    (WebCore::ImageInputType::handleDOMActivateEvent): Make sure layout runs before
    attempting to perform event handling.
    * html/SubmitInputType.cpp:
    (WebCore::SubmitInputType::handleDOMActivateEvent): Ditto.
    
    LayoutTests:
    Prevent assertion when changing forms
    https://bugs.webkit.org/show_bug.cgi?id=185173
    <rdar://problem/39738669>
    
    Reviewed by Ryosuke Niwa.
    
    * fast/forms/form-submission-crash-3-expected.txt: Added.
    * fast/forms/form-submission-crash-3.html: Added.
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@231236 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-05-01  Brent Fulgham  <bfulgham@apple.com>

            Prevent Debug ASSERT when changing forms
            https://bugs.webkit.org/show_bug.cgi?id=185173
            <rdar://problem/39738669>

            Reviewed by Ryosuke Niwa.

            Form submission could trigger a debug assertion during validation when
            a form is changed during an input submission. Fix this by cleaning up
            the event handling logic and make it more consistent with modern WebKit
            coding style.

            Test: fast/forms/form-submission-crash-3.html

            * html/HTMLButtonElement.cpp:
            (WebCore::HTMLButtonElement::defaultEventHandler): Make sure layout runs before
            attempting to perform event handling.
            * html/HTMLFormElement.cpp:
            (WebCore::HTMLFormElement::reportValidity): Ditto.
            (WebCore::HTMLFormElement::validateInteractively): Remove call to perform layout here,
            since we expect this to happen earlier in the layout pass. Add an assertion that the
            tree is not dirty.
            * html/ImageInputType.cpp:
            (WebCore::ImageInputType::handleDOMActivateEvent): Make sure layout runs before
            attempting to perform event handling.
            * html/SubmitInputType.cpp:
            (WebCore::SubmitInputType::handleDOMActivateEvent): Ditto.

2018-05-08  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r231291. rdar://problem/40050729

    Use RetainPtr for form input type
    https://bugs.webkit.org/show_bug.cgi?id=185210
    <rdar://problem/39734040>
    
    Reviewed by Ryosuke Niwa.
    
    Source/WebCore:
    
    Refactor our HTMLInputElement class to store its InputType member as a RefPtr.
    
    Test: fast/forms/access-key-mutation-2.html.
    
    * html/HTMLInputElement.cpp:
    (WebCore::HTMLInputElement::HTMLInputElement):
    (WebCore::HTMLInputElement::didAddUserAgentShadowRoot):
    (WebCore::HTMLInputElement::accessKeyAction):
    (WebCore::HTMLInputElement::parseAttribute):
    (WebCore::HTMLInputElement::appendFormData):
    * html/HTMLInputElement.h:
    * html/InputType.cpp:
    (WebCore::createInputType):
    (WebCore::InputType::create):
    (WebCore::InputType::createText):
    * html/InputType.h:
    
    LayoutTests:
    
    * fast/forms/access-key-mutation-2-expected.txt: Added.
    * fast/forms/access-key-mutation-2.html: Added.
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@231291 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-05-02  Brent Fulgham  <bfulgham@apple.com>

            Use RetainPtr for form input type
            https://bugs.webkit.org/show_bug.cgi?id=185210
            <rdar://problem/39734040>

            Reviewed by Ryosuke Niwa.

            Refactor our HTMLInputElement class to store its InputType member as a RefPtr.

            Test: fast/forms/access-key-mutation-2.html.

            * html/HTMLInputElement.cpp:
            (WebCore::HTMLInputElement::HTMLInputElement):
            (WebCore::HTMLInputElement::didAddUserAgentShadowRoot):
            (WebCore::HTMLInputElement::accessKeyAction):
            (WebCore::HTMLInputElement::parseAttribute):
            (WebCore::HTMLInputElement::appendFormData):
            * html/HTMLInputElement.h:
            * html/InputType.cpp:
            (WebCore::createInputType):
            (WebCore::InputType::create):
            (WebCore::InputType::createText):
            * html/InputType.h:

2018-04-03  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r230052. rdar://problem/39155251

    WebSocket cookie incorrectly stored
    https://bugs.webkit.org/show_bug.cgi?id=184100
    <rdar://problem/37928715>
    
    Reviewed by Brent Fulgham.
    
    Source/WebCore:
    
    A cookie received in a WebSocket response should be stored with respect to the
    origin of the WebSocket server in order for it to be sent in a subsequent request.
    
    Also removed a FIXME about implementing support for the long since
    deprecated Set-Cookie2 header.
    
    Test: http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html
    
    * Modules/websockets/WebSocketChannel.cpp:
    (WebCore::WebSocketChannel::processBuffer):
    * Modules/websockets/WebSocketHandshake.h:
    
    LayoutTests:
    
    * http/tests/websocket/tests/hybi/cookie_wsh.py: Added. Downloaded from
    <https://github.com/w3c/pywebsocket/blob/b2e1d11086fdf00b33a0d30c504f227e7d4fa86b/src/example/cookie_wsh.py>.
    (_add_set_cookie):
    (web_socket_do_extra_handshake):
    (web_socket_transfer_data):
    * http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior-expected.txt: Added.
    * http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html: Added.
    
    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230052 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-03-28  Daniel Bates  <dabates@apple.com>

            WebSocket cookie incorrectly stored
            https://bugs.webkit.org/show_bug.cgi?id=184100
            <rdar://problem/37928715>

            Reviewed by Brent Fulgham.

            A cookie received in a WebSocket response should be stored with respect to the
            origin of the WebSocket server in order for it to be sent in a subsequent request.

            Also removed a FIXME about implementing support for the long since
            deprecated Set-Cookie2 header.

            Test: http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html

            * Modules/websockets/WebSocketChannel.cpp:
            (WebCore::WebSocketChannel::processBuffer):
            * Modules/websockets/WebSocketHandshake.h:

2018-04-03  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r230063. rdar://problem/39155049

    The SVGAnimatedProperty wrappers have to be detached from the referenced values before the SVGAnimatedType is deleted
    https://bugs.webkit.org/show_bug.cgi?id=183972

    Reviewed by Daniel Bates.

    If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers
    of the animated properties have to be detached from the items in the list
    before it's deleted.

    * svg/SVGAnimateElementBase.cpp:
    (WebCore::SVGAnimateElementBase::clearAnimatedType):


    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@230063 268f45cc-cd09-0410-ab3c-d52691b4dbfc

    2018-03-28  Said Abou-Hallawa  <sabouhallawa@apple.com>

            The SVGAnimatedProperty wrappers have to be detached from the referenced values before the SVGAnimatedType is deleted
            https://bugs.webkit.org/show_bug.cgi?id=183972

            Reviewed by Daniel Bates.

            If the SVGAnimatedType is a list type, e.g. SVGLengthListValues, the wrappers
            of the animated properties have to be detached from the items in the list
            before it's deleted.

            * svg/SVGAnimateElementBase.cpp:
            (WebCore::SVGAnimateElementBase::clearAnimatedType):

2018-03-20  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r229505. rdar://problem/38651624

    2018-03-09  Zalan Bujtas  <zalan@apple.com>

            Turn off offset*/scroll* optimization for input elements with shadow content
            https://bugs.webkit.org/show_bug.cgi?id=182383
            <rdar://problem/37114190>

            Reviewed by Antti Koivisto.

            We normally ensure clean tree before calling offsetHeight/Width, scrollHeight/Width.
            In certain cases (see updateLayoutIfDimensionsOutOfDate() for details), it's okay to return
            the previously computed values even when some part of the tree is dirty.
            In case of shadow content, updateLayoutIfDimensionsOutOfDate() might return false (no need to layout)
            for the root, while true (needs layout) for the shadow content.
            This could confuse the caller (Element::scrollWidth/Height etc) and lead to incorrect result.

            Test: fast/forms/scrollheight-with-mutation-crash.html

            * dom/Document.cpp:
            (WebCore::Document::updateLayoutIfDimensionsOutOfDate):

2018-02-20  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r228585. rdar://problem/37697677

    2018-02-16  Antti Koivisto  <antti@apple.com>

            Assert in mixed blend animation
            https://bugs.webkit.org/show_bug.cgi?id=182887
            <rdar://problem/37598140>

            Reviewed by Zalan Bujtas.

            Test: fast/css/calc-mixed-blend-crash.html

            * platform/CalculationValue.cpp:
            (WebCore::CalcExpressionBlendLength::CalcExpressionBlendLength):

            Fix mismatch between the type test and the value used.

2018-02-14  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r228476. rdar://problem/37549893

    2018-02-14  Dean Jackson  <dino@apple.com>

            CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::HTMLPlugInImageElement::didAddUserAgentShadowRoot + 618
            https://bugs.webkit.org/show_bug.cgi?id=182798
            <rdar://problem/23337253>

            Reviewed by Eric Carlson.

            Speculative fix for a crash in HTMLPlugInImageElement::didAddUserAgentShadowRoot.
            The guess is that the m_swapRendererTimer is set, and the display state changes to
            something that does not require a shadow root, but before the timer fires.
            Fix this by ensuring that the timer is reset on every display state change.

            * html/HTMLPlugInElement.cpp:
            (WebCore::HTMLPlugInElement::setDisplayState): Guard for sets that wouldn't
            actually change value, and make sure we always reset the timer.

2018-02-13  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r228299. rdar://problem/37518837

    2018-02-08  Chris Dumez  <cdumez@apple.com>

            Form submission after navigation fails when decidePolicyForNavigationAction is async
            https://bugs.webkit.org/show_bug.cgi?id=182412
            <rdar://problem/35181099>

            Reviewed by Alex Christensen.

            When the form is submitted and schedules the load in an iframe that is already loading,
            FrameLoader::stopLoading() is called as expected. However, because policy checks can
            now be asynchronous, stopLoading() also needs to stop pending policy checks. Otherwise,
            continueLoadAfterNavigationPolicy() gets called for a cancelled load and we're in trouble
            because the FrameLoader was reused for another load since then.

            Test: http/tests/navigation/sync-form-submit-iframe.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::stopLoading):

2017-07-10  Andreas Kling  <akling@apple.com>

        REGRESSION(r210226): Keyboard-focused element not preserved when navigating back through page cache, causing multiple elements to have focus
        https://bugs.webkit.org/show_bug.cgi?id=174302
        <rdar://problem/33204273>

        Reviewed by Antti Koivisto.

        Don't clear the active/hovered/focused elements when destroying the render tree,
        since we might need to reconstruct it later, and would like to remember which
        elements those were.

        Only the focused state actually stuck when going in and out of the page cache,
        but this patch removes all the element pointer clearing for consistency.

        Test: fast/history/page-cache-element-state-focused.html

        * dom/Document.cpp:
        (WebCore::Document::destroyRenderTree):

2017-01-05  Andreas Kling  <akling@apple.com>

        REGRESSION(r210226): overflow:scroll scroll position not restored on back navigation
        <https://webkit.org/b/166724>

        Reviewed by Antti Koivisto.

        Before r210226, the render tree being torn down and the document being destroyed
        were roughly the same thing, since they would always happen together, from the
        render tree's perspective.

        Changing this caused us to skip over the code that saves the scroll position
        for an element's RenderLayer when going into the page cache. Navigating back to
        that page would then scroll the layer to (0,0) instead of the previous position.

        The fix is simply to remove the check for documentBeingDestroyed() in ~RenderLayer().
        Note that two checks are being removed, there was also a weird "optimization"
        to avoid nulling out EventHandler's m_resizeLayer if it points to this layer.
        That pointer would eventually get nulled out in EventHandler::clear() anyway,
        but it feels better to not let that pointer dangle.

        Test: fast/scrolling/page-cache-back-overflow-scroll-restore.html

        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::~RenderLayer):

2017-01-03  Andreas Kling  <akling@apple.com>

        REGRESSION(r210226): fast/history/back-from-page-with-focused-iframe.html crashes under GuardMalloc
        <https://webkit.org/b/166657>
        <rdar://problem/29848806>

        Reviewed by Antti Koivisto.

        The problem was that tearDownRenderers() would cause commit Widget hierarchy updates
        before returning, which is just before Document clears its m_renderView pointer.
        This led to an awkward callback into Page::setActivityState() which ended up trying
        to clear the selection inside a partially dead render tree.

        Fix this by adding a WidgetHierarchyUpdatesSuspensionScope to Document::destroyRenderTree()
        which ensures that Widget updates don't happen until after Document::m_renderView is cleared.

        * dom/Document.cpp:
        (WebCore::Document::destroyRenderTree):

018-01-29  Antti Koivisto  <antti@apple.com>

        CalcExpressionBlendLength::evaluate hits stack limit
        https://bugs.webkit.org/show_bug.cgi?id=182243

        Reviewed by Zalan Bujtas.

        Speculative fix to prevent nesting of CalcExpressionBlendLength.

        No test, don't know how to make one.

        * platform/CalculationValue.cpp:
        (WebCore::CalcExpressionBlendLength::CalcExpressionBlendLength):

        CalcExpressionBlendLength is only used in Length values of animated style. Normally such styles are not used
        as input for further blending but there are some paths where this could in principle happen. Repeated
        application (for each animation frame) could construct CalcExpressionBlendLength expression that blows
        the stack when evaluated.

        Speculatively fix by flattening any nesting.

        * platform/CalculationValue.h:
        (WebCore::CalcExpressionBlendLength::CalcExpressionBlendLength): Deleted.

2018-01-30  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r227697. rdar://problem/37019483

    2018-01-26  Simon Fraser  <simon.fraser@apple.com>

            REGRESSiON (r226492): Crash under Element::absoluteEventBounds() on a SVGPathElement which has not been laid out yet
            https://bugs.webkit.org/show_bug.cgi?id=182185
            rdar://problem/36836262

            Reviewed by Zalan Bujtas.

            Document::absoluteRegionForEventTargets() can fire when layout is dirty, and SVGPathElement's path() can be null if it
            hasn't been laid out yet. So protect against a null path in getBBox().

            Not easily testable because internals.nonFastScrollableRects() forces layout, and the crash depends on the timing of
            absoluteRegionForEventTargets().

            * svg/SVGPathElement.cpp:
            (WebCore::SVGPathElement::getBBox):

2018-01-06  Simon Fraser  <simon.fraser@apple.com>

        Possible crash computing event regions
        https://bugs.webkit.org/show_bug.cgi?id=181368
        rdar://problem/34847081

        Reviewed by Zalan Bujtas.

        Don't trigger layout in Element::absoluteEventHandlerBounds(), since this can run arbirary script
        which might delete elements or re-enter Document::absoluteRegionForEventTargets().

        It's OK to not trigger layout, because if layout is dirty, the next layout will update event regions again.

        Add a LayoutDisallowedScope to check that Document::absoluteRegionForEventTargets() doesn't
        trigger layout, and move the check for LayoutDisallowedScope::isLayoutAllowed() from Document::updateLayout()
        to LayoutContext::layout(), since some layouts don't happen via the former (e.g. the one being removed here).

        The test checks that the assertion does not fire. I was not able to get a reliable test for any crash.

        Test: fast/events/event-handler-regions-layout.html

        * dom/Document.cpp:
        (WebCore::Document::updateLayout):
        (WebCore::Document::absoluteRegionForEventTargets):
        * dom/Element.cpp:
        (WebCore::Element::absoluteEventHandlerBounds):
        * page/LayoutContext.cpp:
        (WebCore::LayoutContext::layout):
        * rendering/LayoutDisallowedScope.h: Move the #ifdefs around to avoid defining the enum twice.
        (WebCore::LayoutDisallowedScope::LayoutDisallowedScope):
        (WebCore::LayoutDisallowedScope::isLayoutAllowed):

2018-01-25  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r227578. rdar://problem/36873356

    2018-01-24  Chris Dumez  <cdumez@apple.com>

            close() operation should not be exposed inside a ServiceWorkerGlobalScope
            https://bugs.webkit.org/show_bug.cgi?id=182057

            Reviewed by Youenn Fablet.

            Move close() from WorkerGlobalScope to DedicatedWorkerGlobalScope as per:
            - https://html.spec.whatwg.org/multipage/workers.html#dedicatedworkerglobalscope

            This change to the specification was made to avoid exposing this deprecated
            features to service workers (which are new).

            No new tests, rebaselined existing test.

            * workers/DedicatedWorkerGlobalScope.idl:
            * workers/WorkerGlobalScope.idl:


2018-01-25  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r227567. rdar://problem/36873353

    2018-01-24  Daniel Bates  <dabates@apple.com>

            [CSP] Check policy for targeted windows when navigating to a JavaScript URL
            https://bugs.webkit.org/show_bug.cgi?id=182018
            <rdar://problem/36795781>

            Reviewed by Brent Fulgham.

            Move the CSP check to be earlier in the function.

            Test: http/tests/security/contentSecurityPolicy/window-open-javascript-url-with-target-blocked.html

            * loader/FrameLoader.cpp:
            (WebCore::createWindow):

2018-01-24  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r227531. rdar://problem/36830355

    2018-01-24  Youenn Fablet  <youenn@apple.com>

            Fetch response should copy its url from the request if null
            https://bugs.webkit.org/show_bug.cgi?id=182048
            Reviewed by Chris Dumez.

            No change of behavior.

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::responseReceived): Add assertion to check that the response URL is not null.

2018-01-19  Ryosuke Niwa  <rniwa@webkit.org>

        Release assertion in canExecuteScript when executing scripts during page cache restore
        https://bugs.webkit.org/show_bug.cgi?id=181902

        Reviewed by Antti Koivisto.

        The crash was caused by an erroneous instantiation of ScriptDisallowedScope::InMainThread in CachedPage::restore.
        It can execute arbitrary scripts since CachedFrame::open can update style, layout, and evaluate media queries.

        This is fine because there is no way to put this page back into a page cache until the load is commited via
        FrameLoader::commitProvisionalLoad is invoked later which only happens after CachedPage::restore had exited.

        Also added a release assert to make sure this condition holds.

        Tests: fast/history/page-cache-execute-script-during-restore.html
               fast/history/page-cache-navigate-during-restore.html

        * history/CachedPage.cpp:
        (WebCore::CachedPageRestorationScope::CachedPageRestorationScope): Added.
        (WebCore::CachedPageRestorationScope::~CachedPageRestorationScope): Added.
        (WebCore::CachedPage::restore): Don't instantiate ScriptDisallowedScope::InMainThread. Set isRestoringCachedPage
        on the cached pate to release-assert that there won't be any attempt to put this very page back into the cache.
        * history/PageCache.cpp:
        (WebCore::canCachePage): Added a release assert to make sure the page which is in the process of being restored
        from the page cache is not put into the page cache.
        * page/Page.h:
        (WebCore::Page::setIsRestoringCachedPage): Added.
        (WebCore::Page::isRestoringCachedPage const): Added.

2018-01-21  Jer Noble  <jer.noble@apple.com>

        REGRESSION (macOS 10.13.2): imported/w3c/web-platform-tests/media-source/mediasource-* LayoutTests failing
        https://bugs.webkit.org/show_bug.cgi?id=181891

        Reviewed by Eric Carlson.

        In macOS 10.13.2, CoreMedia changed the definition of CMSampleBufferGetDuration() to return
        the presentation duration rather than the decode duration. For media streams where those two
        durations are identical (or at least, closely similar), this isn't a problem. But the media
        file used in the WPT tests have an unusual frame cadence: decode durations go {3000, 1, 5999,
        1, 5999,...} and presentation durations go {3000, 2999, 3000, 2999}. This caused one check in
        the "Coded Frame Processing" algorithm to begin failing, where it checks that the delta
        between the last sample's decode time and the new decode time is no more than 2x as far as
        the last sample's duration. That's not a problem as long as the "duration" is the "decode
        duration" and the samples are all adjacent. Once the "duration" is "presentation duration",
        all the assumptions in the algorithm are invalidated. In the WPT test case, the delta between
        decode times is 5999, and 2 * the presentation duration is 5998, causing all samples up to
        the next sync sample to be dropped.

        To work around this change in behavior, we'll adopt the same technique used by Mozilla's MSE
        implementation, which was done for similar reasons. Rather than track the "last frame duration",
        we'll record the "greatest frame duration", and use actual decode timestamps to derive this
        duration. The "greatest frame duration" field will be reset at the same times as "last frame
        duration", and will be used only in the part of the algorithm that checks for large decode
        timestamp gaps.

        * Modules/mediasource/SourceBuffer.cpp:
        (WebCore::SourceBuffer::TrackBuffer::TrackBuffer):
        (WebCore::SourceBuffer::resetParserState):
        (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2018-01-16  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r227000. rdar://problem/36567987

    2018-01-16  Simon Fraser  <simon.fraser@apple.com>

            Text looks bad on some CSS spec pages
            https://bugs.webkit.org/show_bug.cgi?id=181700
            rdar://problem/36552107

            Reviewed by Tim Horton.

            When making new tiles in a TileController, we failed to set their "supports antialiased layer text"
            setting, so tile caches could end up with a mixture of layers that do and do not support
            antialiased layer text.

            No tests because the tiled drawing tests don't dump out tiles inside of tile caches.

            * platform/graphics/ca/TileController.cpp:
            (WebCore::TileController::createTileLayer):

2015-10-05  Jiewen Tan  <jiewen_tan@apple.com>

        Fix null pointer dereference in WebSocket::connect()        
        https://bugs.webkit.org/show_bug.cgi?id=149311
        <rdar://problem/22748858>

        Reviewed by Chris Dumez.

        This is a merge of Blink r187441,
        https://codereview.chromium.org/785933005

        Test: http/tests/websocket/construct-in-detached-frame.html

        * Modules/websockets/WebSocket.cpp:
        (WebCore::WebSocket::connect):
        Call function implemented below instead of duplicating the code.
        * page/ContentSecurityPolicy.cpp:
        (WebCore::ContentSecurityPolicy::shouldBypassMainWorldContentSecurityPolicy):
        * page/ContentSecurityPolicy.h:
        Factor the logic to check shouldBypassMainWorldContentSecurityPolicy into 
        a function in this class. Check Frame pointers are not null before getting 
        shouldBypassMainWorldContentSecurityPolicy via those pointers.
        * page/EventSource.cpp:
        (WebCore::EventSource::create):
        This got fixed as a bonus.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::open):
        This got fixed as a bonus too.

2018-01-16  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r226951. rdar://problem/36568098

    2018-01-15  Youenn Fablet  <youenn@apple.com>

            RealtimeMediaSource should be ThreadSafeRefCounted
            https://bugs.webkit.org/show_bug.cgi?id=181649

            Reviewed by Eric Carlson.

            Difficult to write a test as this is really racy.
            RealtimeIncomingVideoSourceCocoa::OnFrame is taking a reference on a background thread
            to send a task to the main thread.
            This requires it to be thread safe ref counted.

            * platform/mediastream/RealtimeMediaSource.h:

2018-01-16  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r226929. rdar://problem/36567962

    2018-01-12  Alex Christensen  <achristensen@webkit.org>

            History state should be updated during client redirects with asynchronous policy decisions
            https://bugs.webkit.org/show_bug.cgi?id=181358
            <rdar://problem/35547689>

            Reviewed by Andy Estes.

            When decidePolicyForNavigationAction is responded to asynchronously during a client redirect,
            HistoryController::updateForRedirectWithLockedBackForwardList does not update the history because
            the document loader has not been marked as a client redirect because the FrameLoader only looks
            at its provisional document loader to mark it as a client redirect.  When decidePolicyForNavigationAction
            is responded to asynchronously, though, the FrameLoader's provisional document loader has moved to
            its policy document loader.  To get both asynchronous and synchronous cases, let's just mark the document
            loader as a client redirect whether it's the provisional or policy document loader.

            Covered by a new API test.

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::loadURL):
            (WebCore::FrameLoader::loadPostRequest):

2018-01-16  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r226908. rdar://problem/36568060

    2018-01-12  Dean Jackson  <dino@apple.com>

            drawElements should be invalid if vertexAttrib0 doesn't have data
            https://bugs.webkit.org/show_bug.cgi?id=181609
            <rdar://problem/36392883>

            Reviewed by Antoine Quint.

            If a vertex attribute has been enabled, but no data provided, then
            draw validation should fail.

            Test: fast/canvas/webgl/drawElements-empty-vertex-data.html

            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::validateVertexAttributes): If there were
            never any data in the vertex buffer, then we incorrectly compared with 0.

2018-01-11  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r226653. rdar://problem/36429147

    2018-01-09  Antti Koivisto  <antti@apple.com>

            Blank page except for inner iframes because pending stylesheets cause style.isNotFinal() to be true
            https://bugs.webkit.org/show_bug.cgi?id=180940
            <rdar://problem/36116507>

            Reviewed by Darin Adler.

            Test: http/tests/local/loading-stylesheet-import-remove.html

            If a <link> referencing a stylesheet containing an @import that was still loading was removed
            from the document, the loading state was never cleared. For head stylesheets this blocked
            rendering permanently.

            Test reduction by Justin Ridgewell.

            * html/HTMLLinkElement.cpp:
            (WebCore::HTMLLinkElement::removedFromAncestor):

            Test if the stylesheet it loading before clearing the pointer.

2018-01-06  Simon Fraser  <simon.fraser@apple.com>

        Crash under RenderLayer::scrollTo() with marquee
        https://bugs.webkit.org/show_bug.cgi?id=181349
        rdar://problem/36190168

        Reviewed by Zalan Bujtas.

        Don't call updateWidgetPositions() synchonously during RenderLayer scrolling, because it
        can run arbitrary script which may trigger destruction of this RenderLayer.

        Instead, queue up updateWidgetPositions() on a zero-delay timer.

        Under some circumstances this may allow a paint to occur before the widgets have been
        updated (which could be fixed with a more invasive change), but in practice I saw no
        painting issues with plug-ins or iframes inside overflow scroll, in WebKit or LegacyWebKit.

        Test: fast/scrolling/marquee-scroll-crash.html

        * page/FrameView.cpp:
        (WebCore::FrameView::FrameView):
        (WebCore::FrameView::updateWidgetPositions):
        (WebCore::FrameView::scheduleUpdateWidgetPositions):
        (WebCore::FrameView::updateWidgetPositionsTimerFired):
        * page/FrameView.h:
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):

2017-12-01  Zalan Bujtas  <zalan@apple.com>

        Nullptr deref in WebCore::RenderTableCaption::containingBlockLogicalWidthForContent
        https://bugs.webkit.org/show_bug.cgi?id=180251
        <rdar://problem/34138562>

        Reviewed by Simon Fraser.

        containingBlockLogicalWidthForContent should check whether the renderer is actually
        attached to the tree.

        Test: fast/table/caption-crash-when-layer-backed.html

        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::containingBlockLogicalWidthForContent const):
        * rendering/RenderTableCaption.h:
        (WebCore::RenderTableCaption::containingBlockLogicalWidthForContent const):

2017-10-27  Daniel Bates  <dabates@apple.com>

        Only allow non-mixed content protected subresources to ask for credentials
        https://bugs.webkit.org/show_bug.cgi?id=178919
        <rdar://problem/35015245>

        Reviewed by Alex Christensen.

        Only allow non-mixed content protected subresources to ask for credentials. It is not meaningful
        to allow protected mixed-content subresources to ask for credentials.

        Tests: http/tests/security/mixedContent/insecure-image-redirects-to-basic-auth-secure-image.html
               http/tests/security/mixedContent/insecure-script-redirects-to-basic-auth-secure-script.html
               http/tests/security/mixedContent/insecure-stylesheet-redirects-to-basic-auth-secure-stylesheet.html
               http/tests/security/mixedContent/secure-redirect-to-insecure-redirect-to-basic-auth-secure-image.https.html
               http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-insecure-image.https.html
               http/tests/security/mixedContent/secure-redirect-to-secure-redirect-to-basic-auth-secure-image.https.html

        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::ResourceLoader): Initialize m_canAskClientForCredentials based on the
        specified resource loader options.
        (WebCore::ResourceLoader::init): Update m_canAskClientForCredentials based on the URL of the initial
        request.
        (WebCore::ResourceLoader::isMixedContent const): Helper function to check if the specified URL
        represents a mixed content resource.
        (WebCore::ResourceLoader::willSendRequestInternal): If the original request or the redirect request
        is mixed content then update state such that we will disallow asking for credentials.
        (WebCore::ResourceLoader::isAllowedToAskUserForCredentials const): Modified to use m_canAskClientForCredentials
        when determining whether the request is allowed to ask for credentials.
        * loader/ResourceLoader.h:

2016-07-26  Youenn Fablet  <youenn@apple.com>

        Remove ClientCredentialPolicy cross-origin option from ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159413

        Reviewed by Alex Christensen.

        ClientCredentialPolicy had three values (not ask, ask, ask only for same origin).
        The distinction between allowing cross-origin or same-origin credentials is misleading as it is not supported
        for synchronous loads and not supported by Network process.
        It is best replaced by a boolean option (ask or not ask).

        Same-origin ClientCredentialPolicy option was only used by DocumentThreadableLoader for asynchronous loads.
        Since DocumentThreadableLoader is already computing whether the request is cross-origin, it can also compute
        whether credentials may be requested or not. In case of cross-origin redirections, credentials are omitted, thus
        disabling any possibility for requesting credentials for cross-origin resources after redirections.

        Moving ClientCredentialPolicy to ResourceLoaderOptions since it is not used by platform code except for some
        mac-specific code that is already using ResourceLoaderOptions.

        Covered by existing tests.

        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::startPreflight): Setting clearly credential mode to Omit credentials.
        (WebCore::CrossOriginPreflightChecker::doPreflight): Ditto.
        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): AskClientForAllCredentials ->
        ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::loadRequest): Disabling requesting credentials for any cross-origin request.
        * loader/FrameLoader.h:
        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Ditto.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::isAllowedToAskUserForCredentials): Disabling client credential request if ClientCredentialPolicy is CannotAskClientForCredentials.
        Otherwise, returns true if fetch credentials mode allows it.
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
        (WebCore::ResourceLoaderOptions::clientCredentialPolicy): Deleted.
        (WebCore::ResourceLoaderOptions::setClientCredentialPolicy): Deleted.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions): AskClientForAllCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading): DoNotAskClientForAnyCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::CannotAskClientForCredentials.
        This is ok as credentials mode is omit and stored credentials are not allowed.
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
        * platform/network/ResourceHandleTypes.h:
        * xml/XSLTProcessorLibxslt.cpp: DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        This is ok as this is a synchronous load.
        (WebCore::docLoaderFunc):
        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::openFunc): DoNotAskClientForCrossOriginCredentials -> ClientCredentialPolicy::MayAskClientForCredentials.
        This is ok as this is a synchronous load.

2016-07-05  Youenn Fablet  <youenn@apple.com>

        Remove CredentialRequest ResourceLoaderOptions
        https://bugs.webkit.org/show_bug.cgi?id=159404

        Reviewed by Sam Weinig.

        No observable change of behavior.
        Removing CredentialRequest from ResourceLoaderOptions and replacing it by FetchOptions::Credentials.
        As per https://fetch.spec.whatwg.org/#http-fetch, credentials flag is set according FetchOptions::Credentials.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::startLoadingMainResource): Set credentials mode to Include.
        * loader/DocumentThreadableLoader.cpp:
        (WebCore::DocumentThreadableLoader::redirectReceived): Disable credentials if credentials mode is SameOrigin
        (request being cross origin).
        * loader/MediaResourceLoader.cpp: Refqctoring to use CachedResourceReauest::setAsPotentiallyCrossOrigin.
        Removed unnecessary ResourceRequest copy by using the mutable request of CachedResourceRequest.
        (WebCore::MediaResourceLoader::requestResource):
        * loader/NetscapePlugInStreamLoader.cpp:
        (WebCore::NetscapePlugInStreamLoader::NetscapePlugInStreamLoader): Set credential mode  to Include
        * loader/ResourceLoaderOptions.h: Removing CredentialRequest option.
        (WebCore::ResourceLoaderOptions::ResourceLoaderOptions):
        (WebCore::ResourceLoaderOptions::credentialRequest): Deleted.
        (WebCore::ResourceLoaderOptions::setCredentialRequest): Deleted.
        * loader/cache/CachedResourceLoader.cpp:
        (WebCore::CachedResourceLoader::requestUserCSSStyleSheet): Set credential mode to Include.
        (WebCore::CachedResourceLoader::defaultCachedResourceOptions): Ditto.
        * loader/cache/CachedResourceRequest.cpp:
        (WebCore::CachedResourceRequest::setAsPotentiallyCrossOrigin): Set credential mode according crossorigin
        atribute value.
        * loader/icon/IconLoader.cpp:
        (WebCore::IconLoader::startLoading): Set credential mode to Omit.
        * page/EventSource.cpp:
        (WebCore::EventSource::connect): Set credential mode according crossorigin atribute value.
        * platform/graphics/avfoundation/cf/WebCoreAVCFResourceLoader.cpp:
        (WebCore::WebCoreAVCFResourceLoader::startLoading): Set credential mode to Omit.
        * platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
        (WebCore::WebCoreAVFResourceLoader::startLoading): Ditto.
        * platform/network/ResourceHandleTypes.h: Removed definition of CredentialRequest.
        * xml/XMLHttpRequest.cpp:
        (WebCore::XMLHttpRequest::createRequest): Set credential mode according crossorigin atribute value.

2016-07-01  Youenn Fablet  <youenn@apple.com>

        Make ResourceLoaderOptions derive from FetchOptions
        https://bugs.webkit.org/show_bug.cgi?id=159345

        Reviewed by Alex Christensen.

        No change of behavior.

        * Modules/fetch/FetchLoader.cpp:
        (WebCore::FetchLoader::start):
        * loader/CrossOriginPreflightChecker.cpp:
        (WebCore::CrossOriginPreflightChecker::startPreflight):
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::fetchOptions): Deleted.
        (WebCore::ResourceLoaderOptions::setFetchOptions): Deleted.
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal):
        * loader/ThreadableLoader.h: Removing securityOrigin field (left over from https://bugs.webkit.org/show_bug.cgi?id=159221)

2016-06-27  Jer Noble  <jer.noble@apple.com>

        Cross-domain video loads do not prompt for authorization.
        https://bugs.webkit.org/show_bug.cgi?id=159195
        <rdar://problem/26234612>

        Reviewed by Brent Fulgham.

        Test: http/tests/media/video-auth.html (modified)

        We should prompt for authorization when a cross-origin <video> is embedded
        in a web page.

        * loader/MediaResourceLoader.cpp:
        (WebCore::MediaResourceLoader::requestResource):

2016-05-24  Youenn Fablet  <youenn.fablet@crf.canon.fr>

        [Fetch API] Implement Fetch redirect mode
        https://bugs.webkit.org/show_bug.cgi?id=157837

        Reviewed by Alex Christensen.

        Implementing step 5 of https://fetch.spec.whatwg.org/#http-fetch.
        Making ResourceLoaderOptions include FetchOptions.
        This allows SubresourceLoader to follow or not redirections based on that option.
        CachedResource is made responsible to handle the type of the response (opaqueredirect, opaque, cors, basic...).
        If redirection is not to be followed, either an error is returned or an empty response is returned.

        Moved Response type and redirected flag from FetchResponse to ResourceResponse.
        This allows CachedResource to easily communicate that information to FetchResponse.

        Made some clean-up refactoring in ThreadableLoaderOptions.

        http/tests/fetch/caching-with-different-options.html ensures that
        caching at CachedResourceLoader will not have bad effects on fetch.
        Covered by updated and rebased tests.

        * Modules/fetch/FetchLoader.cpp:
        (WebCore::FetchLoader::start):
        * Modules/fetch/FetchResponse.cpp:
        (WebCore::FetchResponse::error):
        (WebCore::FetchResponse::redirect):
        (WebCore::FetchResponse::FetchResponse):
        (WebCore::FetchResponse::clone):
        (WebCore::FetchResponse::startFetching):
        * Modules/fetch/FetchResponse.h:
        * WebCore.xcodeproj/project.pbxproj:
        * loader/FetchOptions.h: Moved from Source/WebCore/Modules/fetch/FetchOptions.h.
        * loader/ResourceLoaderOptions.h:
        (WebCore::ResourceLoaderOptions::fetchOptions):
        (WebCore::ResourceLoaderOptions::setFetchOptions):
        * loader/SubresourceLoader.cpp:
        (WebCore::SubresourceLoader::willSendRequestInternal):
        * loader/ThreadableLoader.cpp:
        * loader/ThreadableLoader.h:
        * loader/cache/CachedResource.cpp:
        (WebCore::CachedResource::setResponse):
        * loader/cache/CachedResource.h:
        (WebCore::CachedResource::setOpaqueRedirect):
        * platform/network/ResourceResponseBase.cpp:
        (WebCore::ResourceResponseBase::adopt):
        (WebCore::ResourceResponseBase::copyData):
        * platform/network/ResourceResponseBase.h:
        (WebCore::ResourceResponseBase::type):
        (WebCore::ResourceResponseBase::setType):
        (WebCore::ResourceResponseBase::encode):
        (WebCore::ResourceResponseBase::decode):

2016-06-09  John Wilander  <wilander@apple.com>

        Restrict HTTP/0.9 responses to default ports and cancel HTTP/0.9 resource loads if the document was loaded with another HTTP protocol
        https://bugs.webkit.org/show_bug.cgi?id=158589
        <rdar://problem/25757454>

        Reviewed by Brent Fulgham.

        No new tests. Our layout test environment does not allow for headerless responses
        nor does it allow you to set an explicit HTTP/0.9 status header in PHP. I have
        manually tested this change with a Python socket setup doing both headerless and
        HTTP/0.9 header tests for positive and negative cases.

        * loader/DocumentLoader.cpp:
        (WebCore::DocumentLoader::responseReceived):
            Cancel loads if the request was made to a non-default port.
        * loader/ResourceLoader.cpp:
        (WebCore::ResourceLoader::didReceiveResponse):
            Cancel loads if the request was made to a non-default port or if the document
            was loaded with another protocol. Cancelation is handled as a fail so as to
            fire the onerror event and allow sites to handle it gracefully.

2017-11-22  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r224398. rdar://problem/35329715

    2017-11-03  Daniel Bates  <dabates@apple.com>

            Invalidate node list when associated form control element is removed
            https://bugs.webkit.org/show_bug.cgi?id=179232
            <rdar://problem/35308269>

            Reviewed by Ryosuke Niwa.

            A node list represents a live view of the DOM. Invalidate the node list
            associated with a form element whenever one of its associated form control
            elements is removed.

            Test: fast/forms/node-list-remove-button-from-form.html

            * html/HTMLFormElement.cpp:
            (WebCore::HTMLFormElement::removeFormElement):

2018-01-05  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r226457. rdar://problem/36323985

    2018-01-05  Said Abou-Hallawa  <sabouhallawa@apple.com>

            SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded() should do nothing if the property is not animating
            https://bugs.webkit.org/show_bug.cgi?id=181316
            <rdar://problem/36147545>

            Reviewed by Simon Fraser.

            This is a speculative change to fix a crash which appeared after r226065.
            The crash is very intermittent and sometimes very hard to reproduce. The
            basic code analysis did not show how this crash can even happen.

            * svg/SVGAnimatedTypeAnimator.h:
            (WebCore::SVGAnimatedTypeAnimator::resetFromBaseValues): For SVG property
            with two values, e.g. <SVGAngleValue, SVGMarkerOrientType>,  we need to
            detach the wrappers of the animated property if the animated values are
            going to change. This is similar to what we did in resetFromBaseValue().

            * svg/properties/SVGAnimatedListPropertyTearOff.h:
            (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):

2017-12-18  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r226065. rdar://problem/36080413

    2017-12-18  Zalan Bujtas  <zalan@apple.com>

            [SVG] Detach list wrappers before resetting the base value.
            https://bugs.webkit.org/show_bug.cgi?id=180912
            <rdar://problem/36017970>

            Reviewed by Simon Fraser.

            Before resetting the animation value (and destroying the assigned SVG object -SVGLengthValue in this case),
            we need to check if there's an associated tear off wrapper for the said SVG object and make a copy of it.
            This is currently done in the wrong order through animValDidChange.

            Test: svg/animations/crash-when-animation-is-running-while-getting-value.html

            * svg/SVGAnimatedTypeAnimator.h:
            (WebCore::SVGAnimatedTypeAnimator::resetFromBaseValue):
            * svg/properties/SVGAnimatedPropertyTearOff.h:
            * svg/properties/SVGAnimatedStaticPropertyTearOff.h:
            (WebCore::SVGAnimatedStaticPropertyTearOff::synchronizeWrappersIfNeeded):

2017-10-10  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r221831. rdar://problem/34891283

    2017-09-08  Dean Jackson  <dino@apple.com>

            gl.detachShader breaks shader program
            https://bugs.webkit.org/show_bug.cgi?id=137689
            <rdar://problem/34025056>

            Reviewed by Sam Weinig.

            It should be possible to compile shaders, attach them to a program,
            link the program, detach the shaders, delete the shaders, and then
            ask for the uniform and attribute locations. That is, once you've
            linked, the shaders can be thrown away.

            We were using the attached shaders to look up uniform locations, so
            we now keep around a separate map that remembers what shaders were
            attached when the program links.

            This fixes the bug, but the whole area is still a bit messy. For one,
            we're keeping around all the shader information even after it is
            no longer used.
            See https://bugs.webkit.org/show_bug.cgi?id=98204

            Test: fast/canvas/webgl/detachShader-before-accessing-uniform.html

            * platform/graphics/GraphicsContext3D.h: Add another map to remember
            what shaders were used when a program was linked.
            * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
            (WebCore::GraphicsContext3D::mappedSymbolInShaderSourceMap): New helper
            to look up a name in our source maps.
            (WebCore::GraphicsContext3D::mappedSymbolName): Use the helper, and look
            at linked shaders if there are no attached shaders.
            (WebCore::GraphicsContext3D::originalSymbolInShaderSourceMap): Does the
            reverse of the above.
            (WebCore::GraphicsContext3D::originalSymbolName):
            (WebCore::GraphicsContext3D::linkProgram): Add to the new map.
            (WebCore::GraphicsContext3D::deleteProgram): Delete the program from
            our shader entries.

2017-10-09  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r221046. rdar://problem/34891067

    2017-08-22  Jer Noble  <jer.noble@apple.com>

            Refactor videoPerformanceQuality() MediaPlayer methods into single call.
            https://bugs.webkit.org/show_bug.cgi?id=175830

            Reviewed by Eric Carlson.

            Allow MediaPlayerPrivate subclasses to return all the metrics required for VideoPerformanceQuality in
            a single call. For clients which incur significant overhead to request this data, this reduces the cost
            of requesting data by the number of calls removed.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::getVideoPlaybackQuality):
            * platform/graphics/MediaPlayer.cpp:
            (WebCore::MediaPlayer::videoPlaybackQualityMetrics):
            (WebCore::MediaPlayer::totalVideoFrames): Deleted.
            (WebCore::MediaPlayer::droppedVideoFrames): Deleted.
            (WebCore::MediaPlayer::corruptedVideoFrames): Deleted.
            (WebCore::MediaPlayer::totalFrameDelay): Deleted.
            * platform/graphics/MediaPlayer.h:
            (WebCore::PlatformVideoPlaybackQualityMetrics::PlatformVideoPlaybackQualityMetrics):
            * platform/graphics/MediaPlayerPrivate.h:
            (WebCore::MediaPlayerPrivateInterface::videoPlaybackQualityMetrics):
            (WebCore::MediaPlayerPrivateInterface::totalVideoFrames): Deleted.
            (WebCore::MediaPlayerPrivateInterface::droppedVideoFrames): Deleted.
            (WebCore::MediaPlayerPrivateInterface::corruptedVideoFrames): Deleted.
            (WebCore::MediaPlayerPrivateInterface::totalFrameDelay): Deleted.
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::videoPlaybackQualityMetrics):
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::totalVideoFrames): Deleted.
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::droppedVideoFrames): Deleted.
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::corruptedVideoFrames): Deleted.
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::totalFrameDelay): Deleted.
            * platform/graphics/gstreamer/mse/MediaPlayerPrivateGStreamerMSE.h:
            * platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:
            (WebCore::MockMediaPlayerMediaSource::videoPlaybackQualityMetrics):
            (WebCore::MockMediaPlayerMediaSource::totalVideoFrames): Deleted.
            (WebCore::MockMediaPlayerMediaSource::droppedVideoFrames): Deleted.
            (WebCore::MockMediaPlayerMediaSource::corruptedVideoFrames): Deleted.
            (WebCore::MockMediaPlayerMediaSource::totalFrameDelay): Deleted.
            * platform/mock/mediasource/MockMediaPlayerMediaSource.h:
            * platform/mock/mediasource/MockMediaSourcePrivate.cpp:
            (WebCore::MockMediaSourcePrivate::videoPlaybackQualityMetrics):
            * platform/mock/mediasource/MockMediaSourcePrivate.h:

2017-10-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r223442. rdar://problem/34745623

    2017-10-16  Maureen Daum  <mdaum@apple.com>

            If an origin doesn't have databases in the Databases table we should still remove its information from disk in DatabaseTracker::deleteOrigin()
            https://bugs.webkit.org/show_bug.cgi?id=178281
            <rdar://problem/34576132>

            Reviewed by Brent Fulgham.

            New test:
            DatabaseTracker.DeleteOriginWithMissingEntryInDatabasesTable

            * Modules/webdatabase/DatabaseTracker.cpp:
            (WebCore::DatabaseTracker::deleteOrigin):
            If databaseNames is empty, don't bail early. Instead, delete everything in the directory
            containing the databases for this origin. This condition indicates that we previously
            tried to remove the origin but didn't get all of the way through the deletion process.
            Because we have lost track of the databases for this origin, we can assume that no
            other process is accessing them. This means it should be safe to delete them outright.

2017-10-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r223438. rdar://problem/34745623

    2017-10-16  Ryan Haddad  <ryanhaddad@apple.com>

            Unreviewed attempt to fix the Windows debug build.

            * Modules/webdatabase/DatabaseTracker.cpp:
            (WebCore::DatabaseTracker::deleteOrigin):

2017-10-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r223427. rdar://problem/34745623

    2017-10-16  Maureen Daum  <mdaum@apple.com>

            If we fail to delete any database file, don't remove its information from the tracker database
            <rdar://problem/34576132> and https://bugs.webkit.org/show_bug.cgi?id=178251

            Reviewed by Brady Eidson.

            New tests:
            DatabaseTracker.DeleteDatabase
            DatabaseTracker.DeleteDatabaseWhenDatabaseDoesNotExist
            DatabaseTracker.DeleteOrigin
            DatabaseTracker.DeleteOriginWhenDeletingADatabaseFails
            DatabaseTracker.DeleteOriginWhenDatabaseDoesNotExist

            * Modules/webdatabase/DatabaseTracker.cpp:
            (WebCore::DatabaseTracker::deleteDatabasesModifiedSince):
            If the database doesn't exist, we previously deleted it but failed to remove the
            information from the tracker database. We still want to delete all of the information
            associated with this database from the tracker database, so add it to databaseNamesToDelete.
            (WebCore::DatabaseTracker::deleteOrigin):
            If a database doesn't exist, don't try to delete it. We don't need to, but more
            importantly, deleteDatabaseFile() will fail if the database doesn't exist, which
            will cause us to incorrectly think we failed to remove database information from disk.
            If we actually fail to delete any database file, return before we remove the origin
            information from the tracker database so we don't lose track of the database.
            (WebCore::DatabaseTracker::deleteDatabase):
            If a database doesn't exist, don't try to delete it. We don't need to, but also it
            will cause us to incorrectly think that we were unable to delete a database, so we
            would bail before we remove the database information from the tracker database. We
            want to remove the database information from the tracker database because the database
            doesn't exist.
            * Modules/webdatabase/DatabaseTracker.h:
            Expose fullPathForDatabase() for use by tests.
            * platform/Logging.h:
            Add a logging channel.

2017-10-18  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r223423. rdar://problem/34745623

    2017-10-16  Maureen Daum  <mdaum@apple.com>

            We should wrap the removal of information from the tracker database in a transaction in DatabaseTracker::deleteOrigin()
            https://bugs.webkit.org/show_bug.cgi?id=178274
            <rdar://problem/34576132>

            Reviewed by Tim Horton.

            * Modules/webdatabase/DatabaseTracker.cpp:
            (WebCore::DatabaseTracker::deleteOrigin):
            Wrap the removal of information from the tracker database in a transaction so that
            we don't end up in a case where only one of the tables contains information about
            an origin.
            If anything goes wrong when we're modifying the tracker database, rollback the transaction
            before bailing.

2017-10-18  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r223228. rdar://problem/35061705

    2017-10-11  Brent Fulgham  <bfulgham@apple.com>

            Correct nullptr deref in selection handling.
            https://bugs.webkit.org/show_bug.cgi?id=178189
            <rdar://problem/33833012>

            Reviewed by Ryosuke Niwa.

            The VisibleSelection::toNormalizedRange returns nullptr for certain conditions (e.g., 'isNone'
            and 'isOrphaned' cases). It's possible to crash the WebProcess by executing a code path with
            an orphaned selection range.

            The return value of 'toNormalizedRange' is checked for nullptr in many places, but not everywhere.
            This patch adds those missing nullptr checks.

            * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
            (-[WebAccessibilityObjectWrapper textMarkerRangeForSelection]):
            * editing/DeleteSelectionCommand.cpp:
            (WebCore::DeleteSelectionCommand::makeStylingElementsDirectChildrenOfEditableRootToPreventStyleLoss):
            * editing/EditingStyle.cpp:
            (WebCore::EditingStyle::styleAtSelectionStart):
            * editing/Editor.cpp:
            (WebCore::Editor::misspelledWordAtCaretOrRange const):
            * page/DOMSelection.cpp:
            (WebCore::DOMSelection::containsNode const):
            * page/DragController.cpp:
            (WebCore::DragController::concludeEditDrag):

2017-10-18  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r221971. rdar://problem/34958928

    2017-09-13  Ms2ger  <Ms2ger@igalia.com>

            Make WebGLRenderingContextBase::TypedList::data() const-correct.
            https://bugs.webkit.org/show_bug.cgi?id=176833

            Reviewed by Sam Weinig.

            No change of behavior.

            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::validateUniformMatrixParameters):
            * html/canvas/WebGLRenderingContextBase.h:
            (WebCore::WebGLRenderingContextBase::TypedList::data const):
            * platform/graphics/GraphicsContext3D.h:
            * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
            (WebCore::GraphicsContext3D::uniform1fv):
            (WebCore::GraphicsContext3D::uniform2fv):
            (WebCore::GraphicsContext3D::uniform3fv):
            (WebCore::GraphicsContext3D::uniform4fv):
            (WebCore::GraphicsContext3D::uniform1iv):
            (WebCore::GraphicsContext3D::uniform2iv):
            (WebCore::GraphicsContext3D::uniform3iv):
            (WebCore::GraphicsContext3D::uniform4iv):
            (WebCore::GraphicsContext3D::uniformMatrix2fv):
            (WebCore::GraphicsContext3D::uniformMatrix3fv):
            (WebCore::GraphicsContext3D::uniformMatrix4fv):
            (WebCore::GraphicsContext3D::vertexAttrib1fv):
            (WebCore::GraphicsContext3D::vertexAttrib2fv):
            (WebCore::GraphicsContext3D::vertexAttrib3fv):
            (WebCore::GraphicsContext3D::vertexAttrib4fv):

2017-10-18  Dean Jackson  <dino@apple.com>

        Cherry-pick r223640. rdar://problem/35063901

    2017-10-18  Dean Jackson  <dino@apple.com>

            Some older hardware can't actually use renderbuffers at the size they advertise
            https://bugs.webkit.org/show_bug.cgi?id=178417
            <rdar://problem/35042291>

            Reviewed by Tim Horton.

            The change in r223567 caused some older hardware to fail, because even though
            they claimed to support a maximum renderbuffer and viewport of 16K, they were
            unable to actually handle one. Rather than trying to identify such hardware,
            clamp all buffers to a maximum of 8192. This is bigger than the previous value
            of 4096, and large enough to have a full-screen buffer on a Retina 5K iMac.

            * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
            (WebCore::GraphicsContext3D::getIntegerv):

2017-10-17  Dean Jackson  <dino@apple.com>

        Cherry-pick r223567. rdar://problem/35041476

    2017-10-16  Dean Jackson  <dino@apple.com>

            WebGL clamps drawingBufferWidth to 4096 pixels on a 5120 monitor/canvas
            https://bugs.webkit.org/show_bug.cgi?id=178223
            <rdar://problem/34597567>

            Reviewed by Antoine Quint.

            Remove the limit of 4k on the width/height of the renderbuffer.

            Test: fast/canvas/webgl/large-drawing-buffer-resize.html

            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::reshape):

2017-10-17  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r223313. rdar://problem/35042269

    2017-10-13  Brent Fulgham  <bfulgham@apple.com>

            Protect FrameView during style calculations
            https://bugs.webkit.org/show_bug.cgi?id=178300
            <rdar://problem/34869329>

            Reviewed by Ryosuke Niwa.

            Protect the FrameView during layout and style updates in case arbitrary script
            is run that might clear it.

            Test: fast/html/marquee-reparent-check.html

            * page/FrameView.cpp:
            (WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive):

2017-10-11  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222963. rdar://problem/34891307

    2017-10-05  Dean Jackson  <dino@apple.com>

            [WebGL] Safari performance is slow due to high MSAA usage
            https://bugs.webkit.org/show_bug.cgi?id=177949
            <rdar://problem/34835619>

            Reviewed by Sam Weinig.

            On some hardware, typically integrated GPUs, using MSAA with a sample
            count above 4 produces bad performance. Limit the number of samples to
            4 universally.

            * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
            (WebCore::GraphicsContext3D::reshapeFBOs):

2017-10-10  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r221937. rdar://problem/34893195

    2017-09-12  Jer Noble  <jer.noble@apple.com>

            [MSE] Don't increase the reported totalFrameDelay for non-displayed frames (or frames coming in while paused).
            https://bugs.webkit.org/show_bug.cgi?id=175900

            Reviewed by Eric Carlson.

            When seeking to a specific time, the decompression session necessarily needs to be fed samples from before that
            time (i.e., all samples from the previous I-frame forward). These shouldn't contribute to the "total frame
            delay" metric. Neither should samples delivered when the video is paused (like, during seeking), as a frame can't
            be "late" if time is not moving forward.

            * platform/graphics/cocoa/WebCoreDecompressionSession.mm:
            (WebCore::WebCoreDecompressionSession::handleDecompressionOutput):
            * platform/cf/CoreMediaSoftLink.cpp:
            * platform/cf/CoreMediaSoftLink.h:

2017-10-02  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r221016. rdar://problem/34770830

    2017-08-22  Jer Noble  <jer.noble@apple.com>

            Autoplay Muted Videos Don't Play When Outside Viewport
            https://bugs.webkit.org/show_bug.cgi?id=175748
            <rdar://problem/33974383>

            Reviewed by Eric Carlson.

            Test: media/video-restricted-invisible-autoplay-not-allowed-source.html

            The media session is notified that its client (the media element) will begin autoplaying inside
            prepareForLoad(), where the m_autoplaying flag is also set. But loading via <source> elements does not go
            through prepareForLoad(); the HTML standard states that the <source> element loading path does not trigger the
            "media element load algorithm" which is implemented in prepareForLoad(). Since the m_autoplaying flag is
            initially set to true, notify the media session that the element will begin autoplaying inside the element's
            constructor.

            Drive-by fix: Doing the above causes other tests to crash, as purturbing play state during style change can cause
            re-entrancy in the native controls code, or fail, since we will transition from autoplay -> play even if there's
            not yet a src or source to the media element. Add a task queue for updating the autoplay state and check the ready
            state before allowing autoplay to transition to play.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::HTMLMediaElement):
            (WebCore::HTMLMediaElement::~HTMLMediaElement):
            (WebCore::HTMLMediaElement::canTransitionFromAutoplayToPlay const):
            (WebCore::HTMLMediaElement::isVisibleInViewportChanged):

2017-10-02  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r221128. rdar://problem/34771005

    2017-08-23  Wenson Hsieh  <wenson_hsieh@apple.com>

            DeleteSelectionCommand should be robust when starting and ending editable positions cannot be found
            https://bugs.webkit.org/show_bug.cgi?id=175914
            <rdar://problem/29792688>

            Reviewed by Ryosuke Niwa.

            DeleteSelectionCommand can cause a null dereference if editable start and end positions are not found. This can
            happen when attempting to delete after selecting the contents within a canvas or output element with `read-write`
            `-webkit-user-modify` style. To fix this, we make the initialization step of the DeleteSelectionCommand robust
            when editable start and end positions are missing.

            Test: editing/execCommand/forward-delete-read-write-canvas.html

            * editing/DeleteSelectionCommand.cpp:
            (WebCore::DeleteSelectionCommand::initializePositionData):

            Make this initialization helper indicate failure via a bool return value. DeleteSelectionCommand::doApply bails
            early if initializePositionData returned false.

            (WebCore::DeleteSelectionCommand::doApply):
            * editing/DeleteSelectionCommand.h:

2016-06-24  Mark Lam  <mark.lam@apple.com>

        [JSC] Error prototypes are called on remote scripts.
        https://bugs.webkit.org/show_bug.cgi?id=52192

        Reviewed by Keith Miller.

        Test: http/tests/security/regress-52192.html

        Parsing errors are reported to the main script's window.onerror function.  AFAIK,
        both Chrome and Firefox have the error reporting mechanism use an internal
        sanitized version of Error.prototype.toString() that will not invoke any getters
        or proxies instead.

        This patch fixes this issue by matching Chrome and Firefox's behavior.

        Note: we did not choose to make error objects and prototypes read-only because
        that was observed to have broken the web.
        See https://bugs.chromium.org/p/chromium/issues/detail?id=69187#c73

        Credit for reporting this issue goes to Daniel Divricean (http://divricean.ro).

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::reportException):
        * ForwardingHeaders/runtime/ErrorInstance.h: Added.

2018-01-07  Ryosuke Niwa  <rniwa@webkit.org>

        Reduce the precision of "high" resolution time to 1ms
        https://bugs.webkit.org/show_bug.cgi?id=180910
        <rdar://problem/36085943>

        Reviewed by Saam Barati.

        Reduced the high prevision time's resolution to 1ms, the same precision as Date.now().

        Also fixed the bug in fillRTCStats that we weren't reducing the time resolution in RTCStats dictionaries.

        * Modules/mediastream/libwebrtc/LibWebRTCMediaEndpoint.cpp:
        (WebCore::fillRTCStats):
        * page/Performance.cpp:
        (WebCore::Performance::reduceTimeResolution):

2016-08-22  Johan K. Jensen  <johan_jensen@apple.com>

        Make NetworkLoadTiming use double for higher precision in Resource Timing
        https://bugs.webkit.org/show_bug.cgi?id=161051

        Reviewed by Alex Christensen.

        Test: http/tests/misc/resource-timing-resolution.html

        * page/Performance.h:
        * page/Performance.cpp:
        (WebCore::Performance::now):
        (WebCore::Performance::reduceTimeResolution):
        Add new function to reduce time resolution.

        * page/PerformanceResourceTiming.cpp:
        (WebCore::monotonicTimeToDocumentMilliseconds):
        (WebCore::PerformanceResourceTiming::resourceTimeToDocumentMilliseconds):
        Only use the reduced timing resolution for full timestamps and deltas.

        (WebCore::PerformanceResourceTiming::connectStart): Use doubles.
        * page/PerformanceResourceTiming.h: Use doubles.
        * page/PerformanceTiming.cpp: Use doubles.
        (WebCore::toIntegerMilliseconds): Use doubles.
        (WebCore::PerformanceTiming::connectStart): Use doubles.
        (WebCore::PerformanceTiming::resourceLoadTimeRelativeToFetchStart): Use doubles.
        * page/PerformanceTiming.h: Use doubles.
        * platform/network/NetworkLoadTiming.h: Use doubles.
        * platform/network/curl/ResourceHandleManager.cpp: Use doubles.
        (WebCore::milisecondsSinceRequest): Use doubles.
        (WebCore::calculateWebTimingInformations): Use doubles.
        * platform/network/soup/ResourceHandleSoup.cpp: Use doubles.
        (WebCore::milisecondsSinceRequest): Use doubles.
        (WebCore::networkEventCallback): Use doubles.

2016-07-05  David Kilzer  <ddkilzer@apple.com>

        Throw exceptions for invalid number of channels for ConvolverNode
        <https://webkit.org/b/159238>

        Reviewed by Brent Fulgham.

        Fix based on a Blink change (patch by <rtoy@chromium.org>):
        <https://chromium.googlesource.com/chromium/src.git/+/0cc26bbb7175aec77910d0b47faf9f8c8a640fe5>

        Also includes a related fix for ReverbConvolverStage (patch by <rtoy@chromium.org>):
        <https://src.chromium.org/viewvc/blink?revision=157832&view=revision>

        Test: webaudio/convolver-channels.html

        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::setBuffer): Throw an exception for
        anything but 1, 2 or 4 channels.
        * platform/audio/ReverbConvolverStage.cpp:
        (WebCore::ReverbConvolverStage::ReverbConvolverStage): Don't read past the end of
        the impulseResponse array.

2015-10-23  Hyemi Shin  <hyemi.sin@samsung.com>

        ConvolverNode.buffer must have same sample-rate as the AudioContext 
        https://bugs.webkit.org/show_bug.cgi?id=150385 

        Reviewed by Chris Dumez.

        ConvolverNode.buffer must be of the same sample-rate as the AudioContext
        or an NOT_SUPPORTED_ERR exception MUST be thrown.

        Test : webaudio/convolver-setBuffer-different-samplerate.html

        * Modules/webaudio/ConvolverNode.cpp:
        (WebCore::ConvolverNode::setBuffer):
        * Modules/webaudio/ConvolverNode.h:
        * Modules/webaudio/ConvolverNode.idl:

2016-08-03  Eric Carlson  <eric.carlson@apple.com>

        Cleanup HTMLMediaElement track lists.
        https://bugs.webkit.org/show_bug.cgi?id=160470

        Reviewed by Brent Fulgham.

        * html/track/AudioTrack.cpp:
        (WebCore::AudioTrack::willRemove): Remove unnecessary ASSERT and NULL check.

        * html/track/TextTrackList.cpp:
        (TextTrackList::~TextTrackList): Call clearElement so media element and client pointers are
        cleared.

2016-07-10  Zalan Bujtas  <zalan@apple.com>

        Fix LogicalSelectionOffsetCaches to work with detached render tree.
        https://bugs.webkit.org/show_bug.cgi?id=159605
        <rdar://problem/27248845>

        Reviewed by Brent Fulgham.

        When the renderer that is being destroyed is on a selection boundary,
        we need to ensure that all its cached pointers across the selection code (e.g. SelectionSubtreeData)
        are getting reset. In order to do that, we call clearSelection() on the RenderView.
        One of the last steps of clearing selection is to collect the selection gaps. Selection gaps uses this
        LogicalSelectionOffsetCaches helper class to collect selection information across blocks.
        LogicalSelectionOffsetCaches normally operates on rooted renderers. However we need to ensure sure that
        it can also handle renderers that are no longer part of the render tree.

        Test: fast/text/selection-on-a-detached-tree.html

        * rendering/LogicalSelectionOffsetCaches.h:
        (WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::setBlock):
        (WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::logicalLeftSelectionOffset):
        (WebCore::LogicalSelectionOffsetCaches::ContainingBlockInfo::logicalRightSelectionOffset):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::logicalLeftSelectionOffset):
        (WebCore::RenderBlock::logicalRightSelectionOffset):

2016-06-29  David Kilzer  <ddkilzer@apple.com>

        Crash when 'input' event handler for input[type=color] changes the input type
        <https://webkit.org/b/159262>
        <rdar://problem/27020404>

        Reviewed by Daniel Bates.

        Fix based on a Blink change (patch by <tkent@chromium.org>):
        <https://chromium.googlesource.com/chromium/src.git/+/a17cb3ecef49a078657524cdeaba33ad2083646c>

        Test: fast/forms/color/color-type-change-on-input-crash.html

        * html/ColorInputType.cpp:
        (WebCore::ColorInputType::didChooseColor): Add EventQueueScope
        before setValueFromRenderer() to fix the bug.
        * html/HTMLInputElement.h:
        (WebCore::HTMLInputElement::setValueFromRenderer): Add comment
        about how to use this method.

2015-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>

        The error handler of ReadableJSStream should own stream object
        https://bugs.webkit.org/show_bug.cgi?id=148653

        Reviewed by Sam Weinig.

        ReadableJSStream's m_errorFunction does not own the readable stream.
        So when this error callback is executed asynchronously through Promises,
        the stream could be already destroyed.
        The fulfill callback which is jointly configured with this error callback
        owns the stream. However, when the promise is rejected, the following things
        occur.

        1. Promise clears the fulfill handlers immediately.
        2. queue the reject handlers to the microtask queue.
        3. When draining the microtasks, the rejected handler will be executed.

        At the time of 2 or 3, the references to the fulfill handlers are already discarded.
        So when GC occurs at the time of 2 or 3, it will collect the fulfill handlers and the
        stream object owned by the fulfill handlers even if the error callback will touch the
        stream object later.

        Before r189124, this fault does not occur. This is because the std::function in the
        fulfill handler is not destroyed before that patch. Since the std::function owns the
        stream object, the std::function and the stream object were leaked and never destroyed.
        After that patch, the std::function in the fulfill handler becomes destroyed. And it
        makes this fault happen.

        In this patch, we separate the error callback from the stream object. Previously, the
        error callback resides in the stream object as the member. To avoid the cyclic references,
        this error callback did not own the stream object. But this causes this fault.
        Instead of caching the error callback in the stream object, we always create the error
        callback, when it is needed. The created error callback owns the stream object as well as
        the fulfill callbacks owns the stream object.

        No behavior change.

        * bindings/js/ReadableJSStream.cpp:
        (WebCore::createGenericErrorRejectedFunction):
        (WebCore::ReadableJSStream::doStart):
        (WebCore::ReadableJSStream::doPull):
        (WebCore::ReadableJSStream::ReadableJSStream): Deleted.
        * bindings/js/ReadableJSStream.h:

2016-06-07  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION (r201667): ASSERTION FAILED: !m_anchorNode || !editingIgnoresContent(*m_anchorNode)
        https://bugs.webkit.org/show_bug.cgi?id=158373
        <rdar://problem/26690795>

        Reviewed by Brent Fulgham.

        The bug was caused by VisibleSelection::toNormalizedRange calling parentAnchoredEquivalent on an orphaned Position.
        Fixed it by checking that condition and exiting early since we can't create a Range with a detached node anyway.

        Also renamed isNonOrphanedCaretOrRange to isNoneOrOrphaned after negating the semantics for clarity.

        Test: editing/selection/selection-in-iframe-removed-crash.html

        * editing/EditorCommand.cpp:
        (WebCore::valueFormatBlock):
        * editing/FrameSelection.cpp:
        (WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance):
        * editing/InsertLineBreakCommand.cpp:
        (WebCore::InsertLineBreakCommand::doApply):
        * editing/InsertListCommand.cpp:
        (WebCore::InsertListCommand::doApply):
        * editing/InsertParagraphSeparatorCommand.cpp:
        (WebCore::InsertParagraphSeparatorCommand::doApply):
        * editing/InsertTextCommand.cpp:
        (WebCore::InsertTextCommand::doApply):
        * editing/RemoveFormatCommand.cpp:
        (WebCore::RemoveFormatCommand::doApply):
        * editing/ReplaceSelectionCommand.cpp:
        (WebCore::ReplaceSelectionCommand::doApply):
        * editing/SetSelectionCommand.cpp:
        (WebCore::SetSelectionCommand::doApply):
        (WebCore::SetSelectionCommand::doUnapply):
        * editing/TypingCommand.cpp:
        (WebCore::TypingCommand::doApply):
        * editing/VisibleSelection.cpp:
        (WebCore::VisibleSelection::firstRange): Also added a check for isNoneOrOrphaned since this function can hit the same
        assertion when the selection end points are orphaned.
        (WebCore::VisibleSelection::toNormalizedRange): Fixed the bug.
        * editing/VisibleSelection.h:
        (WebCore::VisibleSelection::isNoneOrOrphaned): Renamed from isNonOrphanedCaretOrRange and negated the semantics.

2016-06-03  Ryosuke Niwa  <rniwa@webkit.org>

        Crash under VisibleSelection::firstRange()
        https://bugs.webkit.org/show_bug.cgi?id=158241

        Reviewed by Enrica Casucci.

        The crash was commonly caused by parentAnchoredEquivalent returning null when the anchored node was a shadow root.
        Fixed it by returning a shadow root in parentAnchoredEquivalent.

        Also guard against other kinds of crashes by adding a null check in VisibleSelection::firstRange() since we've seen
        a crash in the same code path outside of a shadow tree.

        This patch also fixes other Position methods to stop using nonShadowBoundaryParentNode in place of parentNode as
        that would cause a similar crash and/or a bug elsewhere.

        Test: fast/shadow-dom/selection-at-shadow-root-crash.html

        * accessibility/AXObjectCache.cpp:
        (AXObjectCache::startCharacterOffsetOfParagraph): Fixed a bug uncovered by the assertion fix in Position::Position.
        This code was sometimes creating a position inside a BR, which is wrong.
        (AXObjectCache::endCharacterOffsetOfParagraph): Ditto.
        * dom/Position.cpp:
        (WebCore::Position::Position): Fixed an assertion which was checking that this constructor wasn't being called
        with m_anchorNode set to an element editing ignores content of. ||ing it with isShadowRoot() made this assertion
        useless because it's true whenever m_anchorNode is not a shadow root.
        (WebCore::Position::containerNode): Use parentNode() instead of findParent() which calls nonShadowBoundaryParentNode
        since Position should
        (WebCore::Position::parentAnchoredEquivalent): Fixed the bug by letting this function return a shadow root.
        (WebCore::Position::previous): Use parentNode() instead of findParent().
        (WebCore::Position::next): Ditto.
        (WebCore::Position::atStartOfTree): Ditto.
        (WebCore::Position::atEndOfTree): Ditto.
        (WebCore::Position::findParent): Deleted.
        * dom/Position.h:
        * editing/VisibleSelection.cpp:
        (VisibleSelection::firstRange): Added a null check. 

2016-07-13  Brent Fulgham  <bfulgham@apple.com>

        CSSStyleSheet members should clear their owner node when destroyed
        https://bugs.webkit.org/show_bug.cgi?id=117470

        Reviewed by Chris Dumez.

        Make sure that CSSStyleSheet members are detached from their owner node when
        the owning object is destroyed.

        I audited other CSSStyleSheet uses, and found one other place where the owner node was not
        being cleared during destruction. The Inspector also uses CSSStyleSheet, but seems to
        handle the node ownership properly.

        Fix based on a Blink change (patch by <haraken@chromium.org>):
        <https://chromium.googlesource.com/chromium/blink/+/c4949bfdeb2a613701afa1410bdae70531b8f6bf>

        Also includes a follow-up fix (patch by <haraken@chromium.org>):
        <https://chromium.googlesource.com/chromium/blink/+/9c3932dc80b33429db3a5873cb266b726c8a19bf>

        No test case. Was found by the Chromium team through review of their crash traces under minor DOM GC.

        * contentextensions/ContentExtensionStyleSheet.cpp:
        (WebCore::ContentExtensions::ContentExtensionStyleSheet::~ContentExtensionStyleSheet):
        * contentextensions/ContentExtensionStyleSheet.h:
        * dom/InlineStyleSheetOwner.cpp:
        (WebCore::InlineStyleSheetOwner::~InlineStyleSheetOwner):
        (WebCore::authorStyleSheetsForElement):

2016-10-21  David Kilzer  <ddkilzer@apple.com>

        Bug 163762: IntSize::area() should used checked arithmetic
        <https://webkit.org/b/163762>

        Reviewed by Darin Adler.

        No new tests since no change in nominal behavior.

        * platform/graphics/IntSize.h:
        (WebCore::IntSize::area): Change to return a
        Checked<unsigned, T> value. Use WTF:: namespace to avoid
        including another header.

        * platform/graphics/IntRect.h:
        (WebCore::IntRect::area): Ditto.

        The remaining changes are to use the Checked<unsigned> return
        value of IntSize::area() and IntRect::area() correctly in
        context, in addition to items noted below.

        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::isTopLevelFullPagePlugin):
        Declare contentWidth and contentHeight as float values to
        prevent overflow when computing the area, and to make the
        inequality comparison in the return statement uses the same type
        for both sides.
        * html/ImageData.cpp:
        (WebCore::ImageData::ImageData):
        * html/MediaElementSession.cpp:
        (WebCore::isElementRectMostlyInMainFrame):
        * platform/graphics/ImageBackingStore.h:
        (WebCore::ImageBackingStore::setSize): Restructure logic to
        compute area only once.
        (WebCore::ImageBackingStore::clear):
        * platform/graphics/ImageFrame.h:
        (WebCore::ImageFrame::frameBytes):
        * platform/graphics/ImageSource.cpp:
        (WebCore::ImageSource::maximumSubsamplingLevel):
        * platform/graphics/ca/LayerPool.cpp:
        (WebCore::LayerPool::backingStoreBytesForSize):
        * platform/graphics/cg/ImageDecoderCG.cpp:
        (WebCore::ImageDecoder::frameBytesAtIndex):
        * platform/graphics/filters/FEGaussianBlur.cpp:
        (WebCore::FEGaussianBlur::platformApplySoftware):
        * platform/graphics/filters/FilterEffect.cpp:
        (WebCore::FilterEffect::asUnmultipliedImage):
        (WebCore::FilterEffect::asPremultipliedImage):
        (WebCore::FilterEffect::copyUnmultipliedImage):
        (WebCore::FilterEffect::copyPremultipliedImage):
        (WebCore::FilterEffect::createUnmultipliedImageResult):
        (WebCore::FilterEffect::createPremultipliedImageResult):
        * platform/graphics/win/ImageBufferDataDirect2D.cpp:
        (WebCore::ImageBufferData::getData): Update overflow check,
        rename local variable to numBytes, and compute numBytes once.
        * platform/graphics/win/ImageDecoderDirect2D.cpp:
        (WebCore::ImageDecoder::frameBytesAtIndex):
        * platform/image-decoders/ImageDecoder.cpp:
        (WebCore::ImageDecoder::frameBytesAtIndex):
        * platform/ios/LegacyTileLayerPool.mm:
        (WebCore::LegacyTileLayerPool::bytesBackingLayerWithPixelSize):
        * rendering/RenderLayerCompositor.cpp:
        (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
        * rendering/shapes/Shape.cpp:
        (WebCore::Shape::createRasterShape):

2017-01-02  Andreas Kling  <akling@apple.com>

        Drop the render tree for documents in the page cache.
        <https://webkit.org/b/121798>

        Reviewed by Antti Koivisto.

        To save memory and reduce complexity, have documents tear down their render tree
        when entering the page cache. I've wanted to do this for a long time and it seems
        like we can actually do it now.

        This patch will enable a number of clean-ups since it's no longer valid for renderers
        to exist while the document is in page cache.

        * dom/Document.cpp:
        (WebCore::Document::destroyRenderTree): Remove assertion that we're not in the page cache
        since we will now be tearing down render trees right as they enter the page cache.

        * dom/PageCache.cpp:
        (WebCore::destroyRenderTree):
        (WebCore::PageCache::addIfCacheable): Tear down the render tree right before setting
        the in-cache flag. The render tree is destroyed in bottom-up order to ensure that the
        main frame renderers die last.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore):
        * page/FrameView.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::didRestoreFromPageCache): Update the scollable area set after restoring
        a frame from the page cache. This dirties the scrolling tree, which was covered by tests.

        * page/animation/AnimationBase.cpp:
        (WebCore::AnimationBase::setNeedsStyleRecalc):
        * page/animation/AnimationController.cpp:
        (WebCore::AnimationController::cancelAnimations): Make these no-ops if called
        while the render tree is being torn down. This fixes some assertion failures
        on layout tests and avoids pointless style invalidation.

2016-01-28  Antti Koivisto  <antti@apple.com>

        Tab suspension code hits asserts
             

        Reviewed by Chris Dumez.

        Enabling tab suspension and navigating around in a few tabs hits an assert in
        ScriptExecutionContext::suspendActiveDOMObject. This is because suspend/resume reasons don't pair properly

        * dom/Document.cpp:
        (WebCore::Document::documentWillBecomeInactive):
        (WebCore::Document::suspend):
        (WebCore::Document::resume):

            Provide the reason as argument.

        * dom/Document.h:
        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore):

            No need to call resumeActiveDOMObjects/resumeScriptedAnimationControllerCallbacks explicitly as Document::resume does that.

        (WebCore::CachedFrame::CachedFrame):
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):
        * page/Page.cpp:
        (WebCore::Page::canTabSuspend):
        (WebCore::Page::setIsTabSuspended):

2017-06-13  Chris Dumez  <cdumez@apple.com>

        Event handlers should not be called in frameless documents
        https://bugs.webkit.org/show_bug.cgi?id=173233

        Reviewed by Sam Weinig.

        As per the HTML specification [1], for event handlers on elements, we should use the
        element's document to check if scripting is disabled [2]. Scripting is considered to
        be disabled if the document has no browsing context (i.e. a frame in WebKit terms).

        In JSLazyEventListener::initializeJSFunction(), instead of using the element's
        document to do the checks, we would use the script execution context. In most cases,
        a node's document and its script execution context are the same so this is not an
        issue. However, if the node's document is a document created via JS, its nodes'
        script execution context will be the document's context document (i.e the one that
        created the document, see implementation of Node::scriptExecutionContext()). In those
        cases, using the wrong document is an issue because the document's context document
        (aka script execution context) may allow scripting but we still do not want to call
        the event handler because its document is frameless.

        This impacts documents created by JS, using the following APIs:
        - DOMParser.parseFromHTML
        - new Document()
        - DOMImplementation.createDocument / createHTMLDocument
        - XHRs whose responseType is Document.

        [1] https://html.spec.whatwg.org/multipage/webappapis.html#getting-the-current-value-of-the-event-handler (step 1.1.)
        [2] https://html.spec.whatwg.org/multipage/webappapis.html#concept-n-noscript

        Tests: fast/events/event-handler-detached-document-dispatchEvent.html
               fast/events/event-handler-detached-document.html

        * bindings/js/JSLazyEventListener.cpp:
        (WebCore::JSLazyEventListener::initializeJSFunction):

2017-05-18  Antti Koivisto  <antti@apple.com>

        Design mode should not affect UA shadow trees
        https://bugs.webkit.org/show_bug.cgi?id=171854
        <rdar://problem/32071037>

        Reviewed by Zalan Bujtas.

        Test: editing/deleting/search-shadow-tree-delete.html

        * html/HTMLElement.cpp:
        (WebCore::HTMLElement::editabilityFromContentEditableAttr):

            Ignore design mode for UA shadow trees.

        * html/SearchInputType.cpp:
        (WebCore::SearchInputType::~SearchInputType):
        (WebCore::SearchInputType::createShadowSubtree):
        (WebCore::SearchInputType::resultsButtonElement):
        (WebCore::SearchInputType::cancelButtonElement):
        * html/SearchInputType.h:

            Use RefPtr.

2017-09-20  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION(r191731): SVGPatternElement can only reference another SVGPatternElement in the same SVG document
        https://bugs.webkit.org/show_bug.cgi?id=176221

        Reviewed by Tim Horton.

        According to the specs:

        https://www.w3.org/TR/SVG11/filters.html#FilterElementHrefAttribute
        https://www.w3.org/TR/SVG11/pservers.html#LinearGradientElementHrefAttribute
        https://www.w3.org/TR/SVG11/pservers.html#RadialGradientElementHrefAttribute
        https://www.w3.org/TR/SVG11/pservers.html#PatternElementHrefAttribute

        The xlink:href attribute of the SVG filter, gradient and pattern elements
        must reference another element within the current SVG of the same type.

        In r191731, the code of SVGPatternElement::collectPatternAttributes() was
        removed and replaced by RenderSVGResourcePattern::collectPatternAttributes()
        to avoid cyclic reference in the pattern element. The problem is the old
        code used to check whether the referenced element is<SVGPatternElement>
        before casting it. This code was not copied to the new function. So we
        now allow the SVGPatternElement to reference any SVG resource element.

        To fix this issue, we need to prevent SVGResources from chaining an incorrect
        type of element to the SVG filter, gradient and pattern elements.

        We also need to use the SVGResources for getting the referenced element
        when collecting the attributes for the gradient elements. SVGResources solves
        the cyclic referencing issue so there is no need to repeat the same code
        in many places. Also, from now on the SVGResources will have valid linked
        resource only. So casting the referenced element should always be valid.

        Tests: svg/custom/pattern-invalid-content-inheritance.svg

        * rendering/svg/RenderSVGResourcePattern.cpp:
        (WebCore::RenderSVGResourcePattern::collectPatternAttributes const): Asserts
        the linkedResource is of type RenderSVGResourcePattern.
        * rendering/svg/SVGResources.cpp:
        (WebCore::SVGResources::SVGResources):
        (WebCore::isChainableResource): Ensure that an SVG resource can reference
        only an SVG resource with the valid type.
        (WebCore::SVGResources::buildCachedResources):
        * rendering/svg/SVGResources.h:

2017-10-27  Ryosuke Niwa  <rniwa@webkit.org>

        Crash in addChildNodesToDeletionQueue
        https://bugs.webkit.org/show_bug.cgi?id=178974
        <rdar://problem/35234372>

        Reviewed by Brent Fulgham.

        The bug was caused by HTMLConstructionSite::insertTextNode constructing an ill-formed tree
        when fostering parent under a template element by adjusting HTMLConstructionSiteTask's parent
        without clearing nextChild. Fixed the crash by simply removing this code since executeTask
        already takes care of fostering the parent in static inline insert(HTMLConstructionSiteTask&).

        Test: fast/parser/foster-parent-under-template.html

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::HTMLConstructionSite::insertTextNode):

2017-07-07  Daniel Bates  <dabates@apple.com>

        [AppCache] Ignore fallback entries whose namespace is not prefixed with manifest path
        https://bugs.webkit.org/show_bug.cgi?id=174273
        <rdar://problem/33011682>

        Reviewed by Brent Fulgham.

        As per <https://html.spec.whatwg.org/multipage/offline.html#parsing-cache-manifests> (07/06/2017)
        we should ignore fallback entires whose fallback namespace URL is not prefixed with
        the manifest path. For now we only apply this policy when the manifest is served with
        a non-standard Content-Type to minimize web compatibility risk.

        Test: http/tests/appcache/fallback-namespace-outside-manifest-path.html

        * loader/appcache/ApplicationCacheGroup.cpp:
        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest): Pass the MIME type of the manifest.
        * loader/appcache/ManifestParser.cpp:
        (WebCore::manifestPath): Computes the manifest path from a manifest URL.
        (WebCore::parseManifest): Modified to take the MIME type of the manifest. If the MIME type is
        non-standard (i.e. not text/cached-manifest) then skip fallback entries whose namespace is not
        prefixed with the manifest path. Otherwise, process fallback entries as we do now. Also cleaned
        up the code a bit while I was here, including renaming a local variable to be more descriptive
        and using a const character array for the manifest signature to avoid the need to document the
        length of the manifest signature in a comment.
        * loader/appcache/ManifestParser.h:

2017-05-06  Chris Dumez  <cdumez@apple.com>

        Implement the concept of cookie-averse document
        https://bugs.webkit.org/show_bug.cgi?id=171746
        <rdar://problem/32004466>

        Reviewed by Sam Weinig.

        Implement the concept of cookie-averse document:
        - https://html.spec.whatwg.org/#cookie-averse-document-object

        Test: fast/cookies/cookie-averse-document.html

        * dom/Document.cpp:
        (WebCore::Document::isCookieAverse):
        (WebCore::Document::cookie):
        (WebCore::Document::setCookie):
        * dom/Document.h:

2016-03-31  Daniel Bates  <dabates@apple.com>

        REGRESSION (r195605): ASSERTION FAILED: !NoEventDispatchAssertion::isEventDispatchForbidden()
        when pressing the back button on a page with a focused subframe
        https://bugs.webkit.org/show_bug.cgi?id=156033
        <rdar://problem/25446561>

        Reviewed by Chris Dumez.

        Fixes an assertion failure when navigating back, by pressing the browser back button, to
        the previous page from a page with a focused subframe.

        Following r195605 (https://bugs.webkit.org/show_bug.cgi?id=153449), the responsibility for
        dispatching a DOM pagehide event moved from CachedFrame to PageCache and we now instantiate
        a NoEventDispatchAssertion object to enforce the invariant that no additional DOM events are
        dispatched as part of adding a page to the page cache. When adding a page with a focused
        subframe to the page cache we focus its main frame, which implicitly defocuses the subframe
        and dispatches a DOM blur event at it. Therefore an assertion failure occurs when dispatching
        this DOM blur event (because a NoEventDispatchAssertion object was allocated on the stack).

        Test: fast/history/back-from-page-with-focused-iframe.html

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame): Move logic to focus the main frame from here...
        * history/PageCache.cpp:
        (WebCore::PageCache::addIfCacheable): to here such that any DOM blur and focus events
        are dispatched before instantiate the NoEventDispatchAssertion object and enter the page
        cache.

2015-07-17  Myles C. Maxfield  <mmaxfield@apple.com>

        style.fontFamily accessor crashes on unstyled node created from DOMParser().parseFromString()
        https://bugs.webkit.org/show_bug.cgi?id=147026
        <rdar://problem/21864487>

        Reviewed by Andreas Kling.

        Font CSS properties are a little special because they are used as indices into caches.
        Normally, StyleResolver gives all nodes a default font family, so our cache works correctly.
        However, if the document doesn't have a Settings object, StyleResolver wasn't doing this.
        Documents created from DOMParser().parseFromString() don't have a Settings object.

        Test: fast/text/crash-font-family-parsed.html

        * css/StyleResolver.cpp:
        (WebCore::StyleResolver::defaultStyleForElement):
        (WebCore::StyleResolver::initializeFontStyle): Set a font family even if we don't have a
        Settings object.

2015-10-08  Jiewen Tan  <jiewen_tan@apple.com>

        Gracefully handle XMLDocumentParser being detached by mutation events.
        https://bugs.webkit.org/show_bug.cgi?id=149485
        <rdar://problem/22811489>

        This is a merge of Blink change 200026,
        https://codereview.chromium.org/1267283002

        Reviewed by Darin Adler.

        Test: fast/parser/xhtml-dom-character-data-modified-crash.html

        * xml/parser/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::createLeafTextNode):
        Renamed from enterText() to make it more descriptive. 

        (WebCore::XMLDocumentParser::updateLeafTextNode):
        Renamed from exitText to firm up this stage.

        (WebCore::XMLDocumentParser::end):
        Gracefully handle stopped states.

        (WebCore::XMLDocumentParser::enterText): Deleted.
        (WebCore::XMLDocumentParser::exitText): Deleted.

        * xml/parser/XMLDocumentParser.h:
        Rename enterText to createLeafTextNode.
        Rename exitText to updateLeafTextNode.

        * xml/parser/XMLDocumentParserLibxml2.cpp:
        (WebCore::XMLDocumentParser::startElementNs):
        (WebCore::XMLDocumentParser::endElementNs):
        (WebCore::XMLDocumentParser::characters):
        (WebCore::XMLDocumentParser::processingInstruction):
        (WebCore::XMLDocumentParser::cdataBlock):
        (WebCore::XMLDocumentParser::comment):
        (WebCore::XMLDocumentParser::endDocument):
        Rename function calls and firm up updateLeafTextNode stage accordingly.

2015-11-02  Jiewen Tan  <jiewen_tan@apple.com>

        Null dereference loading Blink layout test fast/css/background-repeat-null-y-crash.html
        https://bugs.webkit.org/show_bug.cgi?id=150211
        <rdar://problem/23137321>

        Reviewed by Alex Christensen.

        This is a merge of Blink r188842:
        https://codereview.chromium.org/846933002

        By setting the backgroundRepeatY property to null it can
        happen that accessing that CSS value returns a null pointer.
        In that case simply bail out early.

        Test: fast/css/background-repeat-null-y-crash.html

        * css/StyleProperties.cpp:
        (WebCore::StyleProperties::getLayeredShorthandValue):

2016-02-08  Said Abou-Hallawa  <sabouhallawa@apple.com>

        REGRESSION(r181345): SVG polyline and polygon leak page
        https://bugs.webkit.org/show_bug.cgi?id=152759

        Reviewed by Darin Adler.

        The leak happens because of cyclic reference between SVGListPropertyTearOff 
        and SVGAnimatedListPropertyTearOff which is derived from SVGAnimatedProperty.
        There is also cyclic reference between SVGAnimatedProperty and SVGElement
        and this causes the whole document to be leaked. So if the JS requests, for
        example, an instance of SVGPolylineElement.points, the whole document will be
        leaked.

        The fix depends on having the cyclic reference as is since the owning and the
        owned classes have to live together if any of them is referenced. But the owning
        class caches a raw 'ref-counted' pointer of the owned class. If it is requested
        for an instance of the owned class it returned a RefPtr<> of it. Once the owned
        class is not used, it can delete itself. The only thing needed here is to notify
        the owner class of the deletion so it cleans its caches and be able to create a
        new pointer if it is requested for an instance of the owned class later.

        Revert the change of r181345 in SVGAnimatedProperty::lookupOrCreateWrapper()
        to break the cyclic reference between SVGElement and SVGAnimatedProperty.
        
        Also apply the same approach in SVGAnimatedListPropertyTearOff::baseVal() and
        animVal() to break cyclic reference between SVGListPropertyTearOff and
        SVGAnimatedListPropertyTearOff.

        Test: svg/animations/smil-leak-list-property-instances.svg

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue): The SVG non-string list tear-off properties became of
        type RefPtr<>. So we need to use get() with the casting expressions.
        
        * svg/SVGMarkerElement.cpp:
        (WebCore::SVGMarkerElement::orientType):
        Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().

        * svg/SVGPathElement.cpp:
        (WebCore::SVGPathElement::pathByteStream):
        (WebCore::SVGPathElement::lookupOrCreateDWrapper):
        Since SVGAnimatedProperty::lookupWrappe() returns a RefPtr<> we need to 
        use get() for the casting expressions.
        
        (WebCore::SVGPathElement::pathSegList):
        (WebCore::SVGPathElement::normalizedPathSegList):
        (WebCore::SVGPathElement::animatedPathSegList):
        (WebCore::SVGPathElement::animatedNormalizedPathSegList):
        * svg/SVGPathElement.h:
        Change the return value from raw pointer to RefPtr<>.

        * svg/SVGPathSegWithContext.h:
        (WebCore::SVGPathSegWithContext::animatedProperty):
        Change the return type to be RefPtr<> to preserve the value from being deleted.
        
        * svg/SVGPolyElement.cpp:
        (WebCore::SVGPolyElement::parseAttribute):
        Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to 
        use get() for the casting expressions.
        
        (WebCore::SVGPolyElement::points):
        (WebCore::SVGPolyElement::animatedPoints):
        * svg/SVGPolyElement.h:
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/SVGViewSpec.cpp:
        (WebCore::SVGViewSpec::setTransformString):
        Since SVGAnimatedProperty::lookupWrapper() returns a RefPtr<> we need to 
        use get() for the casting expressions.

        (WebCore::SVGViewSpec::transform):
        * svg/SVGViewSpec.h:
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/properties/SVGAnimatedListPropertyTearOff.h:
        (WebCore::SVGAnimatedListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedListPropertyTearOff::animVal):
        Change the return value from raw pointer to RefPtr<> and change the cached
        value from RefPtr<> to raw pointer. If the property is null, it will be
        created, its raw pointer will be cached and the only ref-counted RefPtr<>
        will be returned. This will guarantee, the RefPtr<> will be deleted once
        it is not used anymore. 
        
        (WebCore::SVGAnimatedListPropertyTearOff::propertyWillBeDeleted):
        Clean the raw pointer caches m_baseVal and m_animVal upon deleting the
        actual pointer. This function will be called from the destructor of
        SVGListPropertyTearOff.
        
        (WebCore::SVGAnimatedListPropertyTearOff::findItem):
        (WebCore::SVGAnimatedListPropertyTearOff::removeItemFromList):
        We have to ensure the baseVal() is created before using it.
        
        (WebCore::SVGAnimatedListPropertyTearOff::detachListWrappers):
        (WebCore::SVGAnimatedListPropertyTearOff::currentAnimatedValue):
        (WebCore::SVGAnimatedListPropertyTearOff::animationStarted):
        (WebCore::SVGAnimatedListPropertyTearOff::animationEnded):
        (WebCore::SVGAnimatedListPropertyTearOff::synchronizeWrappersIfNeeded):
        (WebCore::SVGAnimatedListPropertyTearOff::animValWillChange):
        (WebCore::SVGAnimatedListPropertyTearOff::animValDidChange):
        For animation, a separate RefPtr<> 'm_animatingAnimVal' will be assigned
        to the animVal(). This will prevent deleting m_animVal while animation.
        
        * svg/properties/SVGAnimatedPathSegListPropertyTearOff.h:
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::animVal):
        Same as what is done in SVGAnimatedListPropertyTearOff.
        
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::findItem):
        (WebCore::SVGAnimatedPathSegListPropertyTearOff::removeItemFromList):
        Same as what is done in SVGAnimatedListPropertyTearOff.
        
        * svg/properties/SVGAnimatedProperty.h:
        (WebCore::SVGAnimatedProperty::lookupOrCreateWrapper):
        Change the return value from raw reference to Ref<> and change the
        cached value from Ref<> to raw pointer. This reverts the change of
        r181345 in this function.
        
        (WebCore::SVGAnimatedProperty::lookupWrapper):
        Change the return value from raw pointer to RefPtr<>.
        
        * svg/properties/SVGAnimatedPropertyMacros.h:
        Use 'auto' type for the return of SVGAnimatedProperty::lookupWrapper().
        
        * svg/properties/SVGAnimatedTransformListPropertyTearOff.h:
        (WebCore::SVGAnimatedTransformListPropertyTearOff::baseVal):
        (WebCore::SVGAnimatedTransformListPropertyTearOff::animVal):
        Same as what is done in SVGAnimatedListPropertyTearOff.

        * svg/properties/SVGListPropertyTearOff.h:
        (WebCore::SVGListPropertyTearOff::~SVGListPropertyTearOff):
        Call the SVGAnimatedListPropertyTearOff::propertyWillBeDeleted() to clean
        its raw pointers when the RefPtr<> deletes itself.

2016-04-14  Dean Jackson  <dino@apple.com>

        CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::CachedResource::addClientToSet + 27
        https://bugs.webkit.org/show_bug.cgi?id=156602
        <rdar://problem/18921091>

        Reviewed by Simon Fraser.

        The CSS property list-style-image is inherited, so a transition on a parent
        might cause a transition on a child. On that child, the value might be between
        two generated crossfade images which haven't yet resolved, causing a crash.

        Test: transitions/crossfade-transition.html

        * css/CSSCrossfadeValue.cpp:
        (WebCore::CSSCrossfadeValue::blend): Return null if there are no cached images.
        * page/animation/CSSPropertyAnimation.cpp:
        (WebCore::blendFunc): If we don't have an actual image to blend between, fall
        out to the default case.


2015-09-18  Dean Jackson  <dino@apple.com>

        Null dereference loading Blink layout test svg/filters/feImage-failed-load-crash.html
        https://bugs.webkit.org/show_bug.cgi?id=149316
        <rdar://problem/22749532>

        Reviewed by Tim Horton.

        If an feImage triggered loading a resource, and then was removed from the document,
        we'd still try to notify its parent when the resource arrived (or failed).

        Merge Blink commit:
        https://chromium.googlesource.com/chromium/blink/+/9cbcfd7866bbaff0c4b3c4c8508b7c97b46d6e6a

        Test: svg/filters/feImage-failed-load-crash.html

        * svg/SVGFEImageElement.cpp:
        (WebCore::SVGFEImageElement::notifyFinished): Add a null check to the parent element
        before sending the notification.

2015-10-21  Dean Jackson  <dino@apple.com>

        Null dereference loading Blink layout test svg/filters/display-none-filter-primitive.html
        https://bugs.webkit.org/show_bug.cgi?id=150212
        <rdar://problem/23137376>

        Reviewed by Brent Fulgham.

        * svg/filters/display-none-filter-primitive-expected.txt: Added.
        * svg/filters/display-none-filter-primitive.html: Added.

2016-01-21  Said Abou-Hallawa  <sabouhallawa@apple.com>

        A crash reproducible in Path::isEmpty() under RenderSVGShape::paint()
        https://bugs.webkit.org/show_bug.cgi?id=149613

        Reviewed by Darin Adler.

        When RenderSVGRoot::layout() realizes its layout size has changed and
        it has resources which have relative sizes, it marks all the clients of
        the resources for invalidates regardless whether they belong to the
        same RenderSVGRoot or not. But it reruns the layout only for its children.
        If one of these clients comes before the current RenderSVGRoot in the render
        tree, ee end up having renderer marked for invalidation at rendering time.
        This also prevents scheduling the layout if the same renderer is marked
        for another invalidation later. We prevent this because we do not want
        to schedule another layout for a renderer which is already marked for
        invalidation. This can cause crash if the renderer is an RenderSVGPath.
        
        The fix is to mark "only" the clients of a resource which belong to the
        same RenderSVGRoot of the resource. Also we need to run the layout for
        all the resources which belong to different RenderSVGRoots before running
        the layout for an SVG renderer.
         
        Tests: svg/custom/filter-update-different-root.html
               svg/custom/pattern-update-different-root.html

        * rendering/svg/RenderSVGResourceContainer.cpp:
        (WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation):
        We should not mark any client outside the current root for invalidation
        
        * rendering/svg/RenderSVGResourceContainer.h: Remove unneeded private keyword.
        
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::addResourceForClientInvalidation):
        Code clean up; use findTreeRootObject() instead of repeating the same code.
        
        * rendering/svg/RenderSVGShape.cpp:
        (WebCore::RenderSVGShape::isEmpty): Avoid crashing if RenderSVGShape::isEmpty()
        is called before calling RenderSVGShape::layout().
         
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::layout): findTreeRootObject() now returns a pointer.
        
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::findTreeRootObject): I do think nothing 
        guarantees that an SVG renderer has to have an RenderSVGRoot in its
        ancestors. So change this function to return a pointer. Also Provide
        the non-const version of this function.
         
        (WebCore::SVGRenderSupport::layoutDifferentRootIfNeeded): Runs the layout
        if needed for all the resources which belong to different RenderSVGRoots.
        
        (WebCore::SVGRenderSupport::layoutChildren): Make sure all the renderer's
        resources which belong to different RenderSVGRoots are laid out before
        running the layout for this renderer.
        
        * rendering/svg/SVGRenderSupport.h: Remove a mysterious comment.
        
        * rendering/svg/SVGResources.cpp:
        (WebCore::SVGResources::layoutDifferentRootIfNeeded): Run the layout for
        all the resources which belong to different RenderSVGRoots outside the
        context of their RenderSVGRoots.
        
        * rendering/svg/SVGResources.h:
        (WebCore::SVGResources::clipper):
        (WebCore::SVGResources::markerStart):
        (WebCore::SVGResources::markerMid):
        (WebCore::SVGResources::markerEnd):
        (WebCore::SVGResources::masker):
        (WebCore::SVGResources::filter):
        (WebCore::SVGResources::fill):
        (WebCore::SVGResources::stroke):
        Code clean up; use nullptr instead of 0.

2015-09-18  Dean Jackson  <dino@apple.com>

        Null dereference loading Blink layout test svg/custom/use-href-attr-removal-crash.html
        https://bugs.webkit.org/show_bug.cgi?id=149315
        <rdar://problem/22749358>

        Reviewed by Tim Horton.

        We were not checking if the corresponding element referenced from
        the SVG <use> actually existed before trying to set attributes on it.
        The original Blink change is a little more detailed:
        https://chromium.googlesource.com/chromium/blink/+/e2f1087f32bb088160ab7d59a715a1403ef267c7
        However, we've significantly diverged at this point.

        Tests: svg/custom/use-href-attr-removal-crash.html
               svg/custom/use-href-attr-removal-crash2.svg
               svg/custom/use-href-change-local-to-invalid-remote.html

        * svg/SVGUseElement.cpp:
        (WebCore::SVGUseElement::transferSizeAttributesToTargetClone):

2017-09-19  Zalan Bujtas  <zalan@apple.com>

        Attempt to fix Linux build.

        * rendering/RenderText.cpp:

2017-09-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222226. rdar://problem/34534758

    2017-09-19  Zalan Bujtas  <zalan@apple.com>

            AXObjectCache::performDeferredCacheUpdate is called recursively through FrameView::layout.
            https://bugs.webkit.org/show_bug.cgi?id=176218
            <rdar://problem/34205612>

            Reviewed by Simon Fraser.

            There are certain cases when we might re-enter performDeferredCacheUpdate through recursive
            layout calls (see webkit.org/b/177176) and mutate m_deferredTextChangedList multiple times.

            Test: accessibility/crash-table-recursive-layout.html

            * accessibility/AXObjectCache.cpp:
            (WebCore::AXObjectCache::performDeferredCacheUpdate):
            * accessibility/AXObjectCache.h:

2017-09-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222220. rdar://problem/34534766

    2017-09-15  Wenson Hsieh  <wenson_hsieh@apple.com>

            createMarkupInternal should protect its pointer to the Range's common ancestor
            https://bugs.webkit.org/show_bug.cgi?id=177033
            <rdar://problem/34265390>

            Reviewed by Tim Horton.

            Adds basic safeguarding to codepaths hit while executing an outdent command.

            Test: editing/execCommand/outdent-with-media-query-listener-in-iframe.html

            * editing/IndentOutdentCommand.cpp:
            (WebCore::IndentOutdentCommand::outdentRegion):

            Avoid an infinite loop if endOfCurrentParagraph is a null position.

            * editing/markup.cpp:
            (WebCore::createMarkupInternal):

            Protect the raw pointer to the Range's common ancestor node.

2017-09-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222214. rdar://problem/34534751

    2017-09-19  Zalan Bujtas  <zalan@apple.com>

            Do not mutate RenderText content during layout.
            https://bugs.webkit.org/show_bug.cgi?id=176219
            <rdar://problem/34205724>

            Reviewed by David Hyatt.

            Update combined text when the style/content change as opposed to lazily, during layout.
            -content mutation during layout might make the inline tree go out of sync.

            Test: fast/text/international/dynamic-text-combine-crash.html

            * rendering/RenderBlockFlow.cpp:
            (WebCore::RenderBlockFlow::computeInlinePreferredLogicalWidths const):
            * rendering/RenderCombineText.cpp:
            (WebCore::RenderCombineText::styleDidChange):
            (WebCore::RenderCombineText::setRenderedText):
            (WebCore::RenderCombineText::combineTextIfNeeded):
            (WebCore::RenderCombineText::combineText): Deleted.
            * rendering/RenderCombineText.h:
            * rendering/RenderText.h:
            * rendering/line/BreakingContext.h:
            (WebCore::BreakingContext::handleText):
            * rendering/line/LineBreaker.cpp:
            (WebCore::LineBreaker::skipLeadingWhitespace):

2017-09-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r221978. rdar://problem/34508522

    2017-09-13  Daniel Bates  <dabates@apple.com>

            Make history.pushState()/replaceState() more closely aligned to the HTML standard
            https://bugs.webkit.org/show_bug.cgi?id=176730
            <rdar://problem/33839265>

            Reviewed by Alex Christensen.

            Update history.pushState()/replaceState() to more closely align with the algorithm
            specified in <https://html.spec.whatwg.org/multipage/history.html#dom-history-pushstate-2> (9 September 2017).

            Test: http/tests/security/history-pushState-replaceState-from-sandboxed-iframe.html

            * page/History.cpp:
            (WebCore::History::stateObjectAdded):
            * page/SecurityOrigin.cpp:
            (WebCore::SecurityOrigin::extractInnerURL): Use URL constructor that takes a base URL as opposed
            to using the special ParsedURLString-variant because the latter can only be used to parse a string
            returned from URL::string(). And the extracted inner URL does not meet this criterion. Using the
            ParsedURLString-variant of the URL constructor with a string that is not the result of URL::string()
            will cause an assertion failure in a debug build.

2017-09-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222167. rdar://problem/34508525

    2017-09-18  Antti Koivisto  <antti@apple.com>

            Avoid style resolution when clearing focused element.
            https://bugs.webkit.org/show_bug.cgi?id=176224
            <rdar://problem/34206409>

            Reviewed by Zalan Bujtas.

            Test: fast/dom/focus-style-resolution.html

            * dom/Document.cpp:
            (WebCore::Document::setFocusedElement):

                Don't do synchronous style resolution with FocusRemovalEventsMode::DoNotDispatch.
                Style resolution may dispatch events.

            * html/HTMLInputElement.cpp:
            (WebCore::HTMLInputElement::didBlur):

                Move resolveStyleIfNeeded call to setFocusedElement. It is the only client for didBlur.

2016-10-18  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION (r201471): Keyboard remains visible when swiping back on twitter.com
        https://bugs.webkit.org/show_bug.cgi?id=163581
        <rdar://problem/27739558>

        Reviewed by Simon Fraser.

        The bug was caused by Chrome::elementDidBlur not getting called, which resulted in
        StopAssistingNode not getting sent to the UI process.

        Test: fast/forms/ios/hide-keyboard-on-node-removal.html

        * dom/Document.cpp:
        (WebCore::Document::setFocusedElement): Restore the behavior prior to r201471 by calling
        Chrome::elementDidBlur explicitly.
        * html/HTMLTextFormControlElement.cpp:
        (WebCore::HTMLTextFormControlElement::dispatchBlurEvent): Added a comment about ordering.

2016-06-28  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r201471): FormClient.textFieldDidEndEditing is no longer called when a text field is removed
        https://bugs.webkit.org/show_bug.cgi?id=159199
        <rdar://problem/26748189>

        Reviewed by Alexey Proskuryakov.

        The bug was caused by HTMLInputElement's endEditing no longer getting called due to the behavior change.
        Preserve the WebKit2 API semantics by manually calling HTMLInputElement::endEditing in setFocusedElement.

        Tests: WebKit2TextFieldDidBeginAndEndEditing

        * dom/Document.cpp:
        (WebCore::Document::setFocusedElement):

2016-05-26  Ryosuke Niwa  <rniwa@webkit.org>

        Crash in TreeScope::focusedElement
        https://bugs.webkit.org/show_bug.cgi?id=158108

        Reviewed by Enrica Casucci.

        The bug was caused by a flawed sequence of steps we took to remove an element. When an element is removed,
        willRemoveChild and willRemoveChildren fire blur events on removed focused element and its ancestors and
        unload event on any removed iframes. However, it was possible to focus an element on which we had fired blur
        during an unload event, leaving m_focusedElement point to an element that's not in the document anymore.

        Changing the order doesn't help because that would make it possible to insert the removed iframes back into
        the document inside a event listener of the blur event, which was specifically fixed by r127534 four years ago.

        Instead, fix the bug by not firing blur and change events on removed nodes. New behavior matches Firefox and HTML5
        specification: https://html.spec.whatwg.org/multipage/interaction.html#focus-fixup-rule-one

        Test: fast/shadow-dom/shadow-root-active-element-crash.html

        * dom/ContainerNode.cpp:
        (WebCore::willRemoveChild): Made this function static local since it didn't need to have access to any private
        member variables. Call Document::nodeWillBeRemoved after disconnecting iframes since unload event handler could
        allocate new Ranges just like mutation events.
        (WebCore::willRemoveChildren): Ditto.
        (WebCore::ContainerNode::removeChild): Removed the calls to removeFullScreenElementOfSubtree and
        removeFocusedNodeOfSubtree as they're now called in Document::nodeWillBeRemoved.
        (WebCore::ContainerNode::removeChildren): Ditto.
        * dom/ContainerNode.h:
        * dom/Document.cpp:
        (WebCore::Document::removeFocusedNodeOfSubtree): Don't dispatch blur and change events when a node is removed.
        (WebCore::Document::setFocusedElement): Added FocusRemovalEventsMode as the third argument. Avoid dispatching blur
        and change events when FocusRemovalEventsMode::Dispatch is set.
        (WebCore::Document::nodeChildrenWillBeRemoved): Added calls to removeFullScreenElementOfSubtree and
        removeFocusedNodeOfSubtree. Also assert that no events are fired within this function. If we ever fire an event here,
        "unloaded" iframes can be inserted back into a document before ContainerNode::removeChild actually removes them.
        (WebCore::Document::nodeWillBeRemoved): Ditto.
        * dom/Document.h:
        * dom/TreeScope.cpp:
        (WebCore::TreeScope::focusedElement): Added a release assertion to make sure the focused element is in the document
        of the tree scope, and added an explicit type check just in case.

2017-09-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222163. rdar://problem/34508516

    2017-09-18  Per Arne Vollan  <pvollan@apple.com>

            [WK1] Layout Test fast/events/beforeunload-dom-manipulation-crash.html is crashing.
            https://bugs.webkit.org/show_bug.cgi?id=177071

            Reviewed by Brent Fulgham.

            The Page pointer in the history controller's frame is null. Add a null pointer check before
            accessing the page.

            No new tests, covered by exiting tests.

            * loader/HistoryController.cpp:
            (WebCore::HistoryController::updateForStandardLoad):
            (WebCore::HistoryController::updateForRedirectWithLockedBackForwardList):
            (WebCore::HistoryController::updateForClientRedirect):

2017-09-19  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222114. rdar://problem/34508510

    2017-09-15  Wenson Hsieh  <wenson_hsieh@apple.com>

            Avoid style recomputation when forwarding a focus event to an text field's input type
            https://bugs.webkit.org/show_bug.cgi?id=176160
            <rdar://problem/34184820>

            Reviewed by Ryosuke Niwa.

            Currently, TextFieldInputType::forwardEvent synchronously triggers style recomputation, for the purpose of
            scrolling to the origin upon handling a blur event, and also for updating caps lock state after a blur or focus.
            In synchronously triggering style recomputation, we may end up running arbitrary JavaScript, which may change
            the HTMLInputElement's type and cause the current TextFieldInputType to be destroyed.

            To mitigate this, we only update caps lock state when forwarding a focus or blur event to the InputType, and
            instead scroll blurred text fields to the origin later, in HTMLInputElement::didBlur (invoked from
            Document::setFocusedElement after blur and focusout events have fired). Instead of having the InputType update
            style, lift the call to Document::updateStyleIfNeeded up into HTMLInputElement so that we gracefully handle the
            case where the page destroys and sets a new InputType within the scope of this style update.

            Test: fast/forms/change-input-type-in-focus-handler.html

            * dom/Document.cpp:
            (WebCore::Document::setFocusedElement):
            * html/HTMLInputElement.cpp:
            (WebCore::HTMLInputElement::didBlur):
            * html/HTMLInputElement.h:
            * html/InputType.h:
            (WebCore::InputType::elementDidBlur):
            * html/TextFieldInputType.cpp:
            (WebCore::TextFieldInputType::forwardEvent):
            (WebCore::TextFieldInputType::elementDidBlur):
            * html/TextFieldInputType.h:

2017-09-13  Carlos Alberto Lopez Perez  <clopez@igalia.com>

        [GTK] Fails to build because 'Float32Array' has not been declared in AudioContext.h
        https://bugs.webkit.org/show_bug.cgi?id=176870

        Reviewed by Konstantin Tokarev.

        Add missing include of Float32Array.h

        No new tests, its a build fix.

        * Modules/webaudio/AudioContext.h:

2017-08-25  Miguel Gomez  <magomez@igalia.com>

        [GTK] Completely garbled display in Transifex in accelerated compositing mode
        https://bugs.webkit.org/show_bug.cgi?id=174632

        Reviewed by Michael Catanzaro.

        Remove the copy constructor from PlatformContextCairo::State. This is because it will be used by WTF::Vector
        to copy the instances around when allocating new memory, but it doesn't copy the m_imageMaskInformation
        attribute, so it will be lost when the Vector reallocates its contents. When this happens, renderings that use
        GraphicsContext::clipToImageBuffer() fail to render properly.

        Covered by existent tests.

        * platform/graphics/cairo/PlatformContextCairo.cpp:
        (WebCore::PlatformContextCairo::State::State):
        (WebCore::PlatformContextCairo::save):

2017-08-22  Zan Dobersek  <zdobersek@igalia.com>

        GLContext: zero-initialize the GLContext pointer in ThreadGlobalGLContext
        https://bugs.webkit.org/show_bug.cgi?id=175819

        Reviewed by Xabier Rodriguez-Calvar.

        * platform/graphics/GLContext.cpp: The ThreadGlobalGLContext object is
        allocated on heap, so the embedded GLContext pointer can contain a
        non-null value that can cause problems when e.g. checking for a current
        GLContext on some specific thread on which a GLContext hasn't yet been
        made current. Zero-initializing this pointer will avoid false positives
        that can occur in these circumstances.

2017-09-14  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222008. rdar://problem/34426473

    2017-09-13  Zalan Bujtas  <zalan@apple.com>

            Switch multicolumn's spanner map from raw over to weak pointers.
            https://bugs.webkit.org/show_bug.cgi?id=176367
            <rdar://problem/34254896>

            Reviewed by Antti Koivisto.

            Test: fast/multicol/spanner-crash-when-adding-summary.html

            * rendering/RenderMultiColumnFlowThread.cpp:
            (WebCore::RenderMultiColumnFlowThread::evacuateAndDestroy):
            (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):
            (WebCore::RenderMultiColumnFlowThread::handleSpannerRemoval):
            * rendering/RenderMultiColumnFlowThread.h:
            * rendering/RenderMultiColumnSet.cpp:
            (WebCore::RenderMultiColumnSet::firstRendererInFlowThread const):
            (WebCore::RenderMultiColumnSet::lastRendererInFlowThread const):
            * rendering/RenderMultiColumnSpannerPlaceholder.cpp:
            (WebCore::RenderMultiColumnSpannerPlaceholder::RenderMultiColumnSpannerPlaceholder):
            * rendering/RenderMultiColumnSpannerPlaceholder.h:

2017-09-14  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r222005. rdar://problem/34426487

    2017-09-13  Wenson Hsieh  <wenson_hsieh@apple.com>

            Submitting a form can cause HTMLFormElement's associated elements vector to be mutated during iteration
            https://bugs.webkit.org/show_bug.cgi?id=176368
            <rdar://problem/34254998>

            Reviewed by Ryosuke Niwa.

            In the process of iterating over form.associatedElements() during form submission in FormSubmission::create, the
            page may cause us to clobber the vector of FormAssociatedElements* we're currently iterating over by inserting
            new form controls beneath the form element we're in the process of submitting. This happens because
            FormSubmission::create calls HTMLTextAreaElement::appendFormData, which requires layout to be up to date, which
            in turn makes us updateLayout() and set focus, which fires a `change` event, upon which the page's JavaScript
            inserts additonal DOM nodes into the form, modifying the vector of associated elements.

            To mitigate this, instead of iterating over HTMLFormElement::associatedElements(), which returns a reference to
            the HTMLFormElement's actual m_associatedElements vector, we iterate over a new vector of
            Ref<FormAssociatedElement>s created from m_associatedElements.

            This patch also removes an event dispatch assertion added in r212026. This assertion was added to catch any
            other events dispatched in this scope, since dispatching events there would have had security implications, but
            after making iteration over associated elements robust, this NoEventDispatchAssertion is no longer useful.

            Test: fast/forms/append-children-during-form-submission.html

            * loader/FormSubmission.cpp:
            (WebCore::FormSubmission::create):

2017-09-10  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r221014. rdar://problem/34169683

    2017-08-21  Matt Rajca  <mrajca@apple.com>

            Call updateIsPlayingMedia whenever m_userHasInteractedWithMediaElement changes
            https://bugs.webkit.org/show_bug.cgi?id=175796

            Reviewed by Eric Carlson.

            Test: media/video-user-gesture-tracking.html

            The page media state depends on m_userHasInteractedWithMediaElement, so force it to update
            as soon as m_userHasInteractedWithMediaElement changes. This fixes an issue where the media
            state would not reflect the user interaction flag until a call to updateIsPlayingMedia was made.

            * dom/Document.cpp:
            (WebCore::Document::noteUserInteractionWithMediaElement):
            * dom/Document.h:
            (WebCore::Document::noteUserInteractionWithMediaElement): Deleted.
            * testing/Internals.cpp:
            (WebCore::Internals::pageMediaState):

2017-08-02  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r220085. rdar://problem/33687398

    2017-07-31  Matt Rajca  <mrajca@apple.com>

            Support quirk for letting media autoplay if the user interacted with at least one media element.
            https://bugs.webkit.org/show_bug.cgi?id=175005
            <rdar://problem/33476038>

            Reviewed by Eric Carlson.

            If the user has interacted with at least one media element, let other media elements auto-play
            as a quirk.

            * dom/Document.cpp:
            (WebCore::Document::updateIsPlayingMedia):
            * dom/Document.h:
            (WebCore::Document::noteUserInteractionWithMediaElement):
            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture):
            * html/MediaElementSession.cpp:
            (WebCore::needsDocumentLevelMediaUserGestureQuirk):
            (WebCore::MediaElementSession::playbackPermitted const):
            * page/MediaProducer.h:

2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211965. rdar://problem/30149422

    2017-02-09  Ryosuke Niwa  <rniwa@webkit.org>

            Adopting a child node of a script element can run script
            https://bugs.webkit.org/show_bug.cgi?id=167318

            Reviewed by Darin Adler.

            The bug was caused by ScriptElement::childrenChanged indiscriminately running the script.
            Do this only if some node has been inserted as spec'ed:

            https://html.spec.whatwg.org/multipage/scripting.html#script-processing-model
            "The script element is connected and a node or document fragment is inserted into
            the script element, after any script elements inserted at that time."

            Split NonContentsChildChanged into NonContentsChildInserted and NonContentsChildRemoved to disambiguate
            non-contents child such as text and element being removed or inserted. New behavior matches that of
            Gecko and Chrome as well as the latest HTML5 specification.

            Also deploy NoEventDispatchAssertion in more places. Unfortunately, this results in some DOM trees
            internal to WebKit to be mutated while there is NoEventDispatchAssertion in the stack. Added a new RAII
            object "EventAllowedScope" to temporarily disable this assertion within such a tree. CachedSVGFont's
            ensureCustomFontData used to completely disable this assertion but we no longer have to do this either.

            To clarify the new semantics, renamed isEventDispatchForbidden to isEventAllowedInMainThread with
            the negated boolean value, and added a new variant isEventDispatchAllowedInSubtree, which checks
            isEventDispatchForbidden() is true or if the node was one of an internal DOM node or its descendent
            held by EventAllowedScope.

            Inspired by https://chromium.googlesource.com/chromium/src/+/604e798ec6ee30f44d57a5c4a44ce3dab3a871ed

            Tests: fast/html/script-must-not-run-when-child-is-adopted.html
                   fast/html/script-must-not-run-when-child-is-removed.html

            * dom/CharacterData.cpp:
            (WebCore::CharacterData::notifyParentAfterChange): Added NoEventDispatchAssertion.
            * dom/ContainerNode.cpp:
            (WebCore::ContainerNode::insertBefore): Added NoEventDispatchAssertion around TreeScope's adoptIfNeeded
            and insertBeforeCommon as done elsewhere.
            (WebCore::ContainerNode::appendChildCommon): Added NoEventDispatchAssertion.
            (WebCore::ContainerNode::changeForChildInsertion): Use NonContentsChildInserted here.
            (WebCore::ContainerNode::notifyChildRemoved): Added NoEventDispatchAssertion.
            (WebCore::ContainerNode::replaceChild): Moved adoptIfNeeded into NoEventDispatchAssertion.
            (WebCore::ContainerNode::removeChild): Added NoEventDispatchAssertion.
            (WebCore::ContainerNode::parserRemoveChild): Added NoEventDispatchAssertion.
            (WebCore::ContainerNode::removeChildren): Call childrenChanged in NoEventDispatchAssertion.
            (WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck): Moved adoptIfNeeded into
            NoEventDispatchAssertion.
            (WebCore::dispatchChildInsertionEvents): Check the forbidden-ness more precisely.
            (WebCore::dispatchChildRemovalEvents): Ditto.
            * dom/ContainerNode.h:
            (WebCore::ContainerNode::ChildChange::isInsertion): Added.
            * dom/ContainerNodeAlgorithms.cpp:
            (WebCore::notifyChildNodeInserted): Check the forbidden-ness more precisely. Here, we check against
            insertionPoint since EventAllowedScope checks against the root node.
            * dom/Document.cpp:
            (WebCore::Document::adoptNode): Assert the node to be adopted has not been inserted back, or else
            remove() had resulted in an exception before calling TreeScope::adoptIfNeeded.
            * dom/Element.cpp:
            (WebCore::Element::childrenChanged):
            * dom/NoEventDispatchAssertion.h:
            (WebCore::NoEventDispatchAssertion::isEventDispatchForbidden): Added a new variant that takes a node.
            If this node is a descendent of a node "marked as safe" by EventAllowedScope, then we don't consider
            the event dispatch to be forbidden.
            (WebCore::NoEventDispatchAssertion::dropTemporarily): Deleted.
            (WebCore::NoEventDispatchAssertion::restoreDropped): Deleted.
            (WebCore::NoEventDispatchAssertion::EventAllowedScope): Added. A RAII object which marks descendants of
            a given node as "safe" for the purpose of checking isEventDispatchForbidden.
            (WebCore::NoEventDispatchAssertion::EventAllowedScope::EventAllowedScope): Added. There can be a chain
            of EventAllowedScope objects in the stack. s_currentScope points to the most recently instantiated
            RAII object, and each instance remembers prior instance.
            (WebCore::NoEventDispatchAssertion::EventAllowedScope::~EventAllowedScope): Added.
            (WebCore::NoEventDispatchAssertion::EventAllowedScope::isAllowedNode): Added. Returns true if the given
            node is a descendent of any node held by instances of EventAllowedScope.
            (WebCore::NoEventDispatchAssertion::EventAllowedScope::isAllowedNodeInternal): Added. A helper function
            for isAllowedNode.
            * dom/Node.cpp:
            (WebCore::Node::dispatchSubtreeModifiedEvent): Check the forbidden-ness more precisely.
            * dom/ScriptElement.cpp:
            (WebCore::ScriptElement::childrenChanged): Only prepare the script if we've inserted nodes.
            (WebCore::ScriptElement::executeClassicScript): Assert isEventDispatchForbidden is false since running
            arbitrary author scripts can, indeed, result dispatch any events.
            * dom/ScriptElement.h:
            * html/HTMLElement.cpp:
            (WebCore::textToFragment): Made this a static local function and not return an exception since there
            is no way appendChild called in this function can throw an exception.
            (WebCore::HTMLElement::setInnerText): Create EventAllowedScope for the fragment. It's called called by
            HTMLTextAreaElement's childrenChanged to update its UA shadow tree, and it's dispatching as event on
            a new fragment can't execute arbitrary scripts since it has never been exposed to author scripts.
            Because of the precise-ness of this check, this does not disable the assertion for "this" element.
            HTMLTextFormControlElement::setInnerTextValue explicitly creates another EventAllowedScope to mark
            the shadow tree into which the fragment is inserted safe.
            (WebCore::HTMLElement::setOuterText):
            * html/HTMLElement.h:
            * html/HTMLScriptElement.cpp:
            (WebCore::HTMLScriptElement::childrenChanged):
            * html/HTMLTextFormControlElement.cpp:
            (WebCore::HTMLTextFormControlElement::setInnerTextValue): See above (setInnerText).
            * html/track/VTTCue.cpp:
            (WebCore::VTTCue::createCueRenderingTree): Create EventAllowedScope for the cloned fragment here since
            the VTT tree is never exposed to author scripts.
            (WebCore::VTTCue::updateDisplayTree): Ditto.
            * loader/cache/CachedSVGFont.cpp:
            (WebCore::CachedSVGFont::ensureCustomFontData): Use EventAllowedScope to disable assertions only on
            the new SVG document we just created instead of disabling for all DOM trees.
            * svg/SVGScriptElement.cpp:
            (WebCore::SVGScriptElement::childrenChanged):

2017-08-13  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r220551. rdar://problem/33843388

    2017-08-10  Nan Wang  <n_wang@apple.com>

            AX: crash at WebCore::AccessibilityObject::supportsARIALiveRegion() const + 24
            https://bugs.webkit.org/show_bug.cgi?id=175340
            <rdar://problem/33782159>

            Reviewed by Chris Fleizach.

            The issue here is that we manualy set the parent object of the AccessibilitySVGRoot object
            and there are chances that the parent doesn't detach it properly during the parent's destroying
            process. Accessing the stale parent object will lead to a crash.
            Fixed this by making the parent object a weak pointer so we don't access an invalid memory.

            Test: accessibility/add-children-pseudo-element.html

            * accessibility/AccessibilityRenderObject.cpp:
            (WebCore::AccessibilityRenderObject::AccessibilityRenderObject):
            * accessibility/AccessibilityRenderObject.h:
            (WebCore::AccessibilityRenderObject::createWeakPtr):
            * accessibility/AccessibilitySVGRoot.cpp:
            (WebCore::AccessibilitySVGRoot::AccessibilitySVGRoot):
            (WebCore::AccessibilitySVGRoot::setParent):
            (WebCore::AccessibilitySVGRoot::parentObject const):
            * accessibility/AccessibilitySVGRoot.h:

2017-08-09  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r220289. rdar://problem/33810941

    2017-08-04  Said Abou-Hallawa  <sabouhallawa@apple.com>

            RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available
            https://bugs.webkit.org/show_bug.cgi?id=174874
            <rdar://problem/33530130>

            Reviewed by Simon Fraser.

            If an <img> element has a non-CachedImage content data, e.g. -webkit-named-image,
            RenderImageResourceStyleImage will be created and  attached to the RenderImage.
            RenderImageResourceStyleImage::m_cachedImage will be set to null at the
            beginning because the m_styleImage->isCachedImage() is false in this case.
            When ImageLoader finishes loading the url of the src attribute,
            RenderImageResource::setCachedImage() will be called to set m_cachedImage.

            A crash will happen when the RenderImage is destroyed. Destroying the
            RenderImage calls RenderImageResourceStyleImage::shutdown() which checks
            m_cachedImage and finds it not null, so it calls RenderImageResourceStyleImage::image()
            which ends up calling CSSNamedImageValue::image() which returns a null pointer
            because the size is empty. RenderImageResourceStyleImage::shutdown() calls
            image()->stopAnimation() without checking the return value of image().

            Another crash will happen later when deleting the CachedImage from the memory
            cache if CachedImage::canDestroyDecodedData() is called because the client
            it gets from m_clients is a freed pointer. This happens because RenderImageResourceStyleImage
            has m_styleImage of type StyleGeneratedImage but its m_cachedImage is set
            by RenderImageResource::setCachedImage(). When RenderImageResourceStyleImage::shutdown()
            is called, it calls  StyleGeneratedImage::removeClient() which does not
            know anything about RenderImageResourceStyleImage::m_cachedImage. So we
            end up having a freed pointer in the m_clients of the CachedImage.

            Test: fast/images/image-element-image-content-data.html

            * rendering/RenderImageResourceStyleImage.cpp:
            (WebCore::RenderImageResourceStyleImage::shutdown):  Revert back the changes
            of r208511 in this function. Add a call to image()->stopAnimation() without
            checking the return of image() since it will return the nullImage() if
            the image not available. There is no need to check m_cachedImage before
            calling image() because image() does not check or access m_cachedImage.

            If m_styleImage is not a CachedStyleImage but m_cachedImage is not null,
            we need to remove m_renderer from the set of the clients of this m_cachedImage.

            (WebCore::RenderImageResourceStyleImage::image const): The base class method
            RenderImageResource::image() returns the nullImage() if the image not
            available. This is because CachedImage::imageForRenderer() returns
            the nullImage() if the image is not available; see CachedImage.h. We should
            do the same for the derived class for consistency.

2017-07-31  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r220048. rdar://problem/33619591

    2017-07-30  Said Abou-Hallawa  <sabouhallawa@apple.com>

            RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available
            https://bugs.webkit.org/show_bug.cgi?id=174874
            <rdar://problem/33530130>

            Reviewed by Darin Adler.

            If an <img> element has image content data for a none cached image, e.g.
            -webkit-named-image, RenderImageResourceStyleImage will be created and
            attached to the RenderImage. RenderImageResourceStyleImage::m_cachedImage
            will be set to null because the m_styleImage->isCachedImage() is false in
            this case. When ImageLoader finishes loading the url of the src attribute,
            RenderImageResource::setCachedImage() will be called to set m_cachedImage.

            A crash will happen when the RenderImage is destroyed. Destroying the
            RenderImage calls RenderImageResourceStyleImage::shutdown() which checks
            m_cachedImage and finds it not null, so it calls RenderImageResourceStyleImage::image()
            which ends up calling CSSNamedImageValue::image() which returns a null pointer
            because the size is empty. RenderImageResourceStyleImage::shutdown() calls
            image()->stopAnimation() without checking the return value of image().

            Like the base class virtual method RenderImageResource::image(),
            RenderImageResourceStyleImage::image() should return the nullImage() if
            the image is not available.

            Test: fast/images/image-element-image-content-data.html

            * css/CSSCrossfadeValue.cpp:
            * css/CSSFilterImageValue.cpp:
            * page/EventHandler.cpp:
            * page/PageSerializer.cpp:
            * rendering/RenderElement.cpp:
            * rendering/RenderImageResource.cpp:
            * rendering/RenderImageResourceStyleImage.cpp:
            (WebCore::RenderImageResourceStyleImage::initialize):

            (WebCore::RenderImageResourceStyleImage::shutdown): Revert back the changes
            of r208511 in this function. Add a call to image()->stopAnimation() without
            checking the return of image() since it will return the nullImage() if
            the image not available. There is no need to check m_cachedImage before
            calling image() because image() does not check or access m_cachedImage.

            (WebCore::RenderImageResourceStyleImage::image): The base class method
            RenderImageResource::image() returns the nullImage() if the image not
            available. This is because CachedImage::imageForRenderer() returns
            the nullImage() if the image is not available; see CachedImage.h. We should
            do the same for the derived class for consistency.

            * rendering/style/ContentData.cpp:
            * rendering/style/StyleCachedImage.cpp:
            * style/StylePendingResources.cpp:

2017-07-31  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r220042. rdar://problem/33619586

    2017-07-29  Nan Wang  <n_wang@apple.com>

            AX: findMatchingObjects doesn't work when the startObject is ignored
            https://bugs.webkit.org/show_bug.cgi?id=174965

            Reviewed by Chris Fleizach.

            findMatchingObjects would return a wrong element if we pass in an ignored
            start object. To fix this, we should use the closest accessible sibling as
            the start object.

            Test: accessibility/mac/search-predicate-from-ignored-element.html

            * accessibility/AccessibilityObject.cpp:
            (WebCore::appendChildrenToArray):

2017-07-26  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r219751. rdar://problem/33523861

    2017-07-21  Nan Wang  <n_wang@apple.com>

            AX: Expose form validation on iOS as hint
            https://bugs.webkit.org/show_bug.cgi?id=174722
            <rdar://problem/33459761>

            Reviewed by Chris Fleizach.

            Adding the validation message to the hint of the form control element.

            Test: accessibility/ios-simulator/form-control-validation-message.html

            * accessibility/AccessibilityObject.cpp:
            (WebCore::AccessibilityObject::isShowingValidationMessage):
            (WebCore::AccessibilityObject::validationMessage):
            * accessibility/AccessibilityObject.h:
            * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
            (-[WebAccessibilityObjectWrapper accessibilityHint]):
            (-[WebAccessibilityObjectWrapper accessibilityIsShowingValidationMessage]):
            * html/HTMLFormControlElement.cpp:
            (WebCore::HTMLFormControlElement::isShowingValidationMessage):
            * html/HTMLFormControlElement.h:


2017-07-26  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r219736. rdar://problem/33523835

    2017-07-21  Jeremy Jones  <jeremyj@apple.com>

            Noise when AudioChannel lengths don't match.
            https://bugs.webkit.org/show_bug.cgi?id=174706
            rdar://problem/33389856

            Reviewed by Eric Carlson.

            When AudioChannel lengths don't match, copyFrom() returns early leaving uninitialized data in the audio buffer.
            This change zeros out the data, so there isn't objectionable noise sent to the speaker.

            * platform/audio/AudioChannel.cpp:
            (WebCore::AudioChannel::copyFrom):

2017-07-22  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r219709. rdar://problem/33462692

    2017-07-20  David Quesada  <david_quesada@apple.com>

            Add SPI to notify WKNavigationDelegate about client redirects
            https://bugs.webkit.org/show_bug.cgi?id=174680
            rdar://problem/33184886

            Reviewed by Brady Eidson.

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::performClientRedirect):
            * loader/FrameLoader.h:
            Add a convenience method for NavigationScheduler that handles a FrameLoadRequest
            as a client redirect. Currently this means loading the request and informing the
            client about it.

            * loader/FrameLoaderClient.h:
            Add FrameLoaderClient::dispatchDidPerformClientRedirect() to inform the client when
            a client redirect occurs.

            * loader/NavigationScheduler.cpp:
            Removed ScheduledURLNavigation::fire(). This class was never instantiated directly,
            and all subclasses override fire(), so this was unused code.
            For ScheduledRedirects and ScheduledLocationChange, use FrameLoader's new method to
            load the request as a client redirect.

2017-07-22  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r219661. rdar://problem/33465132

    2017-07-19  Nan Wang  <n_wang@apple.com>

            AX: Web page reloaded when a node is labelling multiple childnodes
            https://bugs.webkit.org/show_bug.cgi?id=174655

            Reviewed by Chris Fleizach.

            When we are asking for the aria-labelledby attribute of a node and its
            sibling is also labelled by the same node, we get into an infinite loop
            in textUnderElement since we only ignore one child. Added checks for
            siblings to avoid such loop.

            Test: accessibility/mac/aria-labelledby-multiple-child-crash.html

            * accessibility/AccessibilityNodeObject.cpp:
            (WebCore::AccessibilityNodeObject::textUnderElement):

2017-07-22  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r219645. rdar://problem/33464440

    2017-07-18  Zalan Bujtas  <zalan@apple.com>

            Media controls are missing content in fullscreen when document has scroll offset.
            https://bugs.webkit.org/show_bug.cgi?id=174644
            <rdar://problem/32415323>

            Reviewed by Simon Fraser.

            If a non-user initiated scrolling (result of resize for example) is processed asynchronously, it might
            leapfrog other, programatic scrollings and trigger unintentional scroll offsets (and turn into unwanted clippings).
            This patch ensures that both resize and top content inset change are translated into programatic scrolling.

            Unable to test full screen video.

            * page/FrameView.cpp:
            (WebCore::FrameView::setFrameRect):
            (WebCore::FrameView::topContentInsetDidChange):

2017-07-22  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r219641. rdar://problem/33464325

    2017-07-18  Chris Dumez  <cdumez@apple.com>

            HysteresisActivity cannot be used in the UIProcess
            https://bugs.webkit.org/show_bug.cgi?id=174643
            <rdar://problem/33086442>

            Reviewed by Tim Horton.

            Port HysteresisActivity to RunLoop::Timer so that it can safely be used in
            the UIProcess as well.

            * platform/HysteresisActivity.h:

2017-07-17  Wenson Hsieh  <wenson_hsieh@apple.com>

        [iOS DnD] Web process uses too much memory when beginning a drag on a very large image
        https://bugs.webkit.org/show_bug.cgi?id=174585
        <rdar://problem/33302541>

        Reviewed by Tim Horton.

        Currently, attempting to drag a very large image fails, either due to us telling CoreGraphics to create an image
        buffer that is too large, or because the web process exceeds its memory limit and gets jetsamed. There are two
        places where we can optimize our memory use during the drag initialization sequence, and this patch improves
        both.

        First, on iOS, we attempt to encode and send over a WebCore::Image in the PasteboardImage when writing to the
        item providers upon starting a drag. Currently, this Image is only used in the drag and drop codepath, in
        PlatformPasteboard::writeObjectRepresentations, to grab the size of the image being written for the purpose of
        specifying estimated display size. Serializing and deserializing an Image calls into Image::nativeImage, which
        attempts to draw the contents of the image into a buffer so that it can be shipped across to the UI process.
        Instead, we can simply compute the size in the web process while we already have the Image, and simply send that
        across. For copy/paste, this doesn't result in any behavior change, since we don't use the PasteboardImage's
        image in the first place.

        Secondly, when starting a drag, we try to allocate create an image buffer the size of the WebCore::Image for the
        purpose of generating the drag preview. Instead, this patch establishes a limit on the size of this drag preview
        image, such that if the Image's size is larger, we'll scale down the drag preview image to be the maximum
        allowed size.

        Test: DataInteractionTests.CanStartDragOnEnormousImage.

        * editing/ios/EditorIOS.mm:
        (WebCore::Editor::writeImageToPasteboard):
        * platform/Pasteboard.h:
        * platform/graphics/GeometryUtilities.cpp:
        (WebCore::sizeWithAreaAndAspectRatio):

        Introduce a new helper function to compute a size with the given aspect ratio and area.

        * platform/graphics/GeometryUtilities.h:
        * platform/ios/DragImageIOS.mm:
        (WebCore::createDragImageFromImage):
        * platform/ios/PlatformPasteboardIOS.mm:
        (WebCore::PlatformPasteboard::writeObjectRepresentations):

2017-01-17  Joseph Pecoraro  <pecoraro@apple.com>

        Crash when closing tab with debugger paused
        https://bugs.webkit.org/show_bug.cgi?id=161746
        <rdar://problem/15607819>

        Reviewed by Brian Burg and Brent Fulgham.

        * page/Page.h:
        (WebCore::Page::incrementNestedRunLoopCount):
        (WebCore::Page::decrementNestedRunLoopCount):
        (WebCore::Page::insideNestedRunLoop):
        Keep track of whether or not this Page is inside of a nested run loop.
        Currently the only nested run loop we know about is EventLoop used
        by Web Inspector when debugging JavaScript.

        (WebCore::Page::whenUnnested):
        Callback that can be called when we are no longer inside of a nested
        run loop.

        (WebCore::Page::~Page):
        Ensure we are not in a known nested run loop when destructing, since
        that could be unsafe.

        * inspector/PageScriptDebugServer.cpp:
        (WebCore::PageScriptDebugServer::runEventLoopWhilePausedInternal):
        Increment and decrement as we go into or leave the nested runloop.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::inspectedPageDestroyed):
        (WebCore::InspectorController::disconnectAllFrontends):
        Rework destruction to allow disconnectAllFrontends to happen earlier
        if necessary. WebKit clients may use this to disconnect remote
        frontends when closing a Page.

2016-10-31  Joseph Pecoraro  <pecoraro@apple.com>

        Web Inspector: Provide an opportunity to clear ScriptValues associated with debugged target
        https://bugs.webkit.org/show_bug.cgi?id=164167
        <rdar://problem/29010148>

        Reviewed by Mark Lam.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::inspectedPageDestroyed):
        Page is going away, discard values.

        * inspector/WorkerInspectorController.h:
        * inspector/WorkerInspectorController.cpp:
        (WebCore::WorkerInspectorController::workerTerminating):
        Worker is going away, discard values.

2015-09-04  Brian Burg  <bburg@apple.com>

        Web Inspector: InspectorController should support multiple frontend channels
        https://bugs.webkit.org/show_bug.cgi?id=148538

        Reviewed by Joseph Pecoraro.

        No new tests, no behavior change from this patch. Teardown scenarios are
        covered by existing protocol and inspector tests running under DRT and WKTR.

        * ForwardingHeaders/inspector/InspectorFrontendRouter.h: Added.
        * WebCore.vcxproj/WebCore.vcxproj:
        * inspector/InspectorClient.h: Stop using forwarded types.
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::inspectedPageDestroyed):
        (WebCore::InspectorController::hasLocalFrontend):
        (WebCore::InspectorController::hasRemoteFrontend):
        (WebCore::InspectorController::connectFrontend):
        (WebCore::InspectorController::disconnectFrontend):
        (WebCore::InspectorController::disconnectAllFrontends): Added. Disconnects all
        frontends and signals DisconnectReason::InspectedTargetDestroyed.

        (WebCore::InspectorController::show):
        (WebCore::InspectorController::close):
        (WebCore::InspectorController::dispatchMessageFromFrontend):
        * inspector/InspectorController.h: Add default value for isAutomaticInspection.
        * inspector/InspectorDatabaseAgent.cpp:
        * inspector/InspectorIndexedDBAgent.cpp:
        * inspector/InspectorResourceAgent.cpp:
        * inspector/WorkerInspectorController.cpp: Use a router with a singleton channel
        that forwards messages over to the main page.

        (WebCore::WorkerInspectorController::WorkerInspectorController):
        (WebCore::WorkerInspectorController::connectFrontend):
        (WebCore::WorkerInspectorController::disconnectFrontend):
        (WebCore::WorkerInspectorController::dispatchMessageFromFrontend):
        * inspector/WorkerInspectorController.h:
        * page/PageDebuggable.cpp:
        (WebCore::PageDebuggable::disconnect):
        * page/PageDebuggable.h:
        * testing/Internals.cpp: Clear the frontend client before disconnecting frontend channel.
        (WebCore::Internals::openDummyInspectorFrontend):
        (WebCore::Internals::closeDummyInspectorFrontend):

2015-08-27  Brian Burg  <bburg@apple.com>

        Web Inspector: FrontendChannel should know its own connection type
        https://bugs.webkit.org/show_bug.cgi?id=148482

        Reviewed by Joseph Pecoraro.

        To prepare for multiple attached frontends, the frontend connection should
        be able to report its type rather than explicitly setting connection type
        via a getter.

        No behavior change, no new tests.

        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::hasLocalFrontend): Ask the channel what it is.
        (WebCore::InspectorController::hasRemoteFrontend): Ask the channel what it is.
        (WebCore::InspectorController::connectFrontend): Use hasRemoteFrotend().
        (WebCore::InspectorController::disconnectFrontend): Use hasRemoteFrontend().
        (WebCore::InspectorController::InspectorController): Deleted.
        * inspector/InspectorController.h: Initialize a few members here.
        (WebCore::InspectorController::hasFrontend): Deleted, it was unused.
        (WebCore::InspectorController::setHasRemoteFrontend): Deleted.
        * inspector/WorkerInspectorController.cpp:
        * page/PageDebuggable.cpp:
        (WebCore::PageDebuggable::connect):
        (WebCore::PageDebuggable::disconnect):
        * testing/Internals.cpp: Add connectionType().

2017-02-12  Ryosuke Niwa  <rniwa@webkit.org>

        parserRemoveChild should unload subframes
        https://bugs.webkit.org/show_bug.cgi?id=168151

        Reviewed by Darin Adler.

        Fix the bug that the adoption agency algorithm does not unload subframes as it disconnects nodes.

        Also moved calls to nodeWillBeRemoved inside NoEventDispatchAssertion to expand on r211965.

        Tests: fast/parser/adoption-agency-clear-focus-range.html
               fast/parser/adoption-agency-unload-iframe-1.html
               fast/parser/adoption-agency-unload-iframe-2.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::takeAllChildrenFrom): Rewritten using idioms used in removeChildren and parserAppendChild.

        Disconnect all subframes first since this can synchronously dispatch an unload event. Then update DOM ranges,
        the focused element, and other states in the document.

        Second, use the regular removeBetween, notifyChildNodeRemoved, childrenChanged sequence of calls to disconnect nodes
        instead of a single call to removeDetachedChildren to properly disconnect child nodes since those nodes may have
        already come live due to execution of synchronous scripts prior to the adoption agency algorithm has run, or in
        response to the unload event we just dispatched.

        Third, append these nodes using parserAppendChild to avoid dispatching mutation events.

        (WebCore::willRemoveChild): Removed the call to nodeWillBeRemoved. It's now called within NoEventDispatchAssertion
        in each call site of willRemoveChild and willRemoveChildren.
        (WebCore::willRemoveChildren): Ditto.
        (WebCore::ContainerNode::removeChild): Call nodeWillBeRemoved inside NoEventDispatchAssertion.
        (WebCore::ContainerNode::replaceAllChildren): Call nodeWillBeRemoved inside NoEventDispatchAssertion.
        (WebCore::ContainerNode::parserRemoveChild): Disconnect subframes and update document's states.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::executeTakeAllChildrenAndReparentTask): Add a release assert that new parent does not already have a parent. 

2016-02-14  Gavin Barraclough  <barraclough@apple.com>

        Organize, deduplicate & comment JSDOMWindowCustom getOwnPropertySlot
        https://bugs.webkit.org/show_bug.cgi?id=154224

        Reviewed by Chris Dumez.

        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):
        (WebCore::jsDOMWindowGetOwnPropertySlotNamedItemGetter):
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
            - organized property access sequence into a more logical order, removed
              duplicated code & added comments.
        (WebCore::namedItemGetter): Deleted.
            - there was no need for a custom callback here; merged functionality into
              jsDOMWindowGetOwnPropertySlotNamedItemGetter.
        (WebCore::jsDOMWindowGetOwnPropertySlotCrossOrigin): Deleted.
            - renamed to jsDOMWindowGetOwnPropertySlotRestrictedAccess
              (this now also handles frameless access).

2016-02-12  Gavin Barraclough  <barraclough@apple.com>

        Separate out !allowsAccess path in JSDOMWindowCustom getOwnPropertySlot
        https://bugs.webkit.org/show_bug.cgi?id=154156

        Reviewed by Chris Dumez.

        JSDOMWindowCustom getOwnPropertySlot currently allows cross-origin access to all
        static properties, relying on the property to perform the access check. This is
        a little insecure, since it is error prone - someone could easily add a property
        to the static table without realizing it would be automatcially exposed.

        Instead, add a hard-coded filter to restrict access. As a future implementation
        we might consider autogenerating this (the properties are already tagged in IDL,
        we might be able to track this in a flag on the static table).

        By separating out the handling of the same- and cross-origin access we can
        simplify & make the policy being enforced much clearer.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::objectToStringFunctionGetter): Deleted.
            - removed objectToStringFunctionGetter - this duplicated functionality of
              nonCachingStaticFunctionGetter.
        * bindings/js/JSDOMBinding.h:
        (WebCore::objectToStringFunctionGetter): Deleted.
            - removed objectToStringFunctionGetter - this duplicated functionality of
              nonCachingStaticFunctionGetter.
        * bindings/js/JSDOMWindowCustom.cpp:
        (WebCore::jsDOMWindowGetOwnPropertySlotDisallowAccess):
            - explicitly handle providing access to only the things we do want to allow cross-origin.
        (WebCore::JSDOMWindow::getOwnPropertySlot):
        (WebCore::JSDOMWindow::getOwnPropertySlotByIndex):
            - push all !allowsAccess handling to jsDOMWindowGetOwnPropertySlotDisallowAccess
        (WebCore::childFrameGetter): Deleted.
            - this was just a deoptimiztion - moving access into a callback saved very
              little & caused more work to be duplicated.

2017-01-06  Daniel Bates  <dabates@apple.com>

        Ensure navigation only allowed for documents not in the page cache
        https://bugs.webkit.org/show_bug.cgi?id=166773
        <rdar://problem/29762809>

        Reviewed by Brent Fulgham.

        It is wise to ensure that navigation is only allowed when initiated from a document that
        is not in- or about to be put in- the page cache. Such a navigation would surprise a
        person that had navigated away from the initiating document among other issues.

        * dom/Document.cpp:
        (WebCore::Document::canNavigate): Only allow navigation if the document is not in the
        page cache.
        * html/HTMLAnchorElement.cpp:
        (WebCore::HTMLAnchorElement::handleClick): Ditto.
        * html/HTMLLinkElement.cpp:
        (WebCore::HTMLLinkElement::handleClick): Ditto.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::urlSelected): Assert triggering event's document is not in the
        page cache.
        (WebCore::FrameLoader::submitForm): Allow submission if the document is not in the
        page cache.
        (WebCore::FrameLoader::loadFrameRequest): Assert triggering event's document is not in
        the page cache.
        * mathml/MathMLElement.cpp:
        (WebCore::MathMLElement::defaultEventHandler): Only allow navigation if the document is
        not in the page cache.
        * svg/SVGAElement.cpp:
        (WebCore::SVGAElement::defaultEventHandler): Ditto.

2016-05-17  Dave Hyatt  <hyatt@apple.com>

        Optimize layer repaint rect computation and painting.
        https://bugs.webkit.org/show_bug.cgi?id=157631

        Reviewed by Zalan Bujtas.

        This patch changes the computation of repaint rects to be for self-painting layers
        only. In addition, hasBoxDecorations() has been changed to hasVisibleBoxDecorations(),
        and it will no longer be set for transparent borders.

        For scrolling layer position updating, visually empty layers have their repaint rects
        cleared, and we don't compute repaint rects during the scroll. We would like to do this
        all the time, but computeRepaintRects can be called at times when the visually empty
        state is stale/unknown. For now we limit it to scrolling, since we know that the layer's
        visually empty state is correct.

        * rendering/InlineFlowBox.cpp:
        (WebCore::InlineFlowBox::paintBoxDecorations):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::paintObject):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::layoutRunsAndFloats):
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::updateFromStyle):
        (WebCore::RenderBox::paintBoxDecorations):
        * rendering/RenderBoxModelObject.cpp:
        (WebCore::RenderBoxModelObject::willBeDestroyed):
        (WebCore::RenderBoxModelObject::hasVisibleBoxDecorationStyle):
        (WebCore::RenderBoxModelObject::updateFromStyle):
        (WebCore::RenderBoxModelObject::hasBoxDecorationStyle): Deleted.
        * rendering/RenderBoxModelObject.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::styleWillChange):
        (WebCore::mustRepaintBackgroundOrBorder):
        * rendering/RenderImage.cpp:
        (WebCore::RenderImage::imageChanged):
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::styleDidChange):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::RenderLayer):
        (WebCore::RenderLayer::updateLayerPositions):
        (WebCore::RenderLayer::repaintRectIncludingNonCompositingDescendants):
        (WebCore::RenderLayer::computeRepaintRects):
        (WebCore::RenderLayer::clearRepaintRects):
        (WebCore::RenderLayer::updateLayerPositionsAfterScroll):
        (WebCore::RenderLayer::scrollTo):
        (WebCore::RenderLayer::calculateClipRects):
        * rendering/RenderLayer.h:
        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::updateDrawsContent):
        (WebCore::RenderLayerBacking::compositingOpacity):
        (WebCore::hasVisibleBoxDecorations):
        (WebCore::canCreateTiledImage):
        (WebCore::hasVisibleBoxDecorationsOrBackgroundImage):
        (WebCore::supportsDirectBoxDecorationsComposition):
        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
        (WebCore::RenderLayerBacking::containsPaintedContent):
        (WebCore::RenderLayerBacking::isDirectlyCompositedImage):
        (WebCore::hasBoxDecorations): Deleted.
        (WebCore::hasBoxDecorationsOrBackgroundImage): Deleted.
        * rendering/RenderLayerModelObject.cpp:
        (WebCore::RenderLayerModelObject::styleDidChange):
        * rendering/RenderNamedFlowFragment.cpp:
        (WebCore::RenderNamedFlowFragment::setObjectStyleInRegion):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::hasVisibleBoxDecorations):
        (WebCore::RenderObject::setFloating):
        (WebCore::RenderObject::setInline):
        (WebCore::RenderObject::computeBackgroundIsKnownToBeObscured):
        (WebCore::RenderObject::setSelectionStateIfNeeded):
        (WebCore::RenderObject::setHasVisibleBoxDecorations):
        (WebCore::RenderObject::invalidateBackgroundObscurationStatus):
        (WebCore::RenderObject::hasBoxDecorations): Deleted.
        (WebCore::RenderObject::setHasBoxDecorations): Deleted.
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::paint):
        * rendering/RenderTable.cpp:
        (WebCore::RenderTable::paintObject):
        (WebCore::RenderTable::paintBoxDecorations):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::styleDidChange):
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::paint):
        * rendering/style/BorderData.h:
        (WebCore::BorderData::hasBorder):
        (WebCore::BorderData::hasVisibleBorder):
        (WebCore::BorderData::hasFill):
        (WebCore::BorderData::hasBorderRadius):
        * rendering/style/RenderStyle.h:
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::layout):
        (WebCore::RenderSVGRoot::styleDidChange):

2015-10-09  Antoine Quint  <graouts@apple.com>

        Dynamic background color changes do not update until a layout is forced
        https://bugs.webkit.org/show_bug.cgi?id=131623

        Compute correct repaint rect for decorated RenderSVGRoots.

        The current implementation of clippedOverflowRectForRepaint() uses the
        generic repaint-rect calculations in SVGRenderSupport. Those in turn make
        use of repaintRectInLocalCoordinates(), which for RenderSVGRoot is the
        union of the painted children (w/ some expansion). If there're no children,
        or they do not fill the entire content box, then a repaint would not
        repaint the correct parts.
        Fix by calculating the union of the border-box and the SVG content
        when the SVG root is decorated (has background/border/etc.)

        Adapted from a Chromium patch by fs@opera.com
        https://src.chromium.org/viewvc/blink?revision=170890&view=revision

        Reviewed by Darin Adler.

        Tests: svg/repaint/add-background-property-on-root.html
               svg/repaint/add-border-property-on-root.html
               svg/repaint/add-outline-property-on-root.html
               svg/repaint/change-background-color.html
               svg/repaint/remove-background-property-on-root.html
               svg/repaint/remove-border-property-on-root.html
               svg/repaint/remove-outline-property-on-root.html

        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::layout):
        (WebCore::RenderSVGRoot::styleDidChange):
        (WebCore::RenderSVGRoot::clippedOverflowRectForRepaint):

2015-10-07  Zalan Bujtas  <zalan@apple.com>

        RenderObject::computeRectForRepaint/computeFloatRectForRepaint should return the computed rectangle.
        https://bugs.webkit.org/show_bug.cgi?id=149883

        Reviewed by Simon Fraser.

        Reduces code complexity at the calling sites.
 
        No change in functionality.

        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::clippedOverflowRectForRepaint):
        (WebCore::RenderBox::computeRectForRepaint):
        * rendering/RenderBox.h:
        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::clippedOverflowRectForRepaint):
        (WebCore::RenderInline::computeRectForRepaint):
        * rendering/RenderInline.h:
        * rendering/RenderListMarker.cpp:
        (WebCore::RenderListMarker::selectionRectForRepaint):
        * rendering/RenderObject.cpp:
        (WebCore::RenderObject::repaintRectangle):
        (WebCore::RenderObject::computeRectForRepaint):
        (WebCore::RenderObject::computeFloatRectForRepaint):
        * rendering/RenderObject.h:
        (WebCore::RenderObject::computeAbsoluteRepaintRect):
        * rendering/RenderReplaced.cpp:
        (WebCore::RenderReplaced::selectionRectForRepaint):
        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
        * rendering/RenderTableCell.cpp:
        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
        (WebCore::RenderTableCell::computeRectForRepaint):
        * rendering/RenderTableCell.h:
        * rendering/RenderText.cpp:
        (WebCore::RenderText::collectSelectionRectsForLineBoxes):
        * rendering/RenderView.cpp:
        (WebCore::RenderView::computeRectForRepaint):
        * rendering/RenderView.h:
        * rendering/svg/RenderSVGForeignObject.cpp:
        (WebCore::RenderSVGForeignObject::computeFloatRectForRepaint):
        (WebCore::RenderSVGForeignObject::computeRectForRepaint):
        * rendering/svg/RenderSVGForeignObject.h:
        * rendering/svg/RenderSVGInline.cpp:
        (WebCore::RenderSVGInline::computeFloatRectForRepaint):
        * rendering/svg/RenderSVGInline.h:
        * rendering/svg/RenderSVGModelObject.cpp:
        (WebCore::RenderSVGModelObject::computeFloatRectForRepaint):
        * rendering/svg/RenderSVGModelObject.h:
        * rendering/svg/RenderSVGRoot.cpp:
        (WebCore::RenderSVGRoot::computeFloatRectForRepaint):
        * rendering/svg/RenderSVGRoot.h:
        * rendering/svg/RenderSVGText.cpp:
        (WebCore::RenderSVGText::computeRectForRepaint):
        (WebCore::RenderSVGText::computeFloatRectForRepaint):
        * rendering/svg/RenderSVGText.h:
        * rendering/svg/SVGRenderSupport.cpp:
        (WebCore::SVGRenderSupport::clippedOverflowRectForRepaint):
        (WebCore::SVGRenderSupport::computeFloatRectForRepaint):
        * rendering/svg/SVGRenderSupport.h:

2015-10-06  Zalan Bujtas  <zalan@apple.com>

        Paint artifacts when hovering on http://jsfiddle.net/Sherbrow/T87Mn/
        https://bugs.webkit.org/show_bug.cgi?id=149535
        rdar://problem/22874920

        Reviewed by Simon Fraser.

        When due to some style change, a renderer's self-painting layer is getting destroyed 
        and the parent's overflow is no longer set to visible, we don't clean up the overflow part.

        When a renderer has a self-painting layer, the parent stops tracking the child's 
        visual overflow rect. All overflow painting is delegated to the self-painting layer.
        However when this layer gets destroyed, no-one issues repaint to clean up
        the overflow bits.
        This patch ensures that we issue a repaint when the self-painting layer is destroyed
        and the triggering style change requires full repaint.

        Test: fast/repaint/overflow-hidden-with-self-painting-child-layer.html

        * rendering/RenderLayer.h:
        * rendering/RenderLayerModelObject.cpp:
        (WebCore::RenderLayerModelObject::styleDidChange):

2015-10-26  Zalan Bujtas  <zalan@apple.com>

        Floating box is misplaced after content change.
        https://bugs.webkit.org/show_bug.cgi?id=150271

        Reviewed by David Hyatt.

        Collapse anonymous block when as the result of a sibling removal only floating siblings are left.

        Test: fast/block/collapse-anon-block-with-float-siblings-only.html

        * rendering/RenderBlock.cpp:
        (WebCore::canCollapseAnonymousBlock):
        (WebCore::canMergeContiguousAnonymousBlocks):
        (WebCore::RenderBlock::collapseAnonymousBoxChild):
        (WebCore::RenderBlock::removeChild):
        (WebCore::canMergeAnonymousBlock): Deleted.
        * rendering/RenderBlock.h:
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::removeAnonymousWrappersForInlinesIfNecessary):

2016-08-10  Chris Dumez  <cdumez@apple.com>

        Optimization in Node.insertBefore() is not spec-compliant
        https://bugs.webkit.org/show_bug.cgi?id=160746

        Reviewed by Ryosuke Niwa.

        We have an optimization in Node.insertBefore(newNode, refChild) to avoid
        doing any work when newNode == refChild or newNode.nextSibling == refChild.

        This optimization is not in the specification:
        - https://dom.spec.whatwg.org/#concept-node-replace

        The issue is that this optimization is observable with DOM mutation
        observers / listeners or DOM ranges.

        This patch addresses the issue by dropping the optimization. This case
        does not seem common enough to be worth optimizing for. However, if it
        turns out to regress the performance of things we care about, we could
        fallback to doing the optimization only when it is not observable.

        Test: fast/dom/Node/insertBefore-no-op-mutationobserver.html

        * dom/ContainerNode.cpp:
        (WebCore::checkAcceptChild):
        Move refChild->parent() == parent check from insertBefore() to our
        pre-insertion check function, right after checking if newNode contains
        parent. This was done in order to match more closely the specification
        and to make sure that exception are thrown in the correct order:
        - https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity (steps 2 and 3)

        (WebCore::ContainerNode::insertBefore):
        1. Drop the (refChild->previousSibling() == &newChild || refChild == &newChild)
           optimization as it is not spc-compliant.
        2. If refChild is newNode, then set refChild to newChild.nextSibling as per:
           - https://dom.spec.whatwg.org/#concept-node-pre-insert (step 3)

2015-09-13  Chris Dumez  <cdumez@apple.com>

        Improve Node pre-insertion validation when the parent is a Document
        https://bugs.webkit.org/show_bug.cgi?id=149109
        <rdar://problem/22560436>

        Reviewed by Ryosuke Niwa.

        Improve Node pre-insertion validation when the parent is a Document to
        match the specification:
        https://dom.spec.whatwg.org/#concept-node-ensure-pre-insertion-validity
        https://dom.spec.whatwg.org/#concept-node-replace

        This affects the following API: Node.insertBefore(), Node.appendChild(),
        Node.replaceChild().

        WebKit current fails to do the following checks whenever the parent is a
        Document from pre-insertion validation:
        1. If the inserted Node is a DocumentFragment, we should make sure it
          contains only one Element.
        -> This is because a Document can have only one child that is an
           Element [1].
        2.a. If an Element is inserted, we should make sure it is not inserted
             before a DocumentType.
        2.b. If a DocumentType is inserted, we should make sure it is not
             inserted after an Element.
        -> This is because the DocType must come before the optional Element
           child [1].

        Firefox and Chrome already match the specification here. This patch
        aligns WebKit's behavior with those browsers and the specification.

        [1] https://dom.spec.whatwg.org/#node-trees

        No new tests, already covered by existing W3C tests.

        * dom/ContainerNode.cpp:
        (WebCore::checkAcceptChild):
        (WebCore::checkAddChild):
        (WebCore::checkReplaceChild):
        (WebCore::ContainerNode::insertBefore):
        (WebCore::ContainerNode::appendChild):
        (WebCore::containsConsideringHostElements): Deleted.
        (WebCore::checkAcceptChildGuaranteedNodeTypes): Deleted.
        * dom/Document.cpp:
        (WebCore::Document::canAcceptChild):
        (WebCore::Document::cloneNodeInternal): Deleted.
        * dom/Document.h:

2015-09-10  Chris Dumez  <cdumez@apple.com>

        Node.appendChild(null) / replaceChild(null, null) / removeChild(null) / insertBefore(null, ref) should throw a TypeError
        https://bugs.webkit.org/show_bug.cgi?id=148971
        <rdar://problem/22560883>
        <rdar://problem/22559225>

        Reviewed by Ryosuke Niwa.

        Node.appendChild(null) / replaceChild(null, null) / removeChild(null)
        and insertBefore(null, ref) should throw a TypeError instead of a
        NotFoundError, as per the specification:
        https://dom.spec.whatwg.org/#node

        The parameters are not nullable so the Web IDL specification says
        we should throw a TypeError in this case.

        This patch moves the null-checking from ContainerNode to the methods
        on Node. The null-checking is supposed to be done by the bindings code
        but our generator currently does not support this so we do the null
        checking as close to the bindings as possible. The bindings code is
        calling the methods on Node. This also makes sure we throw a TypeError
        for null-argument when the Node is not a ContainerNode. For e.g.
        Text.appendChild(null) should throw a TypeError too.

        The methods on ContainerNode now take references insteaad of pointer
        parameters now that the null-checking is done at the call site in
        Node. This lead to a lot of code update as those methods are used
        a lot throughout the code base.

        No new tests, already covered by pre-existing layout tests.

2015-07-05  Sam Weinig  <sam@webkit.org>

        DOM4: prepend, append, before, after & replace
        https://bugs.webkit.org/show_bug.cgi?id=74648

        Reviewed by Darin Adler.

        - Adds support for ChildNode.before/after/replaceWith and ParentNode.prepend/append
          which are new functions in https://dom.spec.whatwg.org
        - Uses custom bindings rather than implementing support for union types in the code
          generator as their uses seems isolated to just this spec at the moment. If more
          uses come along, we should implement proper support for them in the generator and
          remove the custom bindings added here.

        Tests: fast/dom/ChildNode-after.html
               fast/dom/ChildNode-before.html
               fast/dom/ChildNode-replaceWith.html
               fast/dom/ParentNode-append.html
               fast/dom/ParentNode-prepend.html

        * CMakeLists.txt:
        * WebCore.vcxproj/WebCore.vcxproj:
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSBindingsAllInOne.cpp:
        Add new files.

        * bindings/js/JSCharacterDataCustom.cpp: Added.
        (WebCore::JSCharacterData::before):
        (WebCore::JSCharacterData::after):
        (WebCore::JSCharacterData::replaceWith):
        * bindings/js/JSDocumentCustom.cpp:
        (WebCore::JSDocument::prepend):
        (WebCore::JSDocument::append):
        (WebCore::JSDocument::createTouchList):
        * bindings/js/JSDocumentFragmentCustom.cpp: Added.
        (WebCore::JSDocumentFragment::prepend):
        (WebCore::JSDocumentFragment::append):
        * bindings/js/JSDocumentTypeCustom.cpp: Added.
        (WebCore::JSDocumentType::before):
        (WebCore::JSDocumentType::after):
        (WebCore::JSDocumentType::replaceWith):
        * bindings/js/JSElementCustom.cpp:
        (WebCore::toJSNewlyCreated):
        (WebCore::JSElement::before):
        (WebCore::JSElement::after):
        (WebCore::JSElement::replaceWith):
        (WebCore::JSElement::prepend):
        (WebCore::JSElement::append):
        Add custom bindings to implement the use of variadic union types.

        * bindings/js/JSNodeOrString.cpp: Added.
        (WebCore::toNodeOrStringVector):
        * bindings/js/JSNodeOrString.h: Added.
        Adds a help function for converting an JS argument list into a Vector
        of NodeOrString objects.

        * dom/ChildNode.idl:
        Expose before/after/replaceWith to JavaScript.

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::append):
        (WebCore::ContainerNode::prepend):
        * dom/ContainerNode.h:
        Add implementations of append and prepend.

        * dom/Node.h:
        * dom/Node.cpp:
        (WebCore::nodeSetPreTransformedFromNodeOrStringVector):
        (WebCore::firstPrecedingSiblingNotInNodeSet):
        (WebCore::firstFollowingSiblingNotInNodeSet):
        Helper functions for before, after and removeWith.

        (WebCore::Node::before):
        (WebCore::Node::after):
        (WebCore::Node::replaceWith):
        Add implementations of before, after and removeWith.

        * dom/NodeOrString.cpp: Added.
        (WebCore::convertNodesOrStringsIntoNode):
        * dom/NodeOrString.h: Added.
        (WebCore::NodeOrString::NodeOrString):
        (WebCore::NodeOrString::~NodeOrString):
        (WebCore::NodeOrString::type):
        (WebCore::NodeOrString::node):
        (WebCore::NodeOrString::string):
        Custom union type representing the (Node or DOMString) IDL type.

        * dom/ParentNode.idl:
        Expose append/prepend to JavaScript.

2016-04-04  Antti Koivisto  <antti@apple.com>

        Enable assertions against DOM mutations in RenderTreeUpdater
        https://bugs.webkit.org/show_bug.cgi?id=156156

        Reviewed by Andreas Kling.

        Ensure we don't mutate DOM or dispatch events during render tree updates.

        * WebCore.xcodeproj/project.pbxproj:
        * dom/ContainerNode.cpp:
        * dom/ContainerNode.h:
        (WebCore::NoEventDispatchAssertion::NoEventDispatchAssertion): Deleted.
        (WebCore::NoEventDispatchAssertion::~NoEventDispatchAssertion): Deleted.
        (WebCore::NoEventDispatchAssertion::isEventDispatchForbidden): Deleted.

            Move NoEventDispatchAssertion to a header of its own.

        * dom/NoEventDispatchAssertion.h: Added.
        (WebCore::NoEventDispatchAssertion::NoEventDispatchAssertion):
        (WebCore::NoEventDispatchAssertion::~NoEventDispatchAssertion):
        (WebCore::NoEventDispatchAssertion::isEventDispatchForbidden):
        (WebCore::NoEventDispatchAssertion::dropTemporarily):
        (WebCore::NoEventDispatchAssertion::restoreDropped):

            Add a way to disable event assertions temporarily.

        * loader/cache/CachedSVGFont.cpp:
        (WebCore::CachedSVGFont::ensureCustomFontData):

            Temporary SVG font document may get constructed during render tree update. These can't run scripts or generally
            affect anything outside the font document as it does not have a frame. Disable event assertions temporarily.

            Tested by svg/W3C-SVG-1.1/fonts-elem-07-b.svg

        * style/RenderTreeUpdater.cpp:
        (WebCore::RenderTreeUpdater::updateRenderTree):

            Enable assertions.

2017-02-09  Chris Dumez  <cdumez@apple.com>

        Crash under HTMLFormElement::registerFormElement()
        https://bugs.webkit.org/show_bug.cgi?id=167162

        Reviewed by Ryosuke Niwa.

        didMoveToNewDocument() was re-registering FormAttributeTargetObserver
        even if the element's inDocument was not set yet. As a result, it was
        possible for FormAssociatedElement::resetFormOwner() to be called
        when the element was in the tree but with its inDocument still being
        false (because insertedInto() has not been called yet). This could
        end up calling HTMLFormElement::registerFormElement() even though
        the element is still recognized as detached. This is an issue because
        HTMLFormElement::m_associatedElements's order and its corresponding
        indexes (m_associatedElementsBeforeIndex / m_associatedElementsAfterIndex)
        rely on the position of the element with regards to the form element
        (before / inside / after).

        To address the issue, we now only register the FormAttributeTargetObserver
        in didMoveToNewDocument() if the inDocument flag is set to true. This
        is similar to what is done at other call sites of
        resetFormAttributeTargetObserver(). We also ignore the form content
        attribute in HTMLFormElement::formElementIndex() if the element is
        not connected.

        As per the HTML specification [1], the form content attribute is only
        taken if the element is connected (i.e. inDocument flag is true).

        Note that FormAssociatedElement::findAssociatedForm() was already
        ignoring the form content attribute if the element is disconnected.

        [1] https://html.spec.whatwg.org/#reset-the-form-owner (step 3)

        Test: fast/forms/registerFormElement-crash.html

        * html/FormAssociatedElement.cpp:
        (WebCore::FormAssociatedElement::didMoveToNewDocument):
        Only call resetFormAttributeTargetObserver() if inDocument flag is set,
        similarly to what is done at other call sites.

        (WebCore::FormAssociatedElement::resetFormAttributeTargetObserver):
        Add an assertion to make sure no one call this method on an element that
        is not connected.

        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::formElementIndex):
        Ignore the form content attribute if the element is not connected, as
        per the HTML specification [1].

2016-11-10  John Wilander  <wilander@apple.com>

        Add link information to data transfer pasteboard for drag and drop links
        https://bugs.webkit.org/show_bug.cgi?id=163468
        <rdar://problem/20634630>

        Reviewed by Brent Fulgham.

        Test: editing/pasteboard/drag-link-with-data-transfer-adds-trusted-link-to-pasteboard.html
        This test ensures data transfers still work for types 'text' and 'url', i.e. that we don't
        regress in-page use of the drag pasteboard.

        * page/DragController.cpp:
        (WebCore::DragController::startDrag):
            Now adds trustworthy link information to the drag pasteboard.
        * platform/Pasteboard.h:
            New function declaration Pasteboard::writeTrustworthyWebURLsPboardType.
        * platform/efl/PasteboardEfl.cpp:
        (WebCore::Pasteboard::writeTrustworthyWebURLsPboardType):
            Empty, i.e. not implemented.
        * platform/gtk/PasteboardGtk.cpp:
        (WebCore::Pasteboard::writeTrustworthyWebURLsPboardType):
            Empty, i.e. not implemented.
        * platform/ios/PasteboardIOS.mm:
        (WebCore::Pasteboard::writeTrustworthyWebURLsPboardType):
            Calls ASSERT_NOT_REACHED() to make sure we don't use this function before we have
            decided on a trustrworthy URL pasteboard type on iOS. Currently not used since we
            don't support drag & drop on iOS.
        * platform/mac/PasteboardMac.mm:
        (WebCore::Pasteboard::writeTrustworthyWebURLsPboardType):
            Writes the given URL to the WebURLsWithTitlesPboardType. This pasteboard type
            serves as a trusted drop source.
        * platform/win/PasteboardWin.cpp:
        (WebCore::Pasteboard::writeTrustworthyWebURLsPboardType):
            Empty, i.e. not implemented.

2015-07-22  Mark Dittmer  <mark.s.dittmer@gmail.com>

        Fix toJSDOMWindow() in the case of an object that has the actual JS DOM window in its prototype chain.
        https://bugs.webkit.org/show_bug.cgi?id=146785

        Reviewed by Mark Lam.

        * bindings/js/JSDOMWindowBase.cpp: toJSDOMWindow(): Walk the prototype chain of the given JSValue until a JSDOMWindow or JSDOMWindowShell is found.

2017-03-31  Brent Fulgham  <bfulgham@apple.com>

        Merge r214378. rdar://problem/31177657

    2017-03-24  Brent Fulgham  <bfulgham@apple.com>

            Handle recursive calls to ProcessingInstruction::checkStyleSheet
            https://bugs.webkit.org/show_bug.cgi?id=169982
            <rdar://problem/31083051>

            Reviewed by Antti Koivisto.

           See if we triggered a recursive load of the stylesheet during the 'beforeload'
           event handler. If so, reset to a valid state before completing the load.

           We should also check after 'beforeload' that we were not disconnected from (or
           moved to a new) document.

           I also looked for other cases of this pattern and fixed them, too.

           Tests: fast/dom/beforeload/image-removed-during-before-load.html
                   fast/dom/beforeload/recursive-css-pi-before-load.html
                   fast/dom/beforeload/recursive-link-before-load.html
                   fast/dom/beforeload/recursive-xsl-pi-before-load.html

            * dom/ProcessingInstruction.cpp:
            (WebCore::ProcessingInstruction::checkStyleSheet): Prevent recursive calls into
            this function during 'beforeload' handling. Also, safely handle the case where
            the element was disconnected in the 'beforeload' handler (similar to what
            we do in HTMLLinkElement).
            (WebCore::ProcessingInstruction::setCSSStyleSheet): Drive-by Fix: Protect the
            current document to match what we do in setXSLStyleSheet.
            * dom/ProcessingInstruction.h:
            * html/HTMLLinkElement.cpp:
            (WebCore::HTMLLinkElement::process): Prevent recursive calls into
            this function during 'beforeload' handling.
            * html/HTMLLinkElement.h:
            * loader/ImageLoader.cpp:
            (WebCore::ImageLoader::dispatchPendingBeforeLoadEvent): safely handle the case where
            the element was disconnected in the 'beforeload' handler (similar to what
            we do in HTMLLinkElement).

2017-05-11  Zalan Bujtas  <zalan@apple.com>

        AX: Defer text changes until after the tree is clean if needed.
        https://bugs.webkit.org/show_bug.cgi?id=171546
        <rdar://problem/31934942>

        Reviewed by Simon Fraser.

        While updating an accessibility object state, we might
        trigger unintentional style updates. This style update could
        end up destroying renderes that are still referenced by functions
        on the callstack.
        To avoid that, defer such changes and let AXObjectCache operate on a clean tree.         

        Test: accessibility/crash-when-render-tree-is-not-clean.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::remove):
        (WebCore::AXObjectCache::handleAttributeChanged):
        (WebCore::AXObjectCache::labelChanged):
        (WebCore::AXObjectCache::performDeferredCacheUpdate):
        (WebCore::AXObjectCache::deferRecomputeIsIgnored):
        (WebCore::AXObjectCache::deferTextChangedIfNeeded):
        (WebCore::AXObjectCache::recomputeDeferredIsIgnored): Deleted.
        (WebCore::AXObjectCache::deferTextChanged): Deleted.
        * accessibility/AXObjectCache.h: Decouple different type of changes.
        (WebCore::AXObjectCache::deferRecomputeIsIgnored):
        (WebCore::AXObjectCache::deferTextChangedIfNeeded):
        (WebCore::AXObjectCache::recomputeDeferredIsIgnored): Deleted.
        (WebCore::AXObjectCache::deferTextChanged): Deleted.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::deleteLines):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::createAndAppendRootInlineBox):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::setText):

2017-05-02  Zalan Bujtas  <zalan@apple.com>

        Defer AX cache update when text content changes until after layout is finished.
        https://bugs.webkit.org/show_bug.cgi?id=171429
        <rdar://problem/31885984>

        Reviewed by Simon Fraser.

        When the content of the RenderText changes (even as the result of a text-transform change)
        instead of updating the AX cache eagerly (and trigger layout on a half-backed render tree)
        we should just defer it until after the subsequent layout is done. 

        Test: accessibility/crash-while-adding-text-child-with-transform.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::remove):
        (WebCore::AXObjectCache::performDeferredCacheUpdate):
        (WebCore::AXObjectCache::recomputeDeferredIsIgnored):
        (WebCore::AXObjectCache::deferTextChanged):
        (WebCore::AXObjectCache::performDeferredIsIgnoredChange): Deleted.
        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::deferTextChanged):
        (WebCore::AXObjectCache::performDeferredCacheUpdate):
        (WebCore::AXObjectCache::performDeferredIsIgnoredChange): Deleted.
        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::setText):

2016-12-16  Zalan Bujtas  <zalan@apple.com>

        Defer certain accessibility callbacks until after layout is finished.
        https://bugs.webkit.org/show_bug.cgi?id=165861
        rdar://problem/29646301

        Reviewed by Chris Fleizach.

        Currently with certain AXObjectCache callbacks, we can end up in a layout while the render tree is being mutated.  
        This patch ensures that such callbacks are deferred until after tree mutation/layout is finished.

        Test: accessibility/accessibility-crash-with-dynamic-inline-content.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::remove):
        (WebCore::AXObjectCache::performDeferredIsIgnoredChange):
        (WebCore::AXObjectCache::insertDeferredIsIgnoredChange):
        * accessibility/AXObjectCache.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::deleteLines):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::createAndAppendRootInlineBox):

2017-04-28  Per Arne Vollan  <pvollan@apple.com>

        Crash under WebCore::AccessibilityRenderObject::handleAriaExpandedChanged().
        https://bugs.webkit.org/show_bug.cgi?id=171427
        rdar://problem/31863417

        Reviewed by Brent Fulgham.

        The AccessibilityRenderObject object might delete itself in handleAriaExpandedChanged() under the call
        to the parentObject() method. This will cause a crash when accessing the object later in this method.
        Protect the current object while executing arbitrary event code.

        Test: accessibility/accessibility-crash-setattribute.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::handleAriaExpandedChanged):

2017-03-29  Ryosuke Niwa  <rniwa@webkit.org>

        Disconnecting a HTMLObjectElement does not always unload its content document
        https://bugs.webkit.org/show_bug.cgi?id=169606

        Reviewed by Andy Estes.

        When removing a node, we first disconnect all subframes then update the focused element as we remove each child.
        However, when the removed element is a focused object element with a content document, removeFocusedNodeOfSubtree
        can update the style tree synchronously inside Document::setFocusedElement, and reload the document.

        Avoid this by instantiating a SubframeLoadingDisabler on the parent of the focused element.

        Test: fast/dom/removing-focused-object-element.html

        * dom/Document.cpp:
        (WebCore::Document::removeFocusedNodeOfSubtree):

2017-03-24  Daniel Bates  <dabates@apple.com>

        Prevent new navigations during document unload
        https://bugs.webkit.org/show_bug.cgi?id=169934
        <rdar://problem/31247584>

        Reviewed by Chris Dumez.

        Similar to our policy of preventing new navigations from onbeforeunload handlers
        we should prevent new navigations that are initiated during the document unload
        process.

        The significant part of this change is the instantiation of the RAII object NavigationDisabler
        in Document::prepareForDestruction(). The rest of this change just renames class
        NavigationDisablerForBeforeUnload to NavigationDisabler now that this RAII class is
        used to prevent navigation from both onbeforeunload event handlers and when unloading
        a document.

        Test: fast/frames/frame-unload-navigate-and-setTimeout-assert-fail.html

        * dom/Document.cpp:
        (WebCore::Document::prepareForDestruction): Disable new navigations when disconnecting
        subframes. Also assert that the document is not in the page cache before we fall off
        the end of the function.
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::isNavigationAllowed): Update for renaming below.
        (WebCore::FrameLoader::shouldClose): Ditto.
        * loader/NavigationScheduler.cpp:
        (WebCore::NavigationScheduler::shouldScheduleNavigation): Ditto.
        * loader/NavigationScheduler.h:
        (WebCore::NavigationDisabler::NavigationDisabler): Renamed class; formerly named NavigationDisablerForBeforeUnload.
        (WebCore::NavigationDisabler::~NavigationDisabler): Ditto.
        (WebCore::NavigationDisabler::isNavigationAllowed): Ditto.
        (WebCore::NavigationDisablerForBeforeUnload::NavigationDisablerForBeforeUnload): Deleted.
        (WebCore::NavigationDisablerForBeforeUnload::~NavigationDisablerForBeforeUnload): Deleted.
        (WebCore::NavigationDisablerForBeforeUnload::isNavigationAllowed): Deleted.

2017-03-16  Zalan Bujtas  <zalan@apple.com>

        Stay inside the continuation while searching for a candidate ancestor for insertion.
        https://bugs.webkit.org/show_bug.cgi?id=169768
        <rdar://problem/30959936>

        Reviewed by David Hyatt.

        Test: fast/inline/continuation-crash-with-anon-ancestors.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::addChildToContinuation):

2016-10-13  Zalan Bujtas  <zalan@apple.com>

        [Clean RenderTree] LayoutTests/imported/blink/fast/table/crash-bad-child-table-continuation.html fails.
        https://bugs.webkit.org/show_bug.cgi?id=163399

        Reviewed by David Hyatt.

        When we try to insert a renderer before a child whose direct parent is a (anonymus) RenderTable, continuation logic
        should dismiss the RenderTable as the parent and find a more appropriate ancestor.
        RenderTables assumes a certain descendant tree structure which might not be available in the continuation.

        Will be testable with webkit.org/b/162834

        * rendering/RenderInline.cpp:
        (WebCore::canUseAsParentForContinuation):
        (WebCore::RenderInline::addChildToContinuation):

2015-11-10  Zalan Bujtas  <zalan@apple.com>

        Continuations with anonymous wrappers inside misplaces child renderers.
        https://bugs.webkit.org/show_bug.cgi?id=150908

        When a child is appended to an inline container and the beforeChild is not a direct child, but 
        it is inside a generated subtree, we need to special case the inline split to form continuation.

        RenderInline::splitInlines() assumes that beforeChild is always a direct child of the current
        inline container. However when beforeChild type requires wrapper content (such as table cells), the DOM and the
        render tree get out of sync. In such cases, we need to ensure that both the beforeChild and its siblings end up
        in the correct generated block.

        Reviewed by Darin Adler and David Hyatt.

        Test: fast/inline/continuation-with-anon-wrappers.html

        * rendering/RenderInline.cpp:
        (WebCore::RenderInline::splitInlines):
        (WebCore::RenderInline::addChildToContinuation):

2017-03-14  Wenson Hsieh  <wenson_hsieh@apple.com>

        RenderElements should unregister for viewport visibility callbacks when they are destroyed
        https://bugs.webkit.org/show_bug.cgi?id=169521
        <rdar://problem/30959545>

        Reviewed by Simon Fraser.

        When registering a RenderElement for viewport visibility callbacks, we always need to make sure that it is unregistered
        before it is destroyed. While we account for this in the destructor of RenderElement, we only unregister in the destructor
        if we are already registered for visibility callbacks. In the call to RenderObject::willBeDestroyed(), we clear out rare
        data, which holds RenderElement's viewport callback registration state, so upon entering the destructor of RenderElement,
        we skip unregistration because RenderElement thinks that it is not registered.

        We can mitigate this by unregistering the RenderElement earlier, in RenderElement::willBeDestroyed, prior to clearing out
        the rare data. However, we'd ideally want to move the cleanup logic out of the destructor altogether and into willBeDestroyed
        (see https://bugs.webkit.org/show_bug.cgi?id=169650).

        Test: fast/media/video-element-in-details-collapse.html

        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::willBeDestroyed):

2015-12-02  Jer Noble  <jer.noble@apple.com>

        Add a setting and restriction which will pause invisible autoplaying video
        https://bugs.webkit.org/show_bug.cgi?id=151412

        Reviewed by Eric Carlson.

        Test: media/video-restricted-invisible-autoplay-not-allowed.html

        Drive-by fix: m_autoplaying is reset in many places by calling pause() or play(), where those
        calls did not originate from an explicit request to pause or play, e.g., during an interruption.
        This causes m_autoplaying to be set to false, thus breaking resumption of autoplaying when the
        interruption ends. Update PlatformMediaSession to remember its client's "autoplaying" state and
        restore it when an interruption ends.

        Add a means to register for viewport visibility notifications to FrameView, RenderView,
        and RenderElement. Elements who wish to recieve these notifications must do so through their
        renderer, and thus will have to re-register whenever a new renderer is attached.

        Add a restriction to HTMLMediaElement which will pause autoplaying video when that video scrolls
        out of the viewport, or is hidden with CSS.

        Add a setting which controls whether that new restriction is set.

        * dom/Element.h:
        (WebCore::Element::isVisibleInViewportChanged): Add default empty virtual method.
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::HTMLMediaElement):
        (WebCore::HTMLMediaElement::didMoveToNewDocument):
        (WebCore::HTMLMediaElement::documentDidResumeFromPageCache):
        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture):
        (WebCore::HTMLMediaElement::resumeAutoplaying):
        (WebCore::mediaElementIsAllowedToAutoplay):
        (WebCore::HTMLMediaElement::isVisibleInViewportChanged):
        (WebCore::HTMLMediaElement::updateShouldAutoplay):
        (WebCore::HTMLMediaElement::HTMLMediaElement): Set the new restriction based on the current Settings.
        (WebCore::HTMLMediaElement::resumeAutoplaying): Continue autoplay, or begin playback.
        (WebCore::HTMLMediaElement::didMoveToNewDocument): Update our autoplay state.
        (WebCore::HTMLMediaElement::documentDidResumeFromPageCache): Ditto.
        (WebCore::HTMLMediaElement::removedFrom): Ditto.
        (WebCore::HTMLMediaElement::didAttachRenderers): Ditto.
        (WebCore::HTMLMediaElement::didDetachRenderers): Ditto.
        (WebCore::HTMLMediaElement::visibilityDidChange): Ditto.
        (WebCore::HTMLMediaElement::willDetachRenderers): Unregister for visibility callbacks.
        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture): Clear new restriction.
        (WebCore::mediaElementIsAllowedToAutoplay): Check for autoplay requirements.
        (WebCore::HTMLMediaElement::isVisibleInViewportChanged): Added, update our autoplay state.
        (WebCore::HTMLMediaElement::updateShouldAutoplay): Set interruption if necessary, clear otherwise.
        * html/HTMLMediaElement.h:
        * html/MediaElementSession.cpp:
        (WebCore::restrictionName): Added support for new restriction.
        * html/MediaElementSession.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::viewportContentsChanged): Update clients of viewport visibility.
        * page/Settings.in:
        * platform/audio/PlatformMediaSession.cpp:
        (WebCore::stateName): Add new "Autoplay" state.
        (WebCore::interruptionName): Added new interruption type.
        (WebCore::PlatformMediaSession::beginInterruption): Set the m_interruptionType.
        (WebCore::PlatformMediaSession::clientWillBeginAutoplaying): Set the m_state to Autoplaying.
        * platform/audio/PlatformMediaSession.h:
        (WebCore::PlatformMediaSession::interruptionType): Added getter.
        (WebCore::PlatformMediaSessionClient::resumeAutoplaying): Added default.
        * platform/audio/PlatformMediaSessionManager.cpp:
        (WebCore::PlatformMediaSessionManager::sessionWillBeginPlayback): Only pause session if its state is playing.
        * rendering/RenderElement.cpp:
        (WebCore::RenderElement::RenderElement): Set new ivars.
        (WebCore::RenderElement::~RenderElement): Unregister for callbacks if necessary.
        (WebCore::RenderElement::registerForVisibleInViewportCallback): Register for callbacks from RenderView.
        (WebCore::RenderElement::unregisterForVisibleInViewportCallback): Unregister from same.
        (WebCore::RenderElement::visibleInViewportStateChanged): Notify Element if value has changed.
        * rendering/RenderElement.h:
        * rendering/RenderView.cpp:
        (WebCore::RenderView::registerForVisibleInViewportCallback): Add renderer to list of callbacks.
        (WebCore::RenderView::unregisterForVisibleInViewportCallback): Remove renderer from same.
        (WebCore::RenderView::updateVisibleViewportRect): Walk renderers setting their visiblility based on the viewport visible rect.
        * rendering/RenderView.h:
        * testing/Internals.cpp:
        (WebCore::Internals::setMediaElementRestrictions): Support new restriction.

2015-10-01  Eric Carlson  <eric.carlson@apple.com>

        [iOS] AirPlay should not stop when the screen locks
        https://bugs.webkit.org/show_bug.cgi?id=148315
        <rdar://problem/22770703>

        Reviewed by Jer Noble.

        Tested by media/video-interruption-with-resume-allowing-play.html
                  media/video-interruption-with-resume-not-allowing-play.html

        * Modules/webaudio/AudioContext.h: overrideBackgroundPlaybackRestriction -> 
          shouldOverrideBackgroundPlaybackRestriction.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::suspendPlayback): Fix a typo in the logging.
        (WebCore::HTMLMediaElement::mayResumePlayback): Ditto.
        (WebCore::HTMLMediaElement::shouldOverrideBackgroundPlaybackRestriction): Renamed from
          overrideBackgroundPlaybackRestriction.
        (WebCore::HTMLMediaElement::overrideBackgroundPlaybackRestriction): Deleted.
        * html/HTMLMediaElement.h:

        * platform/audio/PlatformMediaSession.cpp:
        (WebCore::stateName):
        (WebCore::interruptionName): New, log the name of the interruption.
        (WebCore::PlatformMediaSession::beginInterruption): Log the interruption type. Don't
          increment the interruption counter if we are going to ignore it. Incorporate logic
          from doInterruption.
        (WebCore::PlatformMediaSession::doInterruption): Deleted.
        (WebCore::PlatformMediaSession::shouldDoInterruption): Deleted.
        (WebCore::PlatformMediaSession::forceInterruption): Deleted.

        * platform/audio/PlatformMediaSession.h: Add SuspendedUnderLock interruption type.
        * platform/audio/PlatformMediaSessionManager.cpp:
        (WebCore::PlatformMediaSessionManager::applicationDidEnterBackground): Deleted.
        * platform/audio/PlatformMediaSessionManager.h:

        * platform/audio/ios/MediaSessionManagerIOS.h:
        * platform/audio/ios/MediaSessionManagerIOS.mm:
        (WebCore::MediaSessionManageriOS::applicationDidEnterBackground): Call beginInterruption
          when appropriate.

2015-09-03  Jer Noble  <jer.noble@apple.com>

        [iOS] Playback does not pause when deselecting route and locking screen.
        https://bugs.webkit.org/show_bug.cgi?id=148724

        Reviewed by Eric Carlson.

        When deselecting a route, the route change notification can be delayed for some amount
        of time. If the screen is locked before the notification is fired, the PlatformMediaSessionManager
        can refuse to pause the video when entering the background due to a wireless playback route
        still being active.

        When the media element transitions from having an active route to not having one (or vice versa),
        re-run the interruption check. In order to correctly determine, when that occurs, whether
        we are in an 'application background' state, cache that value to an ivar when handling
        application{Will,Did}Enter{Background,Foreground}.

        Because we only want to run this step during an actual transition between playing to a route ->
        playing locally, cache the value of isPlayingToWirelessPlayback to another ivar, and only
        inform the PlatformMediaSessionManager when that value actually changes.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaPlayerCurrentPlaybackTargetIsWirelessChanged):
        * platform/audio/PlatformMediaSession.cpp:
        (WebCore::PlatformMediaSession::isPlayingToWirelessPlaybackTargetChanged): Set or clear m_isPlayingToWirelessPlaybackTarget.
        * platform/audio/PlatformMediaSession.h:
        (WebCore::PlatformMediaSession::isPlayingToWirelessPlaybackTarget): Simple getter.
        * platform/audio/PlatformMediaSessionManager.cpp:
        (WebCore::PlatformMediaSessionManager::applicationWillEnterBackground): Set m_isApplicationInBackground.
        (WebCore::PlatformMediaSessionManager::applicationDidEnterBackground): Ditto.
        (WebCore::PlatformMediaSessionManager::applicationWillEnterForeground): Clear m_isApplicationInBackground.
        (WebCore::PlatformMediaSessionManager::sessionIsPlayingToWirelessPlaybackTargetChanged): Run interruption
            if application is in background.

2017-05-11  Zalan Bujtas  <zalan@apple.com>

        AX: Defer text changes until after the tree is clean if needed.
        https://bugs.webkit.org/show_bug.cgi?id=171546
        <rdar://problem/31934942>

        Reviewed by Simon Fraser.

        While updating an accessibility object state, we might
        trigger unintentional style updates. This style update could
        end up destroying renderes that are still referenced by functions
        on the callstack.
        To avoid that, defer such changes and let AXObjectCache operate on a clean tree.         

        Test: accessibility/crash-when-render-tree-is-not-clean.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::remove):
        (WebCore::AXObjectCache::handleAttributeChanged):
        (WebCore::AXObjectCache::labelChanged):
        (WebCore::AXObjectCache::performDeferredCacheUpdate):
        (WebCore::AXObjectCache::deferRecomputeIsIgnored):
        (WebCore::AXObjectCache::deferTextChangedIfNeeded):
        (WebCore::AXObjectCache::recomputeDeferredIsIgnored): Deleted.
        (WebCore::AXObjectCache::deferTextChanged): Deleted.
        * accessibility/AXObjectCache.h: Decouple different type of changes.
        (WebCore::AXObjectCache::deferRecomputeIsIgnored):
        (WebCore::AXObjectCache::deferTextChangedIfNeeded):
        (WebCore::AXObjectCache::recomputeDeferredIsIgnored): Deleted.
        (WebCore::AXObjectCache::deferTextChanged): Deleted.
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::deleteLines):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::createAndAppendRootInlineBox):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::setText):

2017-05-02  Zalan Bujtas  <zalan@apple.com>

        Defer AX cache update when text content changes until after layout is finished.
        https://bugs.webkit.org/show_bug.cgi?id=171429
        <rdar://problem/31885984>

        Reviewed by Simon Fraser.

        When the content of the RenderText changes (even as the result of a text-transform change)
        instead of updating the AX cache eagerly (and trigger layout on a half-backed render tree)
        we should just defer it until after the subsequent layout is done. 

        Test: accessibility/crash-while-adding-text-child-with-transform.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::remove):
        (WebCore::AXObjectCache::performDeferredCacheUpdate):
        (WebCore::AXObjectCache::recomputeDeferredIsIgnored):
        (WebCore::AXObjectCache::deferTextChanged):
        (WebCore::AXObjectCache::performDeferredIsIgnoredChange): Deleted.
        * accessibility/AXObjectCache.h:
        (WebCore::AXObjectCache::deferTextChanged):
        (WebCore::AXObjectCache::performDeferredCacheUpdate):
        (WebCore::AXObjectCache::performDeferredIsIgnoredChange): Deleted.
        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):
        * rendering/RenderText.cpp:
        (WebCore::RenderText::setText):

2016-12-16  Zalan Bujtas  <zalan@apple.com>

        Defer certain accessibility callbacks until after layout is finished.
        https://bugs.webkit.org/show_bug.cgi?id=165861
        rdar://problem/29646301

        Reviewed by Chris Fleizach.

        Currently with certain AXObjectCache callbacks, we can end up in a layout while the render tree is being mutated.  
        This patch ensures that such callbacks are deferred until after tree mutation/layout is finished.

        Test: accessibility/accessibility-crash-with-dynamic-inline-content.html

        * accessibility/AXObjectCache.cpp:
        (WebCore::AXObjectCache::remove):
        (WebCore::AXObjectCache::performDeferredIsIgnoredChange):
        (WebCore::AXObjectCache::insertDeferredIsIgnoredChange):
        * accessibility/AXObjectCache.h:
        * page/FrameView.cpp:
        (WebCore::FrameView::performPostLayoutTasks):
        * rendering/RenderBlock.cpp:
        (WebCore::RenderBlock::deleteLines):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::createAndAppendRootInlineBox):

2017-04-28  Per Arne Vollan  <pvollan@apple.com>

        Crash under WebCore::AccessibilityRenderObject::handleAriaExpandedChanged().
        https://bugs.webkit.org/show_bug.cgi?id=171427
        rdar://problem/31863417

        Reviewed by Brent Fulgham.

        The AccessibilityRenderObject object might delete itself in handleAriaExpandedChanged() under the call
        to the parentObject() method. This will cause a crash when accessing the object later in this method.
        Protect the current object while executing arbitrary event code.

        Test: accessibility/accessibility-crash-setattribute.html

        * accessibility/AccessibilityRenderObject.cpp:
        (WebCore::AccessibilityRenderObject::handleAriaExpandedChanged):

2017-04-19  Joseph Pecoraro  <pecoraro@apple.com>

        ASAN Crash running LayoutTests/inspector/worker tests
        https://bugs.webkit.org/show_bug.cgi?id=170967
        <rdar://problem/31256437>

        Reviewed by Alex Christensen.

        * workers/WorkerMessagingProxy.h:
        * workers/WorkerMessagingProxy.cpp:
        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy):
        (WebCore::WorkerMessagingProxy::workerGlobalScopeDestroyedInternal):
        Make the MessagingProxy thread safe ref counted. Since it used to
        delete itself, turn this into a ref (implicit on construction)
        and deref (replacing delete this).

        (WebCore::WorkerMessagingProxy::postMessageToPageInspector):
        When dispatching have the lambda implicitly ref/deref with the
        lambda to keep the proxy alive while a lambda is queued.

2016-05-20  Joseph Pecoraro  <pecoraro@apple.com>

        Remove LegacyProfiler
        https://bugs.webkit.org/show_bug.cgi?id=153565

        Reviewed by Mark Lam.

        * ForwardingHeaders/profiler/Profile.h: Removed.
        * ForwardingHeaders/profiler/ProfileNode.h: Removed.
        * testing/js/WebCoreTestSupport.cpp:
        * xml/XSLStyleSheetLibxslt.cpp:
        * xml/XSLTProcessorLibxslt.cpp:

2016-05-20  Joseph Pecoraro  <pecoraro@apple.com>

        Remove LegacyProfiler
        https://bugs.webkit.org/show_bug.cgi?id=153565

        Reviewed by Saam Barati.

        JavaScriptCore now provides a sampling profiler and it is enabled
        by all ports. Web Inspector switched months ago to using the
        sampling profiler and displaying its data. Remove the legacy
        profiler, as it is no longer being used by anything other then
        console.profile and tests. We will update console.profile's
        behavior soon to have new behavior and use the sampling data.

        * CMakeLists.txt:
        * DerivedSources.cpp:
        * DerivedSources.make:
        * ForwardingHeaders/profiler/LegacyProfiler.h: Removed.
        * WebCore.xcodeproj/project.pbxproj:
        * bindings/js/JSCustomXPathNSResolver.cpp:
        * bindings/js/JSDOMWindowBase.cpp:
        (WebCore::JSDOMWindowBase::supportsLegacyProfiling): Deleted.
        (WebCore::JSDOMWindowBase::supportsRichSourceInfo): Deleted.
        * bindings/js/JSDOMWindowBase.h:
        * bindings/js/JSWorkerGlobalScopeBase.cpp:
        (WebCore::JSWorkerGlobalScopeBase::supportsLegacyProfiling): Deleted.
        * bindings/js/JSWorkerGlobalScopeBase.h:
        * bindings/js/ScriptCachedFrameData.cpp:
        * bindings/js/ScriptController.cpp:
        (WebCore::ScriptController::clearWindowShell): Deleted.
        * bindings/js/ScriptProfile.h: Removed.
        * bindings/js/ScriptProfileNode.h: Removed.
        * bindings/scripts/CodeGeneratorJS.pm:
        (AddClassForwardIfNeeded): Deleted.
        * bindings/scripts/test/JS/JSTestObj.cpp:
        (WebCore::jsTestObjPrototypeFunctionMethodWithSequenceArg): Deleted.
        (WebCore::jsTestObjPrototypeFunctionMethodReturningSequence): Deleted.
        * bindings/scripts/test/TestObj.idl:
        * css/CSSParser.cpp:
        * dom/Document.cpp:
        * inspector/InspectorConsoleInstrumentation.h:
        (WebCore::InspectorInstrumentation::stopProfiling):
        * inspector/InspectorController.cpp:
        (WebCore::InspectorController::InspectorController):
        (WebCore::InspectorController::legacyProfilerEnabled): Deleted.
        (WebCore::InspectorController::setLegacyProfilerEnabled): Deleted.
        * inspector/InspectorController.h:
        * inspector/InspectorInstrumentation.cpp:
        (WebCore::InspectorInstrumentation::stopProfilingImpl):
        * inspector/InspectorInstrumentation.h:
        * inspector/InspectorTimelineAgent.cpp:
        (WebCore::InspectorTimelineAgent::startFromConsole):
        (WebCore::InspectorTimelineAgent::stopFromConsole):
        * inspector/InspectorTimelineAgent.h:
        * inspector/PageDebuggerAgent.cpp:
        * inspector/PageRuntimeAgent.cpp:
        * inspector/ScriptProfile.idl: Removed.
        * inspector/ScriptProfileNode.idl: Removed.
        * inspector/TimelineRecordFactory.cpp:
        (WebCore::buildAggregateCallInfoInspectorObject): Deleted.
        (WebCore::buildInspectorObject): Deleted.
        (WebCore::buildProfileInspectorObject): Deleted.
        (WebCore::TimelineRecordFactory::appendProfile): Deleted.
        * inspector/TimelineRecordFactory.h:
        * page/DOMWindow.cpp:
        * page/Page.cpp:
        * page/PageConsoleClient.cpp:
        (WebCore::PageConsoleClient::profileEnd):
        (WebCore::PageConsoleClient::clearProfiles): Deleted.
        * page/PageConsoleClient.h:
        * testing/Internals.cpp:
        (WebCore::Internals::resetToConsistentState): Deleted.
        (WebCore::Internals::consoleProfiles): Deleted.
        (WebCore::Internals::setLegacyJavaScriptProfilingEnabled): Deleted.
        * testing/Internals.h:
        * testing/Internals.idl:

2017-07-11  Carlos Alberto Lopez Perez  <clopez@igalia.com>

        [GTK] Spin buttons on input type number appear over the value itself for small widths
        https://bugs.webkit.org/show_bug.cgi?id=173572

        Reviewed by Carlos Garcia Campos.

        When drawing the spin buttons, override the width of the input
        element to increment it with the width of the spin button.
        This ensures that we don't end up covering the input values with
        the spin buttons.

        Do this also for user controlled styles, because most web authors
        won't test how their site renders on WebKitGTK+, and they will
        assume spin buttons in the order of 13 pixels wide (that is what
        most browsers use), but the GTK+ spin button is much wider (66 pixels).

        Test: platform/gtk/fast/forms/number/number-size-spinbutton-nocover.html

        * rendering/RenderTheme.cpp:
        (WebCore::RenderTheme::adjustStyle):
        * rendering/RenderThemeGtk.cpp:
        (WebCore::RenderThemeGtk::adjustTextFieldStyle): Call the theme's adjustTextFieldStyle() also for user controlled styles.
        (WebCore::RenderThemeGtk::adjustInnerSpinButtonStyle):

2017-06-15  Matthew Hanson  <matthew_hanson@apple.com>

        Cherry-pick r218300. rdar://problem/31971362

    2017-06-14  Dean Jackson  <dino@apple.com>

            Restrict filtered painting across cross-origin boundaries with transforms
            https://bugs.webkit.org/show_bug.cgi?id=173388
            <rdar://problem/27362159>

            Reviewed by Simon Fraser.

            Make sure all cases of LayerPaintingInfo maintain the security
            flag. In this case there was only one new place, and since
            everything is scalar, there was no need for a real copy constructor.

            Test: http/tests/css/filters-on-iframes-transform.html

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::paintLayerByApplyingTransform): Make sure the cross
            origin flag is used in the call to paint the layer children.
            * rendering/RenderLayer.h: Fix some typos.

2017-05-25  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r217439. rdar://problem/32089229

    2017-05-24  Jiewen Tan  <jiewen_tan@apple.com>

            Crash on WebCore::FrameSelection::setSelectionWithoutUpdatingAppearance + 1195
            https://bugs.webkit.org/show_bug.cgi?id=172555
            <rdar://problem/32004724>

            Reviewed by Ryosuke Niwa.

            setSelectionWithoutUpdatingAppearance could dispatch a synchronous focusin event,
            which could invoke an event handler that deteles the frame. Therefore, add a
            protector before the call.

            Test: editing/selection/select-iframe-focusin-document-crash.html

            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::setSelection):

2017-05-24  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r217172. rdar://problem/32380123

    2017-05-19  Chris Dumez  <cdumez@apple.com>

            Do not fire load event for SVGElements that are detached or in frameless documents
            https://bugs.webkit.org/show_bug.cgi?id=172289
            <rdar://problem/32275689>

            Reviewed by Ryosuke Niwa.

            We should not fire load event for SVGElements that are detached or in frameless
            documents.

            Test: svg/load-event-detached.html

            * svg/SVGElement.cpp:
            (WebCore::SVGElement::sendSVGLoadEventIfPossible):

2017-05-23  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r217197. rdar://problem/32355285

    2017-05-21  Antti Koivisto  <antti@apple.com>

            matchMedia('print').addListener() fires in WK1 but never in WK2 when printing (breaks printing Google maps, QuickLooks)
            https://bugs.webkit.org/show_bug.cgi?id=172361
            <rdar://problem/28777408>

            Reviewed by Sam Weinig.

            Test: fast/media/matchMedia-print.html

            * page/FrameView.cpp:
            (WebCore::FrameView::layout):

                Evaluate matchMedia queries unconditionally. No idea why it wasn't like that.

            * testing/Internals.cpp:
            (WebCore::Internals::setPrinting):

                Add testing support. The existing ways to do printing testing were unable to hit this bug as
                they had too much additional gunk.

            * testing/Internals.h:
            * testing/Internals.idl:

2017-05-18  Dean Jackson  <dino@apple.com>

        Restrict SVG filters to accessible security origins
        https://bugs.webkit.org/show_bug.cgi?id=118689
        <rdar://problem/27362159>

        Reviewed by Brent Fulgham.

        Certain SVG filters should only be allowed to operate
        on content that is has SecurityOrigin access to. Implement
        this by including a flag in PaintInfo and LayerPaintingInfo,
        and have RenderWidget make sure the documents have acceptable
        SecurityOrigins as it goes to paint.

        This could be used as the first step in a "safe painting"
        strategy, allowing some content to be rendered into a 
        canvas or via the element() CSS function... but it is only
        a small first step.

        Test: http/tests/css/filters-on-iframes.html

        * page/FrameView.cpp:
        (WebCore::FrameView::paintContents):
        * page/FrameView.h:
        * platform/ScrollView.cpp:
        (WebCore::ScrollView::paint):
        * platform/ScrollView.h:
        * platform/Scrollbar.cpp:
        (WebCore::Scrollbar::paint):
        * platform/Scrollbar.h:
        * platform/Widget.h:
        * platform/graphics/filters/FilterOperation.h:
        (WebCore::FilterOperation::shouldBeRestrictedBySecurityOrigin):
        * platform/graphics/filters/FilterOperations.cpp:
        (WebCore::FilterOperations::hasFilterThatShouldBeRestrictedBySecurityOrigin):
        * platform/graphics/filters/FilterOperations.h:
        * platform/mac/WidgetMac.mm:
        (WebCore::Widget::paint):
        * rendering/FilterEffectRenderer.cpp:
        (WebCore::FilterEffectRenderer::build):
        * rendering/FilterEffectRenderer.h:
        * rendering/PaintInfo.h:
        (WebCore::PaintInfo::PaintInfo):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::paint):
        (WebCore::RenderLayer::setupFilters):
        (WebCore::RenderLayer::paintForegroundForFragmentsWithPhase):
        * rendering/RenderLayer.h:
        * rendering/RenderScrollbar.cpp:
        (WebCore::RenderScrollbar::paint):
        * rendering/RenderScrollbar.h:
        * rendering/RenderWidget.cpp:
        (WebCore::RenderWidget::paintContents):

2016-12-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208825. rdar://problem/29277338

    2016-11-16  Brent Fulgham  <bfulgham@apple.com>

            Clear track client when removing a track
            https://bugs.webkit.org/show_bug.cgi?id=164842
            <rdar://problem/29213621>

            Reviewed by Eric Carlson.

            Call 'clearClient' when removing a track from an HTMLMediaElement.

            Test: media/track/audio-track-add-remove.html
                  media/track/video-track-add-remove.html

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::removeAudioTrack): Call 'clearClient'
            (WebCore::HTMLMediaElement::removeVideoTrack): Ditto.

2016-12-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208628. rdar://problem/29277337

    2016-11-11  Brent Fulgham  <bfulgham@apple.com>

            Neutered ArrayBuffers are not properly serialized
            https://bugs.webkit.org/show_bug.cgi?id=164647
            <rdar://problem/29213490>

            Reviewed by David Kilzer.

            Correct binding logic to handle ImageBuffers being deserialized from neutered ArrayBuffers.

            Test: fast/canvas/neutered-imagedata.html

            * bindings/js/SerializedScriptValue.cpp:
            (WebCore::CloneDeserializer::readTerminal):

2016-10-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r206635 and r206637. rdar://problem/28718754

    2016-10-28  Said Abou-Hallawa  <sabouhallawa@apple.com>

            Change the MemoryCache and CachedResource adjustSize functions to take a long argument
            https://bugs.webkit.org/show_bug.cgi?id=162708

            Reviewed by Brent Fulgham.

            Because the MemoryCache stores the size of the cached memory in unsigned,
            two problems my happen when reporting a change in the size of the memory:

            1. Signed integer overflow -- which can happen because MemoryCache::adjustSize()
               takes a signed integer argument. If the allocated or the freed memory size is
               larger than the maximum of a signed integer, an overflow will happen.
               For the image caching code, this can be seen where the unsigned decodedSize
               is casted to an integer before passing it to ImageObserver::decodedSizeChanged().

            2. Unsigned integer overflow -- which can happen if the new allocated memory
               size plus the currentSize exceeds the maximum of unsigned.
               This can be seen in MemoryCache::adjustSize() where we add delta to m_liveSize
               or m_deadSize without checking whether this addition will overflow or not. We
               do not assert for overflow although we assert for underflow.

            The fix for these two problems can be the following:

            1. Make all the adjustSize functions all the way till MemoryCache::adjustSize()
               take a signed long integer argument.

            2. Do not create a NativeImagePtr for an ImageFrame if its frameBytes plus the
               ImageFrameCache::decodedSize() will exceed the maximum of an unsigned integer.

            * loader/cache/CachedImage.cpp:
            (WebCore::CachedImage::decodedSizeChanged): Change the argument to be long. No overflow will happen when casting the argument from unsigned to long.
            * loader/cache/CachedImage.h:
            * loader/cache/CachedResource.cpp:
            (WebCore::CachedResource::setDecodedSize): Use long integer casting when calling MemoryCache::adjustSize().
            (WebCore::CachedResource::setEncodedSize): Ditto.
            * loader/cache/MemoryCache.cpp:
            (WebCore::MemoryCache::MemoryCache): Add as static assert to ensure sizeof(long long) can hold any unsigned or its negation.
            (WebCore::MemoryCache::revalidationSucceeded): Use long integer casting when calling MemoryCache::adjustSize().
            (WebCore::MemoryCache::remove): Ditto.
            (WebCore::MemoryCache::adjustSize): Change the function argument to long integer. No overflow will happen when casting the argument from unsigned to long.
            * loader/cache/MemoryCache.h:
            * platform/graphics/BitmapImage.cpp:
            (WebCore::BitmapImage::destroyMetadataAndNotify): Use long long casting when calling ImageObserver::decodedSizeChanged().
            (WebCore::BitmapImage::cacheFrame): Do not create the NativeImage if adding its frameByes to the MemoryCache will cause numerical overflow.
            (WebCore::BitmapImage::didDecodeProperties): Use long long casting.
            (WebCore::BitmapImage::frameImageAtIndex): Use long long casting when calling ImageObserver::decodedSizeChanged().
            * platform/graphics/ImageObserver.h:
            * platform/graphics/cg/PDFDocumentImage.cpp:
            (WebCore::PDFDocumentImage::decodedSizeChanged): Use long long casting when calling ImageObserver::decodedSizeChanged().

2016-10-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207547. rdar://problem/28810755

    2016-10-19  Zalan Bujtas  <zalan@apple.com>

            Use anonymous table row for new child at RenderTableRow::addChild() if available.
            https://bugs.webkit.org/show_bug.cgi?id=163651
            <rdar://problem/28705022>

            Reviewed by David Hyatt.

            We should try to prevent the continuation siblings from getting separated and inserted into
            wrapper renderers. It makes finding these continuation siblings difficult.
            This patch adds a checks for anonymous table rows so that we could find a closer common ancestor of
            beforeChild/new child.

            Test: fast/table/crash-when-table-has-continuation-and-content-inserted.html

            * rendering/RenderObject.cpp:
            (WebCore::RenderObject::showRenderObject): Add continuation information.
            * rendering/RenderTableRow.cpp:
            (WebCore::RenderTableRow::addChild):

2016-10-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207804. rdar://problem/28849628

    2016-10-24  Zalan Bujtas  <zalan@apple.com>

            Do not update selection rect on dirty lineboxes.
            https://bugs.webkit.org/show_bug.cgi?id=163862
            <rdar://problem/28813156>

            Reviewed by Simon Fraser.

            In certain cases RenderBlock::updateFirstLetter() triggers
            unwanted render tree mutation while the caller assumes intact renderers.
            This patch ensures that no renderers gets destroyed while computing the preferred widths
            when we are outside of layout context.

            Test: fast/css-generated-content/dynamic-first-letter-selection-clear-crash.html

            * rendering/RenderBlock.cpp:
            (WebCore::RenderBlock::computePreferredLogicalWidths):
            (WebCore::RenderBlock::updateFirstLetter):
            * rendering/RenderBlock.h:
            * rendering/RenderListItem.cpp:
            (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):
            * rendering/RenderRubyRun.cpp:
            (WebCore::RenderRubyRun::updateFirstLetter):
            * rendering/RenderRubyRun.h:
            * rendering/RenderTable.cpp:
            (WebCore::RenderTable::updateFirstLetter):
            * rendering/RenderTable.h:
            * rendering/svg/RenderSVGText.cpp:
            (WebCore::RenderSVGText::updateFirstLetter):
            * rendering/svg/RenderSVGText.h:

2016-10-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207683. rdar://problem/28849627

    2016-10-21  Zalan Bujtas  <zalan@apple.com>

            Do not mutate the render tree while collecting selection repaint rects.
            https://bugs.webkit.org/show_bug.cgi?id=163800
            <rdar://problem/28806886>

           Reviewed by David Hyatt.

           RenderListItem not only mutates the tree while in layout but it also uses
           the old descendant context to find the insertion point.
           This patch strictly ensures that we only do it while in layout and never
           in other cases such as collecting repaint rects.
           This gets redundant when webkit.org/b/163789 is fixed.

           Test: fast/lists/crash-when-list-marker-is-moved-during-selection.html

           * rendering/RenderListItem.cpp:
           (WebCore::RenderListItem::insertOrMoveMarkerRendererIfNeeded):

2016-03-15  Zalan Bujtas  <zalan@apple.com>

        Delay HTMLFormControlElement::focus() call until after layout is finished.
        https://bugs.webkit.org/show_bug.cgi?id=155503
        <rdar://problem/24046635>

        Reviewed by Simon Fraser.

        Calling focus on a form element can trigger arbitrary JS code which could interfere with
        the ongoing layout. 
        This patch delays HTMLFormControlElement::focus() call until after layout is finished.
        If we are currently not in the middle of a layout, HTMLFormControlElement::focus() is delayed until
        after style resolution is done. 

        Covered by LayoutTests/fast/dom/adopt-node-crash-2.html

        * accessibility/AccessibilityObject.cpp:
        (WebCore::AccessibilityObject::updateBackingStore):
        * dom/Document.cpp:
        (WebCore::Document::updateStyleIfNeeded):
        (WebCore::Document::updateLayout):
        (WebCore::Document::updateLayoutIfDimensionsOutOfDate):
        * html/HTMLEmbedElement.cpp:
        (WebCore::HTMLEmbedElement::renderWidgetLoadingPlugin):
        * html/HTMLFormControlElement.cpp:
        (WebCore::HTMLFormControlElement::didAttachRenderers):
        * page/FrameView.cpp:
        (WebCore::FrameView::layout):
        (WebCore::FrameView::queuePostLayoutCallback):
        (WebCore::FrameView::flushPostLayoutTasksQueue):
        (WebCore::FrameView::performPostLayoutTasks):
        (WebCore::FrameView::sendResizeEventIfNeeded):
        * page/FrameView.h:
        * rendering/RenderBox.cpp:
        (WebCore::RenderBox::imageChanged):
        * rendering/RenderLayer.cpp:
        (WebCore::RenderLayer::scrollTo):

2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205786. rdar://problem/28476956

    2016-09-10  Chris Dumez  <cdumez@apple.com>

            It is possible for Document::m_frame pointer to become stale
            https://bugs.webkit.org/show_bug.cgi?id=161812
            <rdar://problem/27745023>

            Reviewed by Ryosuke Niwa.

            Document::m_frame is supposed to get cleared by Document::prepareForDestruction().
            The Frame destructor calls Frame::setView(nullptr) which is supposed to call the
            prepareForDestruction() on the Frame's associated document. However,
            Frame::setView(nullptr) was calling prepareForDestruction() only if
            Document::inPageCache() returned true. This is because, we allow Documents to
            stay alive in the PageCache even though they don't have a frame.

            The issue is that Document::m_inPageCache flag was set to true right before
            firing the pagehide event, so technically before really entering PageCache.
            Therefore, we can run into problems if a Frame gets destroyed by a pagehide
            EventHandler because ~Frame() will not call Document::prepareForDestruction()
            due to Document::m_inPageCache being true. After the frame is destroyed,
            Document::m_frame becomes stale and any action on the document will likely
            lead to crashes (such as the one in the layout test and the radar which
            happens when trying to unregister event listeners from the document).

            The solution adopted in this patch is to replace the m_inPageCache boolean
            with a m_pageCacheState enumeration that has 3 states:
            - NotInPageCache
            - AboutToEnterPageCache
            - InPageCache

            Frame::setView() / Frame::setDocument() were then updated to call
            Document::prepareForDestruction() on the associated document whenever
            the document's pageCacheState is not InPageCache. This means that we
            will now call Document::prepareForDestruction() when the document is
            being detached from its frame while firing the pagehide event.

            Note that I tried to keep this patch minimal. Therefore, I kept
            the Document::inPageCache() getter for now. I plan to switch all its
            calls sites to the new Document::pageCacheState() getter in a follow-up
            patch so that we can finally drop the confusing Document::inPageCache().

            Test: fast/history/pagehide-remove-iframe-crash.html

            * dom/Document.cpp:
            (WebCore::Document::Document):
            (WebCore::Document::~Document):
            (WebCore::Document::createRenderTree):
            (WebCore::Document::destroyRenderTree):
            (WebCore::Document::setFocusedElement):
            (WebCore::Document::setPageCacheState):
            (WebCore::Document::topDocument):
            * dom/Document.h:
            (WebCore::Document::pageCacheState):
            (WebCore::Document::inPageCache):
            * history/CachedFrame.cpp:
            (WebCore::CachedFrame::destroy):
            * history/PageCache.cpp:
            (WebCore::setPageCacheState):
            (WebCore::PageCache::addIfCacheable):
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::stopAllLoaders):
            (WebCore::FrameLoader::open):
            * loader/HistoryController.cpp:
            (WebCore::HistoryController::invalidateCurrentItemCachedPage):
            * page/Frame.cpp:
            (WebCore::Frame::setView):

2016-01-26  Chris Dumez  <cdumez@apple.com>

        Make sure a page is still PageCache-able after firing the 'pagehide' events
        https://bugs.webkit.org/show_bug.cgi?id=153449

        Reviewed by Andreas Kling.

        Make sure a page is still PageCache-able after firing the 'pagehide'
        events and abort if it isn't. This should improve robustness and it is
        easy for pagehide event handlers to do things that would make a Page no
        longer PageCache-able and this leads to bugs that are difficult to
        investigate.

        To achieve this, the 'pagehide' event firing logic was moved out of the
        CachedFrame constructor. It now happens earlier in
        PageCache::addIfCacheable() after checking if the page is cacheable and
        before constructing the CachedPage / CachedFrames. After firing the
        'pagehide' event in PageCache::addIfCacheable(), we check again that
        the page is still cacheable and we abort early if it is not.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        * history/PageCache.cpp:
        (WebCore::setInPageCache):
        (WebCore::firePageHideEventRecursively):
        (WebCore::PageCache::addIfCacheable):
        * history/PageCache.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):

2016-01-22  Chris Dumez  <cdumez@apple.com>

        Document.open / Document.write should be prevented while the document is being unloaded
        https://bugs.webkit.org/show_bug.cgi?id=153255
        <rdar://problem/22741293>

        Reviewed by Ryosuke Niwa.

        Document.open / Document.write should be prevented while the document
        is being unloaded, as per the HTML specification:
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)
        - https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)

        This patch is aligning our behavior with the specification and Firefox.
        Calling Document.open / Document.write during the document was being
        unloaded would cause us to crash as this was unexpected.

        Tests: fast/frames/page-hide-document-open.html
               fast/frames/page-unload-document-open.html

        * WebCore.xcodeproj/project.pbxproj:
        Add new IgnoreOpensDuringUnloadCountIncrementer.h header.

        * dom/Document.cpp:
        (WebCore::Document::open):
        Abort if the document's ignore-opens-during-unload counter is greater
        than zero, as per:
        https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-open (step 6)

        (WebCore::Document::write):
        Abort if the insertion point is undefined and the document's
        ignore-opens-during-unload counter is greater than zero, as per:
        https://html.spec.whatwg.org/multipage/webappapis.html#dom-document-write (step 3)

        * dom/Document.h:
        Add data member to maintain the document's ignore-opens-during-unload counter:
        https://html.spec.whatwg.org/multipage/webappapis.html#ignore-opens-during-unload-counter

        * dom/IgnoreOpensDuringUnloadCountIncrementer.h: Added.
        Add utility class to increment / decrement a document's
        ignore-opens-during-unload counter.

        * history/CachedFrame.cpp:
        (WebCore::CachedFrame::CachedFrame):
        When a page goes into PageCache, we don't end up calling
        FrameLoader::detachChildren() so we need to increment the document's
        ignore-opens-during-unload counter before calling stopLoading() on each
        subframe.

        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::detachChildren):
        detachChildren() will end up firing the pagehide / unload events in each
        child frame so we increment the parent frame's document's
        ignore-opens-during-unload counter. This behavior matches the text of:
        https://html.spec.whatwg.org/multipage/browsers.html#unload-a-document

        As per the spec, the document's ignore-opens-during-unload counter should
        be incremented before firing the pagehide / unload events at the document's
        Window object. It should be decremented only after firing the pagehide /
        unload events in each subframe. This is needed in case a subframe tries to
        call document.open / document.write on a parent frame's document, from its
        pagehide or unload handler.

        (WebCore::FrameLoader::dispatchUnloadEvents):
        Increment the document's ignore-opens-during-unload counter before firing
        the pagehide / unload events and decrement it after. As per the spec, we
        are not supposed to decrement this early. We actually supposed to wait
        until the pagehide / unload events have been fired in all the subframes.
        For this reason, we take care of re-incrementing the document's
        ignore-opens-during-unload in detachChildren(), which will take care of
        firing the pagehide / unload in the subframes.

2015-08-10  Chris Dumez  <cdumez@apple.com>

        Simplify code for making Page-cacheability decision
        https://bugs.webkit.org/show_bug.cgi?id=147829

        Reviewed by Antti Koivisto.

        Simplify code for making Page-cacheability decision by merging logging
        code and decision making code. Having the same checks in two places was
        redundant and error-prone as we needed to keep them in sync.

        Also get rid of failure reason enum values as those have not been used
        in a while.

        * history/PageCache.cpp:
        (WebCore::canCacheFrame):
        (WebCore::canCachePage):
        (WebCore::PageCache::canCache):
        (WebCore::logPageCacheFailureDiagnosticMessage): Deleted.
        (WebCore::PageCache::singleton): Deleted.
        (WebCore::PageCache::setMaxSize): Deleted.
        (WebCore::PageCache::frameCount): Deleted.
        (WebCore::PageCache::markPagesForVisitedLinkStyleRecalc): Deleted.
        (WebCore::PageCache::markPagesForFullStyleRecalc): Deleted.
        (WebCore::PageCache::markPagesForDeviceOrPageScaleChanged): Deleted.
        (WebCore::PageCache::markPagesForContentsSizeChanged): Deleted.
        (WebCore::PageCache::markPagesForCaptionPreferencesChanged): Deleted.
        (WebCore::pruningReasonToDiagnosticLoggingKey): Deleted.
        * page/DiagnosticLoggingKeys.cpp:
        (WebCore::DiagnosticLoggingKeys::isDisabledKey):
        (WebCore::DiagnosticLoggingKeys::redirectKey):
        (WebCore::DiagnosticLoggingKeys::replaceKey):
        (WebCore::DiagnosticLoggingKeys::sourceKey):
        (WebCore::DiagnosticLoggingKeys::underMemoryPressureKey):
        (WebCore::DiagnosticLoggingKeys::reloadFromOriginKey): Deleted.
        * page/DiagnosticLoggingKeys.h:

2015-12-12  Katlyn Graff  <kgraff@apple.com>

        Safari background tabs should be fully suspended where possible.
        https://bugs.webkit.org/show_bug.cgi?id=150515

        Reviewed by Ryosuke Niwa.

        Support for tab suspension for Mac, enabled by defaults writing to WebKitTabSuspension.
        Page-down suspension consolidated with PageCache suspension code in Document::
        suspend and Document::resume. Pages canTabSuspend if cacheable, nonvisible, nonprerender,
        and nonactive.

        * dom/Document.cpp: moved scrollbar handling from setInPageCache to suspend/resume
        (WebCore::Document::suspend): moved scrollbar, dom, animation, timer, and visual update suspending into here
        (WebCore::Document::resume): moved scrollbar, dom, animation, timer, and visual update resuming into here
        * dom/Document.h: added m_isSuspended to prevent repeat calls from PageCache/Tab Suspension contention
        * history/CachedFrame.cpp: moved dom, animation, and timer suspension into Document::suspend
        (WebCore::CachedFrame::CachedFrame):
       * history/PageCache.cpp: Added a few nullchecks to prevent crashes if canCacheFrame is called but document is null
        (WebCore::PageCache::canCacheFrame):
        * page/Page.cpp:
        (WebCore::Page::Page): Added timer to fire delayed suspension
        (WebCore::Page::setPageActivityState): Added a call to schedule tab suspension
        (WebCore::Page::setIsVisibleInternal): Added a call to schedule tab suspension
        (WebCore::Page::canTabSuspend): Added support for suspending if cacheable, nonvisible, nonprerender, and nonactive
        (WebCore::Page::setIsTabSuspended): Added a function to suspend or resume tabs
        (WebCore::Page::setTabSuspensionEnabled): Added support for a defaults write enable
        (WebCore::Page::scheduleTabSuspension): Added ability to schedule the suspension timer to fire or resume
        (WebCore::Page::timerFired): Added a suspension timer
        * page/Page.h:
        * page/PageThrottler.h:
        (WebCore::PageThrottler::activityState): Added access to m_activityState for canTabSuspend

2015-11-20  Katlyn Graff  <kgraff@apple.com>

        Renaming PageCache suspension code to support more reasons for suspension.
        https://bugs.webkit.org/show_bug.cgi?id=151527

        Reviewed by Ryosuke Niwa.

        No new tests because this is simply a refactor.

        Renamed Element:: and Document:: documentWillSuspendForPageCache(),
        documentDidResumeFromPageCache(),
        registerForPageCacheSuspensionCallbacks(),
        unregisterForPageCacheSuspensionCallbacks() to prepare to support
        alternate reasons for document-level suspension.

        * dom/Document.cpp:
        (WebCore::Document::suspend):
        (WebCore::Document::resume):
        (WebCore::Document::registerForDocumentSuspensionCallbacks):
        (WebCore::Document::unregisterForDocumentSuspensionCallbacks):
        (WebCore::Document::documentWillSuspendForPageCache): Deleted.
        (WebCore::Document::documentDidResumeFromPageCache): Deleted.
        (WebCore::Document::registerForPageCacheSuspensionCallbacks): Deleted.
        (WebCore::Document::unregisterForPageCacheSuspensionCallbacks): Deleted.
        * dom/Document.h:
        * dom/Element.h:
        (WebCore::Element::prepareForDocumentSuspension):
        (WebCore::Element::resumeFromDocumentSuspension):
        (WebCore::Element::documentWillSuspendForPageCache): Deleted.
        (WebCore::Element::documentDidResumeFromPageCache): Deleted.
        * history/CachedFrame.cpp:
        (WebCore::CachedFrameBase::restore):
        (WebCore::CachedFrame::CachedFrame):
        * html/HTMLFormElement.cpp:
        (WebCore::HTMLFormElement::~HTMLFormElement):
        (WebCore::HTMLFormElement::parseAttribute):
        (WebCore::HTMLFormElement::resumeFromDocumentSuspension):
        (WebCore::HTMLFormElement::didMoveToNewDocument):
        (WebCore::HTMLFormElement::documentDidResumeFromPageCache): Deleted.
        * html/HTMLFormElement.h:
        * html/HTMLInputElement.cpp:
        (WebCore::HTMLInputElement::~HTMLInputElement):
        (WebCore::HTMLInputElement::registerForSuspensionCallbackIfNeeded):
        (WebCore::HTMLInputElement::unregisterForSuspensionCallbackIfNeeded):
        (WebCore::HTMLInputElement::resumeFromDocumentSuspension):
        (WebCore::HTMLInputElement::prepareForDocumentSuspension):
        (WebCore::HTMLInputElement::didMoveToNewDocument):
        (WebCore::HTMLInputElement::documentDidResumeFromPageCache): Deleted.
        (WebCore::HTMLInputElement::documentWillSuspendForPageCache): Deleted.
        * html/HTMLInputElement.h:
        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::registerWithDocument):
        (WebCore::HTMLMediaElement::unregisterWithDocument):
        (WebCore::HTMLMediaElement::prepareForDocumentSuspension):
        (WebCore::HTMLMediaElement::resumeFromDocumentSuspension):
        (WebCore::HTMLMediaElement::documentWillSuspendForPageCache): Deleted.
        (WebCore::HTMLMediaElement::documentDidResumeFromPageCache): Deleted.
        * html/HTMLMediaElement.h:
        * html/HTMLPlugInImageElement.cpp:
        (WebCore::HTMLPlugInImageElement::~HTMLPlugInImageElement):
        (WebCore::HTMLPlugInImageElement::createElementRenderer):
        (WebCore::HTMLPlugInImageElement::didMoveToNewDocument):
        (WebCore::HTMLPlugInImageElement::prepareForDocumentSuspension):
        (WebCore::HTMLPlugInImageElement::resumeFromDocumentSuspension):
        (WebCore::HTMLPlugInImageElement::documentWillSuspendForPageCache): Deleted.
        (WebCore::HTMLPlugInImageElement::documentDidResumeFromPageCache): Deleted.
        * html/HTMLPlugInImageElement.h:
        * loader/FrameLoader.cpp:
        (WebCore::FrameLoader::commitProvisionalLoad):
        * svg/SVGSVGElement.cpp:
        (WebCore::SVGSVGElement::SVGSVGElement):
        (WebCore::SVGSVGElement::~SVGSVGElement):
        (WebCore::SVGSVGElement::didMoveToNewDocument):
        (WebCore::SVGSVGElement::prepareForDocumentSuspension):
        (WebCore::SVGSVGElement::resumeFromDocumentSuspension):
        (WebCore::SVGSVGElement::documentWillSuspendForPageCache): Deleted.
        (WebCore::SVGSVGElement::documentDidResumeFromPageCache): Deleted.
        * svg/SVGSVGElement.h:

2016-09-16  Babak Shafiei  <bshafiei@apple.com>

        Merge r206006. rdar://problem/27991573

    2016-09-15  Brady Eidson  <beidson@apple.com>

            WKWebView.hasOnlySecureContent always returns "YES" after going back to a CachedPage (even if it has http resources).
            <rdar://problem/27681261> and https://bugs.webkit.org/show_bug.cgi?id=162043

            Reviewed by Brent Fulgham.

            No new tests (Not possible with current testing infrastructure).

            This adds the infrastructure for WebCore to track whether or not a CachedFrame had insecure content at the time
            it was cached, and then to report that back to the client when a CachedPage is restored.

            Since "has insecure content" is currently only tracked in the WK2 UI process, that is the only client of this code.

            * history/CachedFrame.cpp:
            (WebCore::CachedFrame::setHasInsecureContent):
            * history/CachedFrame.h:
            (WebCore::CachedFrame::hasInsecureContent):

            * loader/EmptyClients.h:

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::receivedFirstData):
            (WebCore::FrameLoader::commitProvisionalLoad):
            (WebCore::FrameLoader::dispatchDidCommitLoad):
            * loader/FrameLoader.h:

            * loader/FrameLoaderClient.h:

            * loader/FrameLoaderTypes.h:

2017-03-30  Eric Carlson  <eric.carlson@apple.com>

        [Crash] WebCore::AudioBuffer::AudioBuffer don't checking illegal value
        https://bugs.webkit.org/show_bug.cgi?id=169956

        Reviewed by Youenn Fablet.

        Test: webaudio/audiobuffer-crash.html

        * Modules/webaudio/AudioBuffer.cpp:
        (WebCore::AudioBuffer::AudioBuffer): Invalidate the object and return early if the channel 
        array allocation fails.
        (WebCore::AudioBuffer::AudioBuffer): Ditto.
        (WebCore::AudioBuffer::invalidate): Invalidate the object.
        * Modules/webaudio/AudioBuffer.h:

2017-01-24  Miguel Gomez  <magomez@igalia.com>

        [GTK] Do not paint non composited content into the window when using the threaded compositor
        https://bugs.webkit.org/show_bug.cgi?id=167367

        Reviewed by Carlos Garcia Campos.

        When using the threaded compositor we need to send the non composited content for compositing as well,
        not painting it directly into the window.

        No new tests.

        * rendering/RenderLayerBacking.cpp:
        (WebCore::RenderLayerBacking::paintsIntoWindow):

2016-10-27  Myles C. Maxfield  <mmaxfield@apple.com>

        [macOS] [WebGL2] Temporarily upgrade WebGL 2's internal OpenGL context from version 2.1 to 3.2
        https://bugs.webkit.org/show_bug.cgi?id=164091

        Reviewed by Dean Jackson.

        In order to test WebGL2 correctly, I had to upgrade the macOS's OpenGL 
        context to a 3.2-compatible context to make sure the new symbols are
        accepted. Eventually, this 3.2-compatible context will have to be
        reverted and replaced with an ANGLE context. The current 3.2-compatible
        context is just for testing.

        Test: fast/canvas/webgl/webgl2-context-creation.html

        * html/canvas/WebGLBuffer.cpp: Use "nullptr" instead of 0.
        (WebCore::WebGLBuffer::associateBufferData):
        * html/canvas/WebGLRenderingContextBase.cpp: Use make_unique() instead
        of the unique_ptr constructor.
        (WebCore::WebGLRenderingContextBase::create):
        * platform/graphics/GraphicsContext3D.h: GraphicsContext should know
        if it is using a 3.2-compatible context because some parts of 2.1 are
        removed in these contexts, and replaced with new things which aren't
        in 2.1.
        * platform/graphics/mac/GraphicsContext3DMac.mm:
        (WebCore::setPixelFormat): Use kCGLPFAOpenGLProfile to specify an
        OpenGL 3.2 context.
        (WebCore::GraphicsContext3D::GraphicsContext3D): GL_CLAMP is deprecated
        in OpenGL 3.2. Fortunately, GL_CLAMP_TO_EDGE isn't deprecated and does
        exactly what we want. In OpenGL3.2, point sprites are always enabled,
        so there's no need to enable them in those contexts.
        (WebCore::GraphicsContext3D::isGLES2Compliant):
        * platform/graphics/opengl/Extensions3DOpenGL.cpp: In OpenGL 3.2,
        glGetString() no longer accepts GL_EXTENSIONS. Instead, glGetStringi()
        is used instead. Unfortunately, glGetString() is not available in
        OpenGL 2.1 contexts, so we need to use one or the other based on the
        version of the context we're using.
        (WebCore::Extensions3DOpenGL::Extensions3DOpenGL):
        (WebCore::Extensions3DOpenGL::getExtensions):
        * platform/graphics/opengl/Extensions3DOpenGL.h:
        * platform/graphics/opengl/Extensions3DOpenGLCommon.cpp:
        (WebCore::Extensions3DOpenGLCommon::Extensions3DOpenGLCommon):
        (WebCore::Extensions3DOpenGLCommon::initializeAvailableExtensions):
        Instead of modifying getExtensions() to use glGetStringi(), it makes
        better sense to modify this function because getExtensions() returns
        a string. Building up a string just to split it up again is silly, so
        modifying this function instead makes more sense.
        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
        (WebCore::GraphicsContext3D::getIntegerv): GL_MAX_VARYING_FLOATS is
        removed in OpenGL 3.2 contexts. However, it is replaced by
        GL_MAX_VARYING_COMPONENTS, though this is deprecated but not removed.
        In the more recent OpenGL context versions, GL_MAX_VARYING_VECTORS is
        recommended instead, but that isn't available in OpenGL 3.2.
        (WebCore::GraphicsContext3D::getExtensions):

2016-10-28  Alex Christensen  <achristensen@webkit.org>

        Fix Windows WebGL build after r208022
        https://bugs.webkit.org/show_bug.cgi?id=164091

        * platform/graphics/opengl/Extensions3DOpenGLCommon.h:
        * platform/graphics/opengl/Extensions3DOpenGLES.cpp:
        (WebCore::Extensions3DOpenGLES::Extensions3DOpenGLES):
        * platform/graphics/opengl/Extensions3DOpenGLES.h:
        * platform/graphics/opengl/GraphicsContext3DOpenGLES.cpp:
        (WebCore::GraphicsContext3D::getExtensions):

2017-05-17  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r216978. rdar://problem/31971195

    2017-05-17  Ryosuke Niwa  <rniwa@webkit.org>

            getElementById can return a wrong elemnt when a matching element is removed during beforeload event
            https://bugs.webkit.org/show_bug.cgi?id=171374

            Reviewed by Brent Fulgham.

            The bug was caused by HTMLLinkElement firing beforeload event inside insertedInto before the tree state is updated.
            Delay the event dispatch to the post insertion callback.

            Test: fast/html/link-element-removal-during-beforeload.html

            * html/HTMLLinkElement.cpp:
            (WebCore::HTMLLinkElement::insertedInto):
            (WebCore::HTMLLinkElement::finishedInsertingSubtree):
            * html/HTMLLinkElement.h:

2017-05-17  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r216813. rdar://problem/31971160

    2017-05-12  Jiewen Tan  <jiewen_tan@apple.com>

            Elements should be inserted into a template element as its content's last child
            https://bugs.webkit.org/show_bug.cgi?id=171373
            <rdar://problem/31862949>

            Reviewed by Ryosuke Niwa.

            Before this change, our HTML parser obeys the following premises:
            1) A fostering child whose parent is a table should be inserted before its parent and under its grandparent.
            2) When inserting into a template element, an element should be inserted into its content.

            Let's walk through the example:
            a) Before eventhandler takes place
            template
            table
                svg <- parser
            b) After eventhandler takes place
            template
                table
                    svg <- parser
            c) after parsing svg
            template
                content
                    svg
                    (table)
                table

            Finally, in the example, the svg element will be inserted into the content of the template element while
            having its next sibling point to the table element. However, the table element is actually under the
            template element not its content.

            This messy tree is constructed because the second premise is incompleted. It should be: When inserting into
            a template element, an element should be inserted into its content as its last child.
            Quoted from Step 3 of https://html.spec.whatwg.org/multipage/syntax.html#appropriate-place-for-inserting-a-node
            A correct tree will then looks like:
            template
                content
                    svg
                table

            Tests: fast/dom/HTMLTemplateElement/insert-fostering-child-crash.html
                   fast/dom/HTMLTemplateElement/insert-fostering-child.html

            * html/parser/HTMLConstructionSite.cpp:
            (WebCore::insert):
            By nullifying task.nextChild, it will force the parser to append the element as task.parent's last child.

2017-05-09  Matthew Hanson  <matthew_hanson@apple.com>

        Cherry-pick r216131. rdar://problem/31967895

    2017-05-03  Zalan Bujtas  <zalan@apple.com>

            RenderSearchField should not use isTextField() in SPECIALIZE_TYPE_TRAITS_RENDER_OBJECT
            https://bugs.webkit.org/show_bug.cgi?id=171608

            Reviewed by Simon Fraser.

            isTextField() is true for any generic single line text control.

            * rendering/RenderObject.h:
            (WebCore::RenderObject::isSearchField):
            * rendering/RenderSearchField.h:

2017-05-09  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r216443. rdar://problem/31971375

    2017-05-04  Jiewen Tan  <jiewen_tan@apple.com>

            Search events should not fire synchronously for search type input elements with incremental attribute set
            https://bugs.webkit.org/show_bug.cgi?id=171376
            <rdar://problem/31863296>

            Reviewed by Chris Dumez.

            For some reasons, we fire search events immediately for search type input elements with incremental
            attribute set only when the length of the input equals to zero. This behaviour should be prevented
            as event listeners in the middle might perform unexpectedly.

            Test: fast/forms/search/search-incremental-crash.html

            * html/SearchInputType.cpp:
            (WebCore::SearchInputType::startSearchEventTimer):

2017-05-09  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r216159. rdar://problem/31971329

    2017-05-03  Zalan Bujtas  <zalan@apple.com>

            SearchInputType could end up with a mismatched renderer.
            https://bugs.webkit.org/show_bug.cgi?id=171547
            <rdar://problem/31935047>

            Reviewed by Antti Koivisto.

            Normally we've got the correct renderer by the time we call into SearchInputType.
            However, since HTMLInputElement::updateType() eagerly updates the type while the associated renderers are done lazily
            (so we don't get them updated until after the next tree update), we could actually end up
            with a mismatched renderer (e.g. through form submission).

            Test: fast/forms/change-input-type-and-submit-form-crash.html

            * html/SearchInputType.cpp:
            (WebCore::SearchInputType::addSearchResult):
            (WebCore::SearchInputType::didSetValueByUserEdit):

2017-05-09  Matthew Hanson  <matthew_hanson@apple.com>

        Cherry-pick r216120. rdar://problem/31970955

    2017-05-03  Daniel Bates  <dabates@apple.com>

            Abandon the current load once the provisional loader detaches from the frame
            https://bugs.webkit.org/show_bug.cgi?id=171577
            <rdar://problem/31581227>

            Reviewed by Brent Fulgham and Brady Eidson.

            We detach all child frames as part of setting our document loader to the provisional
            document loader when committing a load for a frame. Detaching child frames invokes
            the unload event handler on the child frames that can run arbitrary JavaScript script.
            Among other things, such script can initiate a new load in the frame whose current
            load is being committed. We should stop processing the current load as soon as we
            detect that updating our document loader has started a new provisional load.

            Test: fast/loader/inner-iframe-loads-data-url-into-parent-on-unload-crash.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::transitionToCommitted):

2017-05-09  Matthew Hanson  <matthew_hanson@apple.com>

        Cherry-pick r216023. rdar://problem/31971371

    2017-05-01  Chris Dumez  <cdumez@apple.com>

            Do not dispatch SVG load event in frameless documents
            https://bugs.webkit.org/show_bug.cgi?id=171505
            <rdar://problem/31799776>

            Reviewed by Andreas Kling.

            We should not dispatch SVG load events in frameless documents. <https://trac.webkit.org/changeset/173028/webkit>
            took care of most load events but forgot the SVG load event.

            Test: fast/dom/domparser-parsefromstring-svg-load-event.html

            * dom/Document.cpp:
            (WebCore::Document::implicitClose):

2017-04-11  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick 214358. rdar://problem/31502340

    2017-03-24  Alex Christensen  <achristensen@webkit.org>

            REGRESSION: Content Blocker: Blocking "a[href*=randomString]" doesn't work
            https://bugs.webkit.org/show_bug.cgi?id=169167

            Reviewed by Simon Fraser.

            When testing content extensions, we have always called an API function that internally
            has called AtomicString::init somewhere before we start compiling the content extension.
            On iOS, though, we call [_WKUserContentExtensionStore compileContentExtensionForIdentifier:...]
            without having already called anything that calls AtomicString::init.  The new CSS parser is now
            failing to parse some selectors because CSSSelectorParser::defaultNamespace is returning starAtom,
            which is a null atomic string before AtomicString::init is called.

            Covered by a new API test.

            * contentextensions/ContentExtensionParser.cpp:
            (WebCore::ContentExtensions::isValidCSSSelector):
            (WebCore::ContentExtensions::loadAction):
            (WebCore::ContentExtensions::isValidSelector): Deleted.
            * contentextensions/ContentExtensionParser.h:
            Call AtomicString::init before checking if a css selector is valid.

2017-04-03  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r214703. rdar://problem/31407633

    2017-03-31  Simon Fraser  <simon.fraser@apple.com>

            Rename DOMWindow's m_touchEventListenerCount to m_touchAndGestureEventListenerCount
            https://bugs.webkit.org/show_bug.cgi?id=170371

            Reviewed by Tim Horton.

            This count tracks touch and gesture event listeners, so name it appropriately.

            * page/DOMWindow.cpp:
            (WebCore::DOMWindow::addEventListener):
            (WebCore::DOMWindow::removeEventListener):
            (WebCore::DOMWindow::removeAllEventListeners):
            * page/DOMWindow.h:

2017-04-03  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r214702. rdar://problem/31407633

    2017-03-31  Simon Fraser  <simon.fraser@apple.com>

            When destroying a Node, assert that it's been removed from all the touch handler maps
            https://bugs.webkit.org/show_bug.cgi?id=170363
            rdar://problem/31377469

            Reviewed by Tim Horton.

            Assert that the Node has been removed from the touch handler maps in all documents on destruction.

            * dom/Document.h:
            (WebCore::Document::hasTouchEventHandlers):
            (WebCore::Document::touchEventTargetsContain):
            * dom/Node.cpp:
            (WebCore::Node::~Node):

2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210369. rdar://problem/29100419

    2017-01-05  Zalan Bujtas  <zalan@apple.com>

            Mark the dedicated root linebox for trailing floats in empty inlines dirty.
            https://bugs.webkit.org/show_bug.cgi?id=166732
            <rdar://problem/29100419>

            Reviewed by Antti Koivisto.

            We normally attach floating boxes to the last root linebox. However when the floatbox is preceded by a <br>
            we generate a dedicated root linebox (TrailingFloatsRootInlineBox) for the floatbox.
            When this floatbox is a RenderInline descendant and this RenderInline does not generate lineboxes (it's ancestor RenderBlockFlow does)
            we have to make sure that this special root linebox gets marked dirty when the associated floatbox changes.
            (Unfortunately through the recursive calls on dirtyLinesFromChangedChild(), we lose the information about
            the "changed child" since the inlines propagates the marking logic to the RenderBlockFlow, see FIXME.)

            Test: fast/inline/trailing-floats-inline-crash2.html

            * rendering/RenderLineBoxList.cpp:
            (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

2017-04-03  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r214648. rdar://problem/31408453

    2017-03-30  Simon Fraser  <simon.fraser@apple.com>

            Minor cleanup checking for gesture event names
            https://bugs.webkit.org/show_bug.cgi?id=170319

            Reviewed by Tim Horton.

            Just use isGestureEventType() in a couple of places.

            * dom/Node.cpp:
            (WebCore::tryAddEventListener):
            (WebCore::tryRemoveEventListener):

2017-04-03  Jason Marcell  <jmarcell@apple.com>

        Cherry-pick r214640. rdar://problem/31408453

    2017-03-30  Simon Fraser  <simon.fraser@apple.com>

            Rename a touch event function, and new touch region test results
            https://bugs.webkit.org/show_bug.cgi?id=170309
            rdar://problem/31329520

            Reviewed by Chris Dumez.

            Adapt to a naming change in WebKitAdditions.

            * dom/Document.cpp:
            (WebCore::Document::removeAllEventListeners):
            * page/FrameView.cpp:
            (WebCore::FrameView::layout):
            * rendering/RenderElement.cpp:
            (WebCore::RenderElement::styleWillChange):
            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::scrollTo):
            (WebCore::RenderLayer::calculateClipRects):

2017-03-30  Jason Marcell  <jmarcell@apple.com>

        Merge r214392. rdar://problem/31356105

    2017-03-24  Daniel Bates  <dabates@apple.com>

            media/restore-from-page-cache.html causes NoEventDispatchAssertion::isEventAllowedInMainThread() assertion failure
            https://bugs.webkit.org/show_bug.cgi?id=170087
            <rdar://problem/31254822>

            Reviewed by Simon Fraser.

            Reduce the scope of code that should never dispatch DOM events so as to allow updating contents size
            after restoring a page from the page cache.

            In r214014 we instantiate a NoEventDispatchAssertion in FrameLoader::commitProvisionalLoad()
            around the call to CachedPage::restore() to assert when a DOM event is dispatched during
            page restoration as such events can cause re-entrancy into the page cache. As it turns out
            it is sufficient to ensure that no DOM events are dispatched after restoring all cached frames
            as opposed to after CachedPage::restore() returns.

            Also rename Document::enqueue{Pageshow, Popstate}Event() to dispatch{Pageshow, Popstate}Event(),
            respectively, since they synchronously dispatch events :(. We hope in the future to make them
            asynchronously dispatch events.

            * dom/Document.cpp:
            (WebCore::Document::implicitClose): Update for renaming.
            (WebCore::Document::statePopped): Ditto.
            (WebCore::Document::dispatchPageshowEvent): Renamed; formerly named enqueuePageshowEvent().
            (WebCore::Document::dispatchPopstateEvent): Renamed; formerly named enqueuePopstateEvent().
            (WebCore::Document::enqueuePageshowEvent): Deleted.
            (WebCore::Document::enqueuePopstateEvent): Deleted.
            * dom/Document.h:
            * history/CachedPage.cpp:
            (WebCore::firePageShowAndPopStateEvents): Moved logic from FrameLoader::didRestoreFromCachedPage() to here.
            (WebCore::CachedPage::restore): Modified to call firePageShowAndPopStateEvents().
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::commitProvisionalLoad): Removed use of NoEventDispatchAssertion RAII object. We
            will instantiate it in CachedPage::restore() with a smaller scope.
            (WebCore::FrameLoader::didRestoreFromCachedPage): Deleted; moved logic from here to WebCore::firePageShowAndPopStateEvents().
            * loader/FrameLoader.h:

2017-03-30  Jason Marcell  <jmarcell@apple.com>

        Merge r214510. rdar://problem/31356107

    2017-03-27  Brent Fulgham  <bfulgham@apple.com>

            Only attach Attributes to a given element one time
            https://bugs.webkit.org/show_bug.cgi?id=170125
            <rdar://problem/31279676>

            Reviewed by Chris Dumez.

            Attach the attribute node to the Element before calling 'setAttributeInternal', since that method may cause
            arbitrary JavaScript events to fire.

            Test: fast/dom/Attr/only-attach-attr-once.html

            * dom/Element.cpp:
            (WebCore::Element::attachAttributeNodeIfNeeded): Added.
            (WebCore::Element::setAttributeNode): Use new method. Revise to attach attribute before calling 'setAttributeInternal'.
            (WebCore::Element::setAttributeNodeNS): Ditto.
            * dom/Element.h:

2017-03-30  Jason Marcell  <jmarcell@apple.com>

        Merge r214086. rdar://problem/31356102

    2017-03-16  Dean Jackson  <dino@apple.com>

            WebGL: Improve index validation when using uint index values
            https://bugs.webkit.org/show_bug.cgi?id=169798

            Reviewed by Simon Fraser.

            Make sure that we test index validation with the correct type.
            Also stop using -1 in WebGLBuffer to indicate non-existant values.

            Test: fast/canvas/webgl/draw-elements-out-of-bounds-uint-index.html

            * html/canvas/WebGL2RenderingContext.cpp:
            (WebCore::WebGL2RenderingContext::validateIndexArrayConservative): Use optional<> and
            unsigned values.
            * html/canvas/WebGLBuffer.cpp: Use unsigned for maxIndex (they can't be negative)
            and optional<> to indicate unknown value.
            (WebCore::WebGLBuffer::getCachedMaxIndex):
            (WebCore::WebGLBuffer::setCachedMaxIndex):
            * html/canvas/WebGLBuffer.h:
            * html/canvas/WebGLRenderingContext.cpp:
            (WebCore::WebGLRenderingContext::validateIndexArrayConservative): Use optional<> and
            unsigned values.
            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::validateVertexAttributes): No need to check if
            an unsigned value is less than zero.

2017-03-29  Jason Marcell  <jmarcell@apple.com>

        Merge r214291. rdar://problem/30922110

    2017-03-22  Jiewen Tan  <jiewen_tan@apple.com>

            ASSERT_WITH_SECURITY_IMPLICATION hit when removing an <input type="range"> while dragging on iOS
            https://bugs.webkit.org/show_bug.cgi?id=165535
            <rdar://problem/29559749>

            Reviewed by Ryosuke Niwa.

            Utimately we should prevent SliderThumbElement::unregisterForTouchEvents() being called while
            updating render tree. A quick fix for this is to move dispatchFormControlChangeEvent for input
            from stopDragging up to the callers which really needs to dispatch this event, i.e., finishing
            dragging the slider. It is clear that not every caller of stopDragging wants to
            dispatchFormControlChangeEvent.

            Test: fast/forms/range/range-remove-on-drag.html

            * html/shadow/SliderThumbElement.cpp:
            (WebCore::SliderThumbElement::stopDragging):
            (WebCore::SliderThumbElement::defaultEventHandler):
            (WebCore::SliderThumbElement::handleTouchEndAndCancel):

2016-07-07  Antti Koivisto  <antti@apple.com>

        REGRESSION (r199054): CrashTracer: [USER] parseWebKit at WebCore: WebCore::RenderBlockFlow::checkFloatsInCleanLine + 107
        https://bugs.webkit.org/show_bug.cgi?id=159519

        Reviewed by Zalan Bujtas.

        Test: fast/inline/trailing-floats-inline-crash.html

        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::RenderBlockFlow::checkFloatsInCleanLine):

            Use the existing deletionHasBegun bit in RenderStyle to assert against this reliably.

        * rendering/RenderLineBoxList.cpp:
        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):

            In some cases a special TrailingFloatsRootInlineBox may be added as the last root linebox of a flow.
            If it is combined with br the existing invalidation that invalidates the next and previous line may
            not be sufficient. Test for this case and invalidate the TrailingFloatsRootInlineBox too if it exists.

        * rendering/RootInlineBox.h:
        (WebCore::RootInlineBox::isTrailingFloatsRootInlineBox):
        * rendering/TrailingFloatsRootInlineBox.h:
        * rendering/style/RenderStyle.h:
        (WebCore::RenderStyle::deletionHasBegun):

            Expose the bit in debug.

2017-03-28  Jason Marcell  <jmarcell@apple.com>

        Merge r214194. rdar://problem/31101594

    2017-03-20  Daniel Bates  <dabates@apple.com>

            Prevent new navigations from onbeforeunload handler
            https://bugs.webkit.org/show_bug.cgi?id=169891
            <rdar://problem/31155736>

            Reviewed by Ryosuke Niwa.

            Ensure that all navigations initiated from an onbeforeunload handler are disallowed
            regardless of how they were scheduled. Such navigations go against the expectation
            of a user.

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::isNavigationAllowed): Added.
            (WebCore::FrameLoader::loadURL): Modified code to call FrameLoader::isNavigationAllowed().
            (WebCore::FrameLoader::loadWithDocumentLoader): Ditto.
            (WebCore::FrameLoader::stopAllLoaders): Ditto.
            * loader/FrameLoader.h:

2017-03-28  Jason Marcell  <jmarcell@apple.com>

        Merge r214237. rdar://problem/31178134

    2017-03-21  Brady Eidson  <beidson@apple.com>

            Disable all virtual tables.
            <rdar://problem/31081972> and https://bugs.webkit.org/show_bug.cgi?id=169928

            Reviewed by Jer Noble.

            No new tests (Covered by changes to existing test).

            * Modules/webdatabase/DatabaseAuthorizer.cpp:
            (WebCore::DatabaseAuthorizer::createVTable):
            (WebCore::DatabaseAuthorizer::dropVTable):

2017-03-28  Jason Marcell  <jmarcell@apple.com>

        Merge r211645. rdar://problem/30922105

    2017-02-03  Chris Dumez  <cdumez@apple.com>

            Fix bad assertion under HTMLTreeBuilder::processStartTagForInBody()
            https://bugs.webkit.org/show_bug.cgi?id=167799
            <rdar://problem/30237241>

            Reviewed by Brent Fulgham.

            Fix bad assertion under HTMLTreeBuilder::processStartTagForInBody() that was
            expecting the root element to be an <html> element when parsing a <frameset>.
            While this assertion is true in theory and as per the specification, it does
            not hold in WebKit when parsing a DocumentFragment. This is because WebKit
            has an optimization causing us to have a DocumentFragment as root element
            when parsing a fragment. See the following constructor:
            "HTMLTreeBuilder(HTMLDocumentParser&, DocumentFragment&, Element&, ParserContentPolicy, const HTMLParserOptions&)"

            which has the following code:
            """
            // https://html.spec.whatwg.org/multipage/syntax.html#parsing-html-fragments
            // For efficiency, we skip step 5 ("Let root be a new html element with no attributes") and instead use the DocumentFragment as a root node.
            m_tree.openElements().pushRootNode(HTMLStackItem::create(fragment));
            """

            Update the assertion to expect a DocumentFragment as root element when parsing
            a fragment, and keep expecting an <html> element otherwise.

            Test: fast/parser/fragment-with-frameset-crash.html

            * html/parser/HTMLTreeBuilder.cpp:
            (WebCore::HTMLTreeBuilder::processStartTagForInBody):

2017-03-22  Jason Marcell  <jmarcell@apple.com>

        Merge r214125. rdar://problem/30921831

    2017-03-17  Said Abou-Hallawa  <sabouhallawa@apple.com>

            Time channel attack on SVG Filters
            https://bugs.webkit.org/show_bug.cgi?id=118689

            Reviewed by Simon Fraser.

            The time channel attack can happen if the attacker applies FEColorMatrix
            or FEConvolveMatrix and provides a matrix which is filled with subnormal
            floating point values. Performing floating-point operations on subnormals
            is very expensive unless the pixel in the source graphics is black (or
            zero). By measuring the time a filter takes to be applied, the attacker
            can know whether the pixel he wants to steal from  an iframe is black or
            white. By repeating the same process on all the pixels in the iframe, the
            attacker can reconstruct the whole page of the iframe.

            To fix this issue, the values in the matrices of these filters will clamped
            to FLT_MIN. We do not want to consume too much time calculating filtered
            pixels because of such tiny values. The difference between applying FLT_MIN
            and applying a subnormal should not be even noticeable. Normalizing the
            floating-point matrices should happen only at the beginning of the filter
            platformApplySoftware().

            * platform/graphics/filters/FEColorMatrix.cpp:
            (WebCore::FEColorMatrix::platformApplySoftware):
            * platform/graphics/filters/FEConvolveMatrix.cpp:
            (WebCore::FEConvolveMatrix::fastSetInteriorPixels):
            (WebCore::FEConvolveMatrix::fastSetOuterPixels):
            (WebCore::FEConvolveMatrix::platformApplySoftware):
            * platform/graphics/filters/FEConvolveMatrix.h:
            * platform/graphics/filters/FilterEffect.h:
            (WebCore::FilterEffect::normalizedFloats):

2017-03-21  Jason Marcell  <jmarcell@apple.com>

        Merge r214014. rdar://problem/30921815

    2017-03-15  Daniel Bates  <dabates@apple.com>

            Iteratively dispatch DOM events after restoring a cached page
            https://bugs.webkit.org/show_bug.cgi?id=169703
            <rdar://problem/31075903>

            Reviewed by Brady Eidson.

            Make dispatching of DOM events when restoring a page from the page cache symmetric with
            dispatching of events when saving a page to the page cache.

            * history/CachedFrame.cpp:
            (WebCore::CachedFrameBase::restore): Move code to dispatch events from here to FrameLoader::didRestoreFromCachedPage().
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::commitProvisionalLoad): Ensure that no DOM events are dispatched during
            restoration of a cached page. Call didRestoreFromCachedPage() after restoring the page to
            dispatch DOM events on the restored frames.
            (WebCore::FrameLoader::willRestoreFromCachedPage): Renamed; formerly named prepareForCachedPageRestore().
            (WebCore::FrameLoader::didRestoreFromCachedPage): Added.
            (WebCore::FrameLoader::prepareForCachedPageRestore): Renamed to willRestoreFromCachedPage().
            * loader/FrameLoader.h:
            * page/FrameTree.cpp:
            (WebCore::FrameTree::traverseNextInPostOrderWithWrap): Returns the next Frame* in a post-order
            traversal of the frame tree optionally wrapping around to the deepest first child in the tree.
            (WebCore::FrameTree::deepFirstChild): Added.
            * page/FrameTree.h:

2017-03-16  Jason Marcell  <jmarcell@apple.com>

        Merge r214023. rdar://problem/31091039

    2017-03-15  Zalan Bujtas  <zalan@apple.com>

            Do not reparent floating object until after intruding/overhanging dependency is cleared.
            https://bugs.webkit.org/show_bug.cgi?id=169711
            <rdar://problem/30959743>

            Reviewed by Simon Fraser.

            This patch ensures that we cleanup the m_floatingObjects for siblings before reparenting the fresh float.

            Test: fast/block/float/inline-becomes-float-and-moves-around.html

            * rendering/RenderBlockFlow.cpp:
            (WebCore::RenderBlockFlow::styleDidChange):
            * rendering/RenderElement.cpp:
            (WebCore::RenderElement::styleDidChange):
            * rendering/RenderElement.h:
            (WebCore::RenderElement::noLongerAffectsParentBlock):

2017-03-16  Jason Marcell  <jmarcell@apple.com>

        Merge r213897. rdar://problem/30921833

    2017-03-13  Wenson Hsieh  <wenson_hsieh@apple.com>

            Make RepaintRegionAccumulator hold a WeakPtr to its root RenderView
            https://bugs.webkit.org/show_bug.cgi?id=168480
            <rdar://problem/30566976>

            Reviewed by Antti Koivisto.

            Implements two mitigations to prevent the symptoms of the bug from occurring (see the bugzilla for more details).

            Test: editing/execCommand/show-modal-dialog-during-execCommand.html

            * editing/EditorCommand.cpp:
            (WebCore::Editor::Command::execute):

            Do not allow edit commands to execute if the frame's document before and after layout differ (that is, edit commands
            triggered by a certain document should not run on a different document).

            * rendering/RenderView.cpp:
            (WebCore::RenderView::RenderView):
            (WebCore::RenderView::RepaintRegionAccumulator::RepaintRegionAccumulator):

            Turns RepaintRegionAccumulator's reference to its root RenderView into a WeakPtr to gracefully handle the case
            where its RenderView is destroyed before RepaintRegionAccumulator's destructor gets a chance to flush the
            RenderView's repaint regions.

            * rendering/RenderView.h:

2017-03-16  Jason Marcell  <jmarcell@apple.com>

        Merge r213501. rdar://problem/30921830

    2017-03-06  Brent Fulgham  <bfulgham@apple.com>

            Validate DOM after potentially destructive actions during parser insert operations
            https://bugs.webkit.org/show_bug.cgi?id=169222
            <rdar://problem/30689729>

            Reviewed by Ryosuke Niwa.

            Do not perform an insert operation if the next child's parent is no longer
            part of the tree. This can happen if JavaScript runs during node removal
            events and modifies the contents of the document.

            This patch was inspired by a similar Blink change by Marius Mlynski:
            <https://src.chromium.org/viewvc/blink?view=revision&revision=200690>

            Tests: fast/parser/scriptexec-during-parserInsertBefore.html

            * html/parser/HTMLConstructionSite.cpp:
            (WebCore::executeReparentTask):
            (WebCore::executeInsertAlreadyParsedChildTask):

2017-03-16  Jason Marcell  <jmarcell@apple.com>

        Merge r213311. rdar://problem/30812769

    2017-03-02  Chris Dumez  <cdumez@apple.com>

            We should prevent load of subframes inserted during FrameTree deconstruction
            https://bugs.webkit.org/show_bug.cgi?id=169095

            Reviewed by Brent Fulgham.

            When deconstructing the FrameTree, we fire the unload event in each subframe.
            Such unload event handler may insert a new frame, we would previously load
            such new frame which was unsafe as we would end up with an attached subframe
            on a detached tree. To address the issue, we prevent new subframes from loading
            while deconstructing the FrameTree and firing the unload events. This new
            behavior is consistent with Chrome and should therefore be safe from a
            compatibility standpoint.

            Test: fast/frames/insert-frame-unload-handler.html

            * dom/ContainerNodeAlgorithms.cpp:
            (WebCore::disconnectSubframes):
            Update SubframeLoadingDisabler call site now that the constructor takes in
            a pointer instead of a reference.

            * html/HTMLFrameOwnerElement.h:
            (WebCore::SubframeLoadingDisabler::SubframeLoadingDisabler):
            (WebCore::SubframeLoadingDisabler::~SubframeLoadingDisabler):
            Update SubframeLoadingDisabler constructor to take in a pointer instead
            of a reference, for convenience.

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::detachChildren):
            Prevent loads in subframes while detaching the subframes. It would be unsafe
            as we copy the list of frames before iterating to fire the unload events.
            Therefore, newly inserted frames would not get unloaded.

2017-03-02  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r212893. rdar://problem/30812551

2017-02-28  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r213077. rdar://problem/30704432

    2017-02-27  Matthew Hanson  <matthew_hanson@apple.com>

            Merge r212987. rdar://problem/30704432

        2017-02-24  Chris Dumez  <cdumez@apple.com>

                Unreviewed, follow-up fix after r212972.

                Fixes a few assertions on the debug build bots.
                URL needs to be exactly the same as the parsed one given
                that we are calling the ParsedURLString constructor.

                * platform/network/ResourceResponseBase.cpp:
                (WebCore::ResourceResponseBase::sanitizeSuggestedFilename):

2017-02-28  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r213076. rdar://problem/30704432

    2017-02-27  Matthew Hanson  <matthew_hanson@apple.com>

            Merge r212972. rdar://problem/30704432

        2017-02-24  Chris Dumez  <cdumez@apple.com>

                Download attribute should be sanitized before being used as suggested filename
                https://bugs.webkit.org/show_bug.cgi?id=168839
                <rdar://problem/30683109>

                Reviewed by Darin Adler.

                Sanitize Download attribute before using it as a suggested filename for the download.
                We rely on ResourceResponse's sanitizing of the suggested filename to do so, which has
                the benefit of being consistent with downloads without the download attribute.

                Tests: fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-doublequote.html
                       fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-slashes.html
                       fast/dom/HTMLAnchorElement/anchor-file-blob-download-includes-unicode.html

                * html/HTMLAnchorElement.cpp:
                (WebCore::HTMLAnchorElement::handleClick):
                * platform/network/ResourceResponseBase.cpp:
                (WebCore::ResourceResponseBase::sanitizeSuggestedFilename):
                * platform/network/ResourceResponseBase.h:

2017-02-22  Brent Fulgham  <bfulgham@apple.com>

        Merge r212554. rdar://problem/30636115

    2017-02-16  Brent Fulgham  <bfulgham@apple.com>

            RenderView needs to be updated when FrameView changes
            https://bugs.webkit.org/show_bug.cgi?id=168481
            <rdar://problem/30339638>

            Reviewed by Andreas Kling.

            The state of the Document's RenderView can get out of sync with the Frame's FrameView.
            We need a notification mechanism so that modifications to the Frame's view are properly
            relayed to Document so that it can have a correct RenderView.

            * dom/Document.cpp:
            (WebCore::Document::didBecomeCurrentDocumentInView): Create an updated render tree (if
            one does not already exist).
            (WebCore::Document::destroyRenderTree): Remove an incorrect ASSERT. We may enter this
            code when the Frame uses 'setView(nullptr)', which happens during certain  updates.
            * dom/Document.h:
            * page/Frame.cpp:
            (WebCore::Frame::setView): Destroy the old render tree (if present) before switching to
            the new view. Then notify the document that it is now the current document in the new view.

2017-02-22  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212730. rdar://problem/30515072

    2017-02-21  Per Arne Vollan  <pvollan@apple.com>

            [Win] WebView is not painting in accelerated compositing mode.
            https://bugs.webkit.org/show_bug.cgi?id=168654

            Reviewed by Brent Fulgham.

            Initializing the uncommitted layer change flags to CoverageRectChanged in GraphicsLayerCA,
            stops WebView painting in accelerated mode.

            Covered by existing tests.

            * platform/graphics/ca/GraphicsLayerCA.h:

2017-02-21  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212667. rdar://problem/29852056

    2017-02-20  Brent Fulgham  <bfulgham@apple.com>

            Nullptr dereferences when stopping a load
            https://bugs.webkit.org/show_bug.cgi?id=168608
            <rdar://problem/29852056>

            Reviewed by Ryosuke Niwa.

            Don't attempt to notify a detached frame's load client that the load is
            stopped.

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::stopLoading): Check for null frame loader and
            bypass dereferencing it.

2017-02-18  Ryosuke Niwa  <rniwa@webkit.org>

        REGRESSION(r212218): Assertion failures in and after parserRemoveChild
        https://bugs.webkit.org/show_bug.cgi?id=168458

        Reviewed by Antti Koivisto.

        The bug was caused by parserRemoveChild not preceeding to remove oldChild even when
        oldChild had been inserted elsewhere during unload evnets of the disconnected frames.
        Fixed the bug by checking this condition and exiting early.

        Also fixed various callers of parserRemoveChild to not call parserAppendChild when
        the removed node had already been inserted elsewhere by scripts.

        Tests: fast/parser/adoption-agency-unload-iframe-3.html
               fast/parser/adoption-agency-unload-iframe-4.html
               fast/parser/xml-error-unload-iframe.html

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::parserRemoveChild): Exit early when the node had been
        inserted elsewhere while firing unload events. Also moved the call to
        notifyRemovePendingSheetIfNeeded outside NoEventDispatchAssertion since it can
        synchrnously fire a focus event.
        (WebCore::ContainerNode::parserAppendChild): Moved adoptNode call to inside
        NoEventDispatchAssertion since adoptNode call here should never mutate DOM.
        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::executeReparentTask): Added an early exit when the node had already been
        inserted elsewhere.
        (WebCore::executeInsertAlreadyParsedChildTask): Ditto.
        * xml/XMLErrors.cpp:
        (WebCore::XMLErrors::insertErrorMessageBlock): Ditto.
        * xml/parser/XMLDocumentParser.cpp:
        (WebCore::XMLDocumentParser::end): Fixed a crash unveiled by one of the test cases.
        Exit early when insertErrorMessageBlock detached the parser (by author scripts).
        (WebCore::XMLDocumentParser::finish): Keep the parser alive until we exit.

2017-02-20  Ryosuke Niwa  <rniwa@webkit.org>

        HTMLConstructionSiteTask::Insert should never be called on a node with a parent
        https://bugs.webkit.org/show_bug.cgi?id=168099

        Reviewed by Sam Weinig.

        insertAlreadyParsedChild always use HTMLConstructionSiteTask::InsertAlreadyParsedChild instead
        of using HTMLConstructionSiteTask::Insert when fostering a child.

        Also combine the step to take all children and re-parenting into a single task instead of
        separately issuing TakeAllChildren and Reparent tasks.

        No new tests since this is a refactoring.

        * html/parser/HTMLConstructionSite.cpp:
        (WebCore::insert): Now asserts that the child node never have a parent.
        (WebCore::executeInsertAlreadyParsedChildTask): Moved the code to remove the parent here.
        (WebCore::executeTakeAllChildrenAndReparentTask): Renamed from executeTakeAllChildrenTask
        now that this function also does the reparenting.
        (WebCore::executeTask):
        (WebCore::HTMLConstructionSite::reparent): Removed the variant only used with takeAllChildren.
        (WebCore::HTMLConstructionSite::insertAlreadyParsedChild): Always use InsertAlreadyParsedChild
        instead of calling fosterParent which uses Insert when fostering parents.
        (WebCore::HTMLConstructionSite::takeAllChildrenAndReparent): Renamed from takeAllChildren.
        * html/parser/HTMLConstructionSite.h:
        (WebCore::HTMLConstructionSiteTask:Operation):
        * html/parser/HTMLTreeBuilder.cpp:
        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

2017-02-20  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r212601. rdar://problem/30339638

2017-02-20  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r212647. rdar://problem/30563318

2017-02-20  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r212538. rdar://problem/30541748

2017-02-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212621. rdar://problem/30563318

    2017-02-18  Ryosuke Niwa  <rniwa@webkit.org>

            REGRESSION(r212218): Assertion failures in and after parserRemoveChild
            https://bugs.webkit.org/show_bug.cgi?id=168458

            Reviewed by Antti Koivisto.

            The bug was caused by parserRemoveChild not preceeding to remove oldChild even when
            oldChild had been inserted elsewhere during unload evnets of the disconnected frames.
            Fixed the bug by checking this condition and exiting early.

            Also fixed various callers of parserRemoveChild to not call parserAppendChild when
            the removed node had already been inserted elsewhere by scripts.

            Tests: fast/parser/adoption-agency-unload-iframe-3.html
                   fast/parser/adoption-agency-unload-iframe-4.html
                   fast/parser/xml-error-unload-iframe.html

            * dom/ContainerNode.cpp:
            (WebCore::ContainerNode::parserRemoveChild): Exit early when the node had been
            inserted elsewhere while firing unload events. Also moved the call to
            notifyRemovePendingSheetIfNeeded outside NoEventDispatchAssertion since it can
            synchrnously fire a focus event.
            (WebCore::ContainerNode::parserAppendChild): Moved adoptNode call to inside
            NoEventDispatchAssertion since adoptNode call here should never mutate DOM.
            * html/parser/HTMLConstructionSite.cpp:
            (WebCore::executeReparentTask): Added an early exit when the node had already been
            inserted elsewhere.
            (WebCore::executeInsertAlreadyParsedChildTask): Ditto.
            * xml/XMLErrors.cpp:
            (WebCore::XMLErrors::insertErrorMessageBlock): Ditto.
            * xml/parser/XMLDocumentParser.cpp:
            (WebCore::XMLDocumentParser::end): Fixed a crash unveiled by one of the test cases.
            Exit early when insertErrorMessageBlock detached the parser (by author scripts).
            (WebCore::XMLDocumentParser::finish): Keep the parser alive until we exit.

2017-02-17  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212554. rdar://problem/30339638

    2017-02-16  Brent Fulgham  <bfulgham@apple.com>

            RenderView needs to be updated when FrameView changes
            https://bugs.webkit.org/show_bug.cgi?id=168481
            <rdar://problem/30339638>

            Reviewed by Andreas Kling.

            The state of the Document's RenderView can get out of sync with the Frame's FrameView.
            We need a notification mechanism so that modifications to the Frame's view are properly
            relayed to Document so that it can have a correct RenderView.

            * dom/Document.cpp:
            (WebCore::Document::didBecomeCurrentDocumentInView): Create an updated render tree (if
            one does not already exist).
            (WebCore::Document::destroyRenderTree): Remove an incorrect ASSERT. We may enter this
            code when the Frame uses 'setView(nullptr)', which happens during certain  updates.
            * dom/Document.h:
            * page/Frame.cpp:
            (WebCore::Frame::setView): Destroy the old render tree (if present) before switching to
            the new view. Then notify the document that it is now the current document in the new view.

2017-02-17  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r212488. rdar://problem/29904368

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212518. rdar://problem/30541748

    2017-02-16  Daniel Bates  <dabates@apple.com>

            Remove Chromium-specific code to call FrameLoaderClient::redirectDataToPlugin(nullptr)
            https://bugs.webkit.org/show_bug.cgi?id=168417
            <rdar://problem/30541748>

            Reviewed by Brent Fulgham.

            Remove Chromium-specific code that was added in r125500 to call FrameLoaderClient::redirectDataToPlugin(nullptr)
            in PluginDocument::detachFromPluginElement(). Calling redirectDataToPlugin() with nullptr was used by the
            Chromium port to signify that the plugin document was being destroyed so that they could tear down their
            plugin widget. And PluginDocument::detachFromPluginElement() is the only place that calls redirectDataToPlugin()
            passing nullptr. No other port made use of this machinery and the Chromium port has long since been removed
            from the Open Source WebKit Project. We should remove this code.

            * html/PluginDocument.cpp:
            (WebCore::PluginDocumentParser::appendBytes): Pass the plugin widget by reference.
            (WebCore::PluginDocument::detachFromPluginElement): Remove call to FrameLoaderClient::redirectDataToPlugin().
            This call was only used by the Chromium port as means to be notified when the plugin document was being
            destroyed. No other port made use of this notification or needed such a notification.
            * loader/EmptyClients.cpp: Change argument of redirectDataToPlugin() from Widget* to Widget& to convey
            that this function always takes a valid Widget. Also remove unnecessary argument name as the data type
            of the argument and the name of the function sufficiently describes the purpose of the argument.
            * loader/FrameLoaderClient.h: Ditto.

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212350. rdar://problem/30450379

    2017-02-14  Brent Fulgham  <bfulgham@apple.com>

            Revalidate URL after events that could trigger navigations
            https://bugs.webkit.org/show_bug.cgi?id=168071
            <rdar://problem/30450379>

            Reviewed by Ryosuke Niwa.

            When arbitary javascript runs during a load, we should revalidate
            the URLs involved to make sure they are still valid.

            Tests: http/tests/plugins/navigation-during-load-embed.html
                   http/tests/plugins/navigation-during-load.html

            * html/HTMLEmbedElement.cpp:
            (WebCore::HTMLEmbedElement::updateWidget): Confirm we are still allowed to
            load the URL after executing JS callbacks.
            * html/HTMLFrameElementBase.cpp:
            (WebCore::HTMLFrameElementBase::isURLAllowed): Split existing function into
            existing protected method, and a new public method that checks a passed URL
            for validity.
            * html/HTMLFrameElementBase.h:
            * html/HTMLFrameOwnerElement.h:
            (WebCore::HTMLFrameOwnerElement::isURLAllowed):
            * html/HTMLObjectElement.cpp:
            (WebCore::HTMLObjectElement::updateWidget): Confirm we are still allowed to
            load the URL after executing JS callbacks.
            * loader/SubframeLoader.cpp:
            (WebCore::SubframeLoader::requestFrame): Ditto.

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212335. rdar://problem/29899473

    2017-02-14  Brady Eidson  <beidson@apple.com>

            Unreviewed followup to r212330 to fix Debug builds

            * loader/DocumentThreadableLoader.cpp:
            (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Add call to relaxAdoptionRequirement().

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212330. rdar://problem/29899473

    2017-02-14  Brady Eidson  <beidson@apple.com>

            Speculative fix for: Crash in DocumentThreadableLoader::redirectReceived.
            <rdar://problem/29899473> and https://bugs.webkit.org/show_bug.cgi?id=168337

            Reviewed by Geoffrey Garen.

            No new tests (Unable to find a reproduction).

            * loader/DocumentThreadableLoader.cpp:
            (WebCore::DocumentThreadableLoader::loadRequest):

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212172. rdar://problem/30476807

    2017-02-10  Simon Fraser  <simon.fraser@apple.com>

            REGRESSION (r211845): [ios-simulator] LayoutTest compositing/masks/solid-color-masked.html is a flaky failure
            https://bugs.webkit.org/show_bug.cgi?id=168054

            Reviewed by Tim Horton.

            When adding mask layers, there was an ordering dependency. There was a hack in GraphicsLayerCA::setVisibleAndCoverageRects()
            to propagate m_intersectsCoverageRect to masks. However, if GraphicsLayerCA::setVisibleAndCoverageRects()
            ran on the masked layer before the mask was added, nothing updated the "m_intersectsCoverageRect" state of the mask layer.

            Fix by explicitly calling setVisibleAndCoverageRects() on the mask layer, passing the same rects and
            viewport-constrained state as for its host layer (we already assume that their geometry matches).

            Tested by compositing/masks/solid-color-masked.html

            * platform/graphics/ca/GraphicsLayerCA.cpp:
            (WebCore::GraphicsLayerCA::setVisibleAndCoverageRects):
            (WebCore::GraphicsLayerCA::recursiveCommitChanges):

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212152. rdar://problem/30459055

    2017-02-09  Simon Fraser  <simon.fraser@apple.com>

            Tiled layers are sometimes left with some tiles when outside the viewport
            https://bugs.webkit.org/show_bug.cgi?id=168104
            rdar://problem/30459055

            Reviewed by Tim Horton.

            When the coverage rect of a TiledBacking goes from a non-empty rect to an empty rect, we
            shouldn't just early return from TileGrid::revalidateTiles(), otherwise we are left with some
            tiles. Run through the function as normal, which will remove all the tiles for an empty coverage rect.

            Minor logging changes.

            Test: tiled-drawing/tile-coverage-iframe-to-zero-coverage.html

            * platform/graphics/ca/TileGrid.cpp:
            (WebCore::TileGrid::revalidateTiles):

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212151. rdar://problem/30090186

    2017-02-10  Zalan Bujtas  <zalan@apple.com>

            Mail hangs when removing multiple rows from large table.
            https://bugs.webkit.org/show_bug.cgi?id=168103
            <rdar://problem/30090186>

            Reviewed by Ryosuke Niwa.

            DeleteSelectionCommand::removeNode doesn't actually destroy table structure items,
            but instead it removes their content. In order to be able to continue editing the table after
            the delete, we need to ensure that its cells' width and height are > 0. Currently we issue layout on
            each table item recursively.
            This patch delays the layout until after we've finished with the entire subtree delete (10x progression).

            Performance test added.

            * editing/DeleteSelectionCommand.cpp:
            (WebCore::DeleteSelectionCommand::insertBlockPlaceholderForTableCellIfNeeded):
            (WebCore::DeleteSelectionCommand::removeNodeUpdatingStates):
            (WebCore::shouldRemoveContentOnly):
            (WebCore::DeleteSelectionCommand::removeNode):
            * editing/DeleteSelectionCommand.h:

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211766. rdar://problem/30467124

    2017-02-06  Simon Fraser  <simon.fraser@apple.com>

            Re-land r210095 (avoid a tile revalidation on scale change)
            https://bugs.webkit.org/show_bug.cgi?id=167866

            Reviewed by Tim Horton.

            r210095 was rolled out in r211230 but now that all TileControllers unparent
            offscreen tiles, we can roll it back it.

            Also add more Tiling logging.

            * platform/graphics/ca/TileGrid.cpp:
            (WebCore::validationPolicyAsString):
            (WebCore::TileGrid::setScale):
            (WebCore::TileGrid::prepopulateRect):
            (WebCore::TileGrid::revalidateTiles):
            (WebCore::TileGrid::ensureTilesForRect):

2017-02-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211501. rdar://problem/29904368

    2017-02-01  Antoine Quint  <graouts@apple.com>

            [mac-wk1] LayoutTest media/modern-media-controls/tracks-support/tracks-support-click-track-in-panel.html is a flaky timeout
            https://bugs.webkit.org/show_bug.cgi?id=165319
            <rdar://problem/30284104>

            Reviewed by Dean Jackson.

            Running media/controls/track-menu.html before media/modern-media-controls/tracks-support/tracks-
            support-click-track-in-panel.html makes that test time out in all test runs. The root of the issue
            is that animations are suspended by media/controls/track-menu.html with a call to
            internals.suspendAnimations(), and that state isn't reset with a call to internals.resumeAnimations().
            Then, media/modern-media-controls/tracks-support/tracks-support-click-track-in-panel.html fails because
            the selection animation for the tracks panel menu item that is clicked never completes and the delegate
            to notify that an item in the tracks panel was selected is never fired, which leads to the test failure.

            We change Internals::suspendAnimations() and Internals::resumeAnimations() to only affect the current
            document, rather than calling into AnimationController::suspendAnimations() which would do just that,
            but also set a Frame-wide flag that would prevent further animations from running, even in a subsequent
            document load.

            * dom/Document.cpp:
            (WebCore::Document::prepareForDestruction): Ensure the document that is about to be destroyed is no longer
            associated with an AnimationController.
            * page/animation/AnimationController.cpp:
            (WebCore::AnimationControllerPrivate::ensureCompositeAnimation): Update the animation's suspend state in case
            the document its renderer is associated with is suspended. This is required since previously CompositeAnimations
            would set their suspend state in their constructor, based on the Frame-wide suspended state, but there is no
            document to use as a basis to query its suspended state in that constructor.
            (WebCore::AnimationControllerPrivate::animationsAreSuspendedForDocument):
            (WebCore::AnimationControllerPrivate::detachFromDocument):
            (WebCore::AnimationControllerPrivate::suspendAnimationsForDocument):
            (WebCore::AnimationControllerPrivate::resumeAnimationsForDocument):
            (WebCore::AnimationControllerPrivate::startAnimationsIfNotSuspended):
            (WebCore::AnimationController::animationsAreSuspendedForDocument):
            (WebCore::AnimationController::detachFromDocument):
            * page/animation/AnimationController.h:
            * page/animation/AnimationControllerPrivate.h:
            * testing/Internals.cpp:
            (WebCore::Internals::animationsAreSuspended):
            (WebCore::Internals::suspendAnimations):
            (WebCore::Internals::resumeAnimations):

2017-02-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211495. rdar://problem/30106362

    2017-02-01  Jer Noble  <jer.noble@apple.com>

            NULL-deref crash in TextTrack::removeCue()
            https://bugs.webkit.org/show_bug.cgi?id=167615

            Reviewed by Eric Carlson.

            Test: http/tests/media/track-in-band-hls-metadata-crash.html

            Follow-up to r211401. When passing around a reference to an object, the assumption is that
            the caller is retaining the underlying object. This breaks down for
            InbandDataTextTrack::removeDataCue(), which releases its own ownership of the cue object,
            then passes the reference to that object to its superclass to do further remove steps. The
            retain count of the cue can thus drop to zero within the scope of
            InbandTextTrack::removeCue(). Use "take" semantics to remove the cue from the
            m_incompleteCueMap without releasing ownership, and pass a reference to that retained object
            on to removeCue(), guaranteeing that the cue will not be destroyed until after the
            romeveDataCue() method returns.

            * html/track/InbandDataTextTrack.cpp:
            (WebCore::InbandDataTextTrack::removeDataCue):

2017-02-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211650. rdar://problem/30268004

    2017-02-03  Jeremy Jones  <jeremyj@apple.com>

            Pointer lock events should be delivered directly to the target element
            https://bugs.webkit.org/show_bug.cgi?id=167134
            rdar://problem/30268004

            Reviewed by Dean Jackson.

            pointer-lock/mouse-event-delivery.html: Enabled for mac, added wheel event tests.

            When pointer is locked on an element, route mouse events directly to the target element, instead of
            doing the normal event disptach.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::handleMousePressEvent):
            (WebCore::EventHandler::handleMouseDoubleClickEvent):
            (WebCore::EventHandler::handleMouseMoveEvent):
            (WebCore::EventHandler::handleMouseReleaseEvent):
            (WebCore::EventHandler::handleMouseForceEvent):
            (WebCore::EventHandler::handleWheelEvent):
            * page/PointerLockController.cpp:
            (WebCore::PointerLockController::isLocked): Added.
            (WebCore::PointerLockController::dispatchLockedWheelEvent): Added.
            * page/PointerLockController.h:

2017-02-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211375. rdar://problem/30268004

    2017-01-30  Ryan Haddad  <ryanhaddad@apple.com>

            Unreviewed, rollout r211235 Pointer lock events should be delivered directly to the target element.

            The LayoutTest for this change is frequently failing.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::handleMousePressEvent):
            (WebCore::EventHandler::handleMouseDoubleClickEvent):
            (WebCore::EventHandler::handleMouseMoveEvent):
            (WebCore::EventHandler::handleMouseReleaseEvent):
            (WebCore::EventHandler::handleMouseForceEvent):
            (WebCore::EventHandler::handleWheelEvent):
            * page/PointerLockController.cpp:
            (WebCore::PointerLockController::isLocked): Deleted.
            (WebCore::PointerLockController::dispatchLockedWheelEvent): Deleted.
            * page/PointerLockController.h:

2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r212029. rdar://problem/30376972

    2017-02-09  Chris Dumez  <cdumez@apple.com>

            Make sure Event keeps its current target element alive
            https://bugs.webkit.org/show_bug.cgi?id=167885
            <rdar://problem/30376972>

            Reviewed by Brent Fulgham.

            Make sure Event keeps its current target element alive to avoid
            crashes if it is accessed by JS after it has been garbage collected.

            Test: fast/events/currentTarget-gc-crash.html

            * dom/Event.cpp:
            (WebCore::Event::setCurrentTarget):
            * dom/Event.h:
            (WebCore::Event::currentTarget):

2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211999. rdar://problem/29930443

    2017-02-09  Brent Fulgham  <bfulgham@apple.com>

            Disconnect shadow children of root when detaching a frame
            https://bugs.webkit.org/show_bug.cgi?id=166851
            <rdar://problem/29930443>

            Reviewed by Andy Estes.

            If the root of the tree we are disconnecting has a shadow element, include it in the set of
            things to disconnect.

            Tests: fast/shadow-dom/shadow-at-root-during-disconnect.html

            * dom/ContainerNodeAlgorithms.cpp:
            (WebCore::disconnectSubframes):

2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211382. rdar://problem/29738514

    2017-01-30  Myles C. Maxfield  <mmaxfield@apple.com>

            Correct spacing regression on inter-element complex path shaping on some fonts
            https://bugs.webkit.org/show_bug.cgi?id=166013

            Reviewed by Simon Fraser.

            This patch brings the implementation of ComplexTextController in-line with the
            design at https://trac.webkit.org/wiki/ComplexTextController. Previously,
            ComplexTextController had a few problems:
            - The total width computed by ComplexTextController didn't match the width if
            you iterated over the entire string and added up the advances
            - FontCascade::getGlyphsAndAdvancesForComplexText() tried to compensate for
            the above by construing the concepts of paint advances as distinct from layout
            advances
            - Initial advances were considered part of layout sometimes and part of painting
            other times, depending on which function reports the information
            - For RTL runs, the wrong origin was added to the initial advance, and the origin
            should have been subtracted instead of added

            This patch exhaustively updates every function in ComplexTextController to be
            consistent with the design linked to above. This design solves all of these
            problems.

            Tests: ComplexTextControllerTest.InitialAdvanceWithLeftRunInRTL
                   ComplexTextControllerTest.InitialAdvanceInRTL
                   ComplexTextControllerTest.InitialAdvanceWithLeftRunInLTR
                   ComplexTextControllerTest.InitialAdvanceInLTR
                   ComplexTextControllerTest.InitialAdvanceInRTLNoOrigins
                   ComplexTextControllerTest.LeadingExpansion
                   ComplexTextControllerTest.VerticalAdvances

            * platform/graphics/GlyphBuffer.h:
            (WebCore::GlyphBuffer::setLeadingExpansion): Deleted. No longer necessary.
            (WebCore::GlyphBuffer::leadingExpansion): Deleted. Ditto.
            * platform/graphics/cocoa/FontCascadeCocoa.mm:
            (WebCore::FontCascade::adjustSelectionRectForComplexText): Removed use of
            unnecessary leadingExpansion().
            (WebCore::FontCascade::getGlyphsAndAdvancesForComplexText): This function needs
            to compute paint advances, which means that it can't base this information off
            of layout advances. This function uses the trick mentioned at the end of the
            above link to compute the paint offset of an arbitrary glyph in the middle of
            an RTL run.
            * platform/graphics/mac/ComplexTextController.cpp:
            (WebCore::ComplexTextController::computeExpansionOpportunity): Refactored for
            testing.
            (WebCore::ComplexTextController::ComplexTextController): Ditto.
            (WebCore::ComplexTextController::finishConstruction): Ditto.
            (WebCore::ComplexTextController::offsetForPosition): This function operates on
            layout advances, and the initial layout advance is already added into the
            m_adjustedBaseAdvances vector by adjustGlyphsAndAdvances(). Therefore, there is
            no need to add it again here.
            (WebCore::ComplexTextController::advance): This function had completely busted
            logic about the relationship between initial advances and the first origin in
            each run. Because of the fortunate choice of only representing layout advances
            in m_adjustedBaseAdvances, this entire block can be removed and the raw paint
            initial advance can be reported to the GlyphBuffer. Later in the function, we
            have to update the logic about how to compute a paint advance given a layout
            advance and some origins. In particular, there are two tricky pieces here: 1.
            The layout advance for the first glyph is equal to (initial advance - first
            origin + first Core Text advance, so computing the paint offset must cancel out
            the initial layout offset, and 2. the last paint advance in a run must actually
            end up at the position of the first glyph in the next run, so the next run's
            initial advance must be queried.
            (WebCore::ComplexTextController::adjustGlyphsAndAdvances): Previously, we
            represented an initial advance of a successive run by just adding it to the
            previous run's last advance. However, this is incompatible with the new model
            presented in the link above, so we remove this section. We also have to add in
            the logic that the layout advance for the first glyph is equal to the formula
            presented above.
            * platform/graphics/mac/ComplexTextController.h:
            (WebCore::ComplexTextController::ComplexTextRun::initialAdvance): Adjust comment
            to reflect reality.
            (WebCore::ComplexTextController::leadingExpansion): Deleted.

2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211845. rdar://problem/30187368

    2017-02-06  Ryosuke Niwa  <rniwa@webkit.org>

            WebContent process repeatedly jetsams on BuzzFeed's Another Round page
            https://bugs.webkit.org/show_bug.cgi?id=167830
            <rdar://problem/30187368>

            Reviewed by Simon Fraser.

            The jetsams on https://www.buzzfeed.com/anotherround were caused by WebKit creating the backing store
            for every iframe's layer on the page regardless of whether they're in the viewport or not.

            This was caused by GraphicsLayerCA's setVisibleAndCoverageRects not setting CoverageRectChanged on
            m_uncommittedChanges on the very first call. Fixed the bug by initializing m_uncommittedChanges
            to always have CoverageRectChanged so that the coverage rect would get updated properly.

            Unfortunately, no new tests since somehow the backing store doesn't get created inside the test runner.

            * platform/graphics/ca/GraphicsLayerCA.h:
            (WebCore::GraphicsLayerCA):

2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211835. rdar://problem/27439617

    2017-02-07  Alex Christensen  <achristensen@webkit.org>

            Revert r166597
            https://bugs.webkit.org/show_bug.cgi?id=167951

            Reviewed by Andreas Kling.

            * platform/spi/cf/CFNetworkSPI.h:
            Remove now-unused SPI declaration.

2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211625. rdar://problem/29168795

    2017-02-03  Antti Koivisto  <antti@apple.com>

            WebContent crash when pasting into input fields at com.apple.WebCore: WebCore::ResourceRequestBase::url const + 9
            https://bugs.webkit.org/show_bug.cgi?id=167787
            rdar://problem/29168795

            Reviewed by Andreas Kling.

            No test, don't know how to get here.

            * page/animation/CSSPropertyAnimation.cpp:
            (WebCore::crossfadeBlend): Null check.

2017-02-09  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211564. rdar://problem/29012252

    2017-02-02  Antti Koivisto  <antti@apple.com>

            Column progression wrong after enabling pagination on RTL document
            https://bugs.webkit.org/show_bug.cgi?id=167733
            <rdar://problem/29012252>

            Reviewed by Zalan Bujtas.

            Column progression depends on document direction but was not updated when direction changed.

            Test: fast/multicol/pagination/pagination-dynamic-rtl.html

            * rendering/RenderBox.cpp:
            (WebCore::RenderBox::styleDidChange):

                Update column styles if document direction changes.

2017-02-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211653. rdar://problem/29872943

    2017-02-03  Chris Dumez  <cdumez@apple.com>

            Dismiss HTML form validation popover when pressing Escape key
            https://bugs.webkit.org/show_bug.cgi?id=167716
            <rdar://problem/29872943>

            Reviewed by Simon Fraser.

            Dismiss any visible HTML form validation popover when pressing
            the Escape key.

            Test: fast/forms/validation-bubble-escape-key-dismiss.html

            * page/EventHandler.cpp:
            (WebCore::EventHandler::keyEvent):
            * page/ValidationMessageClient.h:

2017-02-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211659. rdar://problem/28725791

    2017-02-03  Jer Noble  <jer.noble@apple.com>

            ASSERT in HTMLMediaElement::~HTMLMediaElement
            https://bugs.webkit.org/show_bug.cgi?id=167818

            Reviewed by Brent Fulgham.

            Test: media/audio-dealloc-crash.html

            HTMLMediaElement's MediaElementSession can nominate the HTMLMediaElement itself
            to become the playback controls session from inside the HTMLMediaElement destructor. Protect
            against this by clearing out the session before calling updatePlaybackControlsManager().

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::~HTMLMediaElement):

2017-02-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211676. rdar://problem/30229990

    2017-02-04  Chris Dumez  <cdumez@apple.com>

            Unreviewed, fix mistake in comment added in r211569.

            * history/PageCache.cpp:
            (WebCore::PageCache::removeAllItemsForPage):

2017-02-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211569. rdar://problem/30229990

    2017-02-02  Chris Dumez  <cdumez@apple.com>

            [Crash] com.apple.WebKit.WebContent at WebKit: WebKit::WebPage::fromCorePage()
            https://bugs.webkit.org/show_bug.cgi?id=167738
            <rdar://problem/30229990>

            Reviewed by Andreas Kling.

            Upon destruction of a Page, we destroy the BackForwardClient, which is supposed
            to keep track of HistoryItems associated to this particular page and remove them
            from the PageCache. Given the crash trace, the issue seems to be that some
            HistoryItems associated with the Page sometimes linger in the PageCache *after*
            the Page has been destroyed, which leads to crashes later on when pruning the
            PageCache.

            In order to make the process more robust, this patch refactors the code so that
            the Page is now in charge of removing all its associated HistoryItems from the
            PageCache instead of relying on the BackForwardClient. Also, instead of having
            the Page keep track of which HistoryItems are associated with it (which is
            error prone), we now scan all PageCache entries instead to find which ones are
            associated with the Page. While this is in theory slower, this is much safer
            and in practice not an issue because the PageCache usually has 3-5 entries.

            No new tests, could not reproduce.

            * history/CachedPage.cpp:
            (WebCore::CachedPage::CachedPage):
            * history/CachedPage.h:
            (WebCore::CachedPage::page):
            * history/PageCache.cpp:
            (WebCore::PageCache::removeAllItemsForPage):
            * history/PageCache.h:
            * page/Page.cpp:
            (WebCore::Page::~Page):

2017-01-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211387. rdar://problem/29500273

    2017-01-30  Simon Fraser  <simon.fraser@apple.com>

            [iOS] position:fixed inside touch-scrollable overflow is mispositioned
            https://bugs.webkit.org/show_bug.cgi?id=167604
            rdar://problem/29500273

            Reviewed by Zalan Bujtas.

            For layers inside touch-scrollable overflow, RenderLayerBacking::computeParentGraphicsLayerRect() needs
            to account for the offset from the ancestor compositing layer's origin, to handle scrollable elements with
            box-shadow, for example.

            Also make the compositing log output a little easier to read.

            Test: compositing/scrolling/fixed-inside-scroll.html

            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::computeParentGraphicsLayerRect):
            * rendering/RenderLayerCompositor.cpp:
            (WebCore::RenderLayerCompositor::logLayerInfo):

2017-01-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211337. rdar://problem/30126535

    2017-01-28  Zalan Bujtas  <zalan@apple.com>

            Resolve beforeChild's render tree position before calling addChildIgnoringContinuation.
            https://bugs.webkit.org/show_bug.cgi?id=167540
            <rdar://problem/30126535>

            Reviewed by Simon Fraser.

            Use the actual render tree position for the beforeChild when inside a flow thread.

            Test: fast/multicol/assert-on-continuation-with-spanner.html

            * rendering/RenderBlockFlow.cpp:
            (WebCore::RenderBlockFlow::addChild):
            * rendering/RenderInline.cpp:
            (WebCore::RenderInline::addChild):
            * rendering/RenderMultiColumnFlowThread.cpp:
            (WebCore::RenderMultiColumnFlowThread::resolveMovedChild):

2017-01-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211305. rdar://problem/29320059

    2017-01-27  Simon Fraser  <simon.fraser@apple.com>

            Element with a backdrop-filter and a mask may not correctly mask the backdrop
            https://bugs.webkit.org/show_bug.cgi?id=167456
            rdar://problem/29320059

            Reviewed by Antoine Quint.

            If a layer had a backdrop filter, but also corner radii that triggered using a mask layer,
            then the call to updateClippingStrategy() in GraphicsLayerCA::updateBackdropFiltersRect() would
            set the backdrop layer's mask, but GraphicsLayerCA::updateMaskLayer() would promptly then set
            the mask layer back to nil.

            Fix by having GraphicsLayerCA::updateMaskLayer() put the mask on the structural layer, if there
            is one. We always have a structural layer with backdrops, so this will mask both the layer
            and the backdrop.

            Test: css3/filters/backdrop/backdrop-filter-uneven-corner-radii.html

            * platform/graphics/ca/GraphicsLayerCA.cpp:
            (WebCore::GraphicsLayerCA::updateMaskLayer):
            * platform/graphics/mac/WebLayer.mm:
            (-[CALayer _descriptionWithPrefix:]): Dump the mask layer.

2017-01-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211235. rdar://problem/30058933

    2017-01-26  Jeremy Jones  <jeremyj@apple.com>

            Pointer lock events should be delivered directly to the target element
            https://bugs.webkit.org/show_bug.cgi?id=167134

            Reviewed by Jon Lee.

            pointer-lock/mouse-event-delivery.html: Enabled for mac, added wheel event tests.

            When pointer is locked on an element, route mouse events directly to the target element, instead of
            doing the normal event disptach.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::handleMousePressEvent):
            (WebCore::EventHandler::handleMouseDoubleClickEvent):
            (WebCore::EventHandler::handleMouseMoveEvent):
            (WebCore::EventHandler::handleMouseReleaseEvent):
            (WebCore::EventHandler::handleMouseForceEvent):
            (WebCore::EventHandler::handleWheelEvent):
            * page/PointerLockController.cpp:
            (WebCore::PointerLockController::isLocked): Added.
            (WebCore::PointerLockController::dispatchLockedWheelEvent): Added.
            * page/PointerLockController.h:

2017-01-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211230. rdar://problem/30009849

    2017-01-26  Commit Queue  <commit-queue@webkit.org>

            Unreviewed, rolling out r210095.
            https://bugs.webkit.org/show_bug.cgi?id=167464

            broke tiling on mac (Requested by thorton on #webkit).

            Reverted changeset:

            "TileGrid revalidates tiles twice during flush, first with
            wrong visible rect"
            https://bugs.webkit.org/show_bug.cgi?id=166406
            http://trac.webkit.org/changeset/210095

2017-01-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211201. rdar://problem/30134866

    2017-01-25  Ryosuke Niwa  <rniwa@webkit.org>

            Crash under DOMSelection::deleteFromDocument()
            https://bugs.webkit.org/show_bug.cgi?id=167232

            Reviewed by Chris Dumez.

            The crash was caused by DOMSelection's deleteFromDocument() mutating contents inside the user-agent
            shadow tree of an input element when the text field is readonly. Fixed the bug by exiting early
            whenever the selection is inside a shadow tree since getSelection().getRangeAt(0) always returns
            a range outside the input element or any shadow tree for that matter.

            New behavior matches that of Gecko. The working draft spec of which I'm the editor states that
            deleteFromDocument() must invoke Range's deleteContents() on the associated range, which is
            the collapsed range returned by getSelection().getRangeAt(0) in the spec:
            https://www.w3.org/TR/2016/WD-selection-api-20160921/#widl-Selection-deleteFromDocument-void
            And Range's deleteContents() immediately terminates in step 1 when start and end are identical:
            https://dom.spec.whatwg.org/commit-snapshots/6b7621282c2e3b222ac585650e484abf4c0a416b/

            Note that Range's DOM mutating methods are not available inside an user-agent shadow tree because
            WebKit never returns a Range whose end boundary points are inside the tree to author scripts.
            Editing commands (ones executable from document.execCommand) that mutate DOM like this check whether
            the content is editable or not. Since VisibleSelection's validate() function makes sure the selection
            is either entirely within or outside of an root editable element (editing host in the W3C spec lingo),
            editing commands should never mutate a random node inside an user-agent shadow tree.

            Test: editing/selection/deleteFromDocument-shadow-tree-crash.html

            * page/DOMSelection.cpp:
            (WebCore::DOMSelection::deleteFromDocument):

2017-01-26  Andreas Kling  <akling@apple.com>

        Branch-specific fix for a crash seen after merging r201777.
        <rdar://problem/30209068>

        Reviewed by Andy Estes.

        Add null checking of the FrameView in Document::destroyRenderTree() before
        calling functions on it. This is not necessary in trunk, as the FrameView
        is guaranteed to be present there.

        FrameView can be missing on the branch, since render trees for page cached documents
        are destroyed when leaving the page cache, not when entering it (trunk behavior.)
        When leaving the page cache, the FrameView is already detached, hence the bug.

        * dom/Document.cpp:
        (WebCore::Document::destroyRenderTree):

2017-01-25  Matthew Hanson  <matthew_hanson@apple.com>

        Merge 210777. rdar://problem/30186526

    2017-01-15  Andreas Kling  <akling@apple.com>

            FrameView shouldn't keep dangling pointers into dead render trees.
            <https://webkit.org/b/167011>

            Reviewed by Antti Koivisto.

            Added some pretty paranoid assertions to FrameView that verify all of its raw pointers
            into the render tree are gone after the render tree has been destroyed.
            They immediately caught two bugs, also fixed in this patch.

            * page/FrameView.h:
            * page/FrameView.cpp:
            (WebCore::FrameView::willDestroyRenderTree):
            (WebCore::FrameView::didDestroyRenderTree): Added these two callbacks for before/after
            Document tears down its render tree. The former clears the layout root, and detaches
            custom scrollbars. The latter contains a bunch of sanity assertions that pointers into
            the now-destroyed render tree are gone.

            * dom/Document.cpp:
            (WebCore::Document::destroyRenderTree): Notify FrameView before/after teardown.

            * page/animation/AnimationController.h:
            * page/animation/AnimationController.cpp:
            (WebCore::AnimationController::hasAnimations): Added a helper to check if there are
            any composite animations around, as these contain raw pointers to renderers.

            * rendering/RenderElement.cpp:
            (WebCore::RenderElement::willBeRemovedFromTree):
            (WebCore::RenderElement::willBeDestroyed): Moved slow repaint object unregistration
            from willBeRemovedFromTree() to willBeDestroyed(). The willBeRemovedFromTree() callback
            is skipped as an optimization during full tree teardown, but willBeDestroyed() always
            gets called. This fixes a bug where we'd fail to remove dangling pointers.

2017-01-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r211007. rdar://problem/28620919

    2017-01-20  Brady Eidson  <beidson@apple.com>

            Require a button press on a gamepad for them to be exposed to the DOM.
            <rdar://problem/28620919> and https://bugs.webkit.org/show_bug.cgi?id=167272

            Reviewed by Alex Christensen.

            Test: gamepad/gamepad-visibility-1.html

            * Modules/gamepad/GamepadManager.cpp:
            (WebCore::GamepadManager::platformGamepadInputActivity):
            * Modules/gamepad/GamepadManager.h:

            * platform/gamepad/GamepadProvider.cpp:
            (WebCore::GamepadProvider::dispatchPlatformGamepadInputActivity):
            * platform/gamepad/GamepadProvider.h:
            (WebCore::GamepadProvider::~GamepadProvider): Deleted.
            (WebCore::GamepadProvider::isMockGamepadProvider): Deleted.

            * platform/gamepad/GamepadProviderClient.h:

            * platform/gamepad/cocoa/GameControllerGamepad.h:
            * platform/gamepad/cocoa/GameControllerGamepad.mm:
            (WebCore::GameControllerGamepad::setupAsExtendedGamepad):
            (WebCore::GameControllerGamepad::setupAsGamepad):

            * platform/gamepad/cocoa/GameControllerGamepadProvider.h:
            * platform/gamepad/cocoa/GameControllerGamepadProvider.mm:
            (WebCore::GameControllerGamepadProvider::gamepadHadInput):
            (WebCore::GameControllerGamepadProvider::inputNotificationTimerFired):

            * platform/gamepad/mac/HIDGamepad.cpp:
            (WebCore::HIDGamepad::valueChanged):
            * platform/gamepad/mac/HIDGamepad.h:

            * platform/gamepad/mac/HIDGamepadProvider.cpp:
            (WebCore::HIDGamepadProvider::valuesChanged):
            (WebCore::HIDGamepadProvider::inputNotificationTimerFired):
            * platform/gamepad/mac/HIDGamepadProvider.h:

            * testing/MockGamepadProvider.cpp:
            (WebCore::MockGamepadProvider::setMockGamepadButtonValue):
            (WebCore::MockGamepadProvider::gamepadInputActivity):
            * testing/MockGamepadProvider.h:

2017-01-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210945. rdar://problem/28745101

    2017-01-19  Jer Noble  <jer.noble@apple.com>

            CRASH at WebCore::TrackListBase::remove
            https://bugs.webkit.org/show_bug.cgi?id=167217

            Reviewed by Brent Fulgham.

            Test: media/media-source/media-source-error-crash.html

            In very specific conditions, a HTMLMediaElement backed by a MediaSource can try to remove
            the same track from its track list twice. If there are two SourceBuffers attached to a
            HTMLMediaElement, and one has not yet been initialized, when the second fails to parse an
            appended buffer after receiving an initialization segment, the HTMLMediaElement will remove
            all its tracks in mediaLoadingFailed(), then MediaSource object itself will attempt remove
            the same track in removeSourceBuffer().

            Solving this the safest way possible: bail early from TrackListBase if asked to remove a
            track which the list does not contain.

            * html/track/TrackListBase.cpp:
            (TrackListBase::remove):

2017-01-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210939. rdar://problem/29885052

    2017-01-19  Chris Dumez  <cdumez@apple.com>

            Make sure HTML validation bubble gets dismissed when its associated element's frame gets detached
            https://bugs.webkit.org/show_bug.cgi?id=167215
            <rdar://problem/29885052>

            Reviewed by Andreas Kling.

            Make sure HTML validation bubble gets dismissed when its associated
            element's frame gets detached and that we do not crash.

            Tests: fast/forms/validation-message-detached-iframe.html
                   fast/forms/validation-message-detached-iframe2.html

            * dom/Document.cpp:
            (WebCore::Document::prepareForDestruction):
            * page/ValidationMessageClient.h:

2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210447. rdar://problem/29872292

    2017-01-06  Chris Dumez  <cdumez@apple.com>

            [Form Validation] "character" in maxlength validation message should be singular when maxlength is 1
            https://bugs.webkit.org/show_bug.cgi?id=166712
            <rdar://problem/29872292>

            Reviewed by Darin Adler.

            Fix validation message to use singular form of "character" when maxLength value is 1.

            Test: fast/forms/validation-message-maxLength.html

            * English.lproj/Localizable.strings:
            * English.lproj/Localizable.stringsdict: Added.
            * WebCore.xcodeproj/project.pbxproj:
            * extract-localizable-strings.pl:
            * platform/LocalizedStrings.cpp:
            * platform/LocalizedStrings.h:
            * platform/cocoa/LocalizedStringsCocoa.mm:
            (WebCore::localizedNString):
            (WebCore::localizedString):
            (WebCore::validationMessageTooLongText):

2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210536. rdar://problem/29939970

    2017-01-09  Chris Dumez  <cdumez@apple.com>

            REGRESSION(r189555): ImageDocument title no longer includes the size of the image
            https://bugs.webkit.org/show_bug.cgi?id=166876
            <rdar://problem/29939970>

            Reviewed by Tim Horton.

            ImageDocument title no longer included the size of the image after r189555.
            This is because Document::setTitle() is a no-op if the document does not
            have a <head> element. To address the issue, we now include a <head>
            element in ImageDocuments so that their title element properly gets added
            to it.

            Test: fast/images/imageDocument-title.html

            * html/ImageDocument.cpp:
            (WebCore::ImageDocument::createDocumentStructure):

2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210679. rdar://problem/29910273

    2017-01-12  Youenn Fablet  <youenn@apple.com>

            OneDrive application crashes upon launch
            https://bugs.webkit.org/show_bug.cgi?id=166975

            Reviewed by Brady Eidson.

            Checking whether load is terminated just after calling ResourceLoader::willSendRequestInternal.
            The reason is that delegate call may actually cancel the load at that point.

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::willSendRequestInternal):

2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210378. rdar://problem/29024384

    2017-01-05  Zalan Bujtas  <zalan@apple.com>

            Start hittesting a clean tree in RenderEmbeddedObject::isReplacementObscured
            https://bugs.webkit.org/show_bug.cgi?id=166743
            <rdar://problem/29024384>

            Reviewed by Simon Fraser.

            Unable to reproduce.

            * rendering/RenderEmbeddedObject.cpp:
            (WebCore::RenderEmbeddedObject::isReplacementObscured):

2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210095. rdar://problem/29912221

    2016-12-21  Tim Horton  <timothy_horton@apple.com>

            TileGrid revalidates tiles twice during flush, first with wrong visible rect
            https://bugs.webkit.org/show_bug.cgi?id=166406

            Reviewed by Simon Fraser.

            No new tests; existing tests cover this code, this is just a perf win,
            specifically reducing the amount of layer churn during zooming.

            * platform/graphics/ca/TileGrid.cpp:
            (WebCore::TileGrid::setScale):
            Schedule a revalidation, which will happen later in the same flush,
            instead of doing it immediately. Doing it immediately is problematic,
            because we're currently in the middle of a GraphicsLayer tree flush,
            and don't have the complete picture of the new state yet. We're guaranteed
            to get the new scale *before* the flush calls revalidateTiles.

2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210131. rdar://problem/29633667

    2016-12-23  Ryosuke Niwa  <rniwa@webkit.org>

            Eliminate the use of lastChild in TextIterator
            https://bugs.webkit.org/show_bug.cgi?id=166456

            Reviewed by Antti Koivisto.

            Just use the node we just existed in TextIterator::exitNode and in emitting additional new line
            to eliminate the use of Node::lastChild.

            Also initialize member variables in the declaration instead of the constructor to modernize the code.

            * editing/TextIterator.cpp:
            (WebCore::TextIterator::TextIterator):
            (WebCore::TextIterator::advance):
            (WebCore::TextIterator::exitNode):
            * editing/TextIterator.h:

2017-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210094. rdar://problem/29912214

    2016-12-21  Tim Horton  <timothy_horton@apple.com>

            TileGrid creates new tiles when there are recyclable tiles about to be removed
            https://bugs.webkit.org/show_bug.cgi?id=166408

            Reviewed by Simon Fraser.

            No new tests; existing tests cover this code, this is just a perf win,
            specifically reducing the amount of layer churn during zooming.

            * platform/graphics/ca/TileGrid.cpp:
            (WebCore::TileGrid::revalidateTiles):
            Remove all the tiles that will be removed first, then add new tiles.
            Strictly ordering it this way means that tiles will be removed, go into
            the LayerPool, then be pulled back out of the LayerPool to sit in the
            newly-covered areas. Previously, we would sometimes make new layers
            for newly-covered areas, and then remove unneeded but otherwise recyclable
            tiles, which would then just go sit in the LayerPool (and often get
            pruned, wastefully).

2017-01-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210221. rdar://problem/29449474

    2017-01-01  Jeff Miller  <jeffm@apple.com>

            Update user-visible copyright strings to include 2017
            https://bugs.webkit.org/show_bug.cgi?id=166278

            Reviewed by Dan Bernstein.

            * Info.plist:

2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210361. rdar://problem/29870245

    2017-01-05  Chris Dumez  <cdumez@apple.com>

            Form validation: Align email validation with the latest HTML specification
            https://bugs.webkit.org/show_bug.cgi?id=166697
            <rdar://problem/29870245>

            Reviewed by Alex Christensen.

            Align email validation with the latest HTML specification:
            - https://html.spec.whatwg.org/#valid-e-mail-address

            It particular, the following changes were made:
            - The first and last character of the domain now needs to be a letter or a digit
            - Parts of the domain can only be 63 characters in length

            No new tests, extended existing test.

            * html/EmailInputType.cpp:

2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210360. rdar://problem/19595567

    2017-01-05  Enrica Casucci  <enrica@apple.com>

            Support File Promise during drag for macOS.
            https://bugs.webkit.org/show_bug.cgi?id=165204
            rdar://problem/19595567

            Reviewed by Tim Horton.

            Adds the support for handling File Promise type during
            drag. DragData now has the knowledge of the NSFilesPromisePboardType and
            checks for the data type during drag.

            * page/mac/DragControllerMac.mm:
            (WebCore::DragController::dragOperation):
            * platform/DragData.h:
            (WebCore::DragData::setFileNames):
            (WebCore::DragData::fileNames):
            * platform/mac/DragDataMac.mm:
            (WebCore::DragData::containsFiles):
            (WebCore::DragData::numberOfFiles):
            (WebCore::DragData::asFilenames):
            (WebCore::DragData::containsCompatibleContent):
            (WebCore::DragData::containsPromise):
            (WebCore::DragData::asURL):

2017-01-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r210359. rdar://problem/29882478

    2017-01-05  Per Arne Vollan  <pvollan@apple.com>

            [Win] Compile error.
            https://bugs.webkit.org/show_bug.cgi?id=166726

            Reviewed by Alex Christensen.

            Add include folder.

            * CMakeLists.txt:

2017-01-05  Babak Shafiei  <bshafiei@apple.com>

        Merge r210372.

    2017-01-05  Chris Dumez  <cdumez@apple.com>

            Turn preferLowPowerWebGLRendering setting on by default
            https://bugs.webkit.org/show_bug.cgi?id=166737
            <rdar://problem/29870033>

            Reviewed by Dean Jackson.

            Temporarily turn preferLowPowerWebGLRendering setting on by default until
            we deal better with WebGL content in background tabs.

            * page/Settings.in:

2017-01-04  Babak Shafiei  <bshafiei@apple.com>

        Build fix for r210288.

2017-01-04  Babak Shafiei  <bshafiei@apple.com>

        Merge patch for r210288.

    2016-12-22  Brent Fulgham  <bfulgham@apple.com>

            Correct DOMWindow handling during FrameLoader::clear
            https://bugs.webkit.org/show_bug.cgi?id=166357
            <rdar://problem/29741862>

            Reviewed by Andy Estes.

            Make sure that we always clean up the DOM window when clearing Window properties, even if the document will
            remain in the page cache. Since 'clearWindowShell' is only used in FrameLoader, divide it's beahvior into
            two steps:
        
            1. Rename 'clearWindowShell' to 'clearWIndowShellsNotMatchingDOMWindow' to better describe its function.
            Switch to a modern C++ loop. Do not switch to the new DOMWindow here, but detach and clear existing
            DOMWindow connections.

            2. Add a new method 'setDOMWindowForWindowShell'. Complete switch to the new DOMWindow.

            This change allows us to disconnect the old DOMWindow, perform the 'setDocument(nullptr)' operation, and then
            connect to the new Window without leaving the loader in an inconsistent state.

            * loader/bindings/js/ScriptController.cpp:
            (WebCore::clearWindowShellsNotMatchingDOMWindow): Renamed from 'clearWindowShell'
            (WebCore::setDOMWindowForWindowShell): Added.
            * loader/bindings/js/ScriptController.h:
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::clear): Revise to use the new two-step DOMWindow switch logic.

2017-01-04  Babak Shafiei  <bshafiei@apple.com>

        Merge r210273.

    2017-01-04  Tim Horton  <timothy_horton@apple.com>

            Provide a setting for clients to always prefer low-power WebGL
            https://bugs.webkit.org/show_bug.cgi?id=166675
            <rdar://problem/29834093>

            Reviewed by Dan Bernstein.

            No new tests; as noted in r204664, we don't know how to reliably test
            automatic graphics switching. One could use the manual test introduced
            in that commit; after this commit, with the setting switched on, on a
            dual-GPU machine that is actively using integrated graphics, that test
            should return the same result for both contexts.

            * page/Settings.in:
            Add a setting to prefer low-power WebGL.

            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::create):
            If said setting is enabled, set preferLowPowerToHighPerformance.

2017-01-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r210112.

    2016-12-22  Daniel Bates  <dabates@apple.com>

            Bypass pop-up blocker from cross-origin or sandboxed frame
            https://bugs.webkit.org/show_bug.cgi?id=166290
            <rdar://problem/29742039>

            Reviewed by Darin Adler.

            Tests: fast/events/popup-blocked-from-sandboxed-frame-via-window-open-named-sibling-frame.html
                   fast/events/popup-blocked-from-sandboxed-frame-via-window-open-named-sibling-frame2.html
                   fast/events/popup-blocked-from-unique-frame-via-window-open-named-sibling-frame.html

            * page/DOMWindow.cpp:
            (WebCore::DOMWindow::open): Use FrameLoader::findFrameForNavigation() to find the
            target frame to navigate with respect to the active document just as we do in WebCore::createWindow().

2017-01-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r210122.

    2016-12-22  Brent Fulgham  <bfulgham@apple.com>

            Nested calls to setDocument can omit firing 'unload' events
            https://bugs.webkit.org/show_bug.cgi?id=166422
            <rdar://problem/29763012>

            Reviewed by Alex Christensen.

            Test: fast/loader/nested-document-handling.html

            Only allow a single document change to be taking place during a given runloop cycle.

            * bindings/js/ScriptController.cpp:
            (WebCore::ScriptController::executeIfJavaScriptURL): Block script changing the document
            when we are in the middle of changing the document.
            * page/Frame.cpp:
            (WebCore::Frame::setDocument): Keep track of document change state.
            * page/Frame.h:

2017-01-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r210120.

    2016-12-22  Zalan Bujtas  <zalan@apple.com>

            Do not destroy the RenderNamedFlowFragment as leftover anonymous block.
            https://bugs.webkit.org/show_bug.cgi?id=166436
            rdar://problem/29772233

            Reviewed by Simon Fraser.

            When as the result of certain style change, the generated anonymous block is not needed anymore, we
            move its descendants up to the parent and destroy the generated box. While RenderNamedFlowFragment is a generated
            block, the cleanup code should just ignore it the same way we ignore boxes like multicolumn, mathml etc. 

            Test: fast/regions/flow-fragment-as-anonymous-block-crash.html

            * rendering/RenderObject.h:
            (WebCore::RenderObject::isAnonymousBlock):

2016-12-19  Babak Shafiei  <bshafiei@apple.com>

        Build fix for rdar://problem/29737358.

2016-12-19  Babak Shafiei  <bshafiei@apple.com>

        Merge r209990.

    2016-12-18  Brent Fulgham  <bfulgham@apple.com>

            Side effects while restting form elements
            https://bugs.webkit.org/show_bug.cgi?id=165959
            <rdar://problem/29705967>

            Reviewed by Anders Carlsson.

            JavaScript logic can run while resetting FormElement objects. This can
            lead to unintended side-effets and other unwanted behavior. We should
            protect these elements during the reset.

            Test: fast/html/form-mutate.html

            * html/HTMLFormElement.cpp:
            (WebCore::HTMLFormElement::HTMLFormElement): Switch to C++11 initialization.
            (WebCore::HTMLFormElement::reset): Protect elements until the reset
            operation is finished.
            (WebCore::HTMLFormElement::resetAssociatedFormControlElements): Added to share
            code with 'resumeFromDocument'.
            (WebCore::HTMLFormElement::resumeFromDocument): Protect elements until the
            reset operation is finished.

2016-12-15  Babak Shafiei  <bshafiei@apple.com>

        Merge r204618.

    2016-08-18  Dean Jackson  <dino@apple.com>

            Support passing preferLowPowerToHighPerformance and failIfMajorPerformanceCaveat
            https://bugs.webkit.org/show_bug.cgi?id=160982
            <rdar://problem/27915946>

            Reviewed by Simon Fraser.

            Update WebGLContextAttributes to be compliant with the specification,
            by adding preferLowPowerToHighPerformance and failIfMajorPerformanceCaveat.
            They are not implemented yet, so asking the created context what
            values it used should give the default.

            Test: fast/canvas/webgl/context-creation-attributes.html

            * html/canvas/WebGLContextAttributes.cpp:
            (WebCore::WebGLContextAttributes::preferLowPowerToHighPerformance):
            (WebCore::WebGLContextAttributes::setPreferLowPowerToHighPerformance):
            (WebCore::WebGLContextAttributes::failIfMajorPerformanceCaveat):
            (WebCore::WebGLContextAttributes::setFailIfMajorPerformanceCaveat):
            * html/canvas/WebGLContextAttributes.h:
            * html/canvas/WebGLContextAttributes.idl:
            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::create): Deleted.
            * platform/graphics/GraphicsContext3D.h:
            (WebCore::GraphicsContext3D::Attributes::Attributes): Deleted.

2016-12-15  Babak Shafiei  <bshafiei@apple.com>

        Merge r209819.

    2016-12-14  Alex Christensen  <achristensen@webkit.org>

            REGRESSION (r209776): [ios-simulator] LayoutTest http/tests/xmlhttprequest/on-network-timeout-error-during-preflight.html is timing out
            https://bugs.webkit.org/show_bug.cgi?id=165836

            Reviewed by Brady Eidson.

            * loader/CrossOriginAccessControl.cpp:
            (WebCore::createAccessControlPreflightRequest):
            Use the platform default timeout for CORS preflight requests.

2016-12-15  Babak Shafiei  <bshafiei@apple.com>

        Merge r209776.

    2016-12-13  Alex Christensen  <achristensen@webkit.org>

            Restore NSURLRequest's default time interval to match behavior before NSURLSession adoption
            https://bugs.webkit.org/show_bug.cgi?id=165821
            <rdar://problem/28492939>

            Reviewed by Brady Eidson.

            Before adopting NSURLSession, iOS used CFURLConnection, not NSURLConnection.
            iOS used to have a default timeout of INT_MAX and it now has a default timeout of 0, which means use the 
            default NSURLRequest timeout, which is 60 seconds.  This is not enough for some slow mobile networks,
            so we want to match behavior of our CFURLConnection code here.

            * platform/network/ResourceRequestBase.cpp:
            Use INT_MAX as the default timeout of requests on iOS.

2016-12-07  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r209462. rdar://problem/29556990

    2016-12-06  Geoffrey Garen  <ggaren@apple.com>

            performance.now() should truncate to 100us
            https://bugs.webkit.org/show_bug.cgi?id=165503
            <rdar://problem/29544531>

            Reviewed by Mark Lam.

            * page/Performance.cpp:
            (WebCore::Performance::reduceTimeResolution):

2016-12-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r209145. rdar://problem/29404231

    2016-11-30  Brent Fulgham  <bfulgham@apple.com>

            Use 'childOfType' template when retrieving Shadow DOM elements
            https://bugs.webkit.org/show_bug.cgi?id=165145
            <rdar://problem/29331830>

            Reviewed by Antti Koivisto.

            Tests: fast/shadow-dom/color-input-element-shadow-manipulation.html
                   fast/shadow-dom/file-input-element-shadow-manipulation.html
                   fast/shadow-dom/keygen-shadow-manipulation.html
                   fast/shadow-dom/media-shadow-manipulation.html
                   fast/shadow-dom/range-input-element-shadow-manipulation.html
                   fast/shadow-dom/textarea-shadow-manipulation.html

            Switch to using 'childOfType' when retrieving Shadow DOM elements, rather
            than relying on expected element positions, as these can be changed by
            JavaScript.

            Drive by fix: Make more use of is<> and downcast<> templates rather than blindly casting.

            * dom/Element.h:
            (WebCore::Element::isUploadButton): Added.
            (WebCore::Element::isSliderContainerElement): Added.
            * html/ColorInputType.cpp:
            (WebCore::ColorInputType::shadowColorSwatch): Use 'childOfType' rather than assuming
            the first child is the one we want.
            * html/FileInputType.cpp:
            (isType): Added.
            (WebCore::FileInputType::disabledAttributeChanged): Use 'childOfType' rather than assuming
            the first child is the one we want.
            (WebCore::FileInputType::multipleAttributeChanged): Ditto.
            * html/HTMLKeygenElement.cpp:
            (WebCore::HTMLKeygenElement::shadowSelect): Ditto.
            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::mediaControls): Ditto.
            (WebCore::HTMLMediaElement::hasMediaControls): Ditto.
            * html/HTMLTextAreaElement.cpp:
            (WebCore::HTMLTextAreaElement::innerTextElement): Ditto.
            * html/RangeInputType.cpp:
            (WebCore::RangeInputType::sliderTrackElement): Ditto.
            * html/shadow/SliderThumbElement.h:
            (isType): Added.
            * svg/SVGUseElement.cpp:
            (WebCore::SVGUseElement::targetClone): Use 'childOfType' rather than assuming
            the first child is the one we want.

2016-12-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208745. rdar://problem/29277336

    2016-11-14  Brent Fulgham  <bfulgham@apple.com>

            Correct handling of changing input type
            https://bugs.webkit.org/show_bug.cgi?id=164759
            <rdar://problem/29211174>

            Reviewed by Darin Adler.

            Test: fast/forms/search-cancel-button-change-input.html

            It is possible for JavaScript to change the type property of an input field. WebKit
            needs to gracefully handle this case.

            Add a type traits specialization so we can properly downcast InputType elements.
            Use this to only call search functions on actual search input types.

            * html/HTMLInputElement.cpp:
            (WebCore::HTMLInputElement::onSearch): Only perform search functions if the
            input type is actually a search field.
            * html/InputType.h: Add type traits specialization for 'downcast' template.
            * html/SearchInputType.h: Ditto.

2016-12-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208629. rdar://problem/29277337

    2016-11-11  Brent Fulgham  <bfulgham@apple.com>

            Unreviewed build fix after r208628

            * bindings/js/SerializedScriptValue.cpp:
            (WebCore::CloneDeserializer::readTerminal): Cast pointer arithmetic to
            uint32_t to avoid warning.

2016-11-14  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208691. rdar://problem/29250304

    2016-11-14  David Kilzer  <ddkilzer@apple.com>

            Bug 164702: WebContent crash due to checked unsigned overflow in WebCore: WebCore::RenderLayerCompositor::requiresCompositingLayer const + 1104
            <https://webkit.org/b/164702>
            <rdar://problem/29236368>

            Reviewed by Darin Adler.

            Test: inspector/layers/layers-compositing-reasons.html

            * rendering/RenderLayerCompositor.cpp:
            (WebCore::RenderLayerCompositor::requiresCompositingForCanvas):
            Don't composite if the canvas area overflows.

2016-11-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208328. rdar://problem/29084886

    2016-11-03  Dan Bernstein  <mitz@apple.com>

            REGRESSION (r206247): Painting milestones can be delayed until the next layer flush
            https://bugs.webkit.org/show_bug.cgi?id=164340
            <rdar://problem/29074344>

            Reviewed by Tim Horton.

            To give WebKit a chance to deliver the painting milestones to its client after the commit,
            we must tell it about them before or during the commit. To that end, we should not defer
            the call to firePaintRelatedMilestonesIfNeeded until after the commit.

            * rendering/RenderLayerCompositor.cpp:
            (WebCore::RenderLayerCompositor::RenderLayerCompositor): Removed
              m_paintRelatedMilestonesTimer initializer.
            (WebCore::RenderLayerCompositor::didPaintBacking): Call
              FrameView::firePaintRelatedMilestonesIfNeeded directly from here.
            (WebCore::RenderLayerCompositor::paintRelatedMilestonesTimerFired): Deleted.
            * rendering/RenderLayerCompositor.h:

2016-11-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208307. rdar://problem/29078457

    2016-11-02  David Kilzer  <ddkilzer@apple.com>

            Bug 164333: Add logging for "WebKit encountered an internal error" messages due to Network process crashes
            <https://webkit.org/b/164333>
            <rdar://problem/29072727>

            Reviewed by Alex Christensen.

            * page/DiagnosticLoggingKeys.cpp:
            (WebCore::DiagnosticLoggingKeys::networkProcessCrashedKey):
            - Add implementation for new key method.
            * page/DiagnosticLoggingKeys.h:
            (WebCore::DiagnosticLoggingKeys::networkProcessCrashedKey):
            - Add declaration for new key method.

2016-11-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208286. rdar://problem/28634857

    2016-11-02  David Kilzer  <ddkilzer@apple.com>

            Add logging for "WebKit encountered an internal error" messages
            <https://webkit.org/b/164272>
            <rdar://problem/28546064>

            Reviewed by Alex Christensen.

            * page/DiagnosticLoggingKeys.cpp:
            (WebCore::DiagnosticLoggingKeys::internalErrorKey):
            (WebCore::DiagnosticLoggingKeys::invalidSessionIDKey):
            (WebCore::DiagnosticLoggingKeys::createSharedBufferFailedKey):
            (WebCore::DiagnosticLoggingKeys::synchronousMessageFailedKey):
            - Add implementations for new key methods.

            * page/DiagnosticLoggingKeys.h:
            (WebCore::DiagnosticLoggingKeys::internalErrorKey):
            (WebCore::DiagnosticLoggingKeys::invalidSessionIDKey):
            (WebCore::DiagnosticLoggingKeys::createSharedBufferFailedKey):
            (WebCore::DiagnosticLoggingKeys::synchronousMessageFailedKey):
            - Add declarations for new key methods.

2016-11-01  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r208255. rdar://problem/28962886

2016-11-01  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r208173. rdar://problem/28962886

2016-11-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r206637. rdar://problem/28718754

    2016-09-30  Said Abou-Hallawa  <sabouhallawa@apple.com>

            Unreviewed, fix 32-bit build.

            * loader/cache/CachedImage.cpp:
            (WebCore::CachedImage::decodedSizeChanged):

2016-10-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208151. rdar://problem/29032335

    2016-10-31  Jer Noble  <jer.noble@apple.com>

            Opt-out of AVPlayer automatic sleep disabling
            https://bugs.webkit.org/show_bug.cgi?id=163983

            Reviewed by Eric Carlson.

            In addition to the DisplaySleepDisabler, notify the MediaPlayerPrivateAVFoundationObjC object whether
            it should disable display sleep.  Provide all the necessary boilerplate to allow the media player private
            to query the HTMLMediaPlayer so that the correct value can be set on AVPlayer upon creation.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::updateSleepDisabling):
            * html/HTMLMediaElement.h:
            * platform/graphics/MediaPlayer.cpp:
            (WebCore::MediaPlayer::setShouldDisableSleep):
            (WebCore::MediaPlayer::shouldDisableSleep):
            * platform/graphics/MediaPlayer.h:
            (WebCore::MediaPlayerClient::mediaPlayerShouldDisableSleep):
            * platform/graphics/MediaPlayerPrivate.h:
            (WebCore::MediaPlayerPrivateInterface::setShouldDisableSleep):
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVPlayer):
            (WebCore::MediaPlayerPrivateAVFoundationObjC::setShouldDisableSleep):

            Drive-by fix: Re-organize the contents of AVFoundationSPI.h so that there's a single top-level
            #if USE(APPLE_INTERNAL_SDK) statement, rather than that conditional being sprinkled about the
            file.

            * platform/spi/mac/AVFoundationSPI.h:

2016-10-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208168. rdar://problem/28962886

    2016-10-28  Brent Fulgham  <bfulgham@apple.com>

            Do a better job of protecting Frame objects in the context of JavaScript calls
            https://bugs.webkit.org/show_bug.cgi?id=164163
            <rdar://problem/28955249>

            Reviewed by Darin Adler.

            * editing/AlternativeTextController.cpp:
            (WebCore::AlternativeTextController::respondToUnappliedSpellCorrection): Protected the Frame.
            * editing/Editor.cpp:
            (WebCore::Editor::setTextAsChildOfElement): Ditto.
            * editing/EditorCommand.cpp:
            (WebCore::executeSwapWithMark): Ditto.
            * editing/TypingCommand.cpp:
            (WebCore::TypingCommand::deleteKeyPressed): Ditto.
            (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.
            * editing/mac/EditorMac.mm:
            (WebCore::Editor::replaceNodeFromPasteboard): Ditto.
            * page/ContextMenuController.cpp:
            (WebCore::ContextMenuController::contextMenuItemSelected): Ditto.
            * page/DOMSelection.cpp:
            (WebCore::DOMSelection::collapse): Ditto.
            (WebCore::DOMSelection::collapseToEnd): Ditto.
            (WebCore::DOMSelection::collapseToStart): Ditto.
            (WebCore::DOMSelection::setBaseAndExtent): Ditto.
            (WebCore::DOMSelection::setPosition): Ditto.
            (WebCore::DOMSelection::modify): Ditto.
            (WebCore::DOMSelection::extend): Ditto.
            (WebCore::DOMSelection::addRange): Ditto.
            (WebCore::DOMSelection::deleteFromDocument): Ditto.
            * page/DragController.cpp:
            (WebCore::setSelectionToDragCaret): Ditto.
            (WebCore::DragController::startDrag): Ditto.
            * page/Frame.cpp:
            (WebCore::Frame::checkOverflowScroll): Ditto.
            * page/TextIndicator.cpp:
            (WebCore::TextIndicator::createWithRange): Ditto.

2016-10-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r208003. rdar://problem/28811878

    2016-10-27  Brent Fulgham  <bfulgham@apple.com>

            Prevent hit tests from being performed on an invalid render tree
            https://bugs.webkit.org/show_bug.cgi?id=163877
            <rdar://problem/28675761>

            Reviewed by Simon Fraser.

            Changeset r200971 added code to ensure that layout is up-to-date before hit testing, but did
            so only for the main frame. It was still possible to enter cross-frame hit testing with a
            subframe needing style recalc. In that situation, the subframe's updateLayout() would get
            called, which could trigger a compositing change that marked the parent frame as needing style
            recalc. A subsequent layout on the parent frame (for example by hit testing traversing into
            a second subframe) could then mutate the parent frame's layer tree while hit testing was
            traversing it.

            This patch modifies the hit test logic to ensure that a recursive layout is performed so that
            we always perform hit tests on a clean set of frames. It also adds some assertions to warn
            us if we encounter this invalid state.

            Tested by fast/layers/prevent-hit-test-during-layout.html.

            * dom/Document.cpp:
            (WebCore::Document::scheduleStyleRecalc): Assert that we are not hit testing
            during style recalculation.
            * page/EventHandler.cpp:
            (WebCore::EventHandler::hitTestResultAtPoint): Ensure that we have a clean render tree
            when hit testing.
            * page/FrameView.cpp:
            (WebCore::FrameView::setNeedsLayout): Assert that we are not in the process of hit testing
            when we schedule a layout.
            * rendering/RenderView.cpp:
            (WebCore::RenderView::hitTest): Mark RenderView as in an active hit test.
            * rendering/RenderView.h:

2016-10-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r206802. rdar://problem/28409525

    2016-10-28  Said Abou-Hallawa  <sabouhallawa@apple.com>

            The dragged image should be the current frame only of the animated image
            https://bugs.webkit.org/show_bug.cgi?id=162109

            Instead of creating an NSImage with all the frames for the dragImage,
            create an NSImage with the current frame only.

            * bindings/objc/DOM.mm:
            (-[DOMElement image]): Call the Image function with its new name.
            (-[DOMElement _imageTIFFRepresentation]): Ditto.
            * dom/DataTransferMac.mm:
            (WebCore::DataTransfer::createDragImage): Call snapshotNSImage() to create the dragImage.
            * editing/cocoa/HTMLConverter.mm:
            (fileWrapperForElement):  Call the Image function with its new name.
            * platform/graphics/BitmapImage.cpp:
            (WebCore::BitmapImage::framesNativeImages): Added.
            * platform/graphics/BitmapImage.h:
            * platform/graphics/Image.h:
            (WebCore::Image::framesNativeImages): Added.
            (WebCore::Image::nsImage): Rename getNSImage() to nsImage().
            (WebCore::Image::snapshotNSImage): Returns the NSImage of the current frame.
            (WebCore::Image::tiffRepresentation): Rename getTIFFRepresentation() to tiffRepresentation().
            (WebCore::Image::getNSImage): Deleted.
            (WebCore::Image::getTIFFRepresentation): Deleted.
            * platform/graphics/mac/ImageMac.mm:
            (WebCore::BitmapImage::tiffRepresentation): Rename getTIFFRepresentation() to tiffRepresentation().
            (WebCore::BitmapImage::nsImage): Rename getNSImage() to nsImage().
            (WebCore::BitmapImage::snapshotNSImage): Returns the NSImage of the current frame.
            (WebCore::BitmapImage::getTIFFRepresentation): Deleted.
            (WebCore::BitmapImage::getNSImage): Deleted.
            * platform/mac/CursorMac.mm:
            (WebCore::createCustomCursor): Call snapshotNSImage() since the cursor does not animate anyway.
            * platform/mac/DragImageMac.mm:
            (WebCore::createDragImageFromImage): Use snapshotNSImage() for the dragImage.
            * platform/mac/PasteboardMac.mm:
            (WebCore::Pasteboard::write): Call the Image function with its new name.

2016-10-27  Daniel Bates  <dabates@apple.com>

        Merge r207848. rdar://problem/28216276

    2016-10-25  Daniel Bates  <dabates@apple.com>

            REGRESSION (r178265): XSS Auditor fails to block document.write() of incomplete tag
            https://bugs.webkit.org/show_bug.cgi?id=163978
            <rdar://problem/25962131>

            Reviewed by Darin Adler.

            During the tokenization process of an HTML tag the start and end positions of each of its
            attributes is tracked so that the XSS Auditor can request a snippet around a suspected
            injected attribute. We need to take care to consider document.write() boundaries when
            tracking the start and end positions of each HTML tag and attribute so that the XSS Auditor
            receives the correct snippet. Following r178265 we no longer consider document.write()
            boundaries when tracking the start and end positions of attributes. So, the substring
            represented by the start and end positions of an attribute may correspond to some other
            attribute in the tag. Therefore the XSS Auditor may fail to block an injection because the
            snippet it requested may not be the snippet that it intended to request.

            Tests: http/tests/security/xssAuditor/dom-write-location-dom-write-open-img-onerror.html
                   http/tests/security/xssAuditor/dom-write-location-open-img-onerror.html
                   http/tests/security/xssAuditor/nested-dom-write-location-open-img-onerror.html

            * html/parser/HTMLSourceTracker.cpp:
            (WebCore::HTMLSourceTracker::startToken): Set the attribute base offset to be the token
            start position.
            (WebCore::HTMLSourceTracker::source): Use the specified attribute start position as-is. We no
            longer adjust it here because it was adjusted with respect to the attribute base offset, which
            takes into account document.write() boundaries.
            * html/parser/HTMLToken.h:
            (WebCore::HTMLToken::setAttributeBaseOffset): Added.
            (WebCore::HTMLToken::beginAttribute): Subtract attribute base offset from the specified offset.
            (WebCore::HTMLToken::endAttribute): Ditto.
            * html/parser/HTMLTokenizer.h:
            (WebCore::HTMLTokenizer::setTokenAttributeBaseOffset): Added.

2016-10-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207692. rdar://problem/28810751

    2016-10-20  Dean Jackson  <dino@apple.com>

            SVG should not paint selection within a mask
            https://bugs.webkit.org/show_bug.cgi?id=163772
            <rdar://problem/28705129>

            Reviewed by Simon Fraser.

            When masking content, we shouldn't paint the text
            selection as we are rendering into the masking
            offscreen buffer.

            Test: svg/masking/mask-should-not-paint-selection.html

            * rendering/PaintPhase.h: Add a new behavior - PaintBehaviorSkipSelectionHighlight.
            * rendering/svg/SVGInlineTextBox.cpp:
            (WebCore::SVGInlineTextBox::paint): Don't update the selectionStyle if
            PaintBehaviorSkipSelectionHighlight is true.
            * rendering/svg/SVGRenderingContext.cpp:
            (WebCore::SVGRenderingContext::renderSubtreeToImageBuffer): Add PaintBehaviorSkipSelectionHighlight
            to the PaintInfo.

2016-10-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207661. rdar://problem/28857478

    2016-10-21  Jer Noble  <jer.noble@apple.com>

            CRASH in SourceBuffer::sourceBufferPrivateDidReceiveSample + 2169
            https://bugs.webkit.org/show_bug.cgi?id=163735

            Reviewed by Eric Carlson.

            Test: media/media-source/media-source-sample-wrong-track-id.html

            When SourceBuffer receives a sample in sourceBufferPrivateDidReceiveSample() containing
            a trackID not previously seen in an initialization segment, it creates a default TrackBuffer
            object to contain that track's samples. One of the fields in TrackBuffer, description, is
            normally filled out when an initialization segment is received, but with this default
            TrackBuffer, it's still null when it's checked later in sourceBufferPrivateDidReceiveSample().

            Rather than adding a null-check on trackBuffer.description, drop any sample that has a
            trackID which was not present during a previous initialization segment.

            * Modules/mediasource/SourceBuffer.cpp:
            (WebCore::SourceBuffer::sourceBufferPrivateDidReceiveSample):

2016-10-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207631. rdar://problem/28810750

    2016-10-20  Zalan Bujtas  <zalan@apple.com>

            Stop searching for first-letter containers at multi-column boundary.
            https://bugs.webkit.org/show_bug.cgi?id=163739
            <rdar://problem/28810750>

            We should not cross the multi-column boundary while searching for the first-letter container.
            While moving first-letter renderers to a multi-column parent, it could result in finding the wrong
            container and end up adding a new wrapper under the original container (from where we are moving the renderers).

            Reviewed by David Hyatt.

            Test: fast/css-generated-content/first-letter-move-to-multicolumn-crash.html

            * rendering/RenderBoxModelObject.cpp:
            (WebCore::RenderBoxModelObject::moveChildrenTo):
            * rendering/RenderTextFragment.cpp:
            (WebCore::RenderTextFragment::blockForAccompanyingFirstLetter):

2016-10-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207477. rdar://problem/28810756

    2016-10-18  Brent Fulgham  <bfulgham@apple.com>

            Correct Document::removeAllEventListeners
            https://bugs.webkit.org/show_bug.cgi?id=163558
            <rdar://problem/28716840>

            Reviewed by Chris Dumez.

            Tested by fast/dom/node-move-to-new-document-crash-main.html.

            * dom/Document.cpp:
            (WebCore::Document::removeAllEventListeners): Clear out the wheel and
            touch event targets when clearing all data.

2016-10-26  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207221. rdar://problem/28894492

    2016-10-12  Brent Fulgham  <bfulgham@apple.com>

            [WebGL] Revise vertex array attribute checks to account for lazy memory allocation.
            https://bugs.webkit.org/show_bug.cgi?id=163149
            <rdar://problem/28629774>

            Reviewed by Dean Jackson.

            Tested by fast/canvas/webgl/webgl-drawarrays-crash-2.html

            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::validateVertexAttributes):

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r206771. rdar://problem/28811939

    2016-10-04  Wenson Hsieh  <wenson_hsieh@apple.com>

            Media controls are displayed in the incorrect state momentarily after switching between tabs playing media
            https://bugs.webkit.org/show_bug.cgi?id=162766
            <rdar://problem/28533523>

            Reviewed by Jer Noble.

            When showing Now Playing controls for a media session, we should first set up the Now Playing info and
            playback state before telling MediaRemote to make the session visible. This is WebKit work in ensuring that
            when switching Now Playing sessions by switching tabs, we do not first display an invalid Now Playing state
            before updating to the expected state.

            Adds 2 new WebKit API tests in NowPlayingControlsTests: NowPlayingControlsHideAfterShowingClearsInfo and
            NowPlayingControlsClearInfoAfterSessionIsNoLongerValid.

            * platform/audio/PlatformMediaSessionManager.h:
            (WebCore::PlatformMediaSessionManager::lastUpdatedNowPlayingTitle):
            (WebCore::PlatformMediaSessionManager::lastUpdatedNowPlayingDuration):
            (WebCore::PlatformMediaSessionManager::lastUpdatedNowPlayingElapsedTime):
            (WebCore::PlatformMediaSessionManager::hasActiveNowPlayingSession): Deleted.
            * platform/audio/mac/MediaSessionManagerMac.h:
            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207275. rdar://problem/28810752

    2016-10-12  Zalan Bujtas  <zalan@apple.com>

            RenderRubyRun should not mark child renderers dirty at the end of layout.
            https://bugs.webkit.org/show_bug.cgi?id=163359
            <rdar://problem/28711840>

            Reviewed by David Hyatt.

            The current layout logic does not support marking renderers dirty for subsequent layouts.
            Layout needs to exit with a clean tree.
            Should relayoutChild be insufficient, we could also mark the base/text dirty for the justified content.

            Test: fast/ruby/rubyrun-has-bad-child.html

            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::RenderBlockFlow::updateRubyForJustifiedText):
            * rendering/RenderRubyRun.cpp:
            (WebCore::RenderRubyRun::layout):
            (WebCore::RenderRubyRun::layoutBlock):
            * rendering/RenderRubyRun.h:

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r206712. rdar://problem/28216065

    2016-10-01  Simon Fraser  <simon.fraser@apple.com>

            Bad cast when CSS position programmatically changed from -webkit-sticky to fixed
            https://bugs.webkit.org/show_bug.cgi?id=160826

            Reviewed by Zalan Bujtas.

            If a scrolling state tree node changed type (e.g. from sticky to fixed), we'd fail
            to recreate the node so keep a node with the wrong type.

            Fix by destroying the node and making a new one with a new ID in this case. The
            new ID is necessary to ensure that the scrolling tree is updated.

            Test: fast/scrolling/sticky-to-fixed.html

            * page/scrolling/ScrollingStateTree.cpp:
            (WebCore::ScrollingStateTree::nodeTypeAndParentMatch):
            (WebCore::ScrollingStateTree::attachNode):
            (WebCore::ScrollingStateTree::stateNodeForID):
            * page/scrolling/ScrollingStateTree.h:

2016-10-20  Matthew Hanson  <matthew_hanson>

        Merge r206217. rdar://problem/28811877

    2016-09-21  Daniel Bates  <dabates@apple.com>

            REGRESSION (r201090): Setting style.webkitTextSizeAdjust does not change text change on iPad
            https://bugs.webkit.org/show_bug.cgi?id=162227
            <rdar://problem/27201529>

            Reviewed by Simon Fraser.

            The CSS property -webkit-text-size-adjust should be respected on all iOS devices. Following
            r201090 we respect it only on iPhone and in iPhone-apps run on iPad.

            Tests: fast/text-autosizing/ios/ipad/programmatic-text-size-adjust.html
                   fast/text-autosizing/ios/ipad/text-size-adjust-inline-style.html
                   fast/text-autosizing/ios/programmatic-text-size-adjust.html
                   fast/text-autosizing/ios/text-size-adjust-inline-style.html
                   fast/text-autosizing/text-size-adjust-inline-style.html

            * css/parser/CSSParser.cpp:
            (WebCore::isValidKeywordPropertyAndValue): Remove unused code to validate -webkit-text-size-adjust.
            This code is never used because -webkit-text-size-adjust is a value property (since it accepts a
            <percentage> as a value and CSSParserFastPaths::isKeywordPropertyID(CSSPropertyWebkitTextSizeAdjust)
            returns false). That is, it is not a keyword property.
            (WebCore::CSSParser::parseValue): Always enable the -webkit-text-size-adjust CSS property when
            building for iOS regardless of whether Settings:textAutosizingEnabled() is enabled.

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r204637. rdar://problem/28216256

    2016-08-16  Simon Fraser  <simon.fraser@apple.com>

            Rename didLayout(LayoutMilestones) to didReachLayoutMilestone(), and related WK2 functions
            https://bugs.webkit.org/show_bug.cgi?id=160923

            Reviewed by Tim Horton.

            didLayout(LayoutMilestones) -> didReachLayoutMilestone(LayoutMilestones)
            dispatchDidLayout(LayoutMilestones) -> dispatchDidReachLayoutMilestone(LayoutMilestones)

            * dom/Document.cpp:
            (WebCore::Document::setVisualUpdatesAllowed):
            * loader/EmptyClients.h:
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::didReachLayoutMilestone):
            (WebCore::FrameLoader::didLayout): Deleted.
            * loader/FrameLoader.h:
            * loader/FrameLoaderClient.h:
            * page/FrameView.cpp:
            (WebCore::FrameView::fireLayoutRelatedMilestonesIfNeeded):
            (WebCore::FrameView::firePaintRelatedMilestonesIfNeeded):
            * page/LayoutMilestones.h: Formatting
            * page/Page.cpp:
            (WebCore::Page::addRelevantRepaintedObject):

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r207157. rdar://problem/28857500

    2016-10-11  Daniel Bates  <dabates@apple.com>

            [iOS] Sandbox QuickLook previews
            https://bugs.webkit.org/show_bug.cgi?id=163240
            <rdar://problem/25961633>

            Fix bad merge following r207151.

            * platform/network/cf/ResourceResponse.h: Define m_isQuickLook.

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r206132. rdar://problem/28634856

    2016-09-19  Anders Carlsson  <andersca@apple.com>

            Suppress JavaScript prompts early on in certain cases
            https://bugs.webkit.org/show_bug.cgi?id=162243
            rdar://problem/27661602

            Reviewed by Geoffrey Garen.

            Export symbols needed by WebKit2.

            * loader/FrameLoader.h:
            * loader/FrameLoaderStateMachine.h:

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205326. rdar://problem/28476952

    2016-09-01  Ricky Mondello  <rmondello@apple.com>

            YouTube Flash plug-in replacement facility should not insert showinfo=0 into iframe URLs
            https://bugs.webkit.org/show_bug.cgi?id=161478
            <rdar://problem/28050847>

            Reviewed by Eric Carlson.

            * Modules/plugins/YouTubePluginReplacement.cpp:
            (WebCore::YouTubePluginReplacement::youTubeURLFromAbsoluteURL): Stop adding the query parameter.

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205306. rdar://problem/28476952

    2016-09-01  Ricky Mondello  <rmondello@apple.com>

            YouTube Flash plug-in replacement facility should more gracefully handle malformed queries
            https://bugs.webkit.org/show_bug.cgi?id=161476
            <rdar://problem/28050847>

            Reviewed by Eric Carlson.

            Some YouTube Flash embeds use '&' instead of '?' to start the query portion of the URL. Before this patch,
            our implementation discards all parts of the path after the '&', which could drop important query information
            like the start time for the video. This patch treats anything after that '&' as a "malformed query" and uses
            it as the query to restore to the transformed URL if there was no actual query in the original URL.

            * Modules/plugins/YouTubePluginReplacement.cpp:
            (WebCore::processAndCreateYouTubeURL): Add an out-parameter for the path after the first ampersand.
            (WebCore::YouTubePluginReplacement::youTubeURLFromAbsoluteURL): If the input URL had no query, append
                the possibly malformed one found after the first ampersand to the replacement URL.

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205274. rdar://problem/28476952

    2016-08-31  Ricky Mondello  <rmondello@apple.com>

            Enable the YouTube Flash plug-in replacement behavior on all Cocoa ports
            https://bugs.webkit.org/show_bug.cgi?id=161453
            <rdar://problem/28050847>

            Reviewed by Eric Carlson.

            Now that we have some tests for the URL transformation logic (r205212) and the ability to enable the YouTube
            Flash plug-in replacement behavior independently from the QuickTime plug-in replacement behavior (r205214 and
            r205271), enable the YouTube Flash plug-in replacement behavior for Cocoa ports. We can and will continue to
            improve it.

            * page/Settings.cpp: Enable the feature for PLATFORM(COCOA), rather than just PLATFORM(IOS).

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205271. rdar://problem/28476952

    2016-08-31  Ricky Mondello  <rmondello@apple.com>

            Break pluginReplacementEnabled into youTubeFlashPluginReplacementEnabled and quickTimePluginReplacementEnabled
            https://bugs.webkit.org/show_bug.cgi?id=161424
            <rdar://problem/28050847>

            Reviewed by Dean Jackson.

            Replace the single pluginReplacementEnabled setting with individual settings for the YouTube Flash plug-in
            behavior and the QuickTime plug-in behavior. Unless otherwise noted, this change copies the existing plumbing
            for pluginReplacementEnabled and renames it twice. The default values for these settings remain the same.

            * Modules/plugins/PluginReplacement.h:
            (WebCore::ReplacementPlugin::ReplacementPlugin): Augment the constructor.
            (WebCore::ReplacementPlugin::isEnabledBySettings): Added.
            * Modules/plugins/QuickTimePluginReplacement.h: Declare a static member function.
            * Modules/plugins/QuickTimePluginReplacement.mm:
            (WebCore::QuickTimePluginReplacement::registerPluginReplacement): Properly create a ReplacementPlugin instance.
            (WebCore::QuickTimePluginReplacement::isEnabledBySettings): Added.
            * Modules/plugins/YouTubePluginReplacement.cpp:
            (WebCore::YouTubePluginReplacement::registerPluginReplacement): Properly create a ReplacementPlugin instance.
            (WebCore::YouTubePluginReplacement::isEnabledBySettings): Added.
            * Modules/plugins/YouTubePluginReplacement.h: Declare a static member function.
            * html/HTMLPlugInElement.cpp:
            (WebCore::HTMLPlugInElement::requestObject): Ask the ReplacementPlugin whether it's enabled, rather than assume
                all plug-in replacement is guarded by a single run-time setting.
            * page/Settings.cpp: Declare values for defaults for both settings.
            * page/Settings.in: Declare two settings.
            * testing/InternalSettings.cpp:
            (WebCore::InternalSettings::Backup::Backup): Handle both settings.
            (WebCore::InternalSettings::Backup::restoreTo): Ditto.
            (WebCore::InternalSettings::setQuickTimePluginReplacementEnabled): Added.
            (WebCore::InternalSettings::setYouTubeFlashPluginReplacementEnabled): Added.
            (WebCore::InternalSettings::setPluginReplacementEnabled): Deleted.
            * testing/InternalSettings.h: Duplicate and rename.
            * testing/InternalSettings.idl: Ditto.

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205214. rdar://problem/28476952

    2016-08-30  Ricky Mondello  <rmondello@apple.com>

            "pluginReplacementEnabled" should be a Setting, not a RuntimeEnabledFeature
            https://bugs.webkit.org/show_bug.cgi?id=161416
            <rdar://problem/28050847>

            Reviewed by Simon Fraser.

            Mostly mechanical. Tested by running LayoutTests/plugins/quicktime-plugin-replacement.html and manually toggling
            defaultPluginReplacementEnabled and observing a behavior change.

            * bindings/generic/RuntimeEnabledFeatures.cpp:
            (WebCore::RuntimeEnabledFeatures::reset): Purged of the pluginReplacementEnabled setting.
            * bindings/generic/RuntimeEnabledFeatures.h:
            (WebCore::RuntimeEnabledFeatures::setPluginReplacementEnabled): Deleted.
            (WebCore::RuntimeEnabledFeatures::pluginReplacementEnabled): Deleted.
            * html/HTMLPlugInElement.cpp:
            (WebCore::HTMLPlugInElement::requestObject): Use the setting.
            * page/Settings.cpp: Supply different values for iOS and other platforms, matching the RuntimeEnabledFeature values,
                enabled for iOS and disabled otherwise.
            * page/Settings.in: Declare the setting.
            * testing/InternalSettings.cpp:
            (WebCore::InternalSettings::Backup::Backup): Use the setting.
            (WebCore::InternalSettings::Backup::restoreTo): Ditto.
            (WebCore::InternalSettings::setPluginReplacementEnabled): Ditto.
            * testing/InternalSettings.h: Can now throw an exception, like other Settings-backed members.
            * testing/InternalSettings.idl: Declare this as possibly throwing an exception.

2016-10-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205212. rdar://problem/28476952

    2016-08-30  Ricky Mondello  <rmondello@apple.com>

            YouTubePluginReplacementTest's URL transformation logic should have tests
            https://bugs.webkit.org/show_bug.cgi?id=161406
            <rdar://problem/28050847>

            Reviewed by Eric Carlson.

            Refactor most of YouTubePluginReplacement::youTubeURL into a static method that can be used by TestWebKitAPI.

            * Modules/plugins/YouTubePluginReplacement.cpp:
            (WebCore::YouTubePluginReplacement::youTubeURL): Now implemented in terms of youTubeURLFromAbsoluteURL.
            (WebCore::YouTubePluginReplacement::youTubeURLFromAbsoluteURL): Absorbs most of youTubeURL.
            * Modules/plugins/YouTubePluginReplacement.h: Declare a public method, for the benefit of testing.
            * WebCore.xcodeproj/project.pbxproj: Make some heads private for TestWebKitAPI's benefit.

2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r206975. rdar://problem/28545012

    2016-10-07  Ryosuke Niwa  <rniwa@webkit.org>

            REGRESSION(r165103): labels list doesn't get invalidated when other lists are invalidated at document level
            https://bugs.webkit.org/show_bug.cgi?id=163145

            Reviewed by Darin Adler.

            The bug was caused by Document::invalidateNodeListAndCollectionCaches removing all node lists regardless
            of whether they have been invalidated or not.

            Fixed the bug by removing only those node lists that got invalidated via LiveNodeList::invalidateCache.

            Test: fast/dom/NodeList/form-labels-length.html

            * dom/Document.cpp:
            (WebCore::Document::Document):
            (WebCore::Document::unregisterNodeListForInvalidation): Removed the conditional which allowed removal to
            happen while m_listsInvalidatedAtDocument is empty inside invalidateNodeListAndCollectionCaches.
            * dom/Document.h:
            * dom/Node.cpp:
            (WebCore::Document::invalidateNodeListAndCollectionCaches): Just remove the node lists being invalidated via
            LiveNodeList's invalidateCache, which calls unregisterNodeListForInvalidation, instead of removing them all.
            We make a copy of the list of node lists into a local vector because mutating HashMap while iterating over it
            is not a safe operation.

2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205197. rdar://problem/28481424

    2016-08-30  Brent Fulgham  <bfulgham@apple.com>

            Use of uninitialised memory in TransformationMatrx::blend4()
            https://bugs.webkit.org/show_bug.cgi?id=134621
            <rdar://problem/27337539>

            Reviewed by Dean Jackson.

            Change is based on the Blink change (patch by <alancutter@chromium.org>):
            <https://src.chromium.org/viewvc/blink?revision=177453&view=revision>

            TransformationMatrix::blend() was attempting to blend between non-invertable
            matricies. This resulted in garbage stack variables being used.
            This patch ensures that blend() will fall back to a 50% step interpolation
            when one of the sides are not invertable.

            Tested by new TransformationMatrix test in TestWebKitAPI.

            * platform/graphics/transforms/TransformationMatrix.cpp:
            (WebCore::TransformationMatrix::blend2): Properly handle failure in the
            decompose method calls.
            (WebCore::TransformationMatrix::blend4): Ditto.

2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r205190. rdar://problem/28545010

    2016-08-30  Youenn Fablet  <youenn@apple.com>

            [Fetch API] Blob not found URL should result in a network error
            https://bugs.webkit.org/show_bug.cgi?id=161381

            Reviewed by Sam Weinig.

            Covered by rebased and updated tests.

            Raising a network error if no blob can be found from the URL.
            It is no longer notified by a 404 response.

            Updated FileReaderLoader to generate the correct exception.

            Made some clean-up in the code, in particular adding an enum class for BlobResourceHandle errors.

            * fileapi/FileReaderLoader.cpp:
            (WebCore::FileReaderLoader::didFail):
            (WebCore::FileReaderLoader::toErrorCode):
            (WebCore::FileReaderLoader::httpStatusCodeToErrorCode):
            * fileapi/FileReaderLoader.h:
            * platform/network/BlobResourceHandle.cpp:
            (WebCore::BlobResourceHandle::loadResourceSynchronously):
            (WebCore::BlobResourceHandle::doStart):
            (WebCore::BlobResourceHandle::didGetSize):
            (WebCore::BlobResourceHandle::readSync):
            (WebCore::BlobResourceHandle::readFileSync):
            (WebCore::BlobResourceHandle::readAsync):
            (WebCore::BlobResourceHandle::didOpen):
            (WebCore::BlobResourceHandle::didRead):
            (WebCore::BlobResourceHandle::failed):
            (WebCore::BlobResourceHandle::notifyResponse):
            (WebCore::BlobResourceHandle::notifyResponseOnError):
            (WebCore::BlobResourceHandle::notifyFail):
            * platform/network/BlobResourceHandle.h:

2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r204631. rdar://problem/28481427

    2016-08-19  Chris Dumez  <cdumez@apple.com>

            DumpRenderTree crashed in com.apple.WebCore: WebCore::DOMWindow::resetDOMWindowProperties + 607
            https://bugs.webkit.org/show_bug.cgi?id=160983
            <rdar://problem/26768524>

            Reviewed by Brent Fulgham.

            Update DOMWindow::frameDestroyed() to ref the window object as the crash
            traces seem to indicate it can get destroyed during the execution of this
            method. Also update the code in the ~Frame destructor to not iterate over
            the list of FrameDestructionObservers because observers remove themselves
            from the list when they get destroyed.

            No new tests, do not know how to reproduce.

            * page/DOMWindow.cpp:
            (WebCore::DOMWindow::frameDestroyed):
            * page/Frame.cpp:
            (WebCore::Frame::~Frame):

2016-10-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r204266. rdar://problem/28216261

    2016-08-08  John Wilander  <wilander@apple.com>

            Popups opened from a sandboxed iframe should themselves be sandboxed
            https://bugs.webkit.org/show_bug.cgi?id=134850
            <rdar://problem/27375388>

            Reviewed by Brent Fulgham.

            Test: http/tests/security/window-opened-from-sandboxed-iframe-should-inherit-sandbox.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy):
                Now copies the opener's frame loader effective sandbox flags to the
                new frame loader.

2016-10-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r203383. rdar://problem/28216264

    2016-07-18  Brent Fulgham  <bfulgham@apple.com>

            Don't associate form-associated elements with forms in other trees.
            https://bugs.webkit.org/show_bug.cgi?id=119451
            <rdar://problem/27382946>

            Change is based on the Blink change (patch by <adamk@chromium.org>):
            <https://chromium.googlesource.com/chromium/blink/+/0b33128be67e7845d495d5219614c02ccfe7a414>

            Reviewed by Chris Dumez.

            Prevent elements from being associated with forms that are not part of the same home subtree.
            This brings us in line with the WhatWG HTML specification as of September, 2013.

            Tests: fast/forms/image-disconnected-during-parse.html
                   fast/forms/input-disconnected-during-parse.html

            * dom/Element.h:
            (WebCore::Node::rootElement): Added.
            * html/FormAssociatedElement.cpp:
            (WebCore::FormAssociatedElement::insertedInto): If the element is associated with a form that
            is not part of the same tree, remove the association.
            * html/HTMLImageElement.cpp:
            (WebCore::HTMLImageElement::insertedInto): Ditto.

2016-09-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r206518. rdar://problem/28505032

    2016-09-28  Jer Noble  <jer.noble@apple.com>

            [MSE][Mac] In SourceBufferPrivateAVFObjC::abort(), support reseting parser to the last appended initialization segment.
            https://bugs.webkit.org/show_bug.cgi?id=135164

            Reviewed by Eric Carlson.

            Test: media/media-source/media-source-abort-resets-parser.html

            Use the -[AVStreamDataParser appendStreamData:withFlags:] to implement "resetting" the parser. In this case,
            the parser isn't explicitly reset during resetParserState(), but rather a flag is set so that the next append
            signals a data discontinuity, and the parser is reset at that point.

            Because a previous append operation may be in-flight during this abort(), care must be taken to invalidate any
            operations which may have already started on a background thread. So SourceBufferPrivateAVFObjC will use a
            separate WeakPtrFactory for its append operations, will invalidate any outstanding WeakPtrs during an abort(),
            and will block until the previous append() operation completes.

            This will require the WebAVStreamDataParserListener object to occasionally have it's WeakPtr pointing back to the
            SourceBufferPrivateAVFObjC to be reset after an abort(), so make that ivar an @property. Rather than passing a
            RetainPtr to itself in all the callbacks it handles, the WebAVStreamDataParserListener can just pass in a copy
            of its own WeakPtr (which may be invalidated during an abort()).

            Break the distinct operations of "abort()" and "resetParserState()" into their own methods in SourceBufferPrivate
            and all its subclasses.

            * Modules/mediasource/SourceBuffer.cpp:
            (WebCore::SourceBuffer::resetParserState):
            (WebCore::SourceBuffer::abortIfUpdating):
            * platform/graphics/SourceBufferPrivate.h:
            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
            (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:]):
            (-[WebAVStreamDataParserListener streamDataParser:didParseStreamDataAsAsset:withDiscontinuity:]):
            (-[WebAVStreamDataParserListener streamDataParser:didFailToParseStreamDataWithError:]):
            (-[WebAVStreamDataParserListener streamDataParser:didProvideMediaData:forTrackID:mediaType:flags:]):
            (-[WebAVStreamDataParserListener streamDataParser:didReachEndOfTrackWithTrackID:mediaType:]):
            (-[WebAVStreamDataParserListener streamDataParserWillProvideContentKeyRequestInitializationData:forTrackID:]):
            (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]):
            (WebCore::SourceBufferPrivateAVFObjC::SourceBufferPrivateAVFObjC):
            (WebCore::SourceBufferPrivateAVFObjC::append):
            (WebCore::SourceBufferPrivateAVFObjC::abort):
            (WebCore::SourceBufferPrivateAVFObjC::resetParserState):
            (-[WebAVStreamDataParserListener initWithParser:parent:]): Deleted.
            * platform/graphics/gstreamer/SourceBufferPrivateGStreamer.cpp:
            (WebCore::SourceBufferPrivateGStreamer::resetParserState):
            * platform/graphics/gstreamer/SourceBufferPrivateGStreamer.h:
            * platform/mock/mediasource/MockSourceBufferPrivate.cpp:
            (WebCore::MockSourceBufferPrivate::resetParserState):
            * platform/mock/mediasource/MockSourceBufferPrivate.h:
            * platform/spi/mac/AVFoundationSPI.h:

2016-09-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r206399. rdar://problem/28457219

    2016-09-26  Wenson Hsieh  <wenson_hsieh@apple.com>

            Seeking video doesn't update seek position
            https://bugs.webkit.org/show_bug.cgi?id=162575
            <rdar://problem/28457219>

            Reviewed by Jer Noble.

            On ToT, seeking in a video causes the playhead to stutter, and does not actually update media remote's seek
            position. This is partly due to how we do not update media remote with new information when beginning to respond
            to remote seek commands, so media remote continues to think that a playing video is still playing despite the
            user attempting to seek through it.

            To fix this, we introduce timer-based guards around remote seek commands, such that a seek "gesture" begins when
            we receive the first seek command and ends when no seek command has been received in a set amount of time (this
            is 0.5 seconds, which is approximately what other clients around the platform use).

            Also, when responding to a remote seek, perform the seek with no tolerance. This prevents the playhead from
            stuttering at the end of a seek from the final requested destination of the seek to the last actually seeked
            time in the video.

            When beginning to seek, we must pause the media. Through existing mechanisms, this causes the media session
            manager to update its Now Playing information, which informs media remote that we are no longer playing and
            prevents us from stuttering. However, when ending a seek, we must also trigger an additional update to again
            refresh media remote's view of the current time. This prevents a flicker when playing media after seeking.

            Unit tests to be added in a follow-up due to time constraints.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::HTMLMediaElement):
            (WebCore::HTMLMediaElement::handleSeekToPlaybackPosition):
            (WebCore::HTMLMediaElement::seekToPlaybackPositionEndedTimerFired):
            (WebCore::HTMLMediaElement::didReceiveRemoteControlCommand):
            * html/HTMLMediaElement.h:
            * platform/audio/PlatformMediaSessionManager.h:
            (WebCore::PlatformMediaSessionManager::scheduleUpdateNowPlayingInfo):
            (WebCore::PlatformMediaSessionManager::sessionDidEndRemoteScrubbing):
            (WebCore::PlatformMediaSessionManager::sessions): Deleted.
            * platform/audio/mac/MediaSessionManagerMac.h:
            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::PlatformMediaSessionManager::updateNowPlayingInfoIfNecessary):
            (WebCore::MediaSessionManagerMac::scheduleUpdateNowPlayingInfo):
            (WebCore::MediaSessionManagerMac::sessionDidEndRemoteScrubbing):
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):

2016-09-26  Babak Shafiei  <bshafiei@apple.com>

        Merge r206375. rdar://problem/28484393

    2016-09-26  Per Arne Vollan  <pvollan@apple.com>

            [Win][Debug] Compile fix.
            https://bugs.webkit.org/show_bug.cgi?id=162550

            Reviewed by Alex Christensen.

            Windows headers need the FragmentForwardIterator '==' operator in debug mode.

            * rendering/SimpleLineLayout.cpp:
            (WebCore::SimpleLineLayout::FragmentForwardIterator::operator==):

2016-09-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r203982. rdar://problem/27547583

    2016-08-01  Eric Carlson  <eric.carlson@apple.com>

            [Mac][iOS] Adopt MediaRemote "seek to playback position"
            https://bugs.webkit.org/show_bug.cgi?id=160405
            <rdar://problem/27547583>

            Reviewed by Dean Jackson.

            Test: media/remote-control-command-seek.html

            * Modules/webaudio/AudioContext.h: Update for didReceiveRemoteControlCommand argument change.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::didReceiveRemoteControlCommand): Support SeekToPlaybackPositionCommand.
            Drive by fix, support Stop command.
            (WebCore::HTMLMediaElement::supportsSeeking): New.
            * html/HTMLMediaElement.h:

            * platform/RemoteCommandListener.h:
            (WebCore::RemoteCommandListenerClient::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::RemoteCommandListenerClient::supportsSeeking): New.
            (WebCore::RemoteCommandListener::updateSupportedCommands): Ditto.
            (WebCore::RemoteCommandListener::client): Ditto.

            * platform/audio/PlatformMediaSession.cpp:
            (WebCore::PlatformMediaSession::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::PlatformMediaSession::supportsSeeking): New, pass through to client.
            * platform/audio/PlatformMediaSession.h:

            * platform/audio/PlatformMediaSessionManager.cpp:
            (WebCore::PlatformMediaSessionManager::setCurrentSession): Tell remote command listener to
            update supported commands.
            (WebCore::PlatformMediaSessionManager::currentSession): Make const.
            (WebCore::PlatformMediaSessionManager::didReceiveRemoteControlCommand): Add command argument.
            (WebCore::PlatformMediaSessionManager::supportsSeeking): New, pass through to session.
            * platform/audio/PlatformMediaSessionManager.h:

            * platform/ios/RemoteCommandListenerIOS.h:
            (WebCore::RemoteCommandListenerIOS::createWeakPtr):
            * platform/ios/RemoteCommandListenerIOS.mm:
            (WebCore::RemoteCommandListenerIOS::RemoteCommandListenerIOS): Support changePlaybackPositionCommand.
            (WebCore::RemoteCommandListenerIOS::~RemoteCommandListenerIOS): Remove seekToTime target.
            (WebCore::RemoteCommandListenerIOS::updateSupportedCommands): Update changePlaybackPositionCommand.

            * platform/mac/MediaRemoteSoftLink.cpp:
            * platform/mac/MediaRemoteSoftLink.h:

            * platform/mac/RemoteCommandListenerMac.h:
            * platform/mac/RemoteCommandListenerMac.mm:
            (WebCore::RemoteCommandListenerMac::updateSupportedCommands): New, split out of constructor.
            (WebCore::RemoteCommandListenerMac::RemoteCommandListenerMac): Split setup logic out into
            updateSupportedCommands. Support MRMediaRemoteCommandSeekToPlaybackPosition. Don't assert when
            receiving an unsupported command, it happens. Return error when a command isn't supported or
            fails.

            * testing/Internals.cpp:
            (WebCore::Internals::postRemoteControlCommand): Add command argument parameter. Support
            seektoplaybackposition.
            * testing/Internals.h:
            * testing/Internals.idl:

2016-09-22  Babak Shafiei  <bshafiei@apple.com>

        Merge r206193. rdar://problem/28376161

    2016-09-20  Jer Noble  <jer.noble@apple.com>

            Adopt MRMediaRemoteSetParentApplication.
            https://bugs.webkit.org/show_bug.cgi?id=162259
            <rdar://problem/28376161>

            Reviewed by Anders Carlsson.

            Allow MediaSessionManagerMac to retrieve the correct parent application identifier
            from a PlatformMediaSession so that it can pass that identifier through to MediaRemote
            via MRMediaRemoteSetParentApplication.

            * Modules/webaudio/AudioContext.cpp:
            (WebCore::AudioContext::sourceApplicationIdentifier):
            * Modules/webaudio/AudioContext.h:
            * platform/audio/PlatformMediaSession.cpp:
            (WebCore::PlatformMediaSession::sourceApplicationIdentifier):
            * platform/audio/PlatformMediaSession.h:
            (WebCore::PlatformMediaSession::resetPlaybackSessionState): Deleted.
            * platform/audio/mac/MediaSessionManagerMac.mm:
            (WebCore::MediaSessionManagerMac::updateNowPlayingInfo):
            * platform/mac/MediaRemoteSoftLink.cpp:
            * platform/mac/MediaRemoteSoftLink.h:


2016-09-12  Babak Shafiei  <bshafiei@apple.com>

        Merge r204943. rdar://problem/28233330

    2016-08-24  Ryan Haddad  <ryanhaddad@apple.com>

            Rebaseline bindings tests after r204923.

            Unreviewed test gardening.

            * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
            (WebCore::jsTestActiveDOMObjectExcitingAttr):
            (WebCore::jsTestActiveDOMObjectPrototypeFunctionExcitingFunction):

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r203381. rdar://problem/27860536

    2016-07-18  Anders Carlsson  <andersca@apple.com>

            WebKit nightly fails to build on macOS Sierra
            https://bugs.webkit.org/show_bug.cgi?id=159902
            rdar://problem/27365672

            Reviewed by Tim Horton.

            * Modules/applepay/cocoa/PaymentCocoa.mm:
            * Modules/applepay/cocoa/PaymentContactCocoa.mm:
            * Modules/applepay/cocoa/PaymentMerchantSessionCocoa.mm:
            * Modules/applepay/cocoa/PaymentMethodCocoa.mm:
            Use new PassKitSPI header.

            * WebCore.xcodeproj/project.pbxproj:
            Add new PassKitSPI header.

            * icu/unicode/ucurr.h: Added.
            Add ucurr.h from ICU.

            * platform/spi/cocoa/PassKitSPI.h: Added.
            Add new PassKitSPI header.

2016-09-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r205381. rdar://problem/27806012

    2016-09-02  Beth Dakin  <bdakin@apple.com>

            Need to updateEditorState if an element change edit-ability without changing
            selection
            https://bugs.webkit.org/show_bug.cgi?id=161546
            -and corresponding-
            rdar://problem/27806012

            Reviewed by Ryosuke Niwa.

            Call into the client in case edited state needs to be updated.
            * editing/FrameSelection.cpp:
            (WebCore::FrameSelection::updateAppearanceAfterLayout):
            * loader/EmptyClients.h:
            * page/EditorClient.h:

2016-08-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r205044. rdar://problem/27933564

    2016-08-26  Beth Dakin  <bdakin@apple.com>

            charactersAroundPosition can be wrong because it crosses editing boundaries
            https://bugs.webkit.org/show_bug.cgi?id=161215
            -and corresponding-
            rdar://problem/27933564

            Reviewed by Ryosuke Niwa.

            charactersAroundPosition() should not cross editing boundaries. This patch fixes
            that by making nextCharacterBoundaryInDirection() take an
            EditingBoundaryCrossingRule parameter to pass onto VisiblePosition::next() and
            VisiblePosition::previous().

            * editing/VisibleUnits.cpp:
            (WebCore::nextCharacterBoundaryInDirection):
            (WebCore::positionOfNextBoundaryOfGranularity):
            (WebCore::charactersAroundPosition):

2016-08-30  Babak Shafiei  <bshafiei@apple.com>

        Merge r203542. rdar://problem/27991570

    2016-07-21  John Wilander  <wilander@apple.com>

            Block mixed content synchronous XHR
            https://bugs.webkit.org/show_bug.cgi?id=105462
            <rdar://problem/13666424>

            Reviewed by Brent Fulgham.

            Test: http/tests/security/mixedContent/insecure-xhr-sync-in-main-frame.html

            * loader/DocumentThreadableLoader.cpp:
            (WebCore::DocumentThreadableLoader::loadRequest):

2016-08-23  Babak Shafiei  <bshafiei@apple.com>

        Merge r204610. rdar://problem/27750446

    2016-08-18  Beth Dakin  <bdakin@apple.com>

            Update the accessibility titles for list insertion
            https://bugs.webkit.org/show_bug.cgi?id=160972
            -and corresponding-
            rdar://problem/27750446

            Reviewed by Chris Fleizach.

            Update accessibility titles based on feedback.
            * English.lproj/Localizable.strings:
            * platform/LocalizedStrings.cpp:
            (WebCore::insertListTypeNone):
            (WebCore::insertListTypeBulleted):
            (WebCore::insertListTypeBulletedAccessibilityTitle):
            (WebCore::insertListTypeNumbered):
            (WebCore::insertListTypeNumberedAccessibilityTitle):
            (WebCore::insertListTypeNoneAccessibilityTitle): Deleted.
            * platform/LocalizedStrings.h:

2016-08-17  Babak Shafiei  <bshafiei@apple.com>

        Merge r204587. rdar://problem/27807479

    2016-08-17  Anders Carlsson  <andersca@apple.com>

            Add support for additional networks
            https://bugs.webkit.org/show_bug.cgi?id=160951
            rdar://problem/27807479

            Reviewed by Sam Weinig.

            * Modules/applepay/ApplePaySession.cpp:
            (WebCore::createSupportedNetworks):
            (WebCore::createPaymentRequest):
            (WebCore::ApplePaySession::create):
            * Modules/applepay/PaymentRequest.cpp:
            (WebCore::isAdditionalValidSupportedNetwork):
            (WebCore::PaymentRequest::isValidSupportedNetwork):
            * Modules/applepay/PaymentRequest.h:
            (WebCore::PaymentRequest::supportedNetworks):
            (WebCore::PaymentRequest::setSupportedNetworks):
            * Modules/applepay/PaymentRequestValidator.cpp:
            (WebCore::PaymentRequestValidator::validateSupportedNetworks):
            * Modules/applepay/PaymentRequestValidator.h:

2016-06-17  Babak Shafiei  <bshafiei@apple.com>

        Merge r202174.

    2016-06-17  John Wilander  <wilander@apple.com>

            Ignore case in the check for security origin inheritance
            https://bugs.webkit.org/show_bug.cgi?id=158878

            Reviewed by Alex Christensen.

            Darin Adler commented in https://bugs.webkit.org/show_bug.cgi?id=158855:
            "Are these comparisons intentionally case sensitive? Shouldn’t they ignore ASCII 
            case? We could use equalIgnoringASCIICase and equalLettersIgnoringASCIICase for 
            those two lines instead of using ==. URL::parse normalizes letters in the scheme 
            and host by using toASCIILower, but does not normalize letters elsewhere in the 
            URL, such as in the "blank" or "srcdoc" in the above URLs."

            Test: http/tests/dom/window-open-about-uppercase-blank-and-access-document.html

            * platform/URL.cpp:
            (WebCore::URL::shouldInheritSecurityOriginFromOwner):

2016-06-17  Babak Shafiei  <bshafiei@apple.com>

        Merge r202151.

    2016-06-16  John Wilander  <wilander@apple.com>

            Restrict security origin inheritance to empty, about:blank, and about:srcdoc URLs
            https://bugs.webkit.org/show_bug.cgi?id=158855
            <rdar://problem/26142632>

            Reviewed by Alex Christensen.

            Tests: http/tests/dom/window-open-about-blank-and-access-document.html
                   http/tests/dom/window-open-about-webkit-org-and-access-document.html

            Document.cpp previously checked whether a document should inherit its owner's 
            security origin by checking if the URL is either empty or blank. URL.cpp in 
            turn only checks if the protocol is "about:" in the isBlankURL() function. 
            Thus all about:* URLs inherited security origin. This patch restricts 
            security origin inheritance to empty, about:blank, and about:srcdoc URLs.

            Quotes and links from the WHATWG spec regarding about:srcdoc:

            7.1 Browsing contexts
            A browsing context can have a creator browsing context, the browsing context 
            that was responsible for its creation. If a browsing context has a parent 
            browsing context, then that is its creator browsing context. Otherwise, if the 
            browsing context has an opener browsing context, then that is its creator 
            browsing context. Otherwise, the browsing context has no creator browsing 
            context.
            https://html.spec.whatwg.org/multipage/browsers.html#concept-document-bc

            7.1.1 Nested browsing contexts
            Certain elements (for example, iframe elements) can instantiate further 
            browsing contexts. These are called nested browsing contexts. If a browsing 
            context P has a Document D with an element E that nests another browsing 
            context C inside it, then C is said to be nested through D, and E is said to 
            be the browsing context container of C. If the browsing context container 
            element E is in the Document D, then P is said to be the parent browsing 
            context of C and C is said to be a child browsing context of P. Otherwise, 
            the nested browsing context C has no parent browsing context.
            https://html.spec.whatwg.org/multipage/browsers.html#nested-browsing-context

            4.8.5 The iframe element
            The iframe element represents a nested browsing context.
            ...
            If the srcdoc attribute is specified
                Navigate the element's child browsing context to a new response whose 
                url list consists of about:srcdoc ...
            https://html.spec.whatwg.org/multipage/embedded-content.html#attr-iframe-srcdoc

            * dom/Document.cpp:
            (WebCore::Document::initSecurityContext):
                Now uses the URL::shouldInheritSecurityOriginFromOwner() function instead.
            (WebCore::Document::initContentSecurityPolicy):
                Now uses the URL::shouldInheritSecurityOriginFromOwner() function instead.
            (WebCore::shouldInheritSecurityOriginFromOwner): Deleted.
                Moved to URL::shouldInheritSecurityOriginFromOwner() and restricted the check.
            * platform/URL.cpp:
            (WebCore::URL::shouldInheritSecurityOriginFromOwner):
            * platform/URL.h:
                Moved the function from Document and restricted the check to only allow
                security origin inheritance for empty, about:blank, and about:srcdoc URLs.

2016-10-26  Zalan Bujtas  <zalan@apple.com>

        Ignore out-of-flow siblings when searching for a spanner candidate.
        https://bugs.webkit.org/show_bug.cgi?id=164042.
        <rdar://problem/28758456>

        Reviewed by Simon Fraser.

        While searching for the spanner candidates in a flow thread, we have to take into account
        whether renderers are in- or out-of-flow.
        What it means is that while traversing the renderer tree to find the the candidate
        renderer (next sibling/ancestor's next child in pre-order traversal), we have to check if the candidate
        is in the same layout context too.

        Test: fast/multicol/crash-when-spanner-candidate-is-out-of-flow.html

        * rendering/RenderMultiColumnFlowThread.cpp:
        (WebCore::spannerPlacehoderCandidate):
        (WebCore::RenderMultiColumnFlowThread::processPossibleSpannerDescendant):

2016-10-22  Myles C. Maxfield  <mmaxfield@apple.com>

        ASSERTION FAILED: m_fonts in &WebCore::FontCascade::primaryFont
        https://bugs.webkit.org/show_bug.cgi?id=163459

        Reviewed by Darin Adler.

        The CSS Units and Values spec states that font-relative units, when used
        in the font-size property, are resolved against the parent element. When
        calc() is specified, we were trying to resolve them against the current
        element, which is impossible because of the circular dependency. Instead,
        we should resolve against the parent style the same way as when calc() 
        isn't specified.

        Test: fast/text/font-size-calc.html

        * css/StyleBuilderCustom.h:
        (WebCore::StyleBuilderCustom::applyValueFontSize):

2016-09-09  Chris Dumez  <cdumez@apple.com>

        Regression(r186020): Null dereference in getStartDate()
        https://bugs.webkit.org/show_bug.cgi?id=161733

        Reviewed by Eric Carlson.

        Update HTMLMediaElement::getStartDate() to return NaN if m_player is null,
        instead of crashing.

        Test: fast/media/getStartDate-NaN.html

        * bindings/js/IDBBindingUtilities.cpp:
        (WebCore::toJS):
        Add a FIXME comment as this code is using jsDateOrNull() but should
        probably be using jsDate() as per:
        - http://w3c.github.io/IndexedDB/#request-convert-a-key-to-a-value

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::jsDate):
        (WebCore::jsDateOrNull):
        * bindings/js/JSDOMBinding.h:
        - Rename jsDateOrNaN() to jsDate() as this is the default behavior. Also,
          return new Date(NaN) instead of NaN if the implementation returns NaN.
          The IDL says we should return a Date, not a number.
        - Update jsDateOrNull() to only return jsNull() if the native value is
          NaN, instead of doing so for every value that is not finite. Our
          convention is to use NaN as special value to represent null in JS.

        * bindings/scripts/CodeGeneratorJS.pm:
        (NativeToJSValue):
        When converting a native value (double) into a Date, rely on the fact
        that the type is nullable when deciding if we should call jsDate() or
        jsDateOrNull() to convert. This way, we no longe need a WebKit specific
        [TreatReturnedDateAs=Null|NaN] IDL extended attribute.

        * bindings/scripts/IDLAttributes.txt:
        * html/HTMLInputElement.idl:
        Mark valueAsDate attribute as nullable, as per the specification:
        - https://html.spec.whatwg.org/#htmlinputelement

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::getStartDate):
        Return NaN if m_player is null instead of crashing. The reason I decided
        to return NaN is because the specification [1] says to return a new Date
        object representing the current timeline offset. The spec of timeline
        offset [2] says that the initial timeline offset value is NaN.
        [1] https://html.spec.whatwg.org/#dom-media-getstartdate
        [2] https://html.spec.whatwg.org/#timeline-offset

        * bindings/scripts/IDLAttributes.txt:
        * html/HTMLMediaElement.idl:
        Drop [TreatReturnedDateAs] attribute as it is no longer supported.

2016-09-12  Zalan Bujtas  <zalan@apple.com>

        Input type object and the associated render can go out of sync.
        https://bugs.webkit.org/show_bug.cgi?id=161871
        <rdar://problem/28178094>

        Reviewed by Antti Koivisto.

        Bail out when we've got a mismatched renderer.

        Test: fast/forms/assert-on-input-type-change.html

        * html/ImageInputType.cpp:
        (WebCore::ImageInputType::altAttributeChanged):

2016-10-03  Brent Fulgham  <bfulgham@apple.com>

        Avoid null dereference when changing focus in design mode.
        https://bugs.webkit.org/show_bug.cgi?id=162877
        <rdar://problem/28061261>

        Reviewed by Chris Dumez.

        The bare m_frame pointer in DOMWindow can be cleared when setting focus to a new element. Check
        that the m_frame pointer is non-null before using it after calling a routine that could
        clear the pointer value.

        Test: fast/frames/iframe-focus-crash.html

        * page/DOMWindow.cpp:
        (WebCore::DOMWindow::focus): Check that the pointer is still non-null after setting the
        current focused element to nullptr.

2016-08-29  Chris Dumez  <cdumez@apple.com>

        We should throw a SecurityError when denying setting a cross-origin Location property
        https://bugs.webkit.org/show_bug.cgi?id=161368

        Reviewed by Ryosuke Niwa.

        We should throw a SecurityError when denying setting a cross-origin
        Location property:
        - https://html.spec.whatwg.org/#location-set
        - https://html.spec.whatwg.org/#crossoriginset-(-o,-p,-v,-receiver-)
        - https://html.spec.whatwg.org/#location-getownproperty

        Firefox and Chrome already throw. We currently ignore and log an error
        message.

        No new tests, updated existing tests.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):

2016-08-29  Chris Dumez  <cdumez@apple.com>

        Regression(r204923): It should be possible to set 'Location.href' cross origin
        https://bugs.webkit.org/show_bug.cgi?id=161343
        <rdar://problem/28063361>

        Reviewed by Ryosuke Niwa.

        It should be possible to set 'Location.href' cross origin:
        - https://html.spec.whatwg.org/#crossoriginproperties-(-o-)

        Firefox and Chrome allow this but we throw a SecurityError.

        We already allow setting crossOrigin.window.location which is equivalent.

        No new tests, updated existing test.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
        Refactor the [Put] delegate so that it does not log a security error
        when setting 'href' attribute, given that setting it works as expected.
        This fixes a bug in shipping Safari where setting 'href' would work but
        log an error message anyway.

        * bindings/scripts/CodeGeneratorJS.pm:
        (GenerateImplementation):
        Add support for [DoNotCheckSecurityOnSetter] IDL extended attribute,
        in addition to the already supported [DoNotCheckSecurity] and
        [DoNotCheckSecurityOnGetter].

        * page/Location.idl:
        Use [DoNotCheckSecurityOnSetter] on 'href' attribute as it can be
        set cross-origin. This fixes the regression introduced in r204923.

2016-08-26  Chris Dumez  <cdumez@apple.com>

        Trying to access cross-origin Location properties should throw a SecurityError
        https://bugs.webkit.org/show_bug.cgi?id=161248

        Reviewed by Alex Christensen.

        Trying to access cross-origin Location properties should throw a SecurityError:
        - https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-)
        - https://html.spec.whatwg.org/#crossoriginproperties-(-o-)

        Firefox and Chrome already throw. However, WebKit was logging an error message
        and returning undefined.

        No new tests, updated existing tests.

        * bindings/js/JSDOMBinding.cpp:
        (WebCore::throwSecurityError):
        * bindings/js/JSDOMBinding.h:
        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::getOwnPropertySlotDelegate):

2016-06-13  Gavin & Ellie Barraclough  <barraclough@apple.com>

        Remove hasStaticPropertyTable (part 3: JSLocation::putDelegate)
        https://bugs.webkit.org/show_bug.cgi?id=158431

        Reviewed by Geoff Garen.

        All uses of hasStaticPropertyTable flag generated by bindings are wrong.

        JSLocation::putDelegate checks the static property table redundantly.

        In the case of same origin access, if the property is not in the static
        table the method will call JSObject::put and return true (indicating the
        delegate handled the put). If the property is in the static table, the
        method will return false (indicating the the delegate did not handle the
        access) - in which case the calling function will call JSObject::put.
        Checking for the property in the static table is redundant - same origin
        access does not require any special handling, and should just always
        return false & let the caller handle the put.

        In the case of cross origin access, if the property is not in the static
        table we return true (indicating the access was handled, and silently
        blocking it). If it is a static property, we check the name, and if the
        name is not 'href' we also return true, silently blocking. In the case
        that the name is 'href' we'll return false, indicating to the caller
        that the access was not handled by the delegate, resulting in it taking
        place. The additional check of the static table is redundant, since we
        only have special behaviour in the case of 'href'. (Moreover it is
        unnecesszarily fragile, since if we made a change such that 'href' was no
        longer implemented as a static property with would fail.)

        - for same origin, always return false.
        - for cross origin, return false for 'href', otherwise return true.

        * bindings/js/JSLocationCustom.cpp:
        (WebCore::JSLocation::putDelegate):
            - restructure & remove static table check.

2016-01-02  Max Stepin  <maxstepin@gmail.com>

        APNG decoder: only decode the frames up to haltAtFrame
        https://bugs.webkit.org/show_bug.cgi?id=146205

        Reviewed by Michael Catanzaro.

        No new tests, already covered by existing tests.

        * platform/image-decoders/png/PNGImageDecoder.cpp:
        (WebCore::PNGImageReader::close):
        (WebCore::PNGImageReader::decode):
        (WebCore::PNGImageDecoder::isSizeAvailable):
        (WebCore::PNGImageDecoder::frameBufferAtIndex):
        (WebCore::PNGImageDecoder::pngComplete):
        (WebCore::PNGImageDecoder::decode):
        * platform/image-decoders/png/PNGImageDecoder.h:
        (WebCore::PNGImageDecoder::isComplete):
        (WebCore::PNGImageDecoder::isCompleteAtIndex):

2016-03-09  Andreas Kling  <akling@apple.com>

        ImageDocuments leak their world.
        <https://webkit.org/b/155167>
        <rdar://problem/24987363>

        Reviewed by Antti Koivisto.

        ImageDocument uses a special code path in ImageLoader in order to manually
        control how the image is loaded. It has to do this because the ImageDocument
        is really just a synthetic wrapper around a main resource that's an image.

        This custom loading code had a bug where it would create a new CachedImage
        and neglect to set its CachedResource::m_state flag to Pending (which is
        normally set by CachedResource::load(), but we don't call that for these.)

        This meant that when ImageDocument called CachedImage::finishLoading() to
        trigger the notifyFinished() callback path, the image would look at its
        loading state and see that it was Unknown (not Pending), and conclude that
        it hadn't loaded yet. So we never got the notifyFinished() signal.

        The world leaks here because ImageLoader slaps a ref on its <img> element
        while it waits for the loading operation to complete. Once finished, whether
        successfully or with an error, it derefs the <img>.

        Since we never fired notifyFinished(), we ended up with an extra ref on
        these <img> forever, and then the element kept its document alive too.

        Test: fast/dom/ImageDocument-world-leak.html

        * loader/ImageLoader.cpp:
        (WebCore::ImageLoader::updateFromElement):

2016-06-16  Myles C. Maxfield  <mmaxfield@apple.com>

        Sporadic crash in HashTableAddResult following CSSValuePool::createFontFamilyValue
        https://bugs.webkit.org/show_bug.cgi?id=158297

        Reviewed by Darin Adler.

        In an effort to reduce the flash of unstyled content, we force all elements
        to have display: none during an external stylesheet load. We do this by
        ignoring the CSS cascade and forcing all elements to have a placeholder style
        which hardcodes display: none. (This is necessary to make elements created by
        script during the stylesheet load not flash.)

        This style is exposed to web content via getComputedStyle(), which means it
        needs to maintain the invariant that font-families can never be null strings.
        We enforce this by forcing the font-family to be the standard font name.

        Test: fast/text/placeholder-renderstyle-null-font.html

        * style/StyleTreeResolver.cpp:
        (WebCore::Style::ensurePlaceholderStyle):

2016-06-07  Myles C. Maxfield  <mmaxfield@apple.com>

        Text-decoration-style: dashed / dotted rendered as solid
        https://bugs.webkit.org/show_bug.cgi?id=134336

        Reviewed by Dean Jackson.

        We already had most of the infrastructure for dotted / dashed underlines.
        Previously, we were setting the stroke style for the underlines, but then
        filling the underlines (which means the stroke styles is irrelevant).
        Instead, we should just compute the individual dots / dashes to fill.

        The implementation of this is done inside GraphicsContext because
        GraphicsContext is already responsible for handling the single / double
        underline distinction. Extending it to be responsible for dotted / dashed
        is the natural thing to do.

        Tests: fast/css3-text/css3-text-decoration/text-decoration-dashed.html
               fast/css3-text/css3-text-decoration/text-decoration-dotted-dashed.html
               fast/css3-text/css3-text-decoration/text-decoration-dotted.html

        * platform/graphics/GraphicsContext.h:
        * platform/graphics/cairo/GraphicsContextCairo.cpp:
        (WebCore::GraphicsContext::drawLineForText):
        (WebCore::GraphicsContext::drawLinesForText):
        * platform/graphics/cg/GraphicsContextCG.cpp:
        (WebCore::GraphicsContext::drawLineForText):
        (WebCore::GraphicsContext::drawLinesForText):
        * rendering/TextDecorationPainter.cpp:
        (WebCore::drawSkipInkUnderline):
        (WebCore::TextDecorationPainter::paintTextDecoration):

2016-06-02  Darin Adler  <darin@apple.com>

        Fix a couple of mistakes in CSSParserValue memory management
        https://bugs.webkit.org/show_bug.cgi?id=158307
        <rdar://problem/26127225>

        Reviewed by Daniel Bates.

        * css/CSSGrammar.y.in: Added a destructor for calc_func_term. This presumably
        fixes some memory leaks in error cases. Removed an assertion about not needing
        a call to destroy that was far too limited. Tweaked formatting of the percentage
        ase in the key production. Indented calc_func_term to make it consistent with
        other productions nearby.

        * css/CSSParserValues.cpp:
        (WebCore::CSSParserValueList::~CSSParserValueList): Use a modern for loop.
        (WebCore::CSSParserValueList::deleteValueAt): Deleted. Unused function, and also
        would have resulted in a memory leak unless the code already extracted the value
        from the list.
        (WebCore::CSSParserValueList::extend): Properly transfer ownership from one value
        list to the other by setting the unit to 0 in the donor.

        * css/CSSParserValues.h: Removed unused deleteValueAt function.


2016-05-16  Babak Shafiei  <bshafiei@apple.com>

        Merge r200986.

    2016-05-16  Brent Fulgham  <bfulgham@apple.com>

            heap use-after-free at WebCore::TimerBase::heapPopMin()
            https://bugs.webkit.org/show_bug.cgi?id=157742
            <rdar://problem/26236778>

            Reviewed by David Kilzer.

            Tested by fast/frames/resources/crash-during-iframe-load-stop.html.

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::stopForUserCancel): Protect m_frame from destruction while it is still
            being used by the current stack frame.
            (WebCore::FrameLoader::frameDetached): Ditto.
            (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy): Ditto.

2016-05-12  Babak Shafiei  <bshafiei@apple.com>

        Build fix after r195004/r200780.

2016-05-12  Babak Shafiei  <bshafiei@apple.com>

        Merge r195004.

    2016-01-13  Brent Fulgham  <bfulgham@apple.com>

            Cross-protocol, cross-site scripting (XPSS) using HTML forms
            https://bugs.webkit.org/show_bug.cgi?id=153017
            <rdar://problem/5873254>

            Reviewed by David Kilzer.

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::responseReceived): If response HTTP version is 0.9,
            sandbox against script execution and plugins.
            * loader/ResourceLoader.cpp:
            (WebCore::ResourceLoader::didReceiveResponse): Ditto.
            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::didReceiveResponse): Ditto.
            * platform/network/ResourceResponseBase.cpp:
            (WebCore::ResourceResponseBase::adopt): Update for HTTP version.
            (WebCore::ResourceResponseBase::copyData): Ditto.
            (WebCore::ResourceResponseBase::httpVersion): Added.
            (WebCore::ResourceResponseBase::setHTTPVersion): Ditto.
            * platform/network/ResourceResponseBase.h:
            (WebCore::ResourceResponseBase::encode): Update for HTTP version.
            (WebCore::ResourceResponseBase::decode): Ditto.
            * platform/network/cf/ResourceResponseCFNet.cpp:
            (WebCore::ResourceResponse::platformLazyInit): Capture HTTP version.
            * platform/network/cocoa/ResourceResponseCocoa.mm:
            (WebCore::ResourceResponse::platformLazyInit): Ditto.

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r198701. rdar://problem/26228577

    2016-03-25  Zalan Bujtas  <zalan@apple.com>

            RenderImage::repaintOrMarkForLayout fails when the renderer is detached.
            https://bugs.webkit.org/show_bug.cgi?id=155885
            <rdar://problem/25359164>

            Reviewed by Simon Fraser.

            Making containingBlockFor* functions standalone ensures that we don't
            call them on an invalid object.

            Covered by existing tests.

            * dom/Element.cpp:
            (WebCore::layoutOverflowRectContainsAllDescendants):
            * rendering/LogicalSelectionOffsetCaches.h:
            (WebCore::LogicalSelectionOffsetCaches::LogicalSelectionOffsetCaches):
            * rendering/RenderElement.cpp:
            (WebCore::containingBlockForFixedPosition):
            (WebCore::containingBlockForAbsolutePosition):
            (WebCore::containingBlockForObjectInFlow):
            (WebCore::RenderElement::containingBlockForFixedPosition): Deleted.
            (WebCore::RenderElement::containingBlockForAbsolutePosition): Deleted.
            (WebCore::isNonRenderBlockInline): Deleted.
            (WebCore::RenderElement::containingBlockForObjectInFlow): Deleted.
            * rendering/RenderElement.h:
            * rendering/RenderInline.cpp:
            (WebCore::RenderInline::styleWillChange):
            * rendering/RenderObject.cpp:
            (WebCore::RenderObject::containingBlock):

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r198143. rdar://problem/26228593

    2016-03-14  Chris Vienneau  <chris.vno@outlook.com>

            PingHandle delete's itself but pointer is still used by handleDataURL
            https://bugs.webkit.org/show_bug.cgi?id=154752
            <rdar://problem/24872347>

            Reviewed by Alex Christensen.

            When a PingHandle is destroyed, we should tell its client so that the client can clear the pointer it
            holds to the element to avoid accidentally attempting to use deallocated memory.

            The ResourceHandle's client member may be null after "didReceiveResponse" is called. We should confirm
            the client is still valid after these calls.

            * platform/network/DataURL.cpp:
            (WebCore::handleDataURL): Check the client pointer before using it.
            * platform/network/PingHandle.h:
            (WebCore::PingHandle::~PingHandle): Notify the client we are being destroyed.
            * platform/platform/network/ResourceHandle.h:

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r199243. rdar://problem/26228520

    2016-04-08  Said Abou-Hallawa  <sabouhallawa@apple,com>

            Timing attack on SVG feComposite filter circumvents same-origin policy
            https://bugs.webkit.org/show_bug.cgi?id=154338

            Reviewed by Oliver Hunt.

            Ensure the FEComposite arithmetic filter is clamping the resulted color
            components in a constant time.

            * platform/graphics/filters/FEComposite.cpp:
            (WebCore::clampByte):
            (WebCore::computeArithmeticPixels):

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r199101. rdar://problem/26228570

    2016-04-06  Zalan Bujtas  <zalan@apple.com>

            ASSERTION FAILED: !floatingObject->originatingLine() in WebCore::RenderBlockFlow::linkToEndLineIfNeeded
            https://bugs.webkit.org/show_bug.cgi?id=153001

            Reviewed by Dan Bernstein.

            1. Float boxes are always attached to the line where we see them first.
            2. Float box can only be attached to one line.
            3. RenderBlockFlow can perform partial layout on dirty lines only.

            In certain cases, the last dirty line can "pull up" float boxes from the first clean line.
            It simply means that due to some layout changes on previous lines now we see those floats on this last dirty line first.
            If after placing the float we still find it on the same position, the line below is still considered clean.

            Remove the float box from its original line if the line above already placed it.

            Test: fast/block/float/float-moves-between-lines.html

            * rendering/RenderBlockFlow.h:
            * rendering/RenderBlockLineLayout.cpp:
            (WebCore::RenderBlockFlow::reattachCleanLineFloats):
            (WebCore::RenderBlockFlow::linkToEndLineIfNeeded):
            (WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange): Deleted.

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r198780. rdar://problem/26228583

    2016-03-29  Eric Carlson  <eric.carlson@apple.com>

            media/track/track-remove-track.html is flaky, crashing and failing
            https://bugs.webkit.org/show_bug.cgi?id=130971

            Reviewed by Alexey Proskuryakov.

            Prevent HTMLMediaElement from being collected while it is creating media controls.
            These changes prevent the test from crashing but they do not fix the flakiness,
            which is caused by another bug. Fixing that is tracked by
            https://bugs.webkit.org/show_bug.cgi?id=155956.

            * html/HTMLMediaElement.cpp:
            (WebCore::actionName): New, debugging-only helper function.
            (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize new variables.
            (WebCore::HTMLMediaElement::scheduleDelayedAction): Log the flag names to make debugging easier.
            (WebCore::HTMLMediaElement::scheduleNextSourceChild): Add logging.
            (WebCore::HTMLMediaElement::updateActiveTextTrackCues): Update logging.
            (WebCore::HTMLMediaElement::configureTextTrackGroup): Drive-by optimization: don't call
              updateCaptionContainer here, call it before exiting configureTextTracks so we only call
              it once instead of once per track group.
            (WebCore::controllerJSValue):
            (WebCore::HTMLMediaElement::ensureMediaControlsShadowRoot): New, wrapper around calling
              ensureUserAgentShadowRoot so m_creatingControls can be set and cleared appropriately.
            (WebCore::HTMLMediaElement::updateCaptionContainer): ensureUserAgentShadowRoot ->
              ensureMediaControlsShadowRoot. Drive by optimization: set/test m_haveSetupCaptionContainer
              so we only do this setup once.
            (WebCore::HTMLMediaElement::configureTextTracks): Call updateCaptionContainer.
            (WebCore::HTMLMediaElement::clearMediaPlayer): Log flag names.
            (WebCore::HTMLMediaElement::hasPendingActivity): Return true when creating controls so GC
              won't happen during controls setup.
            (WebCore::HTMLMediaElement::updateTextTrackDisplay): ensureUserAgentShadowRoot ->
              ensureMediaControlsShadowRoot.
            (WebCore::HTMLMediaElement::createMediaControls): Ditto.
            (WebCore::HTMLMediaElement::configureMediaControls): Ditto.
            (WebCore::HTMLMediaElement::configureTextTrackDisplay): Ditto.
            * html/HTMLMediaElement.h:

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r198050. rdar://problem/26228588

    2016-03-11  Jiewen Tan  <jiewen_tan@apple.com>

            WebKit should not be redirected to an invalid URL
            https://bugs.webkit.org/show_bug.cgi?id=155263
            <rdar://problem/22820172>

            Reviewed by Brent Fulgham.

            Test: http/tests/navigation/redirect-to-invalid-url.html

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::willSendRequestInternal):

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195724. rdar://problem/26228611

    2016-01-27  Said Abou-Hallawa  <sabouhallawa@apple.com>

            Garbage is displayed when root svg element has mix-blend-mode set
            https://bugs.webkit.org/show_bug.cgi?id=150556

            Reviewed by Darin Adler.

            This bug happens when compositing on a CALayer and drawing on a transparent
            layer, so it happens with WK2 with <svg style="mix-blend-mode...">. And it
            can happen with WK1 also with <svg style="opacity=...;mix-blend-mode...">.
            But in both cases, the SVG root renderer should be the root of the render
            tree. So it happens only with the stand alone SVG documents.

            SVGRenderContext::prepareToRenderSVGContent() ignores the opacity of
            the SVG root but it creates a transparent layer for the blend-mode.

            But RenderLayer::beginTransparencyLayers() creates a transparent layer
            for opacity and it sets the blend-mode also.

            The fix is to begin two transparent layers for the SVG root renderer: one
            for the opacity and the second for the blend-mode. The opacity transparent
            layer will be still managed by RenderLayer::beginTransparencyLayers(). While
            the blend-mode transparent layer will be managed by SVGRenderContext
            ::prepareToRenderSVGContent().

            Tests: svg/css/mix-blend-mode-background-root.svg
                   svg/css/mix-blend-mode-opacity-root.svg

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::beginTransparencyLayers):

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194399. rdar://problem/26228601

    2015-12-23  Pranjal Jumde  <pjumde@apple.com>

            Avoids stack recursion when indexed propertyNames defined using Object.defineProperty are deleted.
            https://bugs.webkit.org/show_bug.cgi?id=149179
            <rdar://problem/22708019>.

            Reviewed by Filip Pizlo.

            * runtime/JSObject.cpp:
            (JSStorage::deletePropertyByIndex was invoking Base::deleteProperty for indexed propertyNames instead of Base::deletePropertyByIndex leading to a stack recursion)

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190820. rdar://problem/26228566

    2015-10-09  Simon Fraser  <simon.fraser@apple.com>

            Garbage texture data with composited table row
            https://bugs.webkit.org/show_bug.cgi?id=148984

            Reviewed by Zalan Bujtas.

            Don't pretend to know if the layer for a table header, section or cell is
            opaque, since table painting is special.

            Test: compositing/contents-opaque/table-parts.html

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::backgroundIsKnownToBeOpaqueInRect):

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r200091. rdar://problem/26228555

    2016-04-26  Brent Fulgham  <bfulgham@apple.com>

            GuardMalloc crash in WebCore::HTMLFrameElementBase::marginHeight()
            https://bugs.webkit.org/show_bug.cgi?id=157020
            <rdar://problem/25148315>

            Reviewed by Darin Adler.

            Calls to setIntegralAttribute triggers event handling code, which can cause
            the underlying m_frameOwnerElement member to be deleted. We could clone this
            object, but since we only want the width and height we should just read them
            while we know the object is in a good state, then execute the potentially
            mutating methods.

            Tested by imported/blink/fast/dom/HTMLBodyElement/body-inserting-iframe-crash.html.

            * html/HTMLBodyElement.cpp:
            (WebCore::HTMLBodyElement::insertedInto): Read margin width and height before
            calling setIntegralAttribute.

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194290. rdar://problem/26053735

    2015-12-18  Brent Fulgham  <bfulgham@apple.com>

            Place an upper bound on canvas pixel count
            https://bugs.webkit.org/show_bug.cgi?id=151825
            <rdar://problem/23324916>

            Reviewed by Simon Fraser (Relanded by Brent Fulgham)

            Malformed JavaScript can attempt to create lots of canvas contexts. Limit the amount of memory
            we will use for this purpose to some percentage of system RAM.

            * html/HTMLCanvasElement.cpp:
            (WebCore::removeFromActivePixelMemory): Added helper function
            (WebCore::HTMLCanvasElement::~HTMLCanvasElement): Call new 'releaseImageBufferAndContext' method
            to ensure ImageBuffer and graphics context state are properly cleaned up.
            (WebCore::maxActivePixels): Use one quarter of the system RAM, or 2 GB (whichever is more) as
            an upper bound on active pixel memory.
            (WebCore::HTMLCanvasElement::getContext): If we are attempting to create a context that will cause
            us to exceed the allowed active pixel count, fail.
            (WebCore::HTMLCanvasElement::releaseImageBufferAndContext): Added helper function
            (WebCore::HTMLCanvasElement::setSurfaceSize): Use the new 'releaseImageBufferAndContext' method
            to handle active pixel memory counts.
            (WebCore::HTMLCanvasElement::createImageBuffer): Refuse to create a backing buffer if it will
            exceed our available pixel memory.

2016-05-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r200375. rdar://problem/26066673

    2016-05-03  Pranjal Jumde  <pjumde@apple.com>

            WorkerGlobalScope's self, location and navigator attributes should not be replaceable
            https://bugs.webkit.org/show_bug.cgi?id=157296
            <rdar://problem/25962738>

            Reviewed by Chris Dumez.

            Tests: http/tests/workers/location-readonly.html
                   http/tests/workers/navigator-readonly.html
                   http/tests/workers/self-readonly.html

            * workers/WorkerGlobalScope.idl:
            The 'self', 'location', and 'navigator' properties of the WorkerGlobalScope must be immutable.
            See: https://html.spec.whatwg.org/multipage/workers.html#the-workerglobalscope-common-interface

2016-04-22  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r199881. rdar://problem/25879498

    2016-04-22  Antti Koivisto  <antti@apple.com>

            REGRESSION (r194898): Multi download of external SVG defs file by <use> xlinks:href (caching)
            https://bugs.webkit.org/show_bug.cgi?id=156368
            <rdar://problem/25611746>

            Reviewed by Simon Fraser.

            We would load svg resources with fragment identifier again because the encoding never matched.

            Test: http/tests/svg/svg-use-external.html

            * loader/TextResourceDecoder.cpp:
            (WebCore::TextResourceDecoder::setEncoding):
            (WebCore::TextResourceDecoder::hasEqualEncodingForCharset):

                Encoding can depend on mime type. Add a comparison function that takes this into account.

            (WebCore::findXMLEncoding):
            * loader/TextResourceDecoder.h:
            (WebCore::TextResourceDecoder::encoding):
            * loader/cache/CachedCSSStyleSheet.h:
            * loader/cache/CachedResource.h:
            (WebCore::CachedResource::textResourceDecoder):

                Add a way to get the TextResourceDecoder from a cached resource.

            * loader/cache/CachedResourceLoader.cpp:
            (WebCore::CachedResourceLoader::determineRevalidationPolicy):

                Use the new comparison function.

            * loader/cache/CachedSVGDocument.h:
            * loader/cache/CachedScript.h:
            * loader/cache/CachedXSLStyleSheet.h:

2016-04-15  Babak Shafiei  <bshafiei@apple.com>

        Merge r199598.

    2016-04-15  Said Abou-Hallawa  <sabouhallawa@apple.com>

            Calling SVGAnimatedPropertyTearOff::animationEnded() will crash if the SVG property is not animating
            https://bugs.webkit.org/show_bug.cgi?id=156549

            Reviewed by Darin Adler.

            A speculative fix for a crash which may happen when calling animationEnded()
            of any SVGAnimatedProperty while it is not animating.

            * svg/SVGAnimatedTypeAnimator.h:
            (WebCore::SVGAnimatedTypeAnimator::executeAction):

2016-03-31  Matthew Hanson  <matthew_hanson@apple.com>

        Roll out r191180. rdar://problem/25448882

        Landed on behalf of Chris Dumez.

        * html/parser/HTMLPreloadScanner.cpp:
        (WebCore::TokenPreloadScanner::StartTagScanner::shouldPreload):
        (WebCore::TokenPreloadScanner::tagIdFor): Deleted.
        (WebCore::TokenPreloadScanner::initiatorFor): Deleted.
        (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute): Deleted.
        (WebCore::TokenPreloadScanner::StartTagScanner::resourceType): Deleted.
        * html/parser/HTMLPreloadScanner.h:

2016-03-30  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r198687. rdar://problem/25448871

    2016-03-25  Brady Eidson  <beidson@apple.com>

            Soften push/replaceState frequency restrictions.
            <rdar://problem/25228439> and https://bugs.webkit.org/show_bug.cgi?id=155901

            Rubber-stamped by Timothy Hatcher.

            Covered by existing LayoutTests and a new Manual Test.

            * page/History.cpp:
            (WebCore::History::stateObjectAdded): Allow 100 state object operations every 30 seconds.
            * page/History.h:

2016-03-18  Brent Fulgham  <bfulgham@apple.com>

        Merge r192285.

        * dom/ContainerNode.cpp:
        (WebCore::ContainerNode::ensurePreInsertionValidity): Added.
        * dom/ContainerNode.h:

    2015-11-10  Pranjal Jumde  <pjumde@apple.com>

            Fixed crash loading Mozilla layout test editor/libeditor/crashtests/431086-1.xhtml.
            https://bugs.webkit.org/show_bug.cgi?id=150252
            <rdar://problem/23149470>

            Reviewed by Brent Fulgham.

            * Source/WebCore/editing/ios/EditorIOS.mm
            * Source/WebCore/editing/mac/EditorMac.mm
              In Editor::fontForSelection moved the node removal code, so that the
              node is only removed if style is not NULL.
            * Source/WebCore/editing/cocoa/EditorCocoa.mm
              In Editor::styleForSelectionStart checking if the parentNode can 
              accept the styleElement node.

2016-03-18  Brent Fulgham  <bfulgham@apple.com>

        Merge r212026. rdar://problem/30096323

    2017-02-09  Chris Dumez  <cdumez@apple.com>

            Crash under FormSubmission::create()
            https://bugs.webkit.org/show_bug.cgi?id=167200
            <rdar://problem/30096323>

            Reviewed by Darin Adler.

            The issue is that FormSubmission::create() was iterating over
            form.associatedElements() as was calling Element::appendFormData()
            in the loop. HTMLObjectElement::appendFormData() was calling
            pluginWidget(PluginLoadingPolicy::Load) which causes a synchronous
            layout and can fire events (such as focus event) synchronously.
            Firing those events synchronously allows the JS to modify the
            form.associatedElements() vector we are currently iterating on.

            To avoid this issue, we now call pluginWidget(PluginLoadingPolicy::DoNotLoad)
            in HTMLObjectElement::appendFormData() as we are not allowed to fire
            synchronous events at this point. I also added a security assertion
            in FormSubmission::create() to catch cases where we fire JS events
            while iterating over the form associated elements to more easily
            notice these things in the future.

            Test: fast/forms/formsubmission-appendFormData-crash.html

            * html/HTMLObjectElement.cpp:
            (WebCore::HTMLObjectElement::appendFormData):
            * loader/FormSubmission.cpp:
            (WebCore::FormSubmission::create):

2017-02-10  Brent Fulgham  <bfulgham@apple.com>

        Unreviewed build fix.

        Get rid of infinitely recursive 'draw' implementation.

        * platform/graphics/Image.cpp:
        (WebCore::Image::draw): Deleted.
        * platform/graphics/Image.h:

2016-03-18  Babak Shafiei  <bshafiei@apple.com>

        Merge r198377.

    2016-03-17  Brent Fulgham  <bfulgham@apple.com>

            [XSS Auditor] Off by one in XSSAuditor::canonicalizedSnippetForJavaScript()
            https://bugs.webkit.org/show_bug.cgi?id=155624
            <rdar://problem/25219962>

            Unreviewed merge from Blink (patch by Tom Sepez <tsepez@chromium.org>):
            <https://src.chromium.org/viewvc/blink?revision=201803&view=revision>

            Test: http/tests/security/xssAuditor/script-tag-with-trailing-script-and-urlencode.html

            * html/parser/XSSAuditor.cpp:
            (WebCore::XSSAuditor::canonicalizedSnippetForJavaScript): Correct off-by-one error.

2016-03-18  Babak Shafiei  <bshafiei@apple.com>

        Merge r198372.

    2016-03-17  Zalan Bujtas  <zalan@apple.com>

            Don't initiate a style recall while drawing text 
            https://bugs.webkit.org/show_bug.cgi?id=155618

            Reviewed by Simon Fraser.

            This patch ensures that we don't initiate a style recalc while in the middle of text drawing.

            Test: fast/canvas/crash-while-resizing-canvas.html

            * html/canvas/CanvasRenderingContext2D.cpp:
            (WebCore::CanvasRenderingContext2D::drawTextInternal):

2016-03-18  Babak Shafiei  <bshafiei@apple.com>

        Merge r198370.

    2016-03-17  Eric Carlson  <eric.carlson@apple.com>

            Improve some metadata tests
            https://bugs.webkit.org/show_bug.cgi?id=155616

            Reviewed by Saam Barati.

            * html/track/DataCue.cpp:
            (WebCore::DataCue::DataCue):
            (WebCore::DataCue::setData):

2016-03-18  Babak Shafiei  <bshafiei@apple.com>

        Merge r198361.

    2016-03-17  Brent Fulgham  <bfulgham@apple.com>

            Some media tests are flaky.
            https://bugs.webkit.org/show_bug.cgi?id=155614

            Reviewed by Eric Carlson.

            * html/track/TextTrack.cpp:
            (WebCore::TextTrack::~TextTrack):

2016-03-18  Babak Shafiei  <bshafiei@apple.com>

        Merge r192770.

    2015-11-25  Pranjal Jumde  <pjumde@apple.com>

            Checks for buffer-overflows when reading characters from textRun
            https://bugs.webkit.org/show_bug.cgi?id=151055
            <rdar://problem/23251789>

            Reviewed by Myles C. Maxfield.

            Prevents an off by one error when adding the last font data to the GlyphBuffer.

            * Source/WebCore/platform/graphics/WidthIterator.cpp:
            * Source/WebCore/platform/graphics/FontCascade.cpp:

2016-03-18  Babak Shafiei  <bshafiei@apple.com>

        Merge r192499.

    2015-11-16  Pranjal Jumde  <pjumde@apple.com>

            Fixes the buffer-overflow when reading characters from textRun
            https://bugs.webkit.org/attachment.cgi?bugid=151055
            <rdar://problem/23251789>

            Reviewed by Brent Fulgham.

            * platform/graphics/FontCascade.cpp

2016-03-18  Babak Shafiei  <bshafiei@apple.com>

        Merge r192252.

    2015-11-10  Zalan Bujtas  <zalan@apple.com>

            Force display: block on ::-webkit-media-controls.
            https://bugs.webkit.org/show_bug.cgi?id=149178
            <rdar://problem/23448397>

            Reviewed by Simon Fraser.

            This patch ensures that we always have a block level container for media controls
            so that continuation never needs to split RenderMedia into multiple subtrees.

            Current inline continuation logic assumes that only inline elements with RenderInline
            type of renderers participate in continuation. This is mostly the case since other inline renderers
            such as RenderReplaced, RenderImage, RenderEmbeddedObject etc can't have (accessible) children.
            (Unlike video::-webkit-media-controls)

            Test: media/webkit-media-controls-display.html

            * Modules/mediacontrols/mediaControlsApple.css:
            (::-webkit-media-controls):
            * Modules/mediacontrols/mediaControlsiOS.css:
            (::-webkit-media-controls):
            * css/mediaControls.css:
            (::-webkit-media-controls):

2016-03-18  Babak Shafiei  <bshafiei@apple.com>

        Merge r192853.

    2015-11-30  Simon Fraser  <simon.fraser@apple.com>

            Fix possible crash with animated layers in reflections
            https://bugs.webkit.org/show_bug.cgi?id=151689
            rdar://problem/23018612

            Reviewed by Darin Adler.

            Reflections create additional PlatformCALayers whose owner is set to the GraphicsLayerCA.
            Those PlatformCALayers need their owner pointer cleared out when the GraphicsLayerCA
            is destroyed.

            Tested by compositing/reflections/nested-reflection-transition.html

            * platform/graphics/ca/GraphicsLayerCA.cpp:
            * platform/graphics/ca/GraphicsLayerCA.h:

2016-03-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188574. rdar://problem/25070230

    2015-08-17  Alex Christensen  <achristensen@webkit.org>

            WinCairo build fix after r188566

            * platform/graphics/win/FontPlatformDataCairoWin.cpp:
            (WebCore::FontPlatformData::FontPlatformData):
            Remove reference to removed m_isCompositeFontReference.

2016-03-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188566. rdar://problem/25070230

    2015-08-17  Myles C. Maxfield  <mmaxfield@apple.com>

            [OS X] Remove support for composite fonts
            https://bugs.webkit.org/show_bug.cgi?id=147920

            Reviewed by Dan Bernstein.

            Composite fonts were first introduced in [1]. These composite fonts are extremely rare
            because:
            1. None of the preinstalled fonts on either OS X nor iOS are composite fonts,
            2. WebKit does not support loading web fonts from composite font files, and
            3. WebKit's support only ever existed on OS X (none of the other ports).

            In fact, no one I've consulted with has ever seen any of these fonts used in the wild.
            The fonts also require a fundamentally broken code path, and add complexity to WebKit.

            [1] https://bugs.webkit.org/attachment.cgi?id=134923&action=review

            No new tests.

            * platform/graphics/Font.h:
            * platform/graphics/FontPlatformData.cpp:
            (WebCore::FontPlatformData::FontPlatformData): Deleted.
            (WebCore::FontPlatformData::operator=): Deleted.
            * platform/graphics/FontPlatformData.h:
            (WebCore::FontPlatformData::isCompositeFontReference): Deleted.
            (WebCore::FontPlatformData::operator==): Deleted.
            * platform/graphics/cocoa/FontCocoa.mm:
            (WebCore::Font::compositeFontReferenceFont): Deleted.
            * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
            (WebCore::FontPlatformData::FontPlatformData): Deleted.
            (WebCore::FontPlatformData::setFont): Deleted.
            * platform/graphics/mac/GlyphPageMac.cpp:
            (WebCore::shouldUseCoreText):
            (WebCore::GlyphPage::fill):

2016-03-16  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r192054. rdar://problem/25152937

        * rendering/OrderIterator.cpp:
        (WebCore::OrderIterator::next):

2016-02-26  Babak Shafiei  <bshafiei@apple.com>

        Roll out r196637. rdar://problem/24494562

2016-02-26  Babak Shafiei  <bshafiei@apple.com>

        Merge patch for rdar://problem/24826901.

2016-02-19  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r196703. rdar://problem/24623986

    2016-02-17  Eric Carlson  <eric.carlson@apple.com>

            [Win] Allow ports to disable automatic text track selection
            https://bugs.webkit.org/show_bug.cgi?id=154322
            <rdar://problem/24623986>

            Reviewed by Brent Fulgham.

            * page/CaptionUserPreferencesMediaAF.cpp:
            (MTEnableCaption2015BehaviorPtr): Implement for Windows.

2016-02-12  Babak Shafiei  <bshafiei@apple.com>

        Merge patch for rdar://problem/24626412.

    2016-02-12  Brent Fulgham  <bfulgham@apple.com>

            [Win] Correct internal branch build failure.
            <rdar://problem/24626412>

            Work around some C++11 compiler limitations in VS2013. Fix the
            Windows build for the new <picture> element code. Correct some
            AVFoundationCF changes that were not properly updated in this
            branch.

            * DerivedSources.cpp: Add missing files.
            * WebCore.vcxproj/WebCore.vcxproj: Ditto.
            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
            * css/CSSAllInOne.cpp: Ditto.
            * html/HTMLElementsAllInOne.cpp: Ditto.
            * platform/graphics/FontCache.h: Work around VS2013 bugs.
            (WebCore::FontDescriptionFontDataCacheKey::FontDescriptionFontDataCacheKey):
            * platform/graphics/avfoundation/cf/CDMSessionAVFoundationCF.cpp:
            (WebCore::CDMSessionAVFoundationCF::CDMSessionAVFoundationCF): Correct
            signature that was not fixed for Windows in this branch.
            * platform/graphics/avfoundation/cf/CDMSessionAVFoundationCF.h:
            (WebCore::CDMSessionAVFoundationCF::~CDMSessionAVFoundationCF):
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.cpp:
            (WebCore::MediaPlayerPrivateAVFoundationCF::takeRequestForKeyURI):
            (WebCore::MediaPlayerPrivateAVFoundationCF::createSession):
            * platform/graphics/avfoundation/cf/MediaPlayerPrivateAVFoundationCF.h:
            * platform/graphics/win/FontCustomPlatformData.cpp:

2016-02-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r196401. rdar://problem/24611749

    2016-02-10  Eric Carlson  <eric.carlson@apple.com>

            Update "manual" caption track logic
            https://bugs.webkit.org/show_bug.cgi?id=154084
            <rdar://problem/24530516>

            Reviewed by Dean Jackson.

            No new tests, media/track/track-manual-mode.html was updated.

            * English.lproj/Localizable.strings: Add new string.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::addTextTrack): track.setManualSelectionMode is no more.
            (WebCore::HTMLMediaElement::configureTextTrackGroup): Never enable a track automatically when
              in manual selection mode.
            (WebCore::HTMLMediaElement::captionPreferencesChanged):  track.setManualSelectionMode is no more.

            * html/track/TextTrack.cpp:
            (WebCore::TextTrack::containsOnlyForcedSubtitles): Return true for forced tracks.
            (WebCore::TextTrack::kind): Deleted.
            * html/track/TextTrack.h:

            * html/track/TrackBase.h:
            (WebCore::TrackBase::kind): De-virtualize, nobody overrides it.

            * page/CaptionUserPreferencesMediaAF.cpp:
            (WebCore::trackDisplayName): Include "forced" in the name of forced tracks.

            * platform/LocalizedStrings.cpp:
            (WebCore::forcedTrackMenuItemText): New.
            * platform/LocalizedStrings.h:

2016-02-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r196226. rdar://problem/24417430

    2016-02-06  Beth Dakin  <bdakin@apple.com>

            ScrollbarPainters needs to be deallocated on the main thread
            https://bugs.webkit.org/show_bug.cgi?id=153932
            -and corresponding-
            rdar://problem/24015483

            Reviewed by Dan Bernstein.

            Darin pointed out that this was still race-y. There was still a race
            condition between the destruction of the two local variables and the
            destruction of the lambda on the main thread. This should fix that.
            * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.h:
            * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
            (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
            (WebCore::ScrollingTreeFrameScrollingNodeMac::releaseReferencesToScrollbarPaintersOnTheMainThread):
            (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r196208. rdar://problem/24417430

    2016-02-05  Beth Dakin  <bdakin@apple.com>

            ScrollbarPainters needs to be deallocated on the main thread
            https://bugs.webkit.org/show_bug.cgi?id=153932
            -and corresponding-
            rdar://problem/24015483

            Reviewed by Geoff Garen.

            Follow-up fix since the first one was still race-y.
            * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
            (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
            (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-10  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r196206. rdar://problem/24417430

    2016-02-05  Beth Dakin  <bdakin@apple.com>

            ScrollbarPainters needs to be deallocated on the main thread
            https://bugs.webkit.org/show_bug.cgi?id=153932
            -and corresponding-
            rdar://problem/24015483

            Reviewed by Tim Horton.

            Ensure the the destructor of ScrollingTreeFrameScrollingNodeMac and the
            assignments done in this class are not responsible for deallocating the
            ScrollbarPainter.
            * page/scrolling/mac/ScrollingTreeFrameScrollingNodeMac.mm:
            (WebCore::ScrollingTreeFrameScrollingNodeMac::~ScrollingTreeFrameScrollingNodeMac):
            (WebCore::ScrollingTreeFrameScrollingNodeMac::updateBeforeChildren):

2016-02-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r190616.

    2015-10-06  Brent Fulgham  <bfulgham@apple.com>

            [Win] Correct positioning error introduced in r190235
            https://bugs.webkit.org/show_bug.cgi?id=149631
            <rdar://problem/22635080>

            Reviewed by Simon Fraser.

            Covered by existing compositing tests:
              css3/filters/clipping-overflow-scroll-with-pixel-moving-effect-on.html
              fast/layers/no-clipping-overflow-hidden-added-after-transform.html
              fast/layers/no-clipping-overflow-hidden-added-after-transition.html
              fast/layers/no-clipping-overflow-hidden-hardware-acceleration.html
              transforms/2d/preserve3d-not-fixed-container.html

            * platform/graphics/ca/TileGrid.cpp:
            (TileGrid::platformCALayerPaintContents): No need to do this extra flipping step
            on Windows.
            * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
            (PlatformCALayerWinInternal::displayCallback): We should always flip the
            coordinate system when drawing these layers on Windows.
            (shouldInvertBeforeDrawingContent): Deleted.
            * platform/graphics/ca/win/WebTiledBackingLayerWin.cpp:
            (WebTiledBackingLayerWin::displayCallback): We do not need to flip coordinates
            for these tiled layers; that's already accounted for in common tile drawing code.

2016-02-09  Babak Shafiei  <bshafiei@apple.com>

        Merge patch for rdar://problem/24563410.

    2016-02-09  Brent Fulgham  <bfulgham@apple.com>

            Remove unused code in r187245

            When merging r187245, we accidentally revived three functions that had been
            removed in a prior commit. This broke the Windows build on this branch.

            * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
            (PlatformCALayerWinInternal::drawTile): Deleted.
            (PlatformCALayerWinInternal::createTileController): Deleted.
            (PlatformCALayerWinInternal::tiledBacking): Deleted.

2016-02-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r187245.

    2015-07-23  Brent Fulgham  <bfulgham@apple.com>

            [Win] Implement High DPI support features
            https://bugs.webkit.org/show_bug.cgi?id=146335
            <rdar://problem/21558269>

            Reviewed by Alex Christensen.

            * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
            (WebCore::PlatformCALayerWinInternal::drawTile): Don't translate the CGContext to the position
            of the CACFLayerRef; the underlying context is already in the right position.
            * platform/win/PlatformMouseEventWin.cpp: Update class to adjust mouse
            event coordinates based on scaling factor.
            (WebCore::deviceScaleFactor):
            (WebCore::positionForEvent):
            * platform/win/ScrollbarThemeWin.cpp:
            (WebCore::scrollbarThicknessInPixels):
            (WebCore::ScrollbarThemeWin::scrollbarThickness):
            (WebCore::ScrollbarThemeWin::themeChanged):
            * platform/win/WheelEventWin.cpp: Update class to adjust wheel event
            coordinates based on scaling factor.
            (WebCore::deviceScaleFactor):
            (WebCore::positionForEvent):
            (WebCore::globalPositionForEvent):
            (WebCore::PlatformWheelEvent::PlatformWheelEvent):

2016-02-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r196010. rdar://problem/24417428

    2016-02-02  Eric Carlson  <eric.carlson@apple.com>

            Allow ports to disable automatic text track selection
            https://bugs.webkit.org/show_bug.cgi?id=153761
            <rdar://problem/24416768>

            Reviewed by Darin Adler.

            Test: media/track/track-manual-mode.html

            * Modules/mediacontrols/MediaControlsHost.cpp:
            (WebCore::MediaControlsHost::manualKeyword): New.
            (WebCore::MediaControlsHost::captionDisplayMode): Support 'manual' mode.
            * Modules/mediacontrols/MediaControlsHost.h:

            * Modules/mediacontrols/mediaControlsApple.js:
            (Controller.prototype.buildCaptionMenu): Check the 'off' item when in manual mode.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::addTextTrack): Update m_captionDisplayMode when called for the first
              time so it is always correct. Set the track's manual selection mode as appropriate.
            (WebCore::HTMLMediaElement::captionPreferencesChanged): Set each track's manual selection
              mode as appropriate.

            * html/track/TextTrack.cpp:
            (WebCore::TextTrack::kind): Return 'subtitles' for forced tracks when in manual mode.
            * html/track/TextTrack.h:

            * html/track/TrackBase.h:
            (WebCore::TrackBase::kind): Make virtual.

            * page/CaptionUserPreferences.cpp:
            (WebCore::CaptionUserPreferences::beginBlockingNotifications): New.
            (WebCore::CaptionUserPreferences::endBlockingNotifications): Ditto.
            (WebCore::CaptionUserPreferences::notify): Don't notify when blocked.
            * page/CaptionUserPreferences.h:

            * page/CaptionUserPreferencesMediaAF.cpp:
            (WebCore::CaptionUserPreferencesMediaAF::CaptionUserPreferencesMediaAF): Set manual mode
              when appropriate.
            (WebCore::CaptionUserPreferencesMediaAF::captionDisplayMode): Check manual mode.
            (WebCore::CaptionUserPreferencesMediaAF::setCaptionDisplayMode): Ditto.
            (WebCore::CaptionUserPreferencesMediaAF::setPreferredLanguage): Ditto.
            (WebCore::CaptionUserPreferencesMediaAF::textTrackSelectionScore): Return zero when in manual mode.
            (WebCore::CaptionUserPreferencesMediaAF::sortedTrackListForMenu): Consider manual mode. Fix
              typos in logging.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::mediaDescriptionForKind): Return 'auxiliary' when in manual mode.

            * testing/Internals.cpp:
            (WebCore::Internals::setCaptionDisplayMode): Support manual mode.

2016-02-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195912. rdar://problem/24417428

    2016-01-30  Eric Carlson  <eric.carlson@apple.com>

            More than one audio and/or text track sometimes selected in media controls menu
            https://bugs.webkit.org/show_bug.cgi?id=153664

            Use an <img> element for the track menu item checkmark instead of a background image and
            the ::before selector.

            Reviewed by Jer Noble.

            Test: media/controls/track-menu.html

            * Modules/mediacontrols/mediaControlsApple.css:
            (audio::-webkit-media-controls-closed-captions-container li:hover):
            (audio::-webkit-media-controls-closed-captions-container li .checkmark-container):
            (audio::-webkit-media-controls-closed-captions-container li.selected .checkmark-container):
            (audio::-webkit-media-controls-closed-captions-container li.selected:hover .checkmark-container):
            (audio::-webkit-media-controls-closed-captions-container li.selected::before): Deleted.
            (audio::-webkit-media-controls-closed-captions-container li.selected:hover::before): Deleted.
            * Modules/mediacontrols/mediaControlsApple.js:
            (Controller.prototype.buildCaptionMenu):
            (Controller.prototype.):
            (Controller.prototype.getCurrentControlsStatus):

2016-02-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r192570. rdar://problem/24417428

    2015-11-18  Aaron Chu  <arona.chu@gmail.com>

            AX: Shadow DOM video player controls menus need aria-owns on the trigger buttons
            https://bugs.webkit.org/show_bug.cgi?id=127065

            Reviewed by Darin Adler.

            Test: media/accessibility-closed-captions-has-aria-owns.html

            * Modules/mediacontrols/mediaControlsApple.js:
            (Controller.prototype.createControls):
            (Controller.prototype.buildCaptionMenu):
            * Modules/mediacontrols/mediaControlsBase.js:
            (Controller.prototype.createControls):
            (Controller.prototype.buildCaptionMenu):

2016-02-01  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195837. rdar://problem/24002220

    2016-01-29  Brent Fulgham  <bfulgham@apple.com>

            [WebGL] Check vertex array bounds before permitting a glDrawArrays to execute
            https://bugs.webkit.org/show_bug.cgi?id=153643
            <rdar://problem/23424456>

            Reviewed by Dean Jackson.

            Tested by fast/canvas/webgl/webgl-drawarrays-crash.html.

            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::validateDrawArrays): Make sure that we have at
            least one buffer bound to a program if a drawArray call with a non-zero range of
            requested data is being made.
            (WebCore::WebGLRenderingContextBase::validateDrawElements): Drive-by formatting fix.

2016-01-31  Babak Shafiei  <bshafiei@apple.com>

        Merge patch for rdar://problem/24426332 and rdar://problem/24209109.

2016-01-31  Babak Shafiei  <bshafiei@apple.com>

        Roll out r195817.

2016-01-29  Babak Shafiei  <bshafiei@apple.com>

        Merge r194479.

    2016-01-01  Jeff Miller  <jeffm@apple.com>

            Update user-visible copyright strings to include 2016
            https://bugs.webkit.org/show_bug.cgi?id=152531

            Reviewed by Alexey Proskuryakov.

            * Info.plist:

2016-01-29  Babak Shafiei  <bshafiei@apple.com>

        Merge r195615.

    2016-01-20  Andy Estes  <aestes@apple.com>

            Re-enable synchronous popstate event for safari-601-branch
            https://bugs.webkit.org/show_bug.cgi?id=153297
            rdar://problem/24154417

            Reviewed by Brent Fulgham.

            r192369 made the popstate event dispatch asynchronously, which matches what the HTML5 spec says to do.
            However, due to compatibility regressions, we do not want to include this behavior change in
            safari-601-branch. This change reverts r192369's changes to Document.cpp, but retains the new tests.
            This change is intended only for safari-601-branch and its copies. The popstate event should remain
            asynchronous in trunk.

            Firing popstate synchronously makes both fast/loader/remove-iframe-during-history-navigation-different.
            Html and fast/loader/remove-iframe-during-history-navigation-same.html crash, because their onpopstate
            handlers remove frames from the document that will later be accessed by
            HistoryController::recursiveGoToItem().

            To prevent the crashes, this change does two things:
            1. Keep a reference to the current frame inside FrameLoader::loadSameDocumentItem(), since calling
               loadInSameDocument() might otherwise delete it.
            2. Handle a null frame when iterating a HistoryItem's child frames in
               HistoryController::recursiveGoToItem(), since calling goToItem() on one frame might cause another
               frame to be deleted.

            Covered by existing tests. fast/loader/stateobjects/popstate-is-asynchronous-expected.txt was updated
            to expect popstate to be synchronous.

            * dom/Document.cpp:
            (WebCore::Document::enqueuePopstateEvent):
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::loadSameDocumentItem):
            * loader/HistoryController.cpp:
            (WebCore::HistoryController::recursiveGoToItem):

2016-01-29  Babak Shafiei  <bshafiei@apple.com>

        Merge patch for rdar://problem/24394636.

2016-01-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r192700.

    2015-11-20  Brent Fulgham  <bfulgham@apple.com>

            [Win] Support High DPI drawing with CACFLayers
            https://bugs.webkit.org/show_bug.cgi?id=147242
            <rdar://problem/19861992>

            Reviewed by Simon Fraser.

            * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
            (WebCore::WKCACFViewLayerTreeHost::initializeContext): Set correct content scale factor
            for current screen, and apply an appropriate base transform to the CACFLayer so drawing
            operations are done properly.

2016-01-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r194235.

    2015-12-17  Brent Fulgham  <bfulgham@apple.com>

            [Win] Prevent flashing/strobing repaints on certain hardware
            https://bugs.webkit.org/show_bug.cgi?id=152394
            <rdar://problem/23875302>

            Reviewed by Simon Fraser.

            This patch reverts a change I made in r192166, where I always set the
            m_viewNeedsUpdate flag to true when a 'flushContext' call was made. Instead,
            we should go back to letting the view decide when it needs to paint.

            * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
            (WebCore::WKCACFViewLayerTreeHost::flushContext): Don't just claim that
            the view needs to be updated any time we are asked to flush. 

2016-01-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r192166.

    2015-11-09  Brent Fulgham  <bfulgham@apple.com>

            [Win] Recognize context flush as an event that requires an update
            https://bugs.webkit.org/show_bug.cgi?id=151001
            <rdar://problem/22956040>

            Reviewed by Simon Fraser.

            * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp:
            (WebCore::WKCACFViewLayerTreeHost::flushContext): Mark view as needing an update
            when flushing so internal drawing code will do the paint.
            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::paintIntoLayer): Skip WK2 assert that does
            not apply to Windows drawing path.

2016-01-28  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195710. rdar://problem/24337780

    2016-01-27  Babak Shafiei  <bshafiei@apple.com>

            Merge r195625.

        2016-01-26  Brady Eidson  <beidson@apple.com>

                History.pushState causes intense memory pressure.
                https://bugs.webkit.org/show_bug.cgi?id=153435

                Reviewed by Sam Weinig, Oliver Hunt, and Geoff Garen.

                Tests: fast/loader/stateobjects/pushstate-frequency-iframe.html
                       fast/loader/stateobjects/pushstate-frequency-with-user-gesture.html
                       fast/loader/stateobjects/pushstate-frequency.html
                       fast/loader/stateobjects/replacestate-frequency-iframe.html
                       fast/loader/stateobjects/replacestate-frequency-with-user-gesture.html
                       fast/loader/stateobjects/replacestate-frequency.html
                       loader/stateobjects/pushstate-size-iframe.html
                       loader/stateobjects/pushstate-size.html
                       loader/stateobjects/replacestate-size-iframe.html
                       loader/stateobjects/replacestate-size.html

                Add restrictions on how frequently push/replaceState can be called,
                as well as how much of a cumulative payload they can deliver.

                * bindings/js/JSHistoryCustom.cpp:
                (WebCore::JSHistory::pushState):
                (WebCore::JSHistory::replaceState):

                * page/History.cpp:
                (WebCore::History::stateObjectAdded):
                * page/History.h:

2016-01-26  Eric Carlson  <eric.carlson@apple.com>

        Cherry-pick r195592 and parts of r194672 to fix rdar://24154288
        <rdar://problem/24154288> FaradayDotFour: Do not see AirPlay icon in Vimeo

        Unreviewed.

        * Modules/mediasession/WebMediaSessionManager.cpp:
        (WebCore::mediaProducerStateString): Log a new flag.
        (WebCore::WebMediaSessionManager::clientStateDidChange): Schedule a client
          reconfiguration if the 'requires monitoring', 'has listener', or 'has audio or
          video' flags have changed.
        (WebCore::WebMediaSessionManager::configurePlaybackTargetMonitoring): Start monitoring if
          at least one client has a listener and at least one has audio/video.

        * html/HTMLMediaElement.cpp:
        (WebCore::HTMLMediaElement::mediaState): Set new flags.

        * page/MediaProducer.h: Add new flags.

2016-01-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195609. rdar://problem/24337868

    2016-01-26  Jeremy Noble  <jer.noble@apple.com>

            [EME][Mac] Crash in [AVStreamSession addStreamDataParser:]; uncaught exception
            https://bugs.webkit.org/show_bug.cgi?id=153495

            Reviewed by Eric Carlson.

            When AVContentKeySession is not available, fall back to pre-AVContentKeySession behavior;
            namely, immediately create an AVStreamSession object in
            willProvideContentKeyRequestInitializationData, rather than waiting for didProvide.

            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
            (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):

2016-01-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195606. rdar://problem/24242476

    2016-01-25  Dave Hyatt  <hyatt@apple.com>

            Speculative fixes for crashing in viewportChangeAffectedPicture
            https://bugs.webkit.org/show_bug.cgi?id=153450

            Reviewed by Dean Jackson.

            Don't attach any conditions to the removal of a picture element from
            the document's HashSet. This ensures that if the condition is ever
            wrong for any reason, we'll still remove the picture element on
            destruction.

            Fix the media query evaluation to match the other evaluations (used by
            the preload scanner and HTMLImageElement). This includes using the
            document element's computed style instead of our own and also null
            checking the document element first. This is the likely cause of the
            crashes.

            * html/HTMLPictureElement.cpp:
            (WebCore::HTMLPictureElement::~HTMLPictureElement):
            (WebCore::HTMLPictureElement::didMoveToNewDocument):
            (WebCore::HTMLPictureElement::viewportChangeAffectedPicture):

2016-01-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195477. rdar://problem/24002217

    2016-01-21  Sam Weinig  <sam@webkit.org>

            Treat non-https actions on secure pages as mixed content
            <rdar://problem/23144492>
            https://bugs.webkit.org/show_bug.cgi?id=153322

            Reviewed by Alexey Proskuryakov.

            Tests:  http/tests/security/mixedContent/insecure-form-in-iframe.html
                    http/tests/security/mixedContent/insecure-form-in-main-frame.html
                    http/tests/security/mixedContent/javascript-url-form-in-main-frame.html

            * html/HTMLFormElement.cpp:
            (WebCore::HTMLFormElement::parseAttribute):
            Check form actions for mixed content.

            * loader/MixedContentChecker.cpp:
            (WebCore::MixedContentChecker::checkFormForMixedContent):
            * loader/MixedContentChecker.h:
            Add new function to check and warn if a form's action is mixed content.

2016-01-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195162. rdar://problem/24302736

    2016-01-15  Jiewen Tan  <jiewen_tan@apple.com>

            FrameLoaderClient::didReceiveServerRedirectForProvisionalLoadForFrame() is never called when loading a main resource from the memory cache
            https://bugs.webkit.org/show_bug.cgi?id=152520
            <rdar://problem/23305737>

            Reviewed by Andy Estes.

            Test: http/tests/loading/server-redirect-for-provisional-load-caching.html

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::responseReceived):
            Dispatch message to notify client that a cached resource was redirected. So,
            client can make proper actions to treat server side redirection.
            * loader/cache/CachedRawResource.h:
            Add a method to tell whether the cached resource was redirected.

2016-01-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195132. rdar://problem/24154292

    2016-01-15  Dave Hyatt  <hyatt@apple.com>

            Avoid downloading the wrong image for <picture> elements.
            https://bugs.webkit.org/show_bug.cgi?id=153027

            Reviewed by Dean Jackson.

            No tests, since they are always flaky.

            * html/HTMLImageElement.cpp:
            (WebCore::HTMLImageElement::HTMLImageElement):
            (WebCore::HTMLImageElement::~HTMLImageElement):
            (WebCore::HTMLImageElement::createForJSConstructor):
            (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
            (WebCore::HTMLImageElement::insertedInto):
            (WebCore::HTMLImageElement::removedFrom):
            (WebCore::HTMLImageElement::pictureElement):
            (WebCore::HTMLImageElement::setPictureElement):
            (WebCore::HTMLImageElement::width):
            * html/HTMLImageElement.h:
            (WebCore::HTMLImageElement::hasShadowControls):
            * html/HTMLPictureElement.h:
            * html/parser/HTMLConstructionSite.cpp:
            (WebCore::HTMLConstructionSite::createHTMLElement):
            * html/parser/HTMLPreloadScanner.cpp:
            (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):

            Images that are built underneath a <picture> element are now connected
            to that picture element via a setPictureNode call from the parser. This
            ensures that the correct <source> elements are examined before checking the image.

            This connection between images and their picture owners is handled using a static
            HashMap in HTMLImageElement. This connection is made both from the parser and from
            DOM insertions, and the map is queried now instead of looking directly at the
            image's parentNode().

2016-01-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195075. rdar://problem/24302727

    2016-01-14  Daniel Bates  <dabates@apple.com>

            Disallow use of Geolocation service from unique origins
            https://bugs.webkit.org/show_bug.cgi?id=153102
            <rdar://problem/23055645>

            Reviewed by Alexey Proskuryakov.

            Tests: fast/dom/Geolocation/dataURL-getCurrentPosition.html
                   fast/dom/Geolocation/dataURL-watchPosition.html
                   fast/dom/Geolocation/srcdoc-getCurrentPosition.html
                   fast/dom/Geolocation/srcdoc-watchPosition.html
                   http/tests/security/sandboxed-iframe-geolocation-getCurrentPosition.html
                   http/tests/security/sandboxed-iframe-geolocation-watchPosition.html

            * Modules/geolocation/Geolocation.cpp:
            (WebCore::Geolocation::securityOrigin): Convenience function to get the SecurityOrigin object
            associated with this script execution context.
            (WebCore::Geolocation::startRequest): Notify requester POSITION_UNAVAILABLE when requested
            from a document with a unique origin.
            * Modules/geolocation/Geolocation.h:
            * page/SecurityOrigin.h:
            (WebCore::SecurityOrigin::canRequestGeolocation): Added.

2016-01-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194559. rdar://problem/24269083

    2016-01-04  Tim Horton  <timothy_horton@apple.com>

            Turn on gesture events when building for Yosemite
            https://bugs.webkit.org/show_bug.cgi?id=152704
            rdar://problem/24042472

            Reviewed by Anders Carlsson.

            * Configurations/FeatureDefines.xcconfig:

2016-01-20  Babak Shafiei  <bshafiei@apple.com>

        Merge r188377.

    2015-08-12  Myles C. Maxfield  <mmaxfield@apple.com>

            [Cocoa] [CJK-configured device] System font has vertical punctuation
            https://bugs.webkit.org/show_bug.cgi?id=147964
            <rdar://problem/22256660>

            Reviewed by Dean Jackson.

            GlyphPage::fill() has multiple code paths to accomplish its goal. It uses the shouldUseCoreText() helper
            function to determine which one of the paths should be taken. However, not all of the code paths in
            GlyphPage::fill() are able of handling all situations. Indeed, the CoreText code paths in GlyphPage::fill()
            are only able to handle the situations which shouldUseCoreText() returns true for. This happens in the
            following cases:

            1. If the font is a composite font
            2. If the font is used for text-combine
            3. If the font has vertical glyphs

            In r187693, I added one more case to this list: If the font is the system font. However, I failed to add
            the necessary support to GlyphPage::fill() for this case. Becasue of this, we just happened to fall into
            the case of vertical fonts (just by coincidence), which causes us to use
            CTFontGetVerticalGlyphsForCharacters() instead of CTFontGetGlyphsForCharacters().

            The solution is to adopt the same behavior we were using before r187693. Back then, we were using
            CGFontGetGlyphsForUnichars(), which always returned horizontal glyphs. We should simply adopt this same
            behavior, except in the Core Text case. Therefore, this patch is just a simple check to see if we are
            using the system font when determining which Core Text function to use.

            Test: fast/text/system-font-punctuation.html

            * platform/graphics/FontDescription.h:
            (WebCore::FontDescription::setWidthVariant):
            * platform/graphics/FontPlatformData.h:
            (WebCore::FontPlatformData::isForTextCombine):
            * platform/graphics/mac/GlyphPageMac.cpp:
            (WebCore::shouldUseCoreText):
            (WebCore::GlyphPage::fill):
            * rendering/RenderCombineText.cpp:
            (WebCore::RenderCombineText::combineText):

2016-01-20  Babak Shafiei  <bshafiei@apple.com>

        Merge r188263.

    2015-08-11  Myles C. Maxfield  <mmaxfield@apple.com>

            [iOS] Arabic letter Yeh is drawn in LastResort
            https://bugs.webkit.org/show_bug.cgi?id=147862
            <rdar://problem/22202935>

            Reviewed by Darin Adler.

            In order to perform font fallback, we must know which fonts support which characters. We
            perform this check by asking each font to map a sequence of codepoints to glyphs, and
            any glyphs which end up with a 0 value are unsupported by the font.

            One of the mechanisms that we use to do this is to combine the code points into a string,
            and tell Core Text to lay out the string. However, this is fundamentally a different
            operation than the one we are trying to perform. Strings combine adjacent codepoints into
            grapheme clusters, and CoreText operates on these. However, we are trying to gain
            information regarding codepoints, not grapheme clusters.

            Instead of taking this string-based approach, we should try harder to use Core Text
            functions which operate on ordered collections of characters, rather than strings. In
            particular, CTFontGetGlyphsForCharacters() and CTFontGetVerticalGlyphsForCharacters()
            have the behavior we want where any unmapped characters end up with a 0 value glyph.

            Previously, we were only using the result of those functions if they were successfully
            able to map their entire input. However, given the fact that we can degrade gracefully
            in the case of a partial mapping, we shouldn't need to bail completely to the
            string-based approach should a partial mapping occur.

            At some point we should delete the string-based approach entirely. However, this path
            is still explicitly used for composite fonts. Fixing that use case is out of scope
            for this patch.

            Test: fast/text/arabic-glyph-cache-fill-combine.html

            * platform/graphics/mac/GlyphPageMac.cpp:
            (WebCore::GlyphPage::fill):

2016-01-20  Timothy Hatcher  <timothy@apple.com>

        <rdar://problem/24242600> CrashTracer: com.apple.WebKit.WebContent at �cpector::CSSFrontendDispatcher::mediaQueryResultChanged + 316

        Reviewed by Joseph Pecoraro.

        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::willDestroyFrontendAndBackend): Call disable().
        (WebCore::InspectorCSSAgent::mediaQueryResultChanged): Add null check.

2016-01-20  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r195066. rdar://problem/24154288

    2016-01-20  Matthew Hanson  <matthew_hanson@apple.com>

            Rollout r192200 via r195067. rdar://problem/24154288

2016-01-20  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r195068. rdar://problem/24154288

2016-01-14  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194672. rdar://problem/24154288

    2016-01-06  Eric Carlson  <eric.carlson@apple.com>

            AirPlay route availability event not always sent
            https://bugs.webkit.org/show_bug.cgi?id=152802

            Reviewed by Jer Noble.

            Test: media/airplay-target-availability.html

            * Modules/mediasession/WebMediaSessionManager.cpp:
            (WebCore::mediaProducerStateString): Log the new flags.
            (WebCore::WebMediaSessionManager::clientStateDidChange): Schedule a client reconfiguration if
              the 'requires monitoring', 'has listener', or 'has audio or video' flags have changed.
            (WebCore::WebMediaSessionManager::configurePlaybackTargetMonitoring): Start monitoring if
              at least one client has a listener and at least one has audio/video.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::mediaState): Set new flags.
            * html/HTMLMediaElement.h:

            * page/MediaProducer.h: Define new flags. Add new state enum.

            * platform/graphics/MediaPlaybackTargetContext.h: Initial state is "Unknown".

            * platform/mock/MediaPlaybackTargetMock.h:
            * platform/mock/MediaPlaybackTargetPickerMock.cpp:
            (WebCore::MediaPlaybackTargetPickerMock::externalOutputDeviceAvailable): Enums not bitfields.
            (WebCore::MediaPlaybackTargetPickerMock::startingMonitoringPlaybackTargets): Ditto. Don't make
              device change callback if the device state is "Unknown".
            (WebCore::MediaPlaybackTargetPickerMock::setState): Ditto.
            * platform/mock/MediaPlaybackTargetPickerMock.h:

            * testing/Internals.cpp:
            (WebCore::Internals::setMockMediaPlaybackTargetPickerState): Support new state.

2016-01-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194927. rdar://problem/24101254

    2016-01-12  Daniel Bates  <dabates@apple.com>

            XSS Auditor should navigate to empty substitute data on full page block
            https://bugs.webkit.org/show_bug.cgi?id=152868
            <rdar://problem/18658448>

            Reviewed by David Kilzer and Andy Estes.

            Derived from Blink patch (by Tom Sepez <tsepez@chromium.org>):
            <https://src.chromium.org/viewvc/blink?view=rev&revision=179240>

            Test: http/tests/security/xssAuditor/block-does-not-leak-that-page-was-blocked-using-empty-data-url.html

            * html/parser/XSSAuditorDelegate.cpp:
            (WebCore::XSSAuditorDelegate::didBlockScript): Modified to call NavigationScheduler::schedulePageBlock().
            * loader/NavigationScheduler.cpp:
            (WebCore::ScheduledPageBlock::ScheduledPageBlock): Added.
            (WebCore::NavigationScheduler::schedulePageBlock): Navigate to empty substitute data with
            the same URL as the originating document.
            * loader/NavigationScheduler.h:

2016-01-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194898. rdar://problem/24154290

    2016-01-12  Antti Koivisto  <antti@apple.com>

            Don't reuse memory cache entries with different charset
            https://bugs.webkit.org/show_bug.cgi?id=110031
            rdar://problem/13666418

            Reviewed by Andreas Kling.

            Test: fast/loader/cache-encoding.html

            * loader/cache/CachedResourceLoader.cpp:
            (WebCore::CachedResourceLoader::requestResource):
            (WebCore::logResourceRevalidationDecision):
            (WebCore::CachedResourceLoader::determineRevalidationPolicy):

                Pass full CachedResourceRequest to the function.
                If charset differs don't reuse the cache entry.

            * loader/cache/CachedResourceLoader.h:

2016-01-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194865. rdar://problem/24154291

    2016-01-11  Dave Hyatt  <hyatt@apple.com>

            Picture element needs to work with the preload scanner and select the correct
            source element instead of loading the image.
            https://bugs.webkit.org/show_bug.cgi?id=152983

            Reviewed by Dean Jackson.

            Added new tests in http/tests/loading.

            * html/parser/HTMLPreloadScanner.cpp:
            (WebCore::TokenPreloadScanner::tagIdFor):
            (WebCore::TokenPreloadScanner::initiatorFor):
            (WebCore::TokenPreloadScanner::StartTagScanner::StartTagScanner):
            (WebCore::TokenPreloadScanner::StartTagScanner::processAttributes):
            (WebCore::TokenPreloadScanner::StartTagScanner::processImageAndScriptAttribute):
            (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):
            (WebCore::TokenPreloadScanner::StartTagScanner::resourceType):
            (WebCore::TokenPreloadScanner::scan):
            * html/parser/HTMLPreloadScanner.h:
            (WebCore::TokenPreloadScanner::setPredictedBaseElementURL):
            (WebCore::TokenPreloadScanner::inPicture):

2016-01-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191180. rdar://problem/24154291

    2015-10-16  Chris Dumez  <cdumez@apple.com>

            HTMLPreloadScanner should preload iframes
            https://bugs.webkit.org/show_bug.cgi?id=150097
            <rdar://problem/23094475>

            Reviewed by Antti Koivisto.

            HTMLPreloadScanner should preload iframes to decrease page load time.

            Tests:
            - fast/preloader/frame-src.html
            - http/tests/loading/preload-no-store-frame-src.html

            * html/parser/HTMLPreloadScanner.cpp:
            (WebCore::TokenPreloadScanner::tagIdFor):
            (WebCore::TokenPreloadScanner::initiatorFor):
            (WebCore::TokenPreloadScanner::StartTagScanner::createPreloadRequest):
            (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):
            (WebCore::TokenPreloadScanner::StartTagScanner::resourceType):
            (WebCore::TokenPreloadScanner::StartTagScanner::setUrlToLoad): Deleted.
            (WebCore::TokenPreloadScanner::StartTagScanner::charset): Deleted.
            * html/parser/HTMLPreloadScanner.h:

2016-01-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190641. rdar://problem/24154291

    2015-10-06  Chris Dumez  <cdumez@apple.com>

            Refactor TokenPreloadScanner::StartTagScanner::processAttribute()
            https://bugs.webkit.org/show_bug.cgi?id=149847

            Reviewed by Antti Koivisto.

            Refactor TokenPreloadScanner::StartTagScanner::processAttribute() to only
            process attributes that make sense given the current tagId. In particular,
            - We only process the charset parameter if the tag is a link or a script.
            - We only process the sizes / srcset attributes if the tag is an img.

            * html/parser/HTMLPreloadScanner.cpp:
            (WebCore::TokenPreloadScanner::StartTagScanner::processAttribute):
            (WebCore::TokenPreloadScanner::StartTagScanner::setUrlToLoad): Deleted.

2016-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194751. rdar://problem/24043054

    2016-01-07  Brent Fulgham  <bfulgham@apple.com>

            Correct missing EXT_sRGB Format Handling
            https://bugs.webkit.org/show_bug.cgi?id=152876
            <rdar://problem/23284389>

            Reviewed by Alex Christensen.

            Tested by WebGL 1.0.4 suite.

            * platform/graphics/GraphicsContext3D.cpp:
            (getDataFormat): Handle missing SRGB and SRGB_ALPHA cases.
            * platform/graphics/GraphicsContext3D.h: Add missing SRGB_ALPHA value from the Khronos standard.
            * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
            (WebCore::GraphicsContext3D::texImage2D): Add an assertion that we are not being handed
            an internal format to a method that works with normal formats.

2016-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194745. rdar://problem/24101258

    2016-01-07  Jer Noble  <jer.noble@apple.com>

            [EME] Secure stop information not written to disk
            https://bugs.webkit.org/show_bug.cgi?id=152855

            Reviewed by Eric Carlson.

            Two separate bugs for the two APIs provided by AVFoundation. For the AVStreamSession path,
            we were not calling the lazy-creation function which creates the AVStreamSession, and were
            rather accessing the ivar directly. For the AVContentKeySession, we were not creating the
            intermediate paths containing the secure stop database.

            * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
            (WebCore::CDMSessionAVContentKeySession::contentKeySession):
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setCDMSession):

2016-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194910. rdar://problem/24101255

    2016-01-11  Matthew Hanson  <matthew_hanson@apple.com>

            Merge r194666. rdar://problem/24101185

        2016-01-06  Brent Fulgham  <bfulgham@apple.com>

                Port blocking bypass issue using 307 redirect
                https://bugs.webkit.org/show_bug.cgi?id=152801
                <rdar://problem/24048554>

                Reviewed by Anders Carlsson.

                Tested by http/tests/security/blocked-on-redirect.html.

                Make sure that 307 redirects check the requested URL via 'portAllowed'.

                * loader/DocumentLoader.cpp:
                (WebCore::DocumentLoader::willSendRequest): Confirm that the requested port
                is valid, and block load if it is not.
                * loader/FrameLoader.cpp:
                (WebCore::FrameLoader::reportBlockedPortFailed): Added.
                (WebCore::FrameLoader::blockedError): Added.
                * loader/FrameLoader.h:

2016-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194589. rdar://problem/24101250

    2016-01-05  Eric Carlson  <eric.carlson@apple.com>

            Avoid NULL deference in Page::updateIsPlayingMedia
            https://bugs.webkit.org/show_bug.cgi?id=152732

            No new tests, this fixes a rare crash that I am unable to reproduce.

            Reviewed by David Kilzer.

            * page/Page.cpp:
            (WebCore::Page::updateIsPlayingMedia): frame->document() can return NULL.

2016-01-12  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194908. rdar://problem/24101253

    2016-01-11  Matthew Hanson  <matthew_hanson@apple.com>

            Merge r192186. rdar://problem/24101174

        2015-11-09  Joseph Pecoraro  <pecoraro@apple.com>

                Web Inspector: $0 stops working after navigating to a different domain
                https://bugs.webkit.org/show_bug.cgi?id=147962

                Reviewed by Brian Burg.

                Test: http/tests/inspector/console/cross-domain-inspected-node-access.html

                The inspector backend injects the CommandLineAPI Source with a
                corresponding CommandLineAPIHost into each execution context
                created by the page (main frame, sub frames, etc).

                When creating the JSValue wrapper for the CommandLineAPIHost using
                the generated toJS(...) DOM bindings, we were using the cached
                CommandLineAPIHost wrapper values in the single DOMWrapperWorld shared
                across all frames. This meant that the first time the wrapper was
                needed it was created in context A. But when needed for context B
                it was using the wrapper created in context A. Using this wrapper
                in context B was producing unexpected cross-origin warnings.

                The solution taken here, is to create a new JSValue wrapper for
                the CommandLineAPIHost per execution context. This way each time
                the CommandLineAPIHost wrapper is used in a frame, it is using
                the one created for that frame.

                The C++ host object being wrapped has a lifetime equivalent to
                the Page. It does not change in this patch. The wrapper values
                are cleared on page navigation or when the page is closed, and
                will be garbage collected.

                * WebCore.vcxproj/WebCore.vcxproj:
                * WebCore.vcxproj/WebCore.vcxproj.filters:
                * ForwardingHeaders/inspector/PerGlobalObjectWrapperWorld.h: Added.
                New forwarding header.

                * inspector/CommandLineAPIHost.h:
                * inspector/CommandLineAPIHost.cpp:
                (WebCore::CommandLineAPIHost::CommandLineAPIHost):
                (WebCore::CommandLineAPIHost::wrapper):
                Cached JSValue wrappers per GlobalObject.

                (WebCore::CommandLineAPIHost::clearAllWrappers):
                Clear any wrappers we have, including the $0 value itself
                which we weren't explicitly clearing previously.

                * inspector/CommandLineAPIModule.cpp:
                (WebCore::CommandLineAPIModule::host):
                Simplify creating the wrapper.

                * inspector/WebInjectedScriptManager.h:
                * inspector/WebInjectedScriptManager.cpp:
                (WebCore::WebInjectedScriptManager::discardInjectedScripts):
                When the main frame window object clears, also clear the
                CommandLineAPI wrappers we may have created. Also take this
                opportunity to clear any $0 value that may have pointed
                to a value in the previous page.

2016-01-08  Timothy Hatcher  <timothy@apple.com>

        <rdar://problem/24094651> REGRESSION (193350): CrashTracer: [USER] com.apple.WebKit.WebContent at �c: Inspector::CSSFrontendDispatcher::styleSheetRemoved + 768

        Reviewed by Joseph Pecoraro.

        * inspector/InspectorCSSAgent.cpp:
        (WebCore::InspectorCSSAgent::setActiveStyleSheetsForDocument):
        Add null check before using m_frontendDispatcher.

2016-01-07  Matthew Hanson  <matthew_hanson@apple.com>

        Fix the Mavericks build after r194287. rdar://problem/23769758

        Unreviewed build fix.

        * platform/graphics/Font.cpp:
        Do not implement Font::noSynthesizableFeaturesFont() on Mavericks.

        * platform/graphics/Font.h:
        No not declare Font::noSynthesizableFeaturesFont() on Mavericks.

        * platform/graphics/FontCascade.h:
        Declare the old method signature for fontForCombiningCharacterSequence on Mavericks.

        * platform/graphics/cocoa/FontCascadeCocoa.mm:
        (WebCore::FontCascade::fontForCombiningCharacterSequence):
        Implement the old method (with old method signature) on Mavericks.

        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::platformCreateScaledFont):
        Use the old implementation (prior to the merge of r194287) on Mavericks.
        Use the new implementation (which uses noSynthesizableFeaturesFont) on > Mavericks.

        * platform/graphics/mac/ComplexTextController.cpp:
        (WebCore::ComplexTextController::collectComplexTextRuns):
        Use the old implementation (prior to the merge of r194287) on Mavericks.
        Use the new implementation (which uses noSynthesizableFeaturesFont) on > Mavericks.

2016-01-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194405. rdar://problem/23982006

    2015-12-23  Simon Fraser  <simon.fraser@apple.com>

            REGRESSION (r187593): Scroll position jumps when selecting text in an iframe
            https://bugs.webkit.org/show_bug.cgi?id=152541
            rdar://problem/23886181

            Reviewed by Tim Horton.

            r154382 added code that modifies parentLayer traversal, looking for ancestor
            scrollable layers. However, it confusingly added another code path in which
            the ancestor layer traversal cross a frame boundary, when RenderLayer::scrollRectToVisible()
            already has one. I fixed this new location to adjust the rect coordinates in r187593,
            but then code that hit both crossing points double-mapped the coordinates, causing
            autoscroll jumping.

            Fix by reverting r154382 and r187593, going back to doing the ancestor walk in
            one place. Re-fix r154382 by implementing RenderLayer::allowsCurrentScroll(),
            which contains the logic for line clamp, autoscroll and ensuring that overflow:hidden
            can be programmatically scrolled.

            Form controls are special; they can have overflow:hidden but still be user-scrollable
            during autoscroll; this is handled via the confusingly-named canBeProgramaticallyScrolled().
            RenderTextControlSingleLine implements this to ensure that readonly text inputs
            autoscroll (which is exercised by a test).

            The frame-to-parent-frame rect mapping in RenderLayer::scrollRectToVisible() is
            fixed to use the coordinate mapping functions from Widget/ScrollView, with the
            addition of a new utility function contentsToContainingViewContents().

            A "Scrolling" logging channel is added with a few log points.

            Test: fast/events/autoscroll-in-iframe-body.html

            * page/scrolling/ScrollingCoordinator.cpp:
            (WebCore::ScrollingCoordinator::absoluteNonFastScrollableRegionForFrame):
            use contentsToContainingViewContents().
            * platform/Logging.h:
            * platform/ScrollView.cpp:
            (WebCore::ScrollView::contentsToContainingViewContents):
            * platform/ScrollView.h:
            * platform/graphics/IntPoint.cpp:
            (WebCore::IntPoint::constrainedBetween): New helper to constrain a point between
            two other points.
            * platform/graphics/IntPoint.h:
            (WebCore::IntPoint::expandedTo):
            (WebCore::IntPoint::shrunkTo):
            * rendering/RenderBox.cpp:
            * rendering/RenderLayer.cpp:
            (WebCore::parentLayerCrossFrame):
            (WebCore::RenderLayer::enclosingScrollableLayer):
            (WebCore::frameElementAndViewPermitScroll):
            (WebCore::RenderLayer::allowsCurrentScroll):
            (WebCore::RenderLayer::scrollRectToVisible):
            * rendering/RenderLayer.h:
            * rendering/RenderTextControlSingleLine.h:

2016-01-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194404. rdar://problem/23982006

    2015-12-22  Simon Fraser  <simon.fraser@apple.com>

            Minor cleanup in RenderBox::canBeProgramaticallyScrolled()
            https://bugs.webkit.org/show_bug.cgi?id=152515

            Reviewed by Tim Horton.

            Remove the scrollsOverflow() check in RenderBox::canBeProgramaticallyScrolled(),
            since if hasScrollableOverflow is true, scrollsOverflow() must also be true.

            Factor clientWidth/Height vs. scrollWidth/Height checks into separate functions,
            and call them from two places.

            Added a test which is not affected by this particular change, but will verify
            that a later change doesn't break anything.

            Test: fast/overflow/overflow-hidden-scroll-into-view.html

            * rendering/RenderBox.cpp:
            (WebCore::RenderBox::canBeScrolledAndHasScrollableArea):
            (WebCore::RenderBox::canBeProgramaticallyScrolled):
            * rendering/RenderBox.h:
            (WebCore::RenderBox::hasHorizontalOverflow):
            (WebCore::RenderBox::hasVerticalOverflow):
            (WebCore::RenderBox::hasScrollableOverflowX):
            (WebCore::RenderBox::hasScrollableOverflowY):

2016-01-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194114. rdar://problem/23982010

    2015-12-15  Myles C. Maxfield  <mmaxfield@apple.com>

            [Font Features] TrueType fonts trigger real features even when synthesis is applied
            https://bugs.webkit.org/show_bug.cgi?id=152287

            Reviewed by Darin Adler.

            When using a font feature that is synthesizable, and synthesis is triggered,
            we should make sure to turn off the original font feature. Otherwise, the
            feature will be applied twice on top of itself.

            This worked for OpenType fonts, but not for TrueType fonts.

            Tests: css3/font-variant-petite-caps-synthesis.html
                   css3/font-variant-small-caps-synthesis.html
                   css3/font-variant-petite-caps-synthesis-coverage.html
                   css3/font-variant-small-caps-synthesis-coverage.html

            * platform/graphics/cocoa/FontCocoa.mm:
            (WebCore::defaultSelectorForTrueTypeFeature):
            (WebCore::removedFeature):
            (WebCore::createCTFontWithoutSynthesizableFeatures):

2016-01-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188802. rdar://problem/23982009

    2015-08-21  Myles C. Maxfield  <mmaxfield@apple.com>

            [OS X] Remove dead code from FontCache::systemFallbackForCharacters()
            https://bugs.webkit.org/show_bug.cgi?id=148218

            Reviewed by Daniel Bates.

            lookupCTFont() in FontCacheMac.mm will always return the best font (because
            CTFontCreateForCharactersWithLanguage() does so). Also, all fonts that will
            be created on WebKit's behalf are already printer fonts.

            No new tests because there is no behavior change.

            * platform/graphics/mac/FontCacheMac.mm:
            (WebCore::FontCache::systemFallbackForCharacters): Deleted.

2016-01-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge for rdar://problem/24043055.

        * dom/EventDispatcher.cpp:
        (WebCore::EventPath::EventPath):
        Set the isMouseOrFocusEvent boolean flag to True if the event is a wheelEvent.

2015-12-17  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r193932. rdar://problem/23886464

    2015-12-10  Myles C. Maxfield  <mmaxfield@apple.com>
      
            [Font Features] r193894 introduces leaks
            https://bugs.webkit.org/show_bug.cgi?id=152154

            Reviewed by Joe Pecoraro.

            * platform/graphics/cocoa/FontCocoa.mm:
            (WebCore::smallCapsTrueTypeDictionary):
            (WebCore::createCTFontWithoutSynthesizableFeatures):

2015-12-17  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r193894. rdar://problem/23769758

    2015-12-10  Myles C. Maxfield  <mmaxfield@apple.com>

            font-variant-caps does not work if the font does not support font features
            https://bugs.webkit.org/show_bug.cgi?id=149774

            Reviewed by Antti Koivisto.

            This test implements synthesis for small-caps and all-small-caps. It does so by
            moving font variant selection into a higher level (ComplexTextController).
            In general, the approach is to use the pure font feature until we encounter
            a character which needs to be uppercased, and which the font feature does not
            support uppercasing. In this situation, we try again with synthesis. In this
            case, synthesis means artificially uppercasing letters and rendering them with
            a smaller font.

            We require system support to know which glyphs a particular font feature supports.
            Therefore, on operating systems which do not include this support, we will simply
            say that the font feature does not support any glyphs.

            Test: css3/font-variant-small-caps-synthesis.html
                  css3/font-variant-petite-caps-synthesis.html

            * platform/graphics/Font.cpp:
            (WebCore::Font::noSmallCapsFont): Return the same font, but without smcp or c2sc.
            This function utilizes a cache.
            * platform/graphics/Font.h:
            (WebCore::Font::variantFont): Small caps should never go through this function
            anymore.
            * platform/graphics/FontCascade.h: Because we're moving variant selection into
            a higher level, we remove the FontVariant argument from the lower-level call.
            * platform/graphics/FontCascadeFonts.cpp:
            (WebCore::FontCascadeFonts::glyphDataForVariant): Use early-return style.
            (WebCore::FontCascadeFonts::glyphDataForNormalVariant): Ditto.
            * platform/graphics/cocoa/FontCascadeCocoa.mm:
            (WebCore::FontCascade::fontForCombiningCharacterSequence): Because we're moving
            variant selection into a higher level, we remove the FontVariant argument from
            the lower-level call.
            * platform/graphics/cocoa/FontCocoa.mm:
            (WebCore::Font::smallCapsSupportsCharacter):
            (WebCore::Font::allSmallCapsSupportsCharacter):
            (WebCore::smallCapsOpenTypeDictionary): Helper function for
            smallCapsSupportsCharacter().
            (WebCore::smallCapsTrueTypeDictionary): Ditto.
            (WebCore::unionBitVectors):
            (WebCore::Font::glyphsSupportedBySmallCaps): Compute a bit vector of supported
            glyphs.
            (WebCore::Font::glyphsSupportedByAllSmallCaps): Ditto.
            (WebCore::createDerivativeFont): Moving common code into its own helper function.
            (WebCore::Font::createFontWithoutSmallCaps):
            (WebCore::Font::platformCreateScaledFont): Use the common code.
            * platform/graphics/mac/ComplexTextController.cpp:
            (WebCore::capitalized): What is the capitalized form of a character?
            (WebCore::ComplexTextController::collectComplexTextRuns): Implement the core
            logic of this patch. This includes the retry when we encounter a character which
            is not supported by the font feature.
            * platform/spi/cocoa/CoreTextSPI.h:

2015-12-18  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r192582. rdar://problem/23910980

    2015-11-18  Chris Dumez  <cdumez@apple.com>

            Null dereference in Performance::Performance(WebCore::Frame*)
            https://bugs.webkit.org/show_bug.cgi?id=151390

            Reviewed by Brady Eidson.

            Based on the stack trace, it appears the DocumentLoader can be null
            when constructing the Performance object. This patch thus adds a null
            check before trying to dereference it.

            No new tests, was not able to reproduce.

            * page/DOMWindow.cpp:
            (WebCore::DOMWindow::navigator):
            (WebCore::DOMWindow::performance):
            * page/Performance.cpp:
            (WebCore::Performance::Performance):
            (WebCore::Performance::scriptExecutionContext):
            * page/Performance.h:

2015-12-17  Babak Shafiei  <bshafiei@apple.com>

        Merge r191343.

    2015-10-20  Tim Horton  <timothy_horton@apple.com>

            Try to fix the build by disabling MAC_GESTURE_EVENTS on 10.9 and 10.10

            * Configurations/FeatureDefines.xcconfig:

2015-12-17  Babak Shafiei  <bshafiei@apple.com>

        Merge r191305.

    2015-10-19  Tim Horton  <timothy_horton@apple.com>

            Try to fix the iOS build

            * Configurations/FeatureDefines.xcconfig:

2015-12-16  Babak Shafiei  <bshafiei@apple.com>

        Merge r194125.

    2015-12-15  Tim Horton  <timothy_horton@apple.com>

            [Mac] Gesture Events should not have negative scale
            https://bugs.webkit.org/show_bug.cgi?id=151065
            <rdar://problem/23474123>

            Reviewed by Anders Carlsson.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::clear):
            * page/EventHandler.h:
            Make it possible to use m_gestureInitialDiameter for Mac gesture events too.

2015-12-16  Babak Shafiei  <bshafiei@apple.com>

        Merge r191299.

    2015-10-19  Tim Horton  <timothy_horton@apple.com>

            Add magnify and rotate gesture event support for Mac
            https://bugs.webkit.org/show_bug.cgi?id=150179
            <rdar://problem/8036240>

            Reviewed by Darin Adler.

            No new tests.

            * Configurations/FeatureDefines.xcconfig:
            New feature flag.

            * Configurations/WebCore.xcconfig:
            Don't exclude generated gesture sources; they are already #ifdef-guarded.

            * DerivedSources.make:
            Add GestureEvent.idl for ENABLE_MAC_GESTURE_EVENTS too.

            * WebCore.xcodeproj/project.pbxproj:
            Add GestureEvents.cpp.

            * bindings/objc/DOMEvents.mm:
            (kitClass):
            Support DOMGestureEvent on Mac if the new flag is enabled.

            * dom/mac/GestureEvents.cpp: Added.
            * page/mac/EventHandlerMac.mm:

            * page/EventHandler.cpp:
            (WebCore::EventHandler::clear):
            * page/EventHandler.h:
            Enable some gesture-related code on Mac if the new flag is enabled.

            * platform/PlatformEvent.h:

2015-12-16  Babak Shafiei  <bshafiei@apple.com>

        Merge r191121.

    2015-10-15  Tim Horton  <timothy_horton@apple.com>

            Try to fix the iOS build.

            * page/EventHandler.h:

2015-12-16  Babak Shafiei  <bshafiei@apple.com>

        Merge r191080.

    2015-10-14  Tim Horton  <timothy_horton@apple.com>

            Move some EventHandler initialization to the header
            https://bugs.webkit.org/show_bug.cgi?id=150139

            Reviewed by Andreas Kling.

            No new tests, just cleanup.

            * page/EventHandler.cpp:
            (WebCore::EventHandler::EventHandler): Deleted.
            * page/EventHandler.h:
            Also found one member which was unused, and a few that were uninitialized.
            It's likely the uninitialized ones didn't actually cause any trouble because
            they are reset in lots of places, but this seems better.

2015-12-14  Harris Papadopoulos  <cpapadopoulos@apple.com>

        Merge r192270. rdar://problem/23435543

    2015-11-10  Geoffrey Garen  <ggaren@apple.com>

            alert, confirm, prompt, showModalDialog should be forbidden during page close and navigation
            https://bugs.webkit.org/show_bug.cgi?id=150980

            Reviewed by Chris Dumez.

            Tests: fast/events/beforeunload-alert.html
                   fast/events/beforeunload-confirm.html
                   fast/events/beforeunload-prompt.html
                   fast/events/beforeunload-showModalDialog.html
                   fast/events/pagehide-alert.html
                   fast/events/pagehide-confirm.html
                   fast/events/pagehide-prompt.html
                   fast/events/pagehide-showModalDialog.html
                   fast/events/unload-alert.html
                   fast/events/unload-confirm.html
                   fast/events/unload-prompt.html
                   fast/events/unload-showModalDialog.html

            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::stopLoading): Factored out a helper function for
            unload event processing.
            (WebCore::FrameLoader::handleUnloadEvents): Forbid prompts in unload
            events just like we do in beforeunload events, and for the same reasons.

            (WebCore::FrameLoader::handleBeforeUnloadEvent): Updated for renames.

            * loader/FrameLoader.h:

            * page/DOMWindow.cpp:
            (WebCore::DOMWindow::print):
            (WebCore::DOMWindow::alert):
            (WebCore::DOMWindow::confirm):
            (WebCore::DOMWindow::prompt):
            (WebCore::DOMWindow::showModalDialog): Updated for renames. Refactored
            some of this code to handle null pages more cleanly. In particular, we
            sometimes used to treat null page as "everything is permitted" -- but it
            is best practice in a permissions context to treat lack of information
            as no permission granted rather than all permissions granted. (I don't
            know of a way to trigger this condition in practice.)

            * page/Page.cpp:
            (WebCore::Page::Page):
            (WebCore::Page::forbidPrompts):
            (WebCore::Page::allowPrompts):
            (WebCore::Page::arePromptsAllowed): Renamed to make these functions
            reflect their new, broader context.

            (WebCore::Page::incrementFrameHandlingBeforeUnloadEventCount): Deleted.
            (WebCore::Page::decrementFrameHandlingBeforeUnloadEventCount): Deleted.
            (WebCore::Page::isAnyFrameHandlingBeforeUnloadEvent): Deleted.

            * page/Page.h:

2015-12-08  Harris Papadopoulos  <cpapadopoulos@apple.com>

        Merge r188386. rdar://problem/23816165

    2015-08-12  Anders Carlsson  <andersca@apple.com>

            Use WTF::Optional in WindowFeatures
            https://bugs.webkit.org/show_bug.cgi?id=147956

            Reviewed by Sam Weinig.

            * loader/FrameLoader.cpp:
            (WebCore::createWindow):
            * page/WindowFeatures.cpp:
            (WebCore::WindowFeatures::WindowFeatures):
            (WebCore::WindowFeatures::setWindowFeature):
            (WebCore::WindowFeatures::boolFeature):
            (WebCore::WindowFeatures::floatFeature):
            (WebCore::WindowFeatures::parseDialogFeatures):
            * page/WindowFeatures.h:
            (WebCore::WindowFeatures::WindowFeatures):

2015-12-14  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r194001. rdar://problem/23581577

    2015-12-11  Jiewen Tan  <jiewen_tan@apple.com>

            Strip out Referer header when requesting subresources or following links for documents with "Content-Disposition: attachment"
            https://bugs.webkit.org/show_bug.cgi?id=152102
            <rdar://problem/22124230>

            Reviewed by Andy Estes.

            Keep the ReferrerPolicy for a document as ReferrerPolicyNever if the document is loaded with
            "Content-Disposition: attachment".

            Test: http/tests/contentdispositionattachmentsandbox/subresource-request-not-include-referer-header.html

            * dom/Document.cpp:
            (WebCore::Document::processReferrerPolicy):
            (WebCore::Document::applyContentDispositionAttachmentSandbox):

2015-12-14  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r189942. rdar://problem/23886455

    2015-09-17  Tim Horton  <timothy_horton@apple.com>

            Block Objective-C exceptions in DictionaryLookup
            https://bugs.webkit.org/show_bug.cgi?id=149256

            Reviewed by Anders Carlsson.

            * editing/mac/DictionaryLookup.mm:
            (WebCore::DictionaryLookup::rangeForSelection):
            (WebCore::DictionaryLookup::rangeAtHitTestResult):
            (WebCore::expandSelectionByCharacters):
            (WebCore::DictionaryLookup::stringForPDFSelection):
            (WebCore::showPopupOrCreateAnimationController):
            (WebCore::DictionaryLookup::hidePopup):
            It is possible for Lookup to throw an exception if one of its
            related services dies for some reason. This shouldn't take down
            our UI process, so block the exceptions.

2015-12-14  Babak Shafiei  <bshafiei@apple.com>

        Merge r193999.

    2015-12-11  Jer Noble  <jer.noble@apple.com>

            [EME] Do not pass in the initialization data to AVContentKeyRequest as the contentIdentifier.
            https://bugs.webkit.org/show_bug.cgi?id=152204
            rdar://problem/23867877

            Reviewed by Eric Carlson.

            The AVContentKeyRequest API has been updated to no longer require a contentId parameter if the
            ID can be derived from the initialization data.

            * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm:
            (WebCore::CDMSessionAVContentKeySession::update):

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r193921. rdar://problem/23732405

    2015-12-10  Matthew Hanson  <matthew_hanson@apple.com>

            Merge r190911. rdar://problem/23432368

        2015-10-12  Simon Fraser  <simon.fraser@apple.com>

                Fix iOS and Efl builds.

                * platform/graphics/NamedImageGeneratedImage.cpp:
                (WebCore::NamedImageGeneratedImage::drawPattern):

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r193888. rdar://problem/23732405

    2015-12-09  Simon Fraser  <simon.fraser@apple.com>

            Merge r191590. rdar://problem/23432368

        2015-10-26  Simon Fraser  <simon.fraser@apple.com>

                Implement 'round' and 'space' values for border-image
                https://bugs.webkit.org/show_bug.cgi?id=14185

                Reviewed by Tim Horton.

                Add support for "round" and "space" values for border-image-repeat.
                Following "stretch" and "repeat", the code is added to Image::drawTiled().

                For "round", we compute an integral number of copies of the image that fit,
                and then adjust the tile scale.

                For "space", we also compute an integral number N of copies that will fit,
                and then divide the remaining space amongst N+1 gaps, adjusting the tiling
                phase so that with an even number of images, a gap is centered.

                Tests: fast/borders/border-image-round.html
                       fast/borders/border-image-space.html

                * platform/graphics/Image.cpp:
                (WebCore::Image::drawTiled):
                * platform/graphics/cg/GraphicsContextCG.cpp:
                (WebCore::GraphicsContext::drawPattern):

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190914. rdar://problem/23732405

    2015-12-09  Simon Fraser  <simon.fraser@apple.com>

            Merge r190914. rdar://problem/23432368

        2015-10-12  Simon Fraser  <simon.fraser@apple.com>

                Speculative Cairo build fixes after r190910.

                * platform/graphics/cairo/ImageBufferCairo.cpp:
                (WebCore::ImageBuffer::drawPattern):
                * platform/graphics/cairo/ImageCairo.cpp:
                (WebCore::Image::drawPattern):

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190910. rdar://problem/23732405

    2015-12-09  Simon Fraser  <simon.fraser@apple.com>

            Merge r190910. rdar://problem/23432368

        2015-10-12  Simon Fraser  <simon.fraser@apple.com>

                Remove Image::spaceSize() and ImageBuffer::spaceSize()
                https://bugs.webkit.org/show_bug.cgi?id=150064

                Reviewed by Tim Horton.

                Image spacing when tiled should not be a property of the image; but a description
                of how it's drawn, like tile size. So remove spacing from Image and ImageBuffer,
                and pass it in as an argument.

                * platform/graphics/BitmapImage.cpp:
                (WebCore::BitmapImage::drawPattern):
                * platform/graphics/BitmapImage.h:
                * platform/graphics/CrossfadeGeneratedImage.cpp:
                (WebCore::CrossfadeGeneratedImage::drawPattern):
                * platform/graphics/CrossfadeGeneratedImage.h:
                * platform/graphics/GeneratedImage.h:
                * platform/graphics/GradientImage.cpp:
                (WebCore::GradientImage::drawPattern):
                * platform/graphics/GradientImage.h:
                * platform/graphics/GraphicsContext.cpp:
                (WebCore::GraphicsContext::drawTiledImage):
                * platform/graphics/GraphicsContext.h:
                * platform/graphics/Image.cpp:
                (WebCore::Image::drawTiled):
                * platform/graphics/Image.h:
                (WebCore::Image::spaceSize): Deleted.
                (WebCore::Image::setSpaceSize): Deleted.
                * platform/graphics/ImageBuffer.h:
                (WebCore::ImageBuffer::spaceSize): Deleted.
                (WebCore::ImageBuffer::setSpaceSize): Deleted.
                * platform/graphics/NamedImageGeneratedImage.cpp:
                (WebCore::NamedImageGeneratedImage::drawPattern):
                * platform/graphics/NamedImageGeneratedImage.h:
                * platform/graphics/cg/ImageBufferCG.cpp:
                (WebCore::ImageBuffer::copyImage):
                (WebCore::ImageBuffer::drawPattern):
                * platform/graphics/cg/ImageCG.cpp:
                (WebCore::Image::drawPattern):
                * rendering/RenderBoxModelObject.cpp:
                (WebCore::RenderBoxModelObject::paintFillLayerExtended):
                * svg/graphics/SVGImage.cpp:
                (WebCore::SVGImage::drawPatternForContainer):
                * svg/graphics/SVGImage.h:
                * svg/graphics/SVGImageForContainer.cpp:
                (WebCore::SVGImageForContainer::drawPattern):
                * svg/graphics/SVGImageForContainer.h:

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Speculative build fix.

        Reviewed by Dana Burkart and Babak Shafiei.

        * dom/Document.h:
        Resolve a conflict that was missed during the merge of r193966

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r193922. rdar://problem/23727472

    2015-12-10  Enrica Casucci  <enrica@apple.com>

            Change skin tone support for two emoji.
            https://bugs.webkit.org/show_bug.cgi?id=152147
            rdar://problem/23716993
            rdar://problem/23716344

            Reviewed by Darin Adler.

            Horse race emoji (1F3C7) should no longer have skin tone variation.
            Sleuth/Spy emoji (!F575) should instead have skin tone variation.

            * platform/text/TextBreakIterator.cpp:
            (WebCore::cursorMovementIterator):

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r193859. rdar://problem/23814477

    2015-12-09  David Hyatt  <hyatt@apple.com>

            Picture element needs to respond to dynamic viewport changes.
            https://bugs.webkit.org/show_bug.cgi?id=152013
            <rdar://problem/23766375>

            Reviewed by Dean Jackson.

            Added new tests in fast/picture.

            * css/MediaQueryEvaluator.cpp:
            (WebCore::MediaQueryEvaluator::evalCheckingViewportDependentResults):
            Add new evaluation method that adds viewport dependent results to a vector. A follow-up patch
            will refactor the style resolver code to use this function instead of the special style resolver one, in order to
            get rid of the code duplication. Tracked by https://bugs.webkit.org/show_bug.cgi?id=152089.

            * css/MediaQueryEvaluator.h:
            (WebCore::MediaQueryResult::MediaQueryResult):
            * css/StyleResolver.h:
            (WebCore::MediaQueryResult::MediaQueryResult): Deleted.
            Move MediaQueryResult into a header since it is used in multiple places now and not just by the style
            resolver.

            * dom/Document.cpp:
            (WebCore::Document::evaluateMediaQueryList):
            (WebCore::Document::checkViewportDependentPictures):
            (WebCore::Document::optimizedStyleSheetUpdateTimerFired):
            (WebCore::Document::applyContentDispositionAttachmentSandbox):
            (WebCore::Document::addViewportDependentPicture):
            (WebCore::Document::removeViewportDependentPicture):
            * dom/Document.h:
            The document now maintains a HashSet of viewport-dependent pictures, and it checks them whenever the
            viewport changes. If their media queries stay the same, then nothing happens. If they change, then
            the <picture> will go back and re-check all its <source> elements to see what the new best candidate is.

            * html/HTMLImageElement.cpp:
            (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
            Revised to check for viewport dependencies and to cache viewport-dependent results on the <picture> elements.
            When a <picture> is found to be viewport-dependent (or not) it is also added to or removed from the document's
            set of tracked pictures.

            * html/HTMLPictureElement.cpp:
            (WebCore::HTMLPictureElement::HTMLPictureElement):
            (WebCore::HTMLPictureElement::~HTMLPictureElement):
            (WebCore::HTMLPictureElement::didMoveToNewDocument):
            (WebCore::HTMLPictureElement::create):
            (WebCore::HTMLPictureElement::sourcesChanged):
            (WebCore::HTMLPictureElement::viewportChangeAffectedPicture):
            * html/HTMLPictureElement.h:
            New caching of results and updating of the document HashSet when the picture gets destroyed or moves to
            a different document.

            * html/HTMLSourceElement.cpp:
            (WebCore::HTMLSourceElement::parseAttribute):
            * html/HTMLSourceElement.h:
            Cache the media attribute in a parsed form. A follow-up patch will improve the <video>/<audio>
            code to make use of this parsed result. Tracked by https://bugs.webkit.org/show_bug.cgi?id=152090.

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r192772. rdar://problem/23797220

    2015-11-18  Andy Estes  <aestes@apple.com>

            [Content Filtering] Crash in DocumentLoader::notifyFinished() when allowing a media document to load
            https://bugs.webkit.org/show_bug.cgi?id=151433
            rdar://problem/23506594

            Reviewed by Alexey Proskuryakov.

            When the main resource of a media document commits, WebKit cancels its load since the plug-in or media engine
            will do its own loading. If content filtering is enabled, and the filter waits allow the load until the entire
            resource is downloaded, then ContentFilter will attempt to call DocumentLoader::notifyFinished() immediately
            after delivering the buffered resource data to DocumentLoader. However, delivering the data will have nulled out
            DocumentLoader's m_mainResource when the load was cancelled, leading to a crash in notifyFinished().

            To resolve this, add a new Stopped state to ContentFilter. Set this state if DocumentLoader clears its main
            resource or detaches from its frame. If ContentFilter is in the Stopped state after calling
            DocumentLoader::dataReceived(), do not proceed to call DocumentLoader::notifyFinished().

            Test: contentfiltering/allow-media-document.html

            * loader/ContentFilter.cpp:
            (WebCore::ContentFilter::stopFilteringMainResource): Set m_state to Stopped. If m_mainResource is non-null,
            removed ContentFilter as a client and set m_mainResource to null.
            (WebCore::ContentFilter::notifyFinished): Stopped calling DocumentLoader::notifyFinished() if m_state is Stopped
            after calling DocumentLoader::dataReceived().
            * loader/ContentFilter.h:
            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::detachFromFrame): Called ContentFilter::stopFilteringMainResource() instead of setting
            m_contentFilter to null.
            (WebCore::DocumentLoader::clearMainResource): Ditto.

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r192066. rdar://problem/23715623

    2015-11-05  Zhuo Li  <zachli@apple.com>

            Rename the variable to avoid conflict between the variable and the parameter.
            https://bugs.webkit.org/show_bug.cgi?id=150019.

            Reviewed by Dan Bernstein.

            * platform/cocoa/SearchPopupMenuCocoa.mm:
            (WebCore::typeCheckedRecentSearchesRemovingRecentSearchesAddedAfterDate): Rename `date`
            to `dateAdded` so that it does not have the same name as the parameter passed in.

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191628. rdar://problem/23715623

    2015-10-27  Zhuo Li  <zachli@apple.com>

            Add WebKit API to clear data type Search Field Recent Searches.
            https://bugs.webkit.org/show_bug.cgi?id=150019.

            Reviewed by Anders Carlsson.

            * platform/cocoa/SearchPopupMenuCocoa.h: Add a function to remove recent searches based on
            time.
            * platform/cocoa/SearchPopupMenuCocoa.mm:
            (WebCore::typeCheckedRecentSearchesArray): Return nil if the recent searches array is
            corrupted, otherwise return the array.
            (WebCore::typeCheckedDateInRecentSearch): Return nil if the date in recent search is
            corrupted, otherwise return the date.
            (WebCore::typeCheckedRecentSearchesRemovingRecentSearchesAddedAfterDate): Return nil if the recent searches plist is
            corrupted, otherwise return the recent searches plist.
            (WebCore::writeEmptyRecentSearchesPlist): Replace the existing recent searches plist if there is
            any with a clean one.
            (WebCore::loadRecentSearches): Use -typeCheckedRecentSearchesArray and -typeCheckedDateInRecentSearch.
            (WebCore::removeRecentlyModifiedRecentSearches):
            When the time passed in is equivalent to [NSDate distantPast], clear all recent searches in
            the Recent Searches plist. Otherwise, we only clear the recent searches that were created
            after or at the time that is passed in as the parameter. If all recent searches associated
            with an autosave name were created after or at the time that is passed in as the parameter,
            remove this autosave name key and all of its values in the plist. If all recent searches
            associated with every autosave name in the plist were created after or at the time that is
            passed in as the parameter, clear all recent searches in the Recent Searches plist.

            Also, we clear all recent searches in the Recent Searches plist when we find the plist is
            corrupted.

2015-12-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191084. rdar://problem/23715623

    2015-10-14  Zhuo Li  <zachli@apple.com>

            Augment <input type=search>�fs recent search history with the time each entry was added,
            in order to allow time-based clearing of search history.
            https://bugs.webkit.org/show_bug.cgi?id=148388.

            Reviewed by Darin Adler.

            Replace Vector<String> with Vector<RecentSearch>, where RecentSearch is a struct
            that consists search string and time, for recent searches in order to store additional time
            information.

            * WebCore.xcodeproj/project.pbxproj: Added SearchPopupMenuCocoa.h and SearchPopupMenuCocoa.mm
            and sort the project file.
            * loader/EmptyClients.cpp:
            (WebCore::EmptySearchPopupMenu::saveRecentSearches):
            (WebCore::EmptySearchPopupMenu::loadRecentSearches):
            * platform/SearchPopupMenu.h:
            * platform/cocoa/SearchPopupMenuCocoa.h: Added methods for SeachPopupMenuMac in WebKit
            and WebPageProxyCocoa in WebKit2 to call.
            * platform/cocoa/SearchPopupMenuCocoa.mm: Added.
            (WebCore::searchFieldRecentSearchesStorageDirectory): Recent searches with the new structure
            are stored in a new location.
            (WebCore::searchFieldRecentSearchesPlistPath): Get the path for the plist of the recent
            searches entries.
            (WebCore::RetainPtr<NSMutableDictionary> readSearchFieldRecentSearchesPlist): Return the
            recent searches plist as NSMutableDictionary.
            (WebCore::fromNSDatetoSystemClockTime): Convert from NSDate to system_clock::time_point.
            (WebCore::fromSystemClockTimetoNSDate): Convert from system_clock::time_point to NSDate.
            (WebCore::SearchPopupMenuCocoa::saveRecentSearches): Add a dictionary where it has two pairs
            that the first one is the search string and the second one is the time.
            (WebCore::SearchPopupMenuCocoa::loadRecentSearches): We expect the recent search item in the
            plist to be a two-pair dictionary, and convert the dictionary to the struct RecentSearch.
            * platform/win/SearchPopupMenuWin.cpp:
            (WebCore::SearchPopupMenuWin::saveRecentSearches): Only save the RecentSearch's search
            string on Windows platform, which is what we used to do.
            (WebCore::SearchPopupMenuWin::loadRecentSearches): Since we need to construct a
            RecentSearch, we get the string from the app's preferences, and set the time to be
            std::chrono::system_clock::time_point::min().
            * platform/win/SearchPopupMenuWin.h:
            * rendering/RenderSearchField.cpp: Now that m_recentSearches are Vector<RecentSearch>,
            we cannot use -removeAll with a search string. Use -removeAllMatching instead to remove the
            item that has its member search string equal to the search string user inputs.
            (WebCore::RenderSearchField::addSearchResult):
            (WebCore::RenderSearchField::itemText):

2015-12-09  Babak Shafiei  <bshafiei@apple.com>

        Merge r190505.

    2015-10-02  Antoine Quint  <graouts@apple.com>

            popstate is fired at the wrong time on load
            https://bugs.webkit.org/show_bug.cgi?id=94265

            Reviewed by Darin Adler.

            Don't fire popstate event on initial document load

            According to the specification [1], a popstate event should only be fired
            when the document has a "last entry" and the entry being navigated to isn't
            it.  A document is created without a "last entry" and gets one just after
            this check when it is first navigated to, so a popstate should be fired any
            time a document is navigated to except for the first time after it has been
            created.

            Patch adapted from work by jl@opera.com on Blink [2].

            [1] http://www.whatwg.org/specs/web-apps/current-work/multipage/history.html#traverse-the-history (step 12-14 in particular)
            [2] https://src.chromium.org/viewvc/blink?revision=165221&view=revision

            * dom/Document.cpp:
            (WebCore::Document::implicitClose):

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r191748.

    2015-10-29  Csaba Osztrogonác  <ossy@webkit.org>

            One more URTBF after r191731.

            * rendering/svg/RenderSVGResourcePattern.cpp:

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r191746.

    2015-10-29  Csaba Osztrogonác  <ossy@webkit.org>

            URTBF after r191731.

            * rendering/svg/RenderSVGResourcePattern.cpp:

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r191731.

    2015-10-29  Said Abou-Hallawa  <sabouhallawa@apple.com>

            Exploitable crash happens when an SVG contains an indirect resource inheritance cycle
            https://bugs.webkit.org/show_bug.cgi?id=150203

            Reviewed by Brent Fulgham.

            Detecting cycles in SVG resource references happens in two places.
            1. In SVGResourcesCycleSolver::resolveCycles() which it is called from 
               SVGResourcesCache::addResourcesFromRenderer(). When a cycle is deleted,
               SVGResourcesCycleSolver::breakCycle() is called to break the link. In
               the case of a cyclic resource inheritance, SVGResources::resetLinkedResource()
               is called to break this cycle.
            2. SVGPatternElement::collectPatternAttributes() which is called from
               RenderSVGResourcePattern::buildPattern(). The purpose is to resolve
               the pattern attributes and to build a tile image which can be used to
               fill the SVG element renderer. Detecting the cyclic resource reference
               in this function is not sufficient and can detect simple cycles like
                <pattern id="a" xlink:href="#b"/>
                <pattern id="b" xlink:href="#a"/>.
               But it does not detect cycles like:
                <pattern id="a">
                    <rect fill="url(#b)"/>
                </pattern>
                <pattern id="b" xlink:href="#a"/>.

            The fix is to get rid of SVGPatternElement::collectPatternAttributes() which
            uses SVGURIReference::targetElementFromIRIString() to navigates through the
            referenced resource elements and tries to detect cycles. Instead we can
            implement RenderSVGResourcePattern::collectPatternAttributes() which calls
            SVGResourcesCache::cachedResourcesForRenderer() to get the SVGResources
            of the pattern. Then we use SVGResources::linkedResource() to navigate the
            resource inheritance tree. The cached SVGResources is guaranteed to be free
            of cycles.

            Tests: svg/custom/pattern-content-inheritance-cycle.svg

            * rendering/svg/RenderSVGResourcePattern.cpp:
            (WebCore::RenderSVGResourcePattern::collectPatternAttributes):
            Collect the pattern attributes through the cachedResourcesForRenderer().

            (WebCore::RenderSVGResourcePattern::buildPattern):
            Direct the call to the renderer function.

            * rendering/svg/RenderSVGResourcePattern.h:

            * rendering/svg/RenderSVGRoot.cpp:
            (WebCore::RenderSVGRoot::layout):
            RenderSVGRoot needs to call SVGResourcesCache::clientStyleChanged() for all
            the invalidated resources. If an attribute of an SVG resource was updated
            dynamically, the cached SVGResources associated with the renderer of this
            resource was stale.

            * rendering/svg/SVGRenderTreeAsText.cpp:
            (WebCore::writeSVGResourceContainer):
            Direct the call to the renderer function.        

            * svg/SVGPatternElement.cpp:
            (WebCore::SVGPatternElement::collectPatternAttributes):
            (WebCore::setPatternAttributes): Deleted.
            collectPatternAttributes() is a replacement of setPatternAttributes().

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r192604.

    2015-11-18  Jiewen Tan  <jiewen_tan@apple.com>

            [WK1] Crash loading Blink layout test fast/dom/Window/property-access-on-cached-window-after-frame-removed.html
            https://bugs.webkit.org/show_bug.cgi?id=150198
            <rdar://problem/23136026>

            Reviewed by Brent Fulgham.

            Test: fast/dom/Window/property-access-on-cached-window-after-frame-removed.html

            Properties of a contentWindow could be accessed even if the frame who owns the window is
            detached. Therefore, check whether the document loader is still alive before using it.

            * page/PerformanceTiming.cpp:
            (WebCore::PerformanceTiming::monotonicTimeToIntegerMilliseconds):

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r192433.

    2015-11-13  Jiewen Tan  <jiewen_tan@apple.com>

            Element::focus() should acquire the ownership of Frame.
            https://bugs.webkit.org/show_bug.cgi?id=150204
            <rdar://problem/23136794>

            Reviewed by Brent Fulgham.

            The FrameSelection::setSelection method sometimes releases the last reference to a frame.
            When this happens, the Element::updateFocusAppearance would attempt to use dereferenced memory.
            Instead, we should ensure that the Frame lifetime is guaranteed to extend through the duration
            of the method call.

            Test: editing/selection/focus-iframe-removal-crash.html

            * dom/Element.cpp:
            (WebCore::Element::updateFocusAppearance):

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r192389.

    2015-11-12  Zalan Bujtas  <zalan@apple.com>

            Ignore visited background color when deciding if the input renderer needs to be painted natively.
            https://bugs.webkit.org/show_bug.cgi?id=151211
            rdar://problem/21449823

            Reviewed by Antti Koivisto.

            Test: fast/css/pseudo-visited-background-color-on-input.html

            * rendering/RenderTheme.cpp:
            (WebCore::RenderTheme::isControlStyled):
            * rendering/style/RenderStyle.h:

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r192369.

    2015-11-11  Jon Honeycutt  <jhoneycutt@apple.com>

            popstate event should be dispatched asynchronously
            https://bugs.webkit.org/show_bug.cgi?id=36202
            <rdar://problem/7761279>

            Based on an original patch by Mihai Parparita <mihaip@chromium.org>.

            Reviewed by Brent Fulgham.

            Tests: fast/loader/remove-iframe-during-history-navigation-different.html
                   fast/loader/remove-iframe-during-history-navigation-same.html
                   fast/loader/stateobjects/popstate-is-asynchronous.html

            * dom/Document.cpp:
            (WebCore::Document::enqueuePopstateEvent):
            Use enqueueWindowEvent().

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r192316.

    2015-11-10  Jon Honeycutt  <jhoneycutt@apple.com>

            Crash loading Blink layout test fast/parser/strip-script-attrs-on-input.html
            https://bugs.webkit.org/show_bug.cgi?id=150201
            <rdar://problem/23136478>

            Reviewed by Brent Fulgham.

            Test: fast/parser/strip-script-attrs-on-input.html

            * html/parser/HTMLTreeBuilder.cpp:
            (WebCore::HTMLTreeBuilder::processStartTagForInBody):
            Get the attribute after calling
            HTMLConstructionSite::insertSelfClosingHTMLElement(), as this may
            mutate the token's attributes.

2015-12-08  Babak Shafiei  <bshafiei@apple.com>

        Merge r192281.

    2015-11-10  Brent Fulgham  <bfulgham@apple.com>

            Crash running webaudio/panner-loop.html
            https://bugs.webkit.org/show_bug.cgi?id=150200
            <rdar://problem/23136282>

            Reviewed by Jer Noble.

            Test: webaudio/panner-loop.html

            This is based on the changes in Blink r164822:
            https://codereview.chromium.org/130003002

            Avoid infinitely recursing on audio nodes by keeping track of which nodes we've already
            visited.

            * Modules/webaudio/PannerNode.cpp:
            (WebCore::PannerNode::pullInputs): Pass set of visited nodes so we don't revisit
            nodes we've already serviced.
            (WebCore::PannerNode::notifyAudioSourcesConnectedToNode): Accept visitedNodes argument
            so we can avoid revisiting nodes. Check if the current node has already been visited
            before processing it.
            * Modules/webaudio/PannerNode.h:

2015-12-02  Myles C. Maxfield  <mmaxfield@apple.com>

        Unify font-variant-* with font-variant shorthand
        https://bugs.webkit.org/show_bug.cgi?id=149773

        Reviewed by Darin Adler.

        This patch makes font-variant a shorthand for the following properties:
        font-variant-ligatures
        font-variant-position
        font-variant-caps
        font-variant-numeric
        font-variant-alternates
        font-variant-east-asian

        This is consistent with the CSS Fonts Level 3 spec.

        This patch also migrates the "font" longhand to use the font-variant-caps
        property.

        Test: fast/text/font-variant-shorthand.html

        * css/CSSComputedStyleDeclaration.cpp:
        (WebCore::fontVariantEastAsianPropertyValue): Rename FontVariantEastAsian values.
        (WebCore::fontVariantFromStyle): We must consult with the longhand properties to determine
        font-variant computed style.
        (WebCore::ComputedStyleExtractor::propertyValue): Don't put any-old font-variant-caps inside
        the font shorthand.
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::addFontFaceRule): Guard against incorrect downcasts (due to inherit
        of the new shorthand property).
        * css/CSSParser.cpp: Parse font-variant as a shorthand. Also implement its "normal" and "none" values.
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFont):
        (WebCore::CSSParser::parseSystemFont):
        (WebCore::CSSParser::parseFontVariantLigatures):
        (WebCore::CSSParser::parseFontVariantNumeric):
        (WebCore::CSSParser::parseFontVariantEastAsian):
        (WebCore::CSSParser::parseFontVariant):
        (WebCore::isValidKeywordPropertyAndValue): Deleted.
        (WebCore::isKeywordPropertyID): Deleted.
        * css/CSSParser.h:
        * css/CSSPropertyNames.in: Turn font-variant into a shorthand property.
        * css/FontVariantBuilder.h: Guard against incorrect downcasts. Also update for renamed
        FontVariantEastAsian type.
        (WebCore::applyValueFontVariantLigatures):
        (WebCore::applyValueFontVariantNumeric):
        (WebCore::applyValueFontVariantEastAsian):
        * css/StyleProperties.cpp: Update to use the more specific property.
        (WebCore::StyleProperties::appendFontLonghandValueIfExplicit):
        (WebCore::StyleProperties::fontValue):
        (WebCore::StyleProperties::asText):
        * css/StyleResolver.cpp: Ditto.
        (WebCore::StyleResolver::isValidCueStyleProperty):
        * editing/EditingStyle.cpp: Ditto.
        * editing/cocoa/HTMLConverter.mm: Ditto.
        (HTMLConverterCaches::propertyValueForNode):
        (HTMLConverter::computedAttributesForElement):
        * editing/ios/EditorIOS.mm: Ditto.
        (WebCore::Editor::removeUnchangeableStyles):
        * html/canvas/CanvasRenderingContext2D.cpp: Ditto.
        (WebCore::CanvasRenderingContext2D::font):
        (WebCore::CanvasRenderingContext2D::setFont):
        * platform/graphics/FontCache.h: Removing duplicate cache key value.
        (WebCore::FontDescriptionKey::makeFlagsKey):
        * platform/graphics/FontCascade.cpp: Migrate to the new font-variant-caps from the old member variable.
        (WebCore::FontCascade::glyphDataForCharacter):
        * platform/graphics/FontCascade.h: Ditto.
        (WebCore::FontCascade::isSmallCaps):
        * platform/graphics/FontDescription.cpp: Ditto.
        (WebCore::FontDescription::FontDescription):
        * platform/graphics/FontDescription.h: Ditto.
        (WebCore::FontCascadeDescription::equalForTextAutoSizing):
        (WebCore::FontDescription::smallCaps): Deleted.
        (WebCore::FontDescription::setSmallCaps): Deleted.
        (WebCore::FontDescription::setIsSmallCaps): Deleted.
        (WebCore::FontDescription::operator==): Deleted.
        * platform/graphics/cocoa/FontCacheCoreText.cpp: Rename FontVariantEastAsianWidth.
        (WebCore::computeFeatureSettingsFromVariants):
        * platform/text/TextFlags.h: Ditto.
        (WebCore::FontVariantSettings::operator==):
        * rendering/RenderText.cpp: Migrage to the new font-variant-caps from the old member variable.
        (WebCore::RenderText::widthFromCache):

2015-11-22  Myles C. Maxfield  <mmaxfield@apple.com>

        Font selection should not consult font-variant property
        https://bugs.webkit.org/show_bug.cgi?id=151537

        Reviewed by Simon Fraser.

        In section 4.7 of the CSS Fonts Level 3 spec, it says "[The font-variant and
        font-feature-settings] do not affect font selection."

        All the other browsers (Chrome, Firefox, and Edge) all obey the spec here. We
        are the only one who misbehaves. This patch aligns our behavior with the other
        browsers.

        Test: fast/text/font-selection-font-variant.html

        * css/CSSFontSelector.cpp:
        (WebCore::computeTraitsMask): Deleted.
        (WebCore::compareFontFaces): Deleted.
        (WebCore::CSSFontSelector::getFontFace): Deleted.
        * css/CSSParser.cpp:
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::createFontFaceRule):
        (WebCore::CSSParser::CSSParser): Deleted.
        (WebCore::CSSParser::parseValue): Deleted.
        (WebCore::CSSParser::parseDeclaration): Deleted.
        (WebCore::CSSParser::clearProperties): Deleted.
        (WebCore::CSSParser::parseFontVariant): Deleted.
        (WebCore::CSSParser::createStyleRule): Deleted.
        (WebCore::CSSParser::deleteFontFaceOnlyValues): Deleted.
        * css/CSSParser.h:
        * platform/graphics/FontDescription.cpp:
        (WebCore::FontDescription::traitsMask): Deleted.
        * platform/graphics/win/FontCacheWin.cpp:
        (WebCore::traitsInFamilyEnumProc):
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::toTraitsMask):
        * platform/text/TextFlags.h:

2015-12-07  Matthew Hanson  <matthew_hanson@apple.com>

        Follow-up merge of r191014. rdar://problem/23769801

        Complete the merge of r191014. The missing change was iOS only, but if that ever
        changes we don't want to expose a known compile error.

        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::FontCascade):

2015-10-18  Myles C. Maxfield  <mmaxfield@apple.com>

        Stop honoring the user default "WebKitKerningAndLigaturesEnabledByDefault"
        https://bugs.webkit.org/show_bug.cgi?id=150287

        Reviewed by Simon Fraser.

        This user default is currently on by default. Therefore, by setting the user default,
        users can only disable kerning / ligatures (rather than enable it).

        There are a few reasons why we should stop honoring it:

        1. In the brave new world of font-feature-settings and font-variant-ligatures, there
        are many different kinds of ligatures which may be enabled at will. The simplistic
        statement of "turn on ligatures" no longer has any meaning.

        2. If a user wants to disable kerning / ligatures, he/she can do it with a user
        stylesheet.

        3. The default isn't able to be tested with DumpRenderTree or WebKitTestRunner.

        4. I have never heard of anyone actually using this user default.

        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::setDefaultKerning): Deleted.
        (WebCore::FontCascade::setDefaultLigatures): Deleted.
        * platform/graphics/FontCascade.h:
        (WebCore::FontCascade::advancedTextRenderingMode):

2015-10-17  Myles C. Maxfield  <mmaxfield@apple.com>

        Delete FontPlatformData::allowsLigatures()
        https://bugs.webkit.org/show_bug.cgi?id=150286

        Reviewed by Dan Bernstein.

        This function is only used to force ligatures on for complex fonts (where "complex"
        means "does not support the letter 'a'"). However, ligatures are turned on for all
        fonts by default, which means that this function is unnecessary.

        Required ligatures, such as those which make these complex scripts legible, are always
        enabled, no matter what.

        Test: fast/text/required-ligatures.html

        * platform/graphics/FontPlatformData.h:
        * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
        (WebCore::FontPlatformData::allowsLigatures): Deleted.
        * platform/graphics/mac/SimpleFontDataCoreText.cpp:
        (WebCore::Font::getCFStringAttributes):

2015-10-12  Myles C. Maxfield  <mmaxfield@apple.com>

        Test font-variant-* and font-feature-settings on Yosemite and Mavericks
        https://bugs.webkit.org/show_bug.cgi?id=149778

        Reviewed by Simon Fraser.

        We can simply call the function which enables features on Yosemite and Mavericks.

        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::platformFontLookupWithFamily):
        (WebCore::fontWithFamily):

2015-11-12  Csaba Osztrogonác  <ossy@webkit.org>

        Fix build failure due to missing forward declaration of FontVariantSettings after r191968
        https://bugs.webkit.org/show_bug.cgi?id=151185

        Reviewed by Myles C. Maxfield.

        * css/CSSFontFaceSource.h:

2015-11-03  Myles C. Maxfield  <mmaxfield@apple.com>

        font-variant-* properties in @font-face declarations should be honored
        https://bugs.webkit.org/show_bug.cgi?id=149771

        Reviewed by Simon Fraser.

        According to the CSS Fonts Level 3 spec, web authors are allowed to put
        font-feature-settings / font-variant-* inside @font-face blocks. These
        properties are supposed to be applied at a specific time during the
        font selection algorithm.

        This patch gives a FontFeatureSettings object and a FontVariantSettings
        object to CSSFontFace, and moves common parsing logic from
        StyleBuilderCustom to a shared location. Then, once the two properties
        are parsed from the @font-face block, the relevant data structures are
        passed down into the font selection algorithm. This algorithm then
        consults with these values at the correct time (inside
        preparePlatformFont()).

        Tests: css3/font-feature-settings-font-face-rendering.html
               css3/font-variant-font-face-all.html
               css3/font-variant-font-face-override.html

        * WebCore.xcodeproj/project.pbxproj: Add a header for the common
        location of parsing font-variant-ligatures, font-variant-numeric,
        and font-variant-east-asian.
        * css/CSSFontFace.cpp:
        (WebCore::CSSFontFace::font): Pass the relevant data structures
        into the font selection algorithm.
        * css/CSSFontFace.h: Add FontFeatureSettings and FontVariantSettings
        member variables.
        (WebCore::CSSFontFace::insertFeature):
        (WebCore::CSSFontFace::setVariantCommonLigatures):
        (WebCore::CSSFontFace::setVariantDiscretionaryLigatures):
        (WebCore::CSSFontFace::setVariantHistoricalLigatures):
        (WebCore::CSSFontFace::setVariantContextualAlternates):
        (WebCore::CSSFontFace::setVariantPosition):
        (WebCore::CSSFontFace::setVariantCaps):
        (WebCore::CSSFontFace::setVariantNumericFigure):
        (WebCore::CSSFontFace::setVariantNumericSpacing):
        (WebCore::CSSFontFace::setVariantNumericFraction):
        (WebCore::CSSFontFace::setVariantNumericOrdinal):
        (WebCore::CSSFontFace::setVariantNumericSlashedZero):
        (WebCore::CSSFontFace::setVariantAlternates):
        (WebCore::CSSFontFace::setVariantEastAsianVariant):
        (WebCore::CSSFontFace::setVariantEastAsianWidth):
        (WebCore::CSSFontFace::setVariantEastAsianRuby):
        * css/CSSFontFaceSource.cpp:
        (WebCore::CSSFontFaceSource::font): Pass the relevant data
        structures into the font selection algorithm.
        * css/CSSFontFaceSource.h: Ditto.
        * css/CSSFontSelector.cpp:
        (WebCore::CSSFontSelector::addFontFaceRule): Call the shared
        parsing logic to populate the FontFeatureSettings and
        FontVariantSettings members.
        * css/FontVariantBuilder.h: Added. Destination for shared parsing
        logic.
        (WebCore::applyValueFontVariantLigatures):
        (WebCore::applyValueFontVariantNumeric):
        (WebCore::applyValueFontVariantEastAsian):
        * css/StyleBuilderCustom.h: Source for shared parsing logic.
        (WebCore::StyleBuilderCustom::applyValueFontVariantLigatures):
        (WebCore::StyleBuilderCustom::applyValueFontVariantNumeric):
        (WebCore::StyleBuilderCustom::applyValueFontVariantEastAsian):
        * loader/cache/CachedFont.cpp: Pass the relevant data structures
        into the font selection algorithm.
        (WebCore::CachedFont::createFont):
        (WebCore::CachedFont::platformDataFromCustomData):
        * loader/cache/CachedFont.h: Ditto.
        * loader/cache/CachedSVGFont.cpp: Ditto.
        (WebCore::CachedSVGFont::createFont):
        (WebCore::CachedSVGFont::platformDataFromCustomData):
        * loader/cache/CachedSVGFont.h: Ditto.
        * platform/graphics/FontCache.h: Ditto.
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::codePath): Adjust comment.
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::preparePlatformFont): Consult with the newly parsed values.
        (WebCore::fontWithFamily): Pass the relevant data structures into the
        font selection algorithm.
        (WebCore::FontCache::systemFallbackForCharacters): Ditto.
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData): Ditto.
        * platform/graphics/mac/FontCustomPlatformData.h: Ditto.

2015-10-19  Myles C. Maxfield  <mmaxfield@apple.com>

        FontCascade::typesettingFeatures() is not privy to font-variant-* nor font-feature-settings
        https://bugs.webkit.org/show_bug.cgi?id=149775

        Reviewed by Darin Adler.

        This patch has two pieces:

        We used to have a boolean, enableLigatures, which affected how we perform shaping in both our
        simple and complex text codepaths. However, in this brave new world of font-feature-settings
        and font-variant-*, there are many properties which may affect shaping (and multiple kinds
        of ligatures). This patch renames this boolean to requiresShaping, and teaches it about all
        the various properties which affect text shaping.

        Similarly, one of the places which used this enableLigatures boolean was to tell CoreText
        if it should disable ligatures. However, we now have much finer-grained control over
        ligatures during font creation. This patch moves the responsibility of dictating which
        font features should be enabled entirely to the Font. Therefore, getCFStringAttributes()
        doesn't know anything about ligatures anymore; the logic inside font creation is used
        instead.

        An added benefit of moving all the font feature logic to one place is that we can implement
        the feature resolution algorithm described in the CSS3 fonts spec. This patch adds a test to
        makes sure that text-rendering, font-feature-settings, and font-variant-* play together
        nicely.

        Test: fast/text/multiple-feature-properties.html

        * platform/graphics/Font.cpp:
        (WebCore::Font::applyTransforms):
        * platform/graphics/Font.h:
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::FontCascade):
        (WebCore::FontCascade::operator=):
        (WebCore::FontCascade::update):
        (WebCore::FontCascade::drawText):
        (WebCore::FontCascade::drawEmphasisMarks):
        (WebCore::FontCascade::width):
        (WebCore::FontCascade::adjustSelectionRectForText):
        (WebCore::FontCascade::offsetForPosition):
        (WebCore::FontCascade::codePath):
        (WebCore::FontCascade::floatWidthForSimpleText):
        * platform/graphics/FontCascade.h:
        (WebCore::FontCascade::requiresShaping):
        (WebCore::FontCascade::computeRequiresShaping):
        (WebCore::FontCascade::enableLigatures): Deleted.
        (WebCore::FontCascade::computeEnableLigatures): Deleted.
        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::WidthIterator):
        (WebCore::WidthIterator::applyFontTransforms):
        * platform/graphics/WidthIterator.h:
        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::preparePlatformFont):
        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::canRenderCombiningCharacterSequence):
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
        * platform/graphics/mac/SimpleFontDataCoreText.cpp:
        (WebCore::Font::getCFStringAttributes):
        * svg/SVGFontData.h:

2015-10-13  Myles C. Maxfield  <mmaxfield@apple.com>

        Split TypesettingFeatures into kerning and ligatures bools
        https://bugs.webkit.org/show_bug.cgi?id=150074

        Reviewed by Simon Fraser.

        Our TypesettingFeatures type represents whether kerning or ligatures are enabled
        when laying out text. However, now that I have implemented font-feature-settings
        and font-variant-*, this type is wildly inadequate. There are now multiple kinds
        of ligatures, and many other features which are neither kerning nor ligatures.
        Adding tons of information to this type doesn't make sense because 1) We already
        have a FontVariantSettings struct which contains this information, and 2) None
        of the users of TypesettingFeatures care about most of these new features.

        In this new world of font features, the font-kerning property isn't changing.
        Therefore, all the code which relies only on the Kerning value in
        TypesettingFeatures doesn't need to change. The places which rely on Ligatures,
        however, need to be updated to understand that there are many different kinds
        of ligatures.

        Indeed, after inspection, all of the places which inspect ligatures are more
        interested in a high-level concept of whether or not we can trust some simple
        computation. Therefore, we really have two things we care about: Kerning, and
        this high-level concept.

        This patch is the second step to update our view of the world to include
        font-feature-settings and font-variant-*. In particular, this patch simply
        splits TypesettingFeatures into two Booleans, one for Kerning, and one for
        Ligatures (which has no behavior change). Then, once they are separated, I can
        migrate the Ligatures Boolean to take on its new meaning.

        This change is purely mechanical.

        No new tests because there is no behavior change.

        * WebCore.xcodeproj/project.pbxproj:
        * css/CSSPrimitiveValueMappings.h:
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator FontCascadeDescription::Kerning):
        * platform/graphics/Font.cpp:
        (WebCore::Font::applyTransforms):
        * platform/graphics/Font.h:
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::FontCascade):
        (WebCore::FontCascade::operator=):
        (WebCore::FontCascade::update):
        (WebCore::FontCascade::drawText):
        (WebCore::FontCascade::drawEmphasisMarks):
        (WebCore::FontCascade::width):
        (WebCore::FontCascade::adjustSelectionRectForText):
        (WebCore::FontCascade::offsetForPosition):
        (WebCore::FontCascade::setDefaultKerning):
        (WebCore::FontCascade::setDefaultLigatures):
        (WebCore::FontCascade::codePath):
        (WebCore::FontCascade::floatWidthForSimpleText):
        (WebCore::FontCascade::setDefaultTypesettingFeatures): Deleted.
        (WebCore::FontCascade::defaultTypesettingFeatures): Deleted.
        * platform/graphics/FontCascade.h:
        (WebCore::FontCascade::enableKerning):
        (WebCore::FontCascade::enableLigatures):
        (WebCore::FontCascade::computeEnableKerning):
        (WebCore::FontCascade::computeEnableLigatures):
        (WebCore::FontCascade::typesettingFeatures): Deleted.
        (WebCore::FontCascade::computeTypesettingFeatures): Deleted.
        * platform/graphics/FontDescription.cpp:
        (WebCore::FontCascadeDescription::FontCascadeDescription):
        * platform/graphics/FontDescription.h:
        (WebCore::FontCascadeDescription::setKerning):
        (WebCore::FontCascadeDescription::initialKerning):
        * platform/graphics/TypesettingFeatures.h: Removed.
        * platform/graphics/WidthIterator.cpp:
        (WebCore::WidthIterator::WidthIterator):
        (WebCore::WidthIterator::applyFontTransforms):
        (WebCore::WidthIterator::advanceInternal):
        * platform/graphics/WidthIterator.h:
        * platform/graphics/cocoa/FontCocoa.mm:
        (WebCore::Font::canRenderCombiningCharacterSequence):
        * platform/graphics/mac/ComplexTextControllerCoreText.mm:
        (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):
        * platform/graphics/mac/SimpleFontDataCoreText.cpp:
        (WebCore::Font::getCFStringAttributes):
        * rendering/RenderBlockLineLayout.cpp:
        (WebCore::setLogicalWidthForTextRun):
        * rendering/line/BreakingContext.h:
        (WebCore::WordTrailingSpace::width):
        * svg/SVGFontData.h:

2015-12-07  David Kilzer  <ddkilzer@apple.com>

        Merge r193635. rdar://problem/23581586

    2015-12-07  Chris Dumez  <cdumez@apple.com>

        Crash in MemoryCache::pruneDeadResourcesToSize()
        https://bugs.webkit.org/show_bug.cgi?id=151833
        <rdar://problem/22392235>

        Reviewed by David Kilzer.

        MemoryCache::pruneDeadResourcesToSize() is iterating over m_allResources
        (which is a vector of LRUList). It first destroys decoded data for each
        resource in the LRUList. Then, if it does not suffice to reach the
        target size, and starts actually removing resources from the cache.

        The issue is that this code alters m_allResources (and its LRULists) as
        it is iterating over it. We tried to deal with this in various ways:
        1. Increment the iterator before removing the resource pointed by the
          iterator.
        2. Protect the next resource in the LRUList and abort early if it is no
          longer in the cache.

        This adds code complexity and apparently does not correctly handle all
        the edge cases as we still see crashes in this code. In particular, I
        suspect that 2. may not be sufficient if it is possible for the next
        resource to be moved to another LRUList (in which case, next->inCache()
        would still return true but the iterator would however become invalid).

        To make the code simpler and more robust, this patch copies the LRUList
        (and refs the CachedResources) before iterating over it. This is a lot
        safer and should hopefully fix the crashes we see in this function.

        No new tests, no reproduction case.

        * loader/cache/MemoryCache.cpp:
        (WebCore::MemoryCache::pruneDeadResourcesToSize):

2015-12-06  David Kilzer  <ddkilzer@apple.com>

        REGRESSION (r193575): variantSettings is unused when PLATFORM_FONT_LOOKUP is disabled
        <rdar://problem/23769741>

        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::fontWithFamily): Mark variantSettings as ununsed when
        PLATFORM_FONT_LOOKUP is disabled.

2015-12-06  Babak Shafiei  <bshafiei@apple.com>

        Merge r188114.

    2015-08-06  Myles C. Maxfield  <mmaxfield@apple.com>

            CSSSegmentedFontFace::fontRanges() does not handle duplicate fonts correctly
            https://bugs.webkit.org/show_bug.cgi?id=147765

            Reviewed by Filip Pizlo.

            CSSSegmentedFontFace::fontRanges() was trying to hash on FontDescriptors by
            picking a few specific pieces of data out of the FontDescriptor, computing
            a hash on it, and using that unsigned as a key in a HashMap. This has two
            problems: it doesn't handle equality correctly, as hash collisions cannot
            depend on an equality operator to dedup, and it doesn't hash on all the
            members of a FontDescription.

            Instead, this HashMap should use FontDescriptionKey, which represents a
            FontDescription, and is designed exactly for the purpose of being used as a
            key in a HashMap.

            No new tests because there is no behavior change (because a problem occurs
            when two different FontDescriptions hash to the same value, which is rare).

            * css/CSSSegmentedFontFace.cpp:
            (WebCore::CSSSegmentedFontFace::fontRanges):
            * css/CSSSegmentedFontFace.h:
            * platform/graphics/FontCache.h:
            (WebCore::FontDescriptionKeyHash::hash):
            (WebCore::FontDescriptionKeyHash::equal):

2015-12-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190895. rdar://problem/23769817

    2015-10-12  Myles C. Maxfield  <mmaxfield@apple.com>

            [Font Features] Tiny cleanup regarding FontCascade::typesettingFeatures()
            https://bugs.webkit.org/show_bug.cgi?id=150051

            Reviewed by Simon Fraser.

            There are no typesetting features which aren't kerning nor ligatures.

            No new tests because there is no behavior difference.

            * platform/graphics/FontCascade.cpp:
            (WebCore::FontCascade::codePath):
            * platform/graphics/WidthIterator.h:
            (WebCore::WidthIterator::supportsTypesettingFeatures): Deleted.

2015-12-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190999. rdar://problem/23769821

    2015-10-13  Myles C. Maxfield  <mmaxfield@apple.com>

            Unprefix font-kerning
            https://bugs.webkit.org/show_bug.cgi?id=150080

            Reviewed by Sam Weinig.

            This is the last property in CSS3 Fonts which is prefixed.

            Test: fast/text/font-kerning.html

            * css/CSSPropertyNames.in:

2015-12-06  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190402. rdar://problem/23769741

    2015-10-01  Csaba Osztrogonác  <ossy@webkit.org>

            Fix the ARM build after r190192
            https://bugs.webkit.org/show_bug.cgi?id=149620

            Reviewed by Darin Adler.

            * platform/graphics/FontFeatureSettings.h:
            (WebCore::fontFeatureTag):

2015-09-23  Myles C. Maxfield  <mmaxfield@apple.com>

        [Cocoa] [Font Features] Implement font-variant-*
        https://bugs.webkit.org/show_bug.cgi?id=148413

        Reviewed by Darin Adler.

        This patch is the first pass of implementing of the font-variant-* properties. Specifically,
        these properties are:
        font-variant-ligatures
        font-variant-position
        font-variant-caps
        font-variant-numeric
        font-variant-alternates
        font-variant-east-asian

        These new properties are held inside FontDescription as bit fields. At font creation time,
        we consult with the FontDescription to figure out which variants are specified. We then
        convert those variants to font features, and resolve these font features with the additional
        features specified by font-feature-settings (as the spec requires). This patch also makes
        our caches sensitive to these new properties of FontDescription so we don't look up cached,
        stale fonts.

        The implementation has some caveats, however. They are listed here:
        1. These new properties need to interact correctly with @font-face declarations. In
        particular, only certain properties of the FontDescription should be considered when
        detecting if a @font-face declaration applies to a particular element. This discrimination
        does not happen correctly. In addition, any feature-specific CSS properties inside the
        @font-face declaration need to be consulted at a particular point during the feature
        resolve. This does not currently occur.
        2. One of the properties, font-variant-alternates, has a few values which require custom
        CSS functions, which makes modeling the properties as bit fields tricky. These extra values
        need to be implemented. This patch implements all the values which do not require extra CSS
        features.
        3. These new properties have a shorthand, font-variant, which is designed to be backward-
        compatible with CSS 2.1's concept of font-variant. In particular, CSS 2.1 allows you to use
        "normal" and "small-caps" with font-variant. Both of these values are values of the new
        property font-variant-caps. However, our existing implementation of small-caps does not
        use font features when they exist; instead, it simply draws text at a smaller font size and
        uses (effectively) text-transform to force capital letters. This implementation needs to be
        unified with the new font-variant-caps property so that we can expand font-variant to be
        a shorthand for the new properties.
        4. font-variant-position and font-variant-caps should provide appropriate synthesis if no
        matching font-feature exists.
        5. FontCascade::typesettingFeatures() is now no-longer accurate. Fixing this would be large
        enough to warrant its own patch.
        6. These properties are not tested with TrueType fonts.

        Tests: css3/font-variant-all-webfont.html
               css3/font-variant-parsing.html

        * css/CSSComputedStyleDeclaration.cpp: Reconstruct StyleProperties from a RenderStyle.
        (WebCore::appendLigaturesValue):
        (WebCore::fontVariantLigaturesPropertyValue):
        (WebCore::fontVariantPositionPropertyValue):
        (WebCore::fontVariantCapsPropertyValue):
        (WebCore::fontVariantNumericPropertyValue):
        (WebCore::fontVariantAlternatesPropertyValue):
        (WebCore::fontVariantEastAsianPropertyValue):
        (WebCore::ComputedStyleExtractor::propertyValue):
        * css/CSSFontFeatureValue.cpp: Update to FontFeatureTag instead of WTF::String.
        (WebCore::CSSFontFeatureValue::CSSFontFeatureValue):
        (WebCore::CSSFontFeatureValue::customCSSText):
        * css/CSSFontFeatureValue.h: Ditto.
        (WebCore::CSSFontFeatureValue::create):
        (WebCore::CSSFontFeatureValue::tag):
        * css/CSSParser.cpp: Parse the new properties according to the CSS3 fonts spec.
        (WebCore::isValidKeywordPropertyAndValue):
        (WebCore::isKeywordPropertyID):
        (WebCore::CSSParser::parseValue):
        (WebCore::CSSParser::parseFontFeatureTag):
        (WebCore::CSSParser::parseFontVariantLigatures):
        (WebCore::CSSParser::parseFontVariantNumeric):
        (WebCore::CSSParser::parseFontVariantEastAsian):
        * css/CSSParser.h:
        * css/CSSPrimitiveValueMappings.h: For the three properties which are simple keyword value
        properties, implement casting operators to automatically convert between RenderStyle
        objects and CSS property objects.
        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
        (WebCore::CSSPrimitiveValue::operator FontVariantPosition):
        (WebCore::CSSPrimitiveValue::operator FontVariantCaps):
        (WebCore::CSSPrimitiveValue::operator FontVariantAlternates):
        * css/CSSPropertyNames.in: New properties.
        * css/CSSValueKeywords.in: New values.
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertFontFeatureSettings): Update to not use
        RefPtrs.
        * css/StyleBuilderCustom.h: Properties which are not simple keyword value properties are
        decomposed into multiple members of FontDescription. These properties exist to convert
        between these aggregate members and the CSS properties.
        (WebCore::StyleBuilderCustom::applyInheritFontVariantLigatures):
        (WebCore::StyleBuilderCustom::applyInitialFontVariantLigatures):
        (WebCore::StyleBuilderCustom::applyValueFontVariantLigatures):
        (WebCore::StyleBuilderCustom::applyInheritFontVariantNumeric):
        (WebCore::StyleBuilderCustom::applyInitialFontVariantNumeric):
        (WebCore::StyleBuilderCustom::applyValueFontVariantNumeric):
        (WebCore::StyleBuilderCustom::applyInheritFontVariantEastAsian):
        (WebCore::StyleBuilderCustom::applyInitialFontVariantEastAsian):
        (WebCore::StyleBuilderCustom::applyValueFontVariantEastAsian):
        (WebCore::StyleBuilderCustom::applyInitialWebkitFontVariantLigatures): Deleted.
        (WebCore::StyleBuilderCustom::applyInheritWebkitFontVariantLigatures): Deleted.
        (WebCore::StyleBuilderCustom::applyValueWebkitFontVariantLigatures): Deleted.
        * editing/cocoa/HTMLConverter.mm:
        (HTMLConverter::computedAttributesForElement): Unprefix font-variant-ligatures.
        * platform/graphics/FontCache.h: Update cache to be sensitive to new state in
        FontDescription.
        (WebCore::FontDescriptionKey::FontDescriptionKey):
        (WebCore::FontDescriptionKey::operator==):
        (WebCore::FontDescriptionKey::computeHash):
        (WebCore::FontDescriptionKey::makeFlagsKey):
        (WebCore::FontDescriptionKey::makeFlagKey): Deleted.
        * platform/graphics/FontCascade.cpp:
        (WebCore::FontCascade::codePath): These new variants should trigger the complex text
        codepath.
        * platform/graphics/FontCascade.h:
        (WebCore::FontCascade::computeTypesettingFeatures): Update to use new state enum.
        * platform/graphics/FontDescription.cpp: Add state to hold new property values.
        (WebCore::FontDescription::FontDescription):
        (WebCore::FontCascadeDescription::FontCascadeDescription): Deleted.
        * platform/graphics/FontDescription.h: Add state to hold new property values.
        (WebCore::FontDescription::featureSettings):
        (WebCore::FontDescription::variantCommonLigatures):
        (WebCore::FontDescription::variantDiscretionaryLigatures):
        (WebCore::FontDescription::variantHistoricalLigatures):
        (WebCore::FontDescription::variantContextualAlternates):
        (WebCore::FontDescription::variantPosition):
        (WebCore::FontDescription::variantCaps):
        (WebCore::FontDescription::variantNumericFigure):
        (WebCore::FontDescription::variantNumericSpacing):
        (WebCore::FontDescription::variantNumericFraction):
        (WebCore::FontDescription::variantNumericOrdinal):
        (WebCore::FontDescription::variantNumericSlashedZero):
        (WebCore::FontDescription::variantAlternates):
        (WebCore::FontDescription::variantEastAsianVariant):
        (WebCore::FontDescription::variantEastAsianWidth):
        (WebCore::FontDescription::variantEastAsianRuby):
        (WebCore::FontDescription::variantSettings):
        (WebCore::FontDescription::setFeatureSettings):
        (WebCore::FontDescription::setVariantCommonLigatures):
        (WebCore::FontDescription::setVariantDiscretionaryLigatures):
        (WebCore::FontDescription::setVariantHistoricalLigatures):
        (WebCore::FontDescription::setVariantContextualAlternates):
        (WebCore::FontDescription::setVariantPosition):
        (WebCore::FontDescription::setVariantCaps):
        (WebCore::FontDescription::setVariantNumericFigure):
        (WebCore::FontDescription::setVariantNumericSpacing):
        (WebCore::FontDescription::setVariantNumericFraction):
        (WebCore::FontDescription::setVariantNumericOrdinal):
        (WebCore::FontDescription::setVariantNumericSlashedZero):
        (WebCore::FontDescription::setVariantAlternates):
        (WebCore::FontDescription::setVariantEastAsianVariant):
        (WebCore::FontDescription::setVariantEastAsianWidth):
        (WebCore::FontDescription::setVariantEastAsianRuby):
        (WebCore::FontDescription::operator==):
        (WebCore::FontCascadeDescription::initialVariantPosition):
        (WebCore::FontCascadeDescription::initialVariantCaps):
        (WebCore::FontCascadeDescription::initialVariantAlternates):
        (WebCore::FontCascadeDescription::commonLigaturesState): Deleted.
        (WebCore::FontCascadeDescription::discretionaryLigaturesState): Deleted.
        (WebCore::FontCascadeDescription::historicalLigaturesState): Deleted.
        (WebCore::FontCascadeDescription::setCommonLigaturesState): Deleted.
        (WebCore::FontCascadeDescription::setDiscretionaryLigaturesState): Deleted.
        (WebCore::FontCascadeDescription::setHistoricalLigaturesState): Deleted.
        (WebCore::FontCascadeDescription::operator==): Deleted.
        * platform/graphics/FontFeatureSettings.cpp: Update to use FontFeatureTag instead of
        WTF::String.
        (WebCore::FontFeature::FontFeature):
        (WebCore::FontFeature::operator==):
        (WebCore::FontFeature::operator<):
        (WebCore::FontFeatureSettings::hash):
        (WebCore::FontFeatureSettings::create): Deleted.
        * platform/graphics/FontFeatureSettings.h: Update to use FontFeatureTag instead of
        WTF::String.
        (WebCore::fontFeatureTag):
        (WebCore::FontFeatureTagHash::hash):
        (WebCore::FontFeatureTagHash::equal):
        (WebCore::FontFeatureTagHashTraits::constructDeletedValue):
        (WebCore::FontFeatureTagHashTraits::isDeletedValue):
        (WebCore::FontFeature::tag):
        (WebCore::FontFeatureSettings::operator==):
        (WebCore::FontFeatureSettings::begin):
        (WebCore::FontFeatureSettings::end):
        (WebCore::FontFeatureSettings::FontFeatureSettings): Deleted.
        * platform/graphics/cocoa/FontCacheCoreText.cpp: Ditto. Also, when computing font
        features, consult with the state inside FontDescription.
        (WebCore::tagEquals):
        (WebCore::appendTrueTypeFeature):
        (WebCore::appendOpenTypeFeature):
        (WebCore::computeFeatureSettingsFromVariants):
        (WebCore::preparePlatformFont):
        (WebCore::platformFontLookupWithFamily):
        (WebCore::fontWithFamily):
        (WebCore::FontCache::createFontPlatformData):
        (WebCore::FontCache::systemFallbackForCharacters):
        * platform/graphics/harfbuzz/HarfBuzzShaper.cpp: Update to use references instead of
        pointers.
        (WebCore::HarfBuzzShaper::setFontFeatures):
        * platform/graphics/mac/FontCacheMac.mm:
        (WebCore::platformFontWithFamily): Ditto.
        * platform/graphics/mac/FontCustomPlatformData.cpp:
        (WebCore::FontCustomPlatformData::fontPlatformData): Be sensitive to new state inside FontDescription.
        * platform/text/TextFlags.h:
        (WebCore::FontVariantSettings::isAllNormal): New state enums.
        * rendering/RenderThemeIOS.mm:
        (WebCore::RenderThemeIOS::updateCachedSystemFontDescription): Be sensitive to new state inside
        FontDescription.
        * rendering/line/BreakingContext.h:

2015-07-30  Myles C. Maxfield  <mmaxfield@apple.com>

        Clean up makeFontCascadeCacheKey()
        https://bugs.webkit.org/show_bug.cgi?id=147430

        Reviewed by Benjamin Poulain.

        FontDescriptionKey is designed to encapsulate all the cacheable properties of a FontDescription.
        However, a higher-level cache, FontCascadeCacheKey, was taking some values from FontDescriptions.
        The fact that there wasn't a bug before is just a happy coincidence. This patch moves those bits
        from the higher-level cache and puts them into FontDescriptionKey where they belong.

        No new tests because there is no behavior change.

        * platform/graphics/FontCache.h:
        (WebCore::FontDescriptionKey::makeFlagKey):
        * platform/graphics/FontCascade.cpp:
        (WebCore::operator==):
        (WebCore::makeFontSelectorFlags): Deleted.
        (WebCore::makeFontCascadeCacheKey): Deleted.
        (WebCore::computeFontCascadeCacheHash): Deleted.

2015-08-06  Myles C. Maxfield  <mmaxfield@apple.com>

        Make FontDescriptionKey sensitive to FontFeatureSettings
        https://bugs.webkit.org/show_bug.cgi?id=147751

        Reviewed by Anders Carlsson.

        Just like how FontDescription hashes should be sensitive to locale, they should
        also be sensitive to font features.

        This patch also fixes operator== for FontDescriptionKey, which was previously
        comparing hashes for equality instead of the underlying data. Comparing hashes
        for equality is useless inside hashmaps.

        This is in preparation for implementing font-feature-settings.

        No new tests because there is no behavior change.

        * platform/graphics/FontCache.cpp:
        (WebCore::FontPlatformDataCacheKey::FontPlatformDataCacheKey):
        (WebCore::FontPlatformDataCacheKey::isHashTableDeletedValue):
        (WebCore::FontPlatformDataCacheKey::hashTableDeletedSize): Deleted.
        * platform/graphics/FontCache.h:
        (WebCore::FontDescriptionKey::FontDescriptionKey):
        (WebCore::FontDescriptionKey::operator==):
        (WebCore::FontDescriptionKey::operator!=):
        (WebCore::FontDescriptionKey::isHashTableDeletedValue):
        (WebCore::FontDescriptionKey::computeHash):
        * platform/graphics/FontFeatureSettings.cpp:
        (WebCore::FontFeature::hash):
        (WebCore::FontFeatureSettings::hash):
        * platform/graphics/FontFeatureSettings.h:

2015-08-06  Myles C. Maxfield  <mmaxfield@apple.com>

        Font feature settings comparisons are order-dependent and case-dependent
        https://bugs.webkit.org/show_bug.cgi?id=147719

        Reviewed by Benjamin Poulain.

        We should make our settings vector order-independent and case-independent.

        Test: css3/font-feature-settings-parsing.html

        * css/CSSParser.cpp:
        (WebCore::CSSParser::parseFontFeatureTag):
        * css/StyleBuilderConverter.h:
        (WebCore::StyleBuilderConverter::convertFontFeatureSettings):
        * platform/graphics/FontFeatureSettings.cpp:
        (WebCore::FontFeature::FontFeature):
        (WebCore::FontFeature::operator==):
        (WebCore::FontFeatureSettings::FontFeatureSettings):
        * platform/graphics/FontFeatureSettings.h:
        (WebCore::FontFeature::FontFeature):
        (WebCore::FontFeature::operator==):
        (WebCore::FontFeature::operator<):
        (WebCore::FontFeatureSettings::insert):
        (WebCore::FontFeatureSettings::FontFeatureSettings):
        (WebCore::FontFeatureSettings::append): Deleted.

2015-08-11  Myles C. Maxfield  <mmaxfield@apple.com>

        [font-features] Map OpenType feature tags to TrueType feature selectors
        https://bugs.webkit.org/show_bug.cgi?id=147819

        Reviewed by Dean Jackson.

        Allow uses of font-feature-settings even on TrueType fonts.

        Test: css3/font-feature-settings-preinstalled-fonts.html

        * platform/graphics/cocoa/FontCacheCoreText.cpp:
        (WebCore::appendRawTrueTypeFeature):
        (WebCore::appendTrueTypeFeature):

2015-12-05  Babak Shafiei  <bshafiei@apple.com>

        Merge r193479.

    2015-12-01  Jer Noble  <jer.noble@apple.com>

            Adopt AVContentKeySession
            https://bugs.webkit.org/show_bug.cgi?id=151221

            Reviewed by Eric Carlson.

            Adopt a new API for managing key state, AVContentKeySession. Because this necessitates a change
            in both the initialization data returned by the needkey event, and passed into the createSession()
            method, bump the protocol version number (to 3), and keep supporting the old key management API
            for legacy content.

            To do so, move most of the implementation of CDMPrivateMediaSourceAVFObjC into a new subclass,
            CDMSessionAVStreamSession, and add a new subclass, CDMSessionAVContentKeySession, to support the
            new API.

            * platform/graphics/avfoundation/CDMPrivateMediaSourceAVFObjC.h:
            (WebCore::CDMPrivateMediaSourceAVFObjC::CDMPrivateMediaSourceAVFObjC): Moved to implementation file.
            * platform/graphics/avfoundation/CDMPrivateMediaSourceAVFObjC.mm:
            (WebCore::validKeySystemRE): Support "com.apple.fps.3_x".
            (WebCore::CDMPrivateMediaSourceAVFObjC::~CDMPrivateMediaSourceAVFObjC): Invalidate all outstanding sessions.
            (WebCore::CDMPrivateMediaSourceAVFObjC::supportsKeySystem): Only support "com.apple.fps.3_x" if the AVContentKeySession class is available.
            (WebCore::CDMPrivateMediaSourceAVFObjC::createSession): Create an instance of CDMSessionAVContentKeySession if "com.apple.fps.3_x" is specified and AVContentKeySession is available.
            (WebCore::CDMPrivateMediaSourceAVFObjC::invalidateSession): Remove session from the list of outstanding sessions.
            (WebCore::CDMPrivateMediaSourceAVFObjC::supportsMIMEType): Deleted.
            * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.h: Copied from Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h.
            (WebCore::CDMSessionAVContentKeySession::hasContentKeySession): Simple accessor.
            (WebCore::toCDMSessionAVContentKeySession): Safe casting.
            * platform/graphics/avfoundation/objc/CDMSessionAVContentKeySession.mm: Added.
            (-[CDMSessionAVContentKeySessionDelegate initWithParent:]): Simple constructor.
            (-[CDMSessionAVContentKeySessionDelegate invalidate]): Remove reference to parent.
            (-[CDMSessionAVContentKeySessionDelegate contentKeySession:willProvideKeyRequestInitializationDataForTrackID:]): Pass to parent.
            (-[CDMSessionAVContentKeySessionDelegate contentKeySession:didProvideKeyRequestInitializationData:requestHandling:]): Ditto.
            (-[CDMSessionAVContentKeySessionDelegate contentKeySessionContentProtectionSessionIdentifierDidChange:]): Ditto.
            (WebCore::CDMSessionAVContentKeySession::CDMSessionAVContentKeySession): Create the delegate.
            (WebCore::CDMSessionAVContentKeySession::~CDMSessionAVContentKeySession): Invalidate the delegate and remove all parsers.
            (WebCore::CDMSessionAVContentKeySession::isAvailable): Return true if AVContentKeySession class is available.
            (WebCore::CDMSessionAVContentKeySession::generateKeyRequest): Support "keyrelease" message, setting of the certificate, and creating key request object. 
            (WebCore::CDMSessionAVContentKeySession::releaseKeys): Retrieve keys from storage location.
            (WebCore::isEqual): Compares a Uint8Array to a char*.
            (WebCore::CDMSessionAVContentKeySession::update): Support "acknowledged" message, "renew" message, and key addition.
            (WebCore::CDMSessionAVContentKeySession::addParser): Add the parser to the AVContentKeySession.
            (WebCore::CDMSessionAVContentKeySession::removeParser): Remove parser from same.
            (WebCore::CDMSessionAVContentKeySession::generateKeyReleaseMessage): Retrieve key release message from AVContentKeySession.
            (WebCore::CDMSessionAVContentKeySession::didProvideContentKeyRequest): Simple setter.
            (WebCore::CDMSessionAVContentKeySession::contentKeySession): Lazily create the AVContentKeySession.
            * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h:
            * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
            (WebCore::CDMSessionAVFoundationObjC::CDMSessionAVFoundationObjC):
            * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.h: Copied from Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h.
            (WebCore::toCDMSessionAVStreamSession):
            * platform/graphics/avfoundation/objc/CDMSessionAVStreamSession.mm: Copied from Source/WebCore/platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm.
            (-[CDMSessionAVStreamSessionObserver initWithParent:]): Moved from CDMSessionMediaSourceAVFObjcObserver.
            (-[CDMSessionAVStreamSessionObserver contentProtectionSessionIdentifierChanged:]): Ditto.
            (WebCore::CDMSessionAVStreamSession::CDMSessionAVStreamSession): Ditto.
            (WebCore::CDMSessionAVStreamSession::~CDMSessionAVStreamSession): Ditto.
            (WebCore::CDMSessionAVStreamSession::generateKeyRequest): Ditto.
            (WebCore::CDMSessionAVStreamSession::releaseKeys): Ditto.
            (WebCore::isEqual): Ditto.
            (WebCore::CDMSessionAVStreamSession::update): Ditto.
            (WebCore::CDMSessionAVStreamSession::setStreamSession): Ditto.
            (WebCore::CDMSessionAVStreamSession::addParser): Ditto.
            (WebCore::CDMSessionAVStreamSession::removeParser): Ditto.
            (WebCore::CDMSessionAVStreamSession::generateKeyReleaseMessage): Ditto.
            * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h:
            (WebCore::CDMSessionMediaSourceAVFObjC::invalidateCDM): Clear the m_cdm.
            (WebCore::toCDMSessionMediaSourceAVFObjC):
            * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
            (WebCore::CDMSessionMediaSourceAVFObjC::CDMSessionMediaSourceAVFObjC):
            (WebCore::CDMSessionMediaSourceAVFObjC::~CDMSessionMediaSourceAVFObjC): Instruct our CDM to invalidate their references to us.
            (WebCore::CDMSessionMediaSourceAVFObjC::addSourceBuffer): Call addParser().
            (WebCore::CDMSessionMediaSourceAVFObjC::removeSourceBuffer): Call removeParser().
            (WebCore::CDMSessionMediaSourceAVFObjC::layerDidReceiveError): Deleted.
            (WebCore::CDMSessionMediaSourceAVFObjC::rendererDidReceiveError): Deleted.

            To give us a chance to create a CDMPrivate before we continue decoding media data, "block" further decoding
            on the background thread by creating a semaphore and passing it to the main thread, to be triggered when
            a CDM is created and attached to this source buffer.

            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.h:
            * platform/graphics/avfoundation/objc/SourceBufferPrivateAVFObjC.mm:
            (-[WebAVStreamDataParserListener streamDataParser:didProvideContentKeyRequestInitializationData:forTrackID:]):
            (WebCore::SourceBufferPrivateAVFObjC::~SourceBufferPrivateAVFObjC):
            (WebCore::SourceBufferPrivateAVFObjC::willProvideContentKeyRequestInitializationDataForTrackID):
            (WebCore::SourceBufferPrivateAVFObjC::didProvideContentKeyRequestInitializationDataForTrackID):
            (WebCore::SourceBufferPrivateAVFObjC::setCDMSession):
            (-[WebAVStreamDataParserListener streamDataParserWillProvideContentKeyRequestInitializationData:forTrackID:]): Deleted.
            * platform/graphics/ca/cocoa/PlatformCALayerCocoa.mm:

            Drive-by fix: Only throw an error from keyRequestTimerFired() if the underlying call to
            generateKeyRequest() returned an error, rather than just failed to create a message.

            * Modules/encryptedmedia/MediaKeySession.cpp:
            (WebCore::MediaKeySession::keyRequestTimerFired):

            Drive-by fix: Pass the CDMSessionClient into CDM::createSession() so that it is immediately available
            in the CDMSessionPrivate constructor, rather than setting the client immediately after construction.

            * Modules/encryptedmedia/CDM.cpp:
            (WebCore::CDM::createSession):
            * Modules/encryptedmedia/CDM.h:
            * Modules/encryptedmedia/CDMPrivate.h:
            * Modules/encryptedmedia/CDMPrivateClearKey.cpp:
            (WebCore::CDMPrivateClearKey::createSession):
            * Modules/encryptedmedia/CDMPrivateClearKey.h:
            * Modules/encryptedmedia/CDMPrivateMediaPlayer.cpp:
            (WebCore::CDMPrivateMediaPlayer::createSession):
            * Modules/encryptedmedia/CDMPrivateMediaPlayer.h:
            * Modules/encryptedmedia/CDMSessionClearKey.cpp:
            (WebCore::CDMSessionClearKey::CDMSessionClearKey):
            * Modules/encryptedmedia/CDMSessionClearKey.h:
            * Modules/encryptedmedia/MediaKeySession.cpp:
            (WebCore::MediaKeySession::MediaKeySession):
            * platform/graphics/CDMSession.h:
            * platform/graphics/MediaPlayer.cpp:
            (WebCore::MediaPlayer::createSession):
            * platform/graphics/MediaPlayer.h:
            * platform/graphics/MediaPlayerPrivate.h:
            (WebCore::MediaPlayerPrivateInterface::createSession):
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.h:
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::createSession):
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.h:
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::cdmSession):
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateMediaSourceAVFObjC.mm:
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::setCDMSession):
            (WebCore::MediaPlayerPrivateMediaSourceAVFObjC::keyNeeded): Deleted.
            * testing/MockCDM.cpp:
            (WebCore::MockCDM::createSession):
            (WebCore::MockCDMSession::MockCDMSession):
            * testing/MockCDM.h:

            Add new files to the project:

            * WebCore.xcodeproj/project.pbxproj:

2015-12-05  Babak Shafiei  <bshafiei@apple.com>

        Merge r190202.

    2015-09-24  Gyuyoung Kim  <gyuyoung.kim@webkit.org>

            Reduce almost uses of PassRefPtr in Webcore/testing
            https://bugs.webkit.org/show_bug.cgi?id=149449

            Reviewed by Darin Adler.

            This patch removes all uses of PassRefPtr except for Internals::serializeObject() and Internals::deserializeObject().
            It will be removed by upcoming patch.

            * Modules/encryptedmedia/CDMSessionClearKey.cpp:
            (WebCore::CDMSessionClearKey::generateKeyRequest):
            * Modules/encryptedmedia/CDMSessionClearKey.h:
            * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
            (WebCore::jsTestOverrideBuiltinsPrototypeFunctionNamedItem):
            * platform/graphics/CDMSession.h:
            * platform/graphics/avfoundation/cf/CDMSessionAVFoundationCF.cpp:
            (WebCore::CDMSessionAVFoundationCF::generateKeyRequest):
            * platform/graphics/avfoundation/cf/CDMSessionAVFoundationCF.h:
            * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.h:
            * platform/graphics/avfoundation/objc/CDMSessionAVFoundationObjC.mm:
            (WebCore::CDMSessionAVFoundationObjC::generateKeyRequest):
            * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.h:
            * platform/graphics/avfoundation/objc/CDMSessionMediaSourceAVFObjC.mm:
            (WebCore::CDMSessionMediaSourceAVFObjC::generateKeyRequest):
            * testing/InternalSettings.h:
            (WebCore::InternalSettings::create):
            * testing/Internals.cpp:
            (WebCore::Internals::create):
            (WebCore::Internals::computedStyleIncludingVisitedInfo):
            (WebCore::Internals::markerRangeForNode):
            (WebCore::Internals::rangeFromLocationAndLength):
            (WebCore::Internals::subrange):
            (WebCore::Internals::nodesFromRect):
            (WebCore::Internals::mallocStatistics):
            (WebCore::Internals::typeConversions):
            (WebCore::Internals::memoryInfo):
            (WebCore::Internals::serializeObject):
            (WebCore::Internals::deserializeBuffer):
            (WebCore::Internals::createTimeRanges):
            * testing/Internals.h:
            * testing/MallocStatistics.h:
            (WebCore::MallocStatistics::create):
            * testing/MemoryInfo.h:
            (WebCore::MemoryInfo::create):
            * testing/MockCDM.cpp:
            (WebCore::MockCDMSession::generateKeyRequest):
            * testing/TypeConversions.h:
            (WebCore::TypeConversions::create):

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Rollout r193478. rdar://problem/23732400

2015-12-05  David Kilzer  <ddkilzer@apple.com>

        Merge r192129. rdar://problem/23732379

    2015-11-07  Michael Catanzaro  <mcatanzaro@igalia.com>

        Unreviewed, fix GTK build after r191981

        * html/HTMLFormControlElement.cpp:

2015-12-05  David Kilzer  <ddkilzer@apple.com>

        Merge r191981. rdar://problem/23732379

    2015-10-30  Jon Honeycutt  <jhoneycutt@apple.com>

        Implement support for the autocomplete attribute
        https://bugs.webkit.org/show_bug.cgi?id=150731
        rdar://problem/21078968

        The autocomplete attribute is defined by
        https://html.spec.whatwg.org/multipage/forms.html#autofill.

        Reviewed by Brent Fulgham.

        Test: fast/forms/autocomplete-tokens.html

        * html/HTMLFormControlElement.cpp:
        (WebCore::isContactToken):
        Return true if this is a contact token.
        (WebCore::categoryForAutofillFieldToken):
        Adds all of the autofill field tokens to a map, and returns the
        category for a given token.
        (WebCore::maxTokensForAutofillFieldCategory):
        Return the maximum number of tokens an autofill category supports.
        (WebCore::HTMLFormControlElement::parseAutocompleteAttribute):
        Implement the processing model defined in
        https://html.spec.whatwg.org/multipage/forms.html#processing-model-3
        with respect to the IDL-exposed autofill value.
        (WebCore::HTMLFormControlElement::setAutocomplete):
        Set the autocomplete attribute to the given string.

        * html/HTMLFormControlElement.h:
        Declare setAutocomplete() and autocomplete().

        * html/HTMLInputElement.idl:
        Remove the Reflect attribute. We now have custom processing for getting
        this attribute.

        * html/HTMLSelectElement.idl:
        Declare the autocomplete attribute.

        * html/HTMLTextAreaElement.idl:
        Ditto.

2015-12-05  Dana Burkart  <dburkart@apple.com>

        Merge r190564. rdar://problem/23769747

    2015-10-05  Myles C. Maxfield  <mmaxfield@apple.com>

            Unprefix -webkit-font-feature-settings
            https://bugs.webkit.org/show_bug.cgi?id=149722

            Reviewed by Sam Weinig.

            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::propertyValue):
            * css/CSSParser.cpp:
            (WebCore::CSSParser::parseValue):
            (WebCore::CSSParser::parseFontFeatureSettings):
            * css/CSSPropertyNames.in:
            * css/CSSValueKeywords.in:
            * css/StyleBuilderCustom.h:
            (WebCore::StyleBuilderCustom::applyInitialFontFeatureSettings):
            (WebCore::StyleBuilderCustom::applyInheritFontFeatureSettings):
            (WebCore::StyleBuilderCustom::applyInitialWebkitFontFeatureSettings): Deleted.
            (WebCore::StyleBuilderCustom::applyInheritWebkitFontFeatureSettings): Deleted.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r192953. rdar://problem/23581540

    2015-11-30  David Hyatt  <hyatt@apple.com>

            Implement the picture element.
            https://bugs.webkit.org/show_bug.cgi?id=116963

            Reviewed by Dean Jackson.

            Added fast/picture tests.

            * WebCore.xcodeproj/project.pbxproj:
            Add HTMLPictureElement.* to the project.

            * html/HTMLImageElement.cpp:
            (WebCore::HTMLImageElement::setBestFitURLAndDPRFromImageCandidate):
            Remove the CURRENT_SRC ifdef.

            (WebCore::HTMLImageElement::bestFitSourceFromPictureElement):
            New helper function that checks the <source> elements of a <picture> parent
            for the best match.

            (WebCore::HTMLImageElement::selectImageSource):
            Pull out the process of image selection into its own function so that this can
            be called from many places (to ensure that dynamic changes are reflected as elements
            get changed, added or removed).

            (WebCore::HTMLImageElement::parseAttribute):
            Call selectImageSource when attributes change.

            (WebCore::HTMLImageElement::insertedInto):
            If inserted into a picture element, make sure to update the source.

            * html/HTMLImageElement.h:
            (WebCore::HTMLImageElement::currentSrc):
            Remove the CURRENT_SRC ifdef.

            * html/HTMLImageElement.idl:
            Remove the CURRENT_SRC ifdef.

            * html/HTMLPictureElement.cpp: Added.
            (WebCore::HTMLPictureElement::HTMLPictureElement):
            (WebCore::HTMLPictureElement::create):
            (WebCore::HTMLPictureElement::sourcesChanged):
            * html/HTMLPictureElement.h: Added.
            The new picture element. Has a sourcesChanged() function that is invoked whenever anything
            about the <source> elements changes.

            * html/HTMLSourceElement.cpp:
            (WebCore::HTMLSourceElement::insertedInto):
            (WebCore::HTMLSourceElement::removedFrom):
            (WebCore::HTMLSourceElement::parseAttribute):
            Make sure to call sourcesChanged when new sources come and go or when attributes on
            source elements change.

            * html/HTMLSourceElement.h:
            Added parseAttribute function so we can see when attributes change that force us to
            do a dynamic update.

            * html/HTMLTagNames.in:
            Add the picture element.

            * html/parser/HTMLSrcsetParser.h:
            (WebCore::ImageCandidate::srcOrigin):
            (WebCore::ImageCandidate::isEmpty):
            Some helpers for picture parsing.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191252. rdar://problem/23772905

    2015-10-17  David Hyatt  <hyatt@apple.com>

            Implement the CSS4 'revert' keyword.
            https://bugs.webkit.org/show_bug.cgi?id=149702

            Reviewed by Simon Fraser.

            Added new tests in fast/css and fast/css/variables.

            * CMakeLists.txt:
            * WebCore.xcodeproj/project.pbxproj:
            Add CSSRevertValue to the project and makefiles.

            * css/CSSParser.cpp:
            (WebCore::parseKeywordValue):
            Make sure to handle "revert" in the keyword parsing path (along with inherit/initial/unset).

            (WebCore::CSSParser::parseValue):
            (WebCore::CSSParser::parseCustomPropertyDeclaration):
            At the parser level, "revert" is just like inherit/initial/unset and gets its own special
            singleton value, CSSRevertValue.

            * css/CSSRevertValue.cpp: Added.
            (WebCore::CSSRevertValue::customCSSText):
            * css/CSSRevertValue.h: Added.
            (WebCore::CSSRevertValue::create):
            (WebCore::CSSRevertValue::equals):
            (WebCore::CSSRevertValue::CSSRevertValue):
            This value is identical to the inherit/initial/unset values, i.e., its own special value
            that can be used to indicate a revert when doing style resolution.

            * css/CSSValue.cpp:
            (WebCore::CSSValue::cssValueType):
            (WebCore::CSSValue::equals):
            (WebCore::CSSValue::cssText):
            (WebCore::CSSValue::destroy):
            * css/CSSValue.h:
            (WebCore::CSSValue::isInheritedValue):
            (WebCore::CSSValue::isInitialValue):
            (WebCore::CSSValue::isUnsetValue):
            (WebCore::CSSValue::isRevertValue):
            Add the RevertClass to CSSValue and make sure it is handled in all the appropriate methods.

            * css/CSSValueKeywords.in:
            Add the "revert" keyword to the list of allowed CSS keywords.

            * css/CSSValuePool.cpp:
            (WebCore::CSSValuePool::CSSValuePool):
            * css/CSSValuePool.h:
            (WebCore::CSSValuePool::createRevertValue):
            Add support for a CSSRevertValue singleton, just like inherit/unset/initial.

            * css/FontLoader.cpp:
            (WebCore::FontLoader::resolveFontStyle):
            Add "unset" and "revert" as special keywords to be ignored. This code seems to be turned off,
            but patching it anyway.

            * css/SelectorChecker.h:
            Add a MatchDefault value of 0 to the LinkMatchMask. This enables it to be used as an index
            to the correct value in Property (in the style resolution code).

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::State::initForStyleResolve):
            Delete any lingering old CascadedProperty rollbacks for UA/user rules.

            (WebCore::StyleResolver::styleForKeyframe):
            (WebCore::StyleResolver::styleForPage):
            (WebCore::StyleResolver::applyMatchedProperties):
            Pass along the MatchResult as an additional parameter, since we need it to lazily compute
            the cascade rollbacks if the "revert" keyword is encountered.

            (WebCore::StyleResolver::cascadedPropertiesForRollback):
            This method will lazily create and return a new CascadedProperties pointer that is cached
            in the StyleResolver's state. This will contain only UA rules (for user reverts) and UA/user
            rules (for author reverts). These will only be computed at most once for a given element
            when doing a reversion, and they will be computed lazily, i.e., only if a revert is
            requested.

            (WebCore::StyleResolver::applyProperty):
            Pass along the LinkMatchMask and the MatchResult to applyProperty. This way we know specifically
            which link type we were computing if we have to revert (so that we roll back and look at the
            same index in the reverted version). The MatchResult is passed along because it is needed
            to build the CascadedProperties rollbacks.

            The basic idea is that if a revert is encountered, the level that the rule came from is
            checked. If it is UA level, just treat as "unset." If it is author or user level, get
            the correct CascadedProperties rollback and repeat the applyProperty using the property
            found in the rollback. If the property is not present in the cascade rollback, then the
            revert becomes an unset.

            (WebCore::StyleResolver::CascadedProperties::hasCustomProperty):
            (WebCore::StyleResolver::CascadedProperties::customProperty):
            Helpers used by applyProperty to check on custom properties, since they can revert too
            just like a regular property can.

            (WebCore::StyleResolver::CascadedProperties::setPropertyInternal):
            (WebCore::StyleResolver::CascadedProperties::set):
            (WebCore::StyleResolver::CascadedProperties::setDeferred):
            Passing along the CascadeLevel (UA, User, Author) so that it can be stored in the Property.
            This way when we do property application, we always know where the rule came from so
            that the reversion can be handled properly.

            (WebCore::StyleResolver::CascadedProperties::addStyleProperties):
            (WebCore::cascadeLevelForIndex):
            (WebCore::StyleResolver::CascadedProperties::addMatches):
            When style properties are added, also figure out the CascadeLevel and pass it along to be
            stored in the Property. We use the MatchResult's ranges to know where a property comes from.

            (WebCore::StyleResolver::CascadedProperties::applyDeferredProperties):
            (WebCore::StyleResolver::CascadedProperties::Property::apply):
            (WebCore::StyleResolver::applyCascadedProperties):
            Pass along the MatchResult so we know how to build the rollback.

            * css/StyleResolver.h:
            (WebCore::StyleResolver::State::cascadeLevel):
            (WebCore::StyleResolver::State::setCascadeLevel):
            (WebCore::StyleResolver::State::authorRollback):
            (WebCore::StyleResolver::State::userRollback):
            (WebCore::StyleResolver::State::setAuthorRollback):
            (WebCore::StyleResolver::State::setUserRollback):
            (WebCore::StyleResolver::state):
            (WebCore::StyleResolver::cascadeLevel):
            (WebCore::StyleResolver::setCascadeLevel):
            Move CascadedProperties into the header. Add CascadeLevel to Property. Add the level and
            rollbacks to the resolver's state.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191201. rdar://problem/23772907

    2015-10-16  David Hyatt  <hyatt@apple.com>

            ASSERT in imported/blink/fast/block/float/overhanging-float-crashes-when-sibling-becomes-formatting-context.html
            https://bugs.webkit.org/show_bug.cgi?id=150249

            Reviewed by Myles Maxfield.

            Covered by existing tests.

            * css/CSSValue.cpp:
            (WebCore::CSSValue::equals):
            Make sure the "unset" value has an equals implementation.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191178. rdar://problem/23772788

    2015-10-16  David Hyatt  <hyatt@apple.com>

            Implement the "all" CSS property.
            https://bugs.webkit.org/show_bug.cgi?id=116966

            Reviewed by Zalan Bujtas.

            Added new tests in fast/css.

            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::propertyValue):
            Don't support "all" from computed style for now.

            * css/CSSParser.cpp:
            (WebCore::CSSParser::parseValue):
            Make sure to bail after checking inherit/unset/initial for all, since you can't actually
            accept longhand values in the shorthand declarations.

            (WebCore::CSSParser::parseAnimationProperty):
            "all" for animations is a special value and should not be confused with the property. It
            animates everything and does not omit unicode-bidi/direction the way the "all" property does.

            * css/CSSPropertyNames.in:
            Add the "all" property to the list and use a special keyword in the Longhands value, "all",
            that makeprop.pl will look for. This way we don't have to dump every single CSS property
            into the Longhands expression, since that would be nuts.

            * css/StyleProperties.cpp:
            (WebCore::StyleProperties::getPropertyValue):
            Look for a common value across all properties supported by "all". That way you can get
            back inherit/initial/unset from it.

            * css/makeprop.pl:
            Make the perl script look for "all" in the longhand list, and if it sees it, put every
            single CSS property into the list for the all shorthand.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191155. rdar://problem/23772908

    2015-10-15  David Hyatt  <hyatt@apple.com>

            Patch parseKeywordValue to accept "unset" so that it goes down the faster parsing path.
            https://bugs.webkit.org/show_bug.cgi?id=150213

            Reviewed by Dean Jackson.

            No new tests as correctness doesn't change (just speed).

            * css/CSSParser.cpp:
            (WebCore::parseKeywordValue):

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191151. rdar://problem/23772904

    2015-10-15  David Hyatt  <hyatt@apple.com>

            Add support for the CSS 'unset' keyword.
            https://bugs.webkit.org/show_bug.cgi?id=148614

            Reviewed by Dean Jackson.

            Added new test in fast/css, and existing variables tests also use unset in several tests.

            * WebCore.xcodeproj/project.pbxproj:
            Add CSSUnsetValue.cpp to the project.

            * bindings/objc/DOMCSS.mm:
            (kitClass):
            Make sure UNSET is handled in the switch.

            * css/CSSParser.cpp:
            (WebCore::parseKeywordValue):
            (WebCore::CSSParser::parseValue):
            (WebCore::CSSParser::parseCustomPropertyDeclaration):
            Add cases to create a CSSUnsetValue properly.

            * css/CSSToStyleMap.cpp:
            (WebCore::CSSToStyleMap::styleImage):
            (WebCore::CSSToStyleMap::mapFillAttachment):
            (WebCore::CSSToStyleMap::mapFillClip):
            (WebCore::CSSToStyleMap::mapFillComposite):
            (WebCore::CSSToStyleMap::mapFillBlendMode):
            (WebCore::CSSToStyleMap::mapFillOrigin):
            (WebCore::CSSToStyleMap::mapFillImage):
            (WebCore::CSSToStyleMap::mapFillRepeatX):
            (WebCore::CSSToStyleMap::mapFillRepeatY):
            (WebCore::convertToLengthSize):
            (WebCore::CSSToStyleMap::mapFillSize):
            (WebCore::CSSToStyleMap::mapFillXPosition):
            (WebCore::CSSToStyleMap::mapFillYPosition):
            (WebCore::CSSToStyleMap::mapFillMaskSourceType):
            (WebCore::CSSToStyleMap::mapAnimationDelay):
            (WebCore::CSSToStyleMap::mapAnimationDirection):
            (WebCore::CSSToStyleMap::mapAnimationDuration):
            (WebCore::CSSToStyleMap::mapAnimationFillMode):
            (WebCore::CSSToStyleMap::mapAnimationIterationCount):
            (WebCore::CSSToStyleMap::mapAnimationName):
            (WebCore::CSSToStyleMap::mapAnimationPlayState):
            (WebCore::CSSToStyleMap::mapAnimationProperty):
            (WebCore::CSSToStyleMap::mapAnimationTimingFunction):
            (WebCore::CSSToStyleMap::mapAnimationTrigger):
            The background and animation functions need to check for unset and be able to map it properly to initial. This is done
            with a new treatAsInitial method on CSSValue that can take the property ID and check for both initial
            or unset on a non-inherited property.

            * css/CSSUnsetValue.cpp: Added.
            (WebCore::CSSUnsetValue::customCSSText):
            * css/CSSUnsetValue.h: Added.
            (WebCore::CSSUnsetValue::create):
            (WebCore::CSSUnsetValue::equals):
            (WebCore::CSSUnsetValue::CSSUnsetValue):
            This new value looks exactly like CSSInheritedValue and CSSInitialValue.

            * css/CSSValue.cpp:
            (WebCore::CSSValue::cssValueType):
            (WebCore::CSSValue::cssText):
            (WebCore::CSSValue::destroy):
            (WebCore::CSSValue::isInvalidCustomPropertyValue):
            (WebCore::CSSValue::treatAsInheritedValue):
            (WebCore::CSSValue::treatAsInitialValue):
            * css/CSSValue.h:
            (WebCore::CSSValue::isUnsetValue):
            Add isUnsetValue and the UnsetClass. Add support for treatAsInheritedValue and treatAsInitialValue to have
            a way to query for initial/inherit or the matching unset type.

            * css/CSSValueKeywords.in:
            Add the unset keyword.

            * css/CSSValuePool.cpp:
            (WebCore::CSSValuePool::CSSValuePool):
            * css/CSSValuePool.h:
            (WebCore::CSSValuePool::createUnsetValue):
            Have a singleton model for unset just like we do for inherit/initial.

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::applyProperty):
            Handle unset correctly. It maps to inherit for inherited properties and initial for non-inherited ones.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188130. rdar://problem/23769732

    2015-08-07  Myles C. Maxfield  <mmaxfield@apple.com>

            Allow FontCustomPlatformData to consult with FontDescription
            https://bugs.webkit.org/show_bug.cgi?id=147775

            Reviewed by Zalan Bujtas.

            In order to implement font-feature-settings, web fonts need to be
            able to consult with the set of active font features. Rather than
            add yet another argument to all the functions in this flow, this
            patch passes around a reference to the FontDescription itself instead
            of copies of constituent members of it.

            No new tests because there is no behavior change.

            * css/CSSFontFaceSource.cpp:
            (WebCore::CSSFontFaceSource::font):
            * loader/cache/CachedFont.cpp:
            (WebCore::CachedFont::createFont):
            (WebCore::CachedFont::platformDataFromCustomData):
            * loader/cache/CachedFont.h:
            * loader/cache/CachedSVGFont.cpp:
            (WebCore::CachedSVGFont::platformDataFromCustomData):
            * loader/cache/CachedSVGFont.h:
            * platform/graphics/cairo/FontCustomPlatformData.h:
            * platform/graphics/freetype/FontCustomPlatformDataFreeType.cpp:
            (WebCore::FontCustomPlatformData::fontPlatformData):
            * platform/graphics/freetype/FontPlatformData.h:
            * platform/graphics/freetype/FontPlatformDataFreeType.cpp:
            (WebCore::FontPlatformData::FontPlatformData):
            * platform/graphics/freetype/SimpleFontDataFreeType.cpp:
            (WebCore::Font::platformCreateScaledFont):
            * platform/graphics/mac/FontCustomPlatformData.cpp:
            (WebCore::FontCustomPlatformData::fontPlatformData):
            * platform/graphics/mac/FontCustomPlatformData.h:
            * platform/graphics/win/FontCustomPlatformData.cpp:
            (WebCore::FontCustomPlatformData::fontPlatformData):
            * platform/graphics/win/FontCustomPlatformData.h:

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187709. rdar://problem/23769732

    2015-07-31  Myles C. Maxfield  <mmaxfield@apple.com>

            Fix the build

            Unreviewed.

            * platform/graphics/mac/FontCacheMac.mm:
            (WebCore::lookupCTFont):

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190667. rdar://problem/23769584

    2015-10-06  Simon Fraser  <simon.fraser@apple.com>

            will-change should trigger stacking context based purely on properties
            https://bugs.webkit.org/show_bug.cgi?id=148068

            Reviewed by Zalan Bujtas.

            Previously, our will-change implementation didn't trigger stacking context
            on an inline if the will-change property didn't apply to inlines (like 'transform').
            However, this doesn't agree with the CSS-WG consensus (https://lists.w3.org/Archives/Public/www-style/2015Sep/0112.html).

            Change behavior to have stacking context creation behavior for will-change be
            identical for inlines and blocks.

            Test: fast/css/will-change/will-change-creates-stacking-context-inline.html

            * rendering/RenderInline.cpp:
            (WebCore::inFlowPositionedInlineAncestor):
            * rendering/RenderInline.h:
            (WebCore::RenderInline::willChangeCreatesStackingContext):
            * rendering/style/WillChangeData.cpp:
            (WebCore::propertyCreatesStackingContext):
            (WebCore::WillChangeData::addFeature):
            (WebCore::propertyCreatesStackingContextOnBoxesOnly): Deleted.
            * rendering/style/WillChangeData.h:
            (WebCore::WillChangeData::canCreateStackingContextOnInline): Deleted.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188604. rdar://problem/23769584

    2015-08-18  Simon Fraser  <simon.fraser@apple.com>

            will-change: backface-visibility should not cause stacking context
            https://bugs.webkit.org/show_bug.cgi?id=148091

            Reviewed by Zalan Bujtas.

            Take CSSPropertyWebkitBackfaceVisibility out of the list of properties that causes
            will-change to create stacking context, since no value of the property creates
            stacking.

            Move willChangeCreatesStackingContext() and shouldWillChangeCreateStackingContext()
            into RenderInline since it's only called from there.

            * rendering/RenderElement.cpp:
            (WebCore::RenderElement::shouldWillChangeCreateStackingContext): Deleted.
            * rendering/RenderElement.h:
            (WebCore::RenderElement::willChangeCreatesStackingContext): Deleted.
            * rendering/RenderInline.h:
            (WebCore::RenderInline::willChangeCreatesStackingContext):
            * rendering/style/WillChangeData.cpp:
            (WebCore::propertyCreatesStackingContext): Deleted.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188168. rdar://problem/23769732

    2015-08-07  Myles C. Maxfield  <mmaxfield@apple.com>

            Post-review comments on r188146
            https://bugs.webkit.org/show_bug.cgi?id=147793

            Reviewed by Daniel Bates.

            No new tests because there is no behavior change.

            * platform/graphics/FontCache.h:
            * platform/graphics/cocoa/FontCacheCoreText.cpp:
            (WebCore::appendTrueTypeFeature):
            (WebCore::appendOpenTypeFeature):
            (WebCore::applyFontFeatureSettings):
            * platform/graphics/ios/FontCacheIOS.mm:
            (WebCore::FontCache::getSystemFontFallbackForCharacters):
            (WebCore::FontCache::createFontPlatformData):
            * platform/graphics/mac/FontCacheMac.mm:
            (WebCore::fontWithFamily):
            (WebCore::FontCache::systemFallbackForCharacters):
            * platform/graphics/mac/FontCustomPlatformData.cpp:
            (WebCore::FontCustomPlatformData::fontPlatformData):
            * rendering/RenderThemeIOS.mm:
            (WebCore::RenderThemeIOS::updateCachedSystemFontDescription):

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188146. rdar://problem/23769732

    2015-08-07  Myles C. Maxfield  <mmaxfield@apple.com>

            Implement font-feature-settings
            https://bugs.webkit.org/show_bug.cgi?id=147722

            Reviewed by Simon Fraser.

            Fonts with features are simply modeled as new font objects. Font
            feature information is contained within FontDescription, and our
            caches are correctly sensitive to this information. Therefore,
            we just need to make our font lookup code honor the request to
            use certain features.

            This patch creates a file, FontCacheCoreText.cpp, which will be the
            new home of all shared OS X / iOS FontCache code. Over time, I will
            be moving more and more source into this file, until there is
            nothing left of FontCacheMac.mm and FontCacheIOS.mm. For now, the
            only function in this file is the code which applies font features.

            Test: css3/font-feature-settings-preinstalled-fonts.html

            * WebCore.xcodeproj/project.pbxproj: Add FontCacheCoreText.cpp.
            * platform/graphics/FontCache.h:
            * platform/graphics/cocoa/FontCacheCoreText.cpp: Added.
            (WebCore::appendTrueTypeFeature): What the name says.
            (WebCore::appendOpenTypeFeature): Ditto.
            (WebCore::applyFontFeatureSettings): Ditto.
            * platform/graphics/ios/FontCacheIOS.mm:
            (WebCore::FontCache::getSystemFontFallbackForCharacters): Call
            applyFontFeatureSettings().
            (WebCore::FontCache::createFontPlatformData): Ditto.
            * platform/graphics/mac/FontCacheMac.mm:
            (WebCore::fontWithFamily): Ditto.
            (WebCore::FontCache::systemFallbackForCharacters): Ditto.
            (WebCore::FontCache::createFontPlatformData): Ditto.
            * platform/graphics/mac/FontCustomPlatformData.cpp:
            (WebCore::FontCustomPlatformData::fontPlatformData): Ditto.
            * rendering/RenderThemeIOS.mm:
            (WebCore::RenderThemeIOS::updateCachedSystemFontDescription):
            Ditto.

2015-12-05  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187982. rdar://problem/23769732

    2015-08-05  Myles C. Maxfield  <mmaxfield@apple.com>

            [OS X] Migrate to CTFontCreateForCharactersWithLanguage from [NSFont findFontLike:forString:withRange:inLanguage]
            https://bugs.webkit.org/show_bug.cgi?id=147483

            Reviewed by Dean Jackson.

            [NSFont findFontLike:forString:withRange:inLanguage] doesn't properly handle its last argument. In
            addition, we want to be moving away from NSFont in the first place and on to Core Text. This new
            CoreText function correctly handles its language argument, which is required for language-specific
            font fallback.

            This patch rolls r187707 back in which was rolled out in r187802 due to test flakiness. This patch
            fixes the flakiness.

            No new tests because there is no behavior change.

            * platform/graphics/FontCache.cpp:
            (WebCore::FontCache::purgeInactiveFontData):
            * platform/graphics/FontCache.h:
            (WebCore::FontCache::platformPurgeInactiveFontData):
            * platform/graphics/mac/FontCacheMac.mm:
            (WebCore::fallbackDedupSet):
            (WebCore::FontCache::platformPurgeInactiveFontData):
            (WebCore::lookupCTFont):
            (WebCore::FontCache::systemFallbackForCharacters):
            * platform/spi/cocoa/CoreTextSPI.h:
            * platform/spi/mac/NSFontSPI.h:

2015-12-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191825. rdar://problem/23732363

    2015-10-30  Joseph Pecoraro  <pecoraro@apple.com>

            CSSParserVariable leaks seen on leaks bots
            https://bugs.webkit.org/show_bug.cgi?id=150724

            Reviewed by Darin Adler.

            * css/CSSParserValues.cpp:
            (WebCore::destroy):
            Cleanup variable CSSParserValues.

2015-12-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191128. rdar://problem/23732363

    2015-10-14  David Hyatt  <hyatt@apple.com>

            Implement CSS Variables.
            https://bugs.webkit.org/show_bug.cgi?id=19660

            Reviewed by Dean Jackson.

            Added new tests in fast/css/custom-properties and fast/css/variables.

            * CMakeLists.txt:
            * WebCore.xcodeproj/project.pbxproj:
            Add CSSVariableValue.cpp and CSSVariableDependentValue.cpp to builds.

            * css/CSSCalculationValue.cpp:
            (WebCore::hasDoubleValue):
            Handle the new CSS_PARSER_WHITESPACE value.

            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::customPropertyValue):
            Patched to make sure style is updated so that dynamic changes to custom properties are reflected
            immediately when querying values.

            (WebCore::CSSComputedStyleDeclaration::length):
            (WebCore::CSSComputedStyleDeclaration::item):
            The custom properties table is a reference and not a pointer now.

            * css/CSSCustomPropertyValue.h:
            (WebCore::CSSCustomPropertyValue::create):
            (WebCore::CSSCustomPropertyValue::createInvalid):
            (WebCore::CSSCustomPropertyValue::customCSSText):
            (WebCore::CSSCustomPropertyValue::equals):
            (WebCore::CSSCustomPropertyValue::isInvalid):
            (WebCore::CSSCustomPropertyValue::containsVariables):
            (WebCore::CSSCustomPropertyValue::value):
            (WebCore::CSSCustomPropertyValue::CSSCustomPropertyValue):
            The CSSCustomPropertyValue represents a custom property/value pair in the back end. It holds on
            to both the property name and a CSSValueList that has the original parser terms. This class also
            doubles as the invalid-at-compute-time value for custom properties when they contain cycles, etc.

            * css/CSSFunctionValue.cpp:
            (WebCore::CSSFunctionValue::buildParserValueSubstitutingVariables):
             * css/CSSFunctionValue.h:
            (WebCore::CSSFunctionValue::buildParserValueSubstitutingVariables):
            Hands back a CSSParserValue for a function with variables replaced with their real values (or fallback).

            * css/CSSGrammar.y.in:
            Many changes to support the var() syntax and to handle error conditions and cases.

            * css/CSSParser.cpp:
            (WebCore::filterProperties):
            Null check the value here. Shouldn't happen, but being paranoid.

            (WebCore::CSSParser::parseVariableDependentValue):
            This function converts a CSSValueList back into a CSSParserValueList and then passes
            it off to the parser. If the result parses, successfully, then the parsed CSSValue is handed back.

            (WebCore::CSSParser::parseValue):
            Detect when a property value contains variables and simply make a CSSVariableDependentValue to hold
            a copy of the parser value list (as a CSSValueList). We defer parsing the list until compute-time
            when we know the values of the variables to use.

            (WebCore::CSSParser::parseCustomPropertyDeclaration):
            Add support for inherit, initial and variable references in custom properties.

            (WebCore::CSSParser::detectFunctionTypeToken):
            Add support for detection of the "var" token.

            (WebCore::CSSParser::realLex):
            Fix the parsing of custom properties to allow "--" and to allow them to start with digits, e.g., "--0".

            * css/CSSParser.h:
            Add parseVariableDependentValue function for handling variable substitution and subsequent parsing
            of the resolved parser value list.

            * css/CSSParserValues.cpp:
            (WebCore::CSSParserValueList::containsVariables):
            Get rid of the toString() function (no longer needed) and replace it with containsVariables(). This
            check is used to figure out if a parser value list has variables and thus needs to defer parsing
            until later.

            (WebCore::CSSParserValue::createCSSValue):
            Add support for the creation of values for variables, CSSVariableValues.

            (WebCore::CSSParserValueList::toString): Deleted.
            No longer needed.

            * css/CSSParserValues.h:
            Add CSSParserVariable as a new kind of parser value. This represents a var() that is encountered
            during parsing. It is similar to a function except it has to hold both the reference (custom property name)
            and fallback arguments.

            * css/CSSPrimitiveValue.cpp:
            (WebCore::isValidCSSUnitTypeForDoubleConversion):
            (WebCore::CSSPrimitiveValue::cleanup):
            (WebCore::CSSPrimitiveValue::formatNumberForCustomCSSText):
            (WebCore::CSSPrimitiveValue::cloneForCSSOM):
            (WebCore::CSSPrimitiveValue::equals):
            Add support for CSS_PARSER_WHITESPACE as a way of preserving whitespace as a parsed item (variables can
            be only whitespace, and this has to be retained).

            (WebCore::CSSPrimitiveValue::buildParserValue):
            Conversion from a CSSPrimitiveValue back into a parser value is handled by this function.

            * css/CSSPrimitiveValue.h:
            (WebCore::CSSPrimitiveValue::isParserOperator):
            (WebCore::CSSPrimitiveValue::parserOperator):
            Add ability to get parser operator info. Add the buildParserValue declaration.

            * css/CSSValue.cpp:
            (WebCore::CSSValue::equals):
            (WebCore::CSSValue::cssText):
            (WebCore::CSSValue::destroy):
            (WebCore::CSSValue::cloneForCSSOM):
            (WebCore::CSSValue::isInvalidCustomPropertyValue):
            * css/CSSValue.h:
            Add support for variable values and variable dependent values.

            * css/CSSValueList.cpp:
            (WebCore::CSSValueList::customCSSText):
            Improve serialization to not output extra spaces when a comma operator is a value.

            (WebCore::CSSValueList::containsVariables):
            Whether or not a CSSVariableValue can be found somewhere within the list (or its descendants).

            (WebCore::CSSValueList::checkVariablesForCycles):
            Called to check variables for cycles.

            (WebCore::CSSValueList::buildParserValueSubstitutingVariables):
            (WebCore::CSSValueList::buildParserValueListSubstitutingVariables):
            Functions that handle converting the value list to a parser value list while making
            variable substitutions along the way.

            * css/CSSValueList.h:
            Add the new buildParserXXX functions.

            * css/CSSVariableDependentValue.cpp: Added.
            (WebCore::CSSVariableDependentValue::checkVariablesForCycles):
            * css/CSSVariableDependentValue.h: Added.
            (WebCore::CSSVariableDependentValue::create):
            (WebCore::CSSVariableDependentValue::customCSSText):
            (WebCore::CSSVariableDependentValue::equals):
            (WebCore::CSSVariableDependentValue::propertyID):
            (WebCore::CSSVariableDependentValue::valueList):
            (WebCore::CSSVariableDependentValue::CSSVariableDependentValue):
            This value represents a list of terms that have not had variables substituted yet. The list
            is held by the value so that it can be converted back into a parser value list once the
            variable values are known.

            * css/CSSVariableValue.cpp: Added.
            (WebCore::CSSVariableValue::CSSVariableValue):
            (WebCore::CSSVariableValue::customCSSText):
            (WebCore::CSSVariableValue::equals):
            (WebCore::CSSVariableValue::buildParserValueListSubstitutingVariables):
            * css/CSSVariableValue.h: Added.
            (WebCore::CSSVariableValue::create):
            (WebCore::CSSVariableValue::name):
            (WebCore::CSSVariableValue::fallbackArguments):
            This value represents a var() itself. It knows how to do the substitution of the variable
            value and to apply fallback if that value is not present.

            * css/StyleProperties.cpp:
            (WebCore::StyleProperties::getPropertyValue):
            (WebCore::StyleProperties::borderSpacingValue):
            (WebCore::StyleProperties::getLayeredShorthandValue):
            (WebCore::StyleProperties::getShorthandValue):
            (WebCore::StyleProperties::getCommonValue):
            (WebCore::StyleProperties::getPropertyCSSValue):
            (WebCore::StyleProperties::getPropertyCSSValueInternal):
            (WebCore::StyleProperties::asText):
            (WebCore::StyleProperties::copyPropertiesInSet):
            * css/StyleProperties.h:
            Patched to factor property fetching into an internal method so that variables can work with shorthands
            in the CSS OM.

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::applyProperty):
            Resolve variable values at compute time. If they fail to resolve, use inherit or initial as the
            value (depending on whether the property inherits by default).

            (WebCore::StyleResolver::resolvedVariableValue):
            Helper function that calls parseVariableDependentValue and gets the resolved result.

            (WebCore::StyleResolver::applyCascadedProperties):
            After custom properties have been collected, we check for cycles and perform variable substitutions.
            This way we get all the variables replaced before we inherit down the style tree.

            * css/StyleResolver.h:
            Add resolvedVariableValue declaration.

            * css/makeprop.pl:
            Make sure custom properties are inherited by default.

            * rendering/style/RenderStyle.cpp:
            (WebCore::RenderStyle::checkVariablesInCustomProperties):
            This function handles updating variables with cycles to be invalid in the RenderStyle. It then also
            handles the replacement of variables found in custom properties with resolved values. All custom
            properties are either invalid or are real non-variable-dependent value lists after this function
            completes.

            * rendering/style/RenderStyle.h:
            Add checkVariablesInCustomProperties declaration.

            * rendering/style/StyleCustomPropertyData.h:
            (WebCore::StyleCustomPropertyData::create):
            (WebCore::StyleCustomPropertyData::copy):
            (WebCore::StyleCustomPropertyData::operator==):
            (WebCore::StyleCustomPropertyData::operator!=):
            (WebCore::StyleCustomPropertyData::setCustomPropertyValue):
            (WebCore::StyleCustomPropertyData::getCustomPropertyValue):
            (WebCore::StyleCustomPropertyData::values):
            (WebCore::StyleCustomPropertyData::hasCustomProperty):
            (WebCore::StyleCustomPropertyData::containsVariables):
            (WebCore::StyleCustomPropertyData::setContainsVariables):
            (WebCore::StyleCustomPropertyData::StyleCustomPropertyData):
            Miscellaneous cleanup, and the addition of whether or not the properties still contain variable
            dependent values that need to be resolved.

2015-12-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190231. rdar://problem/23732363

    2015-09-24  David Hyatt  <hyatt@apple.com>

            Keep the already-parsed list of terms in custom property values so that we don't have to re-parse them
            later when doing variable resolution.
            https://bugs.webkit.org/show_bug.cgi?id=149544

            Reviewed by Dean Jackson.

            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::customPropertyValue):
            (WebCore::ComputedStyleExtractor::customPropertyText):
            Add a helper for getting the raw text. More closely parallels how non-custom properties work with the
            extractor.

            (WebCore::ComputedStyleExtractor::propertyValue):
            Change propertyValue to use customPropertyText.

            (WebCore::ComputedStyleExtractor::copyPropertiesInSet):
            Don't copy CSS custom properties into the style declaration. This is just used for things like editing, so
            we didn't need to be putting the custom properties into this set.

            (WebCore::CSSComputedStyleDeclaration::getPropertyValue):
            Patched to go straight to the serialized string value.

            (WebCore::ComputedStyleExtractor::customPropertyValue): Deleted.
            Replaced by customPropertyText.

            * css/CSSComputedStyleDeclaration.h:
            Rename customPropertyValue to customPropertyText and make it just return a String.

            * css/CSSCustomPropertyValue.h:
            (WebCore::CSSCustomPropertyValue::create):
            (WebCore::CSSCustomPropertyValue::customCSSText):
            (WebCore::CSSCustomPropertyValue::name):
            (WebCore::CSSCustomPropertyValue::equals):
            (WebCore::CSSCustomPropertyValue::CSSCustomPropertyValue):
            (WebCore::CSSCustomPropertyValue::value): Deleted.
            Changed to hold both a CSSParserValueList, which it adopts from the CSSParser, and a string value that
            is constructed lazily only if the value is serialized. Now the problematic serialization code will only
            run if someone uses the CSS OM to trigger a serialization (this should be a rare occurrence, so perf
            improves with this change).

            * css/CSSGrammar.y.in:
            Change parsing of custom properties to be identical to regular properties. This refactoring allows
            us to simply invoke the parser from style declarations as well and makes everything behave more
            similarly to normal property parsing.

            * css/CSSParser.cpp:
            (WebCore::CSSParser::parseValue):
            (WebCore::CSSParser::parseCustomPropertyValue):
            (WebCore::CSSParser::parseCustomPropertyDeclaration):
            (WebCore::CSSParser::addCustomPropertyDeclaration): Deleted.
            * css/CSSParser.h:
            (WebCore::CSSParser::setCustomPropertyName):
            We now have a method for parsing custom properties that can be invoked from style declarations. The
            parser list is now adopted by the CSSCustomPropertyValue.

            * css/CSSParserValues.cpp:
            (WebCore::CSSParserValueList::toString):
            Build the string serialization code right into CSSParserValueList.

            * css/CSSParserValues.h:
            Add a toString() method for serialization.

            * css/StyleProperties.cpp:
            (WebCore::MutableStyleProperties::setProperty):
            (WebCore::MutableStyleProperties::setCustomProperty):
            Changed to use the new CSSParser functions. This makes the code behave almost identically to regular
            property parsing.

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::applyProperty):
            * rendering/style/RenderStyle.h:
            * rendering/style/StyleCustomPropertyData.h:
            Change the mapping on RenderStyle to store the custom CSS values. This way we can get to the original
            parser lists for each variable when it comes time to do variable resolution.

2015-12-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190209. rdar://problem/23732363

    2015-09-24  David Hyatt  <hyatt@apple.com>

            Add support for CSS Custom Properties (in preparation for implementing CSS Variables).
            https://bugs.webkit.org/show_bug.cgi?id=130397

            Reviewed by Antti Koivisto.

            Added new tests in fast/css/custom-properties.

            * WebCore.xcodeproj/project.pbxproj:
            Add new header files to the project (CSSCustomPropertyValue and StyleCustomPropertyData).

            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::customPropertyValue):
            (WebCore::ComputedStyleExtractor::propertyValue):
            If a custom property value is queried (i.e., it starts with "--"), then we use our
            customPropertyValue lookup to go to the RenderStyle and fetch the appropriate custom property
            value from the StyleCustomPropertyData.

            (WebCore::CSSComputedStyleDeclaration::length):
            (WebCore::CSSComputedStyleDeclaration::item):
            Patched to include custom properties in the returned array. They appear at the end of the array
            after the built-in properties.

            (WebCore::ComputedStyleExtractor::propertyMatches):
            Patched to check custom properties.

            (WebCore::ComputedStyleExtractor::copyPropertiesInSet):
            Make sure the custom properties get copied into the StyleDeclaration.

            (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
            (WebCore::CSSComputedStyleDeclaration::getPropertyValue):
            Patched to call customPropertyValue for custom properties.

            * css/CSSComputedStyleDeclaration.h:
            Add customPropertyValue() to ComputedStyleExtractor.

            * css/CSSCustomPropertyValue.h: Added.
            (WebCore::CSSCustomPropertyValue::create):
            (WebCore::CSSCustomPropertyValue::equals):
            (WebCore::CSSCustomPropertyValue::customCSSText):
            (WebCore::CSSCustomPropertyValue::name):
            (WebCore::CSSCustomPropertyValue::value):
            (WebCore::CSSCustomPropertyValue::CSSCustomPropertyValue):
            Custom properties are parsed as a property with an ID of CSSPropertyCustom and a CSSCustomPropertyValue
            that holds both the name and the value of the property. Ultimately we might want to just ditch property IDs in
            favor of AtomicStrings for all properties, and then the need to special case custom properties would go
            away. For now, though, this is the way we work custom properties into the existing system.

            * css/CSSGrammar.y.in:
            Add a production for recognizing custom properties and storing them using a property ID of CSSPropertyCustom
            and a CSSCustomPropertyValue that has the name/value pair.

            * css/CSSParser.cpp:
            (WebCore::filterProperties):
            Patched to track seen custom properties and to handle them correctly.

            (WebCore::CSSParser::createStyleProperties):
            Pass in a seenCustomProperties table to ensure we bail when encountering the same custom property twice.

            (WebCore::CSSParser::addCustomPropertyDeclaration):
            Called from the grammar production to create the CSSCustomPropertyValue.

            (WebCore::isCustomPropertyIdentifier):
            Recognize the -- custom property during lexing.

            (WebCore::CSSParser::parseIdentifier):
            Patched to return a CUSTOM_PROPERTY token when a custom property is identified.

             * css/CSSParser.h:
            (WebCore::isCustomPropertyName):
            Add a helper function for asking if a property name is custom.

            * css/CSSValue.cpp:
            (WebCore::CSSValue::equals):
            (WebCore::CSSValue::cssText):
            (WebCore::CSSValue::destroy):
            * css/CSSValue.h:
            Patched to add support for CSSCustomPropertyValue.

            * css/PropertySetCSSStyleDeclaration.cpp:
            (WebCore::PropertySetCSSStyleDeclaration::getPropertyCSSValue):
            (WebCore::PropertySetCSSStyleDeclaration::getPropertyValue):
            (WebCore::PropertySetCSSStyleDeclaration::getPropertyPriority):
            (WebCore::PropertySetCSSStyleDeclaration::setProperty):
            (WebCore::PropertySetCSSStyleDeclaration::removeProperty):
            Add code for handling custom properties in the CSS OM.

            * css/StyleProperties.cpp:
            (WebCore::StyleProperties::getPropertyValue):
            (WebCore::StyleProperties::getCustomPropertyValue):
            (WebCore::StyleProperties::getPropertyCSSValue):
            (WebCore::StyleProperties::getCustomPropertyCSSValue):
            (WebCore::MutableStyleProperties::removeProperty):
            (WebCore::MutableStyleProperties::removeCustomProperty):
            (WebCore::StyleProperties::propertyIsImportant):
            (WebCore::StyleProperties::customPropertyIsImportant):
            (WebCore::MutableStyleProperties::setProperty):
            (WebCore::MutableStyleProperties::setCustomProperty):
            (WebCore::MutableStyleProperties::addParsedProperty):
            (WebCore::MutableStyleProperties::findPropertyIndex):
            (WebCore::ImmutableStyleProperties::findCustomPropertyIndex):
            (WebCore::MutableStyleProperties::findCustomPropertyIndex):
            (WebCore::MutableStyleProperties::findCSSPropertyWithID):
            (WebCore::MutableStyleProperties::findCustomCSSPropertyWithName):
            (WebCore::StyleProperties::propertyMatches):
            (WebCore::StyleProperties::PropertyReference::cssName):
            * css/StyleProperties.h:
            (WebCore::StyleProperties::findCustomPropertyIndex):
            Patched to support handling custom properties in the CSS OM. We have to create equivalent methods that operate
            on AtomicString propertyNames instead of on property IDs.

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::CascadedProperties::customProperties):
            (WebCore::StyleResolver::styleForKeyframe):
            (WebCore::StyleResolver::styleForPage):
            (WebCore::StyleResolver::applyMatchedProperties):
            (WebCore::StyleResolver::applyProperty):
            (WebCore::StyleResolver::CascadedProperties::set):
            (WebCore::StyleResolver::applyCascadedProperties):
            The resolver has to hold a HashMap from AtomicStrings to Properties. It matches identically to how built-in
            properties work except that an extensible table (HashMap) is used to hold the property data.

            * css/makeprop.pl:
            Patched to include the special CSSPropertyCustom value of 1 (just after the CSSPropertyInvalid id value but before the first
            built-in property value).

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyle::getText):
            (WebCore::lowercasePropertyName):
            (WebCore::InspectorStyle::populateAllProperties):
            Patch inspector to not lowercase CSS custom property names, since they are case-sensitive.

            * rendering/style/RenderStyle.h:
            * rendering/style/StyleCustomPropertyData.h: Added.
            (WebCore::StyleCustomPropertyData::create):
            (WebCore::StyleCustomPropertyData::copy):
            (WebCore::StyleCustomPropertyData::operator==):
            (WebCore::StyleCustomPropertyData::operator!=):
            (WebCore::StyleCustomPropertyData::setCustomPropertyValue):
            (WebCore::StyleCustomPropertyData::getCustomPropertyValue):
            (WebCore::StyleCustomPropertyData::hasCustomProperty):
            (WebCore::StyleCustomPropertyData::StyleCustomPropertyData):
            * rendering/style/StyleRareInheritedData.cpp:
            (WebCore::StyleRareInheritedData::StyleRareInheritedData):
            (WebCore::StyleRareInheritedData::operator==):
            * rendering/style/StyleRareInheritedData.h:
            The front end storage in the RenderStyle for custom properties. For now, custom properties are always inherited, so the
            data is in StyleRareInheritedData.

2015-12-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191452. rdar://problem/23732400

    2015-10-22  Wenson Hsieh  <wenson_hsieh@apple.com>

            Implement touch-action: manipulation; for iOS
            https://bugs.webkit.org/show_bug.cgi?id=149854
            <rdar://problem/23017145>

            Reviewed by Benjamin Poulain.

            Implements the manipulation value for the CSS property touch-action. Adds support for
            parsing the touch-action property and two of its values: auto and manipulation.

            Tests: css3/touch-action/touch-action-computed-style.html
                   css3/touch-action/touch-action-manipulation-fast-clicks.html
                   css3/touch-action/touch-action-parsing.html

            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::propertyValue):
            * css/CSSParser.cpp:
            (WebCore::isValidKeywordPropertyAndValue):
            (WebCore::isKeywordPropertyID):
            (WebCore::CSSParser::parseValue):
            * css/CSSPrimitiveValueMappings.h:
            (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
            (WebCore::CSSPrimitiveValue::operator TouchAction):
            * css/CSSPropertyNames.in:
            * css/CSSValueKeywords.in:
            * dom/Element.cpp:
            (WebCore::Element::allowsDoubleTapGesture): Here, we determine whether an element that resulted from
                hit-testing a touch should allow double-tap gestures. To do this, we walk up the element's parents,
                stopping when we detect an element that disallows double tap gestures by having a touch-action other
                than auto or by hitting the root node.
            * dom/Element.h:
            * dom/Node.h:
            (WebCore::Node::allowsDoubleTapGesture):
            * rendering/style/RenderStyle.h:
            * rendering/style/RenderStyleConstants.h:
            * rendering/style/StyleRareNonInheritedData.cpp:
            (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
            (WebCore::StyleRareNonInheritedData::operator==):
            * rendering/style/StyleRareNonInheritedData.h:

2015-12-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190595. rdar://problem/23732402

    2015-10-05  Dean Jackson  <dino@apple.com>

            EXT_texture_filter_anisotropic extension exposed with WEBKIT_ prefix
            https://bugs.webkit.org/show_bug.cgi?id=149765
            <rdar://problem/22983722>

            Reviewed by Beth Dakin.

            We can now remove the WEBKIT_ prefix from this extension.

            Test: fast/canvas/webgl/unprefixed-anisotropic-extension.html

            * html/canvas/WebGL2RenderingContext.cpp: Support the prefixed and unprefixed form.
            (WebCore::WebGL2RenderingContext::getExtension):
            * html/canvas/WebGLRenderingContext.cpp:
            (WebCore::WebGLRenderingContext::getExtension):
            (WebCore::WebGLRenderingContext::getSupportedExtensions):

2015-12-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190446. rdar://problem/23732367

    2015-10-01  Dean Jackson  <dino@apple.com>

            Expose WEBGL_debug_renderer_info
            https://bugs.webkit.org/show_bug.cgi?id=149735
            <rdar://problem/18343500>

            Reviewed by Simon Fraser.

            Enable the extension that allows content to query
            for the GPUs vendor and details.

            Now that we're enabling this, there was no need for
            the internal setting that identified privileged situations.
            However, since this meant that WEBGL_debug_shaders was
            also exposed, I explicitly disable it since it is
            not yet conformant.

            Test: fast/canvas/webgl/webgl-debug-renderer-info.html
            as well as the general conformance suite.

            * html/canvas/WebGL2RenderingContext.cpp: No need to guard around allowPrivilegedExtensions().
            (WebCore::WebGL2RenderingContext::getExtension):
            (WebCore::WebGL2RenderingContext::getSupportedExtensions):
            * html/canvas/WebGLRenderingContext.cpp: Ditto.
            (WebCore::WebGLRenderingContext::getExtension):
            (WebCore::WebGLRenderingContext::getSupportedExtensions):
            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::allowPrivilegedExtensions): Deleted.
            * html/canvas/WebGLRenderingContextBase.h:
            * page/Settings.in: Remove privilegedWebGLExtensions.
            * platform/graphics/opengl/Extensions3DOpenGL.cpp: Forbid the translated shader
            extension while it is still buggy.
            (WebCore::Extensions3DOpenGL::supportsExtension):

2015-12-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188647. rdar://problem/23732386

    2015-08-18  Dean Jackson  <dino@apple.com>

            Support CSS filters without webkit prefix
            https://bugs.webkit.org/show_bug.cgi?id=148138
            <rdar://problem/22331434>

            Reviewed by Sam Weinig.

            Add support for the un-prefixed form of the CSS filter property.
            This was straightforward for the general case on HTML content.
            It was a bit more tricky on SVG content, where there already
            was an existing "filter" property/attribute. The parsing
            code is now shared between SVG and HTML, as is the
            computed style output.

            Covered by updating the existing tests, and
            adding one new test: css3/filters/unprefixed.html

            * css/CSSComputedStyleDeclaration.cpp: Rename CSSPropertyWebkitFilter to CSSPropertyFilter.
            (WebCore::isLayoutDependent):
            (WebCore::ComputedStyleExtractor::propertyValue):

            * css/CSSFilterImageValue.cpp:
            (WebCore::CSSFilterImageValue::customCSSText): Use "filter(" as the prefix.

            * css/CSSParser.cpp:
            (WebCore::CSSParser::parseValue): Rename CSSPropertyWebkitFilter to CSSPropertyFilter.
            (WebCore::CSSParser::isGeneratedImageValue): Add support for "filter()".
            (WebCore::CSSParser::parseGeneratedImage): Ditto.
            (WebCore::CSSParser::parseBuiltinFilterArguments):

            * css/CSSPropertyNames.in: Add filter. Make -webkit-filter an alias.

            * css/SVGCSSComputedStyleDeclaration.cpp:
            (WebCore::ComputedStyleExtractor::svgPropertyValue): Deleted.

            * page/animation/CSSPropertyAnimation.cpp: Rename CSSPropertyWebkitFilter to CSSPropertyFilter.
            (WebCore::PropertyWrapperAcceleratedFilter::PropertyWrapperAcceleratedFilter):
            * page/animation/KeyframeAnimation.cpp: Ditto.
            (WebCore::KeyframeAnimation::checkForMatchingFilterFunctionLists):

            * platform/graphics/GraphicsLayer.cpp: Rename AnimatedPropertyWebkitFilter to AnimatedPropertyFilter.
            (WebCore::GraphicsLayer::validateFilterOperations):
            * platform/graphics/GraphicsLayerClient.h: Ditto.
            * platform/graphics/ca/GraphicsLayerCA.cpp: Ditto.
            (WebCore::GraphicsLayerCA::moveOrCopyAnimations):
            (WebCore::GraphicsLayerCA::addAnimation):
            (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
            (WebCore::GraphicsLayerCA::createFilterAnimationsFromKeyframes):

            * rendering/RenderLayer.cpp:
            (WebCore::RenderLayer::updateOrRemoveFilterClients): SVG manages its own filter resources,
            so we shouldn't add a layer that has an SVG root to the filter clients.

            * rendering/RenderLayerBacking.cpp: Renaming.
            (WebCore::RenderLayerBacking::startAnimation):
            (WebCore::RenderLayerBacking::startTransition):
            (WebCore::RenderLayerBacking::graphicsLayerToCSSProperty):
            (WebCore::RenderLayerBacking::cssToGraphicsLayerProperty):
            * rendering/RenderLayerCompositor.cpp: Ditto.
            (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):

            * rendering/style/SVGRenderStyle.h: Remove the SVG filter style.
            (WebCore::SVGRenderStyle::isolatesBlending): No need to check for hasFilter().
            (WebCore::SVGRenderStyle::initialFilterResource): Deleted.
            (WebCore::SVGRenderStyle::setFilterResource): Deleted.
            (WebCore::SVGRenderStyle::filterResource): Deleted.
            (WebCore::SVGRenderStyle::hasFilter): Deleted.

            * rendering/style/SVGRenderStyleDefs.cpp: Remove the filter resource.
            (WebCore::StyleResourceData::StyleResourceData): Deleted.
            (WebCore::StyleResourceData::operator==): Deleted.
            * rendering/style/SVGRenderStyleDefs.h:

            * rendering/style/WillChangeData.cpp: Renaming.
            (WebCore::propertyCreatesStackingContext):
            (WebCore::propertyTriggersCompositing):

            * rendering/svg/SVGRenderSupport.cpp:
            (WebCore::SVGRenderSupport::isolatesBlending): Since SVGRenderStyle no longer checks
            hasFilter() in its isolatesBlending(), we need to do it here.

            * rendering/svg/SVGRenderingContext.cpp:
            (WebCore::SVGRenderingContext::prepareToRenderSVGContent):

            * rendering/svg/SVGRenderTreeAsText.cpp:
            (WebCore::writeResources): Dump from the CSS style value.
            * rendering/svg/SVGResources.cpp: Ditto.
            (WebCore::SVGResources::buildCachedResources):
            * rendering/svg/SVGResources.h:
            * rendering/svg/SVGResourcesCache.cpp:
            (WebCore::SVGResourcesCache::addResourcesFromRenderer):

            * platform/graphics/texmap/TextureMapperLayer.cpp: Renaming.
            * platform/graphics/texmap/TextureMapperAnimation.cpp:
            * platform/graphics/texmap/coordinated/CoordinatedGraphicsLayer.cpp:

2015-12-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188530. rdar://problem/23732374

    2015-08-17  Simon Fraser  <simon.fraser@apple.com>

            will-change should sometimes trigger compositing
            https://bugs.webkit.org/show_bug.cgi?id=148072

            Reviewed by Tim Horton.

            Implement the compositing side-effects of will-change, if any of the
            following properties are specified:
                opacity
                filter (as -webkit-filter)
                backdrop-filter (as -webkit-backdrop-filter)
                transform (on transformable elements only)

            Tests: compositing/layer-creation/will-change-change.html
                   compositing/layer-creation/will-change-layer-creation.html

            * inspector/InspectorLayerTreeAgent.cpp:
            (WebCore::InspectorLayerTreeAgent::reasonsForCompositingLayer): Tell the inspector
            about will-change.
            * rendering/RenderElement.cpp:
            (WebCore::RenderElement::adjustStyleDifference): Need to trigger a recomposite if
            will-change includes a compositing trigger property. This gets called before and
            after setting the style, so this checks both states.
            (WebCore::RenderElement::shouldWillChangeCreateStackingContext):
            * rendering/RenderElement.h:
            (WebCore::RenderElement::willChangeCreatesStackingContext): Helper function that
            RenderInline uses to determine if it needs to create a RenderLayer, since RenderInline
            doesn't get automatic layer RenderLayers as a side effect of having non-auto z-index
            in the style.
            * rendering/RenderInline.h: Need to trigger a RenderLayer if will-change includes
            a property that applies to inlines.
            * rendering/RenderLayerCompositor.cpp:
            (WebCore::RenderLayerCompositor::requiresCompositingLayer): Call requiresCompositingForWillChange().
            (WebCore::RenderLayerCompositor::requiresOwnBackingStore): Call requiresCompositingForWillChange().
            (WebCore::RenderLayerCompositor::reasonsForCompositing): Include requiresCompositingForWillChange().
            (WebCore::RenderLayerCompositor::requiresCompositingForWillChange): If will-change contains a
            property that would trigger compositing on this element, return true.
            * rendering/RenderLayerCompositor.h:
            * rendering/style/RenderStyle.cpp:
            (WebCore::RenderStyle::changeRequiresLayout): Set ContextSensitivePropertyWillChange in
            changedContextSensitiveProperties if will-change changes.
            * rendering/style/RenderStyle.h: Rename for clarity.
            * rendering/style/RenderStyleConstants.h: Add ContextSensitivePropertyWillChange.
            * rendering/style/WillChangeData.cpp:
            (WebCore::propertyCreatesStackingContext): Subset of properties that create stacking
            context on any element.
            (WebCore::propertyCreatesStackingContextOnBoxesOnly): Additional properties that
            create stacking context on boxes.
            (WebCore::propertyTriggersCompositing): Properties that trigger compositing on
            any element.
            (WebCore::propertyTriggersCompositingOnBoxesOnly): Additional properties that
            trigger compositing on boxes.
            (WebCore::WillChangeData::addFeature): As features are added, manage a set of
            flags to know if they trigger stacking context or compositing, on inlines and boxes.
            (WebCore::WillChangeData::createsStackingContext): Deleted.
            * rendering/style/WillChangeData.h:
            (WebCore::WillChangeData::canCreateStackingContext):
            (WebCore::WillChangeData::canCreateStackingContextOnInline):
            (WebCore::WillChangeData::canTriggerCompositing):
            (WebCore::WillChangeData::canTriggerCompositingOnInline):

2015-12-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188514. rdar://problem/23732374

    2015-08-15  Simon Fraser  <simon.fraser@apple.com>

            Have will-change create stacking context when necessary
            https://bugs.webkit.org/show_bug.cgi?id=148060

            Reviewed by Zalan Bujtas.

            If will-change includes a property whose non-initial value can create
            stacking context, create stacking context for that element.

            Test: fast/css/will-change/will-change-creates-stacking-context.html

            * css/StyleResolver.cpp:
            (WebCore::StyleResolver::adjustRenderStyle):
            * rendering/style/RenderStyle.h: Add willChangeCreatesStackingContext(),
            which on most cases is a fast, inlined 'return false'. Otherwise ask
            the WillChangeData.
            * rendering/style/WillChangeData.cpp:
            (WebCore::propertyCreatesStackingContext):
            (WebCore::WillChangeData::createsStackingContext):
            * rendering/style/WillChangeData.h:

2015-12-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188512. rdar://problem/23732374

    2015-08-14  Simon Fraser  <simon.fraser@apple.com>

            Implement parsing for CSS will-change
            https://bugs.webkit.org/show_bug.cgi?id=148052

            Reviewed by Dean Jackson.

            Syntax is
                will-change: auto | <animateable-feature>#
            where
                <animateable-feature> = scroll-position | contents | <custom-ident>

            To support this, add WillChangeData which stores a vector of "feature"
            and CSS property squished into 16 bits. This is stored in rareNonInheritedData.
            If null or an empty list, the property value is 'auto'. The list preserves
            unknown properties.

            Test: fast/css/will-change-parsing.html

            * CMakeLists.txt:
            * WebCore.vcxproj/WebCore.vcxproj:
            * WebCore.vcxproj/WebCore.vcxproj.filters:
            * WebCore.xcodeproj/project.pbxproj:
            * css/CSSComputedStyleDeclaration.cpp:
            (WebCore::getWillChangePropertyValue):
            (WebCore::ComputedStyleExtractor::propertyValue):
            * css/CSSParser.cpp:
            (WebCore::CSSParser::parseValue):
            (WebCore::isValidGridPositionCustomIdent): Renamed from isValidCustomIdent(),
            since it's grid-specific.
            (WebCore::CSSParser::parseIntegerOrCustomIdentFromGridPosition):
            (WebCore::valueIsCSSKeyword): Returns true for the "CSS-wide" keywords like
            "initial", "inherit" and "default".
            (WebCore::CSSParser::parseFontFamily):
            (WebCore::isValidWillChangeAnimatableFeature):
            (WebCore::CSSParser::parseWillChange):
            (WebCore::isValidCustomIdent): Deleted.
            * css/CSSParser.h:
            * css/CSSPrimitiveValue.h:
            (WebCore::CSSPrimitiveValue::isPropertyID): New utility function.
            * css/CSSPropertyNames.in:
            * css/CSSValueKeywords.in:
            * css/StyleBuilderCustom.h:
            (WebCore::StyleBuilderCustom::applyValueWillChange):
            * rendering/style/RenderStyle.cpp:
            (WebCore::RenderStyle::setWillChange):
            * rendering/style/RenderStyle.h:
            * rendering/style/StyleAllInOne.cpp:
            * rendering/style/StyleRareNonInheritedData.cpp:
            (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
            (WebCore::StyleRareNonInheritedData::operator==):
            (WebCore::StyleRareNonInheritedData::willChangeDataEquivalent):
            * rendering/style/StyleRareNonInheritedData.h:
            * rendering/style/WillChangeData.cpp: Added.
            (WebCore::WillChangeData::operator==):
            (WebCore::WillChangeData::containsScrollPosition):
            (WebCore::WillChangeData::containsContents):
            (WebCore::WillChangeData::containsProperty):
            (WebCore::WillChangeData::addFeature):
            (WebCore::WillChangeData::featureAt):
            * rendering/style/WillChangeData.h: Added.
            (WebCore::WillChangeData::create):
            (WebCore::WillChangeData::operator!=):
            (WebCore::WillChangeData::isAuto):
            (WebCore::WillChangeData::numFeatures):
            (WebCore::WillChangeData::WillChangeData):
            (WebCore::WillChangeData::AnimatableFeature::feature):
            (WebCore::WillChangeData::AnimatableFeature::property):
            (WebCore::WillChangeData::AnimatableFeature::featurePropertyPair):
            (WebCore::WillChangeData::AnimatableFeature::AnimatableFeature):
            (WebCore::WillChangeData::AnimatableFeature::operator==):

2015-12-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190383. rdar://problem/23732393

    2015-09-30  Katlyn Graff  <kgraff@apple.com>

            Add support for the imageSmoothingQuality property for CanvasRenderingContext2D.
            https://bugs.webkit.org/show_bug.cgi?id=149541

            Reviewed by Ryosuke Niwa.

            As documented here: https://html.spec.whatwg.org/multipage/scripting.html#image-smoothing
            Exposes the smooothing quality of algorithms used for scaling images. Valid input
            values are low, medium, and high: associated algorithms are expected to vary for
            differing hardware. setImageSmoothingQuality provides a handle into CGInterpolationQuality.

            Test: fast/canvas/canvas-imageSmoothingQuality.html

            * html/canvas/CanvasRenderingContext2D.cpp:
            (WebCore::CanvasRenderingContext2D::State::State):
            (WebCore::CanvasRenderingContext2D::State::operator=):
            (WebCore::smoothingToInterpolationQuality):
            (WebCore::CanvasRenderingContext2D::imageSmoothingQuality):
            (WebCore::CanvasRenderingContext2D::setImageSmoothingQuality):
            (WebCore::CanvasRenderingContext2D::setImageSmoothingEnabled):
            * html/canvas/CanvasRenderingContext2D.h:
            * html/canvas/CanvasRenderingContext2D.idl:

2015-12-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r189427. rdar://problem/23732393

    2015-09-04  Myles C. Maxfield  <mmaxfield@apple.com>

            Rename members of CanvasRenderingContext2D::State
            https://bugs.webkit.org/show_bug.cgi?id=148889

            Reviewed by Tim Horton.

            CanvasRenderingContext2D::State is a struct, so its members should not start with m_.

            No new tests because there is no behavior change.

            * html/canvas/CanvasRenderingContext2D.cpp:
            (WebCore::CanvasRenderingContext2D::State::State):
            (WebCore::CanvasRenderingContext2D::State::operator=):
            (WebCore::CanvasRenderingContext2D::restore):
            (WebCore::CanvasRenderingContext2D::setStrokeStyle):
            (WebCore::CanvasRenderingContext2D::setFillStyle):
            (WebCore::CanvasRenderingContext2D::lineWidth):
            (WebCore::CanvasRenderingContext2D::setLineWidth):
            (WebCore::CanvasRenderingContext2D::lineCap):
            (WebCore::CanvasRenderingContext2D::setLineCap):
            (WebCore::CanvasRenderingContext2D::lineJoin):
            (WebCore::CanvasRenderingContext2D::setLineJoin):
            (WebCore::CanvasRenderingContext2D::miterLimit):
            (WebCore::CanvasRenderingContext2D::setMiterLimit):
            (WebCore::CanvasRenderingContext2D::shadowOffsetX):
            (WebCore::CanvasRenderingContext2D::setShadowOffsetX):
            (WebCore::CanvasRenderingContext2D::shadowOffsetY):
            (WebCore::CanvasRenderingContext2D::setShadowOffsetY):
            (WebCore::CanvasRenderingContext2D::shadowBlur):
            (WebCore::CanvasRenderingContext2D::setShadowBlur):
            (WebCore::CanvasRenderingContext2D::shadowColor):
            (WebCore::CanvasRenderingContext2D::setShadowColor):
            (WebCore::CanvasRenderingContext2D::getLineDash):
            (WebCore::CanvasRenderingContext2D::setLineDash):
            (WebCore::CanvasRenderingContext2D::setWebkitLineDash):
            (WebCore::CanvasRenderingContext2D::lineDashOffset):
            (WebCore::CanvasRenderingContext2D::setLineDashOffset):
            (WebCore::CanvasRenderingContext2D::applyLineDash):
            (WebCore::CanvasRenderingContext2D::globalAlpha):
            (WebCore::CanvasRenderingContext2D::setGlobalAlpha):
            (WebCore::CanvasRenderingContext2D::globalCompositeOperation):
            (WebCore::CanvasRenderingContext2D::setGlobalCompositeOperation):
            (WebCore::CanvasRenderingContext2D::scale):
            (WebCore::CanvasRenderingContext2D::rotate):
            (WebCore::CanvasRenderingContext2D::translate):
            (WebCore::CanvasRenderingContext2D::transform):
            (WebCore::CanvasRenderingContext2D::setTransform):
            (WebCore::CanvasRenderingContext2D::setStrokeColor):
            (WebCore::CanvasRenderingContext2D::setFillColor):
            (WebCore::CanvasRenderingContext2D::fillInternal):
            (WebCore::CanvasRenderingContext2D::strokeInternal):
            (WebCore::CanvasRenderingContext2D::clipInternal):
            (WebCore::CanvasRenderingContext2D::isPointInPathInternal):
            (WebCore::CanvasRenderingContext2D::isPointInStrokeInternal):
            (WebCore::CanvasRenderingContext2D::clearRect):
            (WebCore::CanvasRenderingContext2D::fillRect):
            (WebCore::CanvasRenderingContext2D::strokeRect):
            (WebCore::CanvasRenderingContext2D::setShadow):
            (WebCore::CanvasRenderingContext2D::applyShadow):
            (WebCore::CanvasRenderingContext2D::shouldDrawShadows):
            (WebCore::CanvasRenderingContext2D::drawImage):
            (WebCore::CanvasRenderingContext2D::transformAreaToDevice):
            (WebCore::CanvasRenderingContext2D::rectContainsCanvas):
            (WebCore::CanvasRenderingContext2D::compositeBuffer):
            (WebCore::CanvasRenderingContext2D::didDraw):
            (WebCore::CanvasRenderingContext2D::drawFocusIfNeededInternal):
            (WebCore::CanvasRenderingContext2D::font):
            (WebCore::CanvasRenderingContext2D::setFont):
            (WebCore::CanvasRenderingContext2D::textAlign):
            (WebCore::CanvasRenderingContext2D::setTextAlign):
            (WebCore::CanvasRenderingContext2D::textBaseline):
            (WebCore::CanvasRenderingContext2D::setTextBaseline):
            (WebCore::CanvasRenderingContext2D::direction):
            (WebCore::CanvasRenderingContext2D::setDirection):
            (WebCore::CanvasRenderingContext2D::drawTextInternal):
            (WebCore::CanvasRenderingContext2D::inflateStrokeRect):
            (WebCore::CanvasRenderingContext2D::imageSmoothingEnabled):
            (WebCore::CanvasRenderingContext2D::setImageSmoothingEnabled):
            * html/canvas/CanvasRenderingContext2D.h:

2015-12-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188194. rdar://problem/23732393

    2015-08-08  Dean Jackson  <dino@apple.com>

            Remove the webkit prefix from CanvasRenderingContext2D imageSmoothingEnabled
            https://bugs.webkit.org/show_bug.cgi?id=147803
            <rdar://problem/22200553>

            Reviewed by Sam Weinig.

            Rename webkitImageSmoothingEnabled to imageSmoothingEnabled.

            Updated existing tests, and made sure that the prefixed version is
            identical to the standard version.

            * html/canvas/CanvasRenderingContext2D.cpp:
            (WebCore::CanvasRenderingContext2D::imageSmoothingEnabled): Renamed from webkitImageSmoothingEnabled.
            (WebCore::CanvasRenderingContext2D::setImageSmoothingEnabled): Renamed from setWebkitImageSmoothingEnabled.
            (WebCore::CanvasRenderingContext2D::webkitImageSmoothingEnabled): Deleted.
            (WebCore::CanvasRenderingContext2D::setWebkitImageSmoothingEnabled): Deleted.
            * html/canvas/CanvasRenderingContext2D.h: Rename the methods.
            * html/canvas/CanvasRenderingContext2D.idl: Add the non-prefixed form, and mark is as the
            implementation of the prefixed form.

2015-12-03  Timothy Hatcher  <timothy@apple.com>

        Merge r192592. rdar://problem/23221163

    2015-11-18  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Client Blocked Resource Requests causes Crash under InspectorPageAgent::cachedResource
            https://bugs.webkit.org/show_bug.cgi?id=151398

            Reviewed by Brian Burg.

            Test: inspector/network/client-blocked-load.html

            * inspector/InspectorPageAgent.cpp:
            (WebCore::InspectorPageAgent::cachedResource):
            Gracefully handle null request.

            * loader/cache/CachedResourceLoader.cpp:
            (WebCore::CachedResourceLoader::cachedResource):
            ASSERT if someone tried to pass a null URL.

2015-12-03  Timothy Hatcher  <timothy@apple.com>

        Merge r192585. rdar://problem/23221163

    2015-11-18  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Timeline Recording across page navigations behaves poorly
            https://bugs.webkit.org/show_bug.cgi?id=151112

            Reviewed by Timothy Hatcher.

            * inspector/InspectorPageAgent.cpp:
            (WebCore::InspectorPageAgent::frameStartedLoading): Deleted.
            Don't reset the execution stopwatch on page navigation.
            If a timeline is actively being recorded on the frontend
            then all new timestamps suddenly downshifted towards zero
            introduces bad data.

2015-12-03  Timothy Hatcher  <timothy@apple.com>

        Merge r188222. rdar://problem/23221163

    2015-08-10  Devin Rousso  <drousso@apple.com>

            Web Inspector: Invalid selectors can be applied to the stylesheet
            https://bugs.webkit.org/show_bug.cgi?id=147230

            Reviewed by Timothy Hatcher.

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::isValidSelectorListString):
            (WebCore::InspectorStyleSheet::setRuleSelector):
            Now checks to see that the supplied selector is valid before trying to commit it to the rule.
            (WebCore::InspectorStyleSheet::addRule):
            (WebCore::checkStyleRuleSelector): Deleted.

2015-12-03  Timothy Hatcher  <timothy@apple.com>

        Merge r186891. rdar://problem/23221163

    2015-07-16  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: update $$() to return an Array
            https://bugs.webkit.org/show_bug.cgi?id=146964

            Reviewed by Brian Burg.

            Test: inspector/console/command-line-api.html

            * inspector/CommandLineAPIModuleSource.js:
            Update $$(...) to return an array.
            Also InjectedScriptHost.type was renamed to subtype
            a while ago.

2015-12-03  Timothy Hatcher  <timothy@apple.com>

        Merge r192745. rdar://problem/23221163

    2015-11-23  Brian Burg  <bburg@apple.com>

            Web Inspector: when inspecting the inspector, add the inspection level to the title bar
            https://bugs.webkit.org/show_bug.cgi?id=151555

            Reviewed by Timothy Hatcher.

            * English.lproj/Localizable.strings: add new localized string for alternate inspector title.

2015-12-03  Timothy Hatcher  <timothy@apple.com>

        Merge r192662. rdar://problem/23221163

    2015-11-19  Brian Burg  <bburg@apple.com>

            Web Inspector: yank/kill shortcuts (CTRL+Y, K) don't work in Console / QuickConsole
            https://bugs.webkit.org/show_bug.cgi?id=151157

            Reviewed by Joseph Pecoraro.

            CodeMirror maintains its own editor buffer and implements its own
            `killLine` command but doesn't implement the yank command. So, text
            that is "killed" with CTRL-k inside a CodeMirror instance isn't
            added to Editor's kill ring. Subsequent yank commands won't match
            up with the killed text, instead returning text from a prior kill
            that was handled by Editor (i.e., in a contenteditable or form input).

            This patch adds a host function so that the Inspector frontend can
            append "missed" killed text to Editor's kill ring. Subsequent
            yanks handled by Editor will then match the text killed by CodeMirror.

            No new tests, because we need to use both InspectorFrontendHost
            and TestRunner.execCommand, but the latter is not available in
            the inspector context where we would need to simulate a kill.

            * inspector/InspectorFrontendHost.cpp:
            (WebCore::InspectorFrontendHost::killText):

                Added. This appends the killed text to the kill ring, starting
                a new sequence if necessary. Unlike Editor, Inspector waits
                until the next kill command to clear the existing sequence.

            * inspector/InspectorFrontendHost.h:
            * inspector/InspectorFrontendHost.idl:

2015-12-03  Timothy Hatcher  <timothy@apple.com>

        Merge r192641. rdar://problem/23221163

    2015-11-19  Brian Burg  <bburg@apple.com>

            REGRESSION(r8780): Backwards delete by word incorrectly appends deleted text to kill ring, should be prepend
            https://bugs.webkit.org/show_bug.cgi?id=151300

            Reviewed by Darin Adler.

            Over 11 years ago, someone was in a big hurry to fix a bunch
            of emacs keybindings bugs, and accidentally regressed the kill ring
            behavior for backwards-delete-word. It should prepend to the beginning.

            This patch fixes the regression and cleans up the kill ring-related
            code in Editor and commands. It also adds some tests to cover the
            regressed code a bit better.

            Tests: editing/pasteboard/emacs-killring-alternating-append-prepend.html
                   editing/pasteboard/emacs-killring-backward-delete-prepend.html

            * editing/Editor.cpp:

                Use more explicit names for insertion mode parameters and member variables.

            (WebCore::Editor::deleteWithDirection):
            (WebCore::Editor::performDelete):
            (WebCore::Editor::addRangeToKillRing):
            (WebCore::Editor::addTextToKillRing):

                Only one call site for now, but another will be added in a dependent fix.

            (WebCore::Editor::addToKillRing): Deleted.
            * editing/Editor.h:
            * editing/TypingCommand.cpp:
            (WebCore::TypingCommand::TypingCommand):
            (WebCore::TypingCommand::deleteKeyPressed):
            (WebCore::TypingCommand::forwardDeleteKeyPressed):
            (WebCore::TypingCommand::doApply):
            * editing/TypingCommand.h:
            * platform/mac/KillRingMac.mm:
            (WebCore::KillRing::append):
            (WebCore::KillRing::prepend):

                It turns out that the native API implicitly clears the kill sequence when
                alternating between prepend and append operations. Its behavior does not match
                what Sublime Text or Emacs do in this case. Clear the previous operation flag
                to prevent this behavior from happening.

2015-12-02  Timothy Hatcher  <timothy@apple.com>

        Merge r191967. rdar://problem/23221163

    2015-11-03  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Handle or Remove ParseHTML Timeline Event Records
            https://bugs.webkit.org/show_bug.cgi?id=150689

            Reviewed by Timothy Hatcher.

            Remove ParseHTML nesting recordings. We were not using them
            and for most pages their self-time is very small in comparison
            to other events. We may consider adding it back later for
            UI purposes but for now the frontend doesn't use the records
            so lets remove it.

            * html/parser/HTMLDocumentParser.cpp:
            (WebCore::HTMLDocumentParser::pumpTokenizer): Deleted.
            * inspector/InspectorInstrumentation.cpp:
            (WebCore::InspectorInstrumentation::willWriteHTMLImpl): Deleted.
            (WebCore::InspectorInstrumentation::didWriteHTMLImpl): Deleted.
            * inspector/InspectorInstrumentation.h:
            (WebCore::InspectorInstrumentation::willWriteHTML): Deleted.
            (WebCore::InspectorInstrumentation::didWriteHTML): Deleted.
            * inspector/InspectorTimelineAgent.cpp:
            (WebCore::InspectorTimelineAgent::willWriteHTML): Deleted.
            (WebCore::InspectorTimelineAgent::didWriteHTML): Deleted.
            (WebCore::toProtocol): Deleted.
            * inspector/InspectorTimelineAgent.h:
            * inspector/TimelineRecordFactory.cpp:
            (WebCore::TimelineRecordFactory::createParseHTMLData): Deleted.
            * inspector/TimelineRecordFactory.h:

2015-12-02  Timothy Hatcher  <timothy@apple.com>

        Merge r191732. rdar://problem/23221163

    2015-10-29  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Clean up and audit TimelineRecordFactory records
            https://bugs.webkit.org/show_bug.cgi?id=150660

            Reviewed by Brian Burg.

            Cleanup included removing unused methods and payload data that the
            frontend wasn't likely to use. Also added ASCIILiteral and removed
            unnecessary includes.

            * inspector/InspectorNetworkAgent.cpp:
            * inspector/InspectorPageAgent.cpp:
            * inspector/InspectorTimelineAgent.cpp:
            (WebCore::InspectorTimelineAgent::willLayout):
            * inspector/InspectorTimelineAgent.h:
            * inspector/TimelineRecordFactory.cpp:
            (WebCore::TimelineRecordFactory::createGenericRecord):
            (WebCore::TimelineRecordFactory::createFunctionCallData):
            (WebCore::TimelineRecordFactory::createConsoleProfileData):
            (WebCore::TimelineRecordFactory::createEventDispatchData):
            (WebCore::TimelineRecordFactory::createGenericTimerData):
            (WebCore::TimelineRecordFactory::createTimerInstallData):
            (WebCore::TimelineRecordFactory::createEvaluateScriptData):
            (WebCore::TimelineRecordFactory::createTimeStampData):
            (WebCore::TimelineRecordFactory::createParseHTMLData):
            (WebCore::TimelineRecordFactory::createAnimationFrameData):
            (WebCore::TimelineRecordFactory::createPaintData):
            (WebCore::TimelineRecordFactory::appendLayoutRoot):
            (WebCore::TimelineRecordFactory::createBackgroundRecord): Deleted.
            (WebCore::TimelineRecordFactory::createLayoutData): Deleted.
            * inspector/TimelineRecordFactory.h:
            (WebCore::TimelineRecordFactory::TimelineRecordFactory):

2015-12-02  Timothy Hatcher  <timothy@apple.com>

        Merge r191651. rdar://problem/23221163

    2015-10-27  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Remove Timeline MarkDOMContent and MarkLoad, data is already available
            https://bugs.webkit.org/show_bug.cgi?id=150615

            Reviewed by Timothy Hatcher.

            The timestamp only event data is already available from `Page.domContentEventFired`
            and `Page.loadEventFired` events. We can drop the Timeline specific events in
            favor of these which have existed for a very long time (before iOS 7).

            * inspector/InspectorInstrumentation.cpp:
            (WebCore::InspectorInstrumentation::loadEventFiredImpl):
            (WebCore::InspectorInstrumentation::domContentLoadedEventFiredImpl): Deleted.
            * inspector/InspectorTimelineAgent.cpp:
            (WebCore::InspectorTimelineAgent::didMarkDOMContentEvent): Deleted.
            (WebCore::InspectorTimelineAgent::didMarkLoadEvent): Deleted.
            (WebCore::toProtocol): Deleted.
            * inspector/InspectorTimelineAgent.h:
            * inspector/TimelineRecordFactory.cpp:
            (WebCore::TimelineRecordFactory::createMarkData): Deleted.
            * inspector/TimelineRecordFactory.h:

2015-12-02  Timothy Hatcher  <timothy@apple.com>

        Merge r190416. rdar://problem/23221163

    2015-09-30  João Oliveira  <hello@jxs.pt>

            Web Inspector: Adjust font size of Developer Tools using Command,+ or Command,-
            https://bugs.webkit.org/show_bug.cgi?id=149590

            Reviewed by Joseph Pecoraro.

            Patch by João Oliveira and Brian Burg.

            Expose the frontend page's zoom factor so we can implement relative zoom.

            * inspector/InspectorFrontendHost.cpp:
            (WebCore::InspectorFrontendHost::zoomFactor): Added.
            * inspector/InspectorFrontendHost.h:
            * inspector/InspectorFrontendHost.idl:
            * page/Frame.h:
            (WebCore::Frame::pageZoomFactor):

2015-12-02  Timothy Hatcher  <timothy@apple.com>

        Merge r189883. rdar://problem/23221163

    2015-09-16  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Fix common typo "supress" => "suppress"
            https://bugs.webkit.org/show_bug.cgi?id=149199

            Reviewed by Gyuyoung Kim.

            * html/shadow/ContentDistributor.h:
            (WebCore::ContentDistributor::needsDistribution):
            * page/ContentSecurityPolicy.cpp:
            (WebCore::ContentSecurityPolicy::reportViolation):
            * platform/NotImplemented.h:
            * platform/graphics/ca/win/LayerChangesFlusher.cpp:
            (WebCore::LayerChangesFlusher::hookCallback):
            * platform/mac/HIDGamepadProvider.cpp:
            (WebCore::HIDGamepadProvider::deviceRemoved):
            * platform/win/makesafeseh.asm:

2015-12-02  Timothy Hatcher  <timothy@apple.com>

        Merge r189104. rdar://problem/23221163

    2015-08-28  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Separate creating a style sheet from adding a new rule in the protocol
            https://bugs.webkit.org/show_bug.cgi?id=148502

            Reviewed by Timothy Hatcher.

            Tests: inspector/css/createStyleSheet.html
                   inspector/css/manager-preferredInspectorStyleSheetForFrame.html

            * inspector/InspectorCSSAgent.h:
            Allow for multiple inspector style sheets per document.

            * inspector/InspectorCSSAgent.cpp:
            (WebCore::InspectorCSSAgent::createStyleSheet):
            (WebCore::InspectorCSSAgent::createInspectorStyleSheetForDocument): Added.
            (WebCore::InspectorCSSAgent::viaInspectorStyleSheet): Deleted.
            Extract and generalize creating a via-inspector stylesheet here.

            (WebCore::InspectorCSSAgent::addRule):
            Lookup stylesheet to add a rule to via the provided stylesheet id.

            (WebCore::InspectorCSSAgent::bindStyleSheet):
            (WebCore::InspectorCSSAgent::detectOrigin):
            Update to account for a list of stylesheets per document instead of one.

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::addRule):
            (WebCore::InspectorStyleSheetForInlineStyle::setStyleText):

2015-12-02  Timothy Hatcher  <timothy@apple.com>

        Merge r189002. rdar://problem/23221163

    2015-08-26  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Implement tracking of active stylesheets in the frontend
            https://bugs.webkit.org/show_bug.cgi?id=105828

            Reviewed by Timothy Hatcher.

            Tests: inspector/css/stylesheet-events-basic.html
                   inspector/css/stylesheet-events-imports.html
                   inspector/css/stylesheet-events-inspector-stylesheet.html

            * inspector/InspectorInstrumentation.cpp:
            (WebCore::InspectorInstrumentation::documentDetachedImpl):
            (WebCore::InspectorInstrumentation::activeStyleSheetsUpdatedImpl):
            * inspector/InspectorInstrumentation.h:
            (WebCore::InspectorInstrumentation::documentDetached):
            (WebCore::InspectorInstrumentation::activeStyleSheetsUpdated):
            New hooks for when a document is detached or a document's style sheets are updated.

            * dom/Document.cpp:
            (WebCore::Document::prepareForDestruction):
            Inform the inspector so the CSSAgent can remove document related data.

            * dom/DocumentStyleSheetCollection.h:
            * dom/DocumentStyleSheetCollection.cpp:
            (WebCore::DocumentStyleSheetCollection::updateActiveStyleSheets):
            Inform the inspector so the CSSAgent can push stylesheet related events.

            (WebCore::DocumentStyleSheetCollection::activeStyleSheetsForInspector): Added.
            CSSStyleSheets for the inspector include non-disabled author stylesheets
            even if they are empty.

            * inspector/InspectorCSSAgent.h:
            * inspector/InspectorCSSAgent.cpp:
            (WebCore::InspectorCSSAgent::reset):
            (WebCore::InspectorCSSAgent::documentDetached):
            Handling for the new list of known document to CSSStyleSheets map.

            (WebCore::InspectorCSSAgent::enable):
            When the CSS domain is enabled, tell the frontend about known stylesheets.

            (WebCore::InspectorCSSAgent::activeStyleSheetsUpdated):
            (WebCore::InspectorCSSAgent::setActiveStyleSheetsForDocument):
            Diff the old list of known stylesheets to the new list of stylesheets
            for an individual document. Then send appropriate added/removed events.

            (WebCore::InspectorCSSAgent::collectAllStyleSheets):
            (WebCore::InspectorCSSAgent::collectAllDocumentStyleSheets):
            (WebCore::InspectorCSSAgent::collectStyleSheets):
            Collect stylesheets recursively. A stylesheet may link to other stylesheets
            through @import statements.

            (WebCore::InspectorCSSAgent::getAllStyleSheets):
            Use the new methods, this command should go away as it will no longer be useful.

            (WebCore::InspectorCSSAgent::unbindStyleSheet):
            (WebCore::InspectorCSSAgent::bindStyleSheet):
            Create an InspectorStyleSheet from a CSSStyleSheet and add to the appropriate lists.
            Likewise, unbinding will remove from the appropriate lists.

            (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
            (WebCore::InspectorCSSAgent::detectOrigin):
            When creating the inspector stylesheet, which is a <style> element,
            it will push a StyleSheetAdded event. In the process of binding this
            new stylesheet use the m_creatingViaInspectorStyleSheet to add it to
            out list of Inspector Stylesheets.

2015-12-02  Timothy Hatcher  <timothy@apple.com>

        Merge r188631. rdar://problem/23221163

    2015-08-18  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Links for rules in <style> are incorrect, do not account for <style> offset in the document
            https://bugs.webkit.org/show_bug.cgi?id=148141

            Reviewed by Brian Burg.

            Test: inspector/css/getAllStyleSheets.html

            * css/CSSStyleSheet.h:
            * css/CSSStyleSheet.cpp:
            (WebCore::CSSStyleSheet::create):
            (WebCore::CSSStyleSheet::createInline):
            (WebCore::CSSStyleSheet::CSSStyleSheet):
            Include the starting position when created by the Parser.
            Default to the minimum position, which should never be
            possible for an inline <style> because the "<style>" characters
            themselves require at least some offset.

            * dom/InlineStyleSheetOwner.cpp:
            (WebCore::InlineStyleSheetOwner::createSheet):
            Provide the start position offset for this stylesheet if it was inline.

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::buildObjectForStyleSheetInfo):
            Include new protocol values for the style sheet.

2015-12-01  Timothy Hatcher  <timothy@apple.com>

        Merge r187496. rdar://problem/23221163

    2015-07-28  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Show Pseudo Elements in DOM Tree
            https://bugs.webkit.org/show_bug.cgi?id=139612

            Reviewed by Timothy Hatcher.

            Tests: inspector/css/pseudo-element-matches-for-pseudo-element-node.html
                   inspector/dom/pseudo-element-dynamic.html
                   inspector/dom/pseudo-element-static.html

            Much of this patch was modelled after the Blink implementation of
            pseudo element inspection.

            * dom/PseudoElement.h:
            * dom/PseudoElement.cpp:
            (WebCore::PseudoElement::~PseudoElement):
            (WebCore::PseudoElement::clearHostElement):
            Since InspectorDOMAgent may hold a reference to this PseudoElement we
            can't report it as destroyed in the destructor, as that wouldn't be
            reached if the inspector holds a reference. Move this to when the
            psuedo element is disconnected, which is immediately before destruction.

            * inspector/InspectorCSSAgent.h:
            * inspector/InspectorCSSAgent.cpp:
            (WebCore::InspectorCSSAgent::getMatchedStylesForNode):
            When computing styles for a pseudo element, compute styles from the
            host element for just the pseudo element's pseudo type. Likewise
            only include matched results, not inherited or others.

            (WebCore::InspectorCSSAgent::buildArrayForMatchedRuleList):
            Add the pseudo type to the checker context to try and detect exactly
            which selector in a list of selectors matched the pseudo element.

            * inspector/InspectorDOMAgent.h:
            * inspector/InspectorDOMAgent.cpp:
            (WebCore::InspectorDOMAgent::unbind):
            When unbinding an element, also unbind any pseudo element children
            it may have had and bound.

            (WebCore::InspectorDOMAgent::assertEditableNode):
            (WebCore::InspectorDOMAgent::assertEditableElement):
            (WebCore::InspectorDOMAgent::removeNode):
            Improve grammar in error message. Don't allow editing pseudo elements.

            (WebCore::pseudoElementType):
            (WebCore::InspectorDOMAgent::buildObjectForNode):
            (WebCore::InspectorDOMAgent::buildArrayForPseudoElements):
            If a node is a pseudo element include its pseudoType.
            If a node has pseudo element children include them.

            (WebCore::InspectorDOMAgent::pseudoElementCreated):
            (WebCore::InspectorDOMAgent::pseudoElementDestroyed):
            When pseudo elements are dynamically created or destroyed
            push pseudo element nodes to the frontend if needed.

            * inspector/InspectorInstrumentation.cpp:
            (WebCore::InspectorInstrumentation::pseudoElementCreatedImpl):
            (WebCore::InspectorInstrumentation::pseudoElementDestroyedImpl):
            * inspector/InspectorInstrumentation.h:
            (WebCore::InspectorInstrumentation::pseudoElementCreated):
            (WebCore::InspectorInstrumentation::pseudoElementDestroyed):
            (WebCore::InspectorInstrumentation::layerTreeDidChange):
            (WebCore::InspectorInstrumentation::renderLayerDestroyed):
            Plumbing for pseudo element created/destroyed events.

            * style/StyleResolveTree.cpp:
            (WebCore::Style::attachBeforeOrAfterPseudoElementIfNeeded):
            This is the only place a pseudo element is created, inform the inspector.

            * inspector/InspectorOverlay.cpp:
            (WebCore::buildObjectForElementData):
            Update the element data for the node highlight label to include the
            host element's selector and the pseudo element selector.

2015-12-01  Timothy Hatcher  <timothy@apple.com>

        Merge r187249. rdar://problem/23221163

    2015-07-23  Devin Rousso  <drousso@apple.com>

            Web Inspector: Add a function to CSSCompletions to get a list of supported system fonts
            https://bugs.webkit.org/show_bug.cgi?id=147009

            Reviewed by Joseph Pecoraro.

            Test: inspector/css/get-system-fonts.html

            * inspector/InspectorCSSAgent.cpp:
            (WebCore::InspectorCSSAgent::getSupportedSystemFontFamilyNames):
            Gets the list of system fonts (implemented in each platform) and returns that list.
            * inspector/InspectorCSSAgent.h:
            * platform/graphics/FontCache.h:
            * platform/graphics/freetype/FontCacheFreeType.cpp:
            (WebCore::FontCache::systemFontFamilies):
            * platform/graphics/ios/FontCacheIOS.mm:
            (WebCore::FontCache::systemFontFamilies):
            * platform/graphics/mac/FontCacheMac.mm:
            (WebCore::FontCache::systemFontFamilies):
            * platform/graphics/win/FontCacheWin.cpp:
            (WebCore::FontCache::systemFontFamilies):

2015-12-01  Timothy Hatcher  <timothy@apple.com>

        Merge r187211. rdar://problem/23221163

    2015-07-22  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Timeline should immediately start moving play head when starting a new recording
            https://bugs.webkit.org/show_bug.cgi?id=147210

            Reviewed by Timothy Hatcher.

            Test: inspector/timeline/recording-start-stop-timestamps.html

            * inspector/InspectorTimelineAgent.cpp:
            (WebCore::InspectorTimelineAgent::internalStart):
            (WebCore::InspectorTimelineAgent::internalStop):
            Include the current timestamp when starting / stopping a recording.

2015-12-01  Timothy Hatcher  <timothy@apple.com>

        Merge r186724. rdar://problem/23221163

    2015-07-11  Nikita Vasilyev  <nvasilyev@apple.com>

            Web Inspector: Inspector should be able to be docked to the bottom of a narrow window
            https://bugs.webkit.org/show_bug.cgi?id=146871

            Reviewed by Timothy Hatcher.

            * inspector/InspectorFrontendClientLocal.cpp:

2015-12-01  Dana Burkart  <dburkart@apple.com>

        Merge r192758. rdar://problem/23581476

    2015-11-23  David Kilzer  <ddkilzer@apple.com>

            Hardening against CSSSelector double frees
            <http://webkit.org/b/56124>
            <rdar://problem/9119036>

            Reviewed by Antti Koivisto.

            Add some security assertions to catch this issue if it ever
            happens in Debug builds, and make changes in
            CSSSelector::~CSSSelector() and
            CSSSelectorList::deleteSelectors() to prevent obvious issues if
            they're ever called twice in Release builds.

            No new tests because we don't know how to reproduce this.

            * css/CSSSelector.cpp:
            (WebCore::CSSSelector::CSSSelector): Initialize
            m_destructorHasBeenCalled.
            * css/CSSSelector.h:
            (WebCore::CSSSelector::m_destructorHasBeenCalled): Add bitfield.
            (WebCore::CSSSelector::CSSSelector): Initialize
            m_destructorHasBeenCalled.
            (WebCore::CSSSelector::~CSSSelector): Add security assertion
            that this is never called twice.  Clear out any fields that
            would have caused us to dereference an object twice.

            * css/CSSSelectorList.cpp:
            (WebCore::CSSSelectorList::deleteSelectors): Clear
            m_selectorArray when freeing the memory to which it was
            pointing.  This prevents re-entrancy issues or calling this
            method twice on the same thread.  Also restructure the for()
            loop to prevent calling CSSSelector::isLastInSelectorList()
            after CSSSelector::~CSSSelector() has been called (via CRBug
            241892).

2015-10-29  Babak Shafiei  <bshafiei@apple.com>

        Merge r191756.

    2015-10-29  Simon Fraser  <simon.fraser@apple.com>

            Very slow typing on pages with wheel event handlers on the body, and deep content
            https://bugs.webkit.org/show_bug.cgi?id=150692
            rdar://problem/23242631

            Reviewed by Zalan Bujtas.

            On a large page with a wheel event handler on the body, we would call
            Element::absoluteEventHandlerBounds() for every element under the body,
            and compute an absolute bounds for each one. This is very slow.

            For now, optimize computing a region for the <body> by just using the document
            bounds, which will always be as big or larger. It's OK for this region to
            be an overestimate.

            * dom/Document.cpp:
            (WebCore::Document::absoluteRegionForEventTargets):

2015-10-29  Lucas Forschler  <lforschler@apple.com>

        Merge r191706. rdar://problem/23319292

    2015-10-28  Andy Estes  <aestes@apple.com>

            [Content Filtering] Crash when allowing a 0-byte resource to load
            https://bugs.webkit.org/show_bug.cgi?id=150644
            <rdar://problem/23288538>

            Reviewed by Darin Adler.

            Test: contentfiltering/allow-empty-document.html

            * loader/ContentFilter.cpp:
            (WebCore::ContentFilter::deliverResourceData): resourceBuffer will be null if the resource contained no data.

2015-10-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191636. rdar://problem/23078059

    2015-10-27  Alex Christensen  <achristensen@webkit.org>

            Cancel navigation policy checks like we do content policy checks.
            https://bugs.webkit.org/show_bug.cgi?id=150582
            rdar://problem/22077579

            Reviewed by Brent Fulgham.

            This was verified manually and I'll write a layout test for it soon.

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::DocumentLoader):
            (WebCore::DocumentLoader::~DocumentLoader):
            (WebCore::DocumentLoader::willSendRequest):
            (WebCore::DocumentLoader::continueAfterNavigationPolicy):
            (WebCore::DocumentLoader::cancelPolicyCheckIfNeeded):
            * loader/DocumentLoader.h:
            Add a bool to keep track of whether we are waiting for navigation policy checks, like we do with content policy checks.
            Without this check, sometimes callbacks are made to DocumentLoaders that do not exist any more because they do not get
            cancelled by cancelPolicyCheckIfNeeded when detaching from the frame.

2015-10-27  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191525. rdar://problem/23239748

    2015-10-23  Simon Fraser  <simon.fraser@apple.com>

            Avoid SVG-induced layouts inside Element::absoluteEventBounds()
            https://bugs.webkit.org/show_bug.cgi?id=150516

            Reviewed by Zalan Bujtas.

            Speculative fix for a crash under RenderObject::localToContainerQuad() when
            computing the wheel event handler region, which uses Element::absoluteEventHandlerBounds().
            Element::absoluteEventBounds() was calling SVGElement::getBoundingBox() in a way
            that could trigger a layout.

            * dom/Element.cpp:
            (WebCore::Element::absoluteEventBounds):

2015-10-23  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191484.

    2015-10-22  Gordon Sheridan  <gordon_sheridan@apple.com>

            Fix build for clang-700.0.59.5 by replacing deprecated calls to convert points between screen and window coordinates for Mac.
            https://bugs.webkit.org/show_bug.cgi?id=150379

            Reviewed by Andy Estes.

            Provide WAKWindow versions of the non-deprecated methods for converting an NSRect between
            window and screen coordinates, which replace the deprecated methods that operated on an NSPoint.

            * platform/ios/wak/WAKWindow.h:
            * platform/ios/wak/WAKWindow.mm:
            (-[WAKWindow convertRectToScreen:]): Added.
            (-[WAKWindow convertRectFromScreen:]): Added.

2015-10-22  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191357. rdar://problem/23103279

    2015-10-20  Chris Fleizach  <cfleizach@apple.com>

            AX: CrashTracer: com.apple.WebKit.WebContent at com.apple.WebCore: WebCore::AccessibilityTable::tableElement const + 116
            https://bugs.webkit.org/show_bug.cgi?id=150349

            Reviewed by Brent Fulgham.

            The crash point for this bug says that the parentElement of the firstBody is garbage when it's accessed.
            Unfortunately, I could not reproduce this in-situ or with a test.
            So my speculative solution is to recalculate those body elements to ensure that they're valid before we access.

            * accessibility/AccessibilityTable.cpp:
            (WebCore::AccessibilityTable::tableElement):
            (WebCore::AccessibilityTable::isDataTable):

2015-10-14  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191077. rdar://problem/22993325

    2015-10-14  Alex Christensen  <achristensen@webkit.org>

            [Content Extensions] Make blocked async XHR call onerror
            https://bugs.webkit.org/show_bug.cgi?id=146706

            Reviewed by Brady Eidson.

            Test: http/tests/contentextensions/async-xhr-onerror.html

            * xml/XMLHttpRequest.cpp:
            (WebCore::XMLHttpRequest::XMLHttpRequest):
            (WebCore::XMLHttpRequest::createRequest):
            (WebCore::XMLHttpRequest::networkError):
            (WebCore::XMLHttpRequest::networkErrorTimerFired):
            (WebCore::XMLHttpRequest::abortError):
            * xml/XMLHttpRequest.h:
            Make a timer that calls networkError in 0 time if a content blocker blocks the asynchronous load.
            It is necessary to call setPendingActivity and dropProtection (which calls unsetPendingActivity)
            to keep a reference to the XMLHttpRequest alive.

2015-10-14  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r191008. rdar://problem/23111794

    2015-10-13  Dean Jackson  <dino@apple.com>

            Device motion and orientation should only be visible from the main frame's security origin
            https://bugs.webkit.org/show_bug.cgi?id=150072
            <rdar://problem/23082036>

            Reviewed by Brent Fulgham.

            There are reports that gyroscope and accelerometer information can
            be used to detect keyboard entry. One initial step to reduce the
            risk is to forbid device motion and orientation events from
            being fired in frames that are a different security origin from the main page.

            Manual test: deviceorientation-main-frame-only.html

            * page/DOMWindow.cpp:
            (WebCore::DOMWindow::isSameSecurityOriginAsMainFrame): New helper function.
            (WebCore::DOMWindow::addEventListener): Check if we are the main frame, or the
            same security origin as the main frame. If not, don't add the event
            listeners.

2015-10-14  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188477. rdar://problem/22801969

    2015-08-14  Tim Horton  <timothy_horton@apple.com>

            Fix the Mavericks build.

            * platform/spi/mac/LookupSPI.h:

2015-10-14  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188473. rdar://problem/22801969

    2015-08-14  Tim Horton  <timothy_horton@apple.com>

            Fix the build.

            * platform/spi/mac/LookupSPI.h:

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190570. rdar://problem/23075530

    2015-10-05  Zalan Bujtas  <zalan@apple.com>

            Mark the line dirty when RenderQuote's text changes.
            https://bugs.webkit.org/show_bug.cgi?id=149784
            rdar://problem/22558169

            Reviewed by Antti Koivisto.

            When quotation mark changes ( " -> ' or empty string), we
            need to mark the line dirty to ensure its content gets laid out properly.

            Test: fast/inline/quotation-text-changes-dynamically.html

            * rendering/RenderQuote.cpp:
            (WebCore::quoteTextRenderer):
            (WebCore::RenderQuote::updateText):
            (WebCore::fragmentChild): Deleted.

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190382. rdar://problem/22934301

    2015-09-30  Dean Jackson  <dino@apple.com>

            GraphicsContext3D::mappedSymbolName should initialize count variable
            https://bugs.webkit.org/show_bug.cgi?id=149692
            <rdar://problem/22871304>

            Reviewed by Simon Fraser.

            While debugging another WebGL issue, I noticed that some
            OpenGL renderers can get into a state where they
            drop resources (e.g. a GPU reset). If we don't detect that
            in time, we might try to ask for the currently attached
            resources and our in-parameter will not be set. In this
            case, initialize it to zero so that we don't do silly things.

            * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
            (WebCore::GraphicsContext3D::mappedSymbolName): Initialize count to 0.

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190339. rdar://problem/23075538

    2015-09-29  Jon Honeycutt  <jhoneycutt@apple.com>

            Avoid reparsing an XSLT stylesheet after the first failure.
            https://bugs.webkit.org/show_bug.cgi?id=149188
            <rdar://problem/22709912>

            Reviewed by Dave Hyatt.

            Patch by Jiewen Tan, jiewen_tan@apple.com.

            Test: svg/custom/invalid-xslt-crash.svg

            * xml/XSLStyleSheet.h:
            Add a new member variable m_compilationFailed that tracks whether
            compilation has failed. Default value is false.

            * xml/XSLStyleSheetLibxslt.cpp:
            (WebCore::XSLStyleSheet::compileStyleSheet):
            Return early if the compilation has failed before. After compiling the
            style sheet, if we failed, set m_compilationFailed to true.

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190097. rdar://problem/23075540

    2015-09-21  Ryosuke Niwa  <rniwa@webkit.org>

            Fix release builds with security assertion after r190007.

            * dom/DocumentOrderedMap.cpp:
            * dom/DocumentOrderedMap.h:

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190007. rdar://problem/23075540

    2015-09-18  Ryosuke Niwa  <rniwa@webkit.org>

            REGRESSION(r150187): updateIdForTreeScope may not be called inside shadow trees
            https://bugs.webkit.org/show_bug.cgi?id=149364

            Reviewed by Antti Koivisto.

            Since the tree scope is set to that of Document's inside removeBetween when a node is removed from a shadow tree,
            oldScope != &treeScope() was already true inside Element::removedFrom. This can introduce an inconsistency in
            DocumentOrderedMap which could result in a crash. Fixed the bug by checking it against document(), which is the
            behavior we had prior to r150187.

            Also added a consistency check in DocumentOrderedMap to catch bugs like this.

            No new tests. New assertions fail in existing tests without this fix.

            * dom/DocumentOrderedMap.cpp:
            (WebCore::DocumentOrderedMap::add):
            (WebCore::DocumentOrderedMap::remove):
            (WebCore::DocumentOrderedMap::get):
            * dom/DocumentOrderedMap.h:
            * dom/Element.cpp:
            (WebCore::Element::removedFrom):

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r189979. rdar://problem/23075525

    2015-09-18  Chris Dumez  <cdumez@apple.com>

            WebContent crash in WebCore::MemoryPressureHandler::releaseCriticalMemory() with GuardMalloc when preparing to suspend
            https://bugs.webkit.org/show_bug.cgi?id=149350

            Reviewed by Antti Koivisto.

            in MemoryPressureHandler::releaseCriticalMemory(), iterate over a copy of
            Document::allDocuments() instead of iterating over allDocuments() directly.
            Also make sure the Documents are ref'd inside the copy.

            This is needed because clearing the StyleResolver of a Document may cause
            Documents to be unref'd and removed from the allDocument() HashSet.

            No new tests, already covered by existing tests.

            * platform/MemoryPressureHandler.cpp:
            (WebCore::MemoryPressureHandler::releaseCriticalMemory):

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r189421. rdar://problem/22802049

    2015-09-04  Myles C. Maxfield  <mmaxfield@apple.com>

            Crash when font completes downloading after calling 2D canvas setText() multiple times
            https://bugs.webkit.org/show_bug.cgi?id=148789

            Reviewed by Darin Adler.

            The CSSFontSelector has a list of clients, and when fonts complete downloading, these
            clients get a call back. CanvasRenderingContext2D::State is one such of these clients. However,
            the CSSFontSelector may be destroyed and recreated at any time. We were getting into a case
            where multiple CSSFontSelectors were thinking that the same CanvasRenderingContext2D::State were
            their client. When the CanvasRenderingContext2D::State was destroyed, it only unregistered
            itself from one of the CSSFontSelectors, which means the CSSFontSelector left over has a dangling
            pointer to it.

            The solution is to implement a new helper class, FontProxy, to hold the
            CanvasRenderingContext2D::State's font, and maintain the invariant that this object is always
            registered to exactly one CSSFontSelector, and this CSSFontSelector is the one which is associated
            with the FontProxy's FontCascade object. This patch maintains this invariant, as well as protecting
            all access to the State's FontCascade object so no one can reach in and change it without going
            through functions which maintain the invariant.

            Test: fast/canvas/font-selector-crash.html

            * css/CSSFontSelector.cpp:
            (WebCore::CSSFontSelector::registerForInvalidationCallbacks):
            (WebCore::CSSFontSelector::unregisterForInvalidationCallbacks):
            (WebCore::CSSFontSelector::dispatchInvalidationCallbacks):
            * css/CSSFontSelector.h:
            * dom/Document.cpp:
            (WebCore::Document::fontsNeedUpdate):
            (WebCore::Document::fontSelector):
            (WebCore::Document::clearStyleResolver):
            * dom/Document.h:
            * html/canvas/CanvasRenderingContext2D.cpp:
            (WebCore::CanvasRenderingContext2D::State::State):
            (WebCore::CanvasRenderingContext2D::State::operator=):
            (WebCore::CanvasRenderingContext2D::FontProxy::~FontProxy):
            (WebCore::CanvasRenderingContext2D::FontProxy::FontProxy):
            (WebCore::CanvasRenderingContext2D::FontProxy::update):
            (WebCore::CanvasRenderingContext2D::FontProxy::fontsNeedUpdate):
            (WebCore::CanvasRenderingContext2D::FontProxy::initialize):
            (WebCore::CanvasRenderingContext2D::FontProxy::fontMetrics):
            (WebCore::CanvasRenderingContext2D::FontProxy::fontDescription):
            (WebCore::CanvasRenderingContext2D::FontProxy::width):
            (WebCore::CanvasRenderingContext2D::FontProxy::drawBidiText):
            (WebCore::CanvasRenderingContext2D::font):
            (WebCore::CanvasRenderingContext2D::setFont):
            (WebCore::CanvasRenderingContext2D::measureText):
            (WebCore::CanvasRenderingContext2D::drawTextInternal):
            (WebCore::CanvasRenderingContext2D::State::~State): Deleted.
            (WebCore::CanvasRenderingContext2D::State::fontsNeedUpdate): Deleted.
            (WebCore::CanvasRenderingContext2D::accessFont): Deleted.
            * html/canvas/CanvasRenderingContext2D.h:
            * platform/graphics/FontSelector.h:

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r189834. rdar://problem/22801966

    2015-09-15  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Paused Debugger prevents page reload
            https://bugs.webkit.org/show_bug.cgi?id=148174

            Reviewed by Brian Burg.

            When navigating the page while paused, suppress any pausing until the page
            has completed navigation. If not paused and navigating, you can still pause
            in pagehide and unload handlers or other late page events.

            Could not write a reliable test for this at the moment.
            InspectorTest.reloadPage has multiple issues with the output,
            so I'll investigate making reload tests more reliable later.

            * inspector/InspectorController.h:
            * inspector/InspectorController.cpp:
            (WebCore::InspectorController::resume): Deleted.
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::continueLoadAfterNavigationPolicy):
            We now use existing InspectorInstrumentation functions instead of a method
            on InspectorController during load. In dropping the method InspectorController
            can drop a member variable no longer used.

            * inspector/InspectorInstrumentation.h:
            (WebCore::InspectorInstrumentation::willStartProvisionalLoad):
            Add a new instrumentation hook.

            * inspector/InspectorInstrumentation.cpp:
            (WebCore::InspectorInstrumentation::willStartProvisionalLoadImpl):
            (WebCore::InspectorInstrumentation::didCommitLoadImpl):
            When starting or completing main frame navigations, let the PageDebuggerAgent do some work.

            * inspector/PageDebuggerAgent.h:
            * inspector/PageDebuggerAgent.cpp:
            (WebCore::PageDebuggerAgent::mainFrameStartedLoading):
            (WebCore::PageDebuggerAgent::mainFrameStoppedLoading):
            (WebCore::PageDebuggerAgent::mainFrameNavigated):
            Suppress pausing if navigating while paused. Otherwise behave as normal.

2015-10-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188443. rdar://problem/22801969

    2015-08-13  Tim Horton  <timothy_horton@apple.com>

            Performing a Lookup on wrapped text puts the popover arrow in the wrong place (off to the right)
            https://bugs.webkit.org/show_bug.cgi?id=148012
            <rdar://problem/19238094>

            Reviewed by Simon Fraser.

            * platform/spi/mac/LookupSPI.h:
            Add some SPI.

2015-10-09  Lucas Forschler  <lforschler@apple.com>

        Merge r189168

    2015-08-31  Alexey Proskuryakov  <ap@apple.com>

            Build fix.

            * page/EventHandler.h:
            (WebCore::EventHandler::immediateActionStage): Don't export an inline function,
            to avoid "weak external symbol" errors.

2015-10-08  Lucas Forschler  <lforschler@apple.com>

        Merge r190602. rdar://problem/22995830

    2015-10-05  Alex Christensen  <achristensen@webkit.org>

            Invalid CSS Selector for Content Blockers invalidates others
            https://bugs.webkit.org/show_bug.cgi?id=148446
            rdar://problem/22918235

            Reviewed by Benjamin Poulain.

            Test: http/tests/contentextensions/invalid-selector.html

            * contentextensions/ContentExtensionParser.cpp:
            (WebCore::ContentExtensions::loadTrigger):
            (WebCore::ContentExtensions::isValidSelector):
            (WebCore::ContentExtensions::loadAction):
            (WebCore::ContentExtensions::loadRule):
            Add a check to see if a selector is valid before adding it.

2015-10-08  Lucas Forschler  <lforschler@apple.com>

        Merge r190375. rdar://problem/22881748

    2015-09-30  Myles C. Maxfield  <mmaxfield@apple.com>

            Crash when using an SVG font with > 390 glyphs
            https://bugs.webkit.org/show_bug.cgi?id=149677
            <rdar://problem/21676402>

            Reviewed by Simon Fraser.

            The "Charset Index" in OTF are indices into a collection of strings. There are
            390 predefined strings in this collection. We were currently assigning each
            glyph to one of these strings. However, if there are more glyphs than strings,
            we will be using invalid indices.

            The values of the strings themselves are not necessary for SVG fonts. Therefore,
            the solution is to create a single dummy string, and have all glyphs target it.

            Tests: svg/custom/many-glyphs.svg

            * css/CSSFontFaceSource.cpp:
            (WebCore::CSSFontFaceSource::font):
            * svg/SVGToOTFFontConversion.cpp:
            (WebCore::SVGToOTFFontConverter::appendCFFTable):

2015-10-08  Lucas Forschler  <lforschler@apple.com>

        Merge r189976. rdar://problem/22824652

    2015-09-18  Chris Dumez  <cdumez@apple.com>

            REGRESSION (r182449, Mavericks ONLY): Pages re-open empty after swiping back and scrolling on them
            https://bugs.webkit.org/show_bug.cgi?id=149317
            <rdar://problem/22521514>

            Reviewed by Tim Horton.

            Disable on Mavericks a PageCache optimization from r182449 which lets
            into PageCache pages that only have certain types of pending loads
            (images and XHR). This is because it has been determined via bisection
            that this change is the one that introduced the bug on Mavericks.

            * loader/DocumentLoader.cpp:
            (WebCore::areAllLoadersPageCacheAcceptable):

2015-10-08  Lucas Forschler  <lforschler@apple.com>

        Merge r189976. rdar://problem/22824652

    2015-09-18  Chris Dumez  <cdumez@apple.com>

            REGRESSION (r182449, Mavericks ONLY): Pages re-open empty after swiping back and scrolling on them
            https://bugs.webkit.org/show_bug.cgi?id=149317
            <rdar://problem/22521514>

            Reviewed by Tim Horton.

            Disable on Mavericks a PageCache optimization from r182449 which lets
            into PageCache pages that only have certain types of pending loads
            (images and XHR). This is because it has been determined via bisection
            that this change is the one that introduced the bug on Mavericks.

            * loader/DocumentLoader.cpp:
            (WebCore::areAllLoadersPageCacheAcceptable):

2015-10-08  Andy Estes  <aestes@apple.com>

        Merge r188150, r188517, r188844, r188845, r188851, r188852, r188880, r188881, r188988, r189193, r189289, and r190133.
        rdar://problem/22847063

    2015-08-26  Andy Estes  <aestes@apple.com>

            [Content Filtering] Determine navigation and content policy before continuing to filter a load
            https://bugs.webkit.org/show_bug.cgi?id=148506

            Reviewed by Brady Eidson.

            Prior to this change, ContentFilter would hide from DocumentLoader all CachedRawResourceClient callbacks until
            a decision was made, then replay the missed callbacks. This approach interacted poorly with some features of
            the loader, notably appcache and downloads. In the case of appcache, DocumentLoader might not have a chance to
            check for substitute data until the original load has finished, wasting bandwidth, and might receive duplicate
            or out-of-order callbacks. In the case of downloads, it would often be too late to convert the existing
            connection to a download, leading to restarted downloads or outright failures.

            Bandaids were put in place for these issues in r188150, r188486, and r188851 to fix crashes or serious
            regressions in behavior, but these weren't complete fixes. They did not solve any of the duplicate data loading
            problems, and they did not make downloads work reliably in all cases.

            This patch rolls out the bandaids (but keeps their tests) and replaces them with a more robust fix. Instead of
            hiding callbacks from DocumentLoader, ContentFilter now delivers willSendRequest(), redirectReceived(), and
            responseReceived() to DocumentLoader immediately, and cancels filtering if DocumentLoader decides to ignore the
            load, download it, or load substitute data. ContentFilter continues to buffer incoming data to prevent partial
            rendering of blocked content.

            The existing tests for r188150 and r188851 were kept, the test for r188486 was rewritten to be specific to
            content filtering, and new tests were added to cover the case where ContentFilter is still undecided after a
            load finishes.

            Tests: contentfiltering/allow-never.html
                   contentfiltering/block-never.html
                   ContentFiltering.AllowDownloadAfterAddData
                   ContentFiltering.AllowDownloadAfterFinishedAddingData
                   ContentFiltering.AllowDownloadAfterRedirect
                   ContentFiltering.AllowDownloadAfterResponse
                   ContentFiltering.AllowDownloadAfterWillSendRequest
                   ContentFiltering.AllowDownloadNever
                   ContentFiltering.BlockDownloadAfterAddData
                   ContentFiltering.BlockDownloadAfterFinishedAddingData
                   ContentFiltering.BlockDownloadAfterRedirect
                   ContentFiltering.BlockDownloadAfterResponse
                   ContentFiltering.BlockDownloadAfterWillSendRequest
                   ContentFiltering.BlockDownloadNever

            * bindings/js/JSMockContentFilterSettingsCustom.cpp:
            (WebCore::JSMockContentFilterSettings::decisionPoint): Taught to handle DecisionPoint::Never, and rewrote to
            not need a set of const uint8_ts that mirror the DecisionPoint enum.
            (WebCore::JSMockContentFilterSettings::setDecisionPoint): Ditto.
            (WebCore::toJSValue): Rewrote to not need a set of const uint8_ts that mirror the Decision enum.
            (WebCore::toDecision): Ditto.
            * loader/ContentFilter.cpp:
            (WebCore::ContentFilter::createIfEnabled): Renamed from createIfNeeded, and changed to take a DocumentLoader&
            instead of a DecisionFunction.
            (WebCore::ContentFilter::ContentFilter):
            (WebCore::ContentFilter::responseReceived): If m_state != Blocked after filtering, call DocumentLoader::responseReceived().
            (WebCore::ContentFilter::dataReceived): If m_state == Allowed after filtering, deliver buffered data to DocumentLoader.
            If no filtering was necessary, call DocumentLoader::dataReceived() directly.
            (WebCore::ContentFilter::redirectReceived): If m_state != Blocked after filtering, call DocumentLoader::redirectReceived().
            (WebCore::ContentFilter::notifyFinished): If an error occured, call DocumentLoader::notifyFinished() immediately and return.
            If m_state != Blocked after filtering, deliver buffered data to DocumentLoader and call DocumentLoader::notifyFinished().
            If no filtering was necessary and m_state != Blocked, call DocumentLoader::notifyFinished() directly.
            (WebCore::ContentFilter::didDecide): Called DocumentLoader::contentFilterDidDecide() instead of m_decisionFunction().
            (WebCore::ContentFilter::deliverResourceData): Added a helper function to deliver buffered data to DocumentLoader.
            (WebCore::ContentFilter::createIfNeeded): Renamed to createIfEnabled().
            * loader/ContentFilter.h:
            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::DocumentLoader):
            (WebCore::DocumentLoader::willSendRequest): Stopped asserting that redirectResponse is null and made it part of
            the if condition instead, since willSendRequest() will now be called on redirects when there is an active ContentFilter.
            (WebCore::DocumentLoader::startLoadingMainResource): Called becomeMainResourceClient() instead of becomeMainResourceClientIfFilterAllows().
            (WebCore::DocumentLoader::becomeMainResourceClient): Renamed from becomeMainResourceClientIfFilterAllows().
            Only called ContentFilter::startFilteringMainResource() if the filter state is Initialized, since ContentFilter
            might have already made a decision in willSendRequest().
            (WebCore::DocumentLoader::contentFilterDidDecide): Stopped deleting m_contentFilter, since it will continue to deliver callbacks
            even after making a decision. Fixed a bug where we were creating two copies of ContentFilter's replacement data.
            (WebCore::DocumentLoader::syntheticRedirectReceived): Deleted.
            (WebCore::DocumentLoader::becomeMainResourceClientIfFilterAllows): Renamed to becomeMainResourceClient().
            * loader/DocumentLoader.h:
            * loader/EmptyClients.h:
            * loader/FrameLoaderClient.h:
            * loader/ResourceLoader.cpp:
            (WebCore::ResourceLoader::willSendRequestInternal): Removed part of r188851.
            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::didReceiveResponse): Removed part of r188486.
            * loader/SubresourceLoader.h:
            * loader/cache/CachedRawResource.cpp:
            (WebCore::CachedRawResource::didAddClient): Removed part of r188150.
            * loader/cache/CachedRawResourceClient.h:
            (WebCore::CachedRawResourceClient::syntheticRedirectReceived): Removed part of r188150.
            * testing/MockContentFilterSettings.h: Defined DecisionPoint::Never.
            * testing/MockContentFilterSettings.idl: Defined DECISION_POINT_NEVER.

2015-10-08  Lucas Forschler  <lforschler@apple.com>

        Merge r188148. rdar://problem/22802036

    2015-08-06  Dean Jackson  <dino@apple.com>

            Shadows don't draw on fillText when using a gradient fill
            https://bugs.webkit.org/show_bug.cgi?id=147758
            <rdar://problem/20860912>

            Reviewed by Myles Maxfield.

            Since we use a mask to render a pattern or gradient
            into text, any shadow was being clipped out. Change
            this to draw the shadow before the mask + fill operation,
            using a technique similar to text-shadow.

            Test: fast/canvas/gradient-text-with-shadow.html

            * html/canvas/CanvasRenderingContext2D.cpp:
            (WebCore::CanvasRenderingContext2D::drawTextInternal): Get the current shadow
            style, paint the text with a transformed shadow offset so that we only
            see the shadow and not the text, then combine with the existing pattern/gradient
            fill.

2015-10-08  Lucas Forschler  <lforschler@apple.com>

        Rollout r190745

2015-10-08  Lucas Forschler  <lforschler@apple.com>

        Merge r188443. rdar://problem/22801969

    2015-08-13  Tim Horton  <timothy_horton@apple.com>

            Performing a Lookup on wrapped text puts the popover arrow in the wrong place (off to the right)
            https://bugs.webkit.org/show_bug.cgi?id=148012
            <rdar://problem/19238094>

            Reviewed by Simon Fraser.

            * platform/spi/mac/LookupSPI.h:
            Add some SPI.

2013-03-18  Rune Lillesveen  <rune@opera.com>

        monochrome media feature does not accept integer values
        https://bugs.webkit.org/show_bug.cgi?id=112549

        Allow monochrome media feature with integer values. min/max-monochrome
        already did.

        Reviewed by NOBODY (OOPS!).

        Test: fast/media/media-feature-monochrome.html

        * css/MediaQueryExp.cpp:
        (WebCore::featureWithPositiveInteger):

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190380. rdar://problem/22888962

    2015-09-30  Dean Jackson  <dino@apple.com>

            Crash in gleLookupHashObject when context is lost
            https://bugs.webkit.org/show_bug.cgi?id=149690
            <rdar://problem/22751585>
            <rdar://problem/22465495>

            Reviewed by Simon Fraser.

            When we received notification that the GPU has reset,
            we were nulling out and deleting our OpenGL contexts
            and then trying to do it all over again. The fix was
            to flip the order of operations.

            While there I added some logging, and changed the
            way we check GPU status to make sure we do a check
            after the first draw call.

            Unfortunately we can't test automatically because it
            involves resetting the GPU which can possibly cause
            concurrent tests to fail.

            * platform/graphics/mac/GraphicsContext3DMac.mm:
            (WebCore::GraphicsContext3D::checkGPUStatusIfNecessary): Move forceContextLost()
            to be the first thing we do after we've realised we need to
            bail.

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r190252. rdar://problem/22867962

    2015-09-25  Beth Dakin  <bdakin@apple.com>

            Clicking on a data detected item inside a form control always pops up a map
            on force touch trackpad
            https://bugs.webkit.org/show_bug.cgi?id=149559
            -and corresponding-
            rdar://problem/22826796

            Reviewed by Tim Horton.

            The real bug here appears to be a bug in Lookup, but we can work around it.
            For normal text, we call directly into Data Detectors for map results, and
            that works fine. For text within form controls, we did not properly extract
            the text for DD, so we sent it to Lookup instead, and Lookup has this bug
            where they will pop open the map right away. If we properly extract the text
            for form controls, then we can work around this bug.

            * editing/mac/DataDetection.mm:
            (WebCore::detectItemAtPositionWithRange):
            (WebCore::DataDetection::detectItemAroundHitTestResult):

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r189560. rdar://problem/22824659

    2015-09-09  Benjamin Poulain  <bpoulain@apple.com>

            CSS general sibling selectors does not work without CSS JIT
            https://bugs.webkit.org/show_bug.cgi?id=148987
            rdar://problem/22559860

            Reviewed by Andreas Kling.

            When traversing with the indirect adjacent combinator, SelectorChecker
            was not setting the style invalidation flag on the right element.

            Tests: fast/css/indirect-adjacent-style-invalidation-1.html
                   fast/css/indirect-adjacent-style-invalidation-2.html
                   fast/css/indirect-adjacent-style-invalidation-3.html

            * css/SelectorChecker.cpp:
            (WebCore::SelectorChecker::matchRecursively):

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188990. rdar://problem/22802029

    2015-08-26  Beth Dakin  <bdakin@apple.com>

            REGRESSION: Safari navigates after a cancelled force click
            https://bugs.webkit.org/show_bug.cgi?id=148491
            -and corresponding-
            rdar://problem/22394323

            Reviewed by Tim Horton.

            This regression was introduced on El Capitan because AppKit sends ‘cancel��to
            gesture recognizer BEFORE it sends the mouseUp. So the ImmediateActionStage needs
            to track whether a cancel happened after updates or without any updates since they
            signify different things.

            Don�ft perform default behaviors when the stage is ActionCancelledAfterUpdate.
            * page/EventHandler.cpp:
            (WebCore::EventHandler::handleMouseReleaseEvent):

            New possible stages, and new getter for the current stage.
            * page/EventHandler.h:
            (WebCore::EventHandler::immediateActionStage):

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188768. rdar://problem/22802019

    2015-08-21  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: REGRESSION(173684): Edit as HTML not working
            https://bugs.webkit.org/show_bug.cgi?id=148268

            Reviewed by Chris Dumez.

            Tests: inspector/dom/getOuterHTML.html
                   inspector/dom/setOuterHTML.html

            * inspector/DOMPatchSupport.cpp:
            (WebCore::DOMPatchSupport::innerPatchChildren):
            Revert the optimization change made in r173684. The optimization changes
            had a few issues. It changed the logic to potentially drop out of the
            loop before all new items were processed and using a node reference
            to track an index did not account for the modifications insertBefore
            may have made to that node's index in the list.

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188690. rdar://problem/22802006

    2015-08-20  Chris Dumez  <cdumez@apple.com>

            [Cocoa] Treat Epoch as invalid value for "Last-Modified" header
            https://bugs.webkit.org/show_bug.cgi?id=148162
            rdar://problem/22330837

            Reviewed by Antti Koivisto.

            Ignore "Last-Modified" header when computing heuristic freshness if it
            is Epoch. CFNetwork currently converts a malformed date for Last-Modified
            into Epoch so there is no way for us to distinguish Epoch from invalid
            input. Without this, we would end up with cached resources that have a
            giant lifetime (> 4 years) due to a malformed HTTP header.

            Some Websites (e.g. www.popehat.com) also wrongly return Epoch as
            Last-Modified value and we would end up caching it overly aggressively.
            Now that we consider Epoch as an invalid value for Last-Modified, it will
            also work around this content bug.

            Test: http/tests/cache/disk-cache/disk-cache-last-modified.html

            * platform/network/ResourceResponseBase.cpp:
            (WebCore::ResourceResponseBase::lastModified):

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r189102. rdar://problem/22802034

    2015-08-28  Timothy Horton  <timothy_horton@apple.com>

            [Mac] Right-clicking on GIFs spins the UI process for a while
            https://bugs.webkit.org/show_bug.cgi?id=148566
            <rdar://problem/22460854>

            Reviewed by Brady Eidson.

            * platform/ContextMenuItem.h:
            Properly mark this as Mac-only. It's only implemented in ContextMenuItemMac.

            * platform/mac/ContextMenuItemMac.mm:
            (WebCore::ContextMenuItem::shareMenuItem):
            Take a NSImage directly, so we don't have to round-trip through BitmapImage,
            which can be lossy and expensive.

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188634. rdar://problem/22802013

    2015-08-18  Myles C. Maxfield  <mmaxfield@apple.com>

            [Cocoa] Punctuation near Hindi text is garbled when styled with the system font
            https://bugs.webkit.org/show_bug.cgi?id=148164

            Reviewed by Brian Burg.

            Fonts cache whether or not they are the system font. This caching took place at the end of Font::platformInit().
            However, in the middle of Font::platformInit(), we look up a glyph, which calls GlyphPage::fill() which consults
            with this cache. However, at this point, the cache has not been constructed yet. The solution is just to
            construct the cache earlier (at the beginning of the function).

            Consulting with the cache before it is populated causes it to erroneously say that no fonts are system fonts.
            Then, we use Core Graphics to ask for glyphs instead of Core Text. Core Graphics, however, is incapable of
            handling the system font, and returns us garbled results. In particular, when the system language is set to
            Japanese, the system font does not support punctuation, and Core Text tells us so. However, Core Graphics
            erroneously tells us that the system font does support punctuation.

            Then, if text is near the punctuation which causes us to take the complex text codepath (such as Hindi text),
            we tell Core Text to explicitly lay out the punctuation using the system font (which does not support
            punctuation). Core Text then replies that the provided font doesn't support the punctuation, and that we should
            use LastResort with some other glyphs instead. WebKit then disregards the font CoreText told us to use (because
            we are oh-so-sure that the font in question supports punctuation) and uses the LastResort glyph IDs with our
            font, which causes arbitrary glyphs to be shown.

            Test: fast/text/hindi-system-font-punctuation.html

            * platform/graphics/cocoa/FontCocoa.mm:
            (WebCore::Font::platformInit):

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188622. rdar://problem/22802016

    2015-08-18  Dean Jackson  <dino@apple.com>

            Add null check in ImageBufferData::getData
            https://bugs.webkit.org/show_bug.cgi?id=148156
            <rdar://problem/22337157>

            Reviewed by Simon Fraser.

            We're getting a number of crash reports that suggest the allocation
            of the result buffer has failed, but have been unable to reproduce.
            This patch adds a null check to the allocation, and logs a message
            to the system console. This might avoid the crashes, and hopefully
            we'll see the message.

            No new tests, since we're unable to reproduce this crash.

            * platform/graphics/cg/ImageBufferDataCG.cpp:
            (WebCore::ImageBufferData::getData): Add a null-check and early
            return.

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188298. rdar://problem/22885242

    2015-08-11  Zalan Bujtas  <zalan@apple.com>

            Invalid FrameView::m_viewportRenderer after layout is finished.
            https://bugs.webkit.org/show_bug.cgi?id=147848
            rdar://problem/22205197

            Reviewed by Simon Fraser.

            We cache the current viewport renderer (FrameView::m_viewportRenderer) right before layout.
            It gets dereferenced later when layout is finished to update the overflow status.
            If the viewport renderer gets destroyed during layout, we end up with a dangling pointer.
            This patch replaces the pointer caching with type caching (none, body, document).

            Unable to construct a test case.

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187921. rdar://problem/22801988

    2015-08-04  Chris Dumez  <cdumez@apple.com>

            Subframes with no current HistoryItem should not prevent page-caching
            https://bugs.webkit.org/show_bug.cgi?id=147649
            <rdar://problem/21614832>

            Reviewed by Andreas Kling.

            Subframes with no current HistoryItem should not prevent page-caching.
            We need one for the main frame as this is the key in the PageCache.
            However, there is no reason to require one for subframes.

            This is a common reason for page-caching failures nowadays.

            Frames do no have a current HistoryItem until something has been loaded in them.

            Test: http/tests/navigation/page-cache-iframe-no-current-historyItem.html

            * history/PageCache.cpp:
            (WebCore::logCanCacheFrameDecision):
            (WebCore::PageCache::canCachePageContainingThisFrame):

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187593. rdar://problem/22801973

    2015-07-30  Simon Fraser  <simon.fraser@apple.com>

            Selecting in an iframe can cause main page scrolling
            https://bugs.webkit.org/show_bug.cgi?id=147431
            rdar://problem/19244589

            Reviewed by Zalan Bujtas.

            The RenderLayer auatoscroll code walks up the RenderLayer hierarchy, crossing
            frame boundaries. However, as it crosses into an ancestor frame it failed to
            map the target rect into the coordinate space of the new frame, which caused
            us to scroll to an incorrect location in that parent frame.

            Test: fast/events/autoscroll-in-iframe.html

            * rendering/RenderLayer.cpp:
            (WebCore::parentLayerCrossFrame): Make the layer a reference, and pass in
            an optional rect. When crossing frame boundaries, map the rect from the
            contents of the child frame to the contents of the parent frame.
            (WebCore::RenderLayer::enclosingScrollableLayer): Pass optional rect.
            (WebCore::RenderLayer::scrollRectToVisible):
            (WebCore::RenderLayer::hasScrollableOrRubberbandableAncestor):
            * rendering/RenderLayer.h:

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187210. rdar://problem/22801995

    2015-07-22  Wenson Hsieh  <wenson_hsieh@apple.com>

            Coordinates-based snap offsets don't update correctly when container is scrolled
            https://bugs.webkit.org/show_bug.cgi?id=147215

            Reviewed by Brent Fulgham.

            Fixes the way we append the snap offsets of child elements with coordinates. We
            now consider the scroll offset of the parent scroll snapping container, so snap
            offset recomputations don't fail on scroll snapping containers.

            Test: css3/scroll-snap/scroll-snap-coordinate-overflow-resize.html

            * page/scrolling/AxisScrollSnapOffsets.cpp:
            (WebCore::appendChildSnapOffsets): Fixed to consider the scroll offset of the
                parent container.

2015-10-02  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187145. rdar://problem/22801952

    2015-07-21  Joseph Pecoraro  <pecoraro@apple.com>

            Web Inspector: Node highlights are wrong when the page is zoomed
            https://bugs.webkit.org/show_bug.cgi?id=147177

            Reviewed by Simon Fraser.

            * inspector/InspectorOverlay.cpp:
            (WebCore::InspectorOverlay::update):
            Remove scaling that appears to no longer be needed, it was double
            scaling the overlay content and misplacing it in the process.

2015-09-25  Brent Fulgham  <bfulgham@apple.com>

        Merge r190235. rdar://problem/22852382

    2015-09-24  Brent Fulgham  <bfulgham@apple.com>

            [Win] Support composited content in WebView render-to-context methods
            https://bugs.webkit.org/show_bug.cgi?id=149516
            <rdar://problem/22635080>

            Reviewed by Simon Fraser.

            Extend the CACFLayerTreeHost implementation to render into a passed
            device context when requested. When no context is provided (the default
            case) paint as normal.

            Will be tested by existing compositing tests in a future bug. DumpRenderTree
            has to be extended to do this painting properly.

            * platform/graphics/ca/win/CACFLayerTreeHost.cpp:
            (WebCore::CACFLayerTreeHost::paint): Accept an optional HDC argument, and
            pass it to the render method.
            * platform/graphics/ca/win/CACFLayerTreeHost.h:
            * platform/graphics/ca/win/LegacyCACFLayerTreeHost.cpp: Add missing SOFT_LINK
            command for the WKCACFViewDrawIntoDC.
            (WebCore::LegacyCACFLayerTreeHost::paint): Accept optional HDC argument and
            pass it to the parent class.
            (WebCore::LegacyCACFLayerTreeHost::render): Accept new optional HDC argument.
            If provided, call WKCACFViewDrawIntoDC. Otherwise, call WKCACFVIewDraw.
            * platform/graphics/ca/win/LegacyCACFLayerTreeHost.h:
            * platform/graphics/ca/win/WKCACFViewLayerTreeHost.cpp: Add missing SOFT_LINK
            command for the WKCACFViewDrawIntoDC.
            (WebCore::WKCACFViewLayerTreeHost::paint): Accept optional HDC argument and
            pass it to the parent class.
            (WebCore::WKCACFViewLayerTreeHost::render): Accept new optional HDC argument.
            If provided, call WKCACFViewDrawIntoDC. Otherwise, call WKCACFVIewDraw.
            * platform/graphics/ca/win/WKCACFViewLayerTreeHost.h:

2015-09-22  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r189200. rdar://problem/22803080

    2015-08-31  Brent Fulgham  <bfulgham@apple.com>

            [Win] WebKit cannot load pages based on "file://" URLs
            https://bugs.webkit.org/show_bug.cgi?id=148596
            <rdar://problem/22432585>

            Reviewed by Dean Jackson.

            * platform/URL.cpp:
            (WebCore::URL::URL): Work around bug that causes this assertion to fire on
            the Apple Windows build.
            * platform/network/cf/SynchronousResourceHandleCFURLConnectionDelegate.cpp:
            (WebCore::adjustMIMETypeIfNecessary): Added. If the URL is for a local file,
            determine the MIME type based on extension. Otherwise use the default MIME type.
            (WebCore::SynchronousResourceHandleCFURLConnectionDelegate::didReceiveResponse): If
            the CFURLResponse has no MIME type, call 'adjustMIMETypeIfNecessary'.

2015-09-16  Babak Shafiei  <bshafiei@apple.com>

        Merge r189821.

    2015-09-15  Brent Fulgham  <bfulgham@apple.com>

            [Win] Tiled drawing is rendering more times than it should
            https://bugs.webkit.org/show_bug.cgi?id=149144
            <rdar://problem/22313905>

            Reviewed by Simon Fraser.

            Provide a more faithful implemenation of the Objective C tiled drawing logic.
            (1) Create a new WebTiledBackingLayerWin class that represents a the
                container of tiles. This matches the Objective C design.
            (2) Move implementation of several methods (e.g., isOpaque) to the internal
                class implementation so that the Tile Drawing logic can perform special
                handling in these cases.
            (3) Remove the duplicated Tiled Drawing logic from PlatformCALayerWinInternal,
                since it was just duplicating code in TileController and TileGrid.
            (4) Clean up the display callback code to avoid performing incorrect flipping
                of the coordinate system.

            * PlatformAppleWin.cmake: Add new WebTiledBackingLayerWin file.            
            * WebCore.vcxproj/WebCore.vcxproj: Add the new WebTiledBackingLayerWin files.
            * WebCore.vcxproj/WebCore.vcxproj.filters: Ditto.
            * platform/graphics/ca/PlatformCALayer.cpp:
            (PlatformCALayer::flipContext): Added convenience method.
            (PlatformCALayer::drawRepaintIndicator): Ditto.
            * platform/graphics/ca/TileGrid.cpp:
            (TileGrid::platformCALayerPaintContents): Flip the context before drawing the repaint
            indicator on Windows.
            * platform/graphics/ca/win/PlatformCALayerWin.cpp:
            (PlatformCALayerWin::PlatformCALayerWin): Create a WebTiledBackingLayerWin
            object if using tiled drawing.
            (PlatformCALayerWin::~PlatformCALayerWin):
            (PlatformCALayerWin::isOpaque): Move implementation to internal class.
            (PlatformCALayerWin::setOpaque): Ditto.
            (PlatformCALayerWin::setBorderWidth): Ditto.
            (PlatformCALayerWin::setBorderColor): Ditto.
            (PlatformCALayerWin::contentsScale): Ditto.
            (PlatformCALayerWin::setContentsScale): Ditto.
            (PlatformCALayerWin::cornerRadius): Ditto.
            (PlatformCALayerWin::tiledBacking): Ditto.
            (PlatformCALayerWin::drawTextAtPoint): New helper method to draw repaint counter
            text. Needed to work around bug in CG.
            * platform/graphics/ca/win/PlatformCALayerWinInternal.cpp:
            (PlatformCALayerWinInternal::PlatformCALayerWinInternal): Remove tiling-logic
            related member variables.
            (PlatformCALayerWinInternal::~PlatformCALayerWinInternal):
            (shouldInvertBeforeDrawingContent): Added convenience method.
            (shouldInvertBeforeDrawingRepaintCounters): Ditto.
            (PlatformCALayerWinInternal::displayCallback):
            (PlatformCALayerWinInternal::drawRepaintCounters): Helper method to
            share code between the two layer classes.
            (PlatformCALayerWinInternal::internalSetNeedsDisplay): use nullptr.
            (PlatformCALayerWinInternal::setNeedsDisplay): Ditto.
            (PlatformCALayerWinInternal::setNeedsDisplayInRect): Move tiled code
            to WebTiledBackingLayerWin and simplify the remaing code.
            (PlatformCALayerWinInternal::setSublayers): Remove tile code.
            (PlatformCALayerWinInternal::getSublayers): Ditto.
            (PlatformCALayerWinInternal::removeAllSublayers): Ditto.
            (PlatformCALayerWinInternal::insertSublayer): Ditto.
            (PlatformCALayerWinInternal::sublayerCount): Ditto.
            (PlatformCALayerWinInternal::indexOfSublayer): Ditto.
            (PlatformCALayerWinInternal::sublayerAtIndex): Ditto.
            (PlatformCALayerWinInternal::setBounds): Ditto.
            (PlatformCALayerWinInternal::setFrame): Ditto.
            (PlatformCALayerWinInternal::isOpaque): Ditto.
            (PlatformCALayerWinInternal::setOpaque): Ditto.
            (PlatformCALayerWinInternal::contentsScale): Ditto.
            (PlatformCALayerWinInternal::setContentsScale): Ditto.
            (PlatformCALayerWinInternal::setBorderWidth): Ditto.
            (PlatformCALayerWinInternal::setBorderColor): Ditto.
            (layerTypeIsTiled): Deleted.
            (PlatformCALayerWinInternal::constrainedSize): Deleted.
            (PlatformCALayerWinInternal::tileDisplayCallback): Deleted.
            (PlatformCALayerWinInternal::addTile): Deleted.
            (PlatformCALayerWinInternal::removeTile): Deleted.
            (PlatformCALayerWinInternal::tileAtIndex): Deleted.
            (PlatformCALayerWinInternal::tileCount): Deleted.
            (PlatformCALayerWinInternal::updateTiles): Deleted.
            (PlatformCALayerWinInternal::drawTile): Deleted.
            (PlatformCALayerWinInternal::createTileController): Deleted.
            (PlatformCALayerWinInternal::tiledBacking): Deleted.
            * platform/graphics/ca/win/PlatformCALayerWinInternal.h:
            (WebCore::PlatformCALayerWinInternal::owner):
            * platform/graphics/ca/win/WebTiledBackingLayerWin.cpp: Added.
            (WebTiledBackingLayerWin::WebTiledBackingLayerWin):
            (WebTiledBackingLayerWin::~WebTiledBackingLayerWin):
            (DisplayOnMainThreadContext::DisplayOnMainThreadContext):
            (redispatchOnMainQueue):
            (WebTiledBackingLayerWin::displayCallback):
            (WebTiledBackingLayerWin::setNeedsDisplay):
            (WebTiledBackingLayerWin::setNeedsDisplayInRect):
            (WebTiledBackingLayerWin::setBounds):
            (WebTiledBackingLayerWin::isOpaque):
            (WebTiledBackingLayerWin::setOpaque):
            (WebTiledBackingLayerWin::contentsScale):
            (WebTiledBackingLayerWin::setContentsScale):
            (WebTiledBackingLayerWin::setBorderWidth):
            (WebTiledBackingLayerWin::setBorderColor):
            (WebTiledBackingLayerWin::createTileController):
            (WebTiledBackingLayerWin::tiledBacking):
            (WebTiledBackingLayerWin::invalidate):
            * platform/graphics/ca/win/WebTiledBackingLayerWin.h: Added.

2015-09-11  Babak Shafiei  <bshafiei@apple.com>

        Merge r189598.

    2015-09-10  Chris Fleizach  <cfleizach@apple.com>

            AX: Mavericks: Text cursor does not move along with VoiceOver cursor for text fields
            https://bugs.webkit.org/show_bug.cgi?id=148891

            Reviewed by Alexey Proskuryakov.

            Asychronous focus setting DOES work on Yosemite, just not Mavericks.

            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (-[WebAccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
            (-[WebAccessibilityObjectWrapper _accessibilitySetValue:forAttribute:]):

2015-09-11  Babak Shafiei  <bshafiei@apple.com>

        Merge r189483.

    2015-09-07  Chris Fleizach  <cfleizach@apple.com>

            AX: Mavericks: Text cursor does not move along with VoiceOver cursor for text fields
            https://bugs.webkit.org/show_bug.cgi?id=148891

            Reviewed by Mario Sanchez Prada.

            Undo the asynchronous dispatch of accessibility setting values on pre El Capitan machines
            because it causes focus to not sync correctly.

            Test: accessibility/mac/focus-moves-cursor.html

            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (-[WebAccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
            (-[WebAccessibilityObjectWrapper _accessibilitySetValue:forAttribute:]):

2015-09-10  Babak Shafiei  <bshafiei@apple.com>

        Merge r189469.

    2015-09-07  Daniel Bates  <dabates@apple.com>

            ASSERT_WITH_SECURITY_IMPLICATION in WebCore::DocumentOrderedMap::get(); update form
            association after subtree insertion
            https://bugs.webkit.org/show_bug.cgi?id=148919
            <rdar://problem/21868036>

            Reviewed by Andy Estes.

            Currently we update the form association of a form control upon insertion into
            the document. Instead we should update the form association of a form control
            after its containing subtree is inserted into the document to avoid an assertion
            failure when the containing subtree has an element whose id is identical to both
            the id of some other element in the document and the name of the form referenced
            by the inserted form control.

            Tests: fast/forms/update-form-owner-in-moved-subtree-assertion-failure-2.html
                   fast/forms/update-form-owner-in-moved-subtree-assertion-failure-3.html
                   fast/forms/update-form-owner-in-moved-subtree-assertion-failure-4.html
                   fast/forms/update-form-owner-in-moved-subtree-assertion-failure.html

            * html/FormAssociatedElement.cpp:
            (WebCore::FormAssociatedElement::insertedInto): Moved resetFormOwner() from here
            to {HTMLFormControlElement, HTMLObjectElement}::finishedInsertingSubtree().
            * html/HTMLFormControlElement.cpp:
            (WebCore::HTMLFormControlElement::insertedInto): Return InsertionShouldCallFinishedInsertingSubtree
            so that HTMLFormControlElement::finishedInsertingSubtree() is called.
            (WebCore::HTMLFormControlElement::finishedInsertingSubtree): Added; turn around and
            call FormAssociatedElement::resetFormOwner().
            * html/HTMLFormControlElement.h:
            * html/HTMLInputElement.cpp:
            (WebCore::HTMLInputElement::insertedInto): Return InsertionShouldCallFinishedInsertingSubtree so
            that HTMLInputElement::finishedInsertingSubtree() is called and move logic to update radio button
            group from here...
            (WebCore::HTMLInputElement::finishedInsertingSubtree): to here.
            * html/HTMLInputElement.h:
            * html/HTMLObjectElement.cpp:
            (WebCore::HTMLObjectElement::insertedInto): Return InsertionShouldCallFinishedInsertingSubtree so
            that HTMLObjectElement::finishedInsertingSubtree() is called.
            (WebCore::HTMLObjectElement::finishedInsertingSubtree): Added; turn around and
            call FormAssociatedElement::resetFormOwner().
            * html/HTMLObjectElement.h:
            * html/HTMLSelectElement.cpp:
            (WebCore::HTMLSelectElement::insertedInto): Modified to return the result of
            HTMLFormControlElementWithState::insertedInto(), which may schedule a callback after subtree
            insertion.
            * html/HTMLTextFormControlElement.cpp:
            (WebCore::HTMLTextFormControlElement::insertedInto): Ditto.

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r189167.

    2015-08-31  Enrica Casucci  <enrica@apple.com>

            Incorrect cursor movement for U+26F9, U+1F3CB with variations.
            https://bugs.webkit.org/show_bug.cgi?id=148629
            rdar://problem/22492366

            Reviewed by Ryosuke Niwa.

            Updating text break iterator rules to correctly handle those two emoji with variations.

            * platform/text/TextBreakIterator.cpp:
            (WebCore::cursorMovementIterator):

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r189101.

    2015-08-28  Brady Eidson  <beidson@apple.com>

            Use new CFNetwork cookie jar SPI only on El Capitan.
            https://bugs.webkit.org/show_bug.cgi?id=148574 and rdar://problem/22460752

            Reviewed by David Kilzer.

            * platform/network/mac/CookieJarMac.mm:
            (WebCore::setCookiesFromDOM): Use OS X version to decide which API/SPI to use.
            * platform/spi/cf/CFNetworkSPI.h: Forward declare the SPI

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r188659.

    2015-08-19  Brent Fulgham  <bfulgham@apple.com>

            Scrollable area container is not properly cleared when page is going into the PageCache
            https://bugs.webkit.org/show_bug.cgi?id=148182
            <rdar://problem/21969170>

            Reviewed by Dean Jackson.

            Must be tested manually going back and forth in history several times.

            * history/CachedFrame.cpp:
            (WebCore::CachedFrame::CachedFrame): Clear the cached ScrollableAreas from the FrameView.
            * page/FrameView.cpp:
            (WebCore::FrameView::clearScrollableAreas): Added.
            * page/FrameView.h:

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r188370.

    2015-08-12  Brent Fulgham  <bfulgham@apple.com>

            Move RenderBox-specific Scroll Snap code from RenderElement to RenderBox
            https://bugs.webkit.org/show_bug.cgi?id=147963

            Reviewed by Simon Fraser.

            No new tests: No change in functionality.

            * rendering/RenderBox.cpp:
            (WebCore::RenderBox::styleWillChange): Remove RenderBox-specific code.
            (WebCore::RenderBox::willBeRemovedFromTree): Ditto.
            * rendering/RenderBox.h:
            * rendering/RenderElement.cpp:
            (WebCore::RenderElement::styleWillChange): Move code from RenderElement to
            handle Scroll Snap Points.
            (WebCore::RenderElement::willBeRemovedFromTree): Added new override to handle
            scroll-snap point logic.

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r188340.

    2015-08-12  Brent Fulgham  <bfulgham@apple.com>

            REGRESSION(r185606): ASSERT in WebCore::RenderElement::styleWillChange
            https://bugs.webkit.org/show_bug.cgi?id=147596
            <rdar://problem/21963355>

            Reviewed by Jon Honeycutt.

            Only add (or remove) a RenderElement from the container of RenderBoxes with
            scroll snap coordinates if the element actually is a RenderBox.

            Tested by css3/scroll-snap/improper-snap-points-crash.html.

            * rendering/RenderElement.cpp:
            (WebCore::RenderElement::styleWillChange):
            (WebCore::RenderElement::willBeRemovedFromTree):

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r188271.

    2015-08-11  Said Abou-Hallawa  <sabouhallawa@apple.com>

            feMorphology is not rendered correctly on Retina display
            https://bugs.webkit.org/show_bug.cgi?id=147589

            Reviewed by Dean Jackson.

            The result ImageBuffer of any FilterEffect is already scaled up for 2x
            display. The FEMorphology needs to fix its painting data dimension and
            radius by multiplying them by the filter scale factor.

            Test: fast/hidpi/filters-morphology.html

            * platform/graphics/filters/FEMorphology.cpp:
            (WebCore::FEMorphology::platformApplySoftware):

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r188014.

    2015-08-05  Chris Dumez  <cdumez@apple.com>

            Crash when removing children of a MathMLSelectElement
            https://bugs.webkit.org/show_bug.cgi?id=147704
            <rdar://problem/21940321>

            Reviewed by Ryosuke Niwa.

            When MathMLSelectElement::childrenChanged() is called after its
            children have been removed, MathMLSelectElement calls
            updateSelectedChild() which accesses m_selectedChild. However,
            in this case, m_selectedChild is the previously selected child
            and it may be destroyed as this point if it was removed. To avoid
            this problem, MathMLSelectElement now keep a strong ref to the
            currently selected element.

            Test: mathml/maction-removeChild.html

            * mathml/MathMLSelectElement.h:

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r187564.

    2015-07-29  Zalan Bujtas  <zalan@apple.com>

            Remove the spanner placeholder from m_spannerMap when the placeholder object
            gets transferred to a descendant flow.
            https://bugs.webkit.org/show_bug.cgi?id=147380
            rdar://problem/21981078

            Reviewed by David Hyatt.

            Before r180328, the spanner placeholder was removed from m_spannerMap through
            RenderMultiColumnFlowThread::removeFlowChildInfo() by calling flowThreadRelativeWillBeRemoved()
            when the placeholder renderer got transferred to the descendant flow.
            Now we just remove it from the map when the renderer is being detached.

            Test: fast/multicol/newmulticol/spanner-crash-with-embedded-columns.html

            * rendering/RenderMultiColumnFlowThread.cpp:
            (WebCore::RenderMultiColumnFlowThread::flowThreadDescendantInserted):

2015-09-03  Babak Shafiei  <bshafiei@apple.com>

        Merge r186984.

    2015-07-17  Zalan Bujtas  <zalan@apple.com>

            REGRESSION (r169105): Do not assign a renderer to multiple selection subtrees.
            https://bugs.webkit.org/show_bug.cgi?id=147038
            rdar://problem/21819351

            Reviewed by David Kilzer.

            A renderer should never be assigned to multiple selection subtrees. (Currently RenderObject maintains the last selection state.)
            RenderView::applySubtreeSelection() loops from the start to the end of the selection to find renderers that are inside the selection.
            However, in case of regions (when multiple selection roots are present) traversing the renderer tree by calling RenderObject::nextInPreOrder() could
            end up going across selection roots.
            This patch ensures that we assign renderers to a specific selection only when the current selection root and the renderer's selection root match.

            Test: fast/regions/crash-when-renderer-is-in-multiple-selection-subtrees2.html

            * rendering/RenderView.cpp:
            (WebCore::SelectionIterator::SelectionIterator):
            (WebCore::SelectionIterator::current):
            (WebCore::SelectionIterator::checkForSpanner):
            (WebCore::RenderView::applySubtreeSelection):

2015-08-28  Babak Shafiei  <bshafiei@apple.com>

        Merge r189024.

    2015-08-27  Enrica Casucci  <enrica@apple.com>

            Add some new emoji with modifiers and new sequence.
            https://bugs.webkit.org/show_bug.cgi?id=148202
            rdar://problem/21849857

            Reviewed by Sam Weinig.

            Adding support for some new emoji with modifiers and
            one new emoji sequence.

            * platform/graphics/FontCascade.cpp:
            (WebCore::FontCascade::characterRangeCodePath):
            * platform/text/CharacterProperties.h:
            (WebCore::isEmojiGroupCandidate):
            (WebCore::isEmojiModifier):
            * platform/text/TextBreakIterator.cpp:
            (WebCore::cursorMovementIterator):

2015-08-21  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188769. rdar://problem/22354983

    2015-08-21  Doug Russell  <d_russell@apple.com>

            AX: Table with CSS that makes a row anonymous can return NULL from cellForColumnAndRow
            https://bugs.webkit.org/show_bug.cgi?id=148293

            Reviewed by Chris Fleizach.

            When RenderTableRows are anonymous, they may not be added to the accessible data
            table's internal row list. However, when calculating the row range for a cell,
            we were still accounting for those anonymous sections.
            Change how the row range is calculated to directly ask the accessible parent row
            for its index. This will ensure it’s more inline with what’s being represented to
            the accessibility API.

            Test: accessibility/aria-table-content.html

            * accessibility/AccessibilityTableCell.cpp:
            (WebCore::AccessibilityTableCell::parentRow):
            (WebCore::AccessibilityTableCell::rowIndexRange):
            * accessibility/AccessibilityTableCell.h:

2015-08-21  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188765. rdar://problem/22356782

    2015-08-21  Beth Dakin  <bdakin@apple.com>

            HistoryItems will null CachedPages should never be left in the list of items;
            causes crash
            https://bugs.webkit.org/show_bug.cgi?id=148237
            -and corresponding-
            rdar://problem/22356782

            Reviewed by Brady Eidson.

            Setting the CachedPage to nullptr will destroy the CachedPage, destroy the
            FrameView, re-enter layout, and potentially try to modify items in the PageCache
            based on that layout. So, we should not modify CachedPage in this way while the
            item is still in the list of HistoryItems.
            * history/PageCache.cpp:
            (WebCore::PageCache::take):
            (WebCore::PageCache::remove):
            (WebCore::PageCache::prune):

2015-08-17  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188531. rdar://problem/22308554

    2015-08-17  Andy Estes  <aestes@apple.com>

            REGRESSION (r188486): Crash in SubresourceLoader::didReceiveResponse() when TemporaryChange goes out of scope
            https://bugs.webkit.org/show_bug.cgi?id=148082

            Reviewed by Alexey Proskuryakov.

            Covered by existing tests run under ASan or Guard Malloc.

            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::didReceiveResponse): Ensure that callingDidReceiveResponse is destroyed while the
            SubresourceLoader is still alive by declaring it after protect.

2015-08-14  Babak Shafiei  <bshafiei@apple.com>

        Merge r188486.

    2015-08-13  Andy Estes  <aestes@apple.com>

            [Cocoa] Downloads do not start if policy decision is made asynchronously
            https://bugs.webkit.org/show_bug.cgi?id=147985

            Reviewed by Brady Eidson.

            It's only possible to convert a NSURLConnection to a download while the connection delegate's
            -connection:didReceiveResponse: is being called. However, WebKit clients can decide content policy
            asynchronously. If a client chooses to download a response asynchronously, we can no longer convert the
            connection to a download, so we should start a new download instead.

            New API test: _WKDownload.AsynchronousDownloadPolicy

            * dom/Document.cpp: Updated to include SubresourceLoader.h.
            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::mainResourceLoader): Updated to return a SubresourceLoader.
            (WebCore::DocumentLoader::continueAfterContentPolicy): Cast mainResourceLoader() to a ResourceLoader since
            didFail() is private in SubresourceLoader.
            * loader/DocumentLoader.h:
            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::SubresourceLoader): Initialized m_callingDidReceiveResponse to false.
            (WebCore::SubresourceLoader::didReceiveResponse): Used TemporaryChange<> to set m_callingDidReceiveResponse to true.
            * loader/SubresourceLoader.h:
            * loader/appcache/ApplicationCacheHost.cpp: Updated to include SubresourceLoader.h.
            * loader/mac/DocumentLoaderMac.cpp: Ditto.

2015-08-13  Babak Shafiei  <bshafiei@apple.com>

        Merge r188416.

    2015-08-13  Jer Noble  <jer.noble@apple.com>

            Don't short circuit seeking
            https://bugs.webkit.org/show_bug.cgi?id=147892

            Reviewed by Eric Carlson.

            When two seekWithTolerance() requests come in before the first is acted upon in seekTask(),
            the second will result in a "no seek required" conditional, because the new "currentTime" is
            assumed to be the destination time of the first seek.

            When cancelling a pending seek, first replace the "now" value with the "now" value from the
            replaced seek, thus preserving the original currentTime across all replacement seeks.

            Drive-by fix: some added logging causes occasional crashes, due to the underlying object being
            accessed having been deleted.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::seekWithTolerance):
            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::seekToTime):

2015-08-13  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188390. rdar://problem/21367467

    2015-08-13  Eric Carlson  <eric.carlson@apple.com>

            Don't short circuit seeking
            https://bugs.webkit.org/show_bug.cgi?id=147892

            Reviewed by Jer Noble.

            Test: media/video-seek-to-current-time.html

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::prepareForLoad): Call clearSeeking.
            (WebCore::HTMLMediaElement::fastSeek): Add logging.
            (WebCore::HTMLMediaElement::seekWithTolerance): Add logging. Set m_pendingSeekType.
            (WebCore::HTMLMediaElement::seekTask):  Call clearSeeking. Don't short circuit a
              if the current or pending seek is a fast seek. Set m_seeking to true immediately
              before calling media engine as it may have been cleared before the seek task
              queue ran.
            (WebCore::HTMLMediaElement::clearSeeking): New.
            * html/HTMLMediaElement.h:
            * html/HTMLMediaElementEnums.h:

            * platform/GenericTaskQueue.h:
            (WebCore::GenericTaskQueue::enqueueTask): Clear m_pendingTasks.

            * platform/graphics/avfoundation/MediaPlayerPrivateAVFoundation.cpp:
            (WebCore::MediaPlayerPrivateAVFoundation::seekWithTolerance): Don't return early
              when asked to seek to the current time.
            (WebCore::MediaPlayerPrivateAVFoundation::invalidateCachedDuration): Remove some
              extremely noisy logging.

            * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
            (WebCore::MediaPlayerPrivateAVFoundationObjC::seekToTime): Add logging.

2015-08-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188263. rdar://problem/22202935

2015-08-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188203. rdar://problem/22026625

    2015-08-09  Nan Wang  <n_wang@apple.com>

            AX: CSS table display styles can cause malformed, inaccessible AXTables to be exposed to the AX tree
            https://bugs.webkit.org/show_bug.cgi?id=136415
            <rdar://problem/22026625>

            Reviewed by Chris Fleizach.

            Applying CSS display styles to tables can end up inserting anonymous RenderTableRows, which is not handled well by the
            accessibility code, which treats these as the actual rows. We can address this by diving deeper into anonymous nodes
            and finding the real rows and cells we want. In addition, another thing also causing malformed tables is that "grid"
            roles are being exposed as AXGrid instead of AXTable.

            Test: accessibility/mac/malformed-table.html

            * accessibility/AccessibilityARIAGrid.cpp:
            (WebCore::AccessibilityARIAGrid::addRowDescendant):
            * accessibility/AccessibilityTable.cpp:
            (WebCore::AccessibilityTable::addChildren):
            (WebCore::AccessibilityTable::addTableCellChild):
            (WebCore::AccessibilityTable::addChildrenFromSection):
            * accessibility/AccessibilityTable.h:
            * accessibility/AccessibilityTableCell.cpp:
            (WebCore::AccessibilityTableCell::parentTable):
            (WebCore::AccessibilityTableCell::rowIndexRange):
            * accessibility/AccessibilityTableRow.cpp:
            (WebCore::AccessibilityTableRow::parentTable):
            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (createAccessibilityRoleMap):

2015-08-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188243. rdar://problem/22102378

    2015-08-10  Myles C. Maxfield  <mmaxfield@apple.com>

            Post-review fixup after r188195
            https://bugs.webkit.org/show_bug.cgi?id=147806

            Unreviewed.

            Covered by fast/text/crash-obscure-text.html.

            * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
            (WebCore::FontPlatformData::objectForEqualityCheck):

2015-08-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188195. rdar://problem/22102378

    2015-08-09  Myles C. Maxfield  <mmaxfield@apple.com>

            Crash in ComplexTextController when laying out obscure text
            https://bugs.webkit.org/show_bug.cgi?id=147806
            <rdar://problem/22102378>

            Reviewed by Darin Adler.

            CTFontDescriptorCopyAttribute(fontDescriptor.get(), kCTFontReferenceURLAttribute) can return nullptr.

            Test: fast/text/crash-obscure-text.html

            * platform/graphics/mac/ComplexTextControllerCoreText.mm:
            (WebCore::safeCFEqual):
            (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):

2015-08-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r188263. rdar://problem/22202935

    2015-08-11  Myles C. Maxfield  <mmaxfield@apple.com>

            [iOS] Arabic letter Yeh is drawn in LastResort
            https://bugs.webkit.org/show_bug.cgi?id=147862
            <rdar://problem/22202935>

            Reviewed by Darin Adler.

            In order to perform font fallback, we must know which fonts support which characters. We
            perform this check by asking each font to map a sequence of codepoints to glyphs, and
            any glyphs which end up with a 0 value are unsupported by the font.

            One of the mechanisms that we use to do this is to combine the code points into a string,
            and tell Core Text to lay out the string. However, this is fundamentally a different
            operation than the one we are trying to perform. Strings combine adjacent codepoints into
            grapheme clusters, and CoreText operates on these. However, we are trying to gain
            information regarding codepoints, not grapheme clusters.

            Instead of taking this string-based approach, we should try harder to use Core Text
            functions which operate on ordered collections of characters, rather than strings. In
            particular, CTFontGetGlyphsForCharacters() and CTFontGetVerticalGlyphsForCharacters()
            have the behavior we want where any unmapped characters end up with a 0 value glyph.

            Previously, we were only using the result of those functions if they were successfully
            able to map their entire input. However, given the fact that we can degrade gracefully
            in the case of a partial mapping, we shouldn't need to bail completely to the
            string-based approach should a partial mapping occur.

            At some point we should delete the string-based approach entirely. However, this path
            is still explicitly used for composite fonts. Fixing that use case is out of scope
            for this patch.

            Test: fast/text/arabic-glyph-cache-fill-combine.html

            * platform/graphics/mac/GlyphPageMac.cpp:
            (WebCore::GlyphPage::fill):

2015-08-11  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187758. rdar://problem/22095006

    2015-08-03  Anders Carlsson  <andersca@apple.com>

            Safari is failing to remove SQLite Databases via Remove All Website Data
            https://bugs.webkit.org/show_bug.cgi?id=147584
            rdar://problem/22095006

            Reviewed by Brady Eidson.

            If we end up deleting every single database for an origin, make sure to also delete the origin.

            * Modules/webdatabase/DatabaseTracker.cpp:
            (WebCore::DatabaseTracker::deleteDatabasesModifiedSince):

2015-08-10  Dana Burkart  <dburkart@apple.com>

        Merge r188182. rdar://problem/21254835

    2015-08-07  James Craig  <jcraig@apple.com>

            REGRESSION(r184722) AX: WebKit video playback toolbar removed from DOM; no longer accessible to VoiceOver
            https://bugs.webkit.org/show_bug.cgi?id=145684

            Reviewed by Dean Jackson.

            Updated Apple Video controls to add an invisible but focusable button that allows VoiceOver
            users (and when unblocked, keyboard users) to re-display the video controls.

            Test: media/video-controls-show-on-kb-or-ax-event.html

            * English.lproj/mediaControlsLocalizedStrings.js:
            * Modules/mediacontrols/mediaControlsApple.css:
            (audio::-webkit-media-show-controls):
            (video::-webkit-media-show-controls):
            * Modules/mediacontrols/mediaControlsApple.js:
            (Controller.prototype.createControls):
            (Controller.prototype.handleFullscreenChange):
            (Controller.prototype.handleShowControlsClick):
            (Controller.prototype.handleWrapperMouseMove):
            (Controller.prototype.updateForShowingControls):
            (Controller.prototype.showControls):
            (Controller.prototype.hideControls):
            (Controller.prototype.setNeedsUpdateForDisplayedWidth):
            * Modules/mediacontrols/mediaControlsiOS.css:
            (audio::-webkit-media-show-controls):
            (video::-webkit-media-show-controls):

2015-08-10  Dana Burkart  <dburkart@apple.com>

        Merge r188196. rdar://problem/22192773

    2015-08-09  Eric Carlson  <eric.carlson@apple.com>

            [Mac] Always require ExternalDeviceAutoPlayCandidate flag to AirPlay automatically
            https://bugs.webkit.org/show_bug.cgi?id=147801

            Reviewed by Dean Jackson.

            Test: http/tests/media/video-media-document-disposition-download.html

            * Modules/mediasession/WebMediaSessionManager.cpp:
            (WebCore::WebMediaSessionManager::configurePlaybackTargetClients): Don't tell the last element
              to begin playing to the target unless the ExternalDeviceAutoPlayCandidate flag is set and
              it is not currently playing.

2015-08-10  Dana Burkart  <dburkart@apple.com>

        Merge r188190. rdar://problem/22191482

    2015-08-08  Commit Queue  <commit-queue@webkit.org>

            Unreviewed, rolling out r179871.
            https://bugs.webkit.org/show_bug.cgi?id=147810

            Breaks product images on http://www.apple.com/shop/buy-
            mac/macbook (Requested by smfr on #webkit).

            Reverted changeset:

            "Render: properly update body's background image"
            https://bugs.webkit.org/show_bug.cgi?id=140183
            http://trac.webkit.org/changeset/179871

2015-08-06  Dana Burkart  <dburkart@apple.com>

        Merge r187962. rdar://problem/21827815

    2015-08-05  Daniel Bates  <dabates@apple.com>

            REGRESSION (r185111): Clicking phone numbers doesn't prompt to call sometimes
            https://bugs.webkit.org/show_bug.cgi?id=147678
            <rdar://problem/21827815>

            Reviewed by Brady Eidson.

            Fixes an issue where a non-user-initiated navigation of the main frame to a phone link (tel URL)
            may be ignored. The navigation is ignored if the page was reloaded as a result of a web content
            process crash, its lifetime exceeded the back-forward cache expiration interval, or a person
            quits and opens Safari again, among other scenarios.

            * history/HistoryItem.cpp:
            (WebCore::HistoryItem::setShouldOpenExternalURLsPolicy): Added.
            (WebCore::HistoryItem::shouldOpenExternalURLsPolicy): Added.
            * history/HistoryItem.h:
            * loader/FrameLoader.cpp:
            (WebCore::FrameLoader::loadDifferentDocumentItem): Apply the "should open external URLs" policy
            from the history item, if applicable. Also, be more explicit when instantiating a NavigationAction
            so as to help make it straightforward to reduce the number of NavigationAction constructors we have
            in the future.
            * loader/HistoryController.cpp:
            (WebCore::HistoryController::saveDocumentState): Save the "should open external URLs" policy to
            the history item.
            (WebCore::HistoryController::restoreDocumentState): Apply the "should open external URLs" policy
            from the history item to the document loader.
            (WebCore::HistoryController::initializeItem): Update the "should open external URLs" policy of
            the history item to reflect the policy of the document loader associated with the current frame.

2015-08-06  Dana Burkart  <dburkart@apple.com>

        Merge r187935. rdar://problem/22097682

    2015-08-04  Doug Russell  <d_russell@apple.com>

            AX: tree item children returned from ranged getter are different from full array of children
            https://bugs.webkit.org/show_bug.cgi?id=147660

            Reviewed by Chris Fleizach.

            Add an isTreeItem() check in ranged element getter so that it matches the logic in
            the getter for the full children array. This prevents returning a row as a child
            when only the rows contents should be returned. This prevents navigation issues on
            websites without aria outlines.

            Test: accessibility/mac/aria-tree-item-children.html

            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
            (-[WebAccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):

2015-08-06  Dana Burkart  <dburkart@apple.com>

        Merge r187930. rdar://problem/21870332

    2015-08-04  Brent Fulgham  <bfulgham@apple.com>

            REGRESSION (r173784): [Mac] Correct latching error for non-scrollable iframe nested inside scrollable div.
            https://bugs.webkit.org/show_bug.cgi?id=147668
            <rdar://problem/21870332>

            Reviewed by Simon Fraser.

            Test: platform/mac/fast/scrolling/scroll-div-with-nested-nonscrollable-iframe.html

            When we are wrapping up processing of the wheel event for a given frame, if the current latching context
            does NOT apply to the current frame (e.g., because it's latched to an enclosing frame) we should not pass
            wheel events directly to the latched elements scrollable container. Instead, we should just give the current
            frame an opportunity to perform any custom wheel event handling and return, so that the enclosing (latched)
            frame can do the rest of its event handling.

            If we don't do this, we incorrectly ask the enclosing frame to process the event, then return claiming that
            we handled the event, preventing the enclosing frame from doing its part of the processing.

            * page/mac/EventHandlerMac.mm:
            (WebCore::EventHandler::platformCompleteWheelEvent):

2015-08-06  Dana Burkart  <dburkart@apple.com>

        Merge r187892. rdar://problem/21932187

    2015-08-04  Eric Carlson  <eric.carlson@apple.com>

            [Mac] Do not require a video track for AirPlay
            https://bugs.webkit.org/show_bug.cgi?id=147647

            Reviewed by Jer Noble.

            * Modules/mediacontrols/mediaControlsApple.js:
            (Controller.prototype.handleReadyStateChange): Call updateWirelessTargetAvailable().
            (Controller.prototype.updateHasVideo): Don't call updateWirelessTargetAvailable().
            (Controller.prototype.updateWirelessTargetAvailable): Don't require video.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::setReadyState): Call updateMediaState when we reach HAVE_METADATA.
            (WebCore::HTMLMediaElement::mediaState): Don't require video, only that the file can play.

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::showPlaybackTargetPicker): Check readyState instead of hasVideo.

2015-08-06  Dana Burkart  <dburkart@apple.com>

        Merge r187886. rdar://problem/15779101

    2015-08-04  Alexey Proskuryakov  <ap@apple.com>

            Implement NPAPI redirect handling
            https://bugs.webkit.org/show_bug.cgi?id=138675
            rdar://problem/15779101

            Patch by Jeffrey Pfau, updated and tweaked by me.

            Reviewed by Anders Carlsson.

            Test: http/tests/plugins/get-url-redirect-notify.html

            * loader/NetscapePlugInStreamLoader.cpp:
            (WebCore::NetscapePlugInStreamLoader::init):
            (WebCore::NetscapePlugInStreamLoader::willSendRequest):
            (WebCore::NetscapePlugInStreamLoader::didReceiveResponse):
            * loader/NetscapePlugInStreamLoader.h:
            * loader/ResourceLoader.cpp:
            (WebCore::ResourceLoader::init):
            (WebCore::ResourceLoader::isSubresourceLoader):
            (WebCore::ResourceLoader::willSendRequestInternal):
            (WebCore::ResourceLoader::willSendRequest):
            (WebCore::ResourceLoader::didSendData):
            * loader/ResourceLoader.h:
            * loader/SubresourceLoader.cpp:
            (WebCore::SubresourceLoader::isSubresourceLoader):
            (WebCore::SubresourceLoader::willSendRequestInternal):
            (WebCore::SubresourceLoader::willSendRequest): Deleted.
            * loader/SubresourceLoader.h:
            * plugins/npapi.h:
            * plugins/npfunctions.h:

2015-08-06  Dana Burkart  <dburkart@apple.com>

        Merge r187693. rdar://problem/22047626

    2015-07-31  Myles C. Maxfield  <mmaxfield@apple.com>

            [Cocoa] Latin quotes are used with the system font on Chinese devices
            https://bugs.webkit.org/show_bug.cgi?id=147504

            Reviewed by Dean Jackson.

            The system font has some fancy logic regarding character selection which requires
            using Core Text for glyph selection.

            No new tests because tests can't change the system language of the device.

            * platform/graphics/mac/GlyphPageMac.cpp:
            (WebCore::shouldUseCoreText):

2015-08-06  Dana Burkart  <dburkart@apple.com>

        Merge r187622. rdar://problem/15779101

    2015-07-30  Anders Carlsson  <andersca@apple.com>

            Remove stray printf.

            * loader/SubframeLoader.cpp:
            (WebCore::SubframeLoader::requestObject):

2015-08-06  Dana Burkart  <dburkart@apple.com>

        Merge r187620. rdar://problem/15779101

    2015-07-30  Anders Carlsson  <andersca@apple.com>

            Assertion failure when a plug-in loads a resource that redirects somewhere
            https://bugs.webkit.org/show_bug.cgi?id=147469

            Reviewed by Alexey Proskuryakov.

            Test: http/tests/plugins/get-url-redirect.html

            r186597 moved the call to addPlugInStreamLoader to willSendRequest. This is wrong since
            willSendRequest can be invoked more than once.

            Fix this by making the initialization phase of NetscapePlugInStreamLoader be more like
            SubresourceLoader where we only call addPlugInStreamLoader once we've successfully initialized
            the loader, and only call removePlugInStreamLoader if we've called addPlugInStreamLoader.

            Also change addPlugInStreamLoader and removePlugInStreamLoader to take references.

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::addPlugInStreamLoader):
            (WebCore::DocumentLoader::removePlugInStreamLoader):
            * loader/DocumentLoader.h:
            * loader/NetscapePlugInStreamLoader.cpp:
            (WebCore::NetscapePlugInStreamLoader::create):
            (WebCore::NetscapePlugInStreamLoader::init):
            (WebCore::NetscapePlugInStreamLoader::didFinishLoading):
            (WebCore::NetscapePlugInStreamLoader::didFail):
            (WebCore::NetscapePlugInStreamLoader::didCancel):
            (WebCore::NetscapePlugInStreamLoader::notifyDone):
            * loader/NetscapePlugInStreamLoader.h:
            * loader/ResourceLoader.cpp:
            (WebCore::ResourceLoader::willSendRequest): Deleted.
            * loader/ResourceLoader.h:
            (WebCore::ResourceLoader::isPlugInStreamLoader): Deleted.
            * loader/SubframeLoader.cpp:
            (WebCore::SubframeLoader::requestObject):

2015-08-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187805. rdar://problem/21838271

    2015-08-03  Myles C. Maxfield  <mmaxfield@apple.com>

            Clean up casts between NSFont*s and CTFontRefs
            https://bugs.webkit.org/show_bug.cgi?id=147618

            Reviewed by Mitz Pettel.

            For toll free bridged types, it makes more sense to do a C-style cast, than jump
            through hoops for older compilers.

            No new tests because there is no behavior change.

            * platform/graphics/FontPlatformData.h:
            (WebCore::FontPlatformData::nsFont):
            (WebCore::FontPlatformData::hash):

2015-08-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187807. rdar://problem/21838271

    2015-08-03  Myles C. Maxfield  <mmaxfield@apple.com>

            Fix crashing Mavericks test

            Unreviewed.

            * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
            (WebCore::FontPlatformData::registeredFont):

2015-08-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187776. rdar://problem/21925990

    2015-08-03  Eric Carlson  <eric.carlson@apple.com>

            [Mac] Always require user gesture to begin playing to AppleTV automatically
            https://bugs.webkit.org/show_bug.cgi?id=147591

            Reviewed by Jer Noble.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::mediaState): Don't set the ExternalDeviceAutoPlayCandidate
              flag until the user has explicitly triggered playback.

2015-08-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187806. rdar://problem/21838271

    2015-08-03  Myles C. Maxfield  <mmaxfield@apple.com>

            Unreviewed post-review feedback on r187797

            The correct terminology is "registered" instead of "activated."

            No new tests because there is no behavior change.

            * platform/graphics/FontPlatformData.h:
            * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
            (WebCore::FontPlatformData::registeredFont):
            (WebCore::FontPlatformData::activatedFont): Deleted.

2015-08-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187797. rdar://problem/21838271

    2015-08-03  Myles C. Maxfield  <mmaxfield@apple.com>

            REGRESSION(r184899): Crash when focusing an input element styled with a web font
            https://bugs.webkit.org/show_bug.cgi?id=147616
            <rdar://problem/21838271>

            Reviewed by Dean Jackson.

            NSFontManager can't handle web fonts. We used to pass null to NSFontManager in this case,
            but r184899 changed that.

            Test: fast/text/input-webfont-focus.html

            * platform/graphics/FontPlatformData.h:
            * platform/graphics/cocoa/FontPlatformDataCocoa.mm:
            (WebCore::FontPlatformData::activatedFont):

2015-08-04  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187792. rdar://problem/22116575

    2015-08-03  Tim Horton  <timothy_horton@apple.com>

            REGRESSION (r186916): TextIndicators for multiline link previews are unreadable/offset/blank
            https://bugs.webkit.org/show_bug.cgi?id=147615
            <rdar://problem/22116575>

            Reviewed by Dean Jackson.

            * page/mac/TextIndicatorWindow.mm:
            (-[WebTextIndicatorView initWithFrame:textIndicator:margin:offset:]):
            No need to offset by the difference between the text bounding rect and the selection bounding rect,
            because the snapshot is now (after r186916) taken of exactly the text bounding rect.

2015-08-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187691. rdar://problem/22060183

    2015-07-31  Chris Dumez  <cdumez@apple.com>

            Coalesce authentication credential requests
            https://bugs.webkit.org/show_bug.cgi?id=128006
            <rdar://problem/16839069>

            Reviewed by Alexey Proskuryakov.

            Export symbol for ProtectionSpace::compare() so it can be called from
            WebKit2.

            * platform/network/ProtectionSpaceBase.h:

2015-08-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187685. rdar://problem/21775336

    2015-07-31  Myles C. Maxfield  <mmaxfield@apple.com>

            [SVG -> OTF Converter] Crash when converting Arabic fonts
            https://bugs.webkit.org/show_bug.cgi?id=147510

            Reviewed by Anders Carlsson.

            SVGToOTFFontConverter::compareCodepointsLexicographically() wasn't transitive.

            Test: fast/text/arabic-duplicate-glyph-font.html

            * svg/SVGToOTFFontConversion.cpp:
            (WebCore::SVGToOTFFontConverter::compareCodepointsLexicographically):

2015-08-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187545. rdar://problem/21893047

    2015-07-29  Dean Jackson  <dino@apple.com>

            Remove dispatch_apply_f and instead use vImage more directly
            https://bugs.webkit.org/show_bug.cgi?id=147391
            <rdar://problem/21893047>

            Fix the iOS builds.

            * platform/graphics/cg/ImageBufferDataCG.cpp:
            (WebCore::unpremultiplyBufferData):
            (WebCore::premultiplyBufferData):

2015-08-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187536. rdar://problem/21893047

    2015-07-28  Simon Fraser  <simon.fraser@apple.com>

            Fix debug builds.

            * platform/graphics/cg/ImageBufferDataCG.cpp:
            (WebCore::premultiplyBufferData):
            (WebCore::unpremultiplyBufferData):

2015-08-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187534. rdar://problem/21893047

    2015-07-28  Dean Jackson  <dino@apple.com>

            Remove dispatch_apply_f and instead use vImage more directly
            https://bugs.webkit.org/show_bug.cgi?id=147391
            <rdar://problem/21893047>

            Reviewed by Simon Fraser.

            Use vImage unmultiplication and premultiplication functions on the
            entire ImageBufferData object, rather than getting and setting data on an
            line by line using dispatch_apply.

            We were seeing some crashes in vImage with the smaller buffer sizes, and
            hopefully this will either fix the problem, or give us a better
            stack trace to diagnose.

            I also did a drive-by change of "dst" to "dest". It was inconsistent throughout
            the file.

            Convered by the tests in fast/canvas and imported/w3c/canvas

            * platform/graphics/cg/ImageBufferDataCG.cpp: Remove the ScanlineData structure. It is
            no longer needed.
            (WebCore::premultiplyBufferData): New function that calls vImagePremultiplyData_RGBA8888.
            (WebCore::unpremultiplyBufferData): New function that calls vImageUnpremultiplyData_RGBA8888.
            (WebCore::affineWarpBufferData): Extracting some common code into a function.
            (WebCore::ImageBufferData::getData): Use the two new functions as appropriate. Move
            some of the code around now that more is shared between the different #if branches.
            (WebCore::ImageBufferData::putData):
            (WebCore::convertScanline): Deleted.
            (WebCore::unpremultitplyScanline): Deleted.
            (WebCore::premultitplyScanline): Deleted.

2015-08-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187740. rdar://problem/22098457

    2015-08-03  Brady Eidson  <beidson@apple.com>

            Crash when signing into twitter calling WebCore::DocumentLoader::responseReceived(WebCore::CachedResource*, WebCore::ResourceResponse const&).
            <rdar://problem/22098457> and https://bugs.webkit.org/show_bug.cgi?id=147560

            Reviewed by Alexey Proskuryakov.

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::willSendRequest): Only grab identifierForLoadWithoutResourceLoader() if there's no ResourceLoader.

2015-08-03  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187466. rdar://problem/21960398

    2015-07-27  Brady Eidson  <beidson@apple.com>

            Crash in WebCore::DocumentLoader::willSendRequest() with ContentFilter and AppCache.
            <rdar://problem/21960398> and https://bugs.webkit.org/show_bug.cgi?id=147339

            Reviewed by Alexey Proskuryakov.

            No new tests (Not yet proven to be possible to test this).

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::willSendRequest): Grab the identifier from the CachedResource directly, not from the null ResourceLoader.
            (WebCore::DocumentLoader::continueAfterNavigationPolicy): Null check the ResourceLoader, as it can definitely be gone by this point.

            * loader/cache/CachedResource.cpp:
            (WebCore::CachedResource::clearLoader): Save off the identifier for later use.
            * loader/cache/CachedResource.h:
            (WebCore::CachedResource::identifierForLoadWithoutResourceLoader): Expose the identifier that the ResourceLoader had when it went away.

2015-07-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187675. rdar://problem/21632211

    2015-07-31  Jer Noble  <jer.noble@apple.com>

             CRASH at WebCore::TaskDispatcher<WebCore::ScriptExecutionContext>::postTask + 38
             https://bugs.webkit.org/show_bug.cgi?id=147485

             Rubber-stamped by Joseph Pecoraro.

             Follow-up test crash fix: call superclass's contextDestroyed() which allows the
             m_scriptExecutionContext variable to be cleared.

             * html/HTMLMediaElement.cpp:
             (WebCore::HTMLMediaElement::contextDestroyed):

2015-08-01  Babak Shafiei  <bshafiei@apple.com>

        Merge r187686.

    2015-07-31  Tim Horton  <timothy_horton@apple.com>

            [iOS] DOMNode preview snapshot rects are wrong for user-select: none links
            https://bugs.webkit.org/show_bug.cgi?id=147513
            <rdar://problem/22083354>

            Reviewed by Simon Fraser.

            * bindings/objc/DOM.mm:
            (-[DOMNode getPreviewSnapshotImage:andRects:]):
            Use the same code as WebKit2 to compute the fallback rect (if TextIndicator fails),
            asking the RenderObject (or RenderImage) for its bounding box instead of using the
            (often wrong) Range bounding rect.

            Make sure to use the fallback rect *any* time TextIndicator fails (before
            we would return no rects at all if TextIndicator::createWithRange returned null,
            and the fallback rect if it returned with an empty image).

            Inverse-page-scale the margin, to match the appearance in WebKit2.

2015-08-01  Babak Shafiei  <bshafiei@apple.com>

        Merge r187687.

    2015-07-31  Andreas Kling  <akling@apple.com>

            Crashes under HTMLMediaElement::updateActiveTextTrackCues() when destroying CachedPage.
            <https://webkit.org/b/147506>
            <rdar://problem/21939014>

            Reviewed by Chris Dumez.

            Don't mess with the media element's text tracks below its ActiveDOMObject::stop()
            implementation, since that may cause DOM mutations.

            I don't have a repro or a test for this, but plenty of crash logs to indicate that
            we're getting ourselves into trouble by modifying the DOM during CachedPage teardown.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::configureTextTrackDisplay):

2015-07-31  Babak Shafiei  <bshafiei@apple.com>

        Roll out r187466.

2015-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r187694.

    2015-07-31  Eric Carlson  <eric.carlson@apple.com>

            [iOS] use a media-specific user gesture check
            https://bugs.webkit.org/show_bug.cgi?id=147509

            Reviewed by Tim Horton.

            Change an enum name added in r187688.

            * dom/UserGestureIndicator.cpp:
            (WebCore::isDefinite): DefinitelyProcessingMediaUserGesture -> DefinitelyProcessingPotentialUserGesture
            (WebCore::UserGestureIndicator::processingUserGestureForMedia): Ditto.
            * dom/UserGestureIndicator.h: Ditto.

2015-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r187688.

    2015-07-31  Eric Carlson  <eric.carlson@apple.com>

            [iOS] use a media-specific user gesture check
            https://bugs.webkit.org/show_bug.cgi?id=147509

            Reviewed by Jer Noble.

            * bindings/js/ScriptController.cpp:
            (WebCore::ScriptController::processingUserGestureForMedia): New.
            * bindings/js/ScriptController.h:

            * dom/UserGestureIndicator.cpp:
            (WebCore::isDefinite): Allow DefinitelyProcessingMediaUserGesture.
            (WebCore::UserGestureIndicator::processingUserGestureForMedia): New.
            * dom/UserGestureIndicator.h:

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::load): Use ScriptController::processingUserGestureForMedia instead of 
              ScriptController::processingUserGesture
            (WebCore::HTMLMediaElement::play): Ditto.

2015-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r187684.

    2015-07-31  Jeremy Jones  <jeremyj@apple.com>

            Rename AVPlayerLayerView to _AVPlayerLayerView.
            https://bugs.webkit.org/show_bug.cgi?id=147399

            Reviewed by Eric Carlson.

            Change class name AVPlayerLayerView to match change in AVKit SPI. 
            This prevents conflicts with 3rd party apps.

            * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
            (WebAVPlayerLayerView_dealloc):
            (getWebAVPlayerLayerViewClass):
            * platform/spi/cocoa/AVKitSPI.h:

2015-07-31  Babak Shafiei  <bshafiei@apple.com>

        Merge r187675.

    2015-07-31  Jer Noble  <jer.noble@apple.com>

             CRASH at WebCore::TaskDispatcher<WebCore::ScriptExecutionContext>::postTask + 38
             https://bugs.webkit.org/show_bug.cgi?id=147485

             Rubber-stamped by Joseph Pecoraro.

             Follow-up test crash fix: call superclass's contextDestroyed() which allows the
             m_scriptExecutionContext variable to be cleared.

             * html/HTMLMediaElement.cpp:
             (WebCore::HTMLMediaElement::contextDestroyed):

2015-07-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187655. rdar://problem/21632211

    2015-07-31  Jer Noble  <jer.noble@apple.com>

            CRASH at WebCore::TaskDispatcher<WebCore::ScriptExecutionContext>::postTask + 38
            https://bugs.webkit.org/show_bug.cgi?id=147485

            Reviewed by Eric Carlson.

            CrashLogs indicate a use-after-free of the ScriptExecutionContext (i.e., Document) used by
            the GenericTaskQueue objects owned by HTMLMediaElement. When the ScriptExecutionContext
            notifies its ActiveDOMObjects that it is about to be destroyed, close() the
            GenericTaskQueues so that they can no longer accept new tasks.

            Previously, enqueueing a task on a closed GenericTaskQueue ASSERTed in debug builds, but
            silently succeeded in release builds. Calling enqueueTask() on a  closed GenericTaskQueue is
            now a no-op.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::contextDestroyed):
            * html/HTMLMediaElement.h:
            * platform/GenericTaskQueue.h:
            (WebCore::GenericTaskQueue::enqueueTask):

2015-07-31  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187630. rdar://problem/18835799

    2015-07-30  Andreas Kling  <akling@apple.com>

            [CF] Web process continually eating memory on simple, shared Google Docs spreadsheet.
            <https://webkit.org/b/147403>
            <rdar://problem/18835799>

            Reviewed by Geoffrey Garen.

            Make sure we service the CFRunLoop on worker threads, since ports using CoreFoundation
            will be scheduling garbage collections and heap sweeps using CFRunLoop timers.

            This fix is a stopgap. Long term we need a better design for integrating GC tasks with
            with the web worker run loop.

            * workers/WorkerRunLoop.cpp:
            (WebCore::WorkerRunLoop::runInMode): Instead of sleeping forever, calculate a better
            wakeup deadline by asking the CFRunLoop when its next timer will fire. Then, when a
            timeout occurs, call CFRunLoopRunInMode (with seconds=0) to service pending timers.

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187557

    2015-07-29  Brady Eidson  <beidson@apple.com>

            Crash in WebCore::DocumentLoader::stopLoadingForPolicyChange.
            <rdar://problem/21412186> and https://bugs.webkit.org/show_bug.cgi?id=147418

            Reviewed by Chris Dumez.

            No new tests (No known reproducibility)

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::responseReceived): When setting to m_waitingForContentPolicy true, make sure we have a FrameLoader.
            (WebCore::DocumentLoader::detachFromFrame): Always explicitly call cancelPolicyCheckIfNeeded().
            (WebCore::DocumentLoader::cancelPolicyCheckIfNeeded): Cancel the policy check if there is one.
            (WebCore::DocumentLoader::cancelMainResourceLoad): Use cancelPolicyCheckIfNeeded().
            * loader/DocumentLoader.h:

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187556

    2015-07-29  Brady Eidson  <beidson@apple.com>

            Crash calling webSocket.close() from onError handler for blocked web socket.
            <rdar://problem/21771620> and https://bugs.webkit.org/show_bug.cgi?id=147411

            Reviewed by Tim Horton.

            Tests: http/tests/security/mixedContent/websocket/insecure-websocket-in-iframe.html
                   http/tests/security/mixedContent/websocket/insecure-websocket-in-main-frame.html

            This was introduced with http://trac.webkit.org/changeset/185848

            * Modules/websockets/WebSocket.cpp:
            (WebCore::WebSocket::connect): When blocked because of mixedContent, call dispatchOrQueueErrorEvent().
            (WebCore::WebSocket::didReceiveMessageError): Use dispatchOrQueueErrorEvent() instead.
            (WebCore::WebSocket::dispatchOrQueueErrorEvent): Dispatch the error event, but don't dispatch one twice!
            * Modules/websockets/WebSocket.h:

            * Modules/websockets/WebSocketChannel.cpp:
            (WebCore::WebSocketChannel::fail): Null-check m_handshake before creating a console message from it.

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187535

    2015-07-28  Simon Fraser  <simon.fraser@apple.com>

            Animations sometimes fail to start
            https://bugs.webkit.org/show_bug.cgi?id=147394
            rdar://problem/21852603

            Reviewed by Dean Jackson.

            When an accelerated animation or transition was started at the same time as
            a non-accelerated one, and then the node for the former was removed, we could
            never kick off the non-accelerated animation.

            AnimationControllerPrivate has logic to synchronize the two types of animation
            when they start in the same animation update, which involves setting the
            m_waitingForAsyncStartNotification flag, and waiting for a notifyAnimationStarted()
            to come in from the graphics system.

            However, it failed to handle the case where the accelerated animation was removed
            before the callback was received, which left the m_waitingForAsyncStartNotification flag
            set to true, preventing the non-accelerated animation from running.

            Test: animations/remove-syncing-animation.html

            * page/animation/AnimationBase.h:
            (WebCore::AnimationBase::isAccelerated): Make this public.
            * page/animation/AnimationController.cpp:
            (WebCore::AnimationControllerPrivate::clear): Add logging.
            (WebCore::AnimationControllerPrivate::receivedStartTimeResponse): Add logging.
            (WebCore::AnimationControllerPrivate::animationWillBeRemoved): Add logging.
            After removing animations from the maps, check to see if we expect any of the
            remaining animations are waiting for a notifyAnimationStarted(). If not, clear
            the m_waitingForAsyncStartNotification flag.
            (WebCore::AnimationController::notifyAnimationStarted): Log the renderer.
            (WebCore::AnimationControllerPrivate::AnimationControllerPrivate): Remove unneeded
            initializations of HashMaps.
            * page/animation/CompositeAnimation.cpp:
            (WebCore::CompositeAnimation::updateTransitions): Log renderers.
            (WebCore::CompositeAnimation::updateKeyframeAnimations): Ditto.

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187525

    2015-07-28  Myles C. Maxfield  <mmaxfield@apple.com>

            [iOS] Crash when encountering characters whose natural font is one we can't look up
            https://bugs.webkit.org/show_bug.cgi?id=147377
            <rdar://problem/22022011>

            Reviewed by Simon Fraser.

            These characters hit the complex text code path, where CoreText picks fonts
            to use for each character. We then try to map these CoreText fonts back to
            our own Font objects, and we assume (on iOS) that our own font search will
            always return something.

            On OS X, we do not have such an assumption, and we handle the case where it
            does not hold. This method works on iOS as well, so the solution is to just
            perform it on both OSes.

            Test: fast/text/crash-complex-unknown-font.html

            * platform/graphics/mac/ComplexTextControllerCoreText.mm:
            (WebCore::ComplexTextController::collectComplexTextRunsForCharacters):

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187522

    2015-07-28  Said Abou-Hallawa  <sabouhallawa@apple.com>

            [iOS] REGRESSION(r168075): Fullscreen web video doesn't pause on screen lock
            https://bugs.webkit.org/show_bug.cgi?id=147269

            Reviewed by Andreas Kling.

            Media elements should pause when the application is going to EnterBackground
            under lock regardless whether it is in full screen or not.

            * platform/audio/PlatformMediaSession.h:
            * platform/audio/PlatformMediaSession.cpp:
            (WebCore::PlatformMediaSession::doInterruption): This code was moved from 
            beginInterruption().

            (WebCore::PlatformMediaSession::shouldDoInterruption): Move the condition 
            which allows the media session interruption to a separate function.

            (WebCore::PlatformMediaSession::beginInterruption): Call the functions
            shouldDoInterruption() and doInterruption().

            (WebCore::PlatformMediaSession::forceInterruption): This function will
            be called from PlatformMediaSessionManager::applicationDidEnterBackground()
            to override the decision which is made by PlatformMediaSession::beginInterruption()
            if the application isSuspendedUnderLock.

            * platform/audio/PlatformMediaSessionManager.h:
            * platform/audio/PlatformMediaSessionManager.cpp:
            (WebCore::PlatformMediaSessionManager::applicationDidEnterBackground):
            [UIApp isSuspendedUnderLock] is only valid when it is called when the
            UIApplicationDidEnterBackgroundNotification is received. We need to force
            interrupting the media sessions if the application isSuspendedUnderLock
            and UIApplicationWillResignActiveNotification was ignored because of PiP.

            * platform/audio/ios/MediaSessionManagerIOS.h:
            * platform/audio/ios/MediaSessionManagerIOS.mm:
            (-[WebMediaSessionHelper initWithCallback:]):
            (-[WebMediaSessionHelper applicationDidEnterBackground:]): Listen to 
            UIApplicationDidEnterBackgroundNotification and make a call on the web
            thread to PlatformMediaSessionManager::applicationDidEnterBackground() 
            and pass the isSuspendedUnderLock flag which is queried on the UIProcess.

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187521

    2015-07-28  Tim Horton  <timothy_horton@apple.com>

            [iOS] Creating a TextIndicator causes the view to scroll to the current selection
            https://bugs.webkit.org/show_bug.cgi?id=147379
            <rdar://problem/22038421>

            Reviewed by Beth Dakin.

            * editing/Editor.cpp:
            (WebCore::Editor::setIgnoreCompositionSelectionChange):
            * editing/Editor.h:
            Add a flag so that setIgnoreCompositionSelectionChange(false) can still
            not force-reveal the current selection.

            This is useful for e.g. TextIndicator, who saves the selection, changes it,
            and then restores it, but doesn't want to scroll to the saved/restored selection.

            * page/TextIndicator.cpp:
            (WebCore::TextIndicator::createWithRange):
            Make use of the above flag.

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187516

    2015-07-28  Eric Carlson  <eric.carlson@apple.com>

            [iOS] Set AirPlay discovery mode to disabled when page is hidden
            https://bugs.webkit.org/show_bug.cgi?id=147369

            Reviewed by Jer Noble.

            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::requiresPlaybackTargetRouteMonitoring): Return false when
              the client is not visible.
            * html/MediaElementSession.h:

            * platform/audio/PlatformMediaSession.cpp:
            (WebCore::PlatformMediaSession::clientDataBufferingTimerFired): Call configureWireLessTargetMonitoring.

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187491

    2015-07-28  Jer Noble  <jer.noble@apple.com>

            [iOS] Notify fullscreen controller in UIProcess whether external playback is allowed
            https://bugs.webkit.org/show_bug.cgi?id=147343

            Reviewed by Brady Eidson.

            Pass the value of the MediaElementSession's wirelessVideoPlaybackDisabled() property up through WebKit2 to
            WebVideoFullscreenControllerAVKit.

            * platform/ios/WebVideoFullscreenControllerAVKit.mm:
            (WebVideoFullscreenControllerContext::setWirelessVideoPlaybackDisabled): Pass to the interface on the main thread.
            * platform/ios/WebVideoFullscreenInterface.h:
            * platform/ios/WebVideoFullscreenInterfaceAVKit.h:
            * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
            (WebVideoFullscreenInterfaceAVKit::setWirelessVideoPlaybackDisabled): Sets .allowsExternalPlayback to !disabled.
            (WebVideoFullscreenInterfaceAVKit::wirelessVideoPlaybackDisabled): Returns the last value set.
            * platform/ios/WebVideoFullscreenModelVideoElement.mm:
            (WebVideoFullscreenModelVideoElement::setWebVideoFullscreenInterface): Update the value of wirelessVideoPlaybackDisabled
                if the element is present.
            (WebVideoFullscreenModelVideoElement::setVideoElement): Ditto if the interface is present.
            (WebVideoFullscreenModelVideoElement::updateForEventName): Update the value either way.

    2015-07-28  Brady Eidson  <beidson@apple.com>

            Handle null CFArrayRef returning from _CFHTTPParsedCookiesWithResponseHeaderFields.
            <rdar://problem/21995928> and https://bugs.webkit.org/show_bug.cgi?id=147365

            Reviewed by Alexey Proskuryakov.

            * platform/network/cf/CookieJarCFNet.cpp:
            (WebCore::filterCookies): ASSERT the input is not null.
            (WebCore::createCookies): Always return a CFArrayRef, even if it's empty.

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187489

    2015-07-28  Chris Dumez  <cdumez@apple.com>

            Allow lax MIME type parsing for same-origin CSS in quirks mode.
            https://bugs.webkit.org/show_bug.cgi?id=147327
            <rdar://problem/22010303>

            Reviewed by Zalan Bujtas.

            The change made in r180020 is too strict for the web, and doesn't match Firefox
            Chrome, or IE's behavior. In particular, it does not respect the same-origin
            carveout that the HTML spec specifies:
            https://html.spec.whatwg.org/multipage/semantics.html#link-type-stylesheet

            This patch corrects that oversight and aligns our behavior with other popular
            browsers.

            This change was adapted from Blink r196678:
            https://src.chromium.org/viewvc/blink?revision=196678&view=revision

            Tests: http/tests/security/cross-origin-css-in-quirks-1.html
                   http/tests/security/cross-origin-css-in-quirks-2.html
                   http/tests/security/cross-origin-css-in-quirks-3.html
                   http/tests/security/cross-origin-css-in-quirks-4.html
                   http/tests/security/cross-origin-css-in-quirks-5.html
                   http/tests/security/cross-origin-css-in-quirks-6.html
                   http/tests/security/cross-origin-css-in-quirks-7.html
                   http/tests/security/cross-origin-css-in-quirks-8.html
                   http/tests/security/same-origin-css-1.html
                   http/tests/security/same-origin-css-2.html
                   http/tests/security/same-origin-css-3.html
                   http/tests/security/same-origin-css-4.html
                   http/tests/security/same-origin-css-5.html
                   http/tests/security/same-origin-css-6.html
                   http/tests/security/same-origin-css-7.html
                   http/tests/security/same-origin-css-8.html
                   http/tests/security/same-origin-css-in-quirks.html

            * css/StyleRuleImport.cpp:
            (WebCore::StyleRuleImport::setCSSStyleSheet):
            * css/StyleSheetContents.cpp:
            (WebCore::StyleSheetContents::parseAuthorStyleSheet):
            * css/StyleSheetContents.h:
            * html/HTMLLinkElement.cpp:
            (WebCore::HTMLLinkElement::setCSSStyleSheet):
            * loader/cache/CachedCSSStyleSheet.cpp:
            (WebCore::CachedCSSStyleSheet::sheetText):
            (WebCore::CachedCSSStyleSheet::canUseSheet):
            (WebCore::CachedCSSStyleSheet::checkNotify): Deleted.
            * loader/cache/CachedCSSStyleSheet.h:

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187466

    2015-07-27  Brady Eidson  <beidson@apple.com>

            Crash in WebCore::DocumentLoader::willSendRequest() with ContentFilter and AppCache.
            <rdar://problem/21960398> and https://bugs.webkit.org/show_bug.cgi?id=147339

            Reviewed by Alexey Proskuryakov.

            No new tests (Not yet proven to be possible to test this).

            * loader/DocumentLoader.cpp:
            (WebCore::DocumentLoader::willSendRequest): Grab the identifier from the CachedResource directly, not from the null ResourceLoader.
            (WebCore::DocumentLoader::continueAfterNavigationPolicy): Null check the ResourceLoader, as it can definitely be gone by this point.

            * loader/cache/CachedResource.cpp:
            (WebCore::CachedResource::clearLoader): Save off the identifier for later use.
            * loader/cache/CachedResource.h:
            (WebCore::CachedResource::identifierForLoadWithoutResourceLoader): Expose the identifier that the ResourceLoader had when it went away.

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187448

    2015-07-27  Anders Carlsson  <andersca@apple.com>

            WKWebsiteDataStore remove methods don't properly delete cookies
            https://bugs.webkit.org/show_bug.cgi?id=147333
            rdar://problem/21948230

            Reviewed by Tim Horton.

            If there are multiple cookies for a single domain, make sure to delete all of them
            and not just the first one we find.

            Fix this by keeping a mapping from domain to a list of cookies.

            * platform/network/mac/CookieJarMac.mm:
            (WebCore::deleteCookiesForHostnames):

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187379

    2015-07-24  Dan Bernstein  <mitz@apple.com>

            Tried to fix the iOS 9 build after r187375.

            * platform/network/mac/CookieJarMac.mm:

2015-07-31  Lucas Forschler  <lforschler@apple.com>

        Merge r187375

    2015-07-24  Anders Carlsson  <andersca@apple.com>

            WKWebsiteDataStore remove methods don't properly delete cookies
            https://bugs.webkit.org/show_bug.cgi?id=147282
            rdar://problem/21948230

            Reviewed by Sam Weinig.

            Rename deleteCookiesForHostname to deleteCookiesForHostnames and
            make it take a vector of hostnames instead.

            Also, fix the Mac implementation to not be O(n2) by putting all cookies
            in a dictionary keyed on the domain.

            Also make sure to call _saveStorage after deleting cookies.

            Finally, get rid of deleteCookiesForHostname from CookieJarCFNet.cpp and
            use the Mac implementation on iOS as well. Just stub out deleteCookiesForHostnames
            on Windows since nobody is calling it.

            * platform/network/PlatformCookieJar.h:
            * platform/network/cf/CookieJarCFNet.cpp:
            (WebCore::deleteCookiesForHostnames):
            (WebCore::deleteCookiesForHostname): Deleted.
            * platform/network/mac/CookieJarMac.mm:
            (WebCore::deleteCookiesForHostnames):
            (WebCore::deleteAllCookiesModifiedSince):
            (WebCore::deleteCookiesForHostname): Deleted.
            * platform/network/soup/CookieJarSoup.cpp:
            (WebCore::deleteCookiesForHostnames):
            (WebCore::deleteCookiesForHostname): Deleted.
            * platform/spi/cf/CFNetworkSPI.h:

2015-07-30  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187490. rdar://problem/21995928

    2015-07-28  Brady Eidson  <beidson@apple.com>

            Handle null CFArrayRef returning from _CFHTTPParsedCookiesWithResponseHeaderFields.
            <rdar://problem/21995928> and https://bugs.webkit.org/show_bug.cgi?id=147365

            Reviewed by Alexey Proskuryakov.

            * platform/network/cf/CookieJarCFNet.cpp:
            (WebCore::filterCookies): ASSERT the input is not null.
            (WebCore::createCookies): Always return a CFArrayRef, even if it's empty.

2015-07-30  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187278. rdar://problem/19908029

    2015-07-23  Nan Wang  <n_wang@apple.com>

            AX: AccessibilityNodeObject::childrenChanged() generates too many AXLiveRegionChanged notifications
            https://bugs.webkit.org/show_bug.cgi?id=147211
            <rdar://problem/19908029>

            Reviewed by Chris Fleizach.

            AccessibilityNodeObject::childrenChanged() can be called repeatedly, generating a live region
            change notification each time. Sometimes, so many happen that VoiceOver hangs. We can use a timer
            to make sure that we coalesce these notifications.

            Test: platform/mac/accessibility/aria-multiple-liveregions-notification.html

            * accessibility/AXObjectCache.cpp:
            (WebCore::AXComputedObjectAttributeCache::getIgnored):
            (WebCore::AXObjectCache::AXObjectCache):
            (WebCore::AXObjectCache::~AXObjectCache):
            (WebCore::AXObjectCache::frameLoadingEventNotification):
            (WebCore::AXObjectCache::postLiveRegionChangeNotification):
            (WebCore::AXObjectCache::liveRegionChangedNotificationPostTimerFired):
            (WebCore::AXObjectCache::handleScrollbarUpdate):
            * accessibility/AXObjectCache.h:
            * accessibility/AccessibilityNodeObject.cpp:
            (WebCore::AccessibilityNodeObject::childrenChanged):

2015-07-30  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187504. rdar://problem/21915355

    2015-07-28  Said Abou-Hallawa  <sabouhallawa@apple.com>

            Crash happens when calling removeEventListener for an SVG element which has an instance inside a <defs> element of shadow tree
            https://bugs.webkit.org/show_bug.cgi?id=147290

            Reviewed by Daniel Bates.

            When the shadow tree is built for a <use> element, all the SVG elements
            are allowed to be cloned in the shadow tree but later some of the elements
            are disallowed and removed. Make sure, when disallowing an element in the
            shadow tree, to reset the correspondingElement relationship between all
            the disallowed descendant SVG elements and all their original elements.

            Test: svg/custom/remove-event-listener-shadow-disallowed-element.svg

            *svg/SVGElement.cpp:
            (WebCore::SVGElement::setCorrespondingElement)
            * svg/SVGUseElement.cpp:
            (WebCore::removeDisallowedElementsFromSubtree):

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187352.

    2015-07-24  Devin Rousso  <drousso@apple.com>

            Web Inspector: Editing non-inspector-stylesheet rule selectors fails after the first change
            https://bugs.webkit.org/show_bug.cgi?id=147229

            Reviewed by Timothy Hatcher.

            Test: inspector/css/modify-rule-selector.html

            * inspector/InspectorStyleSheet.cpp:
            (WebCore::InspectorStyleSheet::setRuleSelector):
            Now checks to see if the stylesheet is not mutated before making the change to the
            rule's selector, and if so mark it as not mutated to allow future edits.

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187393.

    2015-07-25  Tim Horton  <timothy_horton@apple.com>

            Expose TextIndicator-backed snapshot and rect gathering on DOMNode
            https://bugs.webkit.org/show_bug.cgi?id=147298
            <rdar://problem/21905839>

            Reviewed by Sam Weinig.

            * bindings/objc/DOM.mm:
            (-[DOMNode getPreviewSnapshotImage:andRects:]):
            No need to multiply by device scale here.

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187392.

    2015-07-25  Tim Horton  <timothy_horton@apple.com>

            Expose TextIndicator-backed snapshot and rect gathering on DOMNode
            https://bugs.webkit.org/show_bug.cgi?id=147298
            <rdar://problem/21905839>

            * bindings/objc/DOM.mm:
            (-[DOMNode getPreviewSnapshotImage:andRects:]):
            * bindings/objc/DOMExtensions.h:
            * bindings/objc/DOMPrivate.h:
            Move this to a private header.

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187391.

    2015-07-25  Tim Horton  <timothy_horton@apple.com>

            Expose TextIndicator-backed snapshot and rect gathering on DOMNode
            https://bugs.webkit.org/show_bug.cgi?id=147298
            <rdar://problem/21905839>

            Reviewed by Sam Weinig.

            * bindings/objc/DOM.mm:
            (-[DOMNode getPreviewSnapshotImage:andRects:]):
            * bindings/objc/DOMExtensions.h:

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187386.

    2015-07-25  Chris Fleizach  <cfleizach@apple.com>

            AX: iOS: Video "start playback" playback controls not accessible
            https://bugs.webkit.org/show_bug.cgi?id=147285

            Reviewed by Jer Noble.

            The start playback control also needs the right label.

            * Modules/mediacontrols/mediaControlsiOS.js:
            (ControllerIOS.prototype.createBase):

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187371.

    2015-07-24  Chris Fleizach  <cfleizach@apple.com>

            AX: scrollable elements do not allow 3-finger swipe
            https://bugs.webkit.org/show_bug.cgi?id=141893

            Reviewed by Mario Sanchez Prada.

            To allow iOS Accessibility to perform by-page scrolling in overflow areas, we move
            that scrolling code into AccessibilityObject and then iterate all the possible ScrollableAreas,
            rather than just finding the parents that are ScrollViews. 

            Test: platform/ios-simulator/accessibility/scroll-in-overflow-div.html

            * accessibility/AccessibilityObject.cpp:
            (WebCore::AccessibilityObject::scrollAreaAndAncestor):
            (WebCore::AccessibilityObject::scrollPosition):
            (WebCore::AccessibilityObject::scrollVisibleContentRect):
            (WebCore::AccessibilityObject::scrollContentsSize):
            (WebCore::AccessibilityObject::scrollByPage):
            * accessibility/ios/WebAccessibilityObjectWrapperIOS.mm:
            (-[WebAccessibilityObjectWrapper accessibilityScroll:]):
            (-[WebAccessibilityObjectWrapper convertPointToScreenSpace:]):
            (-[WebAccessibilityObjectWrapper _accessibilityScrollPosition]):
            (-[WebAccessibilityObjectWrapper _accessibilityScrollSize]):
            (-[WebAccessibilityObjectWrapper _accessibilityScrollVisibleRect]):
            (-[WebAccessibilityObjectWrapper accessibilityElementDidBecomeFocused]):

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187367.

    2015-07-24  Alexey Proskuryakov  <ap@apple.com>

            [Cocoa] Clean up server trust handling in ResourceHandle.
            https://bugs.webkit.org/show_bug.cgi?id=147277
            rdar://problem/21394410

            Reviewed by Brady Eidson.

            * platform/network/ProtectionSpaceBase.h: (WebCore::ProtectionSpaceBase::isPasswordBased):
            * platform/network/ProtectionSpaceBase.cpp: (WebCore::ProtectionSpaceBase::isPasswordBased):
            Added. This is somewhat weak, as authentication schemes could change, but I couldn't find
            any better way.

            * platform/network/ResourceHandle.h:
            * platform/network/cf/ResourceHandleCFNet.cpp:
            (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
            (WebCore::ResourceHandle::tryHandlePasswordBasedAuthentication):
            * platform/network/mac/ResourceHandleMac.mm:
            (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
            (WebCore::ResourceHandle::tryHandlePasswordBasedAuthentication):
            Factored out password handling, and made sure to not try that for server trust.

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187366.

    2015-07-24  Zalan Bujtas  <zalan@apple.com>

            [iOS]: Inline video controls are blurry on scaled-down pages on non-retina devices.
            https://bugs.webkit.org/show_bug.cgi?id=147272
            rdar://problem/21429111

            Reviewed by Simon Fraser.

            Blurry inline video controls are the result of transform scaling up the content when the page
            is zoomed out (page scale > 1).
            This patch addresses the blurriness by switching to css zoom when the content is being scaled up.
            While transform scale is a paint time operation, css zoom triggers layout and the content is getting
            painted on a non-scaled graphics context.

            * Modules/mediacontrols/mediaControlsiOS.css:
            (audio::-webkit-media-controls-timeline-container):
            * Modules/mediacontrols/mediaControlsiOS.js:
            (ControllerIOS.prototype.set pageScaleFactor):

2015-07-27  Babak Shafiei  <bshafiei@apple.com>

        Merge r187358.

    2015-07-24  Alexey Proskuryakov  <ap@apple.com>

            Remove WEBCORE_EXPORT from Page::allowsMediaDocumentInlinePlayback()
            https://bugs.webkit.org/show_bug.cgi?id=147260

            Reviewed by Daniel Bates.

            * page/Page.h:
            (WebCore::Page::allowsMediaDocumentInlinePlayback):

2015-07-26  Babak Shafiei  <bshafiei@apple.com>

        Merge r187244.

    2015-07-23  Myles C. Maxfield  <mmaxfield@apple.com>

            REGRESSION(r182236): Justified Arabic text does not expand
            https://bugs.webkit.org/show_bug.cgi?id=147217

            Reviewed by Simon Fraser.

            When I was writing r182236, I got confused between the levels of the string hierarchy in ComplexTextController.
            I've added a comment in the header which should make it easier to get it right.

            Test: fast/text/international/arabic-justify.html

            * platform/graphics/mac/ComplexTextController.cpp:
            (WebCore::ComplexTextController::adjustGlyphsAndAdvances):
            * platform/graphics/mac/ComplexTextController.h:

2015-07-24  Jer Noble  <jer.noble@apple.com>

        Merge r187251, r187252, r187262, r187263, r187272, r187289. rdar://problem/20689512

    2015-07-21  Jer Noble  <jer.noble@apple.com>

            Notify the UI delegate when a MediaDocument's natural size changes
            https://bugs.webkit.org/show_bug.cgi?id=147182

            Reviewed by Simon Fraser.

            Notify the MediaDocument that it's underlying media element has changed its natural size, either when
            the media engine notifies us that the size changed, or when the ready state progresses to HAVE_METADATA.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::setReadyState): Notify the media document.
            (WebCore::HTMLMediaElement::mediaPlayerSizeChanged): Ditto.
            * html/MediaDocument.cpp:
            (WebCore::MediaDocument::mediaElementNaturalSizeChanged): Pass to the chrome client.
            * html/MediaDocument.h:
            * page/ChromeClient.h:

    2015-07-23  Jer Noble  <jer.noble@apple.com>

            Relax media playback restrictions if the allowsMediaDocumentInlinePlayback property is set.
            https://bugs.webkit.org/show_bug.cgi?id=147234

            Reviewed by Darin Adler.

            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::prepareForLoad): Moved restriction check into MediaElementSession.
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::playbackPermitted): Check if is a top-level media document and if
                allowsMediaDocumentInilnePlayback is set, and return early.
            (WebCore::MediaElementSession::effectivePreloadForElement): Ditto.
            (WebCore::MediaElementSession::allowsAutomaticMediaDataLoading): Ditto.
            * html/MediaElementSession.h:

    2015-07-21  Jer Noble  <jer.noble@apple.com>

            [iOS] Add an explicit API to allow media documents to (temporarily) play inline
            https://bugs.webkit.org/show_bug.cgi?id=147181

            Reviewed by Beth Dakin.

            Add listeners for the new allowsMediaDocumentInlinePlayback API. When this value becomes
            NO, force any playing MediaDocuments to enter fullscreen mode.

            * dom/Document.cpp:
            (WebCore::Document::registerForAllowsMediaDocumentInlinePlaybackChangedCallbacks): Added registration method.
            (WebCore::Document::unregisterForAllowsMediaDocumentInlinePlaybackChangedCallbacks): Added deregistration method.
            (WebCore::Document::allowsMediaDocumentInlinePlaybackChanged): Notify all listeners.
            * dom/Document.h:
            * html/HTMLMediaElement.cpp:
            (WebCore::HTMLMediaElement::registerWithDocument): Listen for allowsMediaDocumentInlinePlayback changes.
            (WebCore::HTMLMediaElement::unregisterWithDocument): Stop listening to same.
            (WebCore::HTMLMediaElement::allowsMediaDocumentInlinePlaybackChanged): Enter fullscreen mode if the value
                changes to false during playback.
            * html/HTMLMediaElement.h:
            * html/MediaElementSession.cpp:
            (WebCore::MediaElementSession::requiresFullscreenForVideoPlayback): Early true if the override value is set.
            * page/Page.cpp:
            (WebCore::Page::setAllowsMediaDocumentInlinePlayback): Notify all documents of the changed value.
            * page/Page.h:
            (WebCore::Page::allowsMediaDocumentInlinePlayback): Simple getter.

2015-07-24  Lucas Forschler  <lforschler@apple.com>

        Merge r187149

    2015-07-21  Benjamin Poulain  <bpoulain@apple.com>

            [CSS Selectors Level 4] Add #ifdefs to the new '>>' descendant combinator
            https://bugs.webkit.org/show_bug.cgi?id=147184

            Reviewed by Anders Carlsson.

            Now that '>>>' is dead, the combinator '>>' is at risk.

            This patch #ifdef all that code with the other experimental
            features from Level 4.

            * css/CSSGrammar.y.in:
            * css/CSSParserValues.cpp:
            (WebCore::CSSParserSelector::appendTagHistory):
            * css/CSSParserValues.h:
            * css/CSSSelector.cpp:
            (WebCore::CSSSelector::CSSSelector):
            (WebCore::CSSSelector::selectorText):
            * css/CSSSelector.h:
            (WebCore::CSSSelector::CSSSelector):

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187036. rdar://problem/21901881

    2015-07-20  Jeremy Jones  <jeremyj@apple.com>

            Allow video to rotate when app doesnt allow rotation.
            https://bugs.webkit.org/show_bug.cgi?id=147121

            Reviewed by Jer Noble.

            Set an SPI bool on the fullscreen video root view controller to allow it to override app rotation restrictions.
            This allows video to be played in landscape in portrait only apps.

            * platform/ios/WebVideoFullscreenInterfaceAVKit.mm:
            (WebVideoFullscreenInterfaceAVKit::setupFullscreen):

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187274. rdar://problem/21905756

    2015-07-23  Timothy Horton  <timothy_horton@apple.com>

            [iOS] Frame snapshots don't factor in page scale
            https://bugs.webkit.org/show_bug.cgi?id=147239
            <rdar://problem/21905756>

            Reviewed by Simon Fraser.

            * page/FrameSnapshotting.cpp:
            (WebCore::snapshotFrameRect):
            Apply page scale when determining the backing store size and setting up the context.

            * page/TextIndicator.cpp:
            (WebCore::TextIndicator::createWithSelectionInFrame):
            Don't assume snapshotFrameRect gave us an image with scale=deviceScale, because it
            will factor in the pageScale too.

            * platform/graphics/ImageBuffer.h:
            (WebCore::ImageBuffer::resolutionScale):
            Expose resolutionScale.

            * rendering/RenderLayerCompositor.cpp:
            (WebCore::RenderLayerCompositor::addToOverlapMap):
            This has been true for a long time.

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187271. rdar://problem/21929247

    2015-07-22  Simon Fraser  <simon.fraser@apple.com>

            Layer z-ordering is incorrect when scrolling on page witih position:fixed
            https://bugs.webkit.org/show_bug.cgi?id=147220
            rdar://problem/15849697&21929247

            Reviewed by Dean Jackson.

            Overlap testing for compositing uses the currently laid out position of fixed
            elements, without taking into account the fact that async scrolling can move
            them around, and possibly under other non-composited elements. This manifested
            as position:fixed elements moving over other elements on some pages when
            scrolling, when they should have moved behind.

            Fix by expanding the overlap map entry for position:fixed elements to create
            an rect for the area they cover at all scroll locations, taking min and max
            scroll offsets into account.

            Also add a couple more LOG(Compositing) statements.

            Tests: compositing/layer-creation/fixed-overlap-extent-rtl.html
                   compositing/layer-creation/fixed-overlap-extent.html

            * rendering/RenderLayerCompositor.cpp:
            (WebCore::fixedPositionOffset):
            (WebCore::RenderLayerCompositor::computeExtent):
            (WebCore::RenderLayerCompositor::needsFixedRootBackgroundLayer):
            (WebCore::RenderLayerCompositor::rootBackgroundTransparencyChanged):

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187219. rdar://problem/21032083

    2015-07-23  Timothy Horton  <timothy_horton@apple.com>

            Try to fix the build

            * platform/spi/cocoa/QuartzCoreSPI.h:

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187216. rdar://problem/21032083

    2015-07-22  Tim Horton  <timothy_horton@apple.com>

            Try to fix the build

            * platform/spi/cocoa/QuartzCoreSPI.h:

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187215. rdar://problem/21032083

    2015-07-22  James Savage  <james.savage@apple.com>

            Use updated CoreAnimation snapshot SPI.
            https://bugs.webkit.org/show_bug.cgi?id=147197
            <rdar://problem/21032083>

            Reviewed by Tim Horton.
            Patch by James Savage.

            * platform/spi/cocoa/QuartzCoreSPI.h:

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187203. rdar://problem/21012688

    2015-07-22  Dean Jackson  <dino@apple.com>

            Video controls, though hidden, are still interactive when in PiP
            https://bugs.webkit.org/show_bug.cgi?id=147216
            <rdar://problem/21012688>

            Reviewed by Simon Fraser.

            Explicitly add the PiP class to the controls container so that
            we can hang a pointer-events: none off it.

            * Modules/mediacontrols/mediaControlsiOS.css:
            (video::-webkit-media-controls-panel.picture-in-picture): Add a pointer-events: none.
            * Modules/mediacontrols/mediaControlsiOS.js:
            (ControllerIOS.prototype.handlePresentationModeChange): Add/remove a PiP class
            to the controls panel when necessary.

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187189. rdar://problem/21567767

    2015-07-22  Dean Jackson  <dino@apple.com>

            Out of bounds in WebGLRenderingContext::simulateVertexAttrib0
            https://bugs.webkit.org/show_bug.cgi?id=147176
            <rdar://problem/21567767>

            Reviewed by Oliver Hunt.

            Test: fast/canvas/webgl/out-of-bounds-simulated-vertexAttrib0-drawArrays.html

            Add overflow checking for the drawing calls, specifically the way
            they may simulate vertexAttrib0.

            * html/canvas/WebGLRenderingContextBase.cpp:
            (WebCore::WebGLRenderingContextBase::validateDrawArrays): Call new validation method.
            (WebCore::WebGLRenderingContextBase::validateDrawElements): Ditto.
            (WebCore::WebGLRenderingContextBase::validateSimulatedVertexAttrib0): New method that
            validates the parameters used to create the simulated attribute.
            (WebCore::WebGLRenderingContextBase::simulateVertexAttrib0): No need to do overflow
            checking here now that the validation method does it for us.
            (WebCore::WebGLRenderingContextBase::validateVertexAttributes): Deleted.
            * html/canvas/WebGLRenderingContextBase.h: Add new validation method.

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187173. rdar://problem/21637698

    2015-07-22  Beth Dakin  <bdakin@apple.com>

            Animated images should animate in previews
            https://bugs.webkit.org/show_bug.cgi?id=147173
            -and corresponding-
            rdar://problem/21637698

            Reviewed by Dan Bernstein.

            New virtual function to indicate whether or not the image is animated.
            * platform/graphics/BitmapImage.h:
            * platform/graphics/Image.h:
            (WebCore::Image::isAnimated):

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187170. rdar://problem/21901076

    2015-07-22  Wenson Hsieh  <wenson_hsieh@apple.com>

            Search fields render placeholder text improperly.
            https://bugs.webkit.org/show_bug.cgi?id=147192
            <rdar://problem/21901076>

            Reviewed by Alexey Proskuryakov.

            Due to changes in the way AppKit renders search inputs, we must now explicitly
            set the placeholder text of a search input rendered using the Mac theme to be
            an empty string when rendering the search input box (not including the actual
            placeholder text).

            * rendering/RenderThemeMac.mm:
            (WebCore::RenderThemeMac::setSearchCellState): Force the placeholder text of
                the NSSearchFieldCell for the Mac theme to be an empty string.

2015-07-24  Matthew Hanson  <matthew_hanson@apple.com>

        Merge r187144. rdar://problem/21931728

    2015-07-21  Dean Jackson  <dino@apple.com>

            Default media controls use a serif font, which seems wrong
            https://bugs.webkit.org/show_bug.cgi?id=147179
            <rdar://problem/21931728>

            Reviewed by Simon Fraser.

            The captions menu (and other text) should use a system style,
            -webkit-small-control.

            * Modules/mediacontrols/mediaControlsApple.css:
            (::-webkit-media-controls):

2015-07-24  Lucas Forschler  <lforschler@apple.com>

        Merge r187133

    2015-07-21  Benjamin Poulain  <bpoulain@apple.com>

            StyleSheetContents::wrapperInsertRule() can create rules that overflow RuleData's selector index
            https://bugs.webkit.org/show_bug.cgi?id=147144

            Reviewed by Alex Christensen.

            RuleData identifies selectors by the index in a large array. The index only has 13 bits
            so rules with more than 8192 selectors should be split.

            One of the paths was not splitting the rule: StyleSheetContents::wrapperInsertRule().
            When rules with too many selectors were added, the index would overflow and
            some RuleData would point to selectors in the middle of selector chains. The resulting
            behavior is random based on the selectors and the DOM.

            We cannot easily fix that because the CSS OM API do not expect to create
            several rules in response to calls to the API.
            In this patch, I don't do anything fancy and just let the calls fail
            if we cannot use the rules safely.


            Content Extensions were also running into this problem. Large Selector lists are
            pretty common, and ContentExtensionStyleSheet::addDisplayNoneSelector() was
            overflowing the RuleData, creating broken page.

            Unlike CSSOM, there is no problem with splitting rules coming from Content Extensions.
            Instead of creating new APIs for that case, I rely on the parser to extend the StyleSheetContents.
            That code already knows how to break rules correctly.

            Tests: fast/css/insert-rule-overflow-rule-data.html
                   http/tests/contentextensions/css-display-none-overflows-rule-data-1.html
                   http/tests/contentextensions/css-display-none-overflows-rule-data-2.html

            * contentextensions/ContentExtensionStyleSheet.cpp:
            (WebCore::ContentExtensions::ContentExtensionStyleSheet::addDisplayNoneSelector):
            * css/StyleSheetContents.cpp:
            (WebCore::StyleSheetContents::wrapperInsertRule):

2015-07-23  Lucas Forschler  <lforschler@apple.com>

        Merge r187130

    2015-07-21  Jon Honeycutt  <jhoneycutt@apple.com>

            [iOS] Keyboard bold/italic/underline keys don't highlight after being
            tapped to style a selection
            https://bugs.webkit.org/show_bug.cgi?id=147164
            <rdar://problem/21630806>

            Reviewed by Ryosuke Niwa.

            * editing/cocoa/EditorCocoa.mm:
            (WebCore::Editor::styleForSelectionStart):
            Use adjustedSelectionStartForStyleComputation(), which will ensure that
            we're at the start of the selected node, not at the end of the node
            before the selection.

2015-07-23  Lucas Forschler  <lforschler@apple.com>

        Merge r187116

    2015-07-21  Said Abou-Hallawa  <sabouhallawa@apple.com>

            REGRESSION (r172417, r184065): Multiple rendering issues with fixed attached background-image
            https://bugs.webkit.org/show_bug.cgi?id=147049
            <rdar://problem/21110936>

            Reviewed by Simon Fraser.

            The fixed-attached background-image rendering is special. In general, to
            display it, the destinationSize should be set to visibleContentSize. The
            destinationLocation should be set such that the background-image does
            not move with scrolling. The topContentInset should be subtracted from
            the destinationLocation such that background-image can be rendered blurred
            in the topContentArea. However there are cases in which these rules have to
            be changed.

            -- destinationSize: In the case of fixed layout size, the fixedLayoutSize
            is bigger than the visibleContentSize. In this case, if the background-image
            belongs to the root element, the destinationSize has to be set to fixedLayoutSize.
            Otherwise it has to be set to the borderBoxSize unless the overflow is
            hidden.

            -- destinationLocation: If the background-image belongs to the root element, no
            scroll offset to added to destinationLocation. For non-root element case,
            FrameView::documentScrollOffsetRelativeToViewOrigin() should be used if no page
            scaling is applied. Otherwise FrameView::scrollOffsetForFixedPosition() should be
            used instead.

            Tests: platform/mac-wk2/tiled-drawing/fixed-layout-size-fixed-attachment-cover.html
                   platform/mac-wk2/tiled-drawing/fixed-layout-size-fixed-attachment-local.html

            * rendering/RenderBoxModelObject.cpp:
            (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Ensure
            the geometry for the fixed-attached background-image is calculated correctly.

            * rendering/RenderLayerBacking.cpp:
            (WebCore::RenderLayerBacking::updateGeometry): Ensure the background layer
            gets the correct size for the fixedLayoutSize mode.

2015-07-23  Lucas Forschler  <lforschler@apple.com>

        Merge r186981

    2015-07-17  Zalan Bujtas  <zalan@apple.com>

            (display: block)input range's thumb disappears when moved.
            https://bugs.webkit.org/show_bug.cgi?id=146896
            <rdar://problem/21787807>

            Reviewed by Simon Fraser.

            Since the thumb is positioned after the layout for the input (shadow) subtree is finished, the repaint rects
            issued during the layout will not cover the re-positioned thumb.
            We need to issue a repaint soon after the thumb is re-positioned.

            Test: fast/repaint/block-inputrange-repaint.html

            * html/shadow/SliderThumbElement.cpp:
            (WebCore::RenderSliderContainer::layout):

== Rolled over to ChangeLog-2015-07-23 ==
